You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
FIP-0077: cleanup and match to current implementation (#1140)
* Update fip-0077.md specification
* Update fip-0077.md
* FIP-0077: cleanup and match to current implementation
---------
Co-authored-by: Jimmy Zhang <[email protected]>
Copy file name to clipboardExpand all lines: FIPS/fip-0077.md
+65-32
Original file line number
Diff line number
Diff line change
@@ -13,75 +13,108 @@ created: 2023-08-21
13
13
14
14
## Simple Summary
15
15
16
-
- Add opportunity cost (in FIL) to each miner actor creation to prevent the miner ID creation spam.
16
+
This proposal implements a deposit requirement for creating new miner actors to prevent unnecessary miner ID creation and potential network spam attacks.
17
17
18
18
## Abstract
19
19
20
-
By imposing a cost, this proposal helps prevent the spamming of creating miner IDs in order to:
20
+
By requiring a deposit when creating a new miner actor, this proposal addresses three key issues:
21
21
22
-
1) lighten the network chain storage burden
22
+
1. Reduces the network chain storage burden caused by inactive miner actors
23
+
2. Decreases resource waste and potential gas cost increases resulting from unused miner actors
24
+
3. Mitigates the risk of network congestion attacks where an attacker creates numerous low-cost miner actors
23
25
24
-
2) Prevent wasted resources and incremental increases in gas cost caused by wasted storage, and;
26
+
The deposit is calculated based on the initial pledge required for 10 TiB of storage capacity, and is vested over 180 days. This introduces an opportunity cost that discourages frivolous miner creation while allowing legitimate storage providers to recover their deposit over time.
25
27
26
-
3) Avoid an attack vector whereby an attacker sends a large amount of low cost `CreateMiner` messages, thus causing network congestion and destabilizing gas fees.
28
+
## Change Motivation
27
29
28
-
## Problem Motivation
30
+
In March 2021, the Filecoin network a [experienced spam attack](https://github.com/filecoin-project/FIPs/discussions/780#discussioncomment-6787043) where thousands of `CreateMiner` messages were sent at minimal cost. This resulted in increased base fees, congestion in the message pool, and reduced chain performance.
29
31
30
-
It [was documented](https://github.com/filecoin-project/FIPs/discussions/780#discussioncomment-6787043) that in March 2021, someone had spammed the network by sending thousands of CreateMiner messages. This caused several issues:
31
-
1) Base fee increases associated with mpool congestion
32
-
2) Redirect nodes away from producing blocks
33
-
3) Lower overall chain performance, specifically related to cron jobs overload
32
+
As of August 2023, statistics from FilScan showed that out of 601,131 total miner IDs, only 4,862 (0.8%) were actively being used. The trend of creating but not using miner IDs has continued, with only 3.7% of newly created miner IDs being activated in the two months prior to that analysis.
34
33
35
-
As of August 2023, according to FilScan statistics, there were 601,131 Miner IDs and only 4,862 actively in use. The actual ID usage counts for merely 0.8% of all existing Miner IDs, and the abuse of ID creation trend continues. In the previous two months, only 3.7% of all newly created Miner IDs (125 Miner IDs are active out of 3,254 newly created) were active.
Many users create multiple miner IDs to secure preferred IDs or favorable deadline schedules, consuming network resources without contributing value. Moreover, the absence of creation costs exposes the network to potential spam attacks that could cause congestion and disrupt important messages like WindowPoSt submissions from landing on-chain.
39
38
40
-
41
-
Users create multiple Minder IDs in order to get preferred IDs, wasting resources and unnecessarily burdening the network. Unused Miner IDs continue to occupy storage on the network. As time goes on, it is expected that the rate of wasted resources will increase, as will future gas prices.
42
-
43
-
Furthermore, allowing network participants to cheaply and easily create numerous accounts introduces a potential attack vector. Were participants to spam the network with CreateMiner messages, mpool congestion and unstable network fees could potentially affect more useful, critical, and/or time sensitive messages (i.e: SubmitWindowedPoSt, ReportConsensusFault, sector/data onboarding messages) from landing on chain.
39
+
## Specification
44
40
41
+
The proposal requires a deposit when creating a new miner actor:
45
42
46
-
## Specification
43
+
1.**Deposit Amount Calculation:**
44
+
- The deposit is based on the initial pledge required for storing 10 TiB (defined by `MINIMUM_CONSENSUS_POWER` constant)
45
+
- This amount is calculated using `StateMinerInitialPledgeCollateral`, which considers the current network economics
46
+
- As of March 2024, this amounts to approximately 62 FIL (10 TiB * 0.1958 FIL/32 GiB)
47
47
48
-
In creating a new Miner actor,
48
+
2.**Vesting Schedule:**
49
+
- The deposited funds are locked in the miner actor's vesting table
50
+
- The funds vest linearly over 180 days, similar to block rewards
51
+
- This creates an opportunity cost while ensuring the funds are eventually returned to the storage provider
49
52
50
-
- Currently: there is no cost associated with creating new miner actors other than the gas cost for the CreateMiner message, so users spam many new miner actors without limit
51
-
- Proposed:
52
-
Require transfer a certain amount of money to the miner's account as locked reward, and the amount of this money depends on the pledge required to reach the network's block production threshold.
