QIP-1: Proposal to include QUIL staking requirement for nodes

Protocol Development
,
1

QIP Number: 1

Title: QUIL staking requirement for nodes

Author(s): P. Jameson

Category: Standards Track

Type: Core

Status: Draft

Created: November 8, 2024

Discussions-To: QIP-1: Proposal to include QUIL staking requirement for nodes

Updated: November 8, 2024

Abstract

This proposal introduces a staking mechanism for running nodes in the Quilibrium network. The goal is to disincentivize malicious node operation and align node performance with the security and stability needs of the network by requiring node operators to stake QUIL tokens proportional to the number of threads their nodes will be running.

Motivation

Currently, Quilibrium lacks a staking mechanism for node operations, which has both benefits and drawbacks. The accessibility of running nodes without significant upfront investment has fostered network growth, leading to over 100,000 active nodes during recent releases. However, this ease of participation can also enable bad actors to spin up thousands of nodes for personal gain, potentially exploiting incentive mechanisms and destabilizing the mesh network. Additionally, delays in the 2.0 release have resulted in emissions exceeding target levels for the intended release period.

Implementing a staking mechanism would address these issues by:

  • Deterring bad actors through a requirement to stake QUIL tokens to run nodes.
  • Reducing the true circulation of QUIL tokens as more would be locked in node operation.
  • Strengthening the network’s overall security and performance.

Specification

Definitions

  • Staking: The process of locking up a certain number of QUIL tokens as a commitment to operate a node.
  • Node Threads: The individual processing units allocated to perform network tasks.
  • QUIL Tokens: The native cryptocurrency used within the Quilibrium network.

Detailed Design

  1. Staking Requirement: Node operators must stake QUIL tokens proportional to the number of threads they intend to run. The formula for staking is defined as:
    Stake Required (QUIL) = Base Stake * Number of Threads
  2. Base Stake: A minimum amount of QUIL tokens set by the network governance that applies per thread.
  3. Dynamic Adjustments: The base stake can be adjusted periodically based on network health and token value to ensure fair participation and scalability.
  4. Penalty for Malicious Behavior: Nodes found engaging in disruptive or malicious behavior will have their stakes slashed, losing a portion or all of their staked tokens.

Rationale

This staking mechanism was chosen to balance network growth with stability. By linking the stake amount to the number of threads, we ensure that more resource-intensive nodes contribute more to network security. This approach discourages bad actors from spinning up numerous low-quality nodes as it requires significant capital investment.

Alternative mechanisms considered included a flat fee per node and a tiered stake structure that improved node seniority relative to stake size, but these were dismissed due to their inability to address key risks and potential to centralize rewards.

Backward Compatibility

This proposal introduces a new requirement for node operation that would necessitate software updates. Existing node operators will need to upgrade their systems to comply with staking regulations.

Test Cases

  1. Single Thread Stake Validation:
  • Input: 1 thread, base stake of 100 QUIL.
  • Expected output: Stake required = 100 QUIL.
  1. Multi-thread Stake Validation:
  • Input: 12 threads, base stake of 100 QUIL.
  • Expected output: Stake required = 1,200 QUIL.
  1. Penalty Test:
  • Malicious node detected with 24 staked threads.
  • Expected outcome: 10% of staked tokens are slashed for each 24 hour period that the node is out of compliance.

Security Considerations

Implementing this staking mechanism introduces additional risks such as:

  • Centralization Concerns: High stake requirements could deter smaller participants and lead to centralization.
  • Token Lockup Risks: Operators may be exposed to liquidity risks due to the lock-up of QUIL tokens.

To mitigate these, mechanisms for gradual stake release and slashing protections will be incorporated.

Reference Implementation

After initial debate, the community will work toward developing a reference implementation.

Copyright

This work is licensed under CCO 1.0 Public Domain Dedication.

Next Steps

  • Gather feedback from the Quilibrium community and stakeholders.
  • Conduct extensive testing in a controlled testnet environment.
  • Integrate feedback, refine the proposal, and prepare for a mainnet implementation.

End of Proposal

3 Likes
2

I like the “Stake Thread” idea as it is pure math and non-biased but the “Penalty Test” is more subjective, what happens with equipment faults, or even DoS and DDoS attacks that can be targeted? much harder to mediated with pure math. Just my thoughts.

1 Like
3

The criteria for what constitutes node compliance is still TBD, and I would want Cassie to weigh in on the use cases. I agree, offline nodes shouldn’t be penalized, but perhaps nodes that remain online but out of date for length of time should? We’ve seen cases in the past where nodes have stayed on old versions for months causing havoc in the mesh.

