# Staking Module ## Overview The Cosmos Hub is a Tendermint-based Proof of Stake blockchain system that serves as a backbone of the Cosmos ecosystem. It is operated and secured by an open and globally decentralized set of validators. Tendermint consensus is a Byzantine fault-tolerant distributed protocol that involves all validators in the process of exchanging protocol messages in the production of each block. To avoid Nothing-at-Stake problem, a validator in Tendermint needs to lock up coins in a bond deposit. Tendermint protocol messages are signed by the validator's private key, and this is a basis for Tendermint strict accountability that allows punishing misbehaving validators by slashing (burning) their bonded Atoms. On the other hand, validators are for it's service of securing blockchain network rewarded by the inflationary provisions and transactions fees. This incentivizes correct behavior of the validators and provide economic security of the network. The native token of the Cosmos Hub is called Atom; becoming a validator of the Cosmos Hub requires holding Atoms. However, not all Atom holders are validators of the Cosmos Hub. More precisely, there is a selection process that determines the validator set as a subset of all validator candidates (Atom holder that wants to become a validator). The other option for Atom holder is to delegate their atoms to validators, i.e., being a delegator. A delegator is an Atom holder that has bonded its Atoms by delegating it to a validator (or validator candidate). By bonding Atoms to securing network (and taking a risk of being slashed in case the validator misbehaves), a user is rewarded with inflationary provisions and transaction fees proportional to the amount of its bonded Atoms. The Cosmos Hub is designed to efficiently facilitate a small numbers of validators (hundreds), and large numbers of delegators (tens of thousands). More precisely, it is the role of the Staking module of the Cosmos Hub to support various staking functionality including validator set selection; delegating, bonding and withdrawing Atoms; and the distribution of inflationary provisions and transaction fees. ## State The staking module persists the following information to the store: - `GlobalState`, describing the global pools and the inflation related fields - `map[PubKey]Candidate`, a map of validator candidates (including current validators), indexed by public key - `map[rational.Rat]Candidate`, an ordered map of validator candidates (including current validators), indexed by shares in the global pool (bonded or unbonded depending on candidate status) - `map[[]byte]DelegatorBond`, a map of DelegatorBonds (for each delegation to a candidate by a delegator), indexed by the delegator address and the candidate public key - `queue[QueueElemUnbondDelegation]`, a queue of unbonding delegations - `queue[QueueElemReDelegate]`, a queue of re-delegations ### Global State GlobalState data structure contains total Atoms supply, amount of Atoms in the bonded pool, sum of all shares distributed for the bonded pool, amount of Atoms in the unbonded pool, sum of all shares distributed for the unbonded pool, a timestamp of the last processing of inflation, the current annual inflation rate, a timestamp for the last comission accounting reset, the global fee pool, a pool of reserve taxes collected for the governance use and an adjustment factor for calculating global feel accum (?). ``` golang type GlobalState struct { TotalSupply int64 // total supply of Atoms BondedPool int64 // reserve of bonded tokens BondedShares rational.Rat // sum of all shares distributed for the BondedPool UnbondedPool int64 // reserve of unbonded tokens held with candidates UnbondedShares rational.Rat // sum of all shares distributed for the UnbondedPool InflationLastTime int64 // timestamp of last processing of inflation Inflation rational.Rat // current annual inflation rate DateLastCommissionReset int64 // unix timestamp for last commission accounting reset FeePool coin.Coins // fee pool for all the fee shares which have already been distributed ReservePool coin.Coins // pool of reserve taxes collected on all fees for governance use Adjustment rational.Rat // Adjustment factor for calculating global fee accum } ``` ### Candidate The `Candidate` data structure holds the current state and some historical actions of validators or candidate-validators. ``` golang type Candidate struct { Status CandidateStatus PubKey crypto.PubKey GovernancePubKey crypto.PubKey Owner Address GlobalStakeShares rational.Rat IssuedDelegatorShares rational.Rat RedelegatingShares rational.Rat VotingPower rational.Rat Commission rational.Rat CommissionMax rational.Rat CommissionChangeRate rational.Rat CommissionChangeToday rational.Rat ProposerRewardPool coin.Coins Adjustment rational.Rat Description Description } ``` CandidateStatus can be VyingUnbonded, VyingUnbonding, Bonded, KickUnbonding and KickUnbonded. ``` golang type Description struct { Name string DateBonded string Identity string Website string Details string } ``` Candidate parameters are described: - Status: signal that the candidate is either vying for validator status, either unbonded or unbonding, an active validator, or a kicked validator either unbonding or unbonded. - PubKey: separated key from the owner of the candidate as is used strictly for participating in consensus. - Owner: Address where coins are bonded from and unbonded to - GlobalStakeShares: Represents shares of `GlobalState.BondedPool` if `Candidate.Status` is `Bonded`; or shares of `GlobalState.UnbondedPool` otherwise - IssuedDelegatorShares: Sum of all shares a candidate issued to delegators (which includes the candidate's self-bond); a delegator share represents their stake in the Candidate's `GlobalStakeShares` - RedelegatingShares: The portion of `IssuedDelegatorShares` which are currently re-delegating to a new validator - VotingPower: Proportional to the amount of bonded tokens which the validator has if the candidate is a validator. - Commission: The commission rate of fees charged to any delegators - CommissionMax: The maximum commission rate this candidate can charge each day from the date `GlobalState.DateLastCommissionReset` - CommissionChangeRate: The maximum daily increase of the candidate commission - CommissionChangeToday: Counter for the amount of change to commission rate which has occurred today, reset on the first block of each day (UTC time) - ProposerRewardPool: reward pool for extra fees collected when this candidate is the proposer of a block - Adjustment factor used to passively calculate each validators entitled fees from `GlobalState.FeePool` - Description - Name: moniker - DateBonded: date determined which the validator was bonded - Identity: optional field to provide a signature which verifies the validators identity (ex. UPort or Keybase) - Website: optional website link - Details: optional details ### DelegatorBond Atom holders may delegate coins to validators; under this circumstance their funds are held in a `DelegatorBond` data structure. It is owned by one delegator, and is associated with the shares for one validator. The sender of the transaction is considered the owner of the bond. ``` golang type DelegatorBond struct { Candidate crypto.PubKey Shares rational.Rat AdjustmentFeePool coin.Coins AdjustmentRewardPool coin.Coins } ``` Description: - Candidate: the public key of the validator candidate: bonding too - Shares: the number of delegator shares received from the validator candidate - AdjustmentFeePool: Adjustment factor used to passively calculate each bonds entitled fees from `GlobalState.FeePool` - AdjustmentRewardPool: Adjustment factor used to passively calculate each bonds entitled fees from `Candidate.ProposerRewardPool`` ### QueueElem Unbonding and re-delegation process is implemented using the ordered queue data structure. All queue elements used share a common structure: ``` golang type QueueElem struct { Candidate crypto.PubKey InitHeight int64 // when the queue was initiated } ``` The queue is ordered so the next to unbond/re-delegate is at the head. Every tick the head of the queue is checked and if the unbonding period has passed since `InitHeight`, the final settlement of the unbonding is started or re-delegation is executed, and the element is pop from the queue. Each `QueueElem` is persisted in the store until it is popped from the queue. ### QueueElemUnbondDelegation ``` golang type QueueElemUnbondDelegation struct { QueueElem Payout Address // account to pay out to Shares rational.Rat // amount of delegator shares which are unbonding StartSlashRatio rational.Rat // candidate slash ratio at start of re-delegation } ``` In the unbonding queue - the fraction of all historical slashings on that validator are recorded (`StartSlashRatio`). When this queue reaches maturity if that total slashing applied is greater on the validator then the difference (amount that should have been slashed from the first validator) is assigned to the amount being paid