Overview

The purpose of this document is to define initial recommendation for the operating procedures for running the wrapping operations, which is planned to be conducted by a decentralized group of oracles and custodians, who are also FIO Chain Block Producers. This document is not intended to describe the detailed functionality of the FIO contracts, Ethereum contracts or the Oracle software. See References below for that information.

Ethereum gas fees

Operations on the Ethereum Chain will require gas.

Oracles

Oracles receive FIO tokens every time a user wraps FIO. The amount is set by Oracles themselves and should be set in such a way that it covers all associated costs including Ethereum gas fees for wrapping. It is the Oracles' responsibility to convert FIO to ETH as required to maintain Oracle operations.

Custodians

Custodians do not receive wrapping fees, so the Ethereum gas fees should be covered by standard fee income generated by the FIO Chain.

Procedures

Custodians

• Custodians' responsibilities are:

  • Ensure minimum 3 oracles willing to participate in Wrapping Operations are registered on both the FIO and Ethereum Chains. Oracles are required to be recruited from the top 21 Block Producer population.

    • FIO Chain

      • Custodians register and un-register Oracles on the FIO Chain’s fio.oracle contract using regoracle and unregoracle actions. These actions require an msig of 2/3+1 of active BPs.

    • Ethereum Chain

      • Custodians register and un-register Oracles on the Ethereum contract using regoracle and unregoracle actions and Ethereum public address. These actions are callable individually by then current custodians and are executed once 2/3+1 of then current custodians call the action.

  • Ensure that all FIO Chain active Block Producers are registered as custodians on the Ethereum Chain. It is not required that this action happen in real-time as active BPs change on FIO Chain, but should be done periodically, e.g. once a week or month or once major changes occur. Initial 10 custodians will be set at Mainnet launch of Ethereum contract and there is a minimum of 7 custodians, but all 21 should be targeted to be added.

    • Custodians register and un-register Custodians on the Ethereum contract using regcust and unregcust actions and Ethereum public address. These actions are callable individually by then current custodian and are executed once 2/3+1 of then current custodians call the action.

  • Ensure their Ethereum private key is secured and has ETH to cover gas fees.

  • Respond to emergency situations which may impact the security or stability of the wrapping infrastructure. See Potential Issues and Suggested Resolution below.

    • A single custodian is allowed to pause the contract.

    • 2/3+1 is required to un-pause the contract.

Oracles

• Oracles' responsibilities are:

  • Monitor FIO Chain for wrap transactions

    • When observed, record observation on Ethereum Chain using wrap action.

  • Monitor Ethereum Chain for unwrap transactions

    • When observed, record observation on FIO Chain using unwraptokens action.

  • Set Oracle fees on FIO Chain using setoraclefee action. This fee will be paid by FIO users when they want to wrap tokens. This fee amount in FIO should be sufficient to cover:

    • Ethereum Chain gas fee to wrap

    • FIO Chain unwrap fee. Since a user can unwrap a smaller amount than was originally wrapped, this fee should potentially cover multiple unwraps on the FIO Chain per a single wrap.

  • Ensure their Ethereum private key is secured and has ETH to cover gas fees.

  • Ensure proper operation of the oracles

    • Monitor oracle operations and fix any issues. See Potential Issues and Suggested Resolution below.

    • A single oracle is allowed to pause the contract.

    • All oracles are required to un-pause the contract.

Environment Variables

Oracles will need to set the following environment variables:

General variables:

• POLLTIME - Seconds between poll for wrap and unwrap events (recommend 60 seconds?)

• SERVER_URL_HISTORY - URL of FIO history node

FIO chain variables:

• FIO_ORACLE_PRIVATE_KEY

• FIO_ORACLE_PUBLIC_KEY

• FIO_ORACLE_ACCOUNT

• FIO_ORACLE_ADDRESS

• POLLOFFSET - The number of wrap transactions to get on FIO side in each call. If you set 20, you can get 20 latest actions on FIO side.

ETH chain variables:

• ETH_ORACLE_PUBLIC, ETH_ORACLE_PRIVATE - The ETH oracle public and private addresses used for signing ERC20 transactions

ETH gas settings:

• USEGASAPI (1 - Use the etherscan API, 0 - Use the GASPRICE and GASLIMIT env vars)

• GASPRICELEVEL - Used to select the high/average/low price on etherscan API for gas pricing.

• TGASPRICE, TGASLIMIT - Manual gas price and gas limit settings.

Potential Issues and Suggested Resolution

Security and Stability

• ERC-20 vulnerability or attack

  • Possible mitigation:

    • Custodians to pause Ethereum contract using pause action until issue can be resolved and contract un-paused.

• FIO contract vulnerability or attack

  • Possible mitigation:

    • Custodians to remove fio.oracle actions from whitelist as required until issue can be resolved and actions added back to whitelist.

