Understanding the Filecoin Consensus Pledge

Locking the Network Journey into Safety

This work is part of a series on Filecoin Core Protocol Review that was inspired by conversations between BlockScience and CryptoEconLab. The goal is to dive into the historical and design context around the decisions and developments in Filecoin Economics, with this article focusing on the Consensus Pledge, and a following article on the Termination Fee.

Intro

This article delves into the interdisciplinary Cryptoeconomic Mechanism called the Consensus Pledge, which is a crucial component of the Filecoin ecosystem. It combines multiple concepts such as FIL token’s Circulating Supply, Baseline Minting, Quality Adjusted Power (QAP), and per-Sector dynamics to regulate storage provision by a Filecoin Storage Provider. To comprehend the Consensus Pledge, it is necessary to have a thorough understanding of the underlying economics of the Filecoin ecosystem.

What does the Consensus Pledge do?

Upon onboarding a new sector, the Filecoin ecosystem mandates a Storage Provider to pre-emptively lock a specific quantity of Filecoin. The primary motive behind this directive is threefold:

Firstly, to establish provisions for faults and penalties, hence resulting in the creation of the Storage Pledge, which is assessed at a value of 20 days of Estimated Sector Rewards.

Secondly, the act of locking rewards, as opposed to immediate release, is an extension of the Storage Pledge’s purpose. This measure is inspired by the need to address the previously outlined function.

A third function served by the pre-emptive locking of Filecoin involves reinforcing the network’s security. This is achieved by imposing significant capital costs upon malicious actors who aim to exploit the system. This function is implemented through the Consensus Pledge mechanism. The exact amount of Filecoin to be locked is determined by the expression mentioned below, which factors in the Target Locked Supply Parameter (TLS).

The Target Locked Supply Parameter (TLS) is set at 30%, and it determines the amount to be locked under the Consensus Pledge, which aims to increase the network’s security by imposing substantial capital costs on malicious actors. Typically, the network trajectory is directed toward locking 30% of the Circulating Supply as Consensus Pledge Collateral. However, this figure may vary considerably, as we will explore in subsequent sections.

A Brief Intro to Filecoin Token Distribution Terminology

In order to understand Circulating Supply, it helps to first to know what are the Sources and Sinks of the Filecoin Token. It has two Sources: Mining Issuance and Vested Filecoin, and it has a single Sink: Burnt Filecoin.

Between the Sources and Sinks, there are multiple token flow pathways. We could argue that Filecoin Economics is all about the different ways of defining the Accumulation points and the circulation between them and the Sources / Sinks.

One possible terminology for the distinct accumulation points is the figure given below. Arrows indicate possible flow directions. From there, we can define some names:

• Miner Collateral = All Storage Pledges + All Consensus Pledges + All Deal Collaterals + Any “surplus” Collateral
• Locked Filecoin = All Locked Rewards + All Miner Collateral
  - Meaning: All Filecoin that’s locked because of Sectors.
• Available Filecoin = (Everything that has been Mined) + (Everything that has been Vested) — (Everything that has been burnt)
  - Meaning: All Filecoin that has been released into the economy. Can be understood as being the Total Supply right now
• Circulating Filecoin = Available Filecoin — Locked Filecoin
  - Meaning: All Filecoin that’s immediately transferable. Can be understood as the Supply on which users can perform deal-making and actions on the Secondary market.

With clarity on those items, we’re ready to perform a deep dive into what the Consensus Pledge does.

Going Deep into the Consensus Pledge

The Consensus Pledge is a Mechanism

From a requirements perspective, Consensus Pledge was designed with two properties in mind:

1. Reflect some measure of existing supply, so that the locked amount is not too large or too small; and
2. Reflect some measure of the relative size of the storage provided, as compared with the ecosystem’s total storage, so that the locked amount enhances security.

The functional form of the Consensus Pledge was selected in service of these reflections — we break down the Pledge in what follows, describing the importance of its components and demonstrating their impact(s) in a series of stylized examples.

