Matheus V. X. Ferreira, Ye Lin Sally Hahn, S. Matthew Weinberg, Catherine Yu
Cryptographic Self-Selection is a subroutine used to select a leader for modern proof-of-stake consensus protocols, such as Algorand. In cryptographic self-selection, each round $r$ has a seed $Q_r$. In round $r$, each account owner is asked to digitally sign $Q_r$, hash their digital signature to produce a credential, and then broadcast this credential to the entire network. A publicly-known function scores each credential in a manner so that the distribution of the lowest scoring credential is identical to the distribution of stake owned by each account. The user who broadcasts the lowest-scoring credential is the leader for round $r$, and their credential becomes the seed $Q_{r+1}$. Such protocols leave open the possibility of a selfish-mining style attack: a user who owns multiple accounts that each produce low-scoring credentials in round $r$ can selectively choose which ones to broadcast in order to influence the seed for round $r+1$. Indeed, the user can pre-compute their credentials for round $r+1$ for each potential seed, and broadcast only the credential (among those with a low enough score to be the leader) that produces the most favorable seed. We consider an adversary who wishes to maximize the expected fraction of rounds in which an account they own is the leader. We show such an adversary always benefits from deviating from the intended protocol, regardless of the fraction of the stake controlled. We characterize the optimal strategy; first by proving the existence of optimal positive recurrent strategies whenever the adversary owns last than $38\%$ of the stake. Then, we provide a Markov Decision Process formulation to compute the optimal strategy.
Blockchain consensus is a state whereby each node in a network agrees on the current state of the blockchain. Existing protocols achieve consensus via a contest or voting procedure to select one node as a dictator to propose new blocks. However, this procedure can still lead to potential attacks that make consensus harder to achieve or lead to coordination issues if multiple, competing chains (i.e., forks) are created with the potential that an untruthful fork might be selected. We explore the potential for mechanisms to be used to achieve consensus that are triggered when there is a dispute impeding consensus. Using the feature that nodes stake tokens in proof of stake (POS) protocols, we construct revelation mechanisms in which the unique (subgame perfect) equilibrium involves validating nodes propose truthful blocks using only the information that exists amongst all nodes. We construct operationally and computationally simple mechanisms under both Byzantine Fault Tolerance and a Longest Chain Rule, and discuss their robustness to attacks. Our perspective is that the use of simple mechanisms is an unexplored area of blockchain consensus and has the potential to mitigate known trade-offs and enhance scalability.
The Non-Fungible Token (NFT) is viewed as one of the important applications of blockchain technology. Although NFT has a large market scale and multiple practical standards, several limitations of the existing mechanism in NFT markets exist. This work proposes a novel securitization and repurchase scheme for NFT to overcome these limitations. We first provide an Asset-Backed Securities (ABS) solution to settle the limitations of non-fungibility of NFT. Our securitization design aims to enhance the liquidity of NFTs and enable Oracles and Automatic Market Makers (AMMs) for NFTs. Then we propose a novel repurchase protocol for a participant owing a portion of NFT to repurchase other shares to obtain the complete ownership. As participants may strategically bid during the acquisition process, our repurchase process is formulated as a Stackelberg game to explore the equilibrium prices. We also provide solutions to handle difficulties at market such as budget constraints and lazy bidders.
In blockchains such as Bitcoin and Ethereum, users compete in a transaction fee auction to get their transactions confirmed in the next block. A line of recent works set forth the desiderata for a "dream" transaction fee mechanism (TFM), and explored whether such a mechanism existed. A dream TFM should satisfy 1) user incentive compatibility (UIC), i.e., truthful bidding should be a user's dominant strategy; 2) miner incentive compatibility (MIC), i.e., the miner's dominant strategy is to faithfully implement the prescribed mechanism; and 3) miner-user side contract proofness (SCP), i.e., no coalition of the miner and one or more user(s) can increase their joint utility by deviating from the honest behavior. The weakest form of SCP is called 1-SCP, where we only aim to provide resilience against the collusion of the miner and a single user. Sadly, despite the various attempts, to the best of knowledge, no existing mechanism can satisfy all three properties in all situations. Since the TFM departs from classical mechanism design in modeling and assumptions, to date, our understanding of the design space is relatively little. In this paper, we further unravel the mathematical structure of transaction fee mechanism design by proving the following results: - Can we have a dream TFM? - Rethinking the incentive compatibility notions. - Do the new design elements make a difference?
