gitlab.com/SkynetLabs/skyd@v1.6.9/skymodules/renter/contractor/contractmaintenance.go

package contractor

// contractmaintenance.go handles forming and renewing contracts for the
// contractor. This includes deciding when new contracts need to be formed, when
// contracts need to be renewed, and if contracts need to be blacklisted.

import (
	"fmt"
	"math"
	"math/big"
	"reflect"
	"time"

	"gitlab.com/NebulousLabs/errors"
	"gitlab.com/NebulousLabs/fastrand"

	"gitlab.com/SkynetLabs/skyd/build"
	"gitlab.com/SkynetLabs/skyd/skymodules"
	"gitlab.com/SkynetLabs/skyd/skymodules/renter/proto"
	"go.sia.tech/siad/modules"
	"go.sia.tech/siad/persist"
	"go.sia.tech/siad/types"
)

const (
	// MaxCriticalRenewFailThreshold is the maximum number of contracts failing
	// to renew as fraction of the total gfr contracts in the allowance before
	// renew alerts are made critical.
	MaxCriticalRenewFailThreshold = 0.2

	// renewWindowLeewayDivisor controls how early we want to raise a renew
	// error from severe to critical. Taking a divisor of 4, means that we raise
	// a critical if a certain amount of renewals failed and if one fourth of
	// the renewal window has passed. This seems like a sane value as we delete
	// a contract after half the window has passed and the renew failed 12
	// consecutive times, so it should give the error some time to resolve
	// itself before becoming a critical.
	renewWindowLeewayDivisor = 4
)

var (
	// ErrInsufficientAllowance indicates that the renter's allowance is less
	// than the amount necessary to store at least one sector
	ErrInsufficientAllowance = errors.New("allowance is not large enough to cover fees of contract creation")
	errTooExpensive          = errors.New("host price was too high")

	// errContractEnded is the error returned when the contract has already ended
	errContractEnded = errors.New("contract has already ended")

	// errContractNotGFR is used to indicate that a contract renewal failed
	// because the contract was marked !GFR.
	errContractNotGFR = errors.New("contract is not GoodForRenew")

	// errHostBlocked is the error returned when the host is blocked
	errHostBlocked = errors.New("host is blocked")
)

type (
	// decoratedFileContractRenewal wraps a fileContractRenewal struct and
	// decorates it with a boolean that indicates whether the contract renewal
	// is already a certain amount of time into the renew window
	decoratedFileContractRenewal struct {
		fileContractRenewal

		lateRenewal bool
	}

	// fileContractRenewal is an instruction to renew a file contract.
	fileContractRenewal struct {
		id         types.FileContractID
		amount     types.Currency
		data       uint64
		hostPubKey types.SiaPublicKey
	}
)

// hostsForPortalFormation returns the hosts to form contracts with for a
// portal. In contrast to regular renters, portals form contracts with every
// host. It only ignores hosts that fail the gouging, have a bad score or hosts
// that we have recoverable contracts with.
func hostsForPortalFormation(allowance skymodules.Allowance, allContracts []skymodules.RenterContract, recoverableContracts []skymodules.RecoverableContract, activeHosts []skymodules.HostDBEntry, l *persist.Logger, scoreBreakdown func(skymodules.HostDBEntry) (skymodules.HostScoreBreakdown, error)) (int, []skymodules.HostDBEntry) {
	if !allowance.PortalMode() {
		build.Critical("hostsForPortalFormation was called on a non-portal")
		return 0, nil
	}
	// Get a list of all current contracts.
	currentContracts := make(map[string]skymodules.RenterContract)
	for _, contract := range allContracts {
		currentContracts[contract.HostPublicKey.String()] = contract
	}
	// Get a map of hosts we have recoverable contracts with.
	recoverable := make(map[string]struct{})
	for _, contract := range recoverableContracts {
		recoverable[contract.HostPublicKey.String()] = struct{}{}
	}

	var hosts []skymodules.HostDBEntry
	for _, host := range activeHosts {
		// Check if there is already a contract with this host.
		_, exists := currentContracts[host.PublicKey.String()]
		if exists {
			continue
		}

		// Skip host if it has a dead score.
		sb, err := scoreBreakdown(host)
		if err != nil || sb.Score.Cmp(types.NewCurrency64(1)) <= 0 {
			l.Debugf("skipping host %v due to dead or unknown score (%v)", host.PublicKey, err)
			continue
		}

		// Skip host if we have a recoverable contract with it.
		_, recoverableContract := recoverable[host.PublicKey.String()]
		if recoverableContract {
			l.Debugf("skipping host %v due to having a recoverable contract with it", host.PublicKey)
			continue
		}

		// Check that the price settings of the host are acceptable.
		hostSettings := host.HostExternalSettings
		err = staticCheckFormPaymentContractGouging(allowance, hostSettings)
		if err != nil {
			l.Debugf("payment contract loop igorning host %v for gouging: %v", hostSettings, err)
			continue
		}

		// Append host if it passed all checks.
		hosts = append(hosts, host)
	}
	return len(hosts), hosts
}

// hostsForRegularFormation returns the number of hosts needed for
// non-portal contract formation plus a set of hosts to use.
func hostsForRegularFormation(allowance skymodules.Allowance, allContracts []skymodules.RenterContract, recoverableContracts []skymodules.RecoverableContract, randomHosts func(_ int, _, _ []types.SiaPublicKey) ([]skymodules.HostDBEntry, error), l *persist.Logger) (int, []skymodules.HostDBEntry) {
	if allowance.PortalMode() {
		build.Critical("hostsForRegularFormation was called on a portal")
		return 0, nil
	}
	// Count the number of contracts which are good for uploading, and then make
	// more as needed to fill the gap.
	uploadContracts := 0
	for _, c := range allContracts {
		if c.Utility.GoodForUpload {
			uploadContracts++
		}
	}
	neededContracts := int(allowance.Hosts) - uploadContracts
	if neededContracts <= 0 {
		l.Debugln("do not seem to need more contracts")
		return 0, nil
	}
	if neededContracts > 0 {
		l.Println("need more contracts:", neededContracts)
	}

	// Assemble two exclusion lists. The first one excludes all hosts that we
	// already have contracts with and the second one excludes all hosts we have
	// active contracts with. Then select a new batch of hosts to attempt
	// contract formation with.
	var blacklist []types.SiaPublicKey
	var addressBlacklist []types.SiaPublicKey
	for _, contract := range allContracts {
		blacklist = append(blacklist, contract.HostPublicKey)
		if !contract.Utility.Locked || contract.Utility.GoodForRenew || contract.Utility.GoodForUpload {
			addressBlacklist = append(addressBlacklist, contract.HostPublicKey)
		}
	}
	// Add the hosts we have recoverable contracts with to the blacklist to
	// avoid losing existing data by forming a new/empty contract.
	for _, contract := range recoverableContracts {
		blacklist = append(blacklist, contract.HostPublicKey)
	}

	hosts, err := randomHosts(neededContracts*4+randomHostsBufferForScore, blacklist, addressBlacklist)
	if err != nil {
		l.Println("WARN: not forming new contracts:", err)
		return 0, nil
	}
	l.Debugln("trying to form contracts with hosts, pulled this many hosts from hostdb:", len(hosts))
	return neededContracts, hosts
}

// initialContractFunding computes the amount of money to put into the first
// contract formed with a host.
func initialContractFunding(a skymodules.Allowance, host skymodules.HostDBEntry, txnFee, min, max types.Currency) types.Currency {
	if a.PortalMode() {
		return a.PaymentContractInitialFunding
	}

	// Calculate the contract funding with host
	contractFunds := host.ContractPrice.Add(txnFee).Mul64(ContractFeeFundingMulFactor)

	// Check that the contract funding is reasonable compared to the max and
	// min initial funding. This is to protect against increases to
	// allowances being used up to fast and not being able to spread the
	// funds across new contracts properly, as well as protecting against
	// contracts renewing too quickly
	if min.Cmp(max) > 0 && !max.IsZero() {
		build.Critical(fmt.Sprintf("WARN: initialContractFunding min > max (%v > %v)", min, max))
	}
	if contractFunds.Cmp(max) > 0 && !max.IsZero() {
		return max
	}
	if contractFunds.Cmp(min) < 0 {
		return min
	}
	return contractFunds
}

// callNotifyDoubleSpend is used by the watchdog to alert the contractor
// whenever a monitored file contract input is double-spent. This function
// marks down the host score, and marks the contract as !GoodForRenew and
// !GoodForUpload.
func (c *Contractor) callNotifyDoubleSpend(fcID types.FileContractID, blockHeight types.BlockHeight) {
	c.staticLog.Println("Watchdog found a double-spend: ", fcID, blockHeight)

	// Mark the contract as double-spent. This will cause the contract to be
	// excluded in period spending.
	c.mu.Lock()
	c.doubleSpentContracts[fcID] = blockHeight
	c.mu.Unlock()

	err := c.MarkContractBad(fcID)
	if err != nil {
		c.staticLog.Println("callNotifyDoubleSpend error in MarkContractBad", err)
	}
}

// managedCheckForDuplicates checks for static contracts that have the same host
// key and moves the older one to old contracts.
func (c *Contractor) managedCheckForDuplicates() {
	// Build map for comparison.
	pubkeys := make(map[string]types.FileContractID)
	var newContract, oldContract skymodules.RenterContract
	for _, contract := range c.staticContracts.ViewAll() {
		id, exists := pubkeys[contract.HostPublicKey.String()]
		if !exists {
			pubkeys[contract.HostPublicKey.String()] = contract.ID
			continue
		}

