Skip to content

Commit b6e5bca

Browse files
authored
README: Heartbeat README tweaks (#6212)
1 parent 005495b commit b6e5bca

File tree

1 file changed

+14
-14
lines changed

1 file changed

+14
-14
lines changed

heartbeat/README.md

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Block Payouts, Suspensions, and Heartbeats
22

33
Running a validator node on Algorand is a relatively lightweight operation. Therefore, participation
4-
in consensus was not compensated. There was an expectation that financial motivated holders of Algos
4+
in consensus was not compensated. There was an expectation that financially motivated holders of Algos
55
would run nodes in order to help secure their holdings.
66

77
Although simple participation is not terribly resource intensive, running _any_ service with high
@@ -11,13 +11,13 @@ face of hardware failure (or the accounts should leave consensus properly).
1111

1212
With those burdens in mind, fewer Algo holders chose to run participation nodes than would be
1313
preferred to provide security against well-financed bad actors. To alleviate this problem, a
14-
mechanism to reward block proposers has been created. With these _block payouts_ in place, large
14+
mechanism to reward block proposers has been created. With these _block payouts_ in place,
1515
Algo holders are incentivized to run participation nodes in order to earn more Algos, increasing
1616
security for the entire Algorand network.
1717

1818
With the financial incentive to run participation nodes comes the risk that some nodes may be
1919
operated without sufficient care. Therefore, a mechanism to _suspend_ nodes that appear to be
20-
performing poorly (or not at all). Appearances can be deceiving, however. Since Algorand is a
20+
performing poorly (or not at all) is required. Appearances can be deceiving, however. Since Algorand is a
2121
probabilistic consensus protocol, pure chance might lead to a node appearing to be delinquent. A new
2222
transaction type, the _heartbeat_, allows a node to explicitly indicate that it is online even if it
2323
does not propose blocks due to "bad luck".
@@ -26,17 +26,17 @@ does not propose blocks due to "bad luck".
2626

2727
Payouts are made in every block, if the proposer has opted into receiving them, has an Algo balance
2828
in an appropriate range, and has not been suspended for poor behavior since opting-in. The size of
29-
the payout is indicated in the block header, and comes from the `FeeSink`. The block payout consist
29+
the payout is indicated in the block header, and comes from the `FeeSink`. The block payout consists
3030
of two components. First, a portion of the block fees (currently 50%) are paid to the proposer.
31-
This component incentives fuller blocks which lead to larger payouts. Second, a _bonus_ payout is
32-
made according to a exponentially decaying formula. This bonus is (intentionally) unsustainable
31+
This component incentivizes fuller blocks which lead to larger payouts. Second, a _bonus_ payout is
32+
made according to an exponentially decaying formula. This bonus is (intentionally) unsustainable
3333
from protocol fees. It is expected that the Algorand Foundation will seed the `FeeSink` with
3434
sufficient funds to allow the bonuses to be paid out according to the formula for several years. If
3535
the `FeeSink` has insufficient funds for the sum of these components, the payout will be as high as
3636
possible while maintaining the `FeeSink`'s minimum balance. These calculations are performed in
3737
`endOfBlock` in `eval/eval.go`.
3838

39-
To opt-in to receiving block payouts, an account includes an extra fee in the `keyreg`
39+
To opt-in to receive block payouts, an account includes an extra fee in the `keyreg`
4040
transaction. The amount is controlled by the consensus parameter `Payouts.GoOnlineFee`. When such a
4141
fee is included, a new account state bit, `IncentiveEligible` is set to true.
4242

@@ -47,7 +47,7 @@ stake. If the account has too much or too little, no payout is performed (thoug
4747
rounds earlier, so a clever proposer can not move Algos in the round it proposes in order to receive
4848
the payout. Finally, in an interesting corner case, a proposing account could be closed at proposal
4949
time, since voting is based on the earlier balance. Such an account receives no payout, even if its
50-
balances was in the proper range 320 rounds ago.
50+
balance was in the proper range 320 rounds ago.
5151

5252
A surprising complication in the implementation of these payouts is that when a block is prepared by
5353
a node, it does not know which account is the proposer. Until now, `algod` could prepare a single
@@ -98,15 +98,15 @@ to 320 rounds past the current round.
9898
## Challenges
9999

100100
The absenteeism checks quickly suspend a high-value account if it becomes inoperative. For example,
101-
and account with 2% of stake can be marked absent after 500 rounds (about 24 minutes). After
101+
an account with 2% of stake can be marked absent after 500 rounds (about 24 minutes). After
102102
suspension, the effect on consensus is mitigated after 320 more rounds (about 15
103103
minutes). Therefore, the suspension mechanism makes Algorand significantly more robust in the face
104104
of operational errors.
105105

106106
However, the absenteeism mechanism is very slow to notice small accounts. An account with 30,000
107107
Algos might represent 1/100,000 or less of total stake. It would only be considered absent after a
108108
million or more rounds without a proposal. At current network speeds, this is about a month. With such
109-
slow detection, a financially motived entity might make the decision to run a node even if they lack
109+
slow detection, a financially motivated entity might make the decision to run a node even if they lack
110110
the wherewithal to run the node with excellent uptime. A worst case scenario might be a node that is
111111
turned off daily, overnight. Such a node would generate profit for the runner, would probably never
112112
be marked offline by the absenteeism mechanism, yet would impact consensus negatively. Algorand
@@ -136,11 +136,11 @@ committed your latest round yet.
136136

137137
It is relatively easy for a bad actor to emit Heartbeats for its accounts without actually
138138
participating. However, there is no financial incentive to do so. Pretending to be operational when
139-
offline does not earn block payouts. Furthermore, running a server to monitor the block chain to
139+
offline does not earn block payouts. Furthermore, running a server to monitor the blockchain to
140140
notice challenges and gather the recent blockseed is not significantly cheaper than simply running a
141141
functional node. It is _already_ possible for malicious, well-resourced accounts to cause consensus
142142
difficulties by putting significant stake online without actually participating. Heartbeats do not
143-
mitigate that risk. But these mechanisms have been designed to avoid _motivating_ such behavior, so
143+
mitigate that risk. Heartbeats have rather been designed to avoid _motivating_ such behavior, so
144144
that they can accomplish their actual goal of noticing poor behavior stemming from _inadvertent_
145145
operational problems.
146146

@@ -163,13 +163,13 @@ The conditions for a free Heartbeat are:
163163

164164
## Heartbeat Service
165165

166-
The Heartbeat Service (`heartbeat/service.go`) watches the state of all acounts for which `algod`
166+
The Heartbeat Service (`heartbeat/service.go`) watches the state of all accounts for which `algod`
167167
has participation keys. If any of those accounts meets the requirements above, a heartbeat
168168
transaction is sent, starting with the round following half a grace period from the challenge. It
169169
uses the (presumably unfunded) logicsig that does nothing except preclude rekey operations.
170170

171171
The heartbeat service does _not_ heartbeat if an account is unlucky and threatened to be considered
172-
absent. We presume such false postives to be so unlikely that, if they occur, the node must be
172+
absent. We presume such false positives to be so unlikely that, if they occur, the node must be
173173
brought back online manually. It would be reasonable to consider in the future:
174174

175175
1. Making heartbeats free for accounts that are "nearly absent".

0 commit comments

Comments
 (0)