The way escrow is now, I could probably cause Storj to lose money by repeatedly setting up new nodes, limiting upload speed (so, I would get as little GET success as possible, while still having connection speeds above the minimums) and then deleting them when they got 1TB or so of data. My earnings and the held amount should be lower than the $10 Storj would pay the other nodes for repair.
The backup should have a timestamp, so the satellite would know what data the restored node definitely has lost.
About the rest of the data - how about this: the node is placed in a special state where the data is split into “before backup” and “after restore”. The “before backup” part is considered damaged by the satellite, except:
- the satellite still issues audits for it - any pieces that pass the audit are considered OK.
- the satellite still allows downloads from that node, including the repair if it is triggered. A successful download by the customers marks the piece as OK, a successful repair download marks the piece as OK on this node as well.
- Repair downloads for those pieces are not paid
For the “after restore” data, the node is treated as new - it has to pass the vetting phase etc and the held amount percentage gets restored.
Alternative 1 - the node is allowed partial GE, with the data that it still has with the same requirements as for a normal GE, with the exception that no data later than the backup timestamp is requested. In this case I get part of the escrow money back.
Alternative 2 - the node is allowed to to a “special” partial GE - giving the data it still has to my new node. In this case, I do not get the escrow money.