The Blockchain Folk Theorem - Department of Economics...

Introduction Preview of results Model Analysis & results Conclusion

The Blockchain Folk TheoremAn economic analysis of the blockchain

Bruno Biais (TSE), Christophe Bisiere (TSE),Matthieu Bouvard (McGill) and Catherine Casamatta (TSE)

Preliminary

April 2017


Blockchain

Distributed ledger, records transactions and ownership, operatedwithin a peer to peer network

Bitcoin blockchain: ownership of bitcoins

Blockchain can be used for other assets & contracts (Ethereum)

If reliable and stable, new cost effective way to record transactionsand ownership

Is it?


Nakamoto (2008): Steps in Blockchain

“The steps to run the network are as follows:1. New transactions are broadcast to all nodes.2. Each node collects new transactions into a block.3. Each node works on finding a difficult

proof-of-work for its block.4. When a node finds a proof-of-work, it broadcasts

the block to all nodes.5. Nodes accept the block only if all transactions in it

are valid and not already spent.6. Nodes express their acceptance of the block by

working on creating the next block in the chain, using thehash of the accepted block as the previous hash.”


Blockchain

!me

ini!alstockoftransac!onsinB1

minersworkoncryptographicproblem(proofofwork)

minersolvesB1

broadcaststoall

nodescheckproofofwork,transac!onsvalid,notspent,thenexpressacceptancebychainingnextblocktoB1

Block1

Block1

Block1B1 B2 B3

tB1 tB2 tB3

transac!onsbetween0andtB1

0

minersolvesB2

broadcaststoall

nodescheckthenchainnextblocktoB2

…


Nