Notary incentives

[dkkapur]

Kicking off a discussion topic to start ideating on notary incentives.

Some prior context:

• Modification: Large Dataset Notary Process - Reducing time to DataCap for LDN #217
• Proposal: Project Beacon - 11.8 PiB Data Set / 60 PiB DataCap #564

[dkkapur]

Two broad categories of incentives: Social Incentives and Financial Incentive

Social incentives

• reputation in the network, as a notary, etc. (e.g., http://filplus.dev/)
• ability to influence the program

Financial incentives

• FIL, i.e., FIL bounty/grant/payout based on performance of a notary
• Something else monetary, i.e., revenue sharing or different currency

[kernelogic]

Social incentives have always been available.

Financial incentive, maybe both client and notary should be considered - both putting in the work.

[jhookersyd]

We need Financial + Social incentives for notaries.

The notary FIL staking amount needs to be a large enough reward for other notaries to care for and fund checking multi-petabyte datasets.

[dkkapur]

Proposal from @jhookersyd #564 (comment)

For projects above 1PiB, I would:-

Choose 6 notaries at random from a global pool, 4 of the 6 notaries need to sign off the project for the Data cap allowance to be approved
Notaries can't know each other at any time during the sector lifecycle
Give Notaries 1% of the project's FIL block reward. 5PiB raw data/5 Copies = 1% of 25PiB block reward
Make Notaries stake 3% of 25PiB in FIL to have skin in the game
If one notary finds fraudulent data, the 9% FIL staked from the other three Notaries goes to that exceptional notary
100% of the lead SPs sectors are terminated if they onboarded fraudulent data

[cryptowhizzard]

This sounds like a really good start

[dkkapur]

One topic I've been thinking about is how we can introduce notary roles within the lifecycle of an application. Specifically, for any application, there are:

• one or more notaries heavily in favor of getting DataCap to a client
• one or more notaries OK going along with it given others have done deeper due diligence
• one or more notaries abstaining
• zero or more notaries against giving DataCap to the client

Similar to what @jhookersyd has mentioned above, I have been loosely sketching up a model where:

• every application has at least one main supporting notary, staking with the intent of bringing attention to the application and being the champion for it. this notary may also be involved in the BD side.
  • if DataCap is allocated and used "well", they get rewarded
  • if not, they lose their stake / some portion of it
• every application has at least one due diligence (DD) notary, with a reduced stake and reduced upside
• every application may have notaries that stake against it, but the allocation can still go through if there is enough support from the sets above

[jhookersyd]

We need to pay and make notaries stake in line with the % of block rewards they will create.

Reputation systems have weak game theory mechanics for the value creation on the line. Why do SPs adhere to PoSt? Because value loss is the ultimate stick.

"Maybe escrow wallets with the FVM to hold the funds till the end of the sector lifecycle?" = Perfect! Could also use a Multisig controlled by the 4 notaries and 1 root key holder for oversight.

We need the SPs to feel the pain if they store dunny data... They need to lose 100% of their sectors.

The loss needs to outweigh the gain for the notary and SP.

[AlexxNica]

if DataCap is allocated and used "well", they get rewarded
if not, they lose their stake / some portion of it

How would this be evaluated? (This question probably needs two or more answers: one for public data, and another one for private/encrypted data.)

Thoughts:

One of the first things we gotta figure out is if the community will be (or stay) part of the program and its processes. This decision has multiple and critical consequences, some of those, related to the quote above, are:

If the data is public

In this case, we could run programs similar to bug bounties.

Here the broader community would be able to participate and help with accountability and other activities.

If the data is private–or encrypted (there is a difference we can discuss later on)

In this case, only notaries would be able to evaluate aspects related to the data. And not every notary–as I understand, only notaries that had signed any type of agreement along the way would be able to tell if that allocation was "used well" (whatever that means) or not (without access (by means or rights) to the data, how can someone tell it was "used well?").

Here, the community is completely left aside and won't be able to participate.

