Mainnet, 2026-07-09, THOR heights `26928532` to `26932198` (~6 h), during inbound USDT flow to the TRON asgard vaults. Code refs are at commit `a22cad0ef` (`develop`). ## Summary **A. Vote-Id fragmentation.** The solvency Id hashes `(chain, height, vault, exact coins)`, but TRON balance queries cannot be pinned to the stamped height: each node reads whatever state its RPC serves at query time. While a vault balance is moving, nodes whose RPC state is a few blocks offset from the majority read a different amount for the same stamped height and split into a minority voter. They get +2 (`LackOfObservationPenalty`) as non-signers of the majority voter, unrefundable: bifrost signs one Id per vault per round, so they can never attest the majority Id. Their minority voter never reaches consensus, so its pre-consensus +1 (`ObserveSlashPoints`) is also never refunded. **B. Slash before stale-discard.** `tron_client.go:694-698` stamps `height - 19` so thornode "will disregard if there is a more recent observation". It does, but only after the slash accounting has run. During active inbound flow `lastChainHeight` is always ahead, so every verifiable consensus in this window was discarded as stale (P3), after +2 was applied to every non-signer. Result: 30 majority consensus events in 6 h; every one of the 95 active validators was absent from at least 5 attestation sets (median 11); up to 2,562 slash points issued for votes the network threw away. ## Affected code | Where | What | |---|---| | `bifrost/pkg/chainclients/tron/tron_client.go:263-267` | `GetAccountByAddress(address string, _ *big.Int)`: height discarded | | `bifrost/pkg/chainclients/tron/api/tron_api.go:129-135` | TRX via `wallet/getaccount` (no height parameter) | | `bifrost/pkg/chainclients/tron/rpc/tron_rpc.go:36-51` | USDT via `eth_call`, no block tag | | `x/thorchain/handler_solvency_helpers.go:74-78` | first consensus: refund signers, +2 non-signers | | `x/thorchain/handler_solvency_helpers.go:117-119` | stale check, runs after the slashing | | `x/thorchain/handler_solvency_helpers.go:51` | pre-consensus +1, refunded only at consensus (`:77`) | Contrast: the EVM client pins queries to the stamped height (`evm/client.go:1544`), so EVM solvency votes do not fragment. ## Mechanism Reporting rounds are synchronized (tip `% 10 == 0`), so all nodes stamp the same `height - 19`. USDT is read via java-tron `eth_call`, which executes on each node's solidified state (measured on one mainnet RPC: `eth_blockNumber` = `getnowblock` height - 19); solidified height advances unevenly and its instantaneous position differs per node. A deposit landing inside that spread splits the network into different coin values, hence different Ids. The bigger cluster wins consensus; the handler slashes the rest (`:74-78`), then discards the result (`:117-119`). The late-attestation refund (`:56-63`) cannot apply to fragmented nodes: they signed a different Id. ## Proofs ### P1. Competing Ids for the same vault and height, one block apart ``` curl -s https://public-thornode.nativeswap.io/cosmos/tx/v1beta1/txs/<txid> \ | jq '.tx.body.messages[0].quoSolvency.solvency, (.tx.body.messages[0].quoSolvency.attestations | length)' ``` | THOR block | txid | vault | TRON height | USDT (1e8) | attesters | |---|---|---|---|---|---| | 26930735 | `5d8cb8de5053eab87f87f3f7706bfb9adce0d4d23b9bcb11615c7bd9b889c049` | `…qkyejdf8` | 84308511 | `9122624142700` | 38 | | 26930736 | `47d46ce0926f51feeee87475edede88fdf8960243505d5bc5d7a57037b24dbe4` | `…qkyejdf8` | 84308511 | `18457840721400` | 7 | Same vault, height, and TRX amount; different USDT amount (91,226 vs 184,578; deposits were landing continuously). The minority value lies between the majority's consecutive consensus readings for this vault (`9122624142700` at 84308511, `22181943721400` at 84309211), consistent with a fresher read of the same growing balance, not a bad one. A 7-of-95 voter never reaches consensus (threshold 2/3): those signers keep both the +1 and the +2. A second minority voter that never reached consensus: `7ea4a359c3dfaba1…` at THOR 26931340 (vault `…ncav37ht`, TRON 84309741, 10 attesters). ### P2. Victim nodes Decode the minority-voter attestation pubkeys (base64 secp256k1; match `/thorchain/nodes` `pub_key_set.secp256k1` after stripping the 5-byte amino prefix). Absences are against the 30 majority sets; each applies +2 at that block, refundable only by attesting the same Id within 10 blocks, which a node that signed a conflicting Id cannot do. Voter `47d46ce0…`: `thor1m2wc44uct7u0avwqrcxjtnlljvsnrzk32qmlrc` (14/30), `thor13vrnh7v2vlma23pv6s34lexqdzpupwamd5y7wc` (11/30), `thor1wd59r6pn0fdaxpu2vcgjypfzr9qh34rhml07ns` (11/30), `thor1fkmdrdtyxcfteewwsuqagekq46ag5s0vulq7qk` (9/30), `thor16hw3da67jrctj6cjn9lrz4vwrwtap73um2m2p7` (7/30), `thor18x0naax76g7ylp7np3wwtthulw55ngtt5w2rcn` (6/30). Voter `7ea4a359…`: `thor19dxkzzp09egc06wv4jcg5q2l6zy2yg3yyxplcw` (17/30), `thor1txggeaqt0jd76wyxg70re4ln6ww3hdujzhdjdl` (15/30), `thor1dqlmsm67h363nuxpd68esg54kt2t7xw2xewqml` (15/30), `thor1agftrgu74z84hef6dt6ykhe7cmjf3f8dcpkfun` (13/30), `thor16xxh3kmd4fsadhf4u92gdte2nnhlw8rhjgw245` (11/30), `thor10pde7fly42dpz5wav23pwz6pz997vsj855qnth` (9/30), `thor1sqf8fjuj050wq3m2p83af8l93g7s6ucn42eqa0` (9/30), `thor1d7rerzkzus2t6v2yv9wuw9xg8a8aqse8p6nvm8` (9/30), `thor10czf2s89h79fsjmqqck85cdqeq536hw5ngz4lt` (9/30). ### P3. Consensus results were discarded as stale, after slashing ``` curl -s "https://public-thornode.nativeswap.io/thorchain/lastblock/tron?height=26930736" # "last_observed_in": 84308523 (> 84308511, so :117 discards) ``` Any validator's logs corroborate: the `:118` stale message fired 65 times in ~3 h, and every consensus event in the log window (20/20) has a discard log in the same THOR block as the slashes, `last chain height` ahead by 3 to 23 blocks. ### P4. Queries cannot be height-pinned on TRON ``` eth_call with a block number: {"code":-32602,"message":"QUANTITY not supported, just support TAG as latest"} eth_call with "finalized": {"code":-32602,"message":"TAG [earliest | pending | finalized] not supported"} ``` `wallet/getaccount` has no height parameter and java-tron keeps no historical state, so the EVM approach is not implementable on TRON. ### P5. Network-wide distribution Absences across all 95 active validators over the 30 majority sets: 5-9 absences: 24 nodes; 10-14: 44; 15-20: 16; all 30: 11. No validator attested all 30. Any period of heavy TRON deposit traffic re-triggers this. ## Expected behavior - Solvency slash accounting should not depend on which side of an unpinnable, oscillating RPC state boundary a node samples. This is not operator-fixable; fresher reads are punished the same as staler ones. - Consensus discarded as stale should not leave non-signer penalties behind, especially when the `height - 19` stamp guarantees nearly every result is discarded during inbound flow.