		// Duplicate contract found, determine older contract to delete.
		if rc, ok := c.staticContracts.View(id); ok {
			if rc.StartHeight >= contract.StartHeight {
				newContract, oldContract = rc, contract
			} else {
				newContract, oldContract = contract, rc
			}
			c.staticLog.Printf("Duplicate contract found. New contract is %x and old contract is %v", newContract.ID, oldContract.ID)

			// Get SafeContract
			oldSC, ok := c.staticContracts.Acquire(oldContract.ID)
			if !ok {
				// Update map
				pubkeys[contract.HostPublicKey.String()] = newContract.ID
				continue
			}

			// Link the contracts to each other and then store the old contract
			// in the record of historic contracts.
			//
			// Note: This means that if there are multiple duplicates, say 3
			// contracts that all share the same host, then the ordering may not
			// be perfect. If in reality the renewal order was A<->B<->C, it's
			// possible for the contractor to end up with A->C and B<->C in the
			// mapping.
			c.mu.Lock()
			c.renewedFrom[newContract.ID] = oldContract.ID
			c.renewedTo[oldContract.ID] = newContract.ID
			c.oldContracts[oldContract.ID] = oldSC.Metadata()

			// Save the contractor and delete the contract.
			//
			// TODO: Ideally these two things would happen atomically, but I'm
			// not completely certain that's feasible with our current
			// architecture.
			//
			// TODO: This should revert the in memory state in the event of an
			// error and continue
			err := c.save()
			if err != nil {
				c.staticLog.Println("Failed to save the contractor after updating renewed maps.")
			}
			c.mu.Unlock()
			c.staticContracts.Delete(oldSC)

			// Update the pubkeys map to contain the newest contract id.
			pubkeys[contract.HostPublicKey.String()] = newContract.ID
		}
	}
}

// managedEstimateRenewFundingRequirements estimates the amount of money that a
// contract is going to need in the next billing cycle by looking at how much
// storage is in the contract and what the historic usage pattern of the
// contract has been.
func (c *Contractor) managedEstimateRenewFundingRequirements(contract skymodules.RenterContract, gfrContracts uint64, blockHeight types.BlockHeight, allowance skymodules.Allowance) (types.Currency, error) {
	// Fetch the host pricing to use in the estimate.
	host, exists, err := c.staticHDB.Host(contract.HostPublicKey)
	if err != nil {
		return types.ZeroCurrency, errors.AddContext(err, "error getting host from hostdb:")
	}
	if !exists {
		return types.ZeroCurrency, errors.New("could not find host in hostdb")
	}
	if host.Filtered {
		return types.ZeroCurrency, errHostBlocked
	}

	// Estimate the amount of money that's going to be needed for existing
	// storage.
	dataStored := contract.Transaction.FileContractRevisions[0].NewFileSize
	storageCost := types.NewCurrency64(dataStored).Mul64(uint64(allowance.Period)).Mul(host.StoragePrice)

	// For the spending estimates, we're going to need to know the amount of
	// money that was spent on upload and download by this contract line in this
	// period. That's going to require iterating over the renew history of the
	// contract to get all the spending across any refreshes that occurred this
	// period.
	prevUploadSpending := contract.UploadSpending
	prevDownloadSpending := contract.DownloadSpending
	prevFundAccountSpending := contract.FundAccountSpending
	prevMaintenanceSpending := contract.MaintenanceSpending
	c.mu.Lock()
	currentID := contract.ID
	for i := 0; i < 10e3; i++ { // prevent an infinite loop if there's an [impossible] contract cycle
		// If there is no previous contract, nothing to do.
		var exists bool
		currentID, exists = c.renewedFrom[currentID]
		if !exists {
			break
		}

		// If the contract is not in oldContracts, that's probably a bug, but
		// nothing to do otherwise.
		currentContract, exists := c.oldContracts[currentID]
		if !exists {
			c.staticLog.Println("WARN: A known previous contract is not found in c.oldContracts")
			break
		}

		// If the contract did not start in the current period, then it is not
		// relevant, and none of the previous contracts will be relevant either.
		if currentContract.StartHeight < c.currentPeriod {
			break
		}

		// Add the historical spending metrics.
		prevUploadSpending = prevUploadSpending.Add(currentContract.UploadSpending)
		prevDownloadSpending = prevDownloadSpending.Add(currentContract.DownloadSpending)
		prevFundAccountSpending = prevFundAccountSpending.Add(currentContract.FundAccountSpending)
		prevMaintenanceSpending = prevMaintenanceSpending.Add(currentContract.MaintenanceSpending)
	}
	c.mu.Unlock()

	// Estimate the amount of money that's going to be needed for new storage
	// based on the amount of new storage added in the previous period. Account
	// for both the storage price as well as the upload price.
	prevUploadDataEstimate := prevUploadSpending
	if !host.UploadBandwidthPrice.IsZero() {
		// TODO: Because the host upload bandwidth price can change, this is not
		// the best way to estimate the amount of data that was uploaded to this
		// contract. Better would be to look at the amount of data stored in the
		// contract from the previous cycle and use that to determine how much
		// total data.
		prevUploadDataEstimate = prevUploadDataEstimate.Div(host.UploadBandwidthPrice)
	}
	// Sanity check - the host may have changed prices, make sure we aren't
	// assuming an unreasonable amount of data.
	if types.NewCurrency64(dataStored).Cmp(prevUploadDataEstimate) < 0 {
		prevUploadDataEstimate = types.NewCurrency64(dataStored)
	}
	// The estimated cost for new upload spending is the previous upload
	// bandwidth plus the implied storage cost for all of the new data.
	newUploadsCost := prevUploadSpending.Add(prevUploadDataEstimate.Mul64(uint64(allowance.Period)).Mul(host.StoragePrice))

	// The download cost is assumed to be the same. Even if the user is
	// uploading more data, the expectation is that the download amounts will be
	// relatively constant. Add in the contract price as well.
	newDownloadsCost := prevDownloadSpending

	// The estimated cost for funding ephemeral accounts and performing RHP3
	// maintenance such as updating price tables and syncing the ephemeral
	// account balance is expected to remain identical.
	newFundAccountCost := prevFundAccountSpending
	newMaintenanceCost := prevMaintenanceSpending.Sum()

	contractPrice := host.ContractPrice

	// Aggregate all estimates so far to compute the estimated siafunds fees.
	// The transaction fees are not included in the siafunds estimate because
	// users are not charged siafund fees on money that doesn't go into the file
	// contract (and the transaction fee goes to the miners, not the file
	// contract).
	beforeSiafundFeesEstimate := storageCost.Add(newUploadsCost).Add(newDownloadsCost).Add(newFundAccountCost).Add(newMaintenanceCost).Add(contractPrice)
	afterSiafundFeesEstimate := types.Tax(blockHeight, beforeSiafundFeesEstimate).Add(beforeSiafundFeesEstimate)

	// Get an estimate for how much money we will be charged before going into
	// the transaction pool.
	_, maxTxnFee := c.staticTPool.FeeEstimation()
	txnFees := maxTxnFee.Mul64(skymodules.EstimatedFileContractTransactionSetSize)

	// Add them all up and then return the estimate plus 33% for error margin
	// and just general volatility of usage pattern.
	estimatedCost := afterSiafundFeesEstimate.Add(txnFees)
	estimatedCost = estimatedCost.Add(estimatedCost.Div64(3))

	// Check for a sane minimum that is equal to the initial contract funding
	// but without an upper cap.
	minInitialContractFunds := allowance.Funds.Div64(allowance.Hosts).Div64(MinInitialContractFundingDivFactor)
	minimum := initialContractFunding(allowance, host, txnFees, minInitialContractFunds, types.ZeroCurrency)
	if estimatedCost.Cmp(minimum) < 0 {
		c.staticLog.Printf("Contract renew amount %v below minimum amount %v", estimatedCost, minimum)
		estimatedCost = minimum
	}
	return estimatedCost, nil
}

// callInterruptContractMaintenance will issue an interrupt signal to any
// running maintenance, stopping that maintenance. If there are multiple threads
// running maintenance, they will all be stopped.
func (c *Contractor) callInterruptContractMaintenance() {
	// Spin up a thread to grab the maintenance lock. Signal that the lock was
	// acquired after the lock is acquired.
	gotLock := make(chan struct{})
	go func() {
		c.maintenanceLock.Lock()
		close(gotLock)
		c.maintenanceLock.Unlock()
	}()

	// There may be multiple threads contending for the maintenance lock. Issue
	// interrupts repeatedly until we get a signal that the maintenance lock has
	// been acquired.
	for {
		select {
		case <-gotLock:
			return
		case c.staticInterruptMaintenance <- struct{}{}:
			c.staticLog.Debugln("Signal sent to interrupt contract maintenance")
		}
	}
}

// managedAddPreferredHosts adds toAdd hosts to the preferredHosts set from the
// potentialHosts set and removes them from the potentialHosts.
func (c *Contractor) managedAddPreferredHosts(toAdd int, preferredHosts, potentialHosts map[string]struct{}) {
	// Grab random hosts from the potential set that are not already in the
	// preferred set. To do so, we use the preferred hosts as the blacklist and
	// the potential hosts as the whitelist.
	var blacklist []types.SiaPublicKey
	for host := range preferredHosts {
		var spk types.SiaPublicKey
		err := spk.LoadString(host)
		if err != nil {
			build.Critical("managedLimitGFUHosts: failed to marshal hostkey", err)
			delete(preferredHosts, host)
			continue
		}
		// Ignore hosts that are already in the preferred set.
		blacklist = append(blacklist, spk)
	}
	hosts, err := c.staticHDB.RandomHostsWithWhitelist(toAdd, blacklist, blacklist, potentialHosts)
	if err != nil {
		c.staticLog.Print("managedLimitGFUHosts: failed to get random hosts:", err)
		return
	}

