feat: slash delay and blacklist fix (#1753)

**Motivation:**

Burn and redistribution of slashed shares previously settled instantly
once an AVS triggered a clear. This left no window to react before funds
moved, which is risky for both stakers and AVSs. We want a built-in
safety buffer plus a way to halt these flows in an emergency.

**Modifications:**

- Introduced a 7-day (`50,400` blocks) slash resolution delay before
slashed shares can be burned or redistributed.
- Added a dedicated pause flag (`PAUSED_BURN_OR_REDISTRIBUTABLE_SHARES`)
so burn/redistribution can be paused independently of other flows.
- Grandfathered pre-upgrade slashes: existing pending slashes have a
zero resolution block and remain immediately clearable after the
upgrade.
- Added unit, integration, and upgrade tests covering the new behavior.

**Result:**

- Slashed shares can no longer be burned or redistributed until the
7-day delay has elapsed.
- Pauser can pause burn/redistribution specifically without affecting
unrelated functionality.

---------

Co-authored-by: Nadir Akhtar <9601075+nadir-akhtar@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

.github/workflows/checks.yml

@@ -47,6 +47,7 @@ jobs:
             gethstore.blob.core.windows.net:443
             github.com:443
             production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
             raw.githubusercontent.com:443
             registry-1.docker.io:443
             release-assets.githubusercontent.com:443

docs/core/DelegationManager.md

@@ -140,7 +140,7 @@ struct VaultConfig {
 
 *Requirements*:
 * Pause status MUST NOT be set: `PAUSED_NEW_STRATEGIES`
-* Token MUST NOT be blacklisted
+* Token MUST NOT be EIGEN or bEIGEN
 * `vaultAdmin` MUST NOT be zero address
 * `arbitrator` MUST NOT be zero address
 * `duration` MUST be non-zero and <= `MAX_DURATION` (2 years for now)
@@ -274,7 +274,6 @@ Called by `StrategyManager` on deposit or when re-adding shares when completing
 
 *Requirements* (all must pass):
 * State *MUST* be `DEPOSITS` (vault not locked)
-* Strategy underlying token *MUST NOT* be blacklisted in `StrategyFactory`
 * Staker *MUST* be delegated to the vault
 * Deposit amount (in underlying) *MUST NOT* exceed `maxPerDeposit`
 * Post-deposit total active shares (in underlying) *MUST NOT* exceed `maxTotalDeposits`
@@ -465,7 +464,6 @@ Rewards follow the standard EigenLayer flow:
 | `DurationAlreadyElapsed` | `advanceToWithdrawals()` called at/after `unlockAt` timestamp |
 | `VaultNotLocked` | `advanceToWithdrawals()` called before the vault is locked |
 | `OperatorIntegrationInvalid` | Invalid operator integration config (zero AVS address) |
-| `UnderlyingTokenBlacklisted` | Deposit attempted with blacklisted token |
 | `PendingAllocation` | `lock()` attempted with pending allocation modification |
 | `MaxPerDepositExceedsMax` | `maxPerDeposit > maxTotalDeposits` or deposit exceeds per-deposit cap |
 | `BalanceExceedsMaxTotalDeposits` | Post-deposit balance exceeds TVL cap |

docs/core/DurationVaultStrategy.md

@@ -134,12 +134,12 @@ The `EigenPodManager` tracks a staker's _deposit shares_ and _beacon chain slash
 ```solidity
 /**
  * @notice mapping from pod owner to the deposit shares they have in the virtual beacon chain ETH strategy
- * 
+ *
  * @dev When an EigenPod registers a balance increase, deposit shares are increased. When registering a balance
  * decrease, however, deposit shares are NOT decreased. Instead, the pod owner's beacon chain slashing factor
  * is decreased proportional to the balance decrease. This impacts the number of shares that will be withdrawn
  * when the deposit shares are queued for withdrawal in the DelegationManager.
- * 
+ *
  * Note that prior to the slashing release, deposit shares were decreased when balance decreases occurred.
  * In certain cases, a combination of queueing a withdrawal plus registering a balance decrease could result
  * in a staker having negative deposit shares in this mapping. This negative value would be corrected when the
@@ -320,9 +320,9 @@ function recordBeaconChainETHBalanceUpdate(
     nonReentrant
 ```
 
-This method is called by an `EigenPod` to report a change in its pod owner's shares. It accepts a positive or negative `balanceDeltaWei`. A positive delta is added to the pod owner's _deposit shares,_ and delegated to their operator if applicable. A negative delta is NOT removed from the pod owner's deposit shares. Instead, the proportion of the balance decrease is used to update the pod owner's beacon chain slashing factor and decrease the number of shares delegated to their operator (if applicable). A zero delta results in no change. 
+This method is called by an `EigenPod` to report a change in its pod owner's shares. It accepts a positive or negative `balanceDeltaWei`. A positive delta is added to the pod owner's _deposit shares,_ and delegated to their operator if applicable. A negative delta is NOT removed from the pod owner's deposit shares. Instead, the proportion of the balance decrease is used to update the pod owner's beacon chain slashing factor and decrease the number of shares delegated to their operator (if applicable). A zero delta results in no change.
 
