stake-pool: Wait at least two epoch boundaries to set fee #3979
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2501babe
reviewed
Jan 26, 2023
Comment on lines
+821
to
+841
| pub fn update_epoch(&mut self) { | ||
| match self { | ||
| Self::None => {} | ||
| Self::One(_) => { | ||
| // The value has waited its last epoch | ||
| *self = Self::None; | ||
| } | ||
| // The value still has to wait one more epoch after this | ||
| Self::Two(v) => { | ||
| *self = Self::One(v.clone()); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| /// Get the value if it's ready, which is only at `One` epoch remaining | ||
| pub fn get(&self) -> Option<&T> { | ||
| match self { | ||
| Self::None | Self::Two(_) => None, | ||
| Self::One(v) => Some(v), | ||
| } | ||
| } |
There was a problem hiding this comment.
I certainly had fun writing it 😄
2501babe
approved these changes
Jan 26, 2023
HaoranYi
pushed a commit
to HaoranYi/solana-program-library
that referenced
this pull request
Jul 19, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
If a malicious manager wants to hike a fee, they can still do so right at the end of an epoch and have it take into account immediately at the start of the next epoch, giving users no time to get their funds out if they want.
Solution
Force a wait of at least two epoch boundaries before applying a new fee. This solution needs to be backwards compatible with existing stake pools, which use
Option<Fee>. In Borsh, this is encoded as:This introduces a new enum
FutureEpoch, which encodes0asNone(same as option),1as "wait one epoch" (same as option), and then2as "wait two epochs" (the new state).The biggest issue with this approach is that it requires calling "update" in two different epochs before applying the fee, rather than having the fee apply at a particular future epoch. Meaning, you can do "set fee", wait two epochs, then call "update", and you'll only move forward one epoch. You must call "set fee", wait at least one epoch boundary, call "update", wait at least one more epoch boundary, and call "update" again. Thankfully, at worst, it just takes longer for the new fee to kick in, which is acceptable (to me).