	// Add hosts to fill the set.
	for i := 0; i < len(hosts) && toAdd > 0; i++ {
		host := hosts[i].PublicKey.String()
		_, exists := potentialHosts[host]
		if !exists {
			continue // try next
		}
		preferredHosts[host] = struct{}{}
		delete(potentialHosts, host)
		toAdd--
	}
}

// managedFindMinAllowedHostScores uses a set of random hosts from the hostdb to
// calculate minimum acceptable score for a host to be marked GFR and GFU.
func (c *Contractor) managedFindMinAllowedHostScores(hostCount uint64) (types.Currency, types.Currency, error) {
	// Pull a new set of hosts from the hostdb that could be used as a new set
	// to match the allowance. The lowest scoring host of these new hosts will
	// be used as a baseline for determining whether our existing contracts are
	// worthwhile.
	hosts, err := c.staticHDB.RandomHosts(int(hostCount)+randomHostsBufferForScore, nil, nil)
	if err != nil {
		return types.Currency{}, types.Currency{}, err
	}

	if len(hosts) == 0 {
		return types.Currency{}, types.Currency{}, errors.New("No hosts returned in RandomHosts")
	}

	// Find the minimum score that a host is allowed to have to be considered
	// good for upload.
	var minScoreGFR, minScoreGFU types.Currency
	sb, err := c.staticHDB.ScoreBreakdown(hosts[0])
	if err != nil {
		return types.Currency{}, types.Currency{}, err
	}

	lowestScore := sb.Score
	for i := 1; i < len(hosts); i++ {
		score, err := c.staticHDB.ScoreBreakdown(hosts[i])
		if err != nil {
			return types.Currency{}, types.Currency{}, err
		}
		if score.Score.Cmp(lowestScore) < 0 {
			lowestScore = score.Score
		}
	}
	// Set the minimum acceptable score to a factor of the lowest score.
	minScoreGFR = lowestScore.Div(scoreLeewayGoodForRenew)
	minScoreGFU = lowestScore.Div(scoreLeewayGoodForUpload)

	// Set min score to the max score seen times 2.
	if c.staticDeps.Disrupt("HighMinHostScore") {
		var maxScore types.Currency
		for i := 1; i < len(hosts); i++ {
			score, err := c.staticHDB.ScoreBreakdown(hosts[i])
			if err != nil {
				return types.Currency{}, types.Currency{}, err
			}
			if score.Score.Cmp(maxScore) > 0 {
				maxScore = score.Score
			}
		}
		minScoreGFR = maxScore.Mul64(2)
	}

	return minScoreGFR, minScoreGFU, nil
}

// managedNewContract negotiates an initial file contract with the specified
// host, saves it, and returns it.
func (c *Contractor) managedNewContract(host skymodules.HostDBEntry, allowance skymodules.Allowance, contractFunding types.Currency, endHeight types.BlockHeight) (_ types.Currency, _ skymodules.RenterContract, err error) {
	// reject hosts that are too expensive
	if host.StoragePrice.Cmp(maxStoragePrice) > 0 {
		return types.ZeroCurrency, skymodules.RenterContract{}, errTooExpensive
	}
	// Determine if host settings align with allowance period
	c.mu.Lock()
	if reflect.DeepEqual(allowance, skymodules.Allowance{}) {
		c.mu.Unlock()
		return types.ZeroCurrency, skymodules.RenterContract{}, errors.New("called managedNewContract but allowance wasn't set")
	}
	hostSettings := host.HostExternalSettings
	period := allowance.Period
	c.mu.Unlock()

	if host.MaxDuration < period {
		err := errors.New("unable to form contract with host due to insufficient MaxDuration of host")
		return types.ZeroCurrency, skymodules.RenterContract{}, err
	}
	// cap host.MaxCollateral
	if host.MaxCollateral.Cmp(maxCollateral) > 0 {
		host.MaxCollateral = maxCollateral
	}

	// Check for price gouging.
	err = checkFormContractGouging(allowance, hostSettings)
	if err != nil {
		return types.ZeroCurrency, skymodules.RenterContract{}, errors.AddContext(err, "unable to form a contract due to price gouging detection")
	}

	// get an address to use for negotiation
	uc, err := c.staticWallet.NextAddress()
	if err != nil {
		return types.ZeroCurrency, skymodules.RenterContract{}, err
	}
	defer func() {
		if err != nil {
			err = errors.Compose(err, c.staticWallet.MarkAddressUnused(uc))
		}
	}()

	// get the wallet seed.
	seed, _, err := c.staticWallet.PrimarySeed()
	if err != nil {
		return types.ZeroCurrency, skymodules.RenterContract{}, err
	}
	// derive the renter seed and wipe it once we are done with it.
	renterSeed := skymodules.DeriveRenterSeed(seed)
	defer fastrand.Read(renterSeed[:])

	// create contract params
	c.mu.RLock()
	params := skymodules.ContractParams{
		Allowance:     allowance,
		Host:          host,
		Funding:       contractFunding,
		StartHeight:   c.blockHeight,
		EndHeight:     endHeight,
		RefundAddress: uc.UnlockHash(),
		RenterSeed:    renterSeed.EphemeralRenterSeed(endHeight),
	}
	c.mu.RUnlock()

	// wipe the renter seed once we are done using it.
	defer fastrand.Read(params.RenterSeed[:])

	// create transaction builder and trigger contract formation.
	txnBuilder, err := c.staticWallet.StartTransaction()
	if err != nil {
		return types.ZeroCurrency, skymodules.RenterContract{}, err
	}

	contract, formationTxnSet, sweepTxn, sweepParents, err := c.staticContracts.FormContract(params, txnBuilder, c.staticTPool, c.staticHDB, c.staticTG.StopChan())
	if err != nil {
		txnBuilder.Drop()
		return types.ZeroCurrency, skymodules.RenterContract{}, err
	}

	monitorContractArgs := monitorContractArgs{
		false,
		contract.ID,
		contract.Transaction,
		formationTxnSet,
		sweepTxn,
		sweepParents,
		params.StartHeight,
	}
	err = c.staticWatchdog.callMonitorContract(monitorContractArgs)
	if err != nil {
		return types.ZeroCurrency, skymodules.RenterContract{}, err
	}

	// Add a mapping from the contract's id to the public key of the host.
	c.mu.Lock()
	_, exists := c.pubKeysToContractID[contract.HostPublicKey.String()]
	if exists {
		c.mu.Unlock()
		txnBuilder.Drop()
		// We need to return a funding value because money was spent on this
		// host, even though the full process could not be completed.
		c.staticLog.Println("WARN: Attempted to form a new contract with a host that we already have a contrat with.")
		return contractFunding, skymodules.RenterContract{}, fmt.Errorf("We already have a contract with host %v", contract.HostPublicKey)
	}
	c.pubKeysToContractID[contract.HostPublicKey.String()] = contract.ID
	c.mu.Unlock()

	contractValue := contract.RenterFunds
	c.staticLog.Printf("Formed contract %v with %v for %v", contract.ID, host.NetAddress, contractValue.HumanString())

	// Update the hostdb to include the new contract.
	err = c.staticHDB.UpdateContracts(c.staticContracts.ViewAll())
	if err != nil {
		c.staticLog.Println("Unable to update hostdb contracts:", err)
	}
	return contractFunding, contract, nil
}

// managedPrunedRedundantAddressRange uses the hostdb to find hosts that
// violate the rules about address ranges and cancels them.
func (c *Contractor) managedPrunedRedundantAddressRange() {
	// Get all contracts which are not canceled.
	allContracts := c.staticContracts.ViewAll()
	var contracts []skymodules.RenterContract
	for _, contract := range allContracts {
		if contract.Utility.Locked && !contract.Utility.GoodForRenew && !contract.Utility.GoodForUpload {
			// contract is canceled
			continue
		}
		contracts = append(contracts, contract)
	}

	// Get all the public keys and map them to contract ids.
	pks := make([]types.SiaPublicKey, 0, len(allContracts))
	cids := make(map[string]types.FileContractID)
	for _, contract := range contracts {
		pks = append(pks, contract.HostPublicKey)
		cids[contract.HostPublicKey.String()] = contract.ID
	}

	// Let the hostdb filter out bad hosts and cancel contracts with those
	// hosts.
	badHosts, err := c.staticHDB.CheckForIPViolations(pks)
	if err != nil {
		c.staticLog.Println("WARN: error checking for IP violations:", err)
		return
	}
	for _, host := range badHosts {
		if err := c.managedCancelContract(cids[host.String()]); err != nil {
			c.staticLog.Print("WARNING: Wasn't able to cancel contract in managedPrunedRedundantAddressRange", err)
		}
	}
}