Some more thoughts

• If the notary receives a reward for allocations "used well," they can be biased towards confirming that status of "used well."
• If more notaries involved receive rewards for the allocations confirmed to be "used well," then we create a pushback for any notaries that go against that status.
• If every application needs a least one more notary focused on due diligence, then we create a dependency that'd need some more thinking:
  • What happens if that notary is unable to check the application in time?
  • What happens if that notary gives a status that goes against other notaries' opinions? (This question is for both due diligence before the allocation and for "used well" status.)
    • If there's enough money involved there could be harsh pushbacks in the form of lawsuits, misleading reports and claims, smear campaigns, etc. How would this be handled?
      • Side-note on this: This can be a decisive question for the program's future in relation to who'd truly be able to participate in it. If the cost and risk is too high and there's no financial and legal support for individual notaries or notaries representing small companies/startups, then it'd mean only wealthy entities would be able to participate in the program in a real way.
• How would we handle situations like mergers and acquisitions between notaries?
  • What happens to running processes (allocations, reviews, rewards)?
  • How would that be communicated?
    • Who would need to be communicated?

[jhookersyd]

@dkkapur The fabric of this network will break very quickly if we don't implement a transparent/robust enterprise onboarding system asap.

I would suggest we fast-track the FIL-E program and look at how we introduce some simple notary mechanics soon.

Random notary selection + Staked Notary Requirements + Staked FIL reward gifted to the most diligent notary = A significant first step!

[AlexxNica]

I agree, and I think we need to have some time to think and plan around this issue. There's only so much we can fast-track, and we can't be pressured into taking action just because of the pressure, otherwise hell will just break loose.

We need to be conscious about our decisions, and those can't be rushed if we want the program to succeed and have a good history. If we want to attract enterprise clients, one of the fundamental things is to have some sort of stability/predictability, and that won't come if we just rush every decision without taking into account the consequences.

We are already seeing the results of taking decisions without proper and transparent thinking and planning, and that's not good.

[cryptowhizzard]

@AlexxNica there is a difference between rush (not carefull ) and uptempo 😉

Something needs to happen and it is better to patch and buy time instead of watch bleeding it empty.

[jhookersyd]

JH Notes:-

• Data cap (DC) is a gift, not a right = I Love this @cryptowhizzard
• DC is highly valuable to SPs
• The biggest deterrent is value loss = SPs fear sector faults
• No human can open and check petabytes of datasets = We need to incentivise Notaries to create/seek out analysis tools
• Notaries/SPs can game the system if they have “different” notaries all over the world
• Staking FIL aligns with the ecosystem ethos
• If a notary or SPs games the system, there should be contractual repercussions = Loss of all sectors and Staked FIL
• Notaries need to be incentivised to check all information/data painstakingly = We need to make this big financial win to find bad actors
• Time from DC application to DC approval needs to be as short as possible = Separate approving DC and checking the actual data
• Notaries need to check the sealed and unsealed to make sure they are the same = This is a big job!
• If the dataset is large, it’s not always ready to check at the beginning = We need to check data once it’s all sealed as well. It could take 3 months depending on the sealing power of SPs
• We can't have 10 notaries under NDA checking data. This will annoy clients and does not scale
• Filecoin doesn't need to store every type of dataset in the world; some datasets are too problematic for analysis
• DC "used well" is a step 2 problem
• Open public research datasets from universities should be whitelisted = Faster time to DC
• The more FIL we lock up, the higher the price goes = PL/FF/SPs/Community are happy
• Smaller miners are getting crushed due to the FIL price = If we don't sort this asap, they will disappear. NOT GOOD!

Simple Trust Mechanism for Data Cap

1. A lead SP hires a lead notary and completes all the pre-work (FIL-E); when the application is ready, they both submit it to the network/community
2. The Lead Notary stakes 10% of the FIL (FIL Staked equals sector stake) to kick off the project = (10% of 1PiB = 5,570 FIL)
3. The network chooses 5 notaries at random from 4 regions, 3 of the 5 notaries check the application and sign it off
4. The 5 Notaries then have 18 months to check all the data; the data is...
5. Good = The lead Notary gets 100% of the FIL they staked back at the end of the 18-month sector lifecycle
6. Bad =
   A. If one of the 5 notaries finds fraudulent data, they receive 100% of the FIL staked in the kick-off process
   B. 100% of the Lead SPs sectors are terminated if they onboarded fraudulent data

FAQ

• Can the lead SP/Notary call out changes to the data mid-sealing? Yes, transparency is a must. The data cap might get stopped from this point. Making sure the data aligns with the DC application keeps the focus on storing the specific dataset requested. It stops many shades of grey.
• What happens if the data isn't retrievable by all SPs? It doesn't matter, it depends on what the lead SP sells the client in the SLA
• Is it OK to ask the client for a portion of the notary stake? Yes. It aligns the client/lead SP and lead Notary.

