Introduction
The design of Celestia’s data availability network relies upon a series of interdependent parameters—time windows—that govern security, liveness, and resource utilization. In particular, the concepts of weak subjectivity, unbonding period, pruning window, and sampling window play pivotal roles in ensuring that light nodes, full nodes, and rollups can securely participate, verify, and recover from adversarial conditions.
This post presents an in-depth examination of each window, its relationships, and derives practical parameters.
What Is Weak Subjectivity?
The weak subjectivity period denotes the maximum duration for which a node may safely remain offline and later rejoin the network without requiring an external trust assumption (such as a trusted checkpoint). We also call it the trusting period which is currently set to 14 days.
In proof-of-stake contexts, prolonged offline periods expose nodes to the risk of misidentifying the canonical chain—an opening for long-range attacks.
The period should be long enough to accommodate ordinary downtime and routine maintenance. If it is too short, then a node would always have to rely on a trusted checkpoint if it cannot stay online continuously. If it is longer than the unbonding period, validators can exit before they are slashed, as we will see in the next section.
Unbonding Period Must Exceed The Weak Subjectivity
The unbonding period specifies how long validators must wait after initiating a withdrawal before their staked tokens become liquid. I provides a buffer to detect and punish malicious behavior, and it ensures that any stake used to compromise consensus can be slashed if necessary. Otherwise validators could be malicious and exit their stake before being punished.
If the unbonding period were shorter than the weak subjectivity period, a node, that is offline longer than the unbonding period but less than the weak subjectivity period could rejoin without knowledge that certain validators had been unbonded (and potentially misbehaved) in its absence. Now this node could be subjected to a long-range attack as validators that already unbonded could sell their private keys and a new (malicious) fork could be created.
Therefore the unbonding period must be at least as long as the weak subjectivity period.
Data Pruning Window Can Be Arbitrary Large
The pruning window defines how long full nodes retain raw block data (including blobs). There exists a lower bound on the pruning window that it should at least be as long as the sampling window. Light nodes would detect a false positive data withholding attack if an honest full node deletes the data while a light node expects it to be sampleable. An additional safety buffer (for example, of an hour to a day) is necessary to accommodate for the practical syncing time and network delays a light node might incur. The relationship is that the pruning window has to be at least the sampling window, but not the other way around. We can have a much larger pruning window and make it dependent on storage costs, incentives, and how long the network wants to promise data retrievability.
Sampling Window and Weak Subjectivity Are Equivalent
The sampling window denotes how far back a light node must sample the chain to confirm data availability. Intuitively, sampling once at the tip suffices for tip availability, but blocks in between might have been withheld when a light node has been offline. You need to check that you have a continuous chain of available blocks.
Weak subjectivity already captures the maximum safe offline period; the sampling period must match this period. Sampling less would leave the node blind to blocks slashed during its absence due to withholding. Sampling more can also lead to issues. An honest full node could have already pruned the data, meaning that the light node would falsely detect that the data has been withheld. Actions taken based on this observation would lead to incorrect outcomes.
Light nodes must sample exactly over the weak subjectivity period—no more, no less.
Social Consensus of Slashing Must Wait for Weak Subjectivity Period
When a data withholding attack is detected, Celestia resorts to a social slashing mechanism: affected parties agree off-chain to slash the responsible validators and hard-fork to restore liveness. It will take some time to reach social consensus among stakeholders. The claim is that this forking cannot happen before the weak subjectivity ends.
Because offline nodes may have missed the initial sampling and detection of the attack, they cannot confidently claim slashing outcomes until they have sampled across the entire weak subjectivity duration. Prematurely enacting slashing on-chain before this interval would risk splitting the network.
Let’s say the validators get slashed too fast. Then, the validators could reveal the samples post-slashing, meaning that new light nodes syncing just before the weak subjectivity period ends would get fooled.
The weak subjectivity period is the lower bound, but there is also an upper bound: the unbonding period. It would be useless to slash a validator after they have already unbonded.
Fraud Proof Time of Optimistic Rollups Must Respect Weak Subjectivity
Optimistic rollups on top of Celestia challenge state updates via fraud proofs. The fraud proof window defines how long a challenger may contest an invalid rollup batch. For rollups relying on Celestia’s data layer, the fraud proof window must allow challengers to sample data and verify state transitions within the underlying network’s security.
If the fraud proof window were shorter than Celestia’s weak subjectivity period, a malicious rollup operator could temporarily withhold data, trigger a malicious state transition, and have that transition exit the fraud proof period before light nodes complete their required sampling. Consequently, invalid batches could become irreversible despite ongoing attacks.
Therefore, the fraud proof window for optimistic rollups must be strictly longer as Celestia’s weak subjectivity period with some additional buffer to create, distribute and settle the fraud proof.
Weak Subjectivity Is Uniform Across Node Types
Celestia’s weak subjectivity period applies universally to light nodes, full nodes, and validator clients. Regardless of role, everyone must share the same offline tolerance.
If light nodes have a shorter weak subjectivity, slashing might happen afterward, and vice versa. For the whole network to follow the same chain, nodes will need the same weak subjectivity period.
Conclusion
The protocol has to balance how often nodes have to be online without a trusted checkpoint with the rollups desire to keep the weak subjectivity of Celestia as low as possible and to socially slash as early as possible. As long as we satisfy the constraints described in the post we can change the weak subjectivity to a more favourable parameter, lets say 1 week for example. This change could also lower the unbonding period closer to 1 week. Additionally, because we established that the sampling window is equivalent to the weak subjectivity, light nodes must sample for 1 week exactly. Finally, because the pruning window is decoupled from these things, we can set it to 2 weeks, as this seems sufficient and would already be in line with the current weak subjectivity period.
Acknowledgments
Thank you, @walldiss and @adlerjohn, for reviewing, and thank you to many others for discussions and comments that led to this forum post.