A reward curve that falls from 95% to 50% across nine quarters is not a tuning parameter. It is a confession.
Filecoin's FIP-0118 rewrites the split of block rewards between two actor classes: consensus providers who commit raw capacity, and service providers who actually store paying client data. Today the consensus side captures roughly 95% of the reward stream. The proposal drags that ceiling to a 50% floor over a transition window of about nine quarters. Any service share that goes unearned is not refunded to the consensus side. It is burned.
If you have traced the EVM's gas accounting, the pattern should look familiar. This is a slashing mechanism wearing the costume of a reward rebalancing. And a slashing mechanism tells you what a protocol actually fears. Here is the arithmetic.
The mechanics underneath
Filecoin is not a rollup and has no sequencer to debate. Its consensus runs on Proof-of-Replication and Proof-of-Spacetime — cryptographic proofs that a storage provider has sealed data and is continuously proving possession of it. Rewards are minted per epoch through a dual model: baseline minting that tracks network capacity, plus simple minting that decays over time. The 2 billion FIL hard cap holds. What FIP-0118 touches is not PoRep, not PoSt, not the throughput of the network. It touches the built-in Reward Actor — the logic that decides who receives minted FIL and in what proportion.
That distinction matters. This is an incentive-layer change, not an execution-layer or consensus-layer upgrade. But "incentive layer" is where most protocols quietly fail. A consensus bug crashes a node; an incentive bug corrupts the behavior of every rational actor on the network at once. When I spent six months in 2017 auditing the EVM spec against the Yellow Paper, I found the same lesson in the gas schedule: the dangerous surface is rarely the proof system. It is the accounting rule that assumes rational agents will not read it adversarially.
The invariant the proposal is trying to restore
For years, Filecoin's dominant miner strategy was Committed Capacity — sealing raw space with no real client data attached, while still harvesting the majority of block rewards. The network advertised exabytes of nominal capacity and a fraction of that in genuine paid utilization. In 2020, while auditing the constant-product invariant in Uniswap V2, I learned to separate the number a protocol publishes from the number its incentives actually produce. Filecoin's published number was capacity. Its incentive produced capacity. Its demand never matched.
FIP-0118 is the protocol admitting that pure-capacity mining failed. If organic paid-storage demand had emerged, no token-economic mandate would be necessary. The proposal itself is the evidence that it did not.
The mechanism is a directed transfer: reduce the consensus share, elevate the service share, and enforce the shift with a burn. An unearned service share leaves circulation permanently. That converts Filecoin's supply model from pure inflationary subsidy into a hybrid — inflation with a deflationary offset. The change is elegant in specification and brutal in execution, because it does not merely redirect rewards. It attaches a penalty to failing to find customers.
The paradox in the burn
Here is the counter-intuitive part, and it is where most coverage will go wrong.
The burn is not a clean bullish signal. Consider the conditional. The burned quantity equals the shortfall between the service-share target and the paid storage actually delivered. Burn more, and supply contracts — superficially bullish. But burn more, and it proves that paying clients did not fill the service quota. The same variable that tightens supply is a live measurement of demand weakness.
A high burn rate is not a supply story. It is a demand confession. The market can read FIP-0118 as either "deflationary reform" or "the network could not find customers," and both readings are supported by the identical on-chain number. Optimizing for clarity, not just gas efficiency, means stating that plainly: the mechanism is reflexive, and its signal inverts depending on which side of the target you land.
The attack surface nobody priced
Now the part the proposal summary omits, and the part I would flag first in any audit: the service share is only as trustworthy as its metering.
To reward paid storage, the protocol must verify that a storage deal was genuinely paid and genuinely served. That verification is not a cryptographic proof in the PoRep sense — it is an accounting claim. And any accounting claim that converts into minted tokens invites the oldest attack in incentive design: self-dealing. A storage provider can act as its own client, generate the appearance of paid demand, and harvest the service share that was meant for real customers. Unless the metering layer distinguishes arms-length deals from circular ones, FIP-0118 subsidizes a new class of synthetic demand — wash storage — that is indistinguishable from organic demand on-chain.
This is the classic unspoken assumption: that "paid" and "real" are the same predicate. A bug is just an unspoken assumption made visible, and here the assumption is load-bearing. If the verification design is weak, the reform does not fix the incentive misalignment — it relocates it from capacity to a more sophisticated theater. The summary discloses no anti-gaming architecture, which is itself a finding.
The governance fault line
Reward restructuring has a second-order effect that no burn curve addresses. The largest governance constituency in Filecoin is the storage miners, and FIP-0118 cuts their income roughly in half unless they convert into service providers. A nine-quarter transition is not generosity. It is a negotiated retreat — evidence that the proposal's authors anticipated miner resistance and pre-paid for it in time. If that resistance hardens, expect the target to be diluted or the window extended, and the reform to arrive weaker than specified. Security is not a feature; it is the architecture — and governance friction is part of the architecture.
Vulnerability forecast
Watch three variables over the next two quarters. First, the ratio of verified paid deals to committed capacity — if it does not rise, the burn accelerates and the demand confession gets louder. Second, the metering design for service shares — if self-dealing is not provably excluded, the reform mints synthetic demand. Third, the miner signaling on the FIP thread — if the consensus share target slips above 50%, the proposal has been captured.
Code is law, but logic is the judge. FIP-0118 gets the direction right and the enforcement wrong until it proves that a burned token and a served customer are not the same event. The curve bends, but the invariant — that rewards must track real service — has not yet been tested. Nine quarters is a long time to find out whether the demand was ever there.
