Sarah Azouvi, Guy Goren, Lioba Heimbach, Alexander Hicks
In 2021 Ethereum adjusted the transaction pricing mechanism by implementing EIP-1559, which introduces the base fee - a network fee that is burned and dynamically adjusts to the network demand. The authors of the Ethereum Improvement Proposal (EIP) noted that a miner with more than 50% of the mining power could be incentivized to deviate from the honest mining strategy. Instead, such a miner could propose a series of empty blocks to artificially lower demand and increase her future rewards. In this paper, we generalize this attack and show that under rational player behavior, deviating from the honest strategy can be profitable for a miner with less than 50% of the mining power. We show that even when miners do not collaborate, it is at times rational for smaller miners to join the attack. Finally, we propose a mitigation to address the identified vulnerability.
Aggelos Kiayias, Ηλίας Κουτσουπιάς, Philip Lazos, Giorgos Panagiotakos
Blockchain systems come with the promise of being inclusive for a variety of decentralized applications (DApps) that can serve different purposes and have different urgency requirements. Despite this, the transaction fee mechanisms currently deployed in popular platforms as well as previous modeling attempts for the associated mechanism design problem focus on an approach that favors increasing prices in favor of those clients who value immediate service during periods of congestion. To address this issue, we introduce a model that captures the traffic diversity of blockchain systems and a tiered pricing mechanism that is capable of implementing more inclusive transaction policies. In this model, we demonstrate formally that EIP-1559, the transaction fee mechanism currently used in Ethereum, is not inclusive and demonstrate experimentally that its prices surge horizontally during periods of congestion. On the other hand, we prove formally that our mechanism achieves stable prices in expectation and we provide experimental results that establish that prices for transactions can be kept low for low urgency transactions, resulting in a diverse set of transaction types entering the blockchain. At the same time, perhaps surprisingly, our mechanism does not necessarily sacrifice revenue since the lowering of the prices for low urgency transactions can be covered from high urgency ones due to the price discrimination ability of the mechanism.
As coin-based rewards dwindle, transaction fees play an important role as mining incentives in Bitcoin. In this paper, we propose a novel mechanism called Efficient Dynamic Transaction Storage (EDTS) for dynamically allocating transactions among blocks to achieve efficient storage utilization. By leveraging a combination of Cuckoo Filter and Dynamic Transaction Storage (DTS) strategies, EDTS is able to improve the scalability while remaining sustainable even after the Bitcoin enters a transaction-fee regime. In addition to preventing deviant mining behaviors under the transaction-fee regime, EDTS can also provide differentiated transmission priorities based on transaction fees while allowing the investors to engage in pledging more transaction fees. In EDTS, we applied the multi-objective optimization algorithm U-NSGA-III to find the best DTS strategy and its corresponding attributes. Experimental results show that the EDTS mechanism together with the optimized DTS strategy can achieve a throughput of 325.3 TPS. The experimental results reveal that the scalability improvement of EDTS is superior to the performance of Bitcoin NG, which is the best known on-chain scaling solution, while maintaining the sustainability under the transaction-fee regime.
Hans Gersbach, Akaki Mamageishvili, Fikri Pitsuwan
Systems and blockchains often have security vulnerabilities and can be attacked by adversaries, with potentially significant negative consequences. Therefore, infrastructure providers increasingly rely on bug bounty programs, where external individuals probe the system and report any vulnerabilities (bugs) in exchange for rewards (bounty). We develop a simple contest model of bug bounty. A group of individuals of arbitrary size is invited to undertake a costly search for bugs. The individuals differ with regard to their abilities, which we capture by different costs to achieve a certain probability to find bugs if any exist. Costs are private information. We study equilibria of the contest and characterize the optimal design of bug bounty schemes. In particular, the designer can vary the size of the group of individuals invited to search, add a paid expert, insert an artificial bug with some probability, and pay multiple prizes.
