Andreas Park PRO
Professor of Finance at UofT
Economics ∩ Blockchain=∅
Andreas Park
Topics I will now cover
0. Intro to econ thinking
- Work on consensus protocols (PoW and PoS) as economic equilibria
- Selfish mining attacks
- Incentivizing PoS Committees
- Transactions fees
- Consensus and scaling
Blockchain Research
Two key components of blockchain
technology
economics
Intro to on economic thinking & blockchain
Economics 101 (from George Mankiw's 10 Principles of Economics)
- Rational People Think at the Margin
- People Respond to Incentives
- Markets Are Usually a Good Way to Organize Economic Activity
- Governments Can Sometimes Improve Economic Outcomes
- Also: economists are by default interested in "welfare" and "social surplus" which is a global view and not "taking sides"
My naive understanding of computer science agents
- Honest vs. Byzantine
- Honest = act as intended by the system
- Byzantine = act in an unintended manner (manipulative, faulty, opportunistic)
A super-high level view of economic agents in "protocols"
- All are rational:
- Participation constraint: participate in protocol only if benefit outweighs cost
- Incentive compatibility: do desired action X only if net benefit of X is better than net benefit of any other action X′
- Work as intended iff PC and IC are both satisfied.
Some examples
- In proof-of-stake:
- if everyone else validates a proposed block, why should I?
- DAO voting
- marginal voter paradox: you are unlikely to matter, why bother voting?
- blockchains are communally run by a large number of validators
- why expense the resources to participate?
Proof-of-Work vs Proof-of-Stake
external punishment
→ misbehavior results in commercial/legal/social punishment
We must trust that records are correct. How achieved?
Economic Design of Recording Technology
allow rents:
→ running the ledger is profitable
→ misbehavior causes lack of trust
→ lack of trust makes people not use the ledger
→ rents gone
physical resource cost
→ running the ledger is costly
→ if I misbehave in the future then lack of trust
→ my previous investment is destroyed
Blockchain Consensus
-
What do you need? An equilibrium in which
- new transactions are processed correctly
- new transactions are being processed
- blocks are appended in sequence on a unique chain
Philosophical Requirement: Decentralization
-
additional philosophical requirement: "decentralization"
- no need to trust a party or rely on government enforcement
- e.g., reputation incentive "not enough"
- collusion gets "harder" with more players
- decentralization = no central of single party
- → random selection of new block producer possible
Economic Considerations
-
you want many participants?
- you need to pay enough for them to stay
- you need to pay enough for them to come
- ensure low barrier to entry
-
Incentives to
- keep adding to the chain (liveness)
- keep adding to the end of the chain (safety)
-
Structurally:
- → dynamic game
Results from the Economics Literature
-
Bruno Biais, Christophe Bisière, Matthieu Bouvard, Catherine Casamata
- Proof of Work is an equilibrium (but only one of many)
-
Fahad Saleh
- Proof of Stake is an equilibrium
- persistent forking is precluded equilibrium because validators = stakeholders.
Robustness to Attacks
related model: Budish (2018)
Selfish Mining Attack
- cost of mining a block: c
- number of miners: N
- block reward: B
basic economics:
expected gain of mining ≥ cost of mining
⇒ probability of winning × block reward ≥ cost
N1×B≥c
\frac{1}{N}\times B\ge c
→ holds for all miners
→ in equilibrium: aggregate cost of mining = aggregate benefit
⇔ c⋅N=B
\Leftrightarrow~c\cdot N=B
related model: Budish (2018)
Selfish Mining Attack
- value of attack: V
- to gain 50% control, pay: c⋅N
- need to gain A>1: (A/(A+1)>.5
- block confirmation convention: t
→ cost of attack: t⋅A⋅c⋅N
total benefit of attack
- attack value V
- block rewards t⋅B
→ for unattractive attack: cost > benefit
t⋅A⋅=Bc⋅N>V+t⋅B
t\cdot A\cdot \underbrace{c\cdot N}_{=B} >V+t\cdot B
t⋅B(A−1)>V
t\cdot B(A-1)> V
⇒∃V s.t. ∀V~>V V~>t⋅B(A−1)
\Rightarrow \exists \mathbb{V} \text{~s.t.~} \forall \tilde{V}>\mathbb{V}~~\tilde{V}>t\cdot B(A-1)
means amounts above V cannot be secured
Double spend attack prevention
- Validation rewards are taken as given, but they are crucial in
- determining incentives to participate,
- to support the chain, and
- to expense electricity and computing power
Basic idea of competitive equilibrium
aggregate mining cost = aggregate reward
Double spend - selfish mining attack
- win N block rewards until confirmation block
- ability to double-spend
condition that prevents it
(Chiu & Koeppl RFS 2018)
mining reward×(N+1)N>double spend amount
\text{mining reward} \times (N+1)N > \text{double spend amount}
Selfish Mining Attack (v2)
However! with attacking don't you
shoot yourself in the foot?
