From 60eb61d1b517232c66010d01b5dd8677c78fd942 Mon Sep 17 00:00:00 2001 From: Jonathan Date: Thu, 26 Sep 2024 21:02:59 -0700 Subject: [PATCH 1/6] Add fip draft without spec --- FIPS/fip-draft_term_fee.md | 114 +++++++++++++++++++++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100644 FIPS/fip-draft_term_fee.md diff --git a/FIPS/fip-draft_term_fee.md b/FIPS/fip-draft_term_fee.md new file mode 100644 index 00000000..84125167 --- /dev/null +++ b/FIPS/fip-draft_term_fee.md @@ -0,0 +1,114 @@ +--- +fip: "" +title: Simplify termination fee calculation to a fixed percentage of initial pledge +author: @anorth, @Schwartz10 +discussions-to: https://github.com/filecoin-project/FIPs/discussions/1036 +status: Draft +type: Technical +category (*only required for Standard Track): Core +created: 2024-09-26 +--- + + + +# FIP-Number: Simplify termination fee calculation to a fixed percentage of initial pledge + +## Simple Summary + + + +Computing the collateral value for a miner actor is critical for making economically secure defi protocols on filecoin; however, computing the collateral value correctly is hard on its own, and impossible in a small time frame and/or from inside the FEVM. The variance in termination fees relative to initial pledge for different miners on the network vary so significantly that DeFi protocols cannot safely use heuristics to estimate miner collateral values. + +This FIP intends to significantly simplify the termination fee calculation by using a fixed "percentage-of-pledge" method. The termination fee for any given sector is calculated as a fixed percentage of the initial pledge held by that sector. + +## Abstract + + + +Today, it is overly sophisticated and computationally expensive to compute termination fees for miner actors. As a result, DeFi applications that leverage miner actors must make major security and/or performance sacrifices in order to operate. + +This FIP addresses the issue by simplifying the calculation of the miner actor termination fee. The proposed new termination fee calculation uses a "percentage of pledge" strategy - where `termination fee = initial pledge * termination penalty %`. The proposed new termination penalty % is 6%. + +As a result, DeFi applications on Filecoin can operate with significantly better performance, UX, and economic security. Additionally, Filecoin economics and code implementations will be significantly simplified, as well as state bloat removed. + +## Change Motivation + + + +In the year+ since FEVM’s launch, we’ve seen a number of protocols use Miner Actors as collateral for lending or leasing applications. Economic security of applications being built on the FEVM is important for developing trust, and understanding precise collateral values for any given miner actor is critical for a DeFi protocol’s economic security. + +Today, it is: (1) computationally expensive, (2) economically sophisticated, and (3) impossible in a FEVM runtime to compute the maximum termination fee for a miner actor’s sectors. As a result, FEVM applications need to either (a) use heuristics to determine a collateral value for a miner (economically insecure), or (b) use off-chain solutions to compute collateral values (significantly bloating the surface area of attack vectors for any lending / leasing protocol). Both of these approaches make major sacrifices towards the economic security of FEVM applications that use miner actors as collateral. + +Two of the original motivations for termination fees are: + +1. Create a more resilient storage network for storage clients, such that if an SP stores a client's data, the client isn't just suddenly left out to dry and their data lost +2. Network stability + +This FIP intends to keep those original motivations in tact for the Filecoin network. + +## Specification + + + +The technical specification should describe the syntax and semantics of any new feature. The specification should be detailed enough to allow competing, interoperable implementations for any of the current Filecoin implementations. + +## Design Rationale + + + +There are a few different approaches one could take to accomplish the same end result: + +1. Optimize data structures based on the current methodology to make an aggregate termination sector method feasible in constant time lookup + - Problems: + - Unsure if this is