Wrapping

User is attempting to wrap FIO to WFIO (FIO->Ethereum):

• Errors on FIO Chain. If user receives errors on the FIO Chain, FIO tokens will not be transferred, so no customer service issue exists.

  • Possible mitigation:

    • Oracles investigate issue.

• Errors on Ethereum Chain. If the Oracle experiences an error when trying to record an observation onto the Ethereum Chain using wrap action, it means that the user has sent FIO, but did not receive the WFIO, creating a customer service issue. Oracles should monitor their nodes to look for errors.

  • Possible mitigation:

    • Preferred: Fix and manually resubmit the wrap transaction to the Ethereum chain to ensure WFIO is delivered to target user.

    • Alternatively, Oracles can unwrap FIO Tokens on FIO Chain using unwraptokens action. This effectively refunds the user’s FIO tokens which failed to wrap.

      • fio_address - use FIO Address owned by account which initiated the wrap

      • obt_id - manually set, e.g. 20210604001RefundDueToFailure - this has to be globally unique and Oracles have to coordinate to all use the same obt_id.

Unwrapping

User is attempting to unwrap WFIO to FIO (Ethereum->FIO):

• Errors on Ethereum Chain. If user receives errors on the Ethereum Chain, WFIO tokens will not be transferred, so no customer service issue exists.

  • Possible mitigation:

    • Oracles investigate issue.

• Errors on FIO Chain. If the Oracle experiences an error when trying to record an observation onto the FIO Chain using unwraptokens action, it means that the user has sent WFIO, but did not receive the FIO, creating a customer service issue. Oracles should monitor their nodes to look for errors.

  • Possible mitigation:

    • Preferred: Fix and manually resubmit the unwrap transaction to the FIO chain to ensure FIO is delivered to target user.

    • Alternatively, Oracles can wrap FIO Tokens on the Ethereum Chain using wrap action. This will mint new WFIO tokens, but it will effectively be a refund of the user’s WFIO tokens which failed to unwrap.

      • address - use Ethereum Public Address which initiated the unwrap

      • obtid - manually set, e.g. 20210604001RefundDueToFailure - this has to be globally unique and Oracles have to coordinate to all use the same obtid.

Local devnet testing information

The nature of the local testing framework requires the use of the 3 producer accounts devtools utilized during the startup procedures.

Keys used during the startup process here:

• eosio: 5KBX1dwHME4VyuUss2sYM25D5ZTDvyYrbEz37UJqwAVAsR4tGuY

• bp1:

  • 5KQ6f9ZgUtagD3LZ4wcMKhhvK9qy4BuwL3L1pkm6E2v62HCne2R

  • FIO7jVQXMNLzSncm7kxwg9gk7XUBYQeJPk8b6QfaK5NVNkh3QZrRr

  • qbxn5zhw2ypw

• bp2:

  • 5JnhMxfnLhZeRCRvCUsaHbrvPSxaqjkQAgw4ZFodx4xXyhZbC9P

  • FIO7uTisye5w2hgrCSE1pJhBKHfqDzhvqDJJ4U3vN9mbYWzataS2b

  • hfdg2qumuvlc

• bp3:

  • 5JvmPVxPxypQEKPwFZQW4Vx7EC8cDYzorVhSWZvuYVFMccfi5mU

  • FIO6oa5UV9ghWgYH9en8Cv8dFcAxnZg2i9z9gKbnHahciuKNRPyHc

  • wttywsmdmfew

• backup bp: 5KLxezoCEw5Ca97FHq3HPyrzkmZQT6Wqw9DmKaJ6inE6fiN1ijT

These BPs are typically registered as oracles manually after the launch of the development chain. In the case of the oracles not registered, please use the following command using the eosio permissions:

• ./clio -u http://localhost:8889 push action fio.oracle regoracle '{"oracle_actor":"qbxn5zhw2ypw","actor":"eosio"}' --permission eosio

Each oracle will be required to vote for fees prior to the activation of the wrapping services. Example of using setoraclefees:

• ./clio -u http://localhost:8889 push action fio.oracle setoraclefee '{"wrap_fio_domain":2000000000,"wrap_fio_tokens":2000000000,"actor":"qbxn5zhw2ypw"}' --permission qbxn5zhw2ypw

Coordination channels

Custodians

Use Mainnet Telegram channel

Oracles

Use FIO Token Wrapping Committee Telegram channel

References

FIO Token Wrapping project

FIO Token Wrapping Go-to-market plan

FIO Token Wrapping Integration Test Server (Information on using the Devnet to wrap and unwrap tokens and Domains)

FIO Token Wrapping Technical Documentation

• Wrap

• Unwrap

• fio.erc20 contract spec

• fio.erc20 contract