// managedLimitGFUHosts caps the number of GFU hosts to allowance.Hosts.
func (c *Contractor) managedLimitGFUHosts(contracts []skymodules.RenterContract, updates map[types.FileContractID]skymodules.ContractUtility, wantedHosts uint64) {
	c.mu.Lock()
	// Store the preferred contracts in a temporary map. If we have too many
	// of them for the current allowance, we delete some.
	preferredHosts := make(map[string]struct{})
	for hk := range c.preferredHosts {
		if uint64(len(preferredHosts)) < wantedHosts {
			preferredHosts[hk] = struct{}{}
		}
	}
	c.mu.Unlock()

	potentialHosts := make(map[string]struct{})
	for _, contract := range contracts {
		// If the contract is !gfu ignore it.
		if !contract.Utility.GoodForUpload {
			continue
		}
		// If it is gfu, mark the corresponding host as a potential candidate.
		potentialHosts[contract.HostPublicKey.String()] = struct{}{}
	}

	// If a preferred host is not part of the potential hosts, it's no longer
	// preferred so we delete it. We also delete hosts that are in the preferred
	// hosts from the potential ones.
	for host := range preferredHosts {
		_, exists := potentialHosts[host]
		delete(potentialHosts, host)
		if !exists {
			delete(preferredHosts, host)
		}
	}

	// Now we are only left with the preferred hosts that are gfu.
	// If they are too many, trim them.
	toTrim := len(preferredHosts) - int(wantedHosts)
	for host := range preferredHosts {
		if toTrim <= 0 {
			break
		}
		delete(preferredHosts, host)
		toTrim--
	}
	// If there are too few, add some.
	toAdd := int(wantedHosts) - len(preferredHosts)
	if toAdd > 0 {
		c.managedAddPreferredHosts(toAdd, preferredHosts, potentialHosts)
	}

	// Sanity check length of set.
	if uint64(len(preferredHosts)) > wantedHosts {
		build.Critical("too many contracts in the set of preferred contracts")
	}

	// Mark all contracts that are not in the preferred set as !gfu.
	for _, contract := range contracts {
		_, isPreferred := preferredHosts[contract.HostPublicKey.String()]
		if isPreferred {
			continue // nothing to do
		}
		if !contract.Utility.GoodForUpload {
			continue // nothing to do
		}
		c.staticLog.Printf("[CONTRACTUTILITY][%v] marking contract as !GFU to take into accounts the cap defined by the allowance (update not applied yet), GFU: true -> false\n", contract.ID)
		u := contract.Utility
		u.GoodForUpload = false
		updates[contract.ID] = u
	}

	// Update the preferred contracts.
	c.mu.Lock()
	c.preferredHosts = preferredHosts
	c.mu.Unlock()
}

// staticCheckFormPaymentContractGouging will check whether the pricing from the
// host for forming a payment contract is too high to justify forming a contract
// with this host.
func staticCheckFormPaymentContractGouging(allowance skymodules.Allowance, hostSettings modules.HostExternalSettings) error {
	// Check whether the RPC base price is too high.
	if !allowance.MaxRPCPrice.IsZero() && allowance.MaxRPCPrice.Cmp(hostSettings.BaseRPCPrice) <= 0 {
		return errors.New("rpc base price of host is too high - extortion protection enabled")
	}
	// Check whether the form contract price is too high.
	if !allowance.MaxContractPrice.IsZero() && allowance.MaxContractPrice.Cmp(hostSettings.ContractPrice) <= 0 {
		return errors.New("contract price of host is too high - extortion protection enabled")
	}
	// Check whether the sector access price is too high.
	if !allowance.MaxSectorAccessPrice.IsZero() && allowance.MaxSectorAccessPrice.Cmp(hostSettings.SectorAccessPrice) <= 0 {
		return errors.New("sector access price of host is too high - extortion protection enabled")
	}

	// Check whether the form contract price does not leave enough room for
	// uploads and downloads. At least half of the payment contract's funds need
	// to remain for download bandwidth.
	if allowance.PaymentContractInitialFunding.Div64(2).Cmp(hostSettings.ContractPrice) <= 0 {
		return errors.New("contract price of host is too high - extortion protection enabled")
	}
	return nil
}

// checkFormContractGouging will check whether the pricing for forming
// this contract triggers any price gouging warnings.
func checkFormContractGouging(allowance skymodules.Allowance, hostSettings modules.HostExternalSettings) error {
	// Check whether the RPC base price is too high.
	if !allowance.MaxRPCPrice.IsZero() && allowance.MaxRPCPrice.Cmp(hostSettings.BaseRPCPrice) < 0 {
		return errors.New("rpc base price of host is too high - price gouging protection enabled")
	}
	// Check whether the form contract price is too high.
	if !allowance.MaxContractPrice.IsZero() && allowance.MaxContractPrice.Cmp(hostSettings.ContractPrice) < 0 {
		return errors.New("contract price of host is too high - price gouging protection enabled")
	}

	return nil
}

// managedRenew negotiates a new contract for data already stored with a host.
// It returns the new contract. This is a blocking call that performs network
// I/O.
func (c *Contractor) managedRenew(id types.FileContractID, a skymodules.Allowance, hpk types.SiaPublicKey, contractFunding types.Currency, newEndHeight types.BlockHeight, hostSettings modules.HostExternalSettings) (_ skymodules.RenterContract, err error) {
	// Fetch the host associated with this contract.
	host, ok, err := c.staticHDB.Host(hpk)
	if err != nil {
		return skymodules.RenterContract{}, errors.AddContext(err, "error getting host from hostdb:")
	}
	// Use the most recent hostSettings, along with the host db entry.
	host.HostExternalSettings = hostSettings

	if c.staticDeps.Disrupt("DefaultRenewSettings") {
		c.staticLog.Debugln("Using default host settings")
		host.HostExternalSettings = modules.DefaultHostExternalSettings()
		// Reset some specific settings, not available through the default.
		host.HostExternalSettings.NetAddress = hostSettings.NetAddress
		host.HostExternalSettings.RemainingStorage = hostSettings.RemainingStorage
		host.HostExternalSettings.TotalStorage = hostSettings.TotalStorage
		host.HostExternalSettings.UnlockHash = hostSettings.UnlockHash
		host.HostExternalSettings.RevisionNumber = hostSettings.RevisionNumber
		host.HostExternalSettings.SiaMuxPort = hostSettings.SiaMuxPort
	}

	if reflect.DeepEqual(a, skymodules.Allowance{}) {
		return skymodules.RenterContract{}, errors.New("called managedRenew but allowance isn't set")
	}
	period := a.Period

	if !ok {
		return skymodules.RenterContract{}, errHostNotFound
	} else if host.Filtered {
		return skymodules.RenterContract{}, errHostBlocked
	} else if host.StoragePrice.Cmp(maxStoragePrice) > 0 {
		return skymodules.RenterContract{}, errTooExpensive
	} else if host.MaxDuration < period {
		return skymodules.RenterContract{}, errors.New("insufficient MaxDuration of host")
	}

	// cap host.MaxCollateral
	if host.MaxCollateral.Cmp(maxCollateral) > 0 {
		host.MaxCollateral = maxCollateral
	}

	// Check for price gouging on the renewal.
	err = checkFormContractGouging(a, host.HostExternalSettings)
	if err != nil {
		return skymodules.RenterContract{}, errors.AddContext(err, "unable to renew - price gouging protection enabled")
	}

	// get an address to use for negotiation
	uc, err := c.staticWallet.NextAddress()
	if err != nil {
		return skymodules.RenterContract{}, err
	}
	defer func() {
		if err != nil {
			err = errors.Compose(err, c.staticWallet.MarkAddressUnused(uc))
		}
	}()

	// get the wallet seed
	seed, _, err := c.staticWallet.PrimarySeed()
	if err != nil {
		return skymodules.RenterContract{}, err
	}
	// derive the renter seed and wipe it after we are done with it.
	renterSeed := skymodules.DeriveRenterSeed(seed)
	defer fastrand.Read(renterSeed[:])

	// create contract params
	c.mu.RLock()
	params := skymodules.ContractParams{
		Allowance:     a,
		Host:          host,
		Funding:       contractFunding,
		StartHeight:   c.blockHeight,
		EndHeight:     newEndHeight,
		RefundAddress: uc.UnlockHash(),
		RenterSeed:    renterSeed.EphemeralRenterSeed(newEndHeight),
	}
	c.mu.RUnlock()

	// wipe the renter seed once we are done using it.
	defer fastrand.Read(params.RenterSeed[:])

	// create a transaction builder with the correct amount of funding for the renewal.
	txnBuilder, err := c.staticWallet.StartTransaction()
	if err != nil {
		return skymodules.RenterContract{}, err
	}
	err = txnBuilder.FundSiacoins(params.Funding)
	if err != nil {
		txnBuilder.Drop() // return unused outputs to wallet
		return skymodules.RenterContract{}, err
	}
	// Add an output that sends all fund back to the refundAddress.
	// Note that in order to send this transaction, a miner fee will have to be subtracted.
	output := types.SiacoinOutput{
		Value:      params.Funding,
		UnlockHash: params.RefundAddress,
	}
	sweepTxn, sweepParents := txnBuilder.Sweep(output)

	var newContract skymodules.RenterContract
	var formationTxnSet []types.Transaction
	if c.staticDeps.Disrupt("LegacyRenew") || build.VersionCmp(host.Version, "1.5.4") < 0 {
		// Acquire the SafeContract.
		oldContract, ok := c.staticContracts.Acquire(id)
		if !ok {
			return skymodules.RenterContract{}, errContractNotFound
		}
		if !oldContract.Utility().GoodForRenew {
			return skymodules.RenterContract{}, errContractNotGFR
		}
		// RHP2 renewal.
		newContract, formationTxnSet, err = c.staticContracts.Renew(oldContract, params, txnBuilder, c.staticTPool, c.staticHDB, c.staticTG.StopChan())
		c.staticContracts.Return(oldContract)
	} else {
		var w skymodules.Worker
		w, err = c.staticWorkerPool.Worker(hpk)
		if err != nil {
			txnBuilder.Drop() // return unused outputs to wallet
			return skymodules.RenterContract{}, err
		}
		newContract, formationTxnSet, err = w.RenewContract(c.staticTG.StopCtx(), id, params, txnBuilder)
	}
	if err != nil {
		txnBuilder.Drop() // return unused outputs to wallet
		return skymodules.RenterContract{}, err
	}

	monitorContractArgs := monitorContractArgs{
		false,
		newContract.ID,
		newContract.Transaction,
		formationTxnSet,
		sweepTxn,
		sweepParents,
		params.StartHeight,
	}
	err = c.staticWatchdog.callMonitorContract(monitorContractArgs)
	if err != nil {
		return skymodules.RenterContract{}, err
	}

