Execution¶
-
class
TransactionRequest
Warning
Anyone wishing to write their own execution client should be sure they fully understand all of the intricacies related to the execution of transaction requests. The guarantees in place for those executing requests are only in place if the executing client is written appropriately.
Important Windows of Blocks/Time¶
Freeze Window¶
Each request may specify a freezePeriod
. This defines a number of blocks
or seconds prior to the windowStart
during which no actions may be
performed against the request. This is primarily in place to provide some
level of guarantee to those executing the request. For anyone executing
requests, once the request enters the freezePeriod
they can know that it
will not be cancelled and that they can send the executing transaction without
fear of it being cancelled at the last moment before the execution window
starts.
The Execution Window¶
The execution window is the range of blocks or timestamps during which the
request may be executed. This window is defined as the range of blocks or
timestamps from windowStart
till windowStart + windowSize
.
For example, if a request was scheduled with a windowStart
of block 2100
and a windowSize
of 255 blocks, the request would be allowed to be executed
on any block such that windowStart <= block.number <= windowStart +
windowSize
.
As another example, if a request was scheduled with a windowStart
of block 2100
and a windowSize
of 0 blocks, the request would only be allowed to be
executed at block 2100.
Very short windowSize
configurations likely lower the chances of your
request being executed at the desired time since it is not possible to force a
transaction to be included in a specific block and thus the party executing
your request may either fail to get the transaction included in the correct
block or they may choose to not try for fear that their transaction will not
be included in the correct block and thus they will not recieve a reimbursment
for their gas costs.
Similarly, very short ranges of time for timestamp based calls may even make it
impossible to execute the call. For example, if you were to specify a
windowStart
at 1480000010 and a windowSize
of 5 seconds then the
request would only be executable on blocks whose block.timestamp
satisfied
the conditions 1480000010 <= block.timestamp <= 1480000015
. Given that it
is entirely possible that no blocks are mined within this small range of
timestamps there would never be a valid block for your request to be executed.
Note
It is worth pointing out that actual size of the execution window will
always be windowSize + 1
since the bounds are inclusive.
Reserved Execution Window¶
Each request may specify a claimWindowSize
which defines a number of blocks
or seconds at the beginning of the execution window during which the request
may only be executed by the address which has claimed the request. Once this
window has passed the request may be executed by anyone.
Note
If the request has not been claimed this window is treated no differently than the remainder of the execution window.
For example, if a request specifies a windowStart
of block 2100, a
windowSize
of 100 blocks, and a reservedWindowSize
of 25 blocks then in
the case that the request was claimed then the request would only be executable
by the claimer for blocks satisfying the condition 2100 <= block.number <
2125
.
Note
It is worth pointing out that unlike the execution window the reserved execution window is not inclusive of it’s righthand bound.
If the reservedWindowSize
is set to 0, then there will be no window of
blocks during which the execution rights are exclusive to the claimer.
Similarly, if the reservedWindowSize
is set to be equal to the full size of
the execution window or windowSize + 1
then there will be not window
after the reserved execution window during which execution can be triggered
by anyone.
The RequestFactory
will allow a reservedWindowSize
of any value
from 0 up to windowSize
+ 1, however, it is highly recommended that you
pick a number around 16 blocks or 270 seconds, leaving at least the same amount
of time unreserved during the second portion of the execution window. This
ensures that there is sufficient motivation for your call to be claimed because
the person claiming the call knows that they will have ample opportunity to
execute it when the execution window comes around. Conversely, leaving at
least as much time unreserved ensures that in the event that your request is
claimed but the claimer fails to execute the request that someone else has
plenty of of time to fulfill the execution before the execution window ends.
The Execution Lifecycle¶
When the :method:`TransactionRequest.execute()` function is called the contract goes through three main sections of logic which are referred to as a whole as the execution lifecycle.
- Validation: Handles all of the checks that must be done to ensure that all of the conditions are correct for the requested transaction to be executed.
- Execution: The actual sending of the requested transaction.
- Accounting: Computing and sending of all payments to the necessary parties.
Part 1: Validation¶
During the validation phase all of the following validation checks must pass.
Check #1: Not already called¶
Requires the wasCalled
attribute of the transaction request to
be false
.
Check #2: Not Cancelled¶
Requires the isCancelled
attribute of the transaction request to
be false
.
Check #3: Not before execution window¶
Requires block.number
or block.timestamp
to be greater than or equal to
the windowStart
attribute.
Check #4: Not after execution window¶
Requires block.number
or block.timestamp
to be less than or equal to
windowStart + windowSize
.
Check #5 and #6: Within the execution window and authorized¶
- If the request is claimed
- If the current time is within the reserved execution window
- Requires that
msg.sender
to be theclaimedBy
address
- Requires that
- Otherwise during the remainder of the execution window
- Always passes.
- If the request is not claimed.
- Always passes if the current time is within the execution window
Check #7: Stack Depth Check¶
In order to understand this check you need to understand the problem it solves.
One of the more subtle attacks that can be executed against a requested
transaction is to force it to fail by ensuring that it will encounter the EVM
stack limit. Without this check the executor of a transaction request could
force any request to fail by arbitrarily increasing the stack depth prior to
execution such that when the transaction is sent it encounters the maximum
stack depth and fails. From the perspective of the TransactionRequest
contract this sort of failure is indistinguishable from any other exception.
In order to prevent this, prior to execution, the TransactionRequest
contract will ensure that the stack can be extended by a number of stack frames
equal to requiredStackDepth
. This check passes if the stack can be
extended by this amount.
