feat: max authority count contraction

state-chain/pallets/cf-validator/src/lib.rs

@@ -16,7 +16,9 @@ mod benchmarking;
 mod rotation_state;
 
 pub use auction_resolver::*;
-use cf_primitives::{AuthorityCount, EpochIndex, SemVer, FLIPPERINOS_PER_FLIP};
+use cf_primitives::{
+	AuthorityCount, EpochIndex, SemVer, FLIPPERINOS_PER_FLIP, MAX_AUTHORITY_SET_CONTRACTION_PERCENT,
+};
 use cf_traits::{
 	impl_pallet_safe_mode, offence_reporting::OffenceReporter, AsyncResult, AuthoritiesCfeVersions,
 	Bid, BidderProvider, Bonding, Chainflip, EpochInfo, EpochTransitionHandler, ExecutionCondition,
@@ -1064,6 +1066,12 @@ impl<T: Config> Pallet<T> {
 	fn try_start_keygen(rotation_state: RuntimeRotationState<T>) {
 		let candidates = rotation_state.authority_candidates();
 		let SetSizeParameters { min_size, .. } = AuctionParameters::<T>::get();
+
+		let min_size = sp_std::cmp::max(
+			min_size,
+			(Self::current_authority_count() * MAX_AUTHORITY_SET_CONTRACTION_PERCENT) / 100,
+		);
+
 		if (candidates.len() as u32) < min_size {
 			log::warn!(
 				target: "cf-validator",

state-chain/pallets/cf-validator/src/tests.rs

@@ -766,6 +766,28 @@ mod keygen {
 			assert_rotation_aborted();
 		});
 	}
+
+	#[test]
+	fn rotation_aborts_if_candidates_below_min_percentage() {
+		new_test_ext().execute_with(|| {
+			// Ban half of the candidates:
+			let failing_count = CANDIDATES.count() / 2;
+			let remaining_count = CANDIDATES.count() - failing_count;
+
+			// We still have enough candidates according to auction resolver parameters:
+			assert!(remaining_count > MIN_AUTHORITY_SIZE as usize);
+
+			// But the rotation should be aborted since authority count would drop too much
+			// compared to the previous set:
+			assert!(
+				remaining_count <
+					AUTHORITIES.count() * MAX_AUTHORITY_SET_CONTRACTION_PERCENT as usize / 100
+			);
+
+			failed_keygen_with_offenders(CANDIDATES.take(failing_count));
+			assert_rotation_aborted();
+		});
+	}
 }
 
 #[cfg(test)]

state-chain/primitives/src/lib.rs

@@ -74,6 +74,10 @@ pub const SECONDS_PER_BLOCK: u64 = MILLISECONDS_PER_BLOCK / 1000;
 
 pub const STABLE_ASSET: Asset = Asset::Usdc;
 
+/// Rotations cannot result in an authority set smaller than
+/// this percentage of the previous authority set size:
+pub const MAX_AUTHORITY_SET_CONTRACTION_PERCENT: u32 = 70;
+
 // Polkadot extrinsics are uniquely identified by <block number>-<extrinsic index>
 // https://wiki.polkadot.network/docs/build-protocol-info
 #[derive(Clone, Encode, Decode, MaxEncodedLen, TypeInfo, Debug, PartialEq, Eq)]