-**Note** that prior to the slashing release, negative balance deltas subtracted from the pod owner's shares, and could, in certain cases, result in a negative share balance. As of the slashing release, negative balance deltas no longer subtract from share balances, updating the beacon chain slashing factor instead. 
+**Note** that prior to the slashing release, negative balance deltas subtracted from the pod owner's shares, and could, in certain cases, result in a negative share balance. As of the slashing release, negative balance deltas no longer subtract from share balances, updating the beacon chain slashing factor instead.
 
 If a staker has negative shares as of the slashing release, this method will REVERT, preventing any further balance updates from their pod while the negative share balance persists. In order to fix this and restore the use of their pod, the staker should complete any outstanding withdrawals in the `DelegationManager` "as shares," which will correct the share deficit.
 
@@ -365,12 +365,12 @@ function increaseBurnOrRedistributableShares(
 
 The `DelegationManager` calls this method when an operator is slashed, calculating the number of slashable shares and marking them for burning here.
 
-Unlike in the `StrategyManager`, there is no current mechanism to burn these shares, as burning requires the Pectra hard fork to be able to eject validators. This will be added in a future update.
+Unlike in the `StrategyManager`, there is no current slash-resolution delay, redistribution, or clearing mechanism for these shares. Burning native ETH requires the Pectra hard fork to be able to eject validators.
 
-We also do not distinguish burnable shares on a per operatorSet/slashId basis, like the `StrategyManager` does. 
+We also do not distinguish burnable ETH shares on a per operatorSet/slashId basis, like the `StrategyManager` does.
 
 *Effects*:
-* Increases `burnableShares` for the beacon chain ETH strategy by `addedSharesToBurn`
+* Increases `burnableETHShares` for the beacon chain ETH strategy by `addedSharesToBurn`
 
 *Requirements*:
-* Can only be called by the `DelegationManager`
+* Can only be called by the `DelegationManager`

docs/core/EigenPodManager.md

@@ -250,11 +250,14 @@ This method directs the `strategy` to convert the input deposit shares to tokens
 
 ## Increasing/Clearing Slashed Shares
 
-Slashes shares are marked as burnable or redistributable. Anybody can call
-`clearBurnOrRedistributableShares` to send tokens to the slash's `redistributionRecipient`. Shares to clear are stored in `_burnOrRedistributableShares`, a nested [EnumerableMap](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/v4.9.0/contracts/utils/structs/EnumerableMap.sol). The operatorSet and slashId are used to index into the enumerableMap of strategies to shares. The following methods handle clearing burn or redistributable shares:
+Slashed shares are marked as burnable or redistributable. Shares to clear are stored in `_burnOrRedistributableShares`, a nested [EnumerableMap](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/v4.9.0/contracts/utils/structs/EnumerableMap.sol). The `operatorSet` and `slashId` are used to index into the enumerableMap of strategies to shares.
+
+For slashes recorded after the slash resolution delay was introduced, clearing is delayed until after `SLASH_RESOLUTION_DELAY_BLOCKS` have elapsed. The resolution block for a slash can be queried with `getSlashResolutionBlock(operatorSet, slashId)`, and clearing reverts with `SlashResolutionDelayNotElapsed` until `block.number` is greater than that value. Slashes recorded before this delay was introduced have a resolution block of `0` and remain immediately clearable as grandfathered state.
+
+Anybody can call `clearBurnOrRedistributableShares` or `clearBurnOrRedistributableSharesByStrategy` after the delay to send tokens to the slash's `redistributionRecipient`. Clearing can be paused with `PAUSED_BURNING_AND_REDISTRIBUTION`. The following methods handle clearing burn or redistributable shares:
 * [`StrategyManager.increaseBurnOrRedistributableShares`](#increaseburnorredistributableshares)
-* [`StrategyManager.clearBurnOrRedistributableShares`](#clearBurnOrRedistributableShares)
-* [`StrategyManager.clearBurnOrRedistributableSharesByStrategy](#clearburnorredistributableshares)
+* [`StrategyManager.clearBurnOrRedistributableShares`](#clearburnorredistributableshares)
+* [`StrategyManager.clearBurnOrRedistributableSharesByStrategy`](#clearburnorredistributableshares)
 * [`StrategyManager.burnShares`](#burnshares) - Legacy burnShares function
 
 #### `increaseBurnOrRedistributableShares`
@@ -279,10 +282,11 @@ function increaseBurnOrRedistributableShares(
 
 The `DelegationManager` calls this method when an operator is slashed, calculating the number of slashable shares and marking them for burn or redistribution here.
 
