RFC: Increase minimum UTXO age for collateralization

[aesedepece]

Where are we?

• Collateralization in Witnet means that nodes that become eligible to participate in resolving a specific oracle query (witnessing) will be required to stake a certain amount of Wit coins upon publishing their commitment transaction. If their committed values pass the filters in the eventual tally of the query, they get the stake back. If they don't pass the filters (aka liar), they lose the collateralized coins.
• For any UTXO to be used as collateral, it must have existed for more than 2000 epochs (25 hours). We often call this UTXO age requirement. It's current value was inherited from the testnet times and was never adjusted to the mainnet reality.
• Collateralized coins are refunded to their owners in the tally transaction, with a new UTXO age of 0 epochs.
• The point of collateralization is twofold: (1) deterring bribery attacks and (2) sybil resistance.
• Bribery attacks on oracles like Witnet, and the role of collateralization for deterring them, have been discussed at length in this Medium post.
• Collateralization provide sybil resistance because it creates exclusion of resources. The same coins cannot be collateralized on multiple identities at the same time, and you can only move the coins from one identity to another just as fast as the minimum UTXO age requirement allows.
• Thus, the maximum amount of identities that an actor can operate in parallel is bounded by the amount of Wit coins they possess, divided by the amount of coins that they could potentially need to collateralize in each of them, over a period equivalent to the UTXO age.
• A minimum collateral requirement for each oracle query is currently enforced by the protocol, and set to 1 Wit. Requesters can freely decide to increase that requirement for any specific query.
• As a naive exercise of landing these numbers, with the current average frequency of 1 query every 51 seconds, totaling 1765 queries over the period equivalent to the UTXO age, each asking in average 5 Wits of collateral, the minimum Wit balance to maintain in each identity is 8825 wits. In other words, you can currently run 113 identities off 1M Wit. At $0.003508 a Wit, the balance requirement for each identity is worth $31.
• The calculation above, however, assumes that identities are always eligible to witness, and totally forgets about RepPoE. In reality, the luckiest of the identities has only witnessed 1 in every 277 queries, and thus all the requirements above can be divided by that factor to find a more realistic (yet still very optimistic) upper bound requirement. That means roughly 32 Wit per identity (worth $0.11), or 31388 identities off 1M Wit.
• In absence of a reliable method for measuring what's the total amount of Wit coins resting at nodes and ready to collateralize, we can make a finger up estimation assuming that everyone is depositing at least those 32 Wit in each identity, and multiplying by the 522013 identities we've ever seen witnessing, adding up 16704416 Wit, which makes some 1.64% of the circulating supply. Let's consider that the lower bound estimation.
• This number should be higher in reality as the official recommendation for new node operators is to deposit at least a few hundred Wits. Also, it's in the nature of the protocol identities to earn more Wits through block rewards and witnessing rewards. Let's then make another estimation by taking a quick look at the average balance of the identities in most recent witnessing committees (1117 Wits, worth $3.92) and multiplying that by the 522013 identities, we get 583M Wits (worth some $2M) deposited in witnessing identities (57% of the circulating supply). Let's consider that the upper bound estimation.

What's the issue then?

• The price feeds powered by the Witnet network are already securing multiple millions in TVL from several DeFi projects.
• This TVL is supported by a total amount of Wit coins that is worth no more than $2M.
• With that stakes, a bribery attack would be, at least in theory, economically feasible.
• Regarding sybil attacks or 51% attacks, that'd require a takeover of the network by means of collateralizing just as much value as the network is already worth. It is hard to believe that a single actor could hold enough Wit to run such an operation, but it really depends on what's the actual percentage of the circulating supply currently resting at witnessing nodes. If it's actually closer to the lower bound as described above, then this attack might as well be possible.
• There's no way around the fact that our TVS is higher than our market cap ($3.5M), and it will probably be forever. By definition, oracles introduce non-economic mechanisms that allow them to remain undercollateralized (e.g. our reputation system). As an example, Chainlink is undercollaterlized by 1/10th (their TVS is 10x their market cap).

Can devs do something?