This check will be skipped if msg.sender == tx.origin
since in this case it
is not possible for the stack to have been arbitrarily extended prior to
execution.
Check #8: Sufficient Call Gas¶
Requires that the current value of msg.gas
be greater than the minimum
call gas. See minimum-call-gas for details on how to compute this
value as it includes both the callGas
amount as well as some extra for the
overhead involved in execution.
Part 2: Execution¶
The execution phase is very minimalistic. It marks the request as having been
called and then dispatches the requested transaction, storing the success or
failure on the wasSuccessful
attribute.
Part 3: Accounting¶
The accounting phase accounts for all of the payments and reimbursements that need to be sent.
The donation payment is the mechanism through which developers can earn a
return on their development efforts on the Alarm service. For the official
scheduler deployed as part of the alarm service this defaults to 1% of the
default payment. This value is multiplied by the gas multiplier (see
Gas Multiplier) and sent to the donationBenefactor
address.
Next the payment for the actual execution is computed. The formula for this is as follows:
totalPayment = payment * gasMultiplier + gasUsed * tx.gasprice + claimDeposit
The three components of the totalPayment
are as follows.
payment * gasMultiplier
: The actual payment for execution.gasUsed * tx.gasprice
: The reimbursement for the gas costs of execution. This is not going to exactly match the actual gas costs, but it will always err on the side of overpaying slightly for gas consumption.claimDeposit
: If the request is not claimed this will be 0. Otherwise, theclaimDeposit
is always given to the executor of the request.
After these payments have been calculated and sent, the Executed
event is
logged, and any remaining ether that is not allocated to be paid to any party
is sent back to the address that scheduled the request.
Gas Multiplier¶
To understand the gas multiplier you must understand the problem it solves.
Transactions requests always provide a 100% reimbursment of gas costs. This is
implemented by requiring the scheduler to provide sufficient funds up-front to
cover the future gas costs of their transaction. Ideally we want the sender of
the transaction that executes the request to be motivated to use a gasPrice
that is as low as possible while still allowing the transaction to be included
in a block in a timely manner.
A naive approach would be to specify a maximum gas price that the scheduler is willing to pay. This might be possible for requests that will be processed a short time in the future, but for transactions that are scheduled sufficiently far in the future it isn’t feasible to set a gas price that is going to reliably reflect the current normal gas prices at that time.
In order to mitigate this issue, we instead provide a financial incentive to the party executing the request to provide as low a gas cost as possible while still getting their transaction included in a timely manner.
Those executing the request are already sufficiently motivated to provide a gas price that is high enough to get the transaction mined in a reasonable time since if the price they specify is too low it is likely that someone else will execute the request before them, or that their transaction will not be included before the execution window closes.
So, to provide incentive to keep the gas cost reasonably low, the gas
multiplier concept was introduced. Simply put, the multiplier produces a
number between 0 and 2 which is applid to the payment
that will be sent for
fulfilling the request.
At the time of scheduling, the gasPrice
of the scheduling transaction is
stored. We refer to this as the anchorGasPrice
as we can assume with some
reliability that this value is a reasonable gas cost that the scheduler is
willing to pay.
At the time of execution, the following will occur based on the gasPrice
used for the executing transaction:
- If
gasPrice
is equal to theanchorGasPrice
then the gas multiplier will be 1, meaning that thepayment
will be issued as is.- When the
gasPrice
is greater than theanchorGasPrice
, the gas multiplier will approach 0 meaning that the payment will steadily get smaller for higher gas prices.- When the
gasPrice
is less than theanchorGasPrice
, the gas multiplier will approach 2 meaning that the payment will steadily get larger for lower gas prices.
The formula used is the following.
If the execution
gasPrice
is greater thananchorGasPrice
:gasMultiplier = anchorGasPrice / tx.gasprice
Else (if the execution
gasPrice
is less than or equal to theanchorGasPrice
:gasMultiplier = 2 - (anchorGasPrice / (2 * anchorGasPrice - tx.gasprice))
For example, if at the time of scheduling the gas price was 100 wei and the
executing transaction uses a gasPrice
of 200 wei, then the gas multiplier
would be 100 / 200 => 0.5
.
Alternatively, if the transaction used a gasPrice
of 75 wei then the gas
multiplier would be 2 - (100 / (2 * 100 - 75)) => 1.2
.
Sending the Execution Transaction¶
In addition to the pre-execution validation checks, the following things should be taken into considuration when sending the executing transaction for a request.
Gas Reimbursement¶
If the gasPrice
of the network has increased significantly since the
request was scheduled it is possible that it no longer has sufficient ether to
pay for gas costs. The following formula can be used to compute the maximum
amount of gas that a request is capable of paying:
(request.balance - 2 * (payment + donation)) / tx.gasprice
If you provide a gas value above this amount for the executing transaction then you are not guaranteed to be fully reimbursed for gas costs.
Minimum ExecutionGas¶
When sending the execution transaction, you should use the following rules to determine the minimum gas to be sent with the transaction:
- Start with a baseline of the
callGas
attribute. - Add
180000
gas to account for execution overhead. - If you are proxying the execution through another contract such that during
execution
msg.sender != tx.origin
then you need to provide an additional700 * requiredStackDepth
gas for the stack depth checking.
For example, if you are sending the execution transaction directly from a
private key based address, and the request specified a callGas
value of
120000 gas then you would need to provide 120000 + 180000 => 300000
gas.
If you were executing the same request, except the execution transaction was
being proxied through a contract, and the request specified a
requiredStackDepth
of 10 then you would need to provide 120000 + 180000 +
700 * 10 => 307000
gas.