Mathematical Model of FIP-047 Incentives

# Mathematical Model of FIP-047 Incentives **Tom Mellan, Shyam Sridhar, Juan Pablo Madrigal Cianci** ### Sector level model #### Terminology • $t_{0}$: time of bug discovery • $\tau$: duration from $t_{0}$ during which reseal is allowed • $t_{\text{rs}}$: time to reseal • $T$: time of sector commitment expiration • $\mathbb{E}\left[R_{t}\right]$: expected daily reward • $p_{t}$: pledge top-up to enable reseal if new pledge is higher • $\gamma^{\text{I}}$: pdf of resesal times in scenario I • $\gamma^{\text{III}}$: pdf of resesal times in scenario III • $\Gamma^{\text{III}}$: cdf of resesal times in scenario III • $P^{\text{machine}}$: penalty associated with machine reseal constraint • $\lambda^{\text{machine}}$: parameter setting the strength of the machine reseal constraint • $P^{\text{gas}}$: penalty associated with block space availability • $\lambda^{\text{gas}}$: parameter setting the strength of the block space reseal constraint ### Scenarios Three scenarios are of interest: • I: reseal • II: no-reseal • III: terminate then reseal Each scenario can be scored by a utility function which says how favourable it is for the sector to take this pathway. ### Scenario utilities In the first instance the expected utility function scores future daily expected rewards per 32GiB sector accrued from the time of bug discovery $t_{0}$ to the expiration of the sector commitment $T$, less additional pledge required to reseal, with time of reseal distributed as $\gamma^{\text{I}}(t_{0},\tau)$, less the expected penalty contributions arising from machine $P^\text{machine}$ and blockspace $P^\text{gas}$ constraints: $$ U^{\text{I}}(\tau,T):=\sum_{t>t_{0}}^{T}\mathbb{E}\left[R_{t}\right]-\gamma^{\text{I}}\left(p_{t}+P^{\text{machine}}(\tau,t;\lambda^{\text{machine}})+P^{\text{gas}}(\tau;\lambda^{\text{gas}})\right) $$ In the second case sector choses not to reseal. The sector generates rewards for as long as possible: \begin{align*} U^{\text{II}}(\tau,T):=\sum_{t>t_{0}}^{t+\tau}\mathbb{E}\left[R_{t}\right]-90\,\mathbb{E}\left[R_{t_{0}+\tau}\right]\ \end{align*} which is until reseal is forced, and there are no gas or resealing constraints but instead a instead a termination is fee levied after the last day the proof is valid for. In a third case, a sector earns rewards up to proof validity, recieves a termination penalty, then seals again: \begin{align*} U^{\text{III}}(\tau,T) & :=\sum_{t>t_{0}}^{t+\tau}\mathbb{E}\left[R_{t}\right]-90\,\mathbb{E}\left[R_{t_{0}+\tau}\right]+\\ & +\sum_{t+\tau}^{T}\mathbb{E}\left[R_{t}\right]\Gamma^{\text{III}}-\gamma^{\text{III}}\left(r_{t}+P^{\text{machine}}(\tau,t;\lambda^{\text{machine}})+P^{\text{gas}}(\tau;\lambda^{\text{gas}})\right) \end{align*} Some time $\gamma^{\text{III}}(\tau,T)$ after the penalty, the sector reseals, paying a pledge difference if applicable, and begins aquiring rewards distributed as $\Gamma^{\text{III}}(\tau,T)$ which is the cdf of $\gamma^{\text{III}}(\tau,T)$. To start with, we consider the resesal time to be a single day $t_0+t_\text{rs}$: \begin{align*} \gamma^{\text{I}}(\cdot)=\delta_{t,t_{0}+t_{\text{rs}}} \end{align*} More broadly this can be promoted form a Kronecker point to an arbitrary distribution with the correct support rather than a single point.  #### Machine availability constraint The distribution of sectors that will aquire penalties through not being able to reseal due to machine constraints is modeled as \begin{align*} S(\tau;\lambda^{\text{machine}})=1-\int_{0}^{\tau}\text{Exponential}(u;\lambda^{\text{machine}})du\,, \end{align*} where \begin{align*} \text{Exponential}(u;\lambda)=\frac{1}{\lambda}e^{-\frac{u}{\lambda}}\,. \end{align*} The parameterisation (value of $\lambda$) depends on the sealing throughput of the network. While this is unknown, we can anchor our assumptions with some data by noting that network sealed approximately 13 EiB rawbyte in 12 months, and is now around 17 EiB. This corresponds to around three quarters of the network to be re-sealable within a year. Furthermore, we might expect that the latent sealing capacity of the network is larger than this: i) for initial sealing, machine capacity is not the only limitation, so it may give a lower bound upon resealing, and ii) resealing machine capacity