technically feasible, and if so, most likely a lot of sophistication and ugly accounting + - Would most likely add state to the Filecoin blockchain +2. Use a "multiple of daily rewards" approach, which computes a termination fee based on a % or multiple of expected daily rewards for a period of time based on the current block rewards + - Problems: + - Unpredictable - DeFi apps now have to be extremely knowledgeable on the future of Filecoin block rewards in order to safely underwrite DeFi loans + - Computing block rewards is still a non-trivial task, and most likely requires more/new solidity FEVM precompiles + +The current design is the simplest and most predictable approach to accomplishing the end goal. + +## Backwards Compatibility + + + +This FIP would introduce backwards incompatibility with how previous tipsets calculate their termination fees. As a result, previous statistical data collected about Filecoin termination fees (which I don't think there's much of), would become incorrect. It's possible to maintain the historical state, but it seems like a lot of work for a little gain. + +## Test Cases + + + +- When terminating a single sector, the realized termination fee should equal the expected % of pledge termination fee +- When terminating all sectors on a miner, the realized termination fee should equal the expected % of pledge termination fee + +## Security Considerations + + + +The security concern with introducing this FIP is that Storage Providers will not face a severe enough penalty to leave the network very quickly, which could cause major power volatility on the network. We don't believe this is a major concern for the following reasons: + +1. As Filecoin matures, the average Storage Provider will likely be accepting paid deals in some form according to an SLA in addition to the SLA guaranteed by PoRep. These additional SLAs can/will enforce their own termination clauses, which should provide adequate motivation and verification to achieve a good experience for the average storage client. +2. It seems appropriate to charge an exit fee for breaking a commitment to the network, but we also do not want to charge a capture fee. Storage Providers who do not wish to use Filecoin anymore shouldn't have prohibitively high expenses for leaving the network early - ultimately for the network, burning some of this SPs tokens through sector terminations is better than 18 months of selling. +3. The 6% proposed termination penalty percentage is what the network is currently charging (on average) for terminations. +4. Governance can always choose to increase the termination penalty percentage. + +## Incentive Considerations + + + +It is important that Storage Providers are incentivized to honor their commitments to the network - this prevents major network volatility. It makes sense to maintain a disincentive for breaking commitments to the network, but this FIP doesn't change the incentive to provide useful storage to the network, it makes it somewhat easier. + +## Product Considerations + + + +From a product perspective, the network will massively simplify its UX. Potential Storage Providers can calculate their risk of mining on the back of a napkin, whereas today it takes a team of highly trained Filecoin experts. Developers can integrate safer DeFi practices. + +## Implementation + + + +## Copyright + +Copyright and related rights waived via [CC0](https://creativecommons.org/publicdomain/zero/1.0/). From 4871bf14dc5b08e7c07411aaad6bd8b527145c63 Mon Sep 17 00:00:00 2001 From: Jonathan Date: Fri, 18 Oct 2024 19:00:33 -0700 Subject: [PATCH 2/6] Update spec --- FIPS/fip-draft_term_fee.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/FIPS/fip-draft_term_fee.md b/FIPS/fip-draft_term_fee.md index 84125167..9a26a356 100644 --- a/FIPS/fip-draft_term_fee.md +++ b/FIPS/fip-draft_term_fee.md @@ -50,7 +50,14 @@ This FIP intends to keep those original motivations in tact for the Filecoin net -The technical specification should describe the syntax and semantics of any new feature. The specification should be detailed enough to allow competing, interoperable implementations for any of the current Filecoin implementations. +A new constant variable called `TERM_PENALTY_PLEDGE_PERCENTAGE` should be created, which is fixed for the whole network and configurable by future governance. + +Refactor