Increase Ignition Queue Throughput

Author Mitchell Tracy Aztec Labs
Payload Address 0x05d2a884760f801c1c59369f6fe576132e8ef96c
Proposal ID 0

Simple Summary

This proposal increases the current throughput of the entry queue, allowing validators to join the set more quickly. It also decreases the maximum possible queue flush rate.

Motivation

The current, relevant parameters are:

Key Value
bootstrapValidatorSetSize 500
bootstrapFlushSize 500
normalFlushSizeMin 1
normalFlushSizeQuotient 2048
maxQueueFlushSize 8
aztecSlotDuration 72 (seconds)
aztecEpochDuration 32 (slots)

The function of the queue is divided into “bootstrap” and “normal” modes. In “bootstrap” mode, no one is flushed into the rollup until bootstrapValidatorSetSize validators are in the queue. At that point, up to bootstrapFlushSize validators may be added per epoch until there are bootstrapValidatorSetSize validators in the set, at which point the system is considered “bootstrapped”, and the queue enters “normal” mode.

In “normal” mode, the number of validators that may be added per epoch is

Math.min(
    Math.max(_activeAttesterCount / config.normalFlushSizeQuotient, config.normalFlushSizeMin),
    config.maxQueueFlushSize
  )

This produces the following characteristic (only looking at “normal” mode)

At the time of writing, there are 827 active validators in the rollup, and 2,911 validators in the queue, so 1 validator is being added per epoch. At this rate, it will take 77 days for validators entering the queue to join the set. This will result in poor network participation and issues as the queue grows with validators being stuck in the queue ahead of the alpha upgrade next year.

The primary point of the queue is to prevent the validator set from being overwhelmed by validators that are misconfigured/offline, and thereby unable to participate in block production or governance.

If the rollup were to take in these “dead” validators faster than they could be removed via slashing, it could put the network in a situation where more than 1/3 of the validators in the set are dead, which is difficult to recover from.

The Ignition network has had extremely good participation in terms of block production and attestations, often hitting 100% on both metrics in an epoch. Further, slashing is working as expected which gives confidence in the network’s ability to withstand dead validators.

Based on this, and given our expertise as the authors of the L1 contracts and Aztec client, we (Aztec Labs), feel a safe assumption is that 95% of the current validators are online and at most 60% of validators in the queue are offline. Therefore, we feel it is safe to increase the throughput of the queue to:

Key Value
normalFlushSizeMin 1
normalFlushSizeQuotient 400
maxQueueFlushSize 4

This would produce the following characteristic (only looking at “normal” mode):

Here are monte carlo simulations demonstrating how this would play out assuming this proposal were enacted at the time of this writing, and 60% of the validators presently in the queue and in perpetuity were offline.

These simulations may be reproduced using the code at here with the command of

uv run main.py --mode monte_carlo --quotient 400 --max-flush 4  --queue-dishonest 0.6 --runs 25 --epochs 6000 --validators 827 --honest-ratio 0.95

Signaling/Voting

To signal for this change, please use the following admin API command on your node.

The payload address is 0x05d2a884760f801c1c59369f6fe576132e8ef96c.

curl -X POST <http://localhost:8880> \\
  -H 'Content-Type: application/json' \\
  -d '{
    "jsonrpc":"2.0",
    "method":"nodeAdmin_setConfig",
    "params":[{"governanceProposerPayload":"0x05d2a884760f801c1c59369f6fe576132e8ef96c"}],
    "id":1
  }'

Simulating Payload Execution

The source for the payload is here. Simulating execution by governance can be done via:

forge script FasterIgnitionSim -vvvv --rpc-url your_rpc

It will be seen that there is one write to 0xE525c64ee3bb9a0ed18e42504d313128ed19fD31 (ValidatorOperationsExtLib), and the entry queue flush size after execution is 2.

References

7 Likes

Hey guys. Am I understanding this right - the top 3 providers can basically decide for the whole network since they hold most of the stake? And if I’m against this proposal, does that mean I don’t really need to vote at all? And one last question: is there anywhere I can see live stats on how many people have voted and how they voted? Thanks.

2 Likes

Thanks @mitch

I understand what this change will do to the current queue and I am partially onboard with the reasoning around risk, but I’m left wondering what the actual motivation is for speeding up the queue.

Can you spell it out for me? Is it this?

At this rate, it will take 77 days for validators entering the queue to join the set. This will result in poor network participation and issues as the queue grows with validators being stuck in the queue ahead of the alpha upgrade next year.

Can you define

poor network participation and issues

for me?

