Alex NorthThis report articulates motivations for Filecoin sector termination fees, notes some issues with the current design, and proposes new design goals.
- Motivation for termination fees
- Security ❌
- Client assurance ❌
- Stability of storage âś…
- Stability of pledge âś…
- Enforcing commitments ❌
- Network revenue ❌
- Summary of motivations
- Healthy termination levels
- Design goals
- Simplicity
- No protocol bias between sectors
Motivation for termination fees
It’s worth describing why we might want termination fees at all. Participants first need to reach alignment here if we want to later align on a mechanism or change.
In decreasing order of importance.
Security ❌
Termination fees play no role in proof-of-space or consensus security. We only require that a terminating sector pay at least one fault fee (so that termination can’t be used to escape a fault).
Client assurance ❌
fees may not be a sufficient disincentive to prevent storage providers from prematurely exiting storage deals
Clients may need storage providers to be subject to some disincentive to prematurely existing storage deals. The primary incentive to maintain deals is the fees (or QAP) for doing so, but additional stake can still be important.
A sector termination fee is not a good way of providing client assurance. Big reasons why are:
- it's not negotiable by the client, either higher or lower,
- it has big impacts on sectors that aren't carrying deals,
- we already have deal collateral as a somewhat negotiable (higher only) disincentive in the built-in storage market actor (see Free CommD: Unconstrained data applications on Filecoin).
With client interests in mind, surely it would also be much preferred to pay the fee to the client in the event of a deal agreement cut short. Client assurance is important, but applies only to data and would be far better left to the parties to negotiate.
The network could assert a level of minimum client assurance, a minimum termination fee that must apply to all arrangements with all clients. Perhaps there is some social good to be gained from this that can't be reached by the market (compare with a minimum wage law, and all associated uncertainty and controversy). If relevant, it shouldn't apply to CC sectors that provably have no data.
Stability of storage âś…
A sector termination fee is a disincentive to storage leaving the network, in that an SP in hard times may be better off maintaining an unprofitable sector than terminating it early. It's also a disincentive to storage entering the network, as an SP accounts for that lack of optionality, and some expected rate of termination due to operational errors, and/or probability of catastrophic event. Both of these can contribute to stability of the amount of storage committed: less onboarding, and what is onboarded is a bit stickier.
How valuable is stability of the storage commitments? Bitcoin has no exit fees, consequently volatile hashpower, but ... does this matter? There is probably some value here for the image of a storage network, even if it only affected CC. Stability will reassure potential clients. Some disincentive to exit is probably justified (but there might be alternatives to termination fee). This motivation does not justify any differential in termination fees for different sectors of the same size – if an SP is going to terminate a sector, it may as well be the least-profitable one to them, regardless of duration.
There might be a security angle to this stability too, raising the cost of a short-duration attack based on flash onboarding then exit of storage.
Stability of pledge âś…
Since pledge is attached to storage, the termination fee is equally a disincentive to un-staking locked collateral (and, similarly, to locking it in the first place). There is some value in stability here, adding friction to rapid changes in supply. A volatile supply is bad for image and might have more immediate effects on SPs too. Hard to quantify, but seems to justify some disincentive mechanism.
Pure staking networks typically address this with mandatory lock-up times or un-staking delays. Filecoin can't mimic these exactly because the un-staking is coupled to a real-world random event of proving storage (or failing to). A termination fee might be second best. Stake is fungible, so this would motivate termination fees proportional to pledge (which, unfortunately, varies between sectors).
Enforcing commitments ❌
Miners make a "commitment" (promise) to the network when pledging a sector, in return for block rewards, and breaking that promise should be met with a penalty. A larger commitment deserves a larger penalty when broken. This is the first reason that somewhat justifies the current design of scaling termination fee with a sector's duration (up to some limit).
This is a moralistic stance, very hard to argue without using words like "should". Blockchain protocol design is far better served by a dispassionate analysis of the incentives that are introduced, and we should (!) attempt to design those incentives to achieve mutually beneficial outcomes. There is no promise, there is only a cold business decision made in light of the protocol rules. Scaling termination fees with duration is a disincentive to long-duration sectors.
An alternative moralistic take on the situation is that a sector that has been online for a long time has done great service to the network. This demonstrated commitment to the network ought to be rewarded. There is zero damage done to the network if it terminates the epoch prior to meeting its "commitment" – why should we charge the highest possible termination fee? We should reduce it with duration instead! OTOH, an SP constantly onboarding and terminating sectors for very short terms is causing state churn, pledge and storage volatility, and probably has ill-intent – why should they get low termination fees?