• We could jump the gun and advocate for raising the minimum collateral amount. In theory, if you make it 100 Wit instead of 1 Wit, we could increase the total staked amount of Wit tokens (our own TVL, let's say) by the same factor. However, as it's on the requester to choose the right collateral requirement for their use case, increasing the minimum would only remove the flexibility of having dirty cheap requests may we adopt a collateral-to-reward ratio.
• The only point in increasing the minimum collateral would be to force requesters to adjust this parameter instead of defaulting to the minimum. However, as most of the requests come from the still-centralized bridge, this is something we can act directly and immediately without any changes to the protocol.
• Increasing any consensus constant denominated in Wit can always have some unexpected side-effects if the price of the Wit coin goes up significantly.
• Increasing the UTXO age requirement however has zero impact on oracle queries. This change should be transparent to end users, and wouldn't affect the cost of the queries may we adopt a collateral-to-reward ratio. The only impact of this chance would be on node oeprators, who would be urged to deposit more Wits into their identities in fear of missing a chance to witness because they lacked enough mature UTXOs.
• As it is obvious, whatever extension to the UTXO age requirement would help multiply the total collateralized value proportionally. Therefore, any proposal that extends this parameter should aim to bring the total collateralized value closer to the upper bound estimation above, and to mitigate the undercollateralization of the protocol. That is, we need collateralization to capture as much of the circulating supply as possible (which btw may cause a supply shock on the market and in turn could help increasing the market cap and further reducing undercollateralization).
• The main downside to a longer UTXO age requirement is obviously that new identities won't be able to witness for a longer period, that is, it would extend the bootstrapping time of new nodes.

My proposal

• Urge all ecosystem players currently publishing oracle queries to adjust up their collateral requirements according to the value they are securing. This will immediately help increase the total collateralized value.
• Urgently enact a WIP that increases the UTXO age requirement significantly. I don't see why it should be less than 2 weeks. That sounds to me like a reasonable bootstrapping time and would immediately provide a >13X multiplier on the protocol security.
• Optionally consider a future increase to the minimum collateral amount requirement, because even if it won't make that big of an impact (as it is up to the requesters to adjust on a query basis), leaving it as low as it is today allow them to be negligent and compose queries that make no sense from an economic point of view. Setting the minimum to 100 Wits should work for now.
• Educate the node operators community in the need of depositing more Wit in their nodes. The message is clear: "if you have less than X Wits in your node, you're missing chances to earn, and you're messing with your own ROI/APY. Go and deposit some more Wits now!!!!"

[drcpu-github]

• Urgently enact a WIP that increases the UTXO age requirement significantly. I don't see why it should be less than 2 weeks. That sounds to me like a reasonable bootstrapping time and would immediately provide a >13X multiplier on the protocol security.

I like this idea, I have been advocating for it when we launched from testnet to mainnet. Not sure if a jump from ~1 day to 14 days is really justified, it feels like a steep increase, but it's likely not a drama either.

It would be good to have a more detailed analysis of required collateral under the current network velocity and some hypothetical increased velocities rather than some back-of-the-envelope numbers though. You probably don't really want to misconfigure this requiring node operators to suddenly stake $100's of dollars on a node.

• Optionally consider a future increase to the minimum collateral amount requirement, because even if it won't make that big of an impact (as it is up to the requesters to adjust on a query basis), leaving it as low as it is today allow them to be negligent and compose queries that make no sense from an economic point of view. Setting the minimum to 100 Wits should work for now.

I don't think an arbitrary change like this moves us in the right direction. The increase from 1 WIT to 100 WIT is exaggerated. Furthermore, for the reasons you already mention it can result in requests becoming prohibitively expensive (assuming an R/C ratio is enabled). If price changes significantly, having a discussion, writing up the WIP and with TAPI taking at least two weeks to apply the WIP, it would likely mean request become expensive for about a month.

[drcpu-github]

Educate the node operators community in the need of depositing more Wit in their nodes. The message is clear: "if you have less than X Wits in your node, you're missing chances to earn, and you're messing with your own ROI/APY. Go and deposit some more Wits now!!!!"

Related to #2218, it would be useful to have proper statistics in e.g. NodeStats to track failure to generate data request commits due to having too few available UTXOs.

[aesedepece]

It would be good to have a more detailed analysis of required collateral under the current network velocity and some hypothetical increased velocities rather than some back-of-the-envelope numbers though. You probably don't really want to misconfigure this requiring node operators to suddenly stake $100's of dollars on a node.

Let me apologize for my lumpy guesstimations. I agree that an eventual WIP on this matter should be supported by a more thorough analysis.

I don't think an arbitrary change like this moves us in the right direction. The increase from 1 WIT to 100 WIT is exaggerated. Furthermore, for the reasons you already mention it can result in requests becoming prohibitively expensive (assuming an R/C ratio is enabled). If price changes significantly, having a discussion, writing up the WIP and with TAPI taking at least two weeks to apply the WIP, it would likely mean request become expensive for about a month.

I agree with you here. My only point for a possible increase is simply to deter users from defaulting to stupidly low values for this parameter.

Related to #2218, it would be useful to have proper statistics in e.g. NodeStats to track failure to generate data request commits due to having too few available UTXOs.

