Proposal on the extension of the V1 proof sector lifetime

[deltazxm]

Summary
It is currently not possible to extend the life cycle of the V1 proof sectors. This has caused a huge loss to the miners who sealed the V1 proof sectors in early days. Sealed sectors should only take windowPoSt challenges, security issues would not be involved. So we propose the V1 proof sectors' life cycle could be extended.

If the life cycle of these sectors cannot be extended, there will be a lot of sealing computation resources wasted to seal these sectors again. If miners have to seal sectors again, it will take much more collaterals and gas. More messages will make the chain congested, and other miners will have to pay more high gas fees too.

If the life cycle of V1 proof sectors is set to 180 days, miners would experience horrible loss and may cause even greater losses due to gas fee issues.

Improvement Goal
Allow the life cycle of V1 proof sectors to be able to extend like v8 proof sectors. Please see the detailed improvement plan: [https://github.com/filecoin-project/specs-actors/pull/1310]

[coder-lb]

This is a good proposal. If V1 proof sectors can't be extended, many sealing machine resources will be wasted to seal sectors again. Filecoin should be a project with less energy consumed, then it will be more competitive in storage markets.

[coder-lb]

If a huge number of sectors can't be extended, there will be several side effects. If the miners seal sectors again, it will take much more time, and much more gas. More messages will make the chain congested, and other miners will pay more high gas fees, too.

[fmtmbs]

Totally agree to extend life cycle of v1 proof sectors.

[flyworker]

If the purpose is for better storage market, instead of extend, it should be upgrade sectors with data deals, otherwise those sectors are useless in storage market.

[ElecRoastChicken]

This is definitely a good suggestion for network development. At present, the high gas cost is due to the congestion of message pool. If V1 sector cannot be extended life cycle will lead to quite a number of re-sealing, which will bring a new round of congestion peak, that is not conducive to the reduction of gas cost, but also bring pressure (can be avoidable, just extend life cycle) to the network.

[steven004]

@deltazxm good proposal to discuss.

I would suggest adding a Motivation section and a Security Consideration section. The motivation is clear that there are half (possibly more) of power are sealed using V1, and massive computing resources consumed for that. To allow the extension of V1 sectors is environment friendly way to keep the power of Filecoin. In addition, it is also good to maintain Filecoin's stability.

However, there might be security concerns, which is not very clear to many miners. To me, I could understand why upgrading from V1 to 1.1 for security issue, but it is more impact on the sealing process, but how's its impact to verification. @nicola may add more to this.

[deltazxm]

If impact to verification.Then the current v1 sector also has security problem.So,I think there is no problem with windowPOST.

[kacee-song]

This is by design, motivated by security considerations for the V1 proof.

[f8-ptrk]

If the life cycle of these sectors cannot be extended, there will be a lot of sealing computation resources wasted to seal these sectors again. If miners have to seal sectors again, it will take much more collaterals and gas. More messages will make the chain congested, and other miners will have to pay more high gas fees too.

this is just not true. this would imply that right now sectors are not being sealed because of existing v1 sectors.

if those sectors expire the baseline will change, that's the first thing. and then resources that would be used for sealing anyways would be used to "reseal" those sectors. i doubt that there will be an overall increase in CC sector sealing activity if we just let those sectors expire.

[xiaoliwe]

If the life cycle of these sectors cannot be extended, there will be a lot of sealing computation resources wasted to seal these sectors again. If miners have to seal sectors again, it will take much more collaterals and gas. More messages will make the chain congested, and other miners will have to pay more high gas fees too.

this is just not true. this would imply that right now sectors are not being sealed because of existing v1 sectors.

if those sectors expire the baseline will change, that's the first thing. and then resources that would be used for sealing anyways would be used to "reseal" those sectors. i doubt that there will be an overall increase in CC sector sealing activity if we just let those sectors expire.

"reseal" still take much collaterals and gas? ?