	// Add a mapping from the contract's id to the public key of the host. This
	// will destroy the previous mapping from pubKey to contract id but other
	// modules are only interested in the most recent contract anyway.
	c.mu.Lock()
	c.pubKeysToContractID[newContract.HostPublicKey.String()] = newContract.ID
	c.mu.Unlock()

	// Update the hostdb to include the new contract.
	err = c.staticHDB.UpdateContracts(c.staticContracts.ViewAll())
	if err != nil {
		c.staticLog.Println("Unable to update hostdb contracts:", err)
	}

	return newContract, nil
}

// managedRenewContract will use the renew instructions to renew a contract,
// returning the amount of money that was put into the contract for renewal.
func (c *Contractor) managedRenewContract(renewInstructions fileContractRenewal, currentPeriod types.BlockHeight, allowance skymodules.Allowance, blockHeight, endHeight types.BlockHeight) (fundsSpent types.Currency, err error) {
	if c.staticDeps.Disrupt("ContractRenewFail") {
		err = errors.New("Renew failure due to dependency")
		return
	}
	// Pull the variables out of the renewal.
	id := renewInstructions.id
	amount := renewInstructions.amount
	hostPubKey := renewInstructions.hostPubKey

	// Get a session with the host, before marking it as being renewed.
	hs, err := c.Session(hostPubKey, c.staticTG.StopChan())
	if err != nil {
		err = errors.AddContext(err, "Unable to establish session with host")
		return
	}
	s := hs.(*hostSession)

	// Mark the contract as being renewed, and defer logic to unmark it
	// once renewing is complete.
	c.staticLog.Debugln("Marking a contract for renew:", id)
	c.mu.Lock()
	c.renewing[id] = true
	c.mu.Unlock()
	defer func() {
		c.staticLog.Debugln("Unmarking the contract for renew", id)
		c.mu.Lock()
		delete(c.renewing, id)
		c.mu.Unlock()
	}()

	// Wait for any active editors/downloaders/sessions to finish for this
	// contract, and then grab the latest host settings.
	var hostSettings modules.HostExternalSettings
	c.mu.RLock()
	e, eok := c.editors[id]
	d, dok := c.downloaders[id]
	c.mu.RUnlock()
	if eok {
		c.staticLog.Debugln("Waiting for editor invalidation")
		e.callInvalidate()
		c.staticLog.Debugln("Got editor invalidation")
	}
	if dok {
		c.staticLog.Debugln("Waiting for downloader invalidation")
		d.callInvalidate()
		c.staticLog.Debugln("Got downloader invalidation")
	}

	// Use the Settings RPC with the host and then invalidate the session.
	hostSettings, err = s.Settings()
	if err != nil {
		err = errors.AddContext(err, "Unable to get host settings")
		return
	}
	c.staticLog.Debugln("Waiting for session invalidation")
	s.callInvalidate()
	c.staticLog.Debugln("Got session invalidation")

	// Perform the actual renew. If the renew fails, return the
	// contract. If the renew fails we check how often it has failed
	// before. Once it has failed for a certain number of blocks in a
	// row and reached its second half of the renew window, we give up
	// on renewing it and set goodForRenew to false.
	c.staticLog.Debugln("calling managedRenew on contract", id)
	newContract, errRenew := c.managedRenew(id, allowance, hostPubKey, amount, endHeight, hostSettings)
	c.staticLog.Debugln("managedRenew has returned with error:", errRenew)
	oldContract, exists := c.staticContracts.Acquire(id)
	if !exists {
		return types.ZeroCurrency, errors.AddContext(errContractNotFound, "failed to acquire oldContract after renewal")
	}
	oldUtility := oldContract.Utility()
	md := oldContract.Metadata()
	if errRenew != nil {
		// Increment the number of failed renews for the contract if it
		// was the host's fault.
		if skymodules.IsHostsFault(errRenew) {
			c.mu.Lock()
			c.numFailedRenews[oldContract.Metadata().ID]++
			totalFailures := c.numFailedRenews[oldContract.Metadata().ID]
			c.mu.Unlock()
			c.staticLog.Debugln("remote host determined to be at fault, tallying up failed renews", totalFailures, id)
		}

		// Check if contract has to be replaced.
		c.mu.RLock()
		numRenews, failedBefore := c.numFailedRenews[md.ID]
		c.mu.RUnlock()
		secondHalfOfWindow := blockHeight+allowance.RenewWindow/2 >= md.EndHeight
		replace := numRenews >= ConsecutiveRenewalsBeforeReplacement
		if failedBefore && secondHalfOfWindow && replace {
			errorMsg := fmt.Sprintf("[CONTRACTUTILITY][%v] WARN: consistently failed to renew contract for host %v, marked as bad and locked: %v, GFU: %v -> false, GFR: %v -> false, GFRef: %v -> false",
				md.ID, md.HostPublicKey, errRenew, oldUtility.GoodForUpload, oldUtility.GoodForRenew, oldUtility.GoodForRefresh)

			oldUtility.GoodForRefresh = false
			oldUtility.GoodForRenew = false
			oldUtility.GoodForUpload = false
			oldUtility.Locked = true
			err := c.callUpdateUtility(oldContract, oldUtility, true)
			if err != nil {
				errorMsg += fmt.Sprintf(", failed to update utility: %v", err)
			}
			c.staticLog.Println(errorMsg)
			c.staticContracts.Return(oldContract)
			return types.ZeroCurrency, errors.AddContext(errRenew, "contract marked as bad for too many consecutive failed renew attempts")
		}

		// Seems like it doesn't have to be replaced yet. Log the
		// failure and number of renews that have failed so far.
		c.staticLog.Printf("WARN: failed to renew contract %v [%v]: '%v', current height: %v, proposed end height: %v, max duration: %v",
			oldContract.Metadata().HostPublicKey, numRenews, errRenew, blockHeight, endHeight, hostSettings.MaxDuration)
		c.staticContracts.Return(oldContract)
		return types.ZeroCurrency, errors.AddContext(errRenew, "contract renewal with host was unsuccessful")
	}
	c.staticLog.Printf("Renewed contract %v\n", id)

	// Skip the deletion of the old contract if required and delete the new
	// contract to make sure we keep using the old one even though it has been
	// finalized.
	if c.staticDeps.Disrupt("SkipContractDeleteAfterRenew") {
		c.staticContracts.Return(oldContract)
		newSC, ok := c.staticContracts.Acquire(newContract.ID)
		if ok {
			c.staticContracts.Delete(newSC)
		}
		return amount, nil
	}

	// Update the utility values for the old contract. We ignore the churn
	// here because we renewed the contract successfully. So we don't want
	// to consider this churn.
	msg := fmt.Sprintf("[CONTRACTUTILITY][%v] updating old contract utility after successful renew, locked: %v -> true, GFU: %v -> false, GFR: %v -> false, GFRef: %v -> false", md.ID, oldUtility.Locked, oldUtility.GoodForUpload, oldUtility.GoodForRenew, oldUtility.GoodForRefresh)
	oldUtility.GoodForRefresh = false
	oldUtility.GoodForRenew = false
	oldUtility.GoodForUpload = false
	oldUtility.Locked = true
	if err := c.callUpdateUtility(oldContract, oldUtility, true); err != nil {
		c.staticLog.Println("Failed to update the contract utilities", err)
		c.staticContracts.Return(oldContract)
		return amount, nil // Error is not returned because the renew succeeded.
	}
	c.staticLog.Println(msg)

	if c.staticDeps.Disrupt("InterruptContractSaveToDiskAfterDeletion") {
		c.staticContracts.Return(oldContract)
		return amount, errors.New("InterruptContractSaveToDiskAfterDeletion disrupt")
	}
	// Lock the contractor as we update it to use the new contract
	// instead of the old contract.
	c.mu.Lock()
	// Link Contracts
	c.renewedFrom[newContract.ID] = id
	c.renewedTo[id] = newContract.ID
	// Store the contract in the record of historic contracts.
	c.oldContracts[id] = oldContract.Metadata()
	// Save the contractor.
	err = c.save()
	if err != nil {
		c.staticLog.Println("Failed to save the contractor after creating a new contract.")
	}
	c.mu.Unlock()
	// Delete the old contract.
	c.staticContracts.Delete(oldContract)

	// Signal to the watchdog that it should immediately post the last
	// revision for this contract.
	go c.staticWatchdog.threadedSendMostRecentRevision(oldContract.Metadata())
	return amount, nil
}