The Components of the Pledge

The components of the Pledge (followed by their notation) are:

Of the above components, Target Locked Supply is a tunable, governance-level parameter, set as of this writing to 0.30. This amount is intended to adjust the impact of the Circulating Supply on the Pledge, e.g. the value of 0.30 implies that 30% of the Circulating Supply contributes to the Pledge. This contribution in turn controls the intensity of the Pledge.

Target Locked Supply and Actual Locked Supply

The Target Locked Supply terminology can be somewhat confusing, as the actual fraction of supply that is locked accounts for not just the Consensus Pledge, but also the Storage Pledge and Locked (Block) Rewards. Thus, over time it may be that the “Actual Locked Supply Fraction” exceeds the fraction expected to be locked when relying upon the TLS parameter. This is more likely to occur if the Network QAP is higher than the Baseline Power, and if the marginal Circulating Supply per onboarded sector rewards is relatively constant.

By contrast, there are also situations where the Actual Locked Supply Fraction is lower than that expected from the TLS parameter. This can occur in between updates of the Consensus Pledge, which only occurs when onboarding, upgrading, or renewing a sector. For example, if Block Rewards were to be unlocked at a time without a Storage Pledge, then less supply would be locked than expected until such time as the Consensus Pledge was updated.

How the Pledge Components Interact

To gain intuition behind this functional form, we can express the same information in a slightly different way, by explicitly defining how the relative amount of storage provided interacts with the fraction of circulating supply. We write:

As of 29 March 2023, the above numbers can be inferred through the Starboard Filecoin Dashboard and the Sentinel database as being:

For example, when the Network QAP is 50% of the Baseline Power, then the Consensus Pledge will be half as much as it would be if the Network QAP is 100% or more of the Baseline Power — assuming that the sector share remains the same.

Practically speaking, given that sectors tend to have fixed sizes, the min operator in the definition of the Effective Target Locked Supply Fraction works by providing a ceiling for how much the Consensus Pledge per Sector should be, for a given amount of Circulating Supply Ωc(t).

Example: Computing the Consensus Pledge

The table below demonstrates the computation of the Consensus Pledge value Pc (the second column) as a function of the variables described above for a single 32 GB raw-bytes sector. We can observe that all things being equal, the only factor that can cause an increase in Consensus Pledge is additional Circulating Supply, while both increasing Network QAP or Baseline growing above Network QAP can both induce a reduction in the Consensus Pledge.

Why Have the Consensus Pledge?

As described earlier, the importance of the Consensus Pledge lies in the fact that it provides a means for storage providers to signal their good faith when engaging within the ecosystem. As this mechanism leverages the usage of the ecosystem FIL token, the Consensus Pledge also becomes the main economic lever to remove circulating FIL, and hence lessen the supply of FIL on the secondary market.

This means that, to first order, the introduction of TLS into the Consensus Pledge

• Significantly increases the cost to onboard 33% of the Filecoin QAP — this is related to protocol security, so that a significant fraction of ecosystem storage is prohibitively expensive to accumulate;
• Provides additional economic protection for the network against faults, by allowing the protocol to slash Pledged amounts locked by a Storage Provider;
• Significantly increases the capital investment and FIL exposure required for onboarding new sectors, endowing storage providers with an incentive to contribute to the stability of the FIL token’s value in the secondary market;
• Provides a means of restricting FIL liquidity as a function of storage provided, so that FIL is less readily available to convert to other stores of value (tokens, fiat, etc.) and hence lose value.

It is more difficult to assess the impact of the introduction of TLS into the Consensus Pledge to higher orders, because the interactions can be more complex than the first-order effects described above. Attempting to provide such an assessment is usually heavily dependent upon underlying assumptions about e.g. ecosystem participant behavior, and conclusions must consequently be drawn with caution. Some (non-exhaustive) potential second-order cause-effect chains include:

• Impacting the valuation of the Filecoin ecosystem based upon fundamental metrics, such as Total Value Locked;
• Favouring Sector onboarding in the direction of token holders; and
• Inducing liquidity scarcity on the secondary markets as a function of ecosystem growth, impacting the use of FIL for other operations.

As an example of the latter effect (and potentially other cause-effect chains not described here), the Consensus Pledge could potentially run counter to properties considered desirable for Deal Marketplace Stakeholders, as it means that the global share of FIL available for Deal Making is diminished.

Not surprisingly, the TLS parameter has always been the most challenging parameter to set, given its impact and the trade-offs involved as described above. Its importance in the ecosystem for explaining the movements of other factors, and hence upon the established Filecoin system goals, is illustrated in the following figure. This figure ranks the importance of various governance parameters of the ecosystem in decision tree analysis (cf. Analysis and Recommendations for Filecoin, p. 40[2]), indicating that TLS carries the highest importance when examining the impact of these parameters upon a measure combining all system goals.

The table following the figure also indicates the impact of TLS on the individual system goals of the ecosystem, showing that only for the system goal “Reliability” is the impact of TLS expected to be minimal (cf. Analysis and Recommendations for Filecoin, p. 10. [2:1]

Challenges of Understanding the Consensus Pledge

Consensus Pledge is notable for the number of different concepts it brings together (and hence creates bridges between), making it challenging to understand its emerging dynamics from its constituent components. Specifically:

Collectively these interactions make analytical predictions, or intuitive ‘stylized facts’, difficult to achieve without a suitably complex model (which itself carries difficulties for e.g. simulation and scenario design). Nevertheless, such a ‘comprehensive’ model is a requirement in order for its evolution to be considered representative of the actual generated dynamics of the Filecoin ecosystem.

Intuiting about Consensus Pledge through a cadCAD Educational Calculator

To give Filecoin ecosystem participants better insights and intuition about the effects of the Consensus Pledge, BlockScience built an interactive simulation that lets users consider the effects of varying scenarios under simplified assumptions.

The app gives users full control over various parameters to test how the network evolves under different conditions. Metrics that can be observed include the Initial Pledge per RBP/QAP, the Cost to Onboard 33% of the QAP, FIL Locked, Collateral and Circulating Supply, among others.

The sidebar on the left lets users set a total time for the simulation and then adjust the scenario for up to five distinct phases. Users can either adjust parameters in-app or via uploading parameters directly as .json files. Additionally, users can download the results as .csv files. Those features allow the simulation input and outputs to be directly reproducible.

As an example for a scenario to be tested, let’s assume the following parameter values for the simulation. This scenario represents a story in which the Quality Adjustment and Storage Onboarding goes up suddenly 1 year after the simulation start, and then the network stays in a steady state in regards to onboarding for 1.75 years. After that, there’s another explosion in onboarding, all while sector lifetime is going up. This can be understood somewhat as a story in which there’s an explosion of demand for Filecoin because of FIL+ and sector duration incentives.

Some of the effects which can be observed (and reproduced by doing more scenario simulations) are:

• The Critical Cost (Capital Costs to onboard 33% of the Network QAP) remains on the ~25M FIL magnitude most of the time. Sudden increases in onboarding will transiently make it go higher, but it does adjust itself fast (eg. in less than 6 months)
• Sudden jumps on Onboarding / Quality Factor tend to make the Filecoin Locked Supply increase significantly initially, although this effect is transient and tends to wash off with time.
• The Initial Pledge per QAP tends to only go down. However, there’s a different story when we look at the Initial Pledge per RBP. It is possible to have large jumps on it when there’s a transition in the onboarding pattern, although it decays very fast (possibly in the order of days or weeks).

The simulation starts with one year of activity seen previously in Filecoin history and then explores some shocks to the network:

1. 25PiB are onboarded daily, with an average Quality Factor of 1.5. Such a scenario corresponds roughly to October 2021 to June 2022. The aggregate sectors have a lifetime of 270 days, while 10% of the PiB are renewed monthly.
   The overall PiB supply drops slightly in this period, since onboarding and renewal rates are not fully keeping up with sectors dropping. As the Baseline Function still increases, this results in Baseline Minting reserving part of the issuance, incentivizing additional PiB to be onboarded.
2. Following this initial phase, we test a brief period where the proposal for Sector Duration Multiplier (SDM) is approved. With this incentive new storage supply is sharply increasing, resulting in the daily onboarding of 200PiB with an average QF of 10 (without SDM, the maximum multiplier would be 10x. As it is unrealistic that every PiB is onboarded through Verified Deals, a QF average of 10 is likely only achieved through additional multipliers, such as an additional 3.5x for SDM).
   As the Baseline Function becomes saturated rewards are increasing, yet the high increase in PiB results in lower rewards per PiB. The increased PiB also needs to lock up collateral and drastically reduce the Circulating FIL. While sector lifetime also increases drastically, renewal rate drops to 0%.
3. As such a period decreases rewards per PiB, storage supply then drops to prior levels while demand stays reasonably high. Sectors still show high lifetimes and renewal rates are slowly increasing again.
4. Next, another brief period of highly increased supply hits the network. We assume that demand for this supply keeps up, so the average QF stays high at 6.5x.
5. Finally, an intense shock hits the system — newly onboarded PiB drops to 0 (QF is set to 7.5, but irrelevant — older sectors that get renewed are adjusted by their old QF). With this shock, renewal rates are dropping too as the reasons for onboarding new PiB are likely correlated with reasons to renew existing sectors.

The Story Behind the Consensus Pledge

The initial economic design of the Filecoin ecosystem didn’t include Consensus Pledge as a means of ensuring ‘good faith’ behavior from storage providers. Miner collateral was instead structured to disincentivize storage providers from dropping sectors early, and so the Initial Pledge was largely derived from actual sector Block Rewards that were locked and released only over time (cf. the screenshot below describing the Initial Pledge per Sector).

The combined introduction of Quality Adjusted Power together with Verified Deals during the design of the network changed how Pledging took place in the ecosystem — this introduction meant that:

• If the system remained largely built upon Committed Capacity (i.e. storage committed to be available but currently unused) and Regular Deals, it would require a comparatively small share of the Raw Byte (RB) power to acquire a large amount of QAP. For example, if (say) 95% of the RB power is provided by Committed Capacity Storage, while only 5% is provided by Verified Deals, the latter storage providers would in reality hold just over 34% of the Network QAP.
• Onboarding deals could now be completed faster than onboarding storage, because the latter is constrained by the Sealing Capacity, which is expensive in terms of hardware (while predictable in terms of its rate of change).

In addition, most of the Filecoin CryptoEconomic mechanisms were being designed in 2019 and 2020, just before and during the so-called “DeFi Summer”. The wave of capital inflows, and concurrent economic attacks, that occurred at this time introduced to the ecosystem a key design goal: resiliency to economic attack. Taken together with the above effects, this design goal provided a strong rationale for introducing the Consensus Pledge mechanism as a way of strengthening both Security and Economic Attack Resiliency.

Sector Lock-up Mechanism Adoption: Historical Challenges

Deciding upon the form and implementation of Sector Collateral was always one of the most difficult problems for Filecoin’s cryptoeconomic mechanism design. Just after the Mainnet Launch (in October 2020) Sector Collateral was one of the main cost drivers for storage providers when onboarding new sectors. This was compounded by the lack of Circulating Supply of the FIL token just after launch, resulting in a liquidity crunch for providers.

When the Consensus Pledge was proposed in June 2020 (two months before Testnet), there was a lot of community discussion resulting in concerted ‘pushback’ against the idea of additional sector collateral. These concerns were addressed through the following measures:

1. Testnet sectors were allowed to remain on Mainnet without the need for collateral. This generated further debate in April 2021, when a Filecoin Improvement Proposal (FIP) allowing sector renewal was approved (cf. The Impact of V1 Sector Expirations on Filecoin Storage and Cryptoeconomics for further information.)
2. Block Rewards were released sooner, by releasing 25% of Block Rewards immediately (cf. FIP0004) and removing the vesting cliff duration. Initially set at 2 months, the cliff duration was first reduced to 20 days and then removed entirely when simulations indicated that there was ultimately no benefit in having a delay in Block Reward release.

During the design and development of the Consensus Pledge, the optimal value of TLS was found to depend heavily on the set of design goals, and on the maximization of Key Performance Indicators (KPIs) associated with those goals. This was complicated by the fact that (as described earlier) TLS has synergistic interactions with other governance parameters, particularly those related to the duration of FIL locking.