-Anyone can then convert the shares to tokens and trigger a burn via `burnShares`. This asynchronous method was added to mitigate potential DoS vectors when slashing.
+The first strategy recorded for an `operatorSet` and `slashId` also sets the slash's resolution block. Additional strategies added for the same slash do not reset the delay. This asynchronous clearing flow was added to mitigate potential DoS vectors when slashing.
 
 *Effects*:
 * Sets `burnOrRedistributableShares` for the given `operatorSet`, `slashId`, and `strategy`
+* Sets the slash resolution block for the given `operatorSet` and `slashId` if this is the first strategy recorded for that slash
 * Emits a `BurnOrRedistributableSharesIncreased` event
 
 
@@ -296,22 +300,26 @@ Anyone can then convert the shares to tokens and trigger a burn via `burnShares`
 
 ```solidity
 /**
- * @notice Removes burned shares from storage and transfers the underlying tokens for the slashId to the slash escrow.
+ * @notice Removes burned shares from storage and transfers the underlying tokens for the slashId to the redistribution recipient.
+ * @dev Reverts if SLASH_RESOLUTION_DELAY_BLOCKS has not elapsed since the slash was recorded.
+ * @dev Reverts if clearing is paused via PAUSED_BURNING_AND_REDISTRIBUTION.
  * @param operatorSet The operator set to burn shares in.
  * @param slashId The slash ID to burn shares in.
- * @return The amounts of tokens transferred to the slash escrow for each strategy
+ * @return The amounts of tokens transferred to the redistribution recipient for each strategy
  */
 function clearBurnOrRedistributableShares(
     OperatorSet calldata operatorSet, 
     uint256 slashId) 
 external returns (uint256[] memory);
 
 /**
- * @notice Removes a single strategy's shares from storage and transfers the underlying tokens for the slashId to the slash escrow.
+ * @notice Removes a single strategy's shares from storage and transfers the underlying tokens for the slashId to the redistribution recipient.
+ * @dev Reverts if SLASH_RESOLUTION_DELAY_BLOCKS has not elapsed since the slash was recorded.
+ * @dev Reverts if clearing is paused via PAUSED_BURNING_AND_REDISTRIBUTION.
  * @param operatorSet The operator set to burn shares in.
  * @param slashId The slash ID to burn shares in.
  * @param strategy The strategy to burn shares in.
- * @return The amount of shares that were burned.
+ * @return The amount of tokens transferred to the redistribution recipient.
  */
 function clearBurnOrRedistributableSharesByStrategy(
     OperatorSet calldata operatorSet,
@@ -320,13 +328,14 @@ function clearBurnOrRedistributableSharesByStrategy(
 ) external returns (uint256);
 ```
 
-Anyone can call this method to transfer slashed shares to the operator sets's `redistributionRecipient`. This method sets the `burnOrRedistributableShares` for the given `slashId` and `operatorSet` to 0. To accommodate the unlimited number of strategies that can be added to an operatorSet, users can also pass in a strategy to clear via `clearBurnOrRedistributableSharesByStrategy`. The strategies that haven not been cleared can be retrieved by calling `getBurnOrRedistributableShares(operatorSet, slashId)`. 
+Anyone can call these methods after the slash resolution delay to transfer slashed shares to the operator set's `redistributionRecipient`. `clearBurnOrRedistributableShares` clears every strategy recorded for the `operatorSet` and `slashId`. To accommodate the unlimited number of strategies that can be added to an operator set, callers can also clear one strategy at a time with `clearBurnOrRedistributableSharesByStrategy`. The strategies that have not been cleared can be retrieved by calling `getBurnOrRedistributableShares(operatorSet, slashId)`.
 
 *Effects*:
-* Resets the strategy's burn or redistributable shares for the operatorSet and slashId to 0
+* Removes the strategy's burn or redistributable shares for the `operatorSet` and `slashId`
 * If the shares to remove are nonzero:
-    * Calls `withdraw` on the `strategy`, withdrawing shares and sending a corresponding amount of tokens to the operator sets's `redistributionRecipient`
+    * Calls `withdraw` on the `strategy`, withdrawing shares and sending a corresponding amount of tokens to the operator set's `redistributionRecipient`
     * Emits a `BurnOrRedistributableSharesDecreased`
+* Deletes the slash resolution block once all strategies for the slash have been cleared
 
 #### `burnShares`