Prove it, then focus it: how Neti built FCSS, a cold storage market on a decentralized storage network

FIDL asked Neti to build a storage market on Filecoin's decentralized storage network, where smart contracts, not people, match datasets to providers; once it worked on mainnet, the two teams rebuilt it as FCSS, a cold storage service in which every dataset’s identity, its service levels and the cost of missing them are recorded on-chain.

The client and the brief

FIDL (Filecoin Incentive Design Labs) designs incentive systems for Filecoin, a decentralized storage network. It wanted to answer a practical question: can a set of smart contracts run a storage market on its own, matching clients to storage providers (SPs), handling payment and tracking service levels, with no negotiation in between?

Filecoin already provides the cryptographic base. When an SP seals data it proves it has created a unique copy (Proof of Replication, or PoRep), and from then on it keeps proving that it still holds that copy. What was missing was the market layer on top: finding a provider, agreeing terms, paying for good service and not for bad, and recovering when a provider leaves.

FIDL brought the product vision and the incentive design, and built the user-facing side itself. Neti supplied the protocol engineering team that built the smart contracts and the tooling around them, proving that a peer-to-pool storage market is possible and efficient. It was not Neti's first Filecoin project: the team had already automated Filecoin Plus governance and stabilized Fil+ infrastructure through FEVM development.

“We always believed that Filecoin should function as a peer to pool system. We asked Neti to prove that a storage market could run without anyone negotiating deals. After 5 years of Filecoin on mainnet, the team delivered this product in less than 4 months. And by the time we launched v1, we already scoped and designed v2 that went live in August. The quality of collaboration with Neti developers is unprecedented.” Marta Geater Piekarska, CEO of FIDL. 

Phase one: proving a peer-to-pool market

The first version was a peer-to-pool market. Clients don’t negotiate with individual providers. They describe what they need, and the contracts pick a provider from a pool of registered offers.

Neti’s team built the pieces needed to run that loop end to end:

• An SP registry where providers register and publish offers.
• A market contract that takes a client’s deal proposal and selects the SP. Clients never choose providers themselves; only an admin can pin a deal to a specific offer.
• Payment rails on Filecoin Pay, with a validator contract that decides what each settlement pays out.
• A client contract for DataCap, Filecoin’s allocation for verified data, so the full lifecycle stays on-chain.
• A command-line tool for clients, SPs and admins to drive all of it.

The v1 market went live on mainnet in April 2026, and many public scientific and open datasets were onboarded to participating SPs: ENCODE, NOAA data, Genome Browser data, the uncopyrighted subset of The Pile and others, all catalogued publicly at toads.directory.

Across the market’s two versions, 24 deals are active on mainnet today (status dashboard). Each one went from proposal to provider match, payment rail and sealed storage without any off-chain negotiation. The model worked.

What v1 taught the team

Running real deals surfaced three needs, and each one shaped the rebuild.

1. Finer-grained SLA tracking. In v1, service-level attestations were recorded per provider: one view of an SP across everything it stored. In v2 they are recorded per deal, and settlement is checked deal by deal for each payment period. The contract confirms that the provider’s sealed data still covers the deal, and the deal’s measured service levels decide whether that period is paid.

2. Flexibility in currency and cost, based on SLA requirements. In v1, prices were fixed per sector in a single stablecoin. In v2, each SP can decide on the currency they accept and the price they expect based on the SLA class. The client states the service levels it needs and the most it will pay, and the market matches it to an offer within a price band. Stronger guarantees can now carry a different price from weaker ones.

3. More client-driven features. v2 gives clients more control over their deals:

• they fingerprint their dataset on-chain;
• they choose whether a deal is public or private;
• they validate their manifest before proposing;
• for private data, they sign retrieval vouchers that authorise other wallets to retrieve it;
• they start a repair themselves when a provider leaves.

Matching still belongs to the market, so clients get more control without picking providers by hand.

The decision: focus on cold storage

With the model proven, FIDL chose to narrow the product. PoRep sealing takes heavy computation up front and suits data that is large, written once and kept for years. For decentralized data storage, that makes long-lived archives the natural fit. As Marta Geater Piekarska (CEO of FIDL) puts it, cold storage is “the best product-market fit for PoRep Filecoin.”

