Collator Guide on the Moonbeam Rewards Cover Insurance Contract
Moonbeam and Moonriver collators can now offer staking rewards cover to their delegators via StakeBaby’s insurance cover contract. Delegators can see which collators offer cover at stakeglmr.com, and they can also claim cover payouts from their account dashboard.
How the contract works in a nutshell
Collators deposit GLMR on the contract. The funds are locked and serve as a security deposit, should that collator miss a round or more. If the collator misses a round, their deposit is reduced and the accounts of their delegators are credited accordingly. Delegators must execute a transaction to claim the cover rewards. They can do so from their account’s cover dashboard at stakeglmr.com.
Since there is no on-chain method to check collator performance or get delegator information, the data must be fed into the contract through an oracle quorum. Only collators will be able to run oracles (one each). As an extra safety measure, StakeBaby’s oracle can veto a quorum decision in case the quorum is overtaken by malicious oracles.
How much does it cost?
There is a one-time fee to join the contract. After that, the service is free as long as you run an oracle. You might even make some money as an oracle (net of tx fees) depending on what other members do. If you don’t run an oracle, then you have to pay a membership fee which is used to pay oracles. The purpose of the fee is to incentivize you to run an oracle that will protect both your deposit and your fellow collators’. Note that the fee is currently 0 until the oracle set is sufficiently diversified.
You should also budget for the deposit you will have to make to secure potential future claims for missing rounds. We recommend starting with something low like 300 GLMR, checking your advertised cover period at stakeglmr.com, and adjusting based on your competitor’s offerings. You can schedule a deposit withdrawal at any time, should you decide to stop offering cover.
Currently, the cover period is limited to a max of 2 days which amounts to a deposit of around 2,109 GLMR for a 3.5M backed collator.
How can I start offering cover?
Please send an email to contact@stakebaby.com, along with
- your collator address
- an address that you want to use to manage your collator
- The tx hash of a recent small (immaterial) payment to the contract address 0x73b460C43E94081F7fA29d9E74572D8C711fA011, which must originate either from your collator, or an account that is a proxy of your collator (this is to prove you represent that collator).
We will reply back to your email to confirm everything is OK and request payment. Once you are whitelisted you will be able to deposit funds to the contract via the Collator Cover dashboard. Your deposit will automatically activate your cover offer. The larger the deposit, the longer the cover period.
Never — ever execute contract methods from your collator address. Beside’s the fact that it won’t work (only the representative address can execute methods on behalf of the collator), it is a huge risk to be using your collator to interact with any contract.
FAQ
How safe is my deposit?
Money changes hands inside the contract mainly through cover claim events. Some funds can also change hands through member fees and gas refunds, but they are not material and have quite low ceilings to be exploitable. Therefore, the main risk is that a number of collators overtake the quorum and submit wrong data. The contract safeguards against this in multiple ways:
- After runtime 2100 is enabled, the contract will get delegation amounts from the chain instead of the oracles. Therefore, the oracles will be limited to reporting only who the delegators are, and not how much they are delegating. This makes it impossible to trick the contract into paying out a large amount to a non-delegator. However, the oracles are still in charge of reporting if a collator had a zero-blocks round so the risk of a false cover-claim is not addressed by runtime 2100.
- After SUDO is removed, only collators will be able to run oracles (one each). Therefore, the criteria to become an oracle will be very strict, since the collator set is already very competitive. Moreover, an oracle will not be able to submit a report if its respective collator has exited the active set. Therefore, oracles must represent active-set collators in order to submit reports.
- Reported data is only pushed and acted upon if it is reported exactly the same by a quorum of oracles. StakeBaby aims to have at least 10 oracles with a quorum of 7.
- The StakeBaby oracle will always have Veto power over a quorum report. This means that StakeBaby has the power to reject a quorum report it deems incorrect. Note that this does not mean that StakeBaby can vote and push a report, only that it can reject one.
- The StakeBaby oracle is required to vote for a quorum to pass. Therefore, even if the malicious oracles achieve a quorum, the report will not pass until StakeBaby votes. If the StakeBaby oracle does not vote for 3 rounds, then this feature is automatically disabled to allow for the contract to continue working without StakeBaby’s participation, until the StakeBaby oracle starts participating again.
- Should many oracles start submitting false data, StakeBaby will automatically pause the oracle contract thereby disabling any cover-triggered transfers.
How can I withdraw my deposit?
You have to schedule a deposit decrease, very much like you undelegate funds from a collator. You then have to execute that decrease, after the required waiting period has passed.
Is it possible that my deposit withdrawal fails?
Yes, there exists the possibility that a matured withdrawal might not be immediately executable. This will happen if the contract’s reducible (not staked) balance is below the withdrawal amount. The solution is to call forceRevoke, which will force the contract to undelegate funds to increase the reducible balance. You will then have to wait for 2 days. Note that, StakeBaby will aim to always keep a high enough liquid balance to meet obligations, so this is a scenario we have prepared for but don’t plan to run into.
What is the Max Covered Delegation?
You might want to limit the size of delegations that you provide cover for. If you, for example, set this limit to 100K GLMR, a delegation of 300K GLMR will only be covered for 100K GLMR.