4

The concept of game theory suggests that players make rational decisions based on the potential outcomes of their actions. Penalties should ideally be based on the impact to profit, so receiving no reward while in non-compliance should suffice.
In regards to “malicious” nodes causing havoc with the Mesh, this should be attacked with engineering/design to exclude interactions (if possible).
A penalty in profit loss should be organic and not arbitrately imposed by other players.

5

I’m not sure whether this is implemented yet, but I assume that malicious actions will result in a loss of seniority / prover slot (Either through barring participation or otherwise). Similarly, certain actions would be punished according to severity (see Polkadot’s implementation of slashing, iirc)

Given that with time, total network size and thus incentive share will scale to such a degree that any loss of seniority / prover slot will very quickly push a participant below break-even, any additional deterrent would become superflous.

On another note, would this imply a change in the economic model to reward according to staked amount, or do you mean a flat amount that’s at risk without additional benefit?

1 Like
6

I would prefer a “Token Bond” rather than a “Stake” as staking can have negative connotations, I do not think it good to associate Quilibrium as another PoS scam coin.

1 Like
7

I basically agree with the staking proposal, but I think the penalty mechanism is very unreasonable. Most nodes will be in normal operation, but accidents will always happen. If the penalty is reduced by 10% due to accidents, I think it is unacceptable.

8

The whole point of the network’s model is that as long as you have at least a few good-faith operators/nodes, the network will function as intended. You already see this working such that if you produce a bad proof you get penalized. If you get penalized you get removed from more lucrative rings and you lose rewards and seniority. This should be tune-able as well to increase, decrease sensitivity to just bad operation (malicious or not).

This is the incentive model… it takes months to build up a decent seniority to the point where it is even impactful to try to influence the inner rings, but when an operator tries this, they get heavily penalized for it and will be replaced relatively quickly by somebody else who has been waiting just behind them.

They then are financially dis-incentived/dinged because you can’t just spin up a node and immediately be profitable. The fact that the resources aren’t free and that “playing the long game” becomes very expensive, and that when you have a healthy mesh with long-standing settled-rings, somebody turning malicious would essentially burn all of their months of work and their nodes would be pruned from the network or removed further down the prover-rings where it is even more costly.

I think this design is cost-prohibitive enough that staking just adds additional complexity and unnecessary overhead costs for good-faith actors.

6 Likes
9

Quil is a genius early practical cryptocurrency. Even ETH only converted to POS after many years of POW. If staking is started now, there will be more and more people with more coins, preventing newcomers from entering, which will lead to a lack of fresh blood, thus posing a threat to the entire project. Therefore, I propose that the official government does not enable staking, but third parties can pledge as they wish.

3 Likes
10

We have implemented a seniority and prover ring system, so why are you trying to grant prover privileges through POS staking like existing chains? It only seems like the intention is for early participants to dominate the network.

I believe that respect and bonuses for the OGs are adequately provided through seniority.

It’s disheartening to see attempts to ignore PoMW and simply change it to suit the preferences of early participants, especially when driven by individuals managing separate community channels.

3 Likes
11

I think as others mentioned, that if we are talking about bad actors behaviour, then the network has to tackle those specifically (if it doesn’t already as now there will be penalties, ways to be kicked out of a ring, I think even cass talked about some sort of blacklist in an article, etc.).

Not to force the whole community to do something, because a minority may be misbehaving.

Moreover, many things could go wrong with such proposal at this stage, mostly leading to centralization of the early whales and discouraging investment in equipment in the network to new participants, because simply they will not be able to afford as easily, the staking requirements.

We all now, so far, that the earnings rate were not the same if you were in the time where the cheap VPS yielded a lot, the times pre 1.4.19 where there were adjustments, then the period 1.4.19-1.4.21, and even there wasn’t the same if you enjoyed fully that period, or perhaps you started closer to 2.0 without reaching the 700k increment max rewards booster.

Looking forward, we also now expect the post 2.0 rewards being less than half what they used to be in the immediately prior period. Who knows what is going to happen until we reach the full original roadmap in let’s say, about 1y from now (we still need 2.1, 3.0 and 4.0 to be there).

Moreover, then we have the token price factor as well, now Q has a mc of about 150m usd, but we may still have the crazy part of the bull cycle ahead of us. Whatever requirement you set for quil/thread, won’t be the same if the price is the current one, or 3x, 5x, 10x, etc. Which depending where that caughts you if you are a new person willing to contribute to the network, will always penalize you vs the ones that were there before when the mc was smaller, then again, creating some sort of barrier to network growth/contribution.

Also, even despite all that if such proposal were to be adopted, I don’t think scaling linearly the quil requirement / thread is a fair approach, because the more you intend to contribute to the network, should be taken into consideration and reduce the requirement gradulally, the more threads you intend to provide. It can’t be just the same if you contribute lets say 64 threads than 64k.