the `pledge_penalty_for_termination` method to: + +1. Take the sector's `initial_pledge` `TokenAmount` as an argument +2. Return `initial_pledge * TERM_PENALTY_PLEDGE_PERCENTAGE` + +We may also be able to remove `expected_storage_pledge` from the `SectorOnChainInfo` struct type as I believe this is only used in computing termination penalties. ## Design Rationale From 431df7ab67442e5dc622376182e174c038ecfe1f Mon Sep 17 00:00:00 2001 From: Jonathan Date: Fri, 18 Oct 2024 19:05:43 -0700 Subject: [PATCH 3/6] Update readme --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index fed9d3d8..199ac701 100644 --- a/README.md +++ b/README.md @@ -131,3 +131,4 @@ This improvement protocol helps achieve that objective for all members of the Fi | [0092](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-0092.md) | Non-Interactive PoRep | FIP | luca (@lucaniz), kuba (@Kubuxu), nicola (@nicola), nemo (@cryptonemo), volker (@vmx), irene (@irenegia), Alex North (@anorth), orjan (@Phi-rjan) | Final | | [0094](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-0094.md) | Add Support for EIP-5656 (MCOPY Opcode) in the FEVM | FIP | Michael Seiler (@snissn), Raúl Kripalani (@raulk), Steven Allen (@stebalien) | Last Call | | [0095](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-0095.md) | Add FEVM precompile to fetch beacon digest from chain history | FIP | @ZenGround0, Alex North (@anorth) | Last Call | +| [XXXX](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-XXXX.md) | Add FEVM precompile to fetch beacon digest from chain history | FIP | Jonathan Schwartz (@Schwartz10), Alex North (@anorth) | Draft | From 060373145e6399b14994589a7acc5eb5c722da63 Mon Sep 17 00:00:00 2001 From: Jonathan Date: Fri, 18 Oct 2024 19:07:18 -0700 Subject: [PATCH 4/6] Update func ref --- FIPS/fip-draft_term_fee.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/FIPS/fip-draft_term_fee.md b/FIPS/fip-draft_term_fee.md index 9a26a356..670d7847 100644 --- a/FIPS/fip-draft_term_fee.md +++ b/FIPS/fip-draft_term_fee.md @@ -52,7 +52,7 @@ This FIP intends to keep those original motivations in tact for the Filecoin net A new constant variable called `TERM_PENALTY_PLEDGE_PERCENTAGE` should be created, which is fixed for the whole network and configurable by future governance. -Refactor the `pledge_penalty_for_termination` method to: +Refactor the [`pledge_penalty_for_termination`](https://github.com/filecoin-project/builtin-actors/blob/12d9af8a00d0909598c67e1a18dc1577e0833137/actors/miner/src/monies.rs#L179) method to: 1. Take the sector's `initial_pledge` `TokenAmount` as an argument 2. Return `initial_pledge * TERM_PENALTY_PLEDGE_PERCENTAGE` From 40cf2c2102cdbd21111f50291b443ca5638059d3 Mon Sep 17 00:00:00 2001 From: Jonathan Date: Tue, 22 Oct 2024 21:16:27 -0700 Subject: [PATCH 5/6] Respond to review comments --- FIPS/fip-draft_term_fee.md | 56 ++++++++++++++++++++++++++------------ 1 file changed, 39 insertions(+), 17 deletions(-) diff --git a/FIPS/fip-draft_term_fee.md b/FIPS/fip-draft_term_fee.md index 670d7847..103287d1 100644 --- a/FIPS/fip-draft_term_fee.md +++ b/FIPS/fip-draft_term_fee.md @@ -1,11 +1,11 @@ --- fip: "" title: Simplify termination fee calculation to a fixed percentage of initial pledge -author: @anorth, @Schwartz10 +author: @Schwartz10, @anorth discussions-to: https://github.com/filecoin-project/FIPs/discussions/1036 status: Draft type: Technical -category (*only required for Standard Track): Core +category: Core created: 2024-09-26 --- @@ -17,9 +17,7 @@ created: 2024-09-26 -Computing the collateral value for a miner actor is critical for making economically secure defi protocols on filecoin; however, computing the collateral value correctly is hard on its own, and impossible in a small time frame and/or from inside the FEVM. The variance in termination fees relative to initial pledge for different miners on the network vary so significantly that DeFi protocols cannot safely use heuristics to estimate miner collateral values. - -This FIP intends to significantly simplify the termination fee calculation by using a fixed "percentage-of-pledge" method. The termination fee for any given sector is calculated as a fixed percentage of the initial pledge held by that sector. +The termination fee for any given sector is calculated as a fixed percentage of the initial pledge held by that sector. The proposed penalty as a percentage of initial pledge is 6%. ## Abstract @@ -39,12 +37,16 @@ In the year+ since FEVM’s launch, we’ve seen a number of protocols use Miner Today, it is: (1) computationally expensive, (2) economically sophisticated, and (3) impossible in a FEVM runtime to compute the maximum termination fee for a miner actor’s sectors. As a result, FEVM applications need to either (a) use heuristics to determine a collateral value for a miner (economically insecure), or (b) use off-chain solutions to compute collateral values (significantly bloating the surface area of attack vectors for any lending / leasing protocol). Both of these approaches make major sacrifices towards the economic security of FEVM applications that use miner actors as collateral. -Two of the original motivations for termination fees are: +The two primary motivations to this FIP proposal are: + +1. Enabling a more efficient termination penalty calculation such that termination penalties can be computed (or returned by an FEVM precompile) in an FEVM runtime. This is important because it enables FEVM protocols that use Miner Actors as collateral to operate with better economic security because they can precisely estimate the value of Miner Actor collateral on-chain. +2. Changing the formula for calculating termination penalties to be simpler to compute. This is important because it allows both Storage Providers and FEVM actors that use Miner Actors as collateral to easily predict their economic riskiness. -1. Create a more resilient storage network for storage clients, such that if an SP stores a client's data, the client isn't just suddenly left out to dry and their data lost -2. Network stability +Additionally, this FIP intends to maintain the original motivations behind termination fees: + +1. Create a more resilient storage network for storage clients, such that if an SP stores a client's data, the client isn't just suddenly left out to dry and their data lost. +2. Network stability - disincentivize large power swings caused by rapid on/off-boarding of power and pledge. -This FIP intends to keep those original motivations in tact for the Filecoin network. ## Specification @@ -57,7 +59,17 @@ Refactor the [`pledge_penalty_for_termination`](https://github.com/filecoin-proj 1. Take the sector's `initial_pledge` `TokenAmount` as an argument 2. Return `initial_pledge * TERM_PENALTY_PLEDGE_PERCENTAGE` -We may also be able to remove `expected_storage_pledge` from the `SectorOnChainInfo` struct type as I believe this is only used in computing termination penalties. +This change would immediately apply to all sectors, including historical sectors. + +The following sector info fields are used exclusively for the termination fee calculation, and are unused by the built-in actors code: + +- expected day reward +- expected storage pledge +- replaced day reward + +For all new sectors or snapped sectors, these three values are set to zero. + +These redundant fields can be removed from state in a future migration. ## Design Rationale @@ -65,22 +77,28 @@ We may also be able to remove `expected_storage_pledge` from the `SectorOnChainI There are a few different approaches one could take to accomplish the same end result: -1. Optimize data structures based on the current methodology to make an aggregate termination sector method feasible in constant time lookup +1. Use a "multiple of daily rewards" approach, which computes a termination fee based on a % or multiple of expected daily rewards for a period of time based on the current block rewards + - Problems: + - Less predictable - in order to estimate the collateral value of a Miner Actor, the protocol needs to be able to estimate what the future daily block reward will be for the network. If the network grows quickly and unexpectedly, this could dangerously impact a DeFi protocol as the daily block rewards may increase due to increasing baseline, thus increasing the termination penalty and decreasing the collateral value for a given Miner Actor. +2. Optimize data structures based on the current methodology to make an aggregate termination sector method feasible in constant time lookup - Problems: - Unsure if this is technically feasible, and if so, most likely a lot of sophistication and ugly accounting - Would most likely add state to the Filecoin blockchain -2. Use a "multiple of daily rewards" approach, which computes a termination fee based on a % or multiple of expected daily rewards for a period of time based on the current block rewards - - Problems: - - Unpredictable - DeFi apps now have to be extremely knowledgeable on the future of Filecoin block rewards in order to safely underwrite DeFi loans - - Computing block rewards is still a non-trivial task, and most likely requires more/new solidity FEVM precompiles -The current design is the simplest and most predictable approach to accomplishing the end goal. +The %-of-pledge method is: + + 1. simple to calculate + 2. predictable + 3. fixed while the sector's pledge is constant + 4. will not decay towards zero as block rewards decline, thus more effectively protecting against churn ## Backwards Compatibility -This FIP would introduce backwards incompatibility with how previous tipsets calculate their termination fees. As a result, previous statistical data collected about Filecoin termination fees (which I don't think there's much of), would become incorrect. It's possible to maintain the historical state, but it seems like a lot of work for a little gain. +This FIP would introduce backwards incompatibility with how previous tipsets calculate their termination fees. As a result, previous statistical data collected about Filecoin termination fees (which I don't think there's much of), would become incorrect. Off-chain tooling that estimates termination penalties must change how they work too. It's possible to maintain the historical state, but it seems like a lot of work for a little gain. + +This FIP requires a network upgrade because it intends to change built-in actor code. ## Test Cases @@ -106,6 +124,10 @@ The security concern with introducing this FIP is that Storage Providers will no It is important that Storage Providers are incentivized to honor their commitments to the network - this prevents major network volatility. It makes sense to maintain a disincentive for breaking commitments to the network, but this FIP doesn't change the incentive to provide useful storage to the network, it makes it somewhat easier. +The termination fee for sectors committed a long time ago will immediately and significantly decrease, but only to match the fee:pledge ratio of new sectors. This will increase the incentive for some SPs with high-pledge sectors to terminate and re-onboard to gain more power for the same amount of pledge (but more hardware). + +In contrast to the current system, the termination penalty for a sector will be constant regardless of its age. Currently the termination penalty starts low and increases with age up to a max. This presents is a change in the incentive structure for short-term-view SPs. + ## Product Considerations From 71e441942d6403417155e5456a37919dc895a417 Mon Sep 17 00:00:00 2001 From: Jon Date: Mon, 4 Nov 2024 20:04:09 -0800 Subject: [PATCH 6/6] Update README.md Co-authored-by: Jorge M. Soares <547492+jsoares@users.noreply.github.com> --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1fee5a1d..a5c46997 100644 --- a/README.md +++ b/README.md @@ -131,4 +131,4 @@ This improvement protocol helps achieve that objective for all members of the Fi | [0092](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-0092.md) | Non-Interactive PoRep | FIP | luca (@lucaniz), kuba (@Kubuxu), nicola (@nicola), nemo (@cryptonemo), volker (@vmx), irene (@irenegia), Alex North (@anorth), orjan (@Phi-rjan) | Final | | [0094](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-0094.md) | Add Support for EIP-5656 (MCOPY Opcode) in the FEVM | FIP | Michael Seiler (@snissn), Raúl Kripalani (@raulk), Steven Allen (@stebalien) | Accepted | | [0095](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-0095.md) | Add FEVM precompile to fetch beacon digest from chain history | FIP | @ZenGround0, Alex North (@anorth) | Accepted | -| [XXXX](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-XXXX.md) | Add FEVM precompile to fetch beacon digest from chain history | FIP | Jonathan Schwartz (@Schwartz10), Alex North (@anorth) | Draft | +| [XXXX](https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-XXXX.md) | Simplify termination fee calculation to a fixed percentage of initial pledge | FIP | Jonathan Schwartz (@Schwartz10), Alex North (@anorth) | Draft |