That'd be very interesting from an UX point of view to let the user discover how hard they are missing out in case that they undercollateralized their nodes. If the WF starts to raise the collateral requirements of their price feeds immediately, we should have this feature in place asap to start to quantify the impact and make a more sensible decision when establishing a new value for the UTXO age requirement.

[drcpu-github]

In an attempt to model what the collateral requirements would be for different lockup periods, I created a simple ARS simulator. This simulator will either simulate past data request traffic or a synthetic data request distribution.

Given a specified collateral lockup period, I tracked the two statistics I believe are most important in this context:

1. How many data requests a node could solve given a fixed amount of Witnet coins deposited
2. How many it was eligible to solve but failed because the node had no Witnet coins available for collateral

Note that this statistical simulation and serves only as a first-order approximation. In the end, there are a lot more network parameters that influence the final ARS make-up (and thus data request eligibility) than I can reasonable simulate.

In total I simulated 6 configurations over 80.640 epochs:

1. A real-world data request distribution (taken from the months of June and July 2022) combined with a lockup period of 1 and 2 weeks respectively. During these months, the average number of data requests per block was close to 1.
2. A synthetic data request distribution with an average number of data requests per block of 2 and a lockup period of 1 and 2 weeks respectively. In the month of May we saw close to this amount of data requests per block on average.
3. A synthetic data request distribution with an average number of data requests per block of 4 and a lockup period of 1 and 2 weeks respectively. This is meant to indicate what happens under more widespread adoption leading to a significant increase in the number of data requests per block.

For each of these simulations I assigned x collateral to all nodes. I summarized the maximum number of data requests any node completed (labeled as Solved ) and the maximum number of data requests any node missed out on labeled as Locked.

Collateral locked for 13440 epochs:

	1.000	2.000	3.000	4.000	5.000
Solved @ 1 DR/block	1.392	2.073	2.233	2.092	2.059
Locked @ 1 DR/block	5.803	213	0	0	0
Solved @ 2 DR/block	779	1.048	1.046	1.133	1.095
Locked @ 2 DR/block	2.690	109	0	0	0
Solved @ 4 DR/block	800	1.599	2.306	2.595	2.809
Locked @ 4 DR/block	11.188	11.894	983	202	0

Collateral locked for 26880 epochs:

	1.000	2.000	3.000	4.000	5.000	6.000	7.000	8.000
Solved @ 1 DR/block	729	1.305	1.854	2.090	2.092	/	/	/
Locked @ 1 DR/block	4.403	1.052	494	55	0	/	/	/
Solved @ 2 DR/block	400	777	997	1.087	1.034	1.120	1.063	1.011
Locked @ 2 DR/block	6.523	474	165	0	0	0	0	0
Solved @ 4 DR/block	400	800	1.200	1.600	2.000	2.288	2.540	2.722
Locked @ 4 DR/block	21.573	8.744	962	771	672	464	221	99

I also checkedthe average number of data requests solved and missed out on for the top 100 most reputable nodes in the ARS at the end of the simulation. While this is certainly an interesting statistic, it does yield a somewhat skewed image because a node could be part of the top 100 because another node missed out on solving a number of data requests which may or may not happen in reality.

Collateral locked for 13440 epochs:

	1.000	2.000	3.000	4.000	5.000
Solved @ 1 DR/block	401	824	839	804	772
Locked @ 1 DR/block	134	6	0	0	0
Solved @ 2 DR/block	239	506	588	555	524
Locked @ 2 DR/block	104	0	0	0	0
Solved @ 4 DR/block	386	487	558	907	836
Locked @ 4 DR/block	1.666	368	31	3	0

Collateral locked for 26880 epochs:

	1.000	2.000	3.000	4.000	5.000	6.000	7.000	8.000
Solved @ 1 DR/block	365	503	635	732	742	/	/	/
Locked @ 1 DR/block	170	15	9	0	0	/	/	/
Solved @ 2 DR/block	269	318	491	549	551	579	522	566
Locked @ 2 DR/block	674	2	1	0	0	0	0	0
Solved @ 4 DR/block	308	462	506	582	640	660	785	867
Locked @ 4 DR/block	10.076	475	22	8	2	1	2	2

There are a lot of conclusions you can draw from these numbers depending on several paramters which have not been decided. However, the most important one is probably that if you never want to miss out on a data requests, you'll need more than 5k coins deposited on your node. If you are happy with missing out on a few and aiming at just being part of the ARS, you'll likely fine with depositing about 3k coins.

[aesedepece]

WIP-0027 is live now on Witnet mainnet!