There are different interpretations of the terms "tokens" and "token-based systems" in the literature around blockchain and digital currencies although the distinction between token-based and account-based systems is well entrenched in economics. Despite the wide use of the terminologies of tokens and tokenisation in the cryptocurrency community, the underlying concept sometimes does not square well with the economic notions, or is even contrary to them. The UTXO design of Bitcoin exhibits partially characteristics of a token-based system and partially characteristics of an account-based system. A discussion on the difficulty to implement the economic notion of tokens in the digital domain, along with an exposition of the design of UTXO, is given in order to discuss why UTXO-based systems should be viewed as account-based according to the classical economic notion. Besides, a detailed comparison between UTXO-based systems and account-based systems is presented. Using the data structure of the system state representation as the defining feature to distinguish digital token-based and account-based systems is therefore suggested. This extended definition of token-based systems covers both physical and digital tokens while neatly distinguishing token-based and account-based systems.
This paper proposes a conceptual framework for the analysis of reward sharing schemes in mining pools, such as those associated with Bitcoin. The framework is centered around the reported shares in a pool instead of agents and results in two new fairness criteria, absolute and relative redistribution. These criteria impose that the addition of a share to the pool affects all previous shares in the same way, either in absolute amount or in relative ratio. We characterize two large classes of economically viable reward sharing schemes corresponding to each of these fairness criteria in turn. We further show that the intersection of these classes brings about a generalization of the well-known proportional scheme, which also leads to a new characterization of the proportional scheme as a corollary.
Proof-of-Stake blockchains based on a longest-chain consensus protocol are an attractive energy-friendly alternative to the Proof-of-Work paradigm. However, formal barriers to "getting the incentives right" were recently discovered, driven by the desire to use the blockchain itself as a source of pseudorandomness \cite{brown2019formal}. We consider instead a longest-chain Proof-of-Stake protocol with perfect, trusted, external randomness (e.g. a randomness beacon). We produce two main results. First, we show that a strategic miner can strictly outperform an honest miner with just $32.5\%$ of the total stake. Note that a miner of this size {\em cannot} outperform an honest miner in the Proof-of-Work model. This establishes that even with access to a perfect randomness beacon, incentives in Proof-of-Work and Proof-of-Stake longest-chain protocols are fundamentally different. Second, we prove that a strategic miner cannot outperform an honest miner with $30.8\%$ of the total stake. This means that, while not quite as secure as the Proof-of-Work regime, desirable incentive properties of Proof-of-Work longest-chain protocols can be approximately recovered via Proof-of-Stake with a perfect randomness beacon. The space of possible strategies in a Proof-of-Stake mining game is {\em significantly} richer than in a Proof-of-Work game. Our main technical contribution is a characterization of potentially optimal strategies for a strategic miner, and in particular, a proof that the corresponding infinite-state MDP admits an optimal strategy that is positive recurrent.
We study a game-theoretic model of blockchain mining economies and show that griefing, a practice according to which participants harm other participants at some lesser cost to themselves, is a prevalent threat at its Nash equilibria. The proof relies on a generalization of evolutionary stability to non-homogeneous populations via griefing factors (ratios that measure network losses relative to deviator's own losses) which leads to a formal theoretical argument for the dissipation of resources, consolidation of power and high entry barriers that are currently observed in practice. A critical assumption in this type of analysis is that miners' decisions have significant influence in aggregate network outcomes (such as network hashrate). However, as networks grow larger, the miner's interaction more closely resembles a distributed production economy or Fisher market and its stability properties change. In this case, we derive a proportional response (PR) update protocol which converges to market equilibria at which griefing is irrelevant. Convergence holds for a wide range of miners risk profiles and various degrees of resource mobility between blockchains with different mining technologies. Our empirical findings in a case study with four mineable cryptocurrencies suggest that risk diversification, restricted mobility of resources (as enforced by different mining technologies) and network growth, all are contributing factors to the stability of the inherently volatile blockchain ecosystem.
Demand for blockchains such as Bitcoin and Ethereum is far larger than supply, necessitating a mechanism that selects a subset of transactions to include "on-chain" from the pool of all pending transactions. This paper investigates the problem of designing a blockchain transaction fee mechanism through the lens of mechanism design. We introduce two new forms of incentive-compatibility that capture some of the idiosyncrasies of the blockchain setting, one (MMIC) that protects against deviations by profit-maximizing miners and one (OCA-proofness) that protects against off-chain collusion between miners and users. This study is immediately applicable to a recent (August 5, 2021) and major change to Ethereum's transaction fee mechanism, based on a proposal called "EIP-1559." Historically, Ethereum's transaction fee mechanism was a first-price (pay-as-bid) auction. EIP-1559 suggested making several tightly coupled changes, including the introduction of variable-size blocks, a history-dependent reserve price, and the burning of a significant portion of the transaction fees. We prove that this new mechanism earns an impressive report card: it satisfies the MMIC and OCA-proofness conditions, and is also dominant-strategy incentive compatible (DSIC) except when there is a sudden demand spike. We also introduce an alternative design, the "tipless mechanism," which offers an incomparable slate of incentive-compatibility guarantees -- it is MMIC and DSIC, and OCA-proof unless in the midst of a demand spike.