- First attack in May 2018
- double spent of $18 million worth of Bitcoin Gold
- → Loss of confidence in Bitcoin Gold and decline in exchange rate
- Only 1/6 of pre-attack value
- transactions ↘ one-third
G
- models: per period flow cost of mining
- Prat & Walter (2019): 2/3 of mining cost are fixed costs.
G
However! with attacking don't you
shoot yourself in the foot?
Garrat & van Oordt (WP 2020)
However! with attacking don't you
shoot yourself in the foot?
Garrat & van Oordt (WP 2020)
drop in exchange rate S
=loss
An alternative design: Conflux (developed by UofT Prof)
Greedy Heaviest Adaptive SubTree (GHAST) algorithm
- Blocks are assigned a weight according to the topologies
- Exists a deterministically heaviest chain called pivot chain
- An epoch contains one pivot chain block and its reachable blocks
Transaction Processing
- Blocks are processed sequentially ordered by epoch, topological order and id
- Only the first occurrence of the transaction is processed
- 3200 tps for simple payment transactions
going back to Budish (2018)
Selfish Mining Attack in Conflux
Serial Chain
Conflux Chain
In Conflux, withholding a block leads to greater anti-cone size
Intuition: Anticone = blocks created without properly referencing others blocks in its vicinity
Selfish Mining/Double-Spent Attack in Conflux
Proof-of-Stake (BFT) Committees
Validation and leader election
random
random
random
Committee 1
Committee 2
random
Block formation
Committee 1
Committee 2
...
Committee 32
attest
attest
Slot 1
Slot 2
Slot 32
...
12 seconds
Finality!
...
checkpoint
...
vote
vote
When final?
2/3 of stake has voted
So what's the problem? (here: for BFT PoS)
-
validity checks
- are not free
- are not observable
- → moral hazard problem
-
thought experiments
- if everyone else is honest, why do the check?
- if everyone else cheats, my checking is irrelevant
- if others cheat I may get punished
- results:
- prescribed protocol is not an equilibrium
- there is an equilibrium with invalid blocks
(happens if slashing cost too low)
- There exists a modified protocol so that consensus is reached
- requires some "opportunistic" voters to be pivotal
- Prescribed protocol: all committee members are instructed to verify blocks.
- Modified protocol: verify blocks if and only if their index is strictly lower than a certain number (essentially flushes out the invalidly proposed blocks)
Transaction Fees
Transaction Fee Considerations
- fees are an important part of incentivizing blockchain validation
- may become more important for bitcoin as coinbase rewards disappear
-
general rule: miners favour transactions with larger fees
- sometimes referred to as a "first price auction"
(winning bit pays their bid) -
correct statement is a "discriminatory price auction"
- sometimes referred to as a "first price auction"
bids sorted by price
→ quantity sold
price
block capacity
area = fees earned
Other pricing formats
- second price auction
→ pay the losing bid - correct formulation in multi-unit: "uniform price auction"
-
any difference?
- second price auction: bid your valuation
- first price auction: bid less than your valuation
-
in single unit auctions:
- revenue equivalence: in expectation the seller earns the same
- in multi-unit auctions:
- tricky: Klemperer (1999) argues that uniform>discriminatory because of more aggressive bidding
- empirical evidence is mixed
discriminatory
price
auction
uniform
price
auction
Other pricing formats
"StableFees: A Predictable Fee Market for Cryptocurrencies"
Soumya Basu, David Easley , Maureen O’Hara , Emin Gün Sirer
- propose uniform price auction
- smaller fee payments but
- much smaller variance in fee income
- → may still benefit miners
Vickery-Clarkes-Groves algorithm
- users truthfully submit how much they value an item
- winning = maximize total welfare
- payment = user share of total welfare:
- user pays difference between the total value to others without their participation minus sum of winning bids by other successful bidders.
- measures the benefit the winner's participation brings to welfare.
Real-world use case?
Google Ad Auctions!
EIP-1559: Objectives
what are the goals for a transactions fee protocol:
- users should bid their true valuation
- miner should follow the envisioned inclusion rule
- there are profitable side deals between miners and users
problems:
- first price auction fails 1.
- Vickery-Clarkes-Groves fails 2. (miners can create fake transactions and extract more from users)
- many approaches have other problems
EIP-1559: What is it an why does it help?
Roughgarden (2021): EIP-1559 satisfies 2. and 3. and almost always 1.
EIP-1559
- reserve price/base fee (time varying)
- base fee gets burned and doesn't go to miners
- block size varies by demand
@financeUTM
andreas.park@rotman.utoronto.ca
slides.com/ap248
sites.google.com/site/parkandreas/
youtube.com/user/andreaspark2812/
Economics ∩ Blockchain ≠ ∅ Andreas Park
Economics & Blockchain Consensus
By Andreas Park
Economics & Blockchain Consensus
Lecture for engineering students
- 404
