Explicit FIL+ subsidy #121
Description
This proposal is an idea of mine to reduce coupling between the storage power mechanism and deal market. Coupling between these two limits design freedom around problems like supporting exponential growth in storage capacity or making deals much more scalable. This proposal is written independent of proposals like Neutron (#119). An analogous idea would apply to supersectors in order to remove linear-in-deals costs from storage maintenance. This proposal could be made either prior to Neutron (simplifying it) or subsequently.
Background
Filecoin network storage growth will eventually be limited by the chain computation costs associated with maintaining storage if a linear amount of state is accessed or retained per sector (where sectors are a fixed size). The Neutron proposal (#119) resolves this for committed-capacity sectors, but sectors with deals still have per-sector (and per-deal) metadata. Per-sector on-chain data includes the sector->deal mapping and per-sector heterogeneous weight, pledge and penalty values. These are all required because verified deals alter a sector’s power as a means of adjusting reward distribution.
Maintaining the facility for heterogenous sectors constrains freedom for more scalable designs, even though most sectors don’t have deals. The premise that most sectors don’t have deals is not something to rely on, though. In the long term we aim for many more deals and a much greater proportion of committed storage to be in active use.
Goals
This proposal aims to reduce deal market limitations on the scale and efficiency of onboarding and maintaining exponentially larger amounts of capacity.
- Remove per-sector on-chain information from state
- Normalise sectors as far as possible, enabling summarised/aggregate accounting with sub-linear state
- Decouple network security from reward distribution policy
These goals are to be sought within existing product and crypto-economic constraints around sound storage and economic security.
Design ideas
The current storage power mechanism assigns a different power value to equal-size sectors based on the size and duration of Filecoin Plus (FIL+) verified deals. This is a means of incentivising useful storage, delegating the definition of “useful” to an off-chain notary. The incentive for storing verified deals is the increased block reward that may be earned from the increased power of those sectors, despite constant physical storage and infrastructure costs. In essence, the network subsidises useful storage by taxing the other power.
Storage power has two different roles, currently coupled. One is to secure the network through raising the economic cost of some party maintaining a significant fraction of the total power, and the other is to determine the distribution of rewards. The block reward is split between rewarding security and subsidising useful storage. This coupling theoretically means the verified deal power boost reduces the hardware cost to attack the network by a factor of 10, if colluding notaries would bless all of a malicious miner’s storage (this is an impractical attack today, though).
This subsidy could be made much more direct, reducing complexity and coupling between the storage market and individual sectors, and clearly separating security from reward distribution policy.
Uniform sector power
Every sector has uniform power corresponding to its raw committed storage size, regardless of the presence of deals. This removes the concepts of sector quality and quality-adjusted power, and makes all bytes equal in the eyes of the power table. This would remove the DealWeight and VerifiedDealWeight fields from SectorOnChainInfo. Network power and committed storage are now the same concept and need not be tracked separately by the power actor.
Uniform power also means that all similarly-sized sectors committed at the same epoch would require the same initial pledge. Similarly the expected day reward and storage pledge (parameters to a possible future termination fee calculation) depend only on activation epoch. The complicated values maintained to track penalties for replaced CC sectors become unnecessary. Historical pledge/reward values may be maintained just once for the network by the power and reward actors. We currently store each of these numbers in chain state some ~500 times per epoch (@ 50PiB/day growth).
With uniform sector power, the power of groups of sectors may be trivially calculated by multiplication. Window PoSt deadline and partition metadata no longer need to maintain values for live, unproven, faulty and recovering power, but the sector number bitfields remain. Processing or recovering from faults does not require loading each sector’s specific values. The complexity of code and scope for error in these various derived data is much reduced.
This ability to aggregate by multiplying becomes instrumental to Neutron-like ideas around hierarchical storage accounting with deals. Without this, supporting partial faults requires on-chain metadata about the individual sectors (with deals) that comprise a supersector, restoring a linear-in-power network cost.
Note that this proposal does leave the per-sector deal IDs on chain. After this proposal and Neutron, this would be the only piece of per-sector data retained.
A miner’s chance of winning the election at each epoch is proportional to their share of the raw byte power committed to the network and non-faulty. Winning the consensus reward remains a lottery.
Market actor tracks deal space-time
The market actor maintains:
- a current total of active verified deal space (optionally unverified, too);
- a short list of “reward periods”, each aggregating a period of, say, 24 hours, and comprising:
- a table of verified deal space-time totals provided by each miner during the period;
- a record of the total deal subsidy earned during the period (see below)
As payments are periodically processed for each deal (currently every 100 epochs), the market actor adds the deal’s size multiplied by the update period epochs to the provider’s space-time tally for the current reward period.
After a reward period completes, the ratio between verified deal space-time of each provider gives their share of the deal subsidy to be claimable. A miner can claim a corresponding share of the total deal subsidy earned at any point up until the reward period expires (e.g. 60 days). Upon claiming a deal subsidy, the reward funds are inserted into the miner’s vesting schedule, alongside block rewards.
FIL+ subsidy paid to market actor
At every epoch, the reward actor queries the power actor for the total network power (= storage) and the market actor for the total verified deal space. The total block reward to be paid is then split into the power reward and the verified deal subsidy according to the ratio of storage to 9*deal space. The block reward is paid as usual, and the deal subsidy is sent to the market actor.
Discussion
The primary motivation for this proposal is to remove per-sector account-keeping metadata in order to unlock exponential scaling of storage. It changes reward behaviour in a couple of ways that we must verify as being beneficial.
- Earning the verified deal subsidy doesn’t depend on winning blocks. This is a deviation from the current protocol that requires a miner to win a block (with a Winning PoSt) in order to claim rewards. This is more reliable for smaller parties that might win only occasional blocks, and might suffer from less robust blockchain node infrastructure and connectivity.
- The market actor does not track temporary faults in sectors: a provider is eligible for the full client payment if the corresponding sector faults, so long as it is recovered soon thereafter. The power table does track temporary faults, suspending rewards until a sector is recovered (necessary for economic arguments about security). This change moves the deal subsidy from being subject to suspension during faults to the same more tolerant treatment of deals. Verified deals no longer subvert the economic security arguments, but it’s not obvious that this makes the more tolerant treatment acceptable.
If not, we might need to communicate faults to the market actor, making them a bit more expensive and exposing the market actor to a concept of sectors it’s currently mostly abstracted from. - We probably need a separate pledge for the deal subsidy, so that collateral remains proportional to future earnings. This pledge would be about (verified) deals, rather than sectors, because this proposal separates those reward streams. This pledge would likely be owned by the market actor and forfeit when a deal defaults.
- A potentially tricky situation to analyze is what happens when the power reward is significantly less than the deal subsidy. Does it create any unwanted incentives for the block producing miner to deviate from the protocol (assuming they don’t have many deals)?