Cheers

1 Like

The Governance and Proposal Process doc does a good job covering this, but I’ll touch on some nuance below.

the top 3 providers can basically decide for the whole network since they hold most of the stake? And if I’m against this proposal, does that mean I don’t really need to vote at all?

No. What providers can do in practice is signal. Payloads go through sequencer signaling, and then token voting in Governance.

To advance out of the signaling phase, it requires 600/1000 consecutive L2 slots to contain support for a specific payload, at which point the payload can be submitted as proposal to Governance.

For token voting, by default, when someone stakes, their voting power is delegated to the rollup contract itself, and the rollup contract has a permissionless function on it to vote “yes” on anything that its sequencers submitted to Governance.

So if users don’t like what their provider signaled for, they can delegate their voting power to themselves and vote “no”.

And one last question: is there anywhere I can see live stats on how many people have voted and how they voted? Thanks.

There isn’t a nice UI yet (it is in the works), but I added some simple utilities here where you can see signaling payloads across rounds and votes on a particular proposal.

1 Like

Good call out. It wasn’t made perfectly clear. The queue is created per rollup. So if the next rollup is deployed before the current queue is drained, then the deposits of all the people remaining in the queue will fail. I suspect this will cause token holders who would’ve otherwise been happily staking, to be unhappy right around TGE.

1 Like

Voting NO on Queue Speed Proposal
Arguments:
Queue is mostly large providers, not solo stakers
Big providers add 20-50 validators vs our 5 max
Faster queue = faster APY dilution (77 days - >40 days)
Top 3 providers already control ~40% stake
Network running fine at 95%+ participation
No urgency: Alpha is 3 months away

4 Likes

We fully support this proposal, and we believe everyone should support this for the sake of community and fairness. They participated in the sale to support the network, and they are already locked for 3 months until TGE. For anyone above 200k, staking is a must; otherwise, they will not get their tokens at TGE. All of this is fine, but while all this is in place, putting people in a 2-month-long queue is not OK.

It just gives some early stakers (public and genesis sequencers who are going to vote on this proposal) so much advantage. Because of low sequencer numbers, APR will be high, and if someone just stakes 100 sequencers in a row at an early stage, that person just gains so much more rewards vs everyone else who just sits in the queue. This just creates a very unfair situation.

It’s just a queue limit increase, which is a very low-risk change unless we enroll a bunch of offline, not capable sequencers and they all get picked up for the committee; but considering top-heavy delegation, that is not a possibility.

1 Like

Sorry if I missed it, but what’s the timeline for this vote?

I agree with this. The proposal makes 0 sense. There is no urgency to speed up the queue. The conditions were perfectly clear from the start and there is no incentive for current voting power to vote “yes“.
Keeping this in mind, be advised that doing nothing will automatically result in voting “yes“ when the proposal voting period is activated. In order to vote “no“ you need to follow these steps before the voting period starts (you can do this right now): Governance and Proposal Process | Privacy-first zkRollup | Aztec Documentation

This needs to be done for every active sequencer and voting power can be delegated to the same address. That address can later be used to vote “no“ on the proposal during the voting period. As always, make sure you have full control over this address.

1 Like

The proposal is at signalling phase, it will only get to a vote if 600/1000 block proposals signal for it.

If that threshold is reached the following timeline then applies:

// votingDelay: 3 * 24 * 60 * 60 # 3 days
// votingDuration: 7 * 24 * 60 * 60 # 7 days
// executionDelay: 7 * 24 * 60 * 60 # 7 days

There are two stages to any proposal, signalling and voting. You don’t need to do anything if you disagree at the signalling phase. A proposal only gets to the vote stage if 60% of the sequencers agree with it via signalling which is why the default vote is yes. You can change this via the link you posted.

Yes, and in my opinion it’s still a good idea to have voting power delegated to a custom address.

2 Likes

I agree with this as well. Although it may not be in my financial interests, the whole point of ignition was so people can get some experience running real nodes before we move on to Alpha. Even if most of the people in the queue are delegating their stake, there could be even just a few who participated in the auction and wish to home stake. Open the gate a little!

1 Like

Can you expand on this logic? Do you mean a “default yes” is only to initiate the signalling phase? A “default yes” for a voting phase seems exploitable. EG: My intuition would be that abstaining on a vote that needs “yes” to pass, would infer that i’m voting “no” by default. If that’s not the case, it seems a good idea for us to highlight it more in the community. I just want to make sure i’m understanding correctly first.

As for the proposal, i agree with those pointing out that the terms and timelines were known from the start. What’s considered “fair” is not easily measurable when these facts were laid out ahead of time. Of course, this can be seen as a biased conclusion if you’re a beneficiary, i suppose.