// managedFindRecoverableContracts will spawn a thread to rescan parts of the
// blockchain for recoverable contracts if the wallet has been locked during the
// last scan.
func (c *Contractor) managedFindRecoverableContracts() {
	if c.staticDeps.Disrupt("disableAutomaticContractRecoveryScan") {
		return
	}
	c.mu.RLock()
	cc := c.recentRecoveryChange
	c.mu.RUnlock()
	if err := c.callInitRecoveryScan(cc); err != nil {
		c.staticLog.Debug(err)
		return
	}
}

// managedAcquireAndUpdateContractUtility is a helper function that acquires a
// contract, updates its ContractUtility and returns the contract again.
// 'notChurn' needs to be 'true' for contracts which changed to !gfr but
// shouldn't be considered churn in the churnLimiter.  e.g. if a user canceled a
// contract manually.
func (c *Contractor) managedAcquireAndUpdateContractUtility(id types.FileContractID, utility skymodules.ContractUtility, notChurn bool) error {
	safeContract, ok := c.staticContracts.Acquire(id)
	if !ok {
		return errors.New("failed to acquire contract for update")
	}
	defer c.staticContracts.Return(safeContract)

	return c.managedUpdateContractUtilityWithNotChurn(safeContract, utility, notChurn)
}

// managedUpdateContractUtility is a helper function that updates the contract
// with the given utility. 'notChurn' needs to be 'true' for contracts which
// changed to !gfr but shouldn't be considered churn in the churnLimiter.  e.g.
// if a user canceled a contract manually.
func (c *Contractor) managedUpdateContractUtilityWithNotChurn(safeContract *proto.SafeContract, utility skymodules.ContractUtility, notChurn bool) error {
	// Sanity check to verify that we aren't attempting to set a good utility on
	// a contract that has been renewed.
	c.mu.Lock()
	_, exists := c.renewedTo[safeContract.Metadata().ID]
	c.mu.Unlock()
	if exists && (utility.GoodForRenew || utility.GoodForUpload) {
		c.staticLog.Critical("attempting to update contract utility on a contract that has been renewed")
	}

	return c.callUpdateUtility(safeContract, utility, notChurn)
}

// managedUpdateContractUtility is a helper function that updates the contract
// with the given utility.
func (c *Contractor) managedUpdateContractUtility(safeContract *proto.SafeContract, utility skymodules.ContractUtility) error {
	// Default behaviour for updating the utility is to consider it churn.
	return c.managedUpdateContractUtilityWithNotChurn(safeContract, utility, false)
}

// callUpdateUtility updates the utility of a contract and notifies the
// churnLimiter of churn if necessary. This method should *always* be used as
// opposed to calling UpdateUtility directly on a safe contract from the
// contractor. Pass in renewed as true if the contract has been renewed and is
// not churn.
func (c *Contractor) callUpdateUtility(safeContract *proto.SafeContract, newUtility skymodules.ContractUtility, notChurn bool) error {
	contract := safeContract.Metadata()

	// If the contract is going from GFR to !GFR, notify the churn limiter.
	if !notChurn && contract.Utility.GoodForRenew && !newUtility.GoodForRenew {
		c.staticChurnLimiter.callNotifyChurnedContract(contract)
	}
	return safeContract.UpdateUtility(newUtility)
}

// threadedContractMaintenance checks the set of contracts that the contractor
// has against the allownace, renewing any contracts that need to be renewed,
// dropping contracts which are no longer worthwhile, and adding contracts if
// there are not enough.
//
// Between each network call, the thread checks whether a maintenance interrupt
// signal is being sent. If so, maintenance returns, yielding to whatever thread
// issued the interrupt.
func (c *Contractor) threadedContractMaintenance() {
	err := c.staticTG.Add()
	if err != nil {
		return
	}
	defer c.staticTG.Done()

	// No contract maintenance unless contractor is synced.
	if !c.managedSynced() {
		c.staticLog.Debugln("Skipping contract maintenance since consensus isn't synced yet")
		return
	}
	c.staticLog.Debugln("starting contract maintenance")

	// Only one instance of this thread should be running at a time. Under
	// normal conditions, fine to return early if another thread is already
	// doing maintenance. The next block will trigger another round. Under
	// testing, control is insufficient if the maintenance loop isn't guaranteed
	// to run.
	if build.Release == "testing" {
		c.maintenanceLock.Lock()
	} else if !c.maintenanceLock.TryLock() {
		c.staticLog.Debugln("maintenance lock could not be obtained")
		return
	}
	defer c.maintenanceLock.Unlock()

	// Register the WalletLockedDuringMaintenance alert if necessary.
	var registerWalletLockedDuringMaintenance bool
	defer func() {
		if registerWalletLockedDuringMaintenance {
			c.staticAlerter.RegisterAlert(modules.AlertIDWalletLockedDuringMaintenance, AlertMSGWalletLockedDuringMaintenance, modules.ErrLockedWallet.Error(), modules.SeverityWarning)
		} else {
			c.staticAlerter.UnregisterAlert(modules.AlertIDWalletLockedDuringMaintenance)
		}
	}()

	// Fetch the allowance in the beginning of the contract maintenance and
	// make sure we are using this one during all of it to avoid race
	// conditions.
	c.mu.RLock()
	allowance := c.allowance
	blockHeight := c.blockHeight
	currentPeriod := c.currentPeriod
	endHeight := c.contractEndHeight()
	c.mu.RUnlock()

	// Perform general cleanup of the contracts. This includes recovering lost
	// contracts, archiving contracts, and other cleanup work. This should all
	// happen before the rest of the maintenance.
	c.managedFindRecoverableContracts()
	c.callRecoverContracts()
	c.managedArchiveContracts()
	c.managedCheckForDuplicates()
	c.managedUpdatePubKeyToContractIDMap()
	c.managedPrunedRedundantAddressRange()
	err = c.managedMarkContractsUtility(allowance.Hosts, endHeight)
	if err != nil {
		c.staticLog.Println("Unable to mark contract utilities:", err)
		return
	}
	err = c.staticHDB.UpdateContracts(c.staticContracts.ViewAll())
	if err != nil {
		c.staticLog.Println("Unable to update hostdb contracts:", err)
		return
	}

	// If there are no hosts requested by the allowance, there is no remaining
	// work.
	wantedHosts := allowance.Hosts
	if wantedHosts <= 0 {
		c.staticLog.Debugln("Exiting contract maintenance because the number of desired hosts is <= zero.")
		return
	}

	// Get the number of gfrContracts we have as well as the data they hold.
	var gfrContracts uint64
	var gfrData uint64
	for _, c := range c.staticContracts.ViewAll() {
		if c.Utility.GoodForRenew {
			gfrContracts++
			gfrData += c.Size()
		}
	}

	// Calculate the anticipated transaction fee.
	_, maxFee := c.staticTPool.FeeEstimation()
	txnFee := maxFee.Mul64(skymodules.EstimatedFileContractTransactionSetSize)

	// Create the renewSet and refreshSet. Each is a list of contracts that need
	// to be renewed, paired with the amount of money to use in each renewal.
	//
	// The renewSet is specifically contracts which are being renewed because
	// they are about to expire. And the refreshSet is contracts that are being
	// renewed because they are out of money.
	//
	// The contractor will prioritize contracts in the renewSet over contracts
	// in the refreshSet. If the wallet does not have enough money, or if the
	// allowance does not have enough money, the contractor will prefer to save
	// data in the long term rather than renew a contract.
	var renewSet []decoratedFileContractRenewal
	var refreshSet []decoratedFileContractRenewal

	// Sanity check that by the end of the contract maintenance, we don't
	// have more than allowance.Hosts gfu contracts.
	if build.Release == "testing" {
		defer func() {
			var gfuContracts uint64
			for _, c := range c.staticContracts.ViewAll() {
				if c.Utility.GoodForUpload {
					gfuContracts++
				}
			}
			if gfuContracts > allowance.Hosts {
				build.Critical(fmt.Sprintf("threadedContractMaintenance: got %v > %v gfu hosts after maintenance (renew/refresh %v/%v)", gfuContracts, allowance.Hosts, len(renewSet), len(refreshSet)))
			}
		}()
	}

	// Iterate through the contracts again, figuring out which contracts to
	// renew and how much extra funds to renew them with.
	for _, contract := range c.staticContracts.ViewAll() {
		c.staticLog.Debugln("Examining a contract:", contract.HostPublicKey, contract.ID)
		// Skip any host that does not match our whitelist/blacklist filter
		// settings.
		host, _, err := c.staticHDB.Host(contract.HostPublicKey)
		if err != nil {
			c.staticLog.Println("WARN: error getting host", err)
			continue
		}
		if host.Filtered {
			c.staticLog.Debugln("Contract skipped because it is filtered")
			continue
		}
		// Skip hosts that can't use the current renter-host protocol.
		if build.VersionCmp(host.Version, modules.MinimumSupportedRenterHostProtocolVersion) < 0 {
			c.staticLog.Debugln("Contract skipped because host is using an outdated version", host.Version)
			continue
		}

		// Skip any contracts which do not exist or are otherwise unworthy for
		// renewal.
		utility, ok := c.managedContractUtility(contract.ID)
		if !ok || (!utility.GoodForRenew && !utility.GoodForRefresh) {
			if blockHeight-contract.StartHeight < types.BlocksPerWeek {
				c.staticLog.Debugln("Contract did not last 1 week and is not being renewed", contract.ID)
			}
			c.staticLog.Debugln("Contract skipped because it is not good for renew nor refresh (utility.GoodForRenew, utility.GoodForRefresh exists)", utility.GoodForRenew, utility.GoodForRefresh, ok)
			continue
		}
		goodForRenew := utility.GoodForRenew
		goodForRefresh := utility.GoodForRefresh

