Skip to main content

​
Decision

A ContentBlacklist contract supports global (network-wide) and regional (jurisdiction-scoped) takedown. Standard governance entries have a 24-hour compliance window; the emergency multisig path takes effect immediately with a 2-hour slash window. The emergency takedown power is a permanent capability — unlike the multisig’s protocol-wide pause(), which sunsets at 12 months, emergency blacklisting does not sunset, since unlawful-content removal is an ongoing legal-compliance duty. (Individual emergency entries still auto-expire unless ratified — see Entry types below.)

​
Why on-chain

The blacklist must be:
  • Non-repudiable. A compromised node operator cannot claim “I didn’t know” if the entry is publicly readable.
  • Atomic per-node. Every node polls the same source of truth. No partial propagation.
  • Auditable. Anyone can see what has been blacklisted and when.
Gossip-only blacklists fail all three. On-chain entries with governance gating meet them.

​
Entry types

Emergency entries auto-expire unless ratified by governance before the deadline — preventing the multisig from maintaining a permanent de-facto blacklist without oversight.

​
Why the 2-hour slash grace

The emergency path takes effect immediately in terms of “don’t serve this”, but the first 2 hours cannot result in a slash. This absorbs gossip propagation lag and clock skew — a node that genuinely hasn’t seen the entry yet is given a realistic reaction window before liability attaches.

​
Regional scoping

A regional entry applies only to nodes that advertise a matching region. The right to add regional entries is granted to regional governance bodies on a per-region basis. A node serving a globally-blacklisted hash is always slashable. A node in region: DE serving a DE-regional entry is slashable; that same node serving the entry via a US client is a gray area — current guidance is that operators adopt the strictest jurisdiction their node’s region subjects them to.

​
Origin blacklisting

Re-uploading blacklisted content under a fresh hash (trivial re-encoding) is defeated by origin blacklisting — the blacklist contract can blacklist an operator address. Re-uploading requires fresh stake under a new identity. This raises the cost of hash evasion from “re-encode” to “spin up a new operator, restake, re-register”.

​
Local denylist

Each node maintains a local denylist for direct legal notices (e.g., a DMCA takedown served to one operator). Local denylists don’t propagate and don’t trigger slashes elsewhere — they’re a per-operator compliance tool.

​
Slash schedule

Blacklist violations use an escalating schedule: 5% / 15% / 50% for first / second / third offense (capped at 50% per offense). Offenses accumulate over the operator’s lifetime; a node whose bond falls below 50% of the minimum is auto-ejected.