So v2 became a single-purpose product: FCSS, the Filecoin Cold Storage Service, aimed at datasets of 1 TiB and up, with the promise “Verified continuously. Not just promised.” (FCSS client site).

v2: designed to be trusted

Neti’s team rebuilt the market from the contracts up. v2 has been on mainnet since August 2026. Its first deals hold neuroscience datasets (mouse autism Neuropixels recordings) of about 21 to 27 TiB each, roughly 670 to 870 sealed 32 GiB sectors per deal (status dashboard).

The design rests on five ideas:

• Dataset identity on-chain. Every deal records a hash of the dataset’s manifest, the list of pieces that make up the dataset. Anyone can check that a provider holds the dataset the client proposed, and the tooling can find every deal that holds the same data.
• Service levels with consequences. Each deal sets thresholds for retrievability, bandwidth and IPNI indexing (content discoverability), among others. FIDL’s tooling measures them. If a provider misses its service level in a settlement period, its payment for that period is withheld. FIDL plans to publish its measurement method.
• Public or private. Public datasets are open to anyone to retrieve. Private ones can be retrieved only by the owner and the wallets the owner authorises.
• Two independent organisations per dataset. FCSS stores every dataset with at least two SPs that belong to different organisations, so one provider leaving never takes the only copy with it.
• Repair built in. When an SP exits, the client proposes a repair deal and the market matches a new provider. The tooling finds a provider that still holds a healthy copy, checks that it actually serves the data and reads its retrieval price. The client then prepays that retrieval on-chain through FIDL’s open-source large-paid-retrievals, so the new SP never fronts the cost and nobody shares keys.

Payments run in USDFC over Filecoin Pay rails.

Clients and providers reach FCSS through FIDL’s client portal and provider portal, and a public status dashboard reports on every dataset.

How Neti’s team built it

Contracts that can evolve. The v2 contracts are upgradeable and role-based. FIDL can refine the matching and settlement rules without asking clients to migrate their deals.

Contracts that are easy to read. A view-helper contract returns a complete snapshot of a deal in one call, with paginated listings by state and organisation. That gives the CLI, and the dashboards FIDL builds on top, a single source of truth on-chain.

One open-source tool for every role. Clients, SPs and admins all use the same open-source Python CLI. It keeps no local state and reads everything from the chain. Every transaction needs explicit confirmation, and declining turns it into a dry run. Signing can stay inside a Lotus wallet, so private keys never reach the tool.

An SP pipeline that runs unattended. SPs can script the whole intake: find newly matched deals, download the data (paying for retrieval where needed), then seal and claim it with Curio or Boost.

Security reviewed. The whole system was security reviewed by Composable Security (audit report). No severe issues were found, and where minor fixes were needed, the team implemented them (response).

“The biggest change in v2 was moving service levels and settlement from the provider to the individual deal. Each deal now carries its own requirements, its own payment token and a hash of its dataset, and payment for each period depends on whether that deal met its terms. It made the contracts larger, but every rule a client or provider cares about can now be checked on-chain.” Jakub Koziol, senior engineer at Neti.

The outcome

FIDL now owns a working cold storage product on mainnet, built in about four months from first market to rebuilt service. It has:

• a matching market that has proven itself on real deals;
• per-deal service levels tied to payment;
• an on-chain fingerprint for every dataset;
• a repair path that doesn’t depend on providers trusting each other;
• open-source tooling that any client or SP can inspect.

FCSS is the cold storage of Filecoin Onchain Cloud. It sits alongside Filecoin Warm Storage Service, which keeps frequently used data online with lighter proofs (Filecoin Onchain Cloud). Hot data goes to warm storage; large, long-lived archives are fit for FCSS. Together they give Filecoin Onchain Cloud a decentralized cloud storage offer for both hot and long-lived data.

As one of the storage providers participating in FCSS put it: “We don’t negotiate with clients. The market assigns us a deal, the terms are on-chain, and the tooling takes us from download to claiming the allocation. We know what we have to deliver and we know payment depends on it. That’s a simpler arrangement than most storage deals we’ve done.”

What’s next

FIDL’s roadmap for FCSS, with Neti’s team, includes:

• erasure-coded parity, to survive the loss of any one provider at about 1.5x storage overhead;
• faster unsealing, aimed at restores in minutes rather than hours;
• SP ingest and repair at about 50 TiB per day each;
• paid retrieval by default;
• a full archival SLA set covering restore windows, audits and repair-time commitments.

Building something similar?

Neti builds infrastructure where correctness matters. Our smart contract development services cover smart-contract markets, payment and settlement flows, decentralized storage and data tooling, and the operator software around them. If you're turning a protocol idea into a product people can rely on, talk to us.