> ## Documentation Index
> Fetch the complete documentation index at: https://docs.decdn.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Content takedown

> An on-chain hash blacklist with global and regional entries, a 24-hour compliance window for governance takedowns, and an immediate emergency path.

## Decision

A **`ContentBlacklist`** contract supports **global** (network-wide) and **regional** (jurisdiction-scoped) takedown. Standard governance entries have a **24-hour compliance window**; the emergency multisig path takes effect **immediately** with a **2-hour slash window**.

The emergency takedown power is a **permanent** capability — unlike the multisig's protocol-wide `pause()`, which [sunsets at 12 months](/protocol/governance#emergency-multisig), emergency blacklisting does not sunset, since unlawful-content removal is an ongoing legal-compliance duty. (Individual emergency *entries* still auto-expire unless ratified — see [Entry types](#entry-types) below.)

## Why on-chain

The blacklist must be:

* **Non-repudiable.** A compromised node operator cannot claim "I didn't know" if the entry is publicly readable.
* **Atomic per-node.** Every node polls the same source of truth. No partial propagation.
* **Auditable.** Anyone can see what has been blacklisted and when.

Gossip-only blacklists fail all three. On-chain entries with governance gating meet them.

## Entry types

| Type                         | Added by                 | Active at                                     | Auto-expiry                  |
| ---------------------------- | ------------------------ | --------------------------------------------- | ---------------------------- |
| Standard governance          | Governor                 | 24 h after vote execution (compliance window) | None (governance can remove) |
| Regional                     | Regional governance body | 24 h                                          | None                         |
| Emergency                    | 3-of-5 multisig          | Immediately (with 2 h slash grace)            | 14 days                      |
| Emergency (CSAM / terrorist) | 3-of-5 multisig          | Immediately                                   | 90 days                      |

Emergency entries **auto-expire unless ratified by governance** before the deadline — preventing the multisig from maintaining a permanent de-facto blacklist without oversight.

## Why the 2-hour slash grace

The emergency path takes effect immediately in terms of "don't serve this", but the first 2 hours cannot result in a slash. This absorbs gossip propagation lag and clock skew — a node that genuinely hasn't seen the entry yet is given a realistic reaction window before liability attaches.

## Regional scoping

A **regional** entry applies only to nodes that advertise a matching region. The right to add regional entries is granted to regional governance bodies on a per-region basis.

A node serving a globally-blacklisted hash is always slashable. A node in `region: DE` serving a `DE`-regional entry is slashable; that same node serving the entry via a US client is a gray area — current guidance is that operators adopt the strictest jurisdiction their node's region subjects them to.

## Origin blacklisting

Re-uploading blacklisted content under a fresh hash (trivial re-encoding) is defeated by **origin blacklisting** — the blacklist contract can blacklist an **operator address**. Re-uploading requires fresh stake under a new identity. This raises the cost of hash evasion from "re-encode" to "spin up a new operator, restake, re-register".

## Local denylist

Each node maintains a **local denylist** for direct legal notices (e.g., a DMCA takedown served to one operator). Local denylists don't propagate and don't trigger slashes elsewhere — they're a per-operator compliance tool.

## Slash schedule

Blacklist violations use an escalating schedule: **5% / 15% / 50%** for first / second / third offense (capped at 50% per offense). Offenses accumulate over the operator's lifetime; a node whose bond falls below 50% of the minimum is auto-ejected.