BlockScience implemented a simulation framework (“Digital Twin”) that provided the means to assess the initial parameterization of the Consensus Pledge. Initially (before Testnet) BlockScience’s recommendation was to set TLS to 0.2, (i.e. 20% of Circulating Supply) while keeping the vesting cliff duration to 3 months.

The pre-Testnet recommendation further evolved before Mainnet launch, when the liquidity crunch was taken into consideration to create an additional design goal, to recommend no vesting cliff duration and a reduced overall period of locked reward to 3 months instead of the initial 6 months (cf. the figure below).

The final value of 0.3 for TLS was arrived at from discussion and feedback between and among BlockScience, Protocol Labs, and miner groups, providing a value that balanced stakeholder preferences with BlockScience’s simulation-based recommendations.

The Future of the Consensus Pledge

The Consensus Pledge was introduced to address the security concerns of the Filecoin ecosystem at the time of its introduction. The evolution of the ecosystem over the past 3 years has changed both the supply side and the demand side of Filecoin’s services (and associated infrastructure), necessitating an adjustment of the associated governance parameters affecting e.g. minimum storage duration. It is natural, then, to view the Consensus Pledge as also requiring an evolution, so that it does not remain a solution to a problem that no longer exists, and a problem for a system seeking a new solution.

For instance, there may also be functional form changes of the Consensus Pledge, which are more difficult to capture. For example, if a Sector Duration Multiplier (SDM) or a Capped Duration Multiplier (CDM) solution changes the immediate or long-term supply of storage, the explicit comparison to the baseline may become less relevant — instead, there may be another metric, such as the relative proportion of committed capacity to verified deals, that provides the security that the Consensus Pledge is designed for.

Ultimately the Consensus Pledge should, as with the other mechanisms present within the Filecoin ecosystem, act in service to the goals held by stakeholders, such as providing safe, secure, retrievable data in a decentralized, economically favorable manner that is (at least) competitive with other data storage solutions. As the ecosystem begins to address the addition of data via Filecoin Plus, and the method by which storage providers are incentivized to extend the duration of a Sector, there is an active role to be played by an informed governance process that can adapt the Consensus Pledge to new conditions.

Although not (strictly speaking) required, a suggestive component of “informed” in this context is the ability to rely upon computer simulations of the Filecoin ecosystem that provide a means to experiment with different ‘what if?’ scenarios. Each scenario (e.g. SDM vs. CDM, short vs. long sector duration, Filecoin Plus vs. Committed Capacity onboarding, etc.) provides a ‘testbed’ for adjusting the parameters and underlying functional form(s) of the Consensus Pledge, by influencing KPIs and metrics that are used to assess whether system goals such as Security and Resiliency are maintained.

In this way, adjustments to e.g. TLS can be supported by more than informed opinion, or (better still) couple informed opinion with quantitative assessments that ensure the continuing evolution of a critical component of the Filecoin safety and incentive mechanism suite.

This article was written by Danilo Lessa Bernardineli, Jamsheed Shorish, and Jakob Hackel with special thanks to Hash, Jeff Emmett, and Jessica Zartler for editing and publication.

Resources

• Reviewing the Target Locked Supply

Footnotes

select
avg(new_baseline_power) / (2^60) as avg_baseline_in_eib /* RB EiB */
from chain_rewards cr
where cr.height > unix_to_height(extract(epoch from timestamp '2023-03-28 15:00')::int8)
and cr.height < unix_to_height(extract(epoch from timestamp '2023-03-28 17:00')::int8)

1. We’ve used the following SQL on Sentinel to retrieve the Baseline Power.
2. cadCAD Decision Support System — Analysis & Recommendations for Filecoin, October, 2020. BlockScience

About BlockScience

BlockScience® is a complex systems engineering, R&D, and analytics firm. By integrating ethnography, applied mathematics, and computational science, we analyze and design safe and resilient socio-technical systems. With deep expertise in Market Design, Distributed Systems, and AI, we provide engineering, design, and analytics services to a wide range of clients including for-profit, non-profit, academic, and government organizations.