Public blockchains group submitted transactions into batches, called blocks. A natural question is how to determine which transactions are included in these batches. In this note, we show a gap between the welfare of so-called `fair' ordering, namely first-in-first-out (an ideal that a number of blockchain protocols strive to achieve), where the first transactions to arrive are the ones put into the block, and the welfare of `optimal' inclusion that is, at least approximately, welfare-maximizing, such as choosing which transactions are included in a block via an auction. We show this gap is positive under a simple model with mild assumptions where we assume transactions are, roughly speaking, uniformly drawn from a reasonable distribution. Our results formalize a performance metric for blockchain inclusion rules and consequently provide a framework to help design and compare these rules. The results can be directly extended to ordering mechanisms as well.
Mikel Cortes-Goicoechea, Tarun Mohandas-Daryanani, José L. Muñoz, Leonardo Bautista-Gomez
Like most modern blockchain networks, Ethereum has relied on economic incentives to promote honest participation in the chain's consensus. The distributed character of the platform, together with the “randomness” or “luck” factor that both proof of work (PoW) and proof of stake (PoS) provide when electing the next block proposer, pushed the industry to model and improve the reward system of the system. With several improvements to predict PoW block proposal rewards and to maximize the extractable rewards of the same ones, the ultimate Ethereum's transition to PoS applied in the Paris Hard-Fork, more generally known as “The Merge”, has meant a significant modification on the reward system in the platform. In this paper, we aim to break down both theoretically and empirically the new reward system in this post-merge era. We present a highly detailed description of the different rewards and their share among validators' rewards. Ultimately, we offer a study that uses the presented reward model to analyze the performance of the network during this transition.
Jason Milionis, Ciamac C. Moallemi, Tim Roughgarden
In decentralized finance ("DeFi"), automated market makers (AMMs) enable traders to programmatically exchange one asset for another. Such trades are enabled by the assets deposited by liquidity providers (LPs). The goal of this paper is to characterize and interpret the optimal (i.e., profit-maximizing) strategy of a monopolist liquidity provider, as a function of that LP's beliefs about asset prices and trader behavior. We introduce a general framework for reasoning about AMMs based on a Bayesian-like belief inference framework, where LPs maintain an asset price estimate. In this model, the market maker (i.e., LP) chooses a demand curve that specifies the quantity of a risky asset to be held at each dollar price. Traders arrive sequentially and submit a price bid that can be interpreted as their estimate of the risky asset price; the AMM responds to this submitted bid with an allocation of the risky asset to the trader, a payment that the trader must pay, and a revised internal estimate for the true asset price. We define an incentive-compatible (IC) AMM as one in which a trader's optimal strategy is to submit its true estimate of the asset price, and characterize the IC AMMs as those with downward-sloping demand curves and payments defined by a formula familiar from Myerson's optimal auction theory. We generalize Myerson's virtual values, and characterize the profit-maximizing IC AMM. The optimal demand curve generally has a jump that can be interpreted as a "bid-ask spread," which we show is caused by a combination of adverse selection risk (dominant when the degree of information asymmetry is large) and monopoly pricing (dominant when asymmetry is small). This work opens up new research directions into the study of automated exchange mechanisms from the lens of optimal auction theory and iterative belief inference, using tools of theoretical computer science in a novel way.
Transaction fee mechanism design is a new decentralized mechanism design problem where users bid for space on the blockchain. Several recent works showed that the transaction fee mechanism design fundamentally departs from classical mechanism design. They then systematically explored the mathematical landscape of this new decentralized mechanism design problem in two settings: in the plain setting where no cryptography is employed, and in a cryptography-assisted setting where the rules of the mechanism are enforced by a multi-party computation protocol. Unfortunately, in both settings, prior works showed that if we want the mechanism to incentivize honest behavior for both users as well as miners (possibly colluding with users), then the miner revenue has to be zero. Although adopting a relaxed, approximate notion of incentive compatibility gets around this zero miner-revenue limitation, the scaling of the miner revenue is nonetheless poor. In this paper, we show that if we make a mildly stronger reasonable-world assumption than prior works, we can circumvent the known limitations on miner revenue, and design auctions that generate optimal miner revenue. We also systematically explore the mathematical landscape of transaction fee mechanism design under the new reasonable-world and demonstrate how such assumptions can alter the feasibility and infeasibility landscape.
