specs-actors Master Tracking

This document tracks:

• Open items that need attention from specs-actors devs: [Open Items]
• Current schedule and objectives [Schedule]
• Ongoing initiatives to understand and document specs-actors behavior: [Documentation]
• Ongoing initiative to come up with scenario tests: [Scenario Testing]
• Items that have been addressed and no longer require attention from specs-actors devs: [Addressed]

Contents

• specs-actors Master Tracking
  • Contents
  • Open Items (Needs Action)
    • Uncategorized
    • P1
    • P2
    • P3
    • Discussions
    • Items with open PRs
    • Scenario Testing
    • Other tests
  • Schedule
    • Phase 1 (pre-testnet)
    • Phase 2 (pre-mainnet)
    • Limitations
  • Documentation
    • Singletons
    • Instanced
  • Addressed (No Action Required)
    • Addressed via PR
    • Issue closed

Open Items (Needs Action)

This section lists any open issues we're tracking. Issues are sorted into sub-sections following specs-actors priority label conventions (P1 / P2 / P3).

• Issues that have not been given a label are listed under Uncategorized
• Issues that have an associated open PR are listed under Items with open PRs
  • Once PRs have been merged, they're removed from this section and tracked in Addressed
• Discussion-based issues are tracked in Discussions
• Proposals for scenario tests are tracked in Scenario Testing

For all sub-sections, issues are appended in order of ascending issue number.

Uncategorized

• Reward: Check miner code CID
  • Issue: specs-actors/#1090
• Market.PublishStorageDeals griefing vector
  • Issue: specs-actors/#1144

P1

Empty!

P2

• ConfirmSectorProofsValid: batch VerifyDealsOnSectorProveCommit
  • Issue: specs-actors/#904
  • Issue: specs-actors/#474
• Simplify cron queue handling in power and market actors
  • Issue: specs-actors/#751
• Power.OnEpochTickEnd: preempt Miner queries to Power and Reward
  • Issue: specs-actors/#799
• Miner.Constructor: Additional input validation
  • Issue: specs-actors/#807
• Miner: Drop precommits from prove commit set if power/pledge/reward values aren't sane
  • Issue: specs-actors/#913
• Miner: ExtendSectorExpiration doesn't correctly check AddressedPartitionsMax
  • Issue: specs-actors/#931
• Where applicable, enforce uniqueness when handling slices
  • Issue: specs-actors/#979
• Miner/Market: Clean up deal weight calculation during precommit
  • Issue: specs-actors/#981
• Miner: Cleanup accounting methods
  • Issue: specs-actors/#1006
• Miner: VerifyPledgeRequirementsAndRepayDebts should return balance available after paying debt
  • Issue: specs-actors/#1020
• Add log messages for significant events
  • Issue: specs-actors/#1060
• Miner: Check Partition invariants
  • Issue: specs-actors/#1068
• Miner: Check Deadline invariants
  • Issue: specs-actors/#1070

P3

• StorageMarket: Refund clients remaining balance since sector became faulty on termination
  • Issue: specs-actors/#694
  • Issue: specs-actors/#667
• Reward: Initialize penalty directly with the min value
  • Issue: specs-actors/#696
• Recommendation: Standardize power/market cron method names
  • Issue: specs-actors/#721
• PaymentChannel.Collect: Switch to "pull" payment pattern rather than "push" payments
  • Issue: specs-actors/#732
• Miner: Simplify sector number allocation during precommit
  • Issue: specs-actors/#905
• Power.CreateMiner does not allow caller to initialize Miner's ControlAddresses
  • Issue: specs-actors/#980
• Miner: Unlock vested funds in SubmitWindowedPoSt
  • Issue: specs-actors/#1002

Discussions

• Miner: NewDeadlineInfo may calculate negative Challenge and FaultCutoff epochs during first ~70 epochs
  • Issue: specs-actors/#805

Items with open PRs

Items are added in order of ascending PR number.

Empty!

• [specs-actors/#1129] prevent faults from double subtracting cc upgrade power
  • Miner: Declaring a replaced CC sector faulty can result in a sector existing in an expiration queue twice
    • Issue: specs–actors/#1100

• [specs-actors/#1140] Add assertion that expiration set is valid
  • Miner: Check ExpirationSet invariants
    • Issue: specs-actors/#1064

Scenario Testing

Scenario tests are being tracked in this document: https://hackmd.io/@-HV50kYcRqOjl_7du8m1AA/rk9_hCMfv

• Miner Alice adds and proves a CC sector

Other tests

During review, I came up with a few final tests that should be implemented (some may already exist). Here they are, somewhat categorized:

Unproven sectors

• Declare an Unproven sector faulty, then recover it
• Terminate an unproven sector

Expirations / Fault max age

• Declare a fault for a sector with on-time expiry < fault max age, then attempt to extend its expiration
• Declare a recovering sector (with rescheduled expiry < fault max age) faulty
• Miss a PoSt for a sector with on-time expiry < fault max age
• Submit a PoSt that "skips" a sector with on-time expiry < fault max age
• Terminate a faulty sector with on-time expiry < fault max age
• Submit a PoSt for a sector expiring in CurrEpoch, then extend its expiry in the same epoch
  • The same as above, but "extend" its expiry to the same epoch (ExtendSectorExpiration allows 0-epoch extensions)
• Expiries are processed by handleProvingDeadline, so they may exist un-processed for up to 1 day after their on-time expiration before being picked up by cron. Tests for these sectors:
  • Declare it faulty
  • Submit a PoSt for it
  • Terminate it
  • Extend its expiry

Misc

• Declare a recovering sector faulty
• "Skip" a sector during PoSt, but terminate it before cron picks it up

Schedule

This section outlines the current schedule and objectives for the assessment phase.