[xiaoliwe]

If the life cycle of these sectors cannot be extended, there will be a lot of sealing computation resources wasted to seal these sectors again. If miners have to seal sectors again, it will take much more collaterals and gas. More messages will make the chain congested, and other miners will have to pay more high gas fees too.

this is just not true. this would imply that right now sectors are not being sealed because of existing v1 sectors.

if those sectors expire the baseline will change, that's the first thing. and then resources that would be used for sealing anyways would be used to "reseal" those sectors. i doubt that there will be an overall increase in CC sector sealing activity if we just let those sectors expire.

"reseal" still take much collaterals and gas? ?

[f8-ptrk]

"reseal" still take much collaterals and gas? ?

reseal here means sealing other sectors to replace them. you have to keep in mind that collateral and fees for most, if not all, v1 sectors were paid with testnet FIL - at a market price of exactly 0. so no one ever paid for them. the reason that this issue exists is not to protect the network or keep the baseFee low - but to go on earning real FIL with sectors that were paid for with testnet FIL - and as you can imagine they have a way higher ROI than sectors that needed to be sealed with real FIL.

[deltazxm]

"reseal" still take much collaterals and gas? ?

reseal here means sealing other sectors to replace them. you have to keep in mind that collateral and fees for most, if not all, v1 sectors were paid with testnet FIL - at a market price of exactly 0. so no one ever paid for them. the reason that this issue exists is not to protect the network or keep the baseFee low - but to go on earning real FIL with sectors that were paid for with testnet FIL - and as you can imagine they have a way higher ROI than sectors that needed to be sealed with real FIL.

All sectors before November 26 have this problem.Not only SR.

[cwhiggins]

Sectors are meant to expire. Miners cannot control the length of time a client makes a deal for. There is no reason to extend these sectors. We will all lose power, yes, that is how the system is designed.

[kaptinlin]

I don't think it's good idea extend life cycle of v1 proof sectors. A lot of v1 sectors are SP1 sectors, some of them are not stable and it should be termination for secure reason.

[gdkiddd]

I don't think it's good idea extend life cycle of v1 proof sectors. A lot of v1 sectors are SP1 sectors, some of them are not stable and it should be termination for secure reason.

what kind of "not stable"?

[gdkiddd]

"reseal" still take much collaterals and gas? ?

reseal here means sealing other sectors to replace them. you have to keep in mind that collateral and fees for most, if not all, v1 sectors were paid with testnet FIL - at a market price of exactly 0. so no one ever paid for them. the reason that this issue exists is not to protect the network or keep the baseFee low - but to go on earning real FIL with sectors that were paid for with testnet FIL - and as you can imagine they have a way higher ROI than sectors that needed to be sealed with real FIL.

The rewards obtained in the testnet are used to pay those miners who have made great contributions to Filecoin. They are willing to follow Filecoin when the mainnet is uncertain, and spend a lot of time and money on machines, labor costs, operation and maintenance. , Laid the foundation for the successful launch of the mainnet, so the testnet coin is surely valuable.

Now these sectors cannot be extended, it means that it will cost 150% more pledge cost and gas to reseal it. This is unnecessary and unreasonable. No one has specifically explained why it has affected the security and stability of the mainnet. Should such a decision on a decentralized network not be more cautious in soliciting community suggestions?

[f8-ptrk]

The rewards obtained in the testnet are used to pay those miners who have made great contributions to Filecoin. They are willing to follow Filecoin when the mainnet is uncertain, and spend a lot of time and money on machines, labor costs, operation and maintenance. , Laid the foundation for the successful launch of the mainnet, so the testnet coin is surely valuable.

neither pledge nor sealing costs of these sectors were part of the rewards. the testnet coin shouldn't have had any value at all. not then, not now, not ever.

Now these sectors cannot be extended, it means that it will cost 150% more pledge cost and gas to reseal it. This is unnecessary and unreasonable. No one has specifically explained why it has affected the security and stability of the mainnet. Should such a decision on a decentralized network not be more cautious in soliciting community suggestions?

not "now" - they never were able to be extended later.