		// If the contract needs to be renewed because it is about to expire,
		// calculate a spending for the contract that is proportional to how
		// much money was spend on the contract throughout this billing cycle
		// (which is now ending).
		if goodForRenew && blockHeight+allowance.RenewWindow >= contract.EndHeight && !c.staticDeps.Disrupt("disableRenew") {
			renewAmount, err := c.managedEstimateRenewFundingRequirements(contract, gfrContracts, blockHeight, allowance)
			if err != nil {
				c.staticLog.Debugln("Contract skipped because there was an error estimating renew funding requirements", renewAmount, err)
				continue
			}

			renewSet = append(renewSet, decoratedFileContractRenewal{
				fileContractRenewal{
					id:         contract.ID,
					amount:     renewAmount,
					data:       contract.Size(),
					hostPubKey: contract.HostPublicKey,
				},
				isLateRenewal(allowance, contract, blockHeight),
			})
			c.staticLog.Debugln("Contract has been added to the renew set for being past the renew height")
			continue
		}

		// Check if the contract is empty. We define a contract as being empty
		// if less than 'minContractFundRenewalThreshold' funds are remaining
		// (3% at time of writing), or if there is less than 3 sectors worth of
		// storage+upload+download remaining.
		blockBytes := types.NewCurrency64(modules.SectorSize * uint64(allowance.Period))
		sectorStoragePrice := host.StoragePrice.Mul(blockBytes)
		sectorUploadBandwidthPrice := host.UploadBandwidthPrice.Mul64(modules.SectorSize)
		sectorDownloadBandwidthPrice := host.DownloadBandwidthPrice.Mul64(modules.SectorSize)
		sectorBandwidthPrice := sectorUploadBandwidthPrice.Add(sectorDownloadBandwidthPrice)
		sectorPrice := sectorStoragePrice.Add(sectorBandwidthPrice)
		percentRemaining, _ := big.NewRat(0, 1).SetFrac(contract.RenterFunds.Big(), contract.TotalCost.Big()).Float64()
		lowFundsRefresh := c.staticDeps.Disrupt("LowFundsRefresh")
		if goodForRefresh && (lowFundsRefresh || ((contract.RenterFunds.Cmp(sectorPrice.Mul64(3)) < 0 || percentRemaining < MinContractFundRenewalThreshold) && !c.staticDeps.Disrupt("disableRenew"))) {
			// Renew the contract with double the amount of funds that the
			// contract had previously. The reason that we double the funding
			// instead of doing anything more clever is that we don't know what
			// the usage pattern has been. The spending could have all occurred
			// in one burst recently, and the user might need a contract that
			// has substantially more money in it.
			//
			// We double so that heavily used contracts can grow in funding
			// quickly without consuming too many transaction fees, however this
			// does mean that a larger percentage of funds get locked away from
			// the user in the event that the user stops uploading immediately
			// after the renew.
			refreshAmount := contract.TotalCost.Mul64(2)
			minInitialContractFunds := allowance.Funds.Div64(allowance.Hosts).Div64(MinInitialContractFundingDivFactor)
			minimum := initialContractFunding(allowance, host, txnFee, minInitialContractFunds, types.ZeroCurrency)
			if refreshAmount.Cmp(minimum) < 0 {
				refreshAmount = minimum
				c.staticLog.Printf("Contract refresh amount %v below minimum amount %v", refreshAmount, minimum)
			}
			refreshSet = append(refreshSet, decoratedFileContractRenewal{
				fileContractRenewal{
					id:         contract.ID,
					amount:     refreshAmount,
					data:       contract.Size(),
					hostPubKey: contract.HostPublicKey,
				},
				isLateRenewal(allowance, contract, blockHeight),
			})
			c.staticLog.Debugln("Contract identified as needing to be added to refresh set", contract.RenterFunds, sectorPrice.Mul64(3), percentRemaining, MinContractFundRenewalThreshold)
		} else {
			c.staticLog.Debugln("Contract did not get added to the refresh set", contract.RenterFunds, sectorPrice.Mul64(3), percentRemaining, MinContractFundRenewalThreshold)
		}
	}
	if len(renewSet) != 0 || len(refreshSet) != 0 {
		c.staticLog.Printf("renewing %v contracts and refreshing %v contracts", len(renewSet), len(refreshSet))
	}

	// Update the failed renew map so that it only contains contracts which we
	// are currently trying to renew or refresh. The failed renew map is a map
	// that we use to track how many times consecutively we failed to renew a
	// contract with a host, so that we know if we need to abandon that host.
	c.mu.Lock()
	newFirstFailedRenew := make(map[types.FileContractID]types.BlockHeight)
	for _, r := range renewSet {
		if _, exists := c.numFailedRenews[r.id]; exists {
			newFirstFailedRenew[r.id] = c.numFailedRenews[r.id]
		}
	}
	for _, r := range refreshSet {
		if _, exists := c.numFailedRenews[r.id]; exists {
			newFirstFailedRenew[r.id] = c.numFailedRenews[r.id]
		}
	}
	c.numFailedRenews = newFirstFailedRenew
	c.mu.Unlock()

	// Depend on the PeriodSpending function to get a breakdown of spending in
	// the contractor. Then use that to determine how many funds remain
	// available in the allowance for renewals.
	spending, err := c.PeriodSpending()
	if err != nil {
		// This should only error if the contractor is shutting down
		c.staticLog.Println("WARN: error getting period spending:", err)
		return
	}
	var fundsRemaining types.Currency
	// Check for an underflow. This can happen if the user reduced their
	// allowance at some point to less than what we've already spent.
	if spending.TotalAllocated.Cmp(allowance.Funds) < 0 {
		fundsRemaining = allowance.Funds.Sub(spending.TotalAllocated)
	}
	c.staticLog.Debugln("Remaining funds in allowance:", fundsRemaining.HumanString())

	// Keep track of the amount of data that failed to renew.
	//
	// NOTE: we only count the failed renew data if the renew window leeway has
	// passed already
	var numRenewFails int
	var failedRenewData uint64

	// Register or unregister and alerts related to contract renewal or
	// formation.
	var registerLowFundsAlert bool
	var renewErr error
	defer func() {
		if registerLowFundsAlert {
			c.staticAlerter.RegisterAlert(modules.AlertIDRenterAllowanceLowFunds, AlertMSGAllowanceLowFunds, AlertCauseInsufficientAllowanceFunds, modules.SeverityWarning)
		} else {
			c.staticAlerter.UnregisterAlert(modules.AlertIDRenterAllowanceLowFunds)
		}

		alertSeverity := modules.SeverityError
		// Increase the alert severity for renewal fails to critical if the
		// number of data which might be lost is more than 20% of the total data
		// in gfr contracts.
		if float64(failedRenewData) > math.Ceil(float64(gfrData)*MaxCriticalRenewFailThreshold) {
			alertSeverity = modules.SeverityCritical
		}
		if renewErr != nil {
			c.staticLog.Debugln("SEVERE", numRenewFails, float64(allowance.Hosts)*MaxCriticalRenewFailThreshold)
			c.staticLog.Debugln("alert err: ", renewErr)
			alertMSG := fmt.Sprintf("%v out of %v renewals failed (%v bytes out of %v) - number of total gfr contracts is %v - see contractor.log for details", numRenewFails, len(renewSet)+len(refreshSet), failedRenewData, gfrData, gfrContracts)
			c.staticAlerter.RegisterAlert(modules.AlertIDRenterContractRenewalError, AlertMSGFailedContractRenewal, alertMSG, modules.AlertSeverity(alertSeverity))
		} else {
			c.staticAlerter.UnregisterAlert(modules.AlertIDRenterContractRenewalError)
		}
	}()
	// Go through the contracts we've assembled for renewal. Any contracts that
	// need to be renewed because they are expiring (renewSet) get priority over
	// contracts that need to be renewed because they have exhausted their funds
	// (refreshSet). If there is not enough money available, the more expensive
	// contracts will be skipped.
	for _, renewal := range renewSet {
		// Return here if an interrupt or kill signal has been sent.
		select {
		case <-c.staticTG.StopChan():
			c.staticLog.Println("returning because the renter was stopped")
			return
		case <-c.staticInterruptMaintenance:
			c.staticLog.Println("returning because maintenance was interrupted")
			return
		default:
		}

		unlocked, err := c.staticWallet.Unlocked()
		if !unlocked || err != nil {
			registerWalletLockedDuringMaintenance = true
			c.staticLog.Println("Contractor is attempting to renew contracts that are about to expire, however the wallet is locked")
			return
		}

		c.staticLog.Println("Attempting to perform a renewal:", renewal.id)
		// Skip this renewal if we don't have enough funds remaining.
		if renewal.amount.Cmp(fundsRemaining) > 0 || c.staticDeps.Disrupt("LowFundsRenewal") {
			c.staticLog.Println("Skipping renewal because there are not enough funds remaining in the allowance", renewal.id, renewal.amount, fundsRemaining)
			registerLowFundsAlert = true
			continue
		}