may increase as a response to avoid termination. In any case we must acknowledge the limitations of our current insight on this point. We therefore simply set $\lambda=1/2$, which gives 98% reseal within 2y, 86% within 1y, 37% within 6m, and 15% within 1m, following this distribution: ![](https://i.imgur.com/Bv2WnuL.png) To define the per sector machine penality $P^{\text{machine}}(\tau)$, we model this as the sealing distribution times the penalty of missing sealing: \begin{align*} P^{\text{machine}}(\tau,t;\lambda^{\text{machine}}):=90\,\mathbb{E}\left[R_{t}\right]\,S(\tau;\lambda^{\text{machine}}) \end{align*} where $\mathbb{E}\left[R_{t}\right]$ is the expected daily minting reward per unit sector. #### Block space constraints The degree to which block space is an actual constraint depends on capacity to aggregate proofs effectively. In typical sealing, aggregation is under used. In emergency resealing, we might expect higher levels of aggregation --- up to 816 proofs --- across much more of the network. However it's likely that resealing is rate-limited by machine constraints, in the sense it is not optimal to aggregate reseals in maximum size batches just to minimize gas. If is may be better to batch in smaller sizes, accept higher marginal gas costs, but start earning again on the resealed sector earlier. However, this depends on the mechanics of the reseal strategy, and the extent to which the SP can decouple resealing process from the continuation and cessation of sector earning to optimise gas costs. We model block space availability, for reseal within $\tau$, as \begin{align*} P^{\text{gas}}(\tau):=\frac{365\mathbb{E}\left[R_t\right]}{10}\left(1+\frac{365\lambda^{\text{gas}}}{\tau}\right) \end{align*} where $\lambda^{\text{gas}}$ is parameter setting the strength of the block space constraint. This is given a default value of $1/2$, which corresponds to block space under 1 year resealing ($\tau=365$ days) being 1.5x as costly as normal chain operation. In the case of unlimited time to reseal, $P^{\text{gas}}(\tau)$ tends to the $\frac{365\mathbb{E}\left[R_t\right]}{10}$, which is approximately the cost of sealing under normal chain operating conditions (currently). ### Network level model #### Terminology • $s_{0}$: time the sector was initially sealed • $t_{0}$: time of bug discovery • $\tau$: duration from $t_{0}$ during which reseal is allowed • $t_{\text{rs}}$: time at which reseal happens • $T$: time of sector commitment expiration • $\mathbb{E}\left[R_{t}\right]$: expected daily reward • $QAP(t)$: quality-adjusted power at time t • $\mathcal{L(t)}$: pledge cost at time t • $p_{t}$: pledge top up to enable reseal if new pledge is higher • $\gamma^{\text{I}}$: pdf of resesal times in scenario I • $\gamma^{\text{III}}$: pdf of resesal times in scenario III • $\Gamma^{\text{III}}$: cdf of resesal times in scenario III • $P^{\text{machine}}$: penalty associated with machine reseal constraint • $\lambda^{\text{machine}}$: parameter setting the strength of the machine reseal constraint • $P^{\text{gas}}$: penalty associated with block space availability • $\lambda^{\text{gas}}$: parameter setting the strength of the block space reseal constraint • $\alpha$: proportion of fake power contributed by the sector due to the faulty PoRep bug ### Scenarios We continue to consider the previously mentioned three scenarios: • I: reseal • II: no-reseal • III: terminate then reseal For each scenario, we develop a network utility function which describes the effect the decision of an SP has on the network (in terms of storage and token flow) ### Scenario utilities For the first scenario, the total utility to the network would essentially be composed of three major components: - The difference in the pledge costs between when the sector was initially sealed and when the sector is resealed: The former is taken out of the network by the SP, and the latter is added to the network as collateral by the SP - The proportion of rewards earned by contributing fake power to the network. Given a bug in the PoRep algorithm, SPs can explot this bug to contribute fake power to the system, thus, depending on the severity of the bug a proportion of the power an SP contributes to the network can be fake power - Machine and blockspace constraints