This paper describes a basic model of a gift economy in the shape of a Giving Game and reveals the fundamental structure of such a game. Main result is that the game shows a community effect in that a small subgroup of players eventually keeps all circulating goods for themselves. Example applications are where computers are sharing processing power for complex calculations, or when commodity traders are making transactions in some professional community. The Giving Game may equally well be viewed as a basic model of clientelism or corruption. Keywords in this paper are giving, gift economy, community effect, stabilization, computational complexity, corruption, micro-economics, game theory, stock trading, distributed computing, crypto currency, blockchain.
Second-price auctions with deposits are frequently used in blockchain environments. An auction takes place on-chain: bidders deposit an amount that fully covers their bid (but possibly exceeds it) in a smart contract. The deposit is used as insurance against bidders not honoring their bid if they win. The deposit, but not the bid, is publicly observed during the bidding phase of the auction. The visibility of deposits can fundamentally change the strategic structure of the auction if bidding happens sequentially: Bidding is costly since deposit are costly to make. Thus, deposits can be used as a costly signal for a high valuation. This is the source of multiple inefficiencies: To engage in costly signalling, a bidder who bids first and has a high valuation will generally over-deposit in equilibrium, i.e.~deposit more than he will bid. If high valuations are likely there can, moreover, be entry deterrence through high deposits: a bidder who bids first can deter subsequent bidders from entering the auction. Pooling can happen in equilibrium, where bidders of different valuations deposit the same amount. The auction fails to allocate the item to the bidder with the highest valuation.
Matheus V. X. Ferreira, Daniel J. Moroz, David C. Parkes, Mitchell Stern
In recent years, prominent blockchain systems such as Bitcoin and Ethereum have experienced explosive growth in transaction volume, leading to frequent surges in demand for limited block space and causing transaction fees to fluctuate by orders of magnitude. Existing systems sell space using first-price auctions; however, users find it difficult to estimate how much they need to bid in order to get their transactions accepted onto the chain. If they bid too low, their transactions can have long confirmation times. If they bid too high, they pay larger fees than necessary. In light of these issues, new transaction fee mechanisms have been proposed, most notably EIP-1559, aiming to provide better usability. EIP-1559 is a history-dependent mechanism that relies on block utilization to adjust a base fee. We propose an alternative design -- a {\em dynamic posted-price mechanism} -- which uses not only block utilization but also observable bids from past blocks to compute a posted price for subsequent blocks. We show its potential to reduce price volatility by providing examples for which the prices of EIP-1559 are unstable while the prices of the proposed mechanism are stable. More generally, whenever the demand for the blockchain stabilizes, we ask if our mechanism is able to converge to a stable state. Our main result provides sufficient conditions in a probabilistic setting for which the proposed mechanism is approximately welfare optimal and the prices are stable. Our main technical contribution towards establishing stability is an iterative algorithm that, given oracle access to a Lipschitz continuous and strictly concave function $f$, converges to a fixed point of $f$.
We study learning dynamics in distributed production economies such as blockchain mining, peer-to-peer file sharing and crowdsourcing. These economies can be modelled as multi-product Cournot competitions or all-pay auctions (Tullock contests) when individual firms have market power, or as Fisher markets with quasi-linear utilities when every firm has negligible influence on market outcomes. In the former case, we provide a formal proof that Gradient Ascent (GA) can be Li-Yorke chaotic for a step size as small as $Θ(1/n)$, where $n$ is the number of firms. In stark contrast, for the Fisher market case, we derive a Proportional Response (PR) protocol that converges to market equilibrium. The positive results on the convergence of the PR dynamics are obtained in full generality, in the sense that they hold for Fisher markets with \emph{any} quasi-linear utility functions. Conversely, the chaos results for the GA dynamics are established even in the simplest possible setting of two firms and one good, and they hold for a wide range of price functions with different demand elasticities. Our findings suggest that by considering multi-agent interactions from a market rather than a game-theoretic perspective, we can formally derive natural learning protocols which are stable and converge to effective outcomes rather than being chaotic.
Hans Gersbach, Akaki Mamageishvili, Manvir Schneider
We study vote delegation with "well-behaving" and "misbehaving" agents and compare it with conventional voting. Typical examples for vote delegation are validation or governance tasks on blockchains. There is a majority of well-behaving agents, but they may abstain or delegate their vote to other agents since voting is costly. Misbehaving agents always vote. We compare conventional voting allowing for abstention with vote delegation. Preferences of voters are private information and a positive outcome is achieved if well-behaving agents win. We illustrate that vote delegation leads to quite different outcomes than conventional voting with abstention. In particular, we obtain three insights: First, if the number of misbehaving voters, denoted by f , is high, both voting methods fail to deliver a positive outcome. Second, if f takes an intermediate value, conventional voting delivers a positive outcome, while vote delegation fails with probability one. Third, if f is low, delegation delivers a positive outcome with higher probability than conventional voting. Finally, our results characterize worst-case outcomes that can happen in a liquid democracy.
This is an expanded version of the lecture given at the AMS Short Course on Mean Field Games, on January 13, 2020 in Denver CO. The assignment was to discuss applications of Mean Field Games in finance and economics. I need to admit upfront that several of the examples reviewed in this chapter were already discussed in book form. Still, they are here accompanied with discussions of, and references to, works which appeared over the last three years. Moreover, several completely new sections are added to show how recent developments in financial engineering and economics can benefit from being viewed through the lens of the Mean Field Game paradigm. The new financial engineering applications deal with bitcoin mining and the energy markets, while the new economic applications concern models offering a smooth transition between macro-economics and finance, and contract theory.
EIP-1559 is a proposal to make several tightly coupled additions to Ethereum's transaction fee mechanism, including variable-size blocks and a burned base fee that rises and falls with demand. This report assesses the game-theoretic strengths and weaknesses of the proposal and explores some alternative designs.
Charles Bertucci, Louis Bertucci, Jean‐Michel Lasry, Pierre‐Louis Lions
We present an analysis of the Proof-of-Work consensus algorithm, used on the Bitcoin blockchain, using a Mean Field Game framework. Using a master equation, we provide an equilibrium characterization of the total computational power devoted to mining the blockchain (hashrate). From a simple setting we show how the master equation approach allows us to enrich the model by relaxing most of the simplifying assumptions. The essential structure of the game is preserved across all the enrichments. In deterministic settings, the hashrate ultimately reaches a steady state in which it increases at the rate of technological progress. In stochastic settings, there exists a target for the hashrate for every possible random state. As a consequence, we show that in equilibrium the security of the underlying blockchain is either $i)$ constant, or $ii)$ increases with the demand for the underlying cryptocurrency.
Bitcoin and Ethereum, whose miners arguably collectively comprise the most powerful computational resource in the history of mankind, offer no more power for processing and verifying transactions than a typical smart phone. The system described herein bypasses this bottleneck and brings scalable computation to Ethereum. Our new system consists of a financial incentive layer atop a dispute resolution layer where the latter takes form of a versatile "verification game." In addition to secure outsourced computation, immediate applications include decentralized mining pools whose operator is an Ethereum smart contract, a cryptocurrency with scalable transaction throughput, and a trustless means for transferring currency between disjoint cryptocurrency systems.
Jason Teutsch, Vitalik Buterin, Christopher L. Brown
Ethereum has emerged as a dynamic platform for exchanging cryptocurrency tokens. While token crowdsales cannot simultaneously guarantee buyers both certainty of valuation and certainty of participation, we show that if each token buyer specifies a desired purchase quantity at each valuation then everyone can successfully participate. Our implementation introduces smart contract techniques which recruit outside participants in order to circumvent computational complexity barriers.
In December 2015, a bounty emerged to establish both reliable communication and secure transfer of value between the Dogecoin and Ethereum blockchains. This prized "Dogethereum bridge" would allow parties to "lock" a DOGE coin on Dogecoin and in exchange receive a newly minted WOW token in Ethereum. Any subsequent owner of the WOW token could burn it and, in exchange, earn the right to "unlock" a DOGE on Dogecoin. We describe an efficient, trustless, and retrofitting Dogethereum construction which requires no fork but rather employs economic collateral to achieve a "lock" operation in Dogecoin. The protocol relies on bulletproofs, Truebit, and parametrized tokens to efficiently and trustlessly relay events from the "true" Dogecoin blockchain into Ethereum. The present construction not only enables cross-platform exchange but also allows Ethereum smart contracts to trustlessly access Dogecoin. A similar technique adds Ethereum-based smart contracts to Bitcoin and Bitcoin data to Ethereum smart contracts.
We outline a token model for Truebit, a retrofitting, blockchain enhancement which enables secure, community-based computation. The model addresses the challenge of stable task pricing, as raised in the Truebit whitepaper, without appealing to external oracles, exchanges, or hierarchical nodes. The system's sustainable economics and fair market pricing derive from a mintable token format which leverages existing tokens for liquidity. Finally, we introduce a governance layer whose lifecycles culminates with permanent dissolution into utility tokens, thereby tending the network towards autonomous decentralization.