The above take shouldn’t carry any weight either, but shows that that a moral take invites debate about "should" that can never be resolved by data or analysis. The incentives are what counts.
Network revenue ❌
Termination fees burn tokens, which is network revenue benefitting holders and already-committed SPs.
Earning revenue by increasing the costs of participation seems like a self-defeating strategy this early in the network's life.
Summary of motivations
- Stability of storage and pledge motivate some level of termination fee, trading off maximum participation levels for decreased volatility.
- Neither of those justify charging different fees based on duration committed or served, but maybe should include reference to heterogenous pledges.
Healthy termination levels
The global economy, the web3 ecosystem, and Filecoin have all suffered from harsh economic conditions for a significant period now. In such conditions, it’s not surprising if some participants (the least-efficient and/or least-aligned) are seeking to exit. Is it not healthy to let them?
An SP who wants to exit because they are losing money is not an aligned participant. The value of any rewards they earn will surely leave Filecoin's ecosystem. Economic value is being destroyed by keeping them running at a loss. If they have investors who are otherwise aligned with the ecosystem but treat this SP as a loss, operating the unprofitable operation is only reducing their ability to re-invest elsewhere.
Larger termination fees lock in unaligned participants for longer. This prevents their block rewards flowing to more efficient or optimistic participants. This in turn moves the most marginal of them closer to a decision to exit, and limits reinvestment potential of others, compared with the original SP being able to rationally exit. This may perversely cause a larger exit than otherwise, if the conditions persist. The fragility of individual sectors or SPs is a source of antifragility for the network as a whole. This is a motivation against any termination fees.
The healthy termination level is not zero. Perhaps its higher than 1/2e-05 per day (0.73% per year, higher than almost all of history) or even 1/3e-05 per day (1.1% pa, middle of CEL report’s projected scary red bars). Is there a principled reason to believe it should be lower? If those projections are in fact prophetic, is that actually worse than a system design that bottles-in smaller stresses but then suffers more badly with a larger shock?
This is orthogonal to client assurance. As discussed above deal assurance is better left to negotiation between the parties.
Design goals
I propose two design goals to consider if we're going to change anything.
Simplicity
The current termination fee mechanism is complicated. The calculations are complex, and the inputs required for those calculations consume chain state. Complexity makes this hard for participants to model, and hard for implementers to ensure correctness.
As a data point on this complexity, the description of the fee calculation in the CEL analysis is incorrect. The B(t) part is not the maximum of the initial or upgrade daily projections times the sector's age. It is the projection at upgrade times the duration since that upgrade, plus the projection at activation times the duration from activation until upgrade less the duration since upgrade, all capped at the 140-day duration. It's complicated to put in words, the code is the source of truth but is also complex and hard to understand.
The inputs to this calculation require three TokenAmount values to be stored on chain per sector, memoizing network conditions from onboarding and upgrade. I calculate this to require a little over 8 GiB of chain state today (3 * 8-byte (BigInts in atto-FIL) * 370k sectors) on every validator just to support this feature.
No protocol bias between sectors
Different sectors have different termination fees depending on the network conditions at they time they were onboarded. This distorts SP incentives about which sectors to terminate, if they are going to do so intentionally.
All sectors with the same QAP earn the same share of block rewards, and contribute the same storage capacity. An SP should be free to terminate whichever sector is least valuable to them. When other incentive systems are appropriately designed, this will also be the sector least valuable to the network. For example, if the SP has a client-paying deal in a sector, it is more valuable to them and the network, and should be least preferred to terminate. A higher-priced deal is in turn more valuable and less preferable to terminate.
The current mechanism of indexing termination fees to past network conditions means that sector termination fees vary independently of sector content. Sometimes a deal sector will have a lower termination fee than a CC sector, giving an SP a preference to terminate the deal. There are mechanisms like mandatory deal collateral to counter this, but the sector termination fee can work in opposition to all parties' interests. It is arbitrary with respect to sector utility.
The bias can be removed with a protocol that treats all currently active power as equal. The activation/upgrade epoch or age of a sector are not factors in the value of a sector to the SP or to the network.
(Note: a second protocol bias between sectors is varying pledge. The termination fee isn't indexed to pledge, though, so the termination-fee-to-pledge ratio also varies.)
A termination fee based only on the current network state would be simpler, cheaper, and remove an arbitrary protocol bias between sectors.