FIL Modelling Questions

• The Lead SP pays a fee to the Lead Notary to help them with the Data cap application form AND a fee for the risk against the 10% FIL that the Notary needs to stake against the application. What should this service/risk fee be?
• The Lead Notary stakes 10% of the FIL needed for the DC application (10% of 1PiB of client raw data = 5,570 FIL)
• The other notaries have 18 months to check the data... On what day... (1PiB of raw data which is 10PiB Adjusted) does the Lead SP stop caring about all his sectors being terminated because they have made 55,570 FIL from block reward? How does diminishing block reward affect this?

Thoughts on this trust structure? @dkkapur @AlexxNica @cryptowhizzard

Editing this as I go along... Chatting to the ecosystem.

[jhookersyd]

Notaries will stake their own FIL when they know the client/data are true. That is the point.
Holon the Notary would do this... So others would.

[kernelogic]

I'm not gonna stake 5000 FIL for 18 months for a LDN lol, is the reward gonna release in linear time or at the end of the 18 month?

Also imagine the new FIP want to extend lifecycle to 5 years or more.

[jhookersyd]

Notaries should be paid for their service and a risk fee against their Lead SP/client, which is a natural market dynamic today.

Good SPs/Clients = Low Risk
Bad SPs/Clients = High risk

The Notary stake would only apply for the first 18 months, not the extended time post first seal.

[f8-ptrk]

first of all holon is a miner and a client - holon should not be a notary. but thats a different topic.

we cannot put a price on becoming a notary. if you lock up FIL as a notary you are still in a position to get as much revenue out of those FIl as there are ways to earn money with locking up fil (aka mining). so locking up fil as a notary will most likely increase corruption, not lower it

[f8-ptrk]

the whole concept to connect the income of notaries to the clients, sps or deals is fraud and the wrong angle to attack this. i agree that we need punishment methods for notaries, sps and clients - but that should be independent from this income discussion

[jhookersyd]

[f8-ptrk]

comment deleted, wrong week for me to deal with something like this - in the end i do not care, sell datacaps if you think this would solve the problem

btw whats the problem this tries to solve? maybe the notaries are just the wrong ones....

[jhookersyd]

I agree with all your first 4 points @f8-ptrk.

My point 6 above:

"Bad =
A. If one of the 5 notaries finds fraudulent data, they receive 100% of the FIL staked in the kick-off process (Staked by the lead Notary)
B. 100% of the Lead SPs sectors are terminated if they onboarded fraudulent data."

This allows miners to be notaries as well. Agree you shouldn't be a miner/client and notary.

[jhookersyd]

Yes. Risk should outweigh gain.

[f8-ptrk]

none of this should involve the sp, nor the client.

[f8-ptrk]

notaries should earn money totally independent from SPs and clients.

[newwebgroup]

How to judge SP cheating? (how to distinguish whether the data belongs to their own enterprise data?)
Who has the right to judge them for cheating?
How to prevent joint cheating between notaries?
Notary's energy input? How to ensure that notaries can actively participate in this set of rules?

[jhookersyd]

SPs Cheating = The dataset isn't what was written in the application
Notaries Colluding = Ramdon function
Notaries Energy = Get paid form SP / Stake FIL they own

[jhookersyd]

All good @f8-ptrk. I'll raise this at the notary call tomorrow. Thanks for your time.

[psh0691]

Providing incentives to encourage active activities among currently selected notaries is a good idea.
However, complicating data cap approvals for notary incentives can cause problems that keep customers waiting more.
You should consider that waiting times for data cap approvals may pile up.

[f8-ptrk]

as soon as we pay notaries they will have to work. period. if times pile up they loose notary status. thats easy to solve. the problem is that no one gets paid right now so no one has incentives to work

[psh0691]

Yes, I agree with you.
My opinion is to simplify the notary's incentive payment method for rapid data cap approval.