You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: security/fma-operator-fee.md
+17-8
Original file line number
Diff line number
Diff line change
@@ -38,13 +38,13 @@ Below are references for this project:
38
38
39
39
### FM1: Operator Fee scalars are set to incorrect values
40
40
41
-
-**Description:**
41
+
-**Description:**
42
42
If the operator fee scalars are incorrectly initialized or updated, there is a risk that the transactions fees will be too high. This could lead to a situation where the chain becomes unusable.
43
43
-**Risk Assessment:**
44
44
High impact, low likelihood.
45
45
**Mitigations:**
46
46
Before setting or updating the operator fee params, the operator should carefully read the [corresponding specs](https://specs.optimism.io/protocol/isthmus/exec-engine.html#operator-fee) and simulate the impact of operator fee on the whole transaction cost.
47
-
-**Detection:**
47
+
-**Detection:**
48
48
By default, the operator fee parameters are set to 0 and the feature is disabled. There are [E2E tests](https://github.com/ethereum-optimism/optimism/blob/develop/op-e2e/system/fees/fees_test.go) that ensure there is no impact on the transaction cost when the operator fee is disabled.
49
49
50
50
On chains that enable operator fee, the operator should monitor the transaction cost and ensure that the operator fee is not too high.
@@ -55,14 +55,14 @@ Below are references for this project:
55
55
56
56
### FM2: Broken Fee Estimation (Wallets)
57
57
58
-
-**Description:**
58
+
-**Description:**
59
59
If wallets fail to update their fee estimation logic, users will no longer be shown the accurate costs of a transaction.
60
60
-**Risk Assessment:**
61
61
This failure mode can only happen on chains that enable the operator fee feature.
62
62
Medium impact, medium likelihood.
63
63
**Mitigations:**
64
64
Coordinate with wallet providers to update their fee estimation logic. This includes MetaMask, Coinbase Wallet, and others.
65
-
-**Detection:**
65
+
-**Detection:**
66
66
Using a given wallet, compare the estimated transaction cost with the actual transaction cost, and check if the difference relates to the operator fee, using the formula.
67
67
-**Recovery Path(s)**:
68
68
Notify wallets of the new fee structure and ask them to update their fee estimation logic if the operator fee is enabled.
@@ -105,18 +105,27 @@ Below are references for this project:
105
105
106
106
So, about 3,7 GB for 1 year.
107
107
-**Recovery Path(s):**
108
+
The decision has been made to not store operator fee parameters in the
109
+
receipts if their values hasn't been set. So updated database growth rate is the following:
110
+
111
+
```
112
+
(12 bytes / 2 seconds) x 365 days × 24 hours × 60 minutes × 60 seconds = 189,216,000 bytes in 1 year.
113
+
```
114
+
115
+
So, about 180 GB for 1 year. Therefore, we don't think the following recovery paths are necessary anymore:
116
+
108
117
- Use archive nodes to maintain historical data.
109
-
- Consider implementing receipt compression retroactively if needed.
### Generic items we need to take into account: `L1Block` badly hydrated
112
121
113
122
-**Description:** At each hardfork, new data can be add to the `L1Block` contract, and the method called to hydrate it change (for instance
114
123
`setL1BlockValuesEcotone` to `setL1BlockValuesIsthmus`). If there is a bug in a future method ending up to operator fee params no
115
124
longer being updated in the `L1Block` contract, the operator fee will no longer be taken into account in transactions fee.
116
125
-**Risk Assessment:** medium severity / low likelihood
117
-
-**Mitigations:**
126
+
-**Mitigations:**
118
127
The [Operator Fee Constistency](https://github.com/ethereum-optimism/optimism/blob/develop/op-e2e/actions/proofs/operator_fee_test.go) action test runs with all known hardforks activated at genesis, and checks that operator fee parameters are correctly reported to the `L1Block` contract.
119
-
-**Detection:**
128
+
-**Detection:**
120
129
The action or E2E tests or local testing may pick up an issue.
121
130
-**Recovery Path(s):**
122
131
- If the bug is located in op-node, a new version must be deployed.
@@ -127,4 +136,4 @@ Below are references for this project:
127
136
Below is what needs to be done before launch to reduce the chances of the above failure modes occurring, and to ensure they can be detected and recovered from:
128
137
129
138
-[ ] Coordinate with wallet providers to update their fee estimation logic
130
-
-[] Implement automated monitoring on dabase growth rate
139
+
-[x] Implement automated monitoring on dabase growth rate
0 commit comments