out. ### QueueElemReDelegate ``` golang type QueueElemReDelegate struct { QueueElem Payout Address // account to pay out to Shares rational.Rat // amount of shares which are unbonding NewCandidate crypto.PubKey // validator to bond to after unbond } ``` ### Transaction Overview Available Transactions: - TxDeclareCandidacy - TxEditCandidacy - TxLivelinessCheck - TxProveLive - TxDelegate - TxUnbond - TxRedelegate ## Transaction processing In this section we describe the processing of the transactions and the corresponding updates to the global state. For the following text we will use gs to refer to the GlobalState data structure, candidateMap is a reference to the map[PubKey]Candidate, delegatorBonds is a reference to map[[]byte]DelegatorBond, unbondDelegationQueue is a reference to the queue[QueueElemUnbondDelegation] and redelegationQueue is the reference for the queue[QueueElemReDelegate]. We use tx to denote reference to a transaction that is being processed. ### TxDeclareCandidacy A validator candidacy can be declared using the `TxDeclareCandidacy` transaction. During this transaction a self-delegation transaction is executed to bond tokens which are sent in with the transaction (TODO: What does this mean?). ``` golang type TxDeclareCandidacy struct { PubKey crypto.PubKey Amount coin.Coin GovernancePubKey crypto.PubKey Commission rational.Rat CommissionMax int64 CommissionMaxChange int64 Description Description } ``` ``` declareCandidacy(tx TxDeclareCandidacy): // create and save the empty candidate candidate = loadCandidate(store, tx.PubKey) if candidate != nil then return candidate = NewCandidate(tx.PubKey) candidate.Status = Unbonded candidate.Owner = sender init candidate VotingPower, GlobalStakeShares, IssuedDelegatorShares,RedelegatingShares and Adjustment to rational.Zero init commision related fields based on the values from tx candidate.ProposerRewardPool = Coin(0) candidate.Description = tx.Description saveCandidate(store, candidate) // move coins from the sender account to a (self-bond) delegator account // the candidate account and global shares are updated within here txDelegate = TxDelegate{tx.BondUpdate} return delegateWithCandidate(txDelegate, candidate) ``` ### TxEditCandidacy If either the `Description` (excluding `DateBonded` which is constant), `Commission`, or the `GovernancePubKey` need to be updated, the `TxEditCandidacy` transaction should be sent from the owner account: ``` golang type TxEditCandidacy struct { GovernancePubKey crypto.PubKey Commission int64 Description Description } ``` ``` editCandidacy(tx TxEditCandidacy): candidate = loadCandidate(store, tx.PubKey) if candidate == nil or candidate.Status == Unbonded return if tx.GovernancePubKey != nil then candidate.GovernancePubKey = tx.GovernancePubKey if tx.Commission >= 0 then candidate.Commission = tx.Commission if tx.Description != nil then candidate.Description = tx.Description saveCandidate(store, candidate) return ``` ### TxDelegate All bonding, whether self-bonding or delegation, is done via `TxDelegate`. Delegator bonds are created using the `TxDelegate` transaction. Within this transaction the delegator provides an amount of coins, and in return receives some amount of candidate's delegator shares that are assigned to `DelegatorBond.Shares`. The amount of created delegator shares depends on the candidate's delegator-shares-to-atoms exchange rate and is computed as `delegator-shares = delegator-coins / delegator-shares-to-atom-ex-rate`. ``` golang type TxDelegate struct { PubKey crypto.PubKey Amount coin.Coin } ``` ``` delegate(tx TxDelegate): candidate = loadCandidate(store, tx.PubKey) if candidate == nil then return return delegateWithCandidate(tx, candidate) delegateWithCandidate(tx TxDelegate, candidate Candidate): if candidate.Status == Revoked then return if candidate.Status == Bonded then poolAccount = address of the bonded pool else poolAccount = address of the unbonded pool // Move coins from the delegator account to the bonded pool account err = transfer(sender, poolAccount, tx.Amount) if err != nil then return // Get or create the delegator bond bond = loadDelegatorBond(store, sender, tx.PubKey) if bond == nil then bond = DelegatorBond{tx.PubKey,rational.Zero, Coin(0), Coin(0)} issuedDelegatorShares = candidate.addTokens(tx.Amount, gs) bond.Shares = bond.Shares.Add(issuedDelegatorShares) saveCandidate(store, candidate) store.Set(GetDelegatorBondKey(sender, bond.PubKey), bond) saveGlobalState(store, gs) return addTokens(amount int64, gs