53
+
3.**Implementation Behavior:**
54
+
- If insufficient funds are provided, the CreateMiner operation fails with an "insufficient funds" error
55
+
- If excess funds are provided, the required amount is locked and the remainder is available in the miner's balance
56
+
- The deposit is processed using the existing vesting mechanism rather than creating a new mechanism
53
57
54
58
## Design Rationale
55
59
56
-
Adding an opportunity cost will prevent such spammy behavior; moreover, depositing fees as locked rewards does not incur actual costs but will occupy funds and bring opportunity costs. Users need to weigh the opportunity cost of locking funds for 180 days per new miner actor. Also, the more miner actors created, the more funds need to be locked. This can prevent users from abusing miner actor creation. Additionally, this mechanism helps determine whether each new miner actor will be fully utilized since idle miners will waste locked funds in vain.
60
+
The design leverages the existing vesting mechanisms to minimize implementation complexity while creating sufficient economic friction to prevent abuse. By requiring a deposit that vests over time:
61
+
62
+
1. Users must evaluate whether a new miner ID justifies the opportunity cost of having funds locked for 180 days
63
+
2. The more miner actors a user creates, the more funds they need to lock, increasing the opportunity cost
64
+
3. The deposit is high enough to prevent spam attacks but low enough not to be prohibitive for legitimate storage providers
65
+
4. Using the vesting mechanism rather than burning funds ensures that legitimate providers eventually recover their deposit
57
66
58
-
## Backward Compatibility
67
+
This approach aligns incentives by encouraging the creation of miner actors only when they will be actively used, while not permanently removing capital from storage providers.
59
68
60
-
N/A
69
+
## Backwards Compatibility
70
+
71
+
This change is not backwards compatible as it introduces a new requirement for creating miner actors. However, it does not affect existing miner actors or their operations.
72
+
73
+
The deposit requirement applies to all new miner creations, including those for committed capacity (CC) sectors. While this creates an additional barrier to entry, the cost is relatively moderate compared to the hardware and operational investments needed to run a storage provider. Since the funds eventually vest back to the provider, this represents an opportunity cost rather than a capital cost.
61
74
62
75
## Test Cases
63
76
64
-
N/A
77
+
Test cases have been implemented to verify:
78
+
- Miner creation succeeds when sufficient balance is provided
79
+
- Miner creation fails with insufficient balance
80
+
- The deposit is correctly added to the vesting table
81
+
- The deposit vests over the correct period
82
+
- Tests have been updated to accommodate the new parameter in MinerConstructorParams
65
83
66
84
## Implementation
67
85
68
-
These changes have been implemented in this PR.
86
+
This proposal has been implemented in the following pull request to builtin-actors: https://github.com/filecoin-project/builtin-actors/pull/1398
1. Adds a `network_qap` parameter to MinerConstructorParams to calculate the deposit
90
+
2. Creates a new `calculate_create_miner_deposit` function that determines the required deposit
91
+
3. Locks the deposit in the miner's vesting table during construction
92
+
4. Updates tests to accommodate the new behavior
71
93
72
94
## Security Considerations
73
95
74
-
There is no security consideration for this proposal; instead, it helps to prevent potential attacks by using a large number of newly created IDs, and the scenarios of network congestion and instability of gas fees that are caused by unnecessary numerous ID creations.
96
+
This proposal improves network security by preventing spam attacks that could congest the network through mass miner creation. The implementation uses existing, well-tested mechanisms for handling vesting funds, minimizing the risk of introducing new vulnerabilities.
75
97
76
98
## Incentive Considerations
77
99
78
-
Charging for creating new accounts can help prevent abuse, reduce unnecessary storage, and avoid increased gas fees over time caused by such wasteful activities that burden the network with unnecessary storage; moreover, this change will be a moat against new SPs entering the Filecoin ecosystem, or existing SPs who want to scale their deployments horizontally instead of vertically (within the same miner_id).
100
+
The proposal creates incentive alignment by:
101
+
1. Discouraging the creation of miner actors that won't be used
102
+
2. Creating an economic cost for potential attackers
103
+
3. Encouraging storage providers to reuse existing miner IDs rather than creating new ones
104
+
4. Not permanently removing capital from legitimate providers, as the deposit eventually vests
105
+
106
+
The deposit amount is calibrated to be significant enough to deter spam but modest enough that it won't prevent legitimate storage providers from joining the network.
79
107
80
108
## Product Considerations
81
109
82
-
Currently, setting no cost for miner actor creation has no benefits but potential risks and drawbacks to the network, occupying the unnecessary storage will increase the network burden and future gas fees, also expanding the potential attack exposure. Therefore, By charging the creation miner actor fees and later either burning the creation fee or converting the fees to lock rewards will stop the abuse of ID creation since they would consider the worthiness of the opportunity cost if they do so. Moreover, this proposal guides or returns to the normal phenomenon that should supposed to exist - truly implement on-demand account creation, where new accounts are only created when they are actually needed for use, or newly created accounts are put into practical use.
110
+
From a product perspective, this change:
111
+
1. Reduces the creation of unused miner IDs, leading to a cleaner and more efficient network
112
+
2. Makes the network more resistant to spam attacks
113
+
3. Encourages on-demand account creation, where new miner actors are created only when needed
114
+
4. Discourages practices like creating multiple miners to get preferred IDs or deadline schedules
115
+
116
+
While this creates an additional step for new storage providers, the deposit eventually returns to them through the vesting mechanism, making it an opportunity cost rather than a permanent expense.
83
117
84
-
Since currently miners need to seal sectors exceeding the block production threshold in order to mine blocks, it is reasonable for miners to prepare and lock up at least the pledge required for these sectors. Moreover, the proposed first solution of converting fees to 180-day locked rewards adds no real capital cost, only opportunity cost. This encourages on-demand account creation, as users will create accounts based on actual needs, ensuring practical use of each new account.
85
118
## Copyright
86
119
87
120
Copyright and related rights waived via [CC0](https://creativecommons.org/publicdomain/zero/1.0/).
0 commit comments