So, in order of preference, my response to that proposal would we:

  1. Don’t implement it, let the network govern itself, and apply specific mechanisms for bad actors, without forcing the >90% of good ones to do something. The risks are too high to promote centralization of early whales/discourage network contribution. Plus the added complexity of the mc change, will always create barriers for new participants, and we all need to understand that if all goes well, the current nodes operators should be just a tiny part of the ones we expect to come in the future, so we shouldn’t create artificial barriers for growth

OR

  1. Implement it as an optional mechanism (but in that case you may have to consider some sort of benefit for the stakers), and even if so, considering applying not a linear scale for the required quil/thread (should be less the more you intend to contribute)
6 Likes
12

I agree with this, except i think its either yes or no. Because if it is “optional” it means that there would be some incentive or benefit to stake. If there is this benefit, then only those who stake will dominate. If there is no benefit then nobody would do it.

3 Likes
13

yes, but the devil is in the details, just for the sake of the argument, i will share a totally different staking model for the optional part: let’s say the overall issuance is reduced 5%, you funnel that 5% to 1, 2 or 3 staking vaults (each having a different staking duration, e.g. 90d, 180d and 1y), you distribute that 5% in like 1%, 1.5% and 2.5% respectively daily, hourly or whatever frequency defined, you will get that at the end of the lock up period, based on your contribution (no minimum, everyone can contribute whatever they want to the vault they prefer), it could be linear vesting or some more complex model, and you can withdraw whenever you want (or there could be an unstake waiting period)
in that way, such type of staking is optional, doesn’t affect emissions, anyone could contribute whatever they want, as long as they want and they could even cut short their participation. of course the concrete % funnelled to the vaults should be attractive enough to attract a certain level of participation in the vaults, otherwise the whole concept will be meaningless, but on the other hand, shouldn’t hurt too much the ones not participating (as the funnelled amount would reduce everyone’s rewards)

probably it will be simpler at this stage if there is no staking at all imho

2 Likes
14

but does not the staking rewards then add to the overall circulation?

15

first you reduce the overall issuance a certain %, let’s say 5% (this is purely an example, just to illustrate my point) and the you funnel that to the staking vaults.

so overall that circulation remains exactly the same (but you get the security benefits of staking a certain part and reducing the circulation of whatever is in the vaults, as long as it remains in the vaults)

17

In my opinion, the primary purpose of staking is to restrict nodes from doing evil. If the proposal is really for this purpose, rather than to restrict miners with a large number of coins from repurchasing coins to participate in mining after 2.0, I think that the scale of the node itself, such as nodes with less than 32 threads (that is, almost covering all ordinary desktops: such as the best 9950x, 16c32t) is the first tier of staking with 300 coins as the benchmark, and the second tier is professional node hosts, such as nodes with 33-256 threads, with staking 600 coins as the benchmark, and higher cluster miners use the number of working threads * 10 as the total staking amount. On this basis, nodes can be allowed to stake more and get more rewards. I think this is a feasible solution, such as a floating multiplier between 1-5x, and a final return ratio between 1-2.5x.
Secondly, as a proposer, I seriously question your purpose of letting nodes stake so much. I don’t know how much selfishness you have. I hope your ideas can take into account the interests of node operators, rather than your interests in maximizing the benefits of the large number of chips accumulated as an early participant.
Finally, you can compare it with the old project, phala, which also has a staking mechanism. I think you can get more experience with it as a reference.
I can give an example from my personal experience:
A 10850k machine has a minimum staking of 1,500 coins and a maximum staking of 10,000 coins.
The cost of the machine is about 5,000 RMB.
The cost of 1,500 coins as the lowest staking was about 3,000 RMB at the time.
There is no penalty for being offline. As long as your node synchronization is completed, you can get a reasonable amount of rewards every day, that is, you can get the total amount of coins you staked in about six to nine months.
That is, the ratio of the cost of the machine to the lowest staking price is 4:1-2:1, which I think is reasonable.
According to the current algorithm, the staking ratio of quil has reached a terrifying 1:1 or even 1:2, which is very unreasonable.

18

Why does it sound like this proposal has already been decided on, and only the implementation is up for debate?

19

I don’t think it is, or at least I hope it isn’t. I think Pete meant that in order to get it to even be implemented, it needs to be be refined with community feedback. If it gets feedback that it isn’t wanted/needed I suppose it goes no further.

That said, I still do not believe that Quilibrium needs staking at all. I think there is an aspect to staking that appeals to some, but I do not see it, and nor does Cassie see how you could implement it into the protocol.