Founded in 2017, Algorand is one of the world's first carbon-negative, public blockchains inspired by proof of stake. Algorand uses a Byzantine agreement protocol to add new blocks to the blockchain. The protocol can tolerate malicious users as long as a supermajority of the stake is controlled by non-malicious users. The protocol achieves about 100x more throughput compared to Bitcoin and can be easily scaled to millions of nodes. Despite its impressive features, Algorand lacks a reward-distribution scheme that can effectively incentivize nodes to participate in the protocol. In this work, we study the incentive issue in Algorand through the lens of game theory. We model the Algorand protocol as a Bayesian game and propose a novel reward scheme to address the incentive issue in Algorand. We derive necessary conditions to ensure that participation in the protocol is a Bayesian Nash equilibrium under our proposed reward scheme even in the presence of a malicious adversary. We also present quantitative analysis of our proposed reward scheme by applying it to two real-world deployment scenarios. We estimate the costs of running an Algorand node and simulate the protocol to measure the overheads in terms of computation, storage, and networking.
Transaction fees represent a major incentive in many blockchain systems as a way to incentivize processing transactions. Unfortunately, they also introduce an enormous amount of incentive asymmetry compared to alternatives like fixed block rewards. We analyze some of the incentive compatibility issues that arise from transaction fees, which relate to the bids that users submit, the allocation rules that miners use to choose which transactions to include, and where they choose to mine in the context of longest-chain consensus. We start by surveying a variety of mining attacks including undercutting, fee sniping, and fee-optimized selfish mining. Then, we move to analyzing mechanistic notions of user incentive compatibility, myopic miner incentive compatibility, and off-chain-agreement-proofness, as well as why they are provably incompatible in their full form. Then, we discuss weaker notions of nearly and $γ$-weak incentive compatibility, and how all of these forms of incentive compatibility hold or fail in the trustless auctioneer setup of blockchains, examining classical mechanisms as well as more recent ones such as Ethereum's EIP-1559 mechanism and \cite{chung}'s burning second-price auction. Throughout, we generalize and interrelate existing notions, provide new unifying perspectives and intuitions on analysis, and discuss both specific and overarching open problems for future work.
Security analysis of blockchain technology is an active domain of research. There has been both cryptographic and game-theoretic security analysis of Proof-of-Work (PoW) blockchains. Prominent work includes the cryptographic security analysis under the Universal Composable framework and Game-theoretic security analysis using Rational Protocol Design. These security analysis models rely on stricter assumptions that might not hold. In this paper, we analyze the security of PoW blockchain protocols. We first show how assumptions made by previous models need not be valid in reality, which attackers can exploit to launch attacks that these models fail to capture. These include Difficulty Alternating Attack, under which forking is possible for an adversary with less than 0.5 mining power, Quick-Fork Attack, a general bound on selfish mining attack and transaction withholding attack. Following this, we argue why previous models for security analysis fail to capture these attacks and propose a more practical framework for security analysis pRPD. We then propose a framework to build PoW blockchains PRAGTHOS, which is secure from the attacks mentioned above. Finally, we argue that PoW blockchains complying with the PRAGTHOS framework are secure against a computationally bounded adversary under certain conditions on the reward scheme.
A central tenet in mechanism design is the ability to irrevocably commit to a mechanism. Commitment is achieved by public declaration, letting players verify incentive properties in advance and the outcome in retrospect. However, public declaration can reveal superfluous information that is private to the mechanism designer, such as her target function or costs. We propose a new approach to commitment, and show how to commit to, and run, any given mechanism without disclosing it, while enabling the verification of incentive properties and the outcome -- all without any mediators. Our framework leverages zero-knowledge proofs -- a cornerstone of modern cryptographic theory.