• sp1 sectors cost 0% and got 100% of the power.
• others pay 100% for 100% of the power.

we cannot cement this inequality forever on the chain. the stability will suffer. cannot talk about security - i assume that if there are issues no one will tell you, for obvious reasons and we just let them phase out.

[gdkiddd]

not "now" - they never were able to be extended later.

• sp1 sectors cost 0% and got 100% of the power.
• others pay 100% for 100% of the power.

we cannot cement this inequality forever on the chain. the stability will suffer. cannot talk about security - i assume that if there are issues no one will tell you, for obvious reasons and we just let them phase out.

Sectors before November 24 will not to be extended, but between October 15 and November 24, we have purchased a large amount of real coins to seal data, these r "real" sectors! why these sectors will now also be "killed"?

[coder-lb]

not "now" - they never were able to be extended later.

• sp1 sectors cost 0% and got 100% of the power.
• others pay 100% for 100% of the power.

we cannot cement this inequality forever on the chain. the stability will suffer. cannot talk about security - i assume that if there are issues no one will tell you, for obvious reasons and we just let them phase out.

Sectors before November 24 will not to be extended, but between October 15 and November 24, we have purchased a large amount of real coins to seal data, these r "real" sectors! why these sectors will now also be "killed"?

Agree. At least sectors between Oct 15 and Nov 24 should be extended.

[kaptinlin]

It was not a good idea to shift the SP1 sector to the mainnet at that time. These sectors should be expired. It's not fair to the new miners.

Now that big miners have more and more advantages, new miners have to spend more to join the network. This is not conducive to decentralization.

[thecreation]

The life cycle of these v1 sectors should not be extended in order to increase the profits of big miners. They have acquired a lot. There should be more opportunities for new miners and small miners to join the network.

[fmtmbs]

It was not a good idea to shift the SP1 sector to the mainnet at that time. These sectors should be expired. It's not fair to the new miners.

Now that big miners have more and more advantages, new miners have to spend more to join the network. This is not conducive to decentralization.

At least sectors between Oct 15 and Nov 24 should be extended.

[deltazxm]

At least sectors between Oct 15 and Nov 24 should be extended.

[steven004]

The only strong reason for objection of extension is security problem, what is that? Is it that the bug in previous proof makes it proving faster? I would believe that is still safe for years before the hardware power is improved significantly for tens of times. If the concern is about related to this, how about allowing one time for perhaps one or two years?

Or any other one not unveiled?

[nicola]

I wrote a comment here a while ago: filecoin-project/specs-actors#1309 (comment)

There is a risk that a year+ from now, with highly pipelined custom hardware (less likely to be software - but not impossible), one may able to avoid storing 100% of the sector and still succeed at WindowPoSt.**

As we come closer to these sectors' expiration (most are a ~year from now), depending on (1) what percentage of power these sectors sum up to, (2) what is the state of the art of ASICs and Proof of Space software, the community should decide what to do with those sectors.

I would not recommend to allow for sector extension right now.

**: note that Filecoin will still be secured by the collateral of these sectors

[deltazxm]

So the conclusion will not be extension?There are different voices in the community.We want extension the sector.At least sectors between Oct 15 and Nov 24. @nicola

[xiaoliwe]

So the conclusion will not be extension?There are different voices in the community.We want extension the sector.At least sectors between Oct 15 and Nov 24. @nicola

Oct 5 ~ Nov 24 ?
It refer to 2020 ?

[deltazxm]

Yes,After mainnet

[flyworker]

if keep the power between Oct 5 ~ Nov 24, does that mean only the sectors before this period is insecure?

No ,if you want to keep , keep all of them, if it is expired due to security, expired all of them.

[ArthurWang1255]

V1 proof sectors deserve extension. First, these V1 proof sectors are not "free", there are thousands of servers maintaining them (I doubt the intentions of those ones who are not supporting this proposal, early miners put in money and time before others doing so to build filecoin system and don't deserve a fair sector? ). Secondly, the large fluctuation of storage volume itself is a security risk to the filecoin network. In the end, what we are pursuing is a larger scale of storage and a moving forward consensus. Giving the V1 proof sectors extension they deserve and let the community put the eyes on the future.

[ArthurWang1255]

V1 proof sectors deserve extension. First, these V1 proof sectors are not "free", there are thousands of servers maintaining them (I doubt the intentions of those ones who are not supporting this proposal, early miners put in money and time before others doing so to build filecoin system and don't deserve a fair sector? ). Secondly, the large fluctuation of storage volume itself is a security risk to the filecoin network. In the end, what we are pursuing is a larger scale of storage and a moving forward consensus. Giving the V1 proof sectors extension they deserve and let the community put the eyes on the future.

Only if fairness is not important in the community and system, then big miners will take over the right to speak. It's harmful to the community and the whole ecosystem of filecoin.

[jennijuju]

Allow v1 sectors to have 540 days in epoch as max sector life time was proposed in fip-0014 as one of the options to this topic. The proposal is still in DRAFT and the community should work on the product consideration, detailed security consideration and other sections before it can move forward to the next stage.

[f8-ptrk]

there is still no argument for how this improves the network. if letting these sectors expire now, as some say here, will create problems - how are these problems different in now+x days?

except adding to the risk of these sectors being "broken" by hardware/software implementations this FIP is doing nothing of value for the network.

[f8-ptrk]

V1 type sectors deserved to be extended as 540days.
It's fair for the miners who sealed it and stress tested the whole network earlier to make the Filecoin network what it is today.

i am sorry, but that is not an argument. why should we keep a security risk (for all people involved!!!) on the chain for the "benefit" of a few miners? to make the network more secure for everyone we should terminate these sectors forcefully as soon as possible. keeping them longer then necessary (and to be straight forward here: no one needs those sectors! they are just "another sector"... can be replaced with new ones at all times) is not fair to everyone involved with filecoin, we deserve security risks to be eliminated as soon as they are known!

[coder-lb]

V1 proof sectors are not free, especially between Oct 15 and Nov 24. Miners who spent a lot of FILs to pledge between Oct 15 and Nov 24 will be long term players and the most loyal supporters of the Filecoin ecosystem, since they were willing to invest real money in a project just started.
At the beginning of mainnet, many other miners dare not seal and they kept on waiting, until they were sure that they could get enough benefits. So we could see the gas fee was low right after the mainnet launched, and got very high in December. This is normal, but it also shows that early miners can bring better loyalty to the network.
Of course, None of the above is an excuse for security. But with current hardware, it is very hard to use the previous bug to pass WindowPoSt without store all of data now. I agree with @steven004, probably we can extend the sectors to 540 days. It will still be secure. Some miners set the expired days to less than 540 days only because they thought it was more flexible. Who knew the sectors would be treated selectively so that it could not be extended In Oct? Who knew the gas fee would be very high so that re-sealing these sectors would cost more in Oct? The security of Filecoin requires people from the entire ecosystem to work out ways and maintain them together, not only just avoiding a possible issue in the future. With more miners and more power, Filecoin will be more secure.

[f8-ptrk]

here are the arguments i see so far pro/contra implementing this FIP.

pro implementing:

• financial advantage for those miners who have large amounts of these sectors sealed

contra implementing:

• financial disadvantage for miners without large amounts of these sectors sealed
• keeping a security risk on the chain for ~360 more days

there is no argument so far how implementing this would improve filecoin - in my eyes.

[f8-ptrk]

With more miners and more power, Filecoin will be more secure.

letting these sectors expire will attract more miners - i am sure about that. the overall power will shrink, allowing new miners/miners without (a lot of) v1 sectors to get a bigger share of the overall power (i know - to not let that happen is the purpose of this FIP), possibly creating a more balanced miner landscape, expanding decentralization and in the end benefit the whole network.