Can I insure my delegators against going offline (DOWN) but not if I am kicked out of the active set (OUT)?
Yes, you can. By default, you provide cover for both DOWN and OUT scenarios. However, you can deactivate one of them and provide cover only for one scenario. Delegators will see what types of covers you provide on the stakeglmr dashboard. Note that, changes in the cover types you provide, become effective after a delay period that depends on the size of your deposit.
Why is it that, the more I deposit, the longer I have to wait if I want to withdraw?
Your total deposit amount is used to calculate the cover period. The larger your deposit, the longer the cover period.
If you decide to withdraw part or all of your deposit, the delegators that delegated to your collator need to stay covered for at least the cover period you initially advertised to them. This means that your funds must stay locked for the last advertised cover period before you can withdraw them. Therefore, the larger your deposit, the longer the advertised cover period, and the longer your wait period to withdraw.
The same logic is applied to cover type changes. If you decide to stop providing DOWN cover, then the change will be applied after the cover period has elapsed.
Are delegators covered while they are undelegating?
No. If a delegator decides to revoke they will no longer receive cover rewards during the revocation period. Delegators receive cover rewards only if they were to receive normal delegation rewards, had the collator not missed the round (there is an exception to this — see next question). The cover gives delegators more time to react, and wait, before deciding to leave the collator. This reduces the run-for-the-door effect and gives collators an opportunity to recoup (at their expense).
What happens if I unregister my collator?
Your members are still covered even if your collator unregisters. Actually, if you unregister, your delegators will receive rewards cover and they are also free to stake with another collator.
How is the cover reward calculated for each delegator?
All delegators will receive the same cover reward per 1 GLMR staked per round if their cover is activated. The reward is the same across collators and it is set to the average APR of the set. So, if your collator has an APR of 10% and they miss the round, you will get 11% APR rewards if the average APR is 11%. Cover APR is managed manually by StakeBaby.
My cover period has changed! There were no claims and no deposits!
Your cover period, i.e the number of rounds you cover, also depends on your total backing (the more delegations you have, the more your obligations and the shorter your cover period). If your total backing changed a lot, then so will your cover period. Also, note that if you are not running an oracle your deposit will slowly decrease (albeit by a very small amount) to pay oracle-running collators. If your initial deposit was small, then this might affect your cover period.
How much does it cost to run an oracle?
The oracle is a really light program that can be hosted along your collator backup node. The oracle will incur some tx fees as it has to submit the report to the contract. On occasions when claims must be calculated, the tx cost may be much higher, however, the extra tx cost is refunded back to the bearing oracle’s deposit account. The cost is charged to the collator that missed the round and resulted in claims.
Keep in mind that oracles may also produce income from member fees unless all collator members decide to run oracles.
What can StakeBaby do while it has SUDO?
SUDO allows StakeBaby to manage oracle membership. This means that StakeBaby will be able to create as many oracles as there are collators, which effectively means it can control fund transfers. Unfortunately, SUDO is required to 1) bootstrap the quorum, and 2) while waiting for smart contracts to gain access to the proxy precompile. Therefore, you must trust that StakeBaby will not maliciously alter oracle data to move funds while SUDO is not removed. This trust is not required after the 2100 runtime update, after which the oracle will source the delegation-amount data directly from the chain instead of the oracles.
How does the contract generate income for StakeBaby?
StakeBaby can stake the deposited funds and generate income from staking rewards.
Can the contract operate without StakeBaby?
We have designed the contract with a mindset of it being self-sustainable economically. Oracle economics are managed through the membership fee. Therefore, setting the fee to a reasonable price point (to be discovered) should ensure sufficient oracle participation without StakeBaby’s involvement.
StakeBaby will be initially responsible for whitelisting members. However, the contract allows outsourcing of this responsibility to collator proxy accounts when proxy is enabled for smart contracts. The same holds for oracles membership management when SUDO is removed.
Bootstrapping the Oracle Quorum
Note that, during the launch phase, StakeBaby will maintain SUDO power over oracle member management, in order to bootstrap the oracle set. Once this is done, and the smart contract access to the proxy precompile is activated, StakeBaby will remove SUDO once and for all.
Incentivizing Oracles
At any time, some collators will be running oracles and some will not. To incentivize collators to run oracles (beyond the obvious incentive to protect their deposits), the contract charges a membership fee to collators that don’t run oracles. The collected fees are then split and credited to the deposit accounts of the collators that run oracles. In other words, collators that don’t run oracles pay collators that run oracles. The fee is charged every 32 rounds. We have not yet decided on the fee amount, but we will experiment until we find a value that incentivizes at least 10 collators to run oracles.
How do I run an Oracle?
To run an oracle, you have to download an executable file, create a service in Linux, and set some parameters. You will need your collator public key, the private key of your oracle account that should have about 10 GLMR in it (for TX costs), and a fullnode WebSocket address. You can also set this up in your collator backup server, and connect to localhost.
If you want, you can also run the oracle as an AWS Lambda service. In fact, that’s how StakeBaby runs its own oracles. To set the oracle as a Lambda function, go here.