GlobalState, candidate Candidate): // get the exchange rate of global pool shares over delegator shares if candidate.IssuedDelegatorShares.IsZero() then exRate = rational.One else exRate = candiate.GlobalStakeShares.Quo(candidate.IssuedDelegatorShares) if candidate.Status == Bonded then gs.BondedPool += amount issuedShares = exchangeRate(gs.BondedShares, gs.BondedPool).Inv().Mul(amount) // (tokens/shares)^-1 * tokens gs.BondedShares = gs.BondedShares.Add(issuedShares) else gs.UnbondedPool += amount issuedShares = exchangeRate(gs.UnbondedShares, gs.UnbondedPool).Inv().Mul(amount) // (tokens/shares)^-1 * tokens gs.UnbondedShares = gs.UnbondedShares.Add(issuedShares) candidate.GlobalStakeShares = candidate.GlobalStakeShares.Add(issuedShares) issuedDelegatorShares = exRate.Mul(receivedGlobalShares) candidate.IssuedDelegatorShares = candidate.IssuedDelegatorShares.Add(issuedDelegatorShares) return exchangeRate(shares rational.Rat, tokenAmount int64): if shares.IsZero() then return rational.One return shares.Inv().Mul(tokenAmount) ``` ### TxUnbond Delegator unbonding is defined with the following transaction: ``` golang type TxUnbond struct { PubKey crypto.PubKey Shares rational.Rat } ``` ``` unbond(tx TxUnbond): // get delegator bond bond = loadDelegatorBond(store, sender, tx.PubKey) if bond == nil then return // subtract bond tokens from delegator bond if bond.Shares.LT(tx.Shares) return // bond shares < tx shares bond.Shares = bond.Shares.Sub(ts.Shares) candidate = loadCandidate(store, tx.PubKey) if candidate == nil return revokeCandidacy = false if bond.Shares.IsZero() { // if the bond is the owner of the candidate then trigger a revoke candidacy if sender.Equals(candidate.Owner) and candidate.Status != Revoked then revokeCandidacy = true // remove the bond removeDelegatorBond(store, sender, tx.PubKey) else saveDelegatorBond(store, sender, bond) // transfer coins back to account if candidate.Status == Bonded then poolAccount = address of the bonded pool else poolAccount = address of the unbonded pool returnCoins = candidate.removeShares(shares, gs) // TODO: Shouldn't it be created a queue element in this case? transfer(poolAccount, sender, returnCoins) if revokeCandidacy then // change the share types to unbonded if they were not already if candidate.Status == Bonded then // replace bonded shares with unbonded shares tokens = gs.removeSharesBonded(candidate.GlobalStakeShares) candidate.GlobalStakeShares = gs.addTokensUnbonded(tokens) candidate.Status = Unbonded transfer(address of the bonded pool, address of the unbonded pool, tokens) // lastly update the status candidate.Status = Revoked // deduct shares from the candidate and save if candidate.GlobalStakeShares.IsZero() then removeCandidate(store, tx.PubKey) else saveCandidate(store, candidate) saveGlobalState(store, gs) return removeDelegatorBond(candidate Candidate): // first remove from the list of bonds pks = loadDelegatorCandidates(store, sender) for i, pk := range pks { if candidate.Equals(pk) { pks = append(pks[:i], pks[i+1:]...) } } b := wire.BinaryBytes(pks) store.Set(GetDelegatorBondsKey(delegator), b) // now remove the actual bond store.Remove(GetDelegatorBondKey(delegator, candidate)) //updateDelegatorBonds(store, delegator) } ``` ### Inflation provisions Validator provisions are minted on an hourly basis (the first block of a new hour). The annual target of between 7% and 20%. The long-term target ratio of bonded tokens to unbonded tokens is 67%. The target annual inflation rate is recalculated for each previsions cycle. The inflation is also subject to a rate change (positive of negative) depending or the distance from the desired ratio (67%). The maximum rate change possible is defined to be 13% per year, however the annual inflation is capped as between 7% and 20%. ``` inflationRateChange(0) = 0 GlobalState.Inflation(0) = 0.07 bondedRatio = GlobalState.BondedPool / GlobalState.TotalSupply AnnualInflationRateChange = (1 - bondedRatio / 0.67) * 0.13 annualInflation += AnnualInflationRateChange if annualInflation > 0.20 then GlobalState.Inflation = 0.20 if annualInflation < 0.07 then GlobalState.Inflation = 0.07 provisionTokensHourly = GlobalState.TotalSupply * GlobalState.Inflation / (365.25*24) ``` Because the validators hold a relative bonded share (`GlobalStakeShares`), when more bonded tokens are added proportionally to all validators, the only term which needs to be updated is the `GlobalState.BondedPool`. So for each previsions cycle: ``` GlobalState.BondedPool += provisionTokensHourly ```