The Radix Foundation Validator Subsidy is intended to level the playing field for all node runners and ensure a baseline compensation is available to subsidise the costs of running server infrastructure. With the current Foundation preparing to handover operations to the community, there is an opportunity to reconsider how the node runner subsidy is managed.
The aim of this proposal is to achieve the following objectives:
-
To remove the dependency on the current Radix Foundation to administer the subsidy.
-
To propose a revised validator subsidy that tapers down over time to both extend runway and minimise validators’ dependency on it as we move to a more sustainable means of incentivising validators.
-
To adjust the subsidy payment to account for both validator uptime and stake weight.
-
To promote the use of validator fees and encourage stake rebalancing across the validator set.
-
To make the receipt of the subsidy contingent on validators opting-in for a pseudo-jailing process to ensure high performance and network health.
Existing subsidy terms for reference:
Validators who KYC’d with the Radix Foundation were eligible to receive a subsidy of $500pm (paid in XRD) which is adjusted for uptime. The subsidy tapers linearly from 100% for 100% uptime, to 0% for 98% uptime.
This new proposal can be considered in two phases as follows:
Phase 1
- The existing Radix Foundation commits to administering the subsidy for a period of 3 months (covering January to March with a final subsidy payment sent in early April). The amount is to be the lesser of 400,000 XRD or $500 worth of XRD, for each of the three transition months (assuming 100% uptime).
This minimises price sensitivity during the transition and caps XRD outflow in the event there is a significant price shock to the downside. This 3 month period is intended to provide time for validators to prepare for phase 2.
Phase 2
- The administration of the subsidy moves to the new community entity.
The subsidy begins to taper aggressively over a period of 9 months from month 4 onwards, as per table 1 below. After 12 months the Radix community should decide whether to continue or cease the subsidy entirely.
Table 1
A small amount of administration will be needed to calculate subsidies each month and a monthly transparency report published. This could be covered via a small stipend to be agreed by the community.
- The subsidy is adjusted for uptime (as per the existing policy) and also stake weight, by assuming a 15% fee is set by all validators.
This is not a mandatory fee, but is used for calculation purposes to promote the use of higher fees for high staked validators. The aim is to encourage unstaking from these nodes and progressively move towards a median stake weight of 1% in the validator set. (Note, this correction will only apply after phase 2, the remaining subsidy payments administered by the current Foundation will not be affected). The impact of this correction can be seen in Table 2 below:
Table 2
The current subsidy correctly accounts for uptime, but does not consider the different economic realities of nodes at different stake levels. The approach above weights the subsidy in favour of nodes with less stake. These nodes incur similar costs, but are less able to cover them through fees. The effect being that nodes with higher stake have a greater incentive to increase their fees.
For a validator with more than around 5% stake, no subsidy would be awarded at all, with values increasing progressively and inversely proportional to stake weight. A highly staked validator is therefore encouraged to raise fees to make up the difference lost by the calculation. It is worth highlighting here, the effect on stakers’ APY in the event a validator increases their fees to 10 or even 15%. Below is an example:
Validator A has a 0% fee and 100% uptime. The APY their stakers earn is 7%
Validator B has a 2% fee and 100% uptime. The APY their stakers earn is 6.84%
Validator C has a 15% fee and 100% uptime. The APY their stakers earn is 5.95%
Whilst the fee increase appears significant, the effect on stakers APY is minimal, with only 1.05% difference in annual yield, despite a 15% increase in validator fees.
Over time, the intention is for this fee mechanism to contribute to stake rebalancing, as stakers will be encouraged to move to validators lower down the set with lower fees. This is healthy for decentralisation and allows the network to become more self-sustaining over time.
If this stake rebalancing effort is successful, an average stake of ~1% across the set will facilitate the end of the subsidy altogether, to a model whereby nodes are incentivised by fees alone. This can also be supplemented by an upgrade to the XRD price on chain (to be considered in a separate proposal) so that transaction fees are brought more inline with the current price, directly benefiting validators.
- The subsidy payments should also be contingent on validators opting-in to a pseudo-jailing mechanism which is described below:
Pseudo-Jailing
Jailing is the term used to describe the action of excluding top 100 validators from taking part in consensus. In the current network, if a validator is offline, suffers high latency or some other network issue, they may not be able to propose the state of the network when called up to do so. As a result the liveness of the network is affected. The impact of this is dependent on the amount of stake carried by validator(s) experiencing the downtime.
Generally the network performs well, and whilst there are currently a handful of validators who are registered for consensus but offline, the effect is negligible as they don’t carry a lot of stake.
One concern for example would be if a cloud provider (take Hetzner for example) decides that validating on Radix breaches their terms. They could theoretically switch off up to 30% of the network overnight. If such an event was to occur, individual validators would be required to unregister or migrate to backup servers to prevent the network halting. In order to limit downtime in such an event, jailing can be implemented which performs the job of unregistering nodes to ensure the network can continue to function.
Ideally this would be implemented at the protocol level, requiring an upgrade to the node software. However, given the importance and criticality of this feature, this proposal suggests an interim solution that can be implemented without any node upgrade.
Some of the validator/node runners already utilise an access manager component which allows them to deposit their owner badge (which has ultimate control of the validator component) and mint multiple admin badges. The original intention for this component was to allow validator teams to collectively take responsibility for a validator or to delegate responsibility to a third party (by enabling anyone with an admin badge to call methods such as “unregister” or “update fee”).
The proposal is to enhance the access manager component with a jailing feature that would automatically be opted-in to, but could be opted-out at the discretion of the validator/node runner.
With the “jailing” feature enabled, this would authorise a validator/community committee to call the unregister method on the validator subject to certain conditions being met. This committee would be able to vote on whether a node should be unregistered, based on a minimum stake weight (TBD) and a number of voting participants (TBD). Once the threshold is met, the committee would be able to force the unregister method to be called on the validator, and potentially lock the component for a period of time.
This approach is not enforced by the network itself and would not require any upgrade to the node software. It is intended to serve as an interim solution for ensuring that poor performing validators can be removed to preserve network function and liveness.
The challenge comes from ensuring that enough validators opt-in to deposit their owner badge into the access manager component. It is therefore suggested that if implemented, receipt of the subsidy be made on the condition of a validator opting in to this process. Provided 70%+ of stake agrees to be bound by this pseudo-jailing process, network liveness can be safeguarded until an automated process can be implemented at the protocol level.
)