[steven004]

I'd emphasizes two things here for further discussion:

1. Fair-play. To limit life time of a proof-type of sectors is more fair. Remember people set the expiration date of a sector to 180, 540 or any other days before the extension is disabled for V1.
2. This is not to extend V1 sectors for more days, while there are more than half of V1 sectors' life time is 540 days, to limit the overall lifetime to 540 days DOES NOT extend this proof-type sectors beyond its existing time in the network. The bound is still there.

[deltazxm]

FIP0014 not only satisfies the need for arrangement, but also does not lose fairness. It is a perfect progress that everyone can accept. We hope it can be implemented as soon as possible. @jennijuju

[mxz9102]

Since these sectors are using V1. To avoid a security risk for the whole network, letting them expire is the best solution from my opinion. So I object the extension of the V1 sector life cycle.

[Fatman13]

there is no argument so far how implementing this would improve filecoin - in my eyes.

@f8-ptrk, I think part of the problem may stem from the fact that core team made the decision of not extending V1 proof sectors pretty much silently. Decisions that may affect that many miners should at least go through some level of discussion.
What if we find a bug in V1.1 tomorrow? We just let V1.1 expire without any discussions? @deltazxm has submitted two issues before, but were closed out by the team. Thus, rendered no other channel to bring this up.

If the core team hadn't made any sector policy changes, then you can see this fip as improvement of network security.

[kaptinlin]

I don’t think it’s fair to the new miners. I worked with them, they complained that the early big miners had so many cheap sectors that it became more difficult for them to participants on the network. This may not be conducive to decentralization.

[momack2]

I think preference from a protocol perspective is still to enable an easy way to upgrade and reseal v1 sectors into v1.1 sectors so they have the same storage power security guarantees, but don't have to take up chain space (and gas/collateral fees) again.

Given this isn't ready for the sectors expiring in the next few months, I think the lotus team is somewhat agnostic about whether the community should allow 6 month sectors to share the 540 day expiry (that is the default for all new sectors) or expire now. The security concerns here absolutely mean these sectors should not be renewed past that 540 day limit - but the level of concern is the same for all v1 sectors (most of which are 540 day sectors, not 180 day sectors). Slight preference to "expire now" since that's the easiest and avoids another state upgrade in the next few weeks - but OK with either of these two options.

For deciding between those options, maybe we can use the new https://filpoll.io tool to collect community sentiment across miners / token holders / clients / etc. Thoughts on that?

I absolutely expect the v1 sector expiration to be a concern again in a year - and it will not be an option to extend v1 sectors without resealing at that time due to security concerns. In preparation for that, I think community members like @steven004 @deltazxm @coder-lb @maobisheng etc should help identify / implement the best path to upgrade v1 sectors into v1.1 sectors if maintaining power and minimizing chain overhead/fees is desired.

[steven004]

Agreed, @momack2 .
Could we start the poll soon? we may just need a few days to complete the poll while broadcasting it via slack, wechat, twitter, which will reach most miners and community members quickly. And then, we could have about one week time to prepare for the new release once major part of the voters agree the proposal, so that we can meet the first hump of the expiration of V1 sectors.

[deltazxm]

Hope to start the poll as soon as possible. @jennijuju.Once the conclusion is reached, publish the conclusion as soon as possible. This issue has been discussed for a long time.

[arajasek]

Hoping to start the poll tomorrow!

[deltazxm]

start the poll

How to initiate a poll

[jennijuju]

start the poll

How to initiate a poll

It will be setup and announced to the community later today.

[danlessa]

The Impact of V1 Sector Expirations on Filecoin Storage and Cryptoeconomics

Background context

Shortly after Filecoin liftoff, a security issue was reported with the v1 proofs. The issue was fixed in v1.1 proofs, which were introduced in the Filecoin network version 7 upgrade, on November 25th, 2020. As a result of this upgrade:

• All new sectors had to use v1.1 proofs
• v1 sectors were allowed to remain on the network, but were NOT allowed to be extended

Since the security of these sectors is not critically compromised, we can consider allowing their extension, which was proposed in FIP-0014. This report details the storage and cryptoeconomic impacts of allowing vs. rejecting FIP-0014.

