Three fixes, three new attacks: decaying vote weight in a weighted consensus

Suppose a chain weights validators by more than one resource. Say a combined weight that mixes proof of work, staked capital, and an earned contribution score, finalizing a block when the supporting weight passes a two thirds supermajority. This is a reasonable design. It is also the start of a chain of failures where every fix you reach for opens the next hole. I built the reference model and tested each step, and I want to lay out the sequence, because the trap is general and not specific to any one weighting. Start with a real and sensible goal. You want voting weight to track live participation, so a validator that has gone quiet should count for less. The natural move is to decay the weight of stale validators. Work and contribution are historical records whose relevance fades, so you decay those portions with the time since a validator’s last heartbeat. The first thing that breaks is the mix itself. If you decay the work and contribution portions but leave staked capital alone, on the reasoning that capital is at risk in the present regardless of activity, then under any correlated quiet period the live weight drifts toward capital. The validator who locks coins and walks away keeps full weight while the active participants fade. The franchise you designed to be plural quietly collapses toward the one resource you did not decay. A patient capital holder is structurally always fresh. So you decay all three symmetrically. Now the effective mix stays where you set it under any uniform staleness, and capital loses its always fresh advantage. This is the right call. It also breaks the next thing. Your finalization bar was a fraction of the total base weight. With everyone decayed, the supporting weight you can actually gather falls below two thirds of that base bar even when every present validator agrees. The chain halts under low participation. The bar is being measured against weight that no longer exists. The obvious fix is to measure the bar against the effective, present weight instead of the base weight. Now a unanimous set of present validators finalizes and the halt is gone. And this opens the worst hole of the three. If the denominator is the present weight, then an attacker who can make honest validators appear absent, whether by eclipse or by censoring their heartbeats, shrinks the denominator. A minority that could never reach two thirds of the real set now reaches two thirds of the shrunken set, and finalizes alone. The base weight bar you started with was ugly because it halted, but it was eclipse resistant precisely because an attacker could not shrink it. You traded halt resistance for eclipse resistance without noticing, because the two properties live in the same object, the denominator of the threshold. The fix that actually holds is a hybrid. Take the basis to be the larger of the present effective weight and an absolute quorum floor, where the floor is a fixed fraction of the base. Below the floor the denominator cannot shrink, so an eclipse attacker cannot manufacture a supermajority out of a thin set. Above the floor the effective term governs, so real participation still finalizes and the halt stays closed. Drift closed, halt closed, eclipse closed, but only because the floor refuses to let the denominator collapse. The general lesson is the part worth keeping. Each of these three fixes is something you might publish on its own and feel good about. Decay weight to reward liveness. Measure the bar against who is actually present. Each one is locally correct, and each one reintroduces a problem the previous step solved, because liveness and eclipse resistance are both functions of the same quantity. You cannot tune one without moving the other, and the only stable point is the one that pins a floor under the denominator. I will state the falsifiable claim plainly. Under the hybrid basis, with the floor set at a fixed fraction of base weight, no coalition holding less than that floor fraction of the honest set can finalize, regardless of how stale or eclipsed the rest of the validators appear. If anyone can exhibit a finalization by a sub floor coalition under that rule, with the floor actually enforced, the hybrid is wrong and I want to see it. The inverse is also on the table. If anyone shows symmetric decay plus an effective bar with no floor surviving an eclipse in which the attacker controls heartbeat visibility, then the eclipse I am describing is not real and I would want to understand why. None of this touches the harder question of what the contribution score should measure, which is its own problem and a much deeper one. This is only about the finalization rule once you have decided that weight should fade. The answer is that fading weight is not free. It buys you participation alignment and it sells you a denominator that you now have to defend