Phase 1 (pre-testnet)

Phase 2 (pre-mainnet)

Limitations

I'm going to use this section to keep track of things I don't think I will have time to review in as much detail as I'd prefer.

This section will only speak to things that are technically within scope (as defined here).

• Unit tests
  • Efficacy of current unit tests (do tests actually test the things they purport to)
  • Coverage of current unit tests
• Miner
  • Deadline assignment
  • Epoch quantization
  • CompactPartitions

Documentation

Up-to-date with commit: c9027ee

Singletons

Instanced

Addressed (No Action Required)

Addressed via PR

• [specs-actors/#588] Multisig: Resolve address before comparing
  • Multisig: Comparison between different Address types.
    • Issue: specs-actors/#587
• [specs-actors/#620] Market: Persist updates to state in CronTick
  • StorageMarket: Deal States update not persisted in CronTick
    • Issue: specs-actors/#606
• [specs-actors/#639] Market: Use ReadOnly transaction for ComputeDataCommitment
  • StorageMarket: ComputeDataCommitment should use ReadOnly, rather than Transaction
    • Issue: specs-actors/#607
• [specs-actors/#644] Market: Should delete pending deals in CronTick and delete them ONLY once
  • StorageMarket: CronTick doesn't persist Proposal deletion from st.PendingProposals
    • Issue: specs-actors/#643
• [specs-actors/#646] Payment Channel: Sign data should include channel address
  • PaymentChannel: vouchers can be replayed across channels
    • Issue: specs-actors/#612
• [specs-actors/#647] Market: Load Proposals AMT only once
  • StorageMarket: CronTick loads identical AMT for each processed deal
    • Issue: specs-actors/#609
  • StorageMarket: ComputeDataCommitment loads identical AMT for each passed-in DealID
    • Issue: specs-actors/#608
• [specs-actors/#684] Market: More tests and fixes
  • StorageMarket: delete pending deals on init timeout
• [specs-actors/#714] Assert that payments are non-negative
  • PaymentChannel.UpdateChannelState: Require that signed vouchers have a non-negative "amount"
    • Issue: specs-actors/#731
• [specs-actors/#718] Market: Caller for withdraw must be the recipient
  • StorageMarket: market withdraw allows anyone to trigger withdrawals
    • Issue: specs-actors/#602
• [specs-actors/#758] VerifReg: Audit Fixes
  • Verifreg: Disallow RootKey from assuming other roles
    • Issue: specs-actors/#722
  • Verifreg.AddVerifier: params.Allowance should be greater than or equal to MinVerifiedDealSize
    • Issue: specs-actors/#724
  • Verifreg.AddVerifiedClient: Existing Verifiers should not be allowed to become VerifiedClients
    • Issue: specs-actors/#725
  • Verifreg.AddVerifiedClient: Misleading parameter "MinVerifiedDealSize"
    • Issue: specs-actors/#726
  • Verifreg.UseBytes: Consider never deleting a VerifiedClient entry
    • Issue: specs-actors/#728
• [specs-actors/#760] Market: Audit fixes
  • StorageMarket.PublishStorageDeals: Check that deals' provider has Miner CodeCID before query
    • Issue: specs-actors/#754
  • StorageMarket.PublishStorageDeals: Validate each deal's PieceSize
    • Issue: specs-actors/#755
• [specs-actors/#775] Market: Audit fixes
  • Market State.dealGetPaymentRemaining: Bad assertion allows for panic
    • Issue: specs-actors/#765
  • Market.CronTick: Branching statements imply potential abort
    • Issue: specs-actors/#766
  • Market.CronTick: Remove RequireSuccess for interaction with Verifreg and BurntFundsActor
    • Issue: specs-actors/#767
  • Market.AddBalance creates balance table entries when provided 0 value
    • Issue: specs-actors/#771
• [specs-actors/#778] Payment: Audit and fixes
  • PaymentChannel: reject equal-nonce voucher submissions
    • Issue: specs-actors/#660
• [specs-actors/#789] Fix deadline index check
  • Miner: Incorrect bounds on SubmitWindowedPoSt params.Deadline
    • Issue: specs-actors/#753
• [specs-actors/#790] Payment: Remove actor for collect
  • PaymentChannel.Collect: Clarify whether Collect implies the channel should be terminated
    • Issue: specs-actors/#733
• [specs-actors/#791] StoragePower: OnConsensusFault incorrectly zeroes out miner power
  • StoragePower: OnConsensusFault incorrectly zeroes out miner power
    • Issue: specs-actors/#692
• [specs-actors/#808] Feat/ip no vest
  • Miner: Duplicate invocations of notifyPledgeChanged in processEarlyTerminations
    • Issue: specs-actors/#752
• [specs-actors/#820] Allow up to the max sector number in precommit
  • Miner.PreCommitSector: Conflicting MaxSectorNumber checks
    • Issue: specs-actors/#798
