Rejig NPoS to avoid certain griefing

[gavofyork]

Currently the NPoS is open to griefing & PoS attack by placing a lot of entries into a single validator's nominator list.

One mechanism against that would be:

• force_unnominate (for a validator to unilaterally remove a nominator from them); and
• max_nominators (beyond this no more nominators could nominate the validator).

Could also introduce a set_max_total to introduce a maximum amount beyond which nominators' balances make no difference.

[rphmeier]

For the finality gadget (which I assume will use stake-weighted votes since this is easy), I don't think unbalanced stake will be a huge issue. I don't see max_nominators or max_total being conducive to maximising stake in the system or incentivising nominators to nominate validators who they trust. Why would adding a nominator ever be an attack? The validator itself is responsible for behaving correctly, and misbehavior in the finality gadget is easy attributable.

For block production or availability slots we could give them a fixed but small price, where those who want to stake more may take up more slots.

[gavofyork]

This is for before we get proper NPoS and just in for the DPoS-with-slashing system we have now. Adding a nominator is an attack in two instances:

• We store nominators by mapping validator to a Vec<AccountId>. If intentionally heavily populated, it could impact computation requirements for later alterations or manipulations of the list (eg payouts).
• A validator with 10,000 on a 100 per-session payout may consider 1% fine, but may not necessarily want to continue validating if a nominator turns up with 90,000 and reduces his effective payout to 0.1%.

These are fairly specific to the current regime which won't last long-term but are needed for a functional testnet.

[rphmeier]

The validator payout should be either fixed or proportional to his own stake and independent of who else has nominated him, in which case I don't see why taking on any new nominators would be a bad thing. Taking on new nominators regardless of value should not affect the real value of the validator's payout.

[gavofyork]

Validator payout is fixed (anything else would result in rampant inflation). At present, nominators are free to nominate any validator they want and share in their payout. The total for a validator is fixed and split between them and their nominators according to stake. My above point should make more sense to you now.

[rphmeier]

anything else would result in rampant inflation

I disagree with the premise. There would be some exponential factor, although you can always scale the proportion in proportional rewards to set a fixed supply (let reward_prop = 1 - current_coins/max_supply) and can also be balanced with storage rent or other fees. And fixed payout means balanced stake, which means we haven't maximized potential security of the network.

If you have a fixed payout with unbalanced stakes, then the higher-staked validators have taken on higher risk for no more reward. The incentives are wrong. Or in converse, the lowest-staked validators provide the least economic security for the network, but benefit relatively the most.

The only argument I can think of for fixed rewards is ease-of-implementation.

[gavofyork]

Fixed with #656