Skip to main content

Decision

A ContentBlacklist contract supports global (network-wide) and regional (jurisdiction-scoped) takedown. Standard governance entries have a 24-hour compliance window; the emergency multisig path takes effect immediately with a 2-hour slash window.

Why on-chain

The blacklist must be:
  • Non-repudiable. A compromised node operator cannot claim “I didn’t know” if the entry is publicly readable.
  • Atomic per-node. Every node polls the same source of truth. No partial propagation.
  • Auditable. Anyone can see what has been blacklisted and when.
Gossip-only blacklists fail all three. On-chain entries with governance gating meet them.

Entry types

TypeAdded byActive atAuto-expiry
Standard governanceGovernor24 h after vote execution (compliance window)None (governance can remove)
RegionalRegional governance body24 hNone
Emergency3-of-5 multisigImmediately (with 2 h slash grace)14 days
Emergency (CSAM / terrorist)3-of-5 multisigImmediately90 days
Emergency entries auto-expire unless ratified by governance before the deadline — preventing the multisig from maintaining a permanent de-facto blacklist without oversight.

Why the 2-hour slash grace

The emergency path takes effect immediately in terms of “don’t serve this”, but the first 2 hours cannot result in a slash. This absorbs gossip propagation lag and clock skew — a node that genuinely hasn’t seen the entry yet is given a realistic reaction window before liability attaches.

Regional scoping

A regional entry applies only to nodes that advertise a matching region in their NodeAnnounce. The contract maintains a mapping {region_code → BLACKLIST_ROLE_holder}, and BLACKLIST_ROLE is granted to regional governance bodies on a per-region basis. A node serving a globally-blacklisted hash is always slashable. A node in region: DE serving a DE-regional entry is slashable; that same node serving the entry via a US client is a gray area — current guidance is that operators adopt the strictest jurisdiction their node’s region subjects them to.

Origin blacklisting

Re-uploading blacklisted content under a fresh hash (trivial re-encoding) is defeated by origin blacklisting — the blacklist contract can blacklist an operator address. Re-uploading requires fresh stake under a new identity. This raises the cost of hash evasion from “re-encode” to “spin up a new operator, restake, re-register”.

Local denylist

Each node maintains a local denylist for direct legal notices (e.g., a DMCA takedown served to one operator). Local denylists don’t propagate and don’t trigger slashes elsewhere — they’re a per-operator compliance tool.

Slash schedule

Blacklist violations use an escalating schedule: 10% / 25% / 50% for first / second / third offense within 90 days. Source ADR: 011-content-takedown.md