Blockchain Economics

Topic:

Execution

Security

Immutability

Problem: double-spending

How can we trust that

  1. sale happened and
  2. $$ only spent once?

Cryptography
\(\Rightarrow\) signature cannot be hacked

Proof of Work Protocol

A Byzantine Fault Tolerant Algorithm

This Hash starts with a pre-specified number of zeros!

B3

B1

B2

B4

B5

Contains transaction from Alice to Bob

Question: Can Alice rewrite history?

Immutability

B3

B1

B2

B4

B5

B6

Where to add a new block \(B_7\)?

  • Add to \(B_3\)?
    • future block \(B_8\) more likely to be added to \(B_6\)
    • \(\to\) lose "coinbase" reward
    • \(\to\) add to \(B_6\)

Detour: Longest chain rule

Equilibrium for "the longest chain"? - Yes!

  • "Blockchain Mining Games" by Kiayias,Koutsoupias, Kyropoulouz, and Tselekounis, Proceedings of the 2016 ACM Conference on Economics and Computation, 2016
  • "The blockchain folk theorem" by Biais, Bisière, Bouvard, and Casamatta, RFS 2018

Note: 

  • accidental "forks" can happen, in particular in fast chains (because of system latencies)
  • \(\to\) need several block confirmations to accept as transaction as settled

B3

B1

B2

B4

B5

  • be faster
  • be able to block confirmations

B8

B7

B9

B10

B6

Contains transaction from Bob to Alice

Bob wants to undo the transaction by rewriting history with B6

Selfish Mining Attack

How?

\(\to\)
create predictability of mining

\(\to\)
have 51% of mining
(= confirmation) power

Back of the envelope calculation (based on 2018)

  • hashrate: 25,000,000 TH/s
  • best GPUs have 2.5GH/s per card=0.0025 TH/s
  • => need 25,000,000 x 400 x 0.5 = 5,000,000,000 GPUs
  • 1 GPU costs around $200
  • =>Cost = $1,000,000,000,000
  • Note from 2020: this cost has not gone down

NB: there is a slightly more subtle view of  selfish mining in which the miner creates a block but holds it back to keep mining exclusively on a part of the chain. Sapirshtein,  Sompolinsky, and Zohar (2015) show that 23.21% of mining power is sufficient for such an attack

Proof of Work uses unsustainable amounts of energy

  • Nakamoto consensus consumes energy on par with (Jan 2019)
    • Austria
    • 2x Denmarks
    • 3x Irelands
    • 4x nuclear power plants
  • No connection between energy burned and economic value created

Most promising fundamentalprojects

Ethereum: Casper & related proof of stake implementations

Bitcoin: Lighting Network

Cardano: delegated proof of stake

Avalanche: iterative algorithmic validation & staking

Algorand: developed by Turing Award winner with random validator assignment & staking

Reality Check: Capacity

transactions per second T per 12 hours (business day)
Bitcoin 7 302,400
Ethereum 30 1,296,000
Algorand 2000 86,400,000
Conflux 4000 172,800,000
Athereum 5000 216,000,000
Payments Canada ACSS 648 28,000,000
US retail 7639 330,000,000
Canada number of equity trades 46 2,000,000
Orders on Canadian equity markets 3588 155,000,000

external punishment
\(\to\) misbehavior results in commercial/legal/social punishment

We must trust that records are correct. How achieved?

Economic Design of Recording Technology

allow rents:

\(\to\) running the ledger is profitable
\(\to\) misbehavior causes lack of trust
\(\to\)
lack of trust makes people not use the ledger
\(\to\) rents gone

physical resource cost
\(\to\) running the ledger is costly
\(\to\) if I misbehave in the future then lack of trust
\(\to\) my previous investment is destroyed

resource efficient

What features would we like a blockchain to have?

