Skip to content

Latest commit

 

History

History
214 lines (139 loc) · 18.8 KB

fip-0098.md

File metadata and controls

214 lines (139 loc) · 18.8 KB
fip title author discussions-to status type category created
0098
Simplify termination fee calculation to a fixed percentage of initial pledge
Jonathan Schwartz (@Schwartz10), Alex North (@anorth), Jim Pick (@jimpick)
Accepted
Technical
Core
2024-09-26

FIP-0098: Simplify termination fee calculation to a fixed percentage of initial pledge

Simple Summary

The termination fee for any given sector is calculated as a fixed percentage of the initial pledge held by that sector, except in 3 special cases. The proposed penalty as a percentage of initial pledge is 8.5%.

Abstract

Today, it is overly sophisticated and computationally expensive to compute termination fees for miner actors. As a result, DeFi applications that leverage miner actors must make major security and/or performance sacrifices in order to operate.

This FIP addresses the issue by simplifying the calculation of the miner actor termination fee. The proposed new termination fee calculation uses a "percentage of pledge" strategy - where termination fee = initial pledge * termination penalty %. The proposed new termination penalty % is 8.5%. There are three special cases to consider where the termination fee must be tweaked to maintain current network conditions, which are addressed in the technical specification and design rationale.

As a result, DeFi applications on Filecoin can operate with significantly better performance, UX, and economic security. Additionally, Filecoin economics and code implementations will be significantly simplified, as well as state bloat removed.

Change Motivation

In the year+ since FEVM’s launch, we’ve seen a number of protocols use Miner Actors as collateral for lending or leasing applications. Economic security of applications being built on the FEVM is important for developing trust, and understanding precise collateral values for any given miner actor is critical for a DeFi protocol’s economic security.

Today, it is: (1) computationally expensive, (2) economically sophisticated, and (3) impossible in a FEVM runtime to compute the maximum termination fee for a miner actor’s sectors. As a result, FEVM applications need to either (a) use heuristics to determine a collateral value for a miner (economically insecure), or (b) use off-chain solutions to compute collateral values (significantly bloating the surface area of attack vectors for any lending / leasing protocol). Both of these approaches make major sacrifices towards the economic security of FEVM applications that use miner actors as collateral.

The two primary motivations to this FIP proposal are:

  1. Enabling a more efficient termination penalty calculation such that termination penalties can be computed (or returned by an FEVM precompile) in an FEVM runtime. This is important because it enables FEVM protocols that use Miner Actors as collateral to operate with better economic security because they can precisely estimate the value of Miner Actor collateral on-chain.
  2. Changing the formula for calculating termination penalties to be simpler to compute. This is important because it allows both Storage Providers and FEVM actors that use Miner Actors as collateral to easily predict their economic riskiness.

Additionally, this FIP intends to maintain the original motivations behind termination fees:

  1. Create a more resilient storage network for storage clients, such that if an SP stores a client's data, the client isn't just suddenly left out to dry and their data lost.
  2. Network stability - disincentivize large power swings caused by rapid on/off-boarding of power and pledge.

Specification

Three new constants should be created, and an existing one will be reused. Each is fixed for the whole network and configurable by future governance:

Constant Description Amount
TERM_FEE_PLEDGE_MULTIPLE This constant will be used to compute termination fees in the base case by multiplying against initial pledge. 0.085x initial pledge
TERM_FEE_MAX_FAULT_FEE_MULTIPLE This constant will be used to compute termination fees when the termination fee of a sector is less than the fault fee for the same sector. 1.05x
TERM_FEE_MIN_PLEDGE_MULTIPLE This constant will ensure the termination fee for young sectors is not arbitrarily low. 0.02x initial pledge
TERMINATION_LIFETIME_CAP (Existing constant) This constant maintains the linear increase in termination fee for young sectors. 140 days

Refactor the pledge_penalty_for_termination method to:

  1. Calculate the simple termination fee:
simple_termination_fee = initial_pledge * TERM_FEE_PLEDGE_MULTIPLE  // (0.085 * initial_pledge)
  1. Apply the age adjustment for young sectors to arrive at the base termination fee:
age_factor = min(1, sector_age_days / TERMINATION_LIFETIME_CAP)
base_termination_fee = simple_termination_fee * age_factor
  1. Calculate the minimum allowed fee (a lower bound on the termination fee) by comparing the absolute minimum termination fee value against the fault fee. Whatever result is larger sets the lower bound for the termination fee:
minimum_fee_abs = initial_pledge * TERM_FEE_MIN_PLEDGE_MULTIPLE  // (0.02 * initial_pledge)
minimum_fee_ff = pledge_penalty_for_continued_fault(sector_power) * TERM_FEE_MAX_FAULT_FEE_MULTIPLE  // (1.05 * fault_fee)

minimum_fee = max(minimum_fee_abs,minimum_fee_ff)
  1. Apply the fee bounds:
termination_fee = max(base_termination_fee, minimum_fee)

This ensures that:

  • The fee is never less than 2% of the initial pledge
  • The fee is never less than 105% of the fault fee
  • For sectors younger than 140 days, the fee scales linearly with age (subject to the bounds)
  • For sectors older than 140 days, the fee is 8.5% of the initial pledge (subject to the bounds)

The complete formula in one expression is:

termination fee = max(
  MIN_TERMINATION_FEE * initial_pledge,
  max(
    TERM_PENALTY_PLEDGE_PERCENTAGE * initial_pledge * min(1, sector_age_days / TERMINATION_LIFETIME_CAP),
    FAULT_FEE_MULTIPLE * sector_fault_fee
  )
)

This change would immediately apply to all sectors, including historical sectors.

The following sector info fields are used exclusively for the termination fee calculation, and are unused by the built-in actors code:

  • expected day reward
  • expected storage pledge
  • replaced day reward

For all new sectors or snapped sectors, these three values are set to zero.

These redundant fields can be removed from state in a future migration.

In addition to the revised termination fee formulas, a few built-in actor methods need to be created and exported so they are accessible from FEVM:

Function Name Function Signature Description
miner_power miner_power() -> (QAPower, RawPower) Returns the miner's quality-adjusted and raw power
miner_initial_pledge miner_initial_pledge() -> TokenAmount Returns the miner's total initial pledge amount
max_termination_fee max_termination_fee(initial_pledge: TokenAmount, power: QAPower) -> TokenAmount Returns the maximum termination fee calculation for a given initial pledge and power amount

Design Rationale

There are a few different approaches one could take to accomplish the same end result:

  1. Use a "multiple of daily rewards" approach, which computes a termination fee based on a % or multiple of expected daily rewards for a period of time, based on the current block rewards
    • Problems:
      • Less predictable - in order to estimate the collateral value of a Miner Actor, the protocol needs to be able to estimate what the future daily block reward will be for the network. If the network grows quickly and unexpectedly, this could dangerously impact a DeFi protocol as the daily block rewards may increase due to increasing baseline, thus increasing the termination penalty and decreasing the collateral value for a given Miner Actor.
  2. Optimize data structures based on the current methodology to make an aggregate termination sector method feasible in constant time lookup
    • Problems:
      • Unsure if this is technically feasible, and if so, most likely a lot of sophistication and ugly accounting
      • Would most likely add state to the Filecoin blockchain

The %-of-pledge method is:

  1. simple to calculate
  2. predictable
  3. fixed while the sector's pledge is constant
  4. will not decay towards zero as block rewards decline, thus more effectively protecting against churn

Additionally, there are two other considerations to make with respect to the design rationale:

  1. According to certain network participants, some Filecoin lenders provide loans to Storage Providers based on lower termination fees for sectors that are younger than 140 days old. The proposed design maintains a linear increasing termination fee over the first 140 days of the sector's life
  2. There are theoretical economic security issues when termination fee < fault fee for a sector (see here for more info). The proposed design ensures this security issue does not happen by forcing the termination fee to be greater than the fault fee if that edge case ever occurs.