• [specs-actors/#830] Fix: StoragePower: Incorrect assignment to Cid fields during construction
  • StoragePower: incorrect assignment to Cid fields during construction
    • Issue: specs-actors/#653
• [specs-actors/#862] AwardBlockReward validates params, better tests
  • Reward: Check if AwardBlockReward param.Penalty is greater or equal to zero
    • Issue: specs-actors/#697
• [specs-actors/#890] Reward Actor: Do not abort on sending funds to the miner
  • Reward.AwardBlockReward: Miner may be able to cause abort during block processing
    • Issue: specs-actors/#797
• [specs-actors/#902] Handle a pending key change that has been replaced
  • Miner.ChangeWorkerAddress: Handle a pending change already exists
    • Issue: specs-actors/#802
• [specs-actors/#912] Multisig: State should ONLY have ID address -> create accounts if they do NOT exist
  • Multisig, verifreg, paych actors create accounts that don't already exist
    • Issue: specs-actors/#730
• [specs-actors/#919] avoid prove commit aborts when sector lifetime <= 0
  • Miner: Sector activation at ProveCommit may allow proving expired/expiring sectors, leading to panic during cron tick
    • Issue: specs-actors/#795
• [specs-actors/#924] Small cleanups
  • Deadline: Avoid modifying ExpirationsEpochs if there are no rescheduled partitions
    • Issue: specs-actors/#916
  • Miner: Reconcile differences in pledgeDelta arithmetics
    • Issue: specs-actors/#917
• [specs-actors/#939] VerifReg: Resolve Verifier and Client Addresses
  • Verified Registry needs to resolve addresses
    • Issue: specs-actors/#729
    • Issue: specs-actors/#566
  • Multisig, verifreg, paych actors create accounts that don't already exist
    • Issue: specs-actors/#730
• [specs-actors/#940] Payment Channel: Create ID accounts if they do not exist
  • Multisig, verifreg, paych actors create accounts that don't already exist
    • Issue: specs-actors/#730
• [specs-actors/#984] Miner: Limit max number of partitions per deadline
  • Miner: Limit max number of partitions per deadline
    • Issue: specs-actors/#945
• [specs-actors/#998] Miner: Limit control addresses
  • Miner: Limit size of ControlAddresses slice
    • Issue: specs-actors/#977
• [specs-actors/#1004] IP accounting refactor
  • Miner: Treat initial pledge like precommit deposits
    • Issue: specs-actors/#1007
  • Miner.PenalizeFundsInPriorityOrder: account for fromVesting greater than target
    • Issue: specs-actors/#1003
• [specs-actors/#1009] Refactor deadline handling
  • Miner: reduce operations performed in handleProvingDeadline where possible
    • Issue: specs-actors/#983
• [specs-actors/#1042] Explicitly specify whether or not faults were added in RecordSkippedFaults
  • Miner: If a PoSt submission skips ONLY unproven sectors, the partition is not added to the deadline's ExpirationsEpochs
    • Issue: specs-actors/#1040
• [specs-actors/#1050] Remove change worker cron and add confirm update worker key method
  • Miner: Remove ChangeWorkerAddress reliance on cron
    • Issue: specs-actors/#982
  • Limit Miner.ChangeWorkerAddress to avoid cron event queue load
    • Issue: specs-actors/#806
• [specs-actors/#1073] swap order of batch proof verifies and deferred cron events
  • Power: Process batch proof verifications before deferred cron events
    • Issue: specs-actors/#909
• [specs-actors/#1089] abort consensus fault reports when miner is already under fault
  • Miner: Verify that duplicate submissions of consensus faults are not processed
    • Issue: specs-actors/#1008
• [specs-actors/#1092] Feat/delete miner claim after cron failure
  • Power: Explicitly delete miner claim on failing cron callback
    • Issue: specs-actors/#1056

Issue closed

• Verifreg.UseBytes: newVcCap is permanently lost if it's smaller than MinVerifiedDealSize
  • Issue: specs-actors/#727
• Power.OnConsensusFault: Assert pledgeAmount is non-negative
  • Issue: specs-actors/#764
• Miner.ReportConsensusFault: possible incorrect constraints on faultAge
  • Issue: specs-actors/#801
• Miner control functions should abort on no-op
  • Issue: specs-actors/#803
• Miner control functions should abort for empty params
  • Issue: specs-actors/#804
• Miner: Remove references to variable seal proof types
  • Issue: specs-actors/#903
• Miner: bubble up error in processEarlyTerminations
  • Issue: specs-actors/#918
• Miner: Remove state.Transaction where not needed
  • Issue: specs-actors/#955
• Miner: Correct for potential overflow when iterating over multiaddresses
  • Issue: specs-actors/#978