Executive Summary

• The current size of the network is large enough to dillute the expiring sectors in April and May.
• The network as measured in raw-bytes capacity is expected to continue growing during the V1 expiration wave.
• It remains to the community to decide about the fairness and incentivization aspects of FIP-0014.

The code and the visualizations for this writing can be seen on the following link: https://blockscience.github.io/filecoin-metrics/notebooks/fip_0014.html

The first wave of expiring sectors

Right now, Filecoin has about 92.3M active sectors, on which 26.2M (28% of the total) uses the V1 proof.

An immediate concern about them is about the sectors with 6 months lifetimes, as they're starting to expire on March 26, 2021, although the majority is going to expire between 22 April, 2021 and 28 May, 2021, peaking on 10 May, 2021.

That first wave makes up 6.3% of all Filecoin active sectors, or 22.3% of all V1 sectors. In absolute terms, they're 5.8M sectors, or about 177PiB over three months.

The big picture is contained in the following chart, where waves related to the 6 months, 12 months and 18 months sectors for both V1 and V2+ sectors are identified:

A more granular view is obtained by getting the count on a daily window before 15 June. Note that the vertical axis is on logarithm scale.

Through the above figures, we can define key dates in regards to daily sector expiration rate:

• 26 Mar, 2021: First sectors are expired
• 14 Apr, 2021: Daily sector expiration rate is above 10k per day, or 312TiB per day.
• 22 Apr, 2021: Daily sector expiration rate is above 100k per day, or 3.05PiB per day.
• 10 May, 2021: Peak of the sector expiration rate, at about 201k per day, or 6.13PiB per day.
• 28 May, 2021: Daily sector expiration rate gets below 10k per day, or 312TiB per day.

Impact on Growth trends & Storage Power

The current forecast points towards having 3.8 EiB of raw-byte storage power by the end of May. This is fuelled by the continued sealing of new sectors.

---

We project that the daily new sectors growth will be between 450k per day and 900k per day, generating a daily SP growth between 13.7 PiB per day to 27.5 PiB per day.

---

The expiration of approximately 5.8M sectors between 22 April and 28 May will subtract 180k per day (5.5 PiB per day) from the above numbers, which is equivalent to a reduction of 40% on the pessimistic side and 20% on the optimistic side. Note that with more 64GiB sectors being added to the network, the actual impact tends towards the more optimistic case.

Impact on Collateral

Right now, Filecoin has 27.8 Million FIL locked as sector collateral, 5.8M (21%) of which are on the V1 sectors. Notice this is relatively lower than the sector share, as the collateral for each new sector tends to increase with time.

The 6 months V1 sectors have 1.2M FIL locked with them (4.3% of the network total), and the event of their droppage should not be an issue for network security.

Conclusions

From a Cryptoeconomics point of view, the network will continue to be safe and healthy on any decision regarding allowing all V1 sectors to be extended to a maxium 540 days in epoch lifetime from their activation epoch.

The decision of letting the V1 sectors expiring or not is to be put before the community, as there are multiple angles to FIP-0014 approval, which include considerations regarding fairness and behaviour incentivation, as well as other ones like environmental and waste minimization.

[jennijuju]

The Impact of V1 Sector Expirations on Filecoin Storage and Cryptoeconomics

This is very informative @danlessa - thank you!

[arajasek]

Storage miners can vote on whether to adopt this FIP here!

[leekueha]

Answering everything with policy, why are you going to change the policy this time?
If it was a deletion policy, it should be deleted.
The vested interest will never be put down.
So, will you increase V8 540 days later?

[jennijuju]

Core devs have reviewed the FIP-0014 survey result and final security audit, and have decided that FIP-0014 will be accepted in the network. Network upgrade epoch and implementation release timelines will be announced in the Network Updates later today.

[jennijuju]

Network upgrade timeline filecoin-project/community#74 (comment)