		// Renew one contract. The error is ignored because the renew function
		// already will have logged the error, and in the event of an error,
		// 'fundsSpent' will return '0'.
		fundsSpent, err := c.managedRenewContract(renewal.fileContractRenewal, currentPeriod, allowance, blockHeight, endHeight)
		if errors.Contains(err, errContractNotGFR) {
			// Do not add a renewal error.
			c.staticLog.Debugln("Contract skipped because it is not good for renew", renewal.id)
		} else if err != nil {
			c.staticLog.Println("Error renewing a contract", renewal.id, err)
			renewErr = errors.Compose(renewErr, err)
			numRenewFails++
			if renewal.lateRenewal {
				failedRenewData += renewal.data
			}
		} else {
			c.staticLog.Println("Renewal completed without error")
		}
		fundsRemaining = fundsRemaining.Sub(fundsSpent)
	}
	for _, renewal := range refreshSet {
		// Return here if an interrupt or kill signal has been sent.
		select {
		case <-c.staticTG.StopChan():
			c.staticLog.Println("returning because the renter was stopped")
			return
		case <-c.staticInterruptMaintenance:
			c.staticLog.Println("returning because maintenance was interrupted")
			return
		default:
		}

		unlocked, err := c.staticWallet.Unlocked()
		if !unlocked || err != nil {
			registerWalletLockedDuringMaintenance = true
			c.staticLog.Println("contractor is attempting to refresh contracts that have run out of funds, however the wallet is locked")
			return
		}

		// Skip this renewal if we don't have enough funds remaining.
		c.staticLog.Debugln("Attempting to perform a contract refresh:", renewal.id)
		if renewal.amount.Cmp(fundsRemaining) > 0 || c.staticDeps.Disrupt("LowFundsRefresh") {
			c.staticLog.Println("skipping refresh because there are not enough funds remaining in the allowance", renewal.amount.HumanString(), fundsRemaining.HumanString())
			registerLowFundsAlert = true
			continue
		}

		// Renew one contract. The error is ignored because the renew function
		// already will have logged the error, and in the event of an error,
		// 'fundsSpent' will return '0'.
		fundsSpent, err := c.managedRenewContract(renewal.fileContractRenewal, currentPeriod, allowance, blockHeight, endHeight)
		if err != nil {
			c.staticLog.Println("Error refreshing a contract", renewal.id, err)
			renewErr = errors.Compose(renewErr, err)
			numRenewFails++
			if renewal.lateRenewal {
				failedRenewData += renewal.data
			}
		} else {
			c.staticLog.Println("Refresh completed without error")
		}
		fundsRemaining = fundsRemaining.Sub(fundsSpent)
	}

	// Get Hosts for contract formation.
	var hosts []skymodules.HostDBEntry
	var neededContracts int
	if allowance.PortalMode() {
		neededContracts, hosts = c.managedHostsForPortalFormation(allowance)
	} else {
		neededContracts, hosts = c.managedHostsForRegularFormation(allowance)
	}

	// Form contracts.
	lf, wl := c.managedFormContracts(fundsRemaining, hosts, neededContracts, allowance, endHeight)

	// Register alerts if necessary.
	registerLowFundsAlert = registerLowFundsAlert || lf
	registerWalletLockedDuringMaintenance = registerWalletLockedDuringMaintenance || wl
}

// managedHostsForPortalFormation returns the hosts to form contracts with for a
// portal.
func (c *Contractor) managedHostsForPortalFormation(allowance skymodules.Allowance) (int, []skymodules.HostDBEntry) {
	hosts, err := c.staticHDB.ActiveHosts()
	if err != nil {
		c.staticLog.Printf("Error fetching list of active hosts when attempting to form view contracts: %v", err)
		return 0, nil
	}
	return hostsForPortalFormation(allowance, c.staticContracts.ViewAll(), c.RecoverableContracts(), hosts, c.staticLog, c.staticHDB.ScoreBreakdown)
}

// managedHostsForRegularFormation returns the number of hosts needed for
// non-portal contract formation plus a set of hosts to use.
func (c *Contractor) managedHostsForRegularFormation(allowance skymodules.Allowance) (int, []skymodules.HostDBEntry) {
	return hostsForRegularFormation(allowance, c.staticContracts.ViewAll(), c.RecoverableContracts(), c.staticHDB.RandomHosts, c.staticLog)
}

// managedFormContracts tries to form up to neededContracts with the hosts given
// by hosts and the provided budget, allowance and endHeight.
func (c *Contractor) managedFormContracts(budget types.Currency, hosts []skymodules.HostDBEntry, neededContracts int, allowance skymodules.Allowance, endHeight types.BlockHeight) (lowFunds, walletLocked bool) {
	// Calculate the anticipated transaction fee.
	_, maxFee := c.staticTPool.FeeEstimation()
	txnFee := maxFee.Mul64(skymodules.EstimatedFileContractTransactionSetSize)

	// Determine the max and min initial contract funding based on the allowance
	// settings
	maxInitialContractFunds := allowance.Funds.Div64(allowance.Hosts).Mul64(MaxInitialContractFundingMulFactor).Div64(MaxInitialContractFundingDivFactor)
	minInitialContractFunds := allowance.Funds.Div64(allowance.Hosts).Div64(MinInitialContractFundingDivFactor)

	// Get a list of all current contracts.
	currentContracts := make(map[string]skymodules.RenterContract)
	gfuContracts := 0
	for _, contract := range c.staticContracts.ViewAll() {
		currentContracts[contract.HostPublicKey.String()] = contract
		if contract.Utility.GoodForUpload {
			gfuContracts++
		}
	}

	// Compute how many gfu contracts we still need.
	remainingGFU := 0
	if gfuContracts < int(allowance.Hosts) {
		remainingGFU = int(allowance.Hosts) - gfuContracts
	}

	// Form contracts with the hosts one at a time, until we have enough
	// contracts.
	for _, host := range hosts {
		// Return here if an interrupt or kill signal has been sent.
		select {
		case <-c.staticTG.StopChan():
			c.staticLog.Println("returning because the renter was stopped")
			return
		case <-c.staticInterruptMaintenance:
			c.staticLog.Println("returning because maintenance was interrupted")
			return
		default:
		}

		// If no more contracts are needed, break.
		if neededContracts <= 0 {
			break
		}

		// Calculate the contract funding with host
		contractFunds := initialContractFunding(allowance, host, txnFee, minInitialContractFunds, maxInitialContractFunds)

		// Confirm the wallet is still unlocked
		unlocked, err := c.staticWallet.Unlocked()
		if !unlocked || err != nil {
			walletLocked = true
			c.staticLog.Println("contractor is attempting to establish new contracts with hosts, however the wallet is locked")
			return
		}

		// Determine if we have enough money to form a new contract.
		if budget.Cmp(contractFunds) < 0 || c.staticDeps.Disrupt("LowFundsFormation") {
			lowFunds = true
			c.staticLog.Println("WARN: need to form new contracts, but unable to because of a low allowance")
			break
		}

		// If we are using a custom resolver we need to replace the domain name
		// with 127.0.0.1 to be able to form contracts.
		if c.staticDeps.Disrupt("customResolver") {
			port := host.NetAddress.Port()
			host.NetAddress = modules.NetAddress(fmt.Sprintf("127.0.0.1:%s", port))
		}

		// Attempt forming a contract with this host.
		start := time.Now()
		fundsSpent, newContract, err := c.managedNewContract(host, allowance, contractFunds, endHeight)
		if err != nil {
			c.staticLog.Printf("Attempted to form a contract with %v, time spent %v, but negotiation failed: %v\n", host.NetAddress, time.Since(start).Round(time.Millisecond), err)
			continue
		}
		budget = budget.Sub(fundsSpent)
		neededContracts--

		sb, err := c.staticHDB.ScoreBreakdown(host)
		if err == nil {
			c.staticLog.Println("A new contract has been formed with a host:", newContract.ID)
			c.staticLog.Println("Score:    ", sb.Score)
			c.staticLog.Println("Age Adjustment:        ", sb.AgeAdjustment)
			c.staticLog.Println("Base Price Adjustment: ", sb.BasePriceAdjustment)
			c.staticLog.Println("Burn Adjustment:       ", sb.BurnAdjustment)
			c.staticLog.Println("Collateral Adjustment: ", sb.CollateralAdjustment)
			c.staticLog.Println("Duration Adjustment:   ", sb.DurationAdjustment)
			c.staticLog.Println("Interaction Adjustment:", sb.InteractionAdjustment)
			c.staticLog.Println("Price Adjustment:      ", sb.PriceAdjustment)
			c.staticLog.Println("Storage Adjustment:    ", sb.StorageRemainingAdjustment)
			c.staticLog.Println("Uptime Adjustment:     ", sb.UptimeAdjustment)
			c.staticLog.Println("Version Adjustment:    ", sb.VersionAdjustment)
		}

		// Add this contract to the contractor and save.
		err = c.managedAcquireAndUpdateContractUtility(newContract.ID, skymodules.ContractUtility{
			GoodForUpload:  remainingGFU > 0,
			GoodForRefresh: true,
			GoodForRenew:   true,
		}, false)
		if err != nil {
			c.staticLog.Println("Failed to update the contract utilities", err)
			return
		}
		remainingGFU--

		c.mu.Lock()
		err = c.save()
		c.mu.Unlock()
		if err != nil {
			c.staticLog.Println("Unable to save the contractor:", err)
		}
	}
	return
}

// isLateRenewal returns true if a the contract is already a certain amount of
// time into the renewal window and it hasn't been renewed yet due to a series
// of failed renewals
func isLateRenewal(allowance skymodules.Allowance, contract skymodules.RenterContract, blockHeight types.BlockHeight) bool {
	return blockHeight+(allowance.RenewWindow-allowance.RenewWindow/renewWindowLeewayDivisor) > contract.EndHeight
}