>my guess before reading the paper is that the contract gives a hash and a file size and the host is responsible for giving a file of that size and that hash if

>my guess before reading the paper is that the contract gives a hash and a file size and the host is responsible for giving a file of that size and that hash if there is a dispute Close! Sia uses Merkle trees to construct the storage proof. The storage contract specifies the Merkle tree root hash. The host must then provide one of the "leaves" of the tree (64 bytes of actual data), along with the other subtree roots in the tree necessary to construct the root hash. The consensus algorithm can then verify that by hashing the leaf and combining it with the other subtree roots, the top-level root can be obtained. This is a lot more compact and efficient than sending the entire file contents. The only trick is selecting which leaf to demand from the host -- if it could be predicted in advance, the host could cheat and store less data. But it can't be purely random either, since all nodes on the network need to pick the same leaf to arrive at consensus. So the leaf is chosen using existing entropy in the blockchain (e.g. the hash of the last block), so that it's both deterministic and difficult for an attacker to control.