feeDistributor vat is not ugpradable

[warner]

While looking at #8499 (comment) . and thinking about how v28-feeDistributor would react under upgrade, we noticed that v28-feeDistributor is not ugpradable.

v23-feeDistributor has code which talks to the timer service and creates a notifier during startDistributing. However this function is called only from makeFeeDistributor, which creates ephemeral creatorFacet and publicFacet objects (using Far()). So this contract instance is not upgradable: if we were to deploy any new version of v23-feeDistributor, these facets would be abandoned, making them unavailable for clients.

Since we can't upgrade v23-feeDistributor, we'll need to replace it, somehow, by convincing any clients to use a different vat, and then terminate the old one.

I didn't find any other tickets describing our plan to replace this code, so I figured I should start a new one.

cc @Chris-Hibbert

[dckc]

Um... did we miss this one in the bulldozer planning somehow? No... we decided it was OK:

"cron job" with no important state. can terminated and replaced at will.
-- #5795

agoric-sdk/packages/builders/scripts/vats/restart-vats.js

Lines 7 to 9 in d3ddae6

	// can be replaced instead of upgraded
	'auctioneer',
	'feeDistributor',

I think there are no clients.

[Chris-Hibbert]

The feeDistributor may only be used by PSM and vat-bank.

[dckc]

feeDistributor collects from vaultFactory and sends to reserve; so it's a client of those 2.

agoric-sdk/packages/inter-protocol/src/proposals/econ-behaviors.js

Lines 500 to 502 in 1749514

	const collectorKit = {
	vaultFactory: E.get(vaultFactoryKit).creatorFacet,
	};

PSM could generate fees, but it doesn't, so we didn't write it up, AFAICT.

feeDistributor 's only client is the time service, I think.

[Chris-Hibbert]

The feeDistributor does all the work, and knows both the payers and payees. Neither of those has any knowledge of the feeDistributor.

The bootstrapSpace has creatorFacets for the payers, which have a makeCollectFeesInvitation() method. It also knows how to make depositFacets for the recipients of the funds.

To replace (not upgrade) the feeDistributor, just create a new one, and register it as the feeDistributor

  feeDistributorKit.resolve(
    harden({ ...instanceKit, label: 'feeDistributor' }),
  );
  feeDistributorP.resolve(instanceKit.instance);

The only current provider of fees is vaultFactory, and the recipients are current configured as

      keywordShares: {
        RewardDistributor: 0n,
        Reserve: 1n,
      }

[LuqiPan]

@Chris-Hibbert, this looks to me a duplicate of #10393 and as such, should it be closed?

[Chris-Hibbert]

@LuqiPan It has details that weren't reproduced in #10393

@anilhelvaci, PTAL at this and verify that it doesn't raise any issues that we might have missed in #10453.

[LuqiPan]

@anilhelvaci ping on above comment/question

[anilhelvaci]

My understanding is that this issue is concerned about any clients of feeDistributor will lose their reference to feeDistributor once it is replaced. And asks "Are we covering this issue?".

I agree with @dckc 's comment here. With one caveat:

feeDistributor 's only client is the time service, I think.

I believe this should be the opposite. feeDistributor is a client of timerService since feeDistributor is the one requesting a notifier from timerService:

agoric-sdk/packages/inter-protocol/src/feeDistributor.js

Lines 94 to 97 in 3b478fb

	const collectionNotifier = E(timerService).makeNotifier(
	0n,
	collectionInterval,
	);

This brings us to the conclusion that feeDistributor has NO clients and it functions with the powers it receives from the bootstrap space. Our current test results comply with this. Here's the scenario we implement to test this:

• Start a new feeDistributor with a shorter collectionInterval (30 seconds) and override the old one from bootstrap space.
• Repeat below steps for three times. This will ensure the fees are coming from the new feeDistributor and not the old one as the old one's collectionInterval is 1 hour.
  • Open a vault
  • Use syncTools to wait until reserve balance increases

replaceFeeDistributor.test.js produces expected results.

I believe it's safe to close this ticket. @LuqiPan @Chris-Hibbert