Alex NorthThe Filecoin Plus data cap mechanism has no notion of the term for which data cap, and hence the network-subsidised rewards, should be granted. Thus, when we remove technical limitations on the length or extensibility of deals, the FIL+ QA power boost will be indefinite.
Is this a design feature?
- If so we can exploit it to greatly simplify implementation and solve most of the Challenges with QA Power.
- If not, we need to restrict FIL+ data cap terms before the term-less nature becomes built-in to architecture, user contracts, SP expectations etc.
Original Slack thread (PL-only).
Background
A brief overview of how the Filecoin Plus verified data program works today.
- FIL+ notaries assign data cap to verified clients. Data cap is measured in bytes and is single-use.
- Clients make deals with the built-in storage market actor. A deal specifies a term (start and end epoch).
- A verified client may indicate that a deal has verified data. In that case, when the deal is activated the corresponding data cap is consumed, and the deal’s space-time contributes to the “quality” of the sector in which it’s stored, increasing its reward.
The built-in storage market actor implements a limited storage market, and is trusted by the FIL+ system to determine deal/sector quality.
- Sectors have a maximum lifetime, and the storage market implementation prohibits deals with a term that exceeds the sector’s commitment. Thus deals have bounded terms.
- There is no mechanism to transfer a deal (and hence its data cap quality) to another sector.
- Therefore there is no mechanism to extend a deal’s term.
The duration for which a FIL+ verified deal provides boosted rewards to a storage provider is thus limited by the deal term. The maximum deal term is in turn limited by the maximum sector lifespan for which we believe SDR PoRep is secure (i.e. an accidental reason totally unrelated to FIL+ economics).
Where we’re headed
- Inability to extend a deal is a shortcoming of the built-in storage market, and a top-requested enhancement. It could be implemented by allowing the deal’s data to be moved/added to a new sector with a farther-out expiration.
- Similarly, the market’s prohibition of a deal term that exceeds the expiration of the sector into which the data is first sealed is an unfortunate limitation of a simplified implementation.
- There’s no technical reason we can’t support indefinite deal terms.
- We plan to resolve these limitations with architectural changes that decouple the market actor from the miner and FIL+ actors, and open the platform for the development of alternative market implementations.
Implications
Therefore, in the rosy future, when a client makes deal they could specify an indefinite term, or extend definite terms forever. Thus the QA power it grants could also exist indefinitely (transferring to new sectors when necessary). In fact this might be the expected behaviour. If the provider charges no fee for FIL+ deals, why not select an indefinite term? Or if a fee is charged, a provider could buy the deal from the client at the end of its term, and extend indefinitely themselves.
A FIL+ data cap allowance has no term, it's "whatever the deal says". It may as well be forever.
This is a feature
A positive view of this is that it’s working just as intended. The Filecoin Plus program is incentivising the storage of valuable data on Filecoin and, for the most part, that value is independent of time. We want to store humanity’s public-good information forever.
Upon realising this, we can greatly simplify the implementation of quality-adjusted power. Today, a sector’s quality depends on the term of the deals which it holds, and reaches the 10x maximum only if the deal term exactly matches the sector’s lifespan. But the sector is storing the valuable data for its entire lifespan, regardless of the deal term.
If FIL+ is supposed to reward the storage of valuable data, why do we care about the terms of a deal with some client who is (maybe) also paying a bit? When the deal is “free”, mismatches between a deal term and sector term are essentially accidents of imperfect cooperation. If optimally coordinated, the client/provider could arrange for a perfect lifespan match of both start and end epoch. With deal extension they could perfectly roll into new sectors indefinitely.
So why not just give the miner the full 10x boost all the time, regardless of the deal term?
FIL+ is about whether the data is valuable, not about how long it's contracted to store for. So if it's being stored, we should reward it. That means giving the provider the power boost for exactly as long as they are provably storing the data (i.e. the sector lifetime), regardless of whether there happens to be a client.
Who cares? This would solve almost all the Challenges with QA Power that the ‣ proposal is trying to solve, but in a much simpler way. Sector storage would be come update-able (rather than write-once), with a simple QA-power recalculation when verified data is added or removed.
This is a bug
Alternatively, one could view this as a problem with the Filecoin Plus implementation. This view says that verified data does have a lifetime, and that once deals become flexible enough that we can no longer use deal term as a proxy for the SDR sector lifetime as a bound, we need to implement something else.
Resolution of this would mean clients must specify a reward term when spending data cap on a deal. The reward term need not match their deal term, but must be specified separately so it can be enforced even if the deal is extended or changes hands.
Adding a term limit to data cap would retain the challenging QA-power recalculations, so something like FIL+ Premium would still be required in order to unlock update-able sector storage.
Discussion
@Alex North I quite like the indefinite nature of data cap, now that I see it. Data won’t really be locked forever, but only until the QA-power reward boost falls below the [opportunity] cost of storing the data for free. But it provides a great “forever” narrative anyway.
Juan’s first impression upon hearing this was more on the “bug” side, since the QA power is a powerful network resource. It could make handing out large amounts of data cap more risky. Suggested there should probably be term limits, perhaps set by notaries, maybe renewable.
@ToBeRemoved Note that to the extent we want to keep FIL+ I am heavily biased towards the feature over bug worldview. It seems like the only justification for a FIL+ program with longevity beyond an early network bootstrapping hack. If this is 100% a bug it means that FIL+ data is only valuable in the context of an agreement between provider and client: i.e. FIL+ really is just a regular storage market with a bad, indirect payout mechanism through power. It will always come back to the question: why not just pay FIL for the data?
If this is a feature there are some big questions to answer. In its most raw form with value tied to content this means that every sector containing a verified deal gets indefinite QAP from it. Is this something we want? Or would we rather take away some potency from the idea and make these deals pay out only to the first sector that includes them. After that sector expires is the verified deal available for inclusion again? Is the list of verified content CIDs append only or can they be removed? In its most raw form content-only dependent properties don’t change with time, so it should be append only. When a deal is verified it is the verified-data oracle declaring discovery of valuable data, analogous to posting the data from resolving a hash pointer.
The degree to which the FIL+ registry keys are not a perfect oracle of data value matches the degree of danger in fully buying into FIL+ forever as a feature. If they are perfect at finding valuable data then its ok for all sectors to get power boost forever for including a verified deal. If they make frequent mistakes or are likely to runaway and mint tons of bad data cap then limiting the scope of verified deal power is important.