I think the biggest thing is A. having the discussion around the topic and B. learning about Quilibirium to better understand how new features would or could not fit into the protocol.

For me, if all we are doing is “preventing people from doing evil” on the network with staking it comes from a lack of education on what Q is.

From Cassie’s blog post, she disusses her decision of PoW over PoS:

Proof of Stake is essentially an acknowledgement that Proof of Work becomes a scenario in which the largest sums of money in terms of hardware and electricity dictate the overall state of the network, and directly aligns economic reward (staking rewards) and disincentive (slashing of stake) respective to the quantity of token which is put up at stake to become a validator on the network. Because network partitions are a matter of course in distributed systems, there is still a need for handling forks, and so a common resolution method is to incorporate some means of attestations on blocks, such that the fork with the largest number of attestations is the chosen fork.

Both of these approaches wish to achieve the same result: strong consensus on a correct sequence formed of a larger series of potentially conflicting events (a reformulation of Byzantine Fault Tolerance) – in particular, ensuring that history cannot be rewritten such that a coin could be spent twice. Because network partitions are an assured event, finality is not reached until the network has reached a probabilistic outcome that a competing long-running fork can no longer exist. With Proof of Work, this probability is based on an assumption of economic certainty – that running comparable hash power to rewrite history would theoretically cost more than it’s worth, but this assumption proves to be fallacious, as electricity and hardware are not zero sum, nor is it a certainty that hash power will increase or even remain static for a network. When it is no longer economically advantageous to run the miners, they get turned off. Nevertheless, consensus is pure from a decentralization standpoint – in the face of forks, the rules of the network will inevitably converge on one, even if it means having to deepen the block height before accepting a transaction to be unlikely to be reverted.

Proof of Stake’s assumptions on the other hand are impure from a decentralization standpoint – in the face of slashing risk, many forms of attacks exist nevertheless, most perniciously, long range attacks. To patch over these problems, there is forced finality “locked in” on a shifting temporal basis. This of course requires some aspect of centralization, as a truly decentralized model would have no means of asserting the validity of one fork over another. The papered over term for this is Weak Subjectivity, but essentially means Proof of Stake ultimately relies on a social trust component to what the correct finalized state is based upon. While there exist other forms of consensus in distributed systems in the adversarial setting, many take on an economic component to improve over the minimum threshold of BFT, which otherwise breaks down when over 1/3 of the network is malicious/misbehaving.

Proof of Meaningful Work is a novel approach, building pure decentralized consensus that increases in security over time regardless of whether the quantity of nodes participating increases or decreases, but incentivizes the network to grow with the pace of technology by using a generational basis of economic policy.

Combined with the blog post on prover rings:

Seniority is a function of time… In 2.0 where VDF difficulty is adjusted to align to 10 second increments on average, we once again become bounded more closely to real world time. These segments of time accumulate as a simple “point” based system.

The [ other side of the coin ] is punishing bad behavior in the form of penalties. Inactivity when not part of a prover ring does not penalize beyond simply not accruing further seniority, but if part of an active ring under 2.0, missing proof intervals, issuing invalid proofs, or other misbehaviors will have penalties to seniority that can cause a peer for the prover range to be “evicted” by protocol rules and the next lower earning ring slot member will be upgraded to stand in place.

If you didn’t want to read all that, the TL;DR of it is that both traditional PoS and PoW have their issues with centralization and often rely on having ever increasing amount of miners or that a large portion of the network trust decide together what the results will be, which can fall apart if A. it becomes uneconomical or B. when too many people try to screw with the system. PoMW takes concepts from both worlds, mining/validation work (that is associated with real network tasks) and the seniority points for network activity and slashing if misbehaving.

PoMW isn’t necessarily tested yet, considering that, but it aims to do better than PoS or PoW.

1 Like
20

I agree with everything you’ve said in this thread so far. I just wanted to add that in many ways, Quilibrium is an untested experiment. Most people, even those who understand how e.g. bitcoin or ethereum work in depth, including myself, don’t understand the implementation (what is a hypergraph?).

PoMW is, as you said, is theory a better system. Quilibrium as a whole is, in theory, an awesome evolution of decentralized networks. It should be given the chance to test out its theories. I think enabling PoS-type mechanisms like this proposal is proposing would be detrimental to the network because it strips it of that chance to test it’s theories without extraneous variables possibly muddling the results.

If, as this proposal warns against, not having staking will lead to bad actors, poor economics, and otherwise poor security, then it is evidence that maybe PoMW isn’t a good system or the other economic mechanisms on Quilibrium don’t work great. But I’d like to see evidence of that being the case before trying to change things to be more similar to every other network which all suffer from a host of problems that Quil is attempting to solve.

2 Likes