Backwards Compatibility

This FIP would introduce backwards incompatibility with how previous tipsets calculate their termination fees. As a result, previous statistical data collected about Filecoin termination fees (which I don't think there's much of), would become incorrect. Off-chain tooling that estimates termination penalties must change how they work too. It's possible to maintain the historical state, but it seems like a lot of work for a little gain.

This FIP requires a network upgrade because it intends to change built-in actor code.

Test Cases

  • When terminating a single sector:

    • Not considering fault fees, for a sector where its age >= TERMINATION_LIFETIME_CAP, termination fee should equal TERM_FEE_PLEDGE_MULTIPLE * initial pledge
    • Not considering fault fees, for a sector where its age < TERMINATION_LIFETIME_CAP, termination fee should equal TERM_FEE_PLEDGE_MULTIPLE * of initial pledge * sector age in days / TERMINATION_LIFETIME_CAP
    • Considering fault fees, for a sector with a termination fee that is less than the associated sector's fault fee, termination fee should equal TERM_FEE_MAX_FAULT_FEE_MULTIPLE * fault fee
    • Given all test cases above, if the termination fee computed is less than TERM_FEE_MIN_PLEDGE_MULTIPLE * initial pledge, termination fee should equal TERM_FEE_MIN_PLEDGE_MULTIPLE * initial pledge

  • Additional test case for the pledge_penalty_for_continued_fault method:

    • pledge_penalty_for_continued_fault should work for aggregate power numbers above the possible QA power for any single sector. For instance, an aggregate of 10 sectors' power should return the same end result as summing the pledge_penalty_for_continued_fault of each sector individually.

Security Considerations

The security concern with introducing this FIP is that Storage Providers will not face a severe enough penalty to leave the network very quickly, which could cause major power volatility on the network. We don't believe this is a major concern for the following reasons:

  1. The 8.5% proposed termination penalty percentage is what the network is currently charging (on average) for steady state terminations.
  2. Governance can always choose to increase the termination penalty percentage.
  3. It seems appropriate to charge an exit fee for breaking a commitment to the network, but we also do not want to charge a capture fee. Storage Providers who do not wish to use Filecoin anymore shouldn't have prohibitively high expenses for leaving the network early - ultimately for the network, burning some of this SPs tokens through sector terminations is better than 18 months of selling.
  4. As Filecoin matures, the average Storage Provider will likely be accepting paid deals in some form according to an SLA in addition to the SLA guaranteed by PoRep. These additional SLAs can/will enforce their own termination clauses, which should provide adequate motivation and verification to achieve a good experience for the average storage client.
  5. The 140 day linear termination fee increase is kept intact to ensure no existing loan / collateral position in the Filecoin capital markets flips undercollateralized.
  6. There can be theoretical security issues when the termination fee is less than the fault fee for the same sector, however, the proposal here does not allow termination fees to drop below fault fees.

Incentive Considerations

It is important that Storage Providers are incentivized to honor their commitments to the network - this prevents major network volatility. It makes sense to maintain a disincentive for breaking commitments to the network, but this FIP doesn't change the incentive to provide useful storage to the network, it makes it somewhat easier.

The termination fee for sectors committed a long time ago will immediately and significantly decrease, but only to match the fee:pledge ratio of new sectors. This will increase the incentive for some SPs with high-pledge sectors to terminate and re-onboard to gain more power for the same amount of pledge (but more hardware). See this discussion comment for the latest data on live sector fee:pledge data from August, 2024.

In contrast to the current system, the termination penalty for a sector will be constant regardless of its age (after the 140 day linear ramp-up). Currently the termination penalty starts low and increases with age up to a max. This presents a change in the incentive structure for short-term-view SPs.

Product Considerations

From a product perspective, the network will massively simplify its UX. Potential Storage Providers can calculate their risk of mining on the back of a napkin, whereas today it takes a team of highly trained Filecoin experts. Developers can integrate safer DeFi practices.

Implementation

Copyright

Copyright and related rights waived via CC0.