Tailor protocol paramaters safely for 10 parties

CHANGELOG.md

@@ -10,6 +10,13 @@ changes.
 
 ## [UNRELEASED]
 
+- Changed `hydra-cluster/config/protocol-parameters.json` so that no layer 2
+  UTxO can become impossible to fan out on layer 1: `maxTxSize` lowered to
+  10250 (fanout carries ~5.8 kB of overhead; safe up to 10 parties),
+  `utxoCostPerByte` restored to the mainnet value 4310 (layer 1 min ada must
+  hold for fanned-out outputs), and `minFeeRefScriptCostPerByte` zeroed like
+  the other fees. See the updated "Ledger parameters" documentation.
+
 - The `POST /commit` endpoint now rejects deposits that could never be claimed:
   a dry-run increment transaction is checked against the layer 1 maximum
   transaction size and maximum serialized value size (5000 bytes on mainnet,

demo/seed-devnet.sh

@@ -105,10 +105,10 @@ function queryPParams() {
   echo >&2 "Query Protocol parameters"
   if [[ -x ${CCLI_CMD} ]]; then
      ccli query protocol-parameters --socket-path ${DEVNET_DIR}/node.socket  --out-file /dev/stdout \
-      | jq ".txFeeFixed = 0 | .txFeePerByte = 0 | .executionUnitPrices.priceMemory = 0 | .executionUnitPrices.priceSteps = 0 | .utxoCostPerByte = 0" > devnet/protocol-parameters.json
+      | jq ".txFeeFixed = 0 | .txFeePerByte = 0 | .executionUnitPrices.priceMemory = 0 | .executionUnitPrices.priceSteps = 0 | .minFeeRefScriptCostPerByte = 0 | .maxTxSize = 10250" > devnet/protocol-parameters.json
    else
      docker exec demo-cardano-node-1 cardano-cli query protocol-parameters --testnet-magic ${NETWORK_ID} --socket-path ${DEVNET_DIR}/node.socket --out-file /dev/stdout \
-      | jq ".txFeeFixed = 0 | .txFeePerByte = 0 | .executionUnitPrices.priceMemory = 0 | .executionUnitPrices.priceSteps = 0 | .utxoCostPerByte = 0" > devnet/protocol-parameters.json
+      | jq ".txFeeFixed = 0 | .txFeePerByte = 0 | .executionUnitPrices.priceMemory = 0 | .executionUnitPrices.priceSteps = 0 | .minFeeRefScriptCostPerByte = 0 | .maxTxSize = 10250" > devnet/protocol-parameters.json
   fi
   echo >&2 "Saved in protocol-parameters.json"
 }

docs/docs/configuration.md

@@ -359,9 +359,13 @@ hydra-node publish-scripts \
 
 The ledger is at the core of a Hydra head. Hydra is currently integrated with Cardano and assumes a ledger configuration similar to layer 1. This translates as a command-line option `--ledger-protocol-parameters`. This defines the updatable protocol parameters such as fees or transaction sizes. These parameters follow the same format as the `cardano-cli query protocol-parameters` output.
 
-We provide existing files in [hydra-cluster/config](https://github.com/cardano-scaling/hydra/blob/master/hydra-cluster/config), which can be used as the basis. In particular, the protocol parameters nullify costs inside a head. Apart from that, they are the direct copy of the current mainnet parameters. An interesting point about Hydra's ledger is that while it re-uses the same rules and code as layer 1 (isomorphic), some parameters can be altered. For example, fees can be adjusted, but not parameters controlling maximum value sizes or minimum ada values, as altering these could make a head unclosable.
+We provide existing files in [hydra-cluster/config](https://github.com/cardano-scaling/hydra/blob/master/hydra-cluster/config), which can be used as the basis. They are a copy of the current mainnet parameters, with three deliberate changes:
 
-A good rule of thumb is that anything that applies strictly to transactions (fees, execution units, max tx size, etc) is safe to change. But anything that could be reflected in the UTXO is not.
+* All fees are nullified (`txFeeFixed`, `txFeePerByte`, `executionUnitPrices`, `minFeeRefScriptCostPerByte`), so transactions inside a head cost nothing.
+* `maxTxSize` is *lowered* to 10250 bytes. Every UTxO produced inside a head must eventually be distributed on layer 1 by a fanout transaction, which additionally carries roughly 5.8 kB of overhead (most of it the head's minting policy, which cannot be a reference script). A larger `maxTxSize` on layer 2 would allow creating a single output (for example one with a big inline datum or reference script) that no fanout transaction can ever fit under the layer 1 limit of 16384 bytes, permanently locking funds in the head. The value 10250 is safe for heads of up to 10 parties; each additional party costs about 31 bytes of fanout overhead.
+* `utxoCostPerByte` is kept at the mainnet value. Lowering it would allow outputs below the layer 1 minimum ada requirement, which would make the fanout transaction invalid on layer 1.
+
+While Hydra's ledger re-uses the same rules and code as layer 1 (isomorphic), only some parameters can be altered safely. Anything that applies strictly to transaction validation and never gets reflected in the UTxO is safe to relax: fees and execution unit prices can be zeroed, and `maxTxExecutionUnits` can be raised, since layer 2 scripts are never re-executed on layer 1. Anything that shapes what a single output can look like must remain at least as restrictive as on layer 1: do not raise `maxTxSize` or `maxValueSize`, and do not lower `utxoCostPerByte`, as any of these could make a head impossible to fan out.
 
 :::info About protocol parameters
 Many protocol parameters are irrelevant in the Hydra context (eg, there is no treasury or stake pools within a head). Therefore, parameters related to reward incentives or delegation rules are unused.

hydra-cluster/config/protocol-parameters.json

@@ -1,7 +1,7 @@
 {
     "txFeeFixed": 0,
     "txFeePerByte": 0,
-    "utxoCostPerByte": 0,
+    "utxoCostPerByte": 4310,
     "executionUnitPrices": {
         "priceMemory": 0,
         "priceSteps": 0
@@ -682,9 +682,9 @@
         "memory": 14000000,
         "steps": 10000000000
     },
-    "maxTxSize": 16384,
+    "maxTxSize": 10250,
     "maxValueSize": 5000,
-    "minFeeRefScriptCostPerByte": 15,
+    "minFeeRefScriptCostPerByte": 0,
     "minPoolCost": 170000000,
     "monetaryExpansion": 3.0e-3,
     "poolPledgeInfluence": 0.3,