I saw @jaosef mentioned in Discord that:

”The earliest TGE can occur is Feb 11th, a vote would need to occur before this to hit this date, which would likely take 10 - 15 days to signal.”

Does this mean that those who may be hit by this issue, are all of those who are not ‘due’ to pass the queue before Feb 11th, at minimum? Do we know by which date people needed to have staked in order to make it under the bar? What the current proportion of the queue today would be impacted? A consideration for me would be how broad the impact might be and whether it would be a widespread issue for those who made sure to utilize their tokens early on (the first few days, for example). It could be considered a bad look on Aztec by some - even if terms etc were known - and i’m interested in the scope of that.

Something to take into account is that increasing throughput will affect solo stakers badly; most of the delegations happening are to top providers on the staking dashboard. I would like to see some solutions improving delegation to other actors outside big providers, or at least wait until TGE.

3 Likes

Rational for auto voting

If you abstain from signalling you are voting no. If a proposal gets past the signalling phase it goes to the vote phase.

In the voting phase how you vote depends on how you staked. When you stake, you can delegate your vote to rollup contract which by default votes yes for any proposal that passed sequencing as by definition it already has 60% support of the active sequencer set. You can also manually vote and in this case you would have to manually vote yes or no depending on your view.

The rational here is that for larger rollup upgrades, most sequencers will want to go with the majority of the network. The two stage process means that you will never auto vote yes on something that the majority of the network doesn’t want to happen. The auto voting is useful to ensure that you keep staking on the canonical chain. If you manually vote and there is a new rollup you may have to enter / exit again.

**Queue length**

Currently the queue lets in ~37 validators a day, based on the exit delay, you would need to be in the rollup staked by Feb 7th to exit by TGE if it occurred on the 11th. That affects the last ~1000 out the currently queued 3200 validators. Furthermore, based on the total amount that is yet to be staked, the problem could get worse. I agree with your sentiment on this point which is why we started the discussion. Ultimately it is the sequencers network and sequencers control the outcome here, but in my view the status quo is very un-desirable.

2 Likes

Hello,

We (Sigma Prime) have considered this at length internally. We are in favor of this change.

Major points in favor:

  • People depositing stake and receiving no rewards before TGE are likely to be surprised
  • Delegators may feel burned
  • It is important stakers gain experience staking during Ignition
  • It is much better that we have a good sense of eventual participation during Ignition

Points against

  • Much of the stake will clear to major providers (ourselves included)
  • APY dilution across the board
  • No urgent need to make a change

At the end of the day we think it’s most important to ensure token holders are done right by, and that network health is prioritized. The point on stake concentration: we should work to distribute the high concentration of stake, but the current queue will clear to the current parties regardless. The impact this has on rewards to major providers is a fair point, but must be weighed vs the loss of rewards to token holders that have delegated. That is about 20x the rewards since most operators are at 5% commission.

2 Likes

(post deleted by author)

VOTE NO. This proposal creates an unfair system by penalizing early supporters who took on the greatest risk.

The current solo stakers, primarily from the Genesis Sequencer set, have taken significant risk. Their tokens are locked for a full year, and they have been securing the network since its launch. In contrast, validators currently in the queue do not have the same level of commitment or lockup period.

Accelerating the queue now would grant these newcomers an too much advantage: the ability to earn inflation rewards during their initial three-month lockup. This inequity could incentivize queued validators to withdraw at the TGE and immediately sell their tokens once the lockup ends, directly increasing sell pressure on the market after the TGE.

If, however, their reward accumulation only begins closer to or after the TGE, their incentive would align better imho. They would be less likely to initiate an exit to sell

So accelerating the flush is unnecessary.

We already have almost 1,000 active sequencers, and at the current rate, we will reach approximately 1,200 in 1 month ! so much before TGE already There is no compelling urgency to accelerate this process.

I recommend that sequencers signal against this proposal by NOT updating their GOVERNANCE_PROPOSER_PAYLOAD_ADDRESS.

Finally, it is crucial that voting power is delegated to a self controled address. Do not allow a vault to vote “Yes” on your behalf, by default.

6 Likes

Is there a way to pause the signaling phase or, if signaling is successful, do not initiate the voting phase? It appears there is currently an issue preventing genesis sequencers from delegating their voting power and to my understanding, this is the only way to vote “no“. There is a thread on Discord about that.

UPDATE: Apparently, Genesis Sequencers can delegate their voting power using the delegate() function of the ATP Proxy contract, deployed on their withdrawal address via Etherscan. They need to “verify and publish” the contract ABI as a proxy contract first, and then use the delegate() function under Contract > Write as Proxy. The version of the rollup in the first parameter is 0

Cheers!

3 Likes