Economic Design of Recording Technology

cheap (or: no rent extraction/competitive operation)

self-powered (no external force needed)

Triangular problem for current blockchain technology

resource efficient

no rent extraction

self-powered

proof-of-work blockchains

proof-of-stake blockchains

centralized

You can't have your cake and eat it ...

based on: Blockchain Economics by Abadi & Brunnermeier 2019

related model: Budish (2018)

Selfish Mining Attack

  • cost of mining a block: \(c\)
  • number of miners: \(N\)
  • block reward: \(B\)

basic economics:

expected gain of mining \(\ge\) cost of mining

\(\Rightarrow\) probability of winning \(\times\) block reward \(\ge\) cost

\frac{1}{N}\times B\ge c

\(\to\) holds for all miners

\(\to\) in equilibrium: aggregate cost of mining \(=\) aggregate benefit

\Leftrightarrow~c\cdot N=B

related model: Budish (2018)

Selfish Mining Attack

  • value of attack: \(V\)
  • to gain 50% control, pay: \(c\cdot N\)
  • need to gain \(A>1\): (\(A/(A+1)>.5\)
  • block confirmation convention: \(t\)

\(\to\) cost of attack: \(t\cdot A\cdot c\cdot N\)

total benefit of attack

  • attack value \(V\)
  • block rewards \(t\cdot B\)

\(\to\) for unattractive attack: cost \(>\) benefit

t\cdot A\cdot \underbrace{c\cdot N}_{=B} >V+t\cdot B
t\cdot B(A-1)> V
\Rightarrow \exists \mathbb{V} \text{~s.t.~} \forall \tilde{V}>\mathbb{V}~~\tilde{V}>t\cdot B(A-1)

means amounts above \(\mathbb{V}\) cannot be secured

Double spend attack prevention

  • Validation rewards are taken as given, but they are crucial in
    • determining incentives to participate,
    • to support the chain, and
    • to expense electricity and computing power

Basic idea of competitive equilibrium

aggregate mining cost = aggregate reward

Double spend - selfish mining attack

  • win \(N\) block rewards until confirmation block
  • ability to double-spend
     

condition that prevents it
(Chiu & Koeppl RFS 2018)


 

\text{mining reward} \times (N+1)N > \text{double spend amount}

Selfish Mining Attack

HOWever! with attacking don't you
shoot yourself in the foot?

  • First attack in May 2018
  • double spent of $18 million worth of Bitcoin Gold
  • \(\to\) Loss of confidence in Bitcoin Gold and decline in exchange rate
  • Only 1/6 of pre-attack value
  • transactions \(\searrow\) one-third

G

  • models:  per period flow cost of mining
  • Prat & Walter (2019): 2/3 of mining cost are fixed costs.

    G

HOWever! with attacking don't you
shoot yourself in the foot?

Garrat & van Oordt (WP 2020)

HOWever! with attacking don't you
shoot yourself in the foot?

Garrat & van Oordt (WP 2020)

drop in exchange rate S

=loss

a better blockchain: Conflux

  • Current networks (Bitcoin, Ethereum, etc.) have limited throughput
  • Unclear long-term economic sustainability
    • Vulnerability to double spending attack once block rewards phase out
  • Inefficient use of storage space
    • Inactive smart contracts occupies state storage
  • Vulnerable to fairness attack
    • An attacker with more than 23.21% computation power can potentially obtain rewards disproportional to its computation power by selfish mining

Conflux: Consensus with TreeGraph

•Blocks are organized in a directed acyclic graph (DAG)

•No concurrent blocks are discarded, leading to higher throughput

a better blockchain: Conflux

Greedy Heaviest Adaptive SubTree (GHAST) algorithm

  • Blocks are assigned a weight according to the topologies
  • Exists a deterministically heaviest chain called pivot chain
  • An epoch contains one pivot chain block and its reachable blocks

Transaction Processing

  • Blocks are processed sequentially ordered by epoch, topological order and id
  • Only the first occurrence of the transaction is processed
  • 3200 tps for simple payment transactions
  • Note: runs Solidity (\to\) 100\% compatible with all Ethereum smart contracts

Disclaimer: token design strongly influenced by yours truly

Goes life on October 29, 8 a.m.

going back to Budish (2018)

Selfish Mining Attack in CONFLUX

Serial Chain

Conflux Chain

In Conflux, withholding a block leads to greater anti-cone size

Intuition: Anticone = blocks created without properly referencing others blocks in its vicinity

Selfish Mining/Double-Spent Attack in CONFLUX

Scalability projects for Ethereum

  • Ethereum blocks have no size limit
     
  • but: gas limit imposes computation  limit and thus transaction limit
     
  • note: in contrast to Bitcoin, Ethererum always announced that it would eliminate proof-of-work eventually

     

Root Problem

  • Side Channels:
    • Keep two-party interactions off the main chain and use chain only for terminal settlement
  • Sharding
    • instead of storing all info on all nodes, break up the blockchain into shards
    • \(\to\) hard problem!

Solutions

https://blog.stephantual.com/what-are-state-channels-32a81f7accab

Key problem of Proof-of-Stake:

How to incentivize support of longest chain?

B3

B1

B2

B4

B5

B6

Where to add a new block B7?

  • PoW: only longest chain
  • PoS: could add both at B3 and  B6 (nothing-at-stake)
    • solution: punish deviations!

My personal problem: I have not yet seen a convincing theoretical model of PoS

economic result: Fahad Saleh (2021) Review of Financial Studies, "Blockchain Without Waste: Proof-of-Stake" shows that PoS is an equilibrium

current state: 

  • promised since 2014
  • still in discussion
  • slashing controversial

From Snowflake to Avalanche - Emin Gün Sirer

a better consensus mechanism: avalanche

now in operation in Athereum (fork of Ethereum)

Cryptocurrencies

coinbase reward to miners

creation and redemption process as part of blockchain operation

examples: Bitcoin, Bitcoin Cash, Ether, Lumens, Cardano

native to a blockchain and essential for operation

  • equity=ownership
  • call option on company
  • residual claim to all future cash flows (after debt an tax)
  • => present value of future cash flows 

\[\text{Fundamental Value}= \sum_{t=1}^\infty \frac{E(\text{cash flow}_t)}{(1+r)^t}.\]

  • tricky stuff:
    • forming expectations => estimating cash flows
    • finding the right discount rate \(r\).

What is a stock and what is its value?

Money vs Financing

  • means of payment & mining reward
  • value? => similar to fiat
    • convenience
    • cost of storage
    • risk of loss
    • volatility relative to usage need
    • inflation and monetary policy vis-a-vis alternatives

What is a coin?

Time for some economics: systematic approach

  • example of a model:
  • Biais, Bisiere, Bouvard, Cadamatta, Menkveld (May 2019);
    Schilling and Uhlig (2019) have a similar model
  • Overlapping generations model of young and old investors who must push money across time to finance consumption

Time for some economics: systematic approach

  • Three assets:
    • cryptocurrency \(X_t\), fiat currency, risk free asset
  • Miners mine at \(t\) and receive \(X_{t+1}-X_t\).
  • Young have
    • \(e_t\) of consumption good
    • can buy \(q^c\) of crypto at price \(p^c_t \) and \(q^f\) of fiat at price \(p^f_t,\) rest \(s\) is saved.
    • crypto involved mining fees \(F\)
    • crypto has transaction benefits in the future \(\theta q^c p^c_{t+1}\)
\begin{array}{rcl} c^y&=&e_t-s-q^cp^c_t-q^fp^f_t-F(q^c)\\ c^o&=&s(1+r)+q^cp^c_{t+1}+q^fp^f_{t+1}\end{array}

consumption budget constraints

\max_{q^c,q^f,s}u(c_t)+\beta Eu(u_{t+1})

consumption decision

p^c=\beta E\left[\frac{u'(c^o)}{u'(c^y)}\times\frac{1+\theta}{1+F'(X_t)}\times p^c_{t+1}\right]

\(\to\) price for crypto

Time for some economics: systematic approach

Time for some economics: systematic approach

Time for some economics: systematic approach

  • Need: relation of discount and interest rate
  • \(\to\) from FOC w.r.t. savings
\beta=\frac{1}{1+r}\frac{u'(c^o)}{Eu'(c^y)}
\Rightarrow~~p^c=\frac{1}{1+r}E\left(\frac{u'(c^o)}{Eu'(c^y)}p^c_{t+1}(1+T)\right)

Convenience yield \(T\)

Intuition: transaction benefit \(\theta\) net of transactions costs \(F'\)

1+T=\frac{1+\theta}{1+F'}
  • There could be multiple equilibria.

  • Price \(p=0\) at all dates is an equilibrium.

Time for some economics: systematic approach

Time for some economics: systematic approach

Time for some economics: systematic approach

\Rightarrow~~p^c=\frac{1}{1+r}E\left(\frac{u'(c^o)}{Eu'(c^y)}p^c_{t+1}(1+T)\right)

pricing kernel

convenience yield \(T\cdot p_{t+1}\)

{  

{  

(captures correlation between marginal utility of consumption and the crypto price)

crypto price at time \(t+1\):\(p_{t+1}\)

\(+\)

  • convenience yield \(=\) scalar \(\times\) crypto price

  • Ceteris paribus \(p^c \nearrow \Rightarrow\) convenience yield \(\nearrow\).

  • Not so for stocks in perfect market

    • stock price at \(t\) reflects the \(E[p_{t+1}+d_{t+1}]\)

    • dividends at \(t+1\) do not depend on the \(t+1\) stock price.

    • \(\Rightarrow\) for stocks, dividends cause fundamental value and therefore prices

    • For the cryptocurrency, prices cause convenience yields

      and therefore fundamental value.

Time for some economics: systematic approach

Model II: Emiliano Pagnotta
"Bitcoin as decentralized money"

  • equilibrium model of demand and supply for decentralized money
  • why hold it?
    • transactional services
    • and speculative value.
    • might increase in value if network increases
  • pros and cons of decentralized money
    • censorship resistent
    • hackable (affects both market value and usefulness)
  • network security provided by miners
    • enable transactions
    • get paid in native currency

Miner's problem

  • Network security function of hash rate \(\tau\)
  • long-term miners
    • choose hash rate (at a cost) \(H\)
    • get block reward if mining successful
    • expected project proportional to hashing power
    • don't keep block reward but cash in right away

General Equilibrium

equilibrium price is a function of

  • network effects
  • risk aversion
  • technology
  • money supply
  • money regime

Model II: Emiliano Pagnotta
"Bitcoin as decentralized money"

Key Concept: Unity

unity: token is means of exchange and incentive for miners

Network Multiple verifiers Free entry for verifiers Asset Unity
DTCC n n public equity n
Bitcoin y y bitcoin y
Ethereum y y ether y
Ethereum y y ERC-20 tokens n
Ripple y n XRP n

Model basics

  • long-term miners
  • overlapping generations model of users
    • enjoy transaction benefits when young and network alive
  • attacks may happen
    • each period, network may get attacked and disappear

objective function user: \(\max \left(\text{transactional service}+\text{resale value}\right) \times \text{network security} -\text{cost}\)

Benchmark: non-unity token

unstable equilibrium

unstable equilibria are also possible with unity tokens

Competitive mining for unity tokens

stable
equilibrium

Note: \(p=0\) is always an equilibrium!

unstable

=smallest network with positive price equilibrium; any smaller network has price=0

Comparative Statics Results

number of miners \(\nearrow\):

  • total hash rate \(\nearrow\) 

  • price \(\nearrow\) 

number of miners \(\to\infty\):

  • there is a finite limit price

  • there is a well-defined minting price

Optimal Monetary Policy

There is a threshold \(\bar{\rho}\) such that:

  • \(\rho<\bar{\rho}\): \(\frac{\partial\text{price}}{\partial\rho}>0\) 

  • \(\rho>\bar{\rho}\): \(\frac{\partial\text{price}}{\partial\rho}<0\) 

measured in growth rate of coinbase reward \(\rho\)

@financeUTM

andreas.park@rotman.utoronto.ca

slides.com/ap248

sites.google.com/site/parkandreas/

youtube.com/user/andreaspark2812/

Blockchain economics (MBA)

By Andreas Park

Blockchain economics (MBA)

This is the slide deck discusses the role of economics in blockchain tech.

  • 368