Mathematically, the network utility wold look something like: $$ U_\text{net}^{\text{I}}(\tau,T, t_{\text{rs}}):= \\ - \mathcal{L(s_{0})} - \gamma^{\text{I}}\left(P^{\text{machine}}_{\text{net}}(\tau,t;\lambda^{\text{machine}})+P^{\text{gas}}_{\text{net}}(\tau;\lambda^{\text{gas}}) - \mathcal{L}(t_{\text{rs}})\right) - \alpha\sum_{t=s_{0}}^{t_{\text{rs}}}\mathbb{E}\left[R_{t}\right] $$ In the second case, the utility to the network would comprise of: - The pledge value when the sector was initially sealed, which is taken away from the network as a security collateral - The proportion of rewards earned by contributing fake power to the network till the proof/sector expires - The termination fee that the miner has to pay which is a way in which block rewards as a collateral is realised in practice \begin{align*} U_\text{net}^{\text{II}}(\tau,T, t_{\text{rs}}):= 90\,\mathbb{E}\left[R_{t_0 + \tau}\right] - \mathcal{L(s_{0})} - \alpha\sum_{t=s_{0}}^{t_{0} + \tau}\mathbb{E}\left[R_{t}\right] \end{align*} There is no machine and block space constraints, or any added pledge that the SP provides as collateral to the network In the third case, the network utility resembles closely, the network utility we derived in the first case with the following differences: - The proportion of rewards earned by contributing fake power to the network is summed up to the point till the proof expires - There is an added component of the termination fee which is paid by the miner when they initially close the sector $$ U_\text{net}^{\text{III}}(\tau,T, t_{\text{rs}}):= \\ - \mathcal{L(s_{0})} - \gamma^{\text{III}}\left(P^{\text{machine}}_{\text{net}}(\tau,t;\lambda^{\text{machine}})+P^{\text{gas}}_{\text{net}}(\tau;\lambda^{\text{gas}}) - \mathcal{L(t_{\text{rs}})}\right) \\ - \alpha\sum_{t=s_{0}}^{\tau}\mathbb{E}\left[R_{t}\right] + 90\,\mathbb{E}\left[R_{t_{0}+\tau}\right] $$ $\gamma^{\text{I}}(\cdot)$, $\gamma^{\text{III}}(\cdot)$, and $\Gamma^{\text{III}}(\cdot)$ continue to follow the same distribution as described in the SP model #### Model constraint We model our constraint penalites in the network model as opportunity cost to the network from the miner failing to reseal their sector due to these constraints In this iteration of the network model, we assume that the distribution of sectors that will are not able to reseal due to machine constraints = $S(\tau;\lambda^{\text{machine}})$ which was previously defined in the SP model - Since, blockspace constraints would ultimately just result in higher gas costs, it is unlikely that they would contribute to sector termination - Thus blockspace constraints would be negligible in such a scenario To define the per sector constraint penality to the network $P^{\text{machine}}_{\text{net}}(\tau) + P^{\text{blockspace}}_{\text{net}}(\tau)$, we model this as the sealing distribution times the losses (opportunity costs) incured to the network due to the sector missing sealing: \begin{align*} P_{\text{net}}(\tau,t;\lambda) := (\mathbb{E}\left[\mathcal{L(t)}\right]\ - 90\mathbb{E}\left[R_{t}\right]) \times S(\tau;\lambda) \end{align*} where $\mathbb{E}\left[\mathcal{L(t)}\right]$ is the expected value of the pledge that would have been added as collateral to the network, if the sector was resealed and $\mathbb{E}\left[R_{t}\right]$ is the expected daily minting reward per unit sector ## References * [Sector-level model for timing](https://github.com/protocol/CryptoEconLab-private/blob/qm-expansion/notebooks/FIP-0047/FIP-0047-sector-model_improved-constraints.ipynb) * [Sector-level model varying termination fee](https://github.com/protocol/CryptoEconLab-private/blob/qm-expansion/notebooks/FIP-0047/FIP-0047-sector-model_improved-constraints_termination-fee.ipynb) * [Network-level model](https://github.com/protocol/CryptoEconLab-private/blob/qm-expansion/notebooks/FIP-0047/FIP_047_network_improved_constraints.ipynb) * [Initial CEL analysis](https://hackmd.io/@-e2UbSEIRjClRu9Dz4XIQw/S1yAmIGgi) * [Proof Expiration & PoRep Bug Policy Notion](https://pl-strflt.notion.site/Proof-Expiration-PoRep-Bug-Policy-FIP-0047-9c661735caa449d28df98e948b244ab0) * [Separation of ProofExpiration and CommitmentExpiration](https://pl-strflt.notion.site/Separation-of-ProofExpiration-and-CommitmentExpiration-3ef75856e0c94fc3855abbfd15aeffe0)