We describe a plausible probabilistic model for a blockchain queueing environment in which rational, profit-maximising schedulers impose adversarial disciplines on incoming messages containing a payload that encodes a state transition in a machine. The model can be specialised to apply to chains with fixed or variable block times, traditional priority queue disciplines with `honest' schedulers, or adversarial public mempools. We find conditions under which the model behaves as a bulk-service queue with priority discipline and derive practical expressions for the relative block and message number of a transaction. We study this setup in the context of orders to a CFMM DEX where the execution price a user receives may be quite sensitive to its positioning in the chain -- in particular, to a string of transactions scheduled for prior execution which is not knowable at the time of order creation. We derive statistical models for the price impact of this order flow both in the presence and absence of MEV extraction activity.
We investigate the welfare loss of continuous and discrete order matching models in blockchain-based decentralized exchanges (DEX) that utilize order books to record outstanding orders. Continuous processing matches each incoming transaction against the current order book. The discrete processing model, i.e., frequent batch auction (FBA), executes transactions discretely in batches with a uniform price double auction: Orders are first matched according to price, then the exact transaction order if competing orders specify the same price. We find that FBA imposes less welfare loss and provides better liquidity than continuous processing in typical scenarios, e.g., when few parties are privately informed about asset valuations. Even otherwise, it achieves better social welfare and liquidity provision in the following settings: when price takers and public information reflecting asset value changes arrive sufficiently frequently compared to private information, when the priority fees (for faster transaction inclusion into blockchains) are small, or when the market is more balanced on both buy and sell sides. Our empirical analysis on the BTC-USD and ETH-USD transactions on a DEX named dYdX indicates that FBA can reduce transaction costs by $21\%-37\%$.
Decentralized Exchanges (DEXs) are new types of marketplaces leveraging Blockchain technology. They allow users to trade assets with Automatic Market Makers (AMM), using funds provided by liquidity providers, removing the need for order books. One such DEX, Uniswap v3, allows liquidity providers to allocate funds more efficiently by specifying an active price interval for their funds. This introduces the problem of finding an optimal strategy for choosing price intervals. We formalize this problem as an online learning problem with non-stochastic rewards. We use regret-minimization methods to show a liquidity provision strategy that guarantees a lower bound on the reward. This is true even for non-stochastic changes to asset pricing, and we express this bound in terms of the trading volume.
Tarun Chitra, Matheus V. X. Ferreira, Kshitij Kulkarni
We study auction design in a setting where agents can communicate over a censorship-resistant broadcast channel like the ones we can implement over a public blockchain. We seek to design credible, strategyproof auctions in a model that differs from the traditional mechanism design framework because communication is not centralized via the auctioneer. We prove this allows us to design a larger class of credible auctions where the auctioneer has no incentive to be strategic. Intuitively, a decentralized communication model weakens the auctioneer's adversarial capabilities because they can only inject messages into the communication channel but not delete, delay, or modify the messages from legitimate buyers. Our main result is a separation in the following sense: we give the first instance of an auction that is credible only if communication is decentralized. Moreover, we construct the first two-round auction that is credible, strategyproof, and optimal when bidder valuations are $α$-strongly regular, for $α> 0$. Our result relies on mild assumptions -- namely, the existence of a broadcast channel and cryptographic commitments.
We develop a model of coordination and allocation of decentralized multi-sided markets, in which our theoretical analysis is promisingly optimizing the decentralized transaction packaging process at high-throughput blockchains or Web 3.0 platforms. In contrast to the stylized centralized platform, the decentralized platform is powered by blockchain technology, which allows for secure and transparent Peer-to-Peer transactions among users. Traditional single-chain-based blockchains suffer from the well-known blockchain trilemma. Beyond the single-chain-based scheme, decentralized high-throughput blockchains adopt parallel protocols to reconcile the blockchain trilemma, implementing any tasking and desired allocation. However, unneglectable network latency may induce partial observability, resulting in incoordination and misallocation issues for the decentralized transaction packaging process at the current high-throughput blockchain protocols. To address this problem, we consider a strategic coordination mechanism for the decentralized transaction packaging process by using a game-theoretic approach. Under a tractable two-period model, we find a Bayesian Nash equilibrium of the miner's strategic transaction packaging under partial observability. Along with novel algorithms for computing equilibrium payoffs, we show that the decentralized platform can achieve an efficient and stable market outcome. The model also highlights that the proposed mechanism can endogenously offer a base fee per gas without any restructuration of the initial blockchain transaction fee mechanism. The theoretical results that underlie the algorithms also imply bounds on the computational complexity of equilibrium payoffs.
Monte Carlo simulations play a crucial role in all stages of particle collider experiments. There has been a long-term trend in HEP of both increasing collision energies and the luminosity. As a result, the requirements for MC simulations have become more rigorous: Their computational complexity has increased due to higher accuracy requirements. Additionally, more simulation data is required to allow data analysts to spot Standard Model deviations in observations of real data and enable the filtering of rare events. In order to keep up with the computational complexity of simulations and analysis of real data, distributed computing approaches are commonly employed. For instance, CERN relies on the Worldwide LHC Computing Grid (WLCG) in order to be able to store, process, distribute and analyze collision data. Since not every HEP experiment has access to these resources and the addition of new Grid servers is a complex process, this publication explores a novel distributed computing approach for HEP which is based on blockchain technology. It features the description of a novel Proof-of-Useful-Work consensus algorithm which aims to both support real-world HEP experiments with the production of required MC data and to secure the underlying blockchain infrastructure at the same time. Instead of being an alternative to WLCG or BOINC projects that rely on volunteer computing, it aims to be a complementary source of additional computing power. This publication also features a brief introduction into blockchain fundamentals and comparisons to existing distributed computing approaches.
Théodore Conrad, Arthur Vinciguerra, Guillaume Méroué
Constant-product market making functions were first introduced by Hayden Adams in 2017 to create Uniswap, a decentralised exchange on Ethereum. This enables users to exchange assets at any given rate. Some variations such as Balancer and Curve were later introduced. In this paper, we analyse the maths that rule this type of protocol. We show that splitting a trade in multiple smaller trades does not impact the final exchange rate. We also show that the protocol is safer and more profitable when no one recompounds their fees.
We identify a subtle security issue that impacts the design of smart contracts, because agents may themselves deploy smart contracts (side contracts). Typically, equilibria of games are analyzed in vitro, under the assumption that players cannot arbitrarily commit to strategies. However, equilibria thus obtained do not hold in general in vivo, when games are deployed on a blockchain. Being able to deploy side contracts changes fundamental game-theoretic assumptions by inducing a meta-game wherein agents strategize to deploy the best contracts. Not taking side contracts into account thus fails to capture an important aspect of deploying smart contracts in practice. A game that remains secure when the players can deploy side contracts is said to be side contract resilient. We demonstrate the non-triviality of side contract resilience by analyzing two smart contracts for decentralized commerce. These contracts have the same intended functionality, but we show that only one is side contract resilient. We then demonstrate a side contract attack on first-price auctions, which are the transaction mechanisms used by most major blockchains. We show that an agent may deploy a contract ensuring their transaction is included in the next block at almost zero cost while forcing most other agents to enter into a lottery for the remaining block space. This benefits all the users, but is detrimental to the miners. This might be cause for re-evaluation of the use of auctions in transaction fee mechanisms. We show that the attack works under certain conditions that hold with high probability from natural distributions. The attack also works against the transaction mechanism EIP-1559. Our work highlights an issue that is necessary to address to ensure the secure deployment of smart contracts and suggests that other contracts already deployed on major blockchains may be susceptible to these attacks.
Sneakers were designated as the most counterfeited fashion item online, with three times more risk in a trade than any other fashion purchase. As the market expands, the current sneaker scene displays several vulnerabilities and trust flaws, mostly related to the legitimacy of assets or actors. In this paper, we investigate various blockchain-based mechanisms to address these large-scale trust issues. We argue that (i) pre-certified and tracked assets through the use of non-fungible tokens can ensure the genuine nature of an asset and authenticate its owner more effectively during peer-to-peer trading across a marketplace; (ii) a game-theoretic-based system with economic incentives for participating users can greatly reduce the rate of online fraud and address missed delivery deadlines; (iii) a decentralized dispute resolution system biased in favour of an honest party can solve potential conflicts more reliably.
Modern blockchains guarantee that submitted transactions will be included eventually; a property formally known as liveness. But financial activity requires transactions to be included in a timely manner. Unfortunately, classical liveness is not strong enough to guarantee this, particularly in the presence of a motivated adversary who benefits from censoring transactions. We define censorship resistance as the amount it would cost the adversary to censor a transaction for a fixed interval of time as a function of the associated tip. This definition has two advantages, first it captures the fact that transactions with a higher miner tip can be more costly to censor, and therefore are more likely to swiftly make their way onto the chain. Second, it applies to a finite time window, so it can be used to assess whether a blockchain is capable of hosting financial activity that relies on timely inclusion. We apply this definition in the context of auctions. Auctions are a building block for many financial applications, and censoring competing bids offers an easy-to-model motivation for our adversary. Traditional proof-of-stake blockchains have poor enough censorship resistance that it is difficult to retain the integrity of an auction when bids can only be submitted in a single block. As the number of bidders $n$ in a single block auction increases, the probability that the winner is not the adversary, and the economic efficiency of the auction, both decrease faster than $1/n$. Running the auction over multiple blocks, each with a different proposer, alleviates the problem only if the number of blocks grows faster than the number of bidders. We argue that blockchains with more than one concurrent proposer have can have strong censorship resistance. We achieve this by setting up a prisoner's dilemma among the proposers using conditional tips.
We study a mechanism design problem in the blockchain proof-of-stake (PoS) protocol. Our main objective is to extend the transaction fee mechanism (TFM) recently proposed in Chung and Shi (SODA, p.3856-3899, 2023), so as to incorporate a long-run utility model for the miner into the burning second-price auction mechanism $\texttt{BSP}(γ)$ proposed in Chung and Shi (where $γ$ is a key parameter in the strict $γ$-utility model that is applied to both miners and users). First, we derive an explicit functional form for the long-run utility of the miner using a martingale approach, and reveal a critical discontinuity of the utility function, namely a small deviation from being truthful will yield a discrete jump (up or down) in the miner's utility. We show that because of this discontinuity the $\texttt{BSP}(γ)$ mechanism will fail a key desired property in TFM, $c$-side contract proofness ($c$-SCP). As a remedy, we introduce another parameter $θ$, and propose a new $\texttt{BSP}(θ)$ mechanism, and prove that it satisfies all three desired properties of TFM: user- and miner-incentive compatibility (UIC and MIC) as well as $c$-SCP, provided the parameter $θ$ falls into a specific range, along with a proper tick size imposed on user bids.
Before the advent of alternative blockchains such as Ethereum, the future of decentralization was all in the hands of Bitcoin. Together with Nakamoto itself, early developers were trying to leverage Bitcoin’s potential to decentralize traditionally centralized applications. However, because Bitcoin was a decentralized machine, the available non-trustless oracles were considered unsuitable. Therefore, strategies had to be elaborated to solve the so-called “oracle problem” in the newborn scenario. By interviewing early developers and crawling early forums and repositories, this paper aims to retrace and reconstruct the chain of events and contributions that gave birth to oracles on Bitcoin. The evolution of early protocols, along with the difficulties encountered in their development, are also outlined. Analyzing technical and social barriers to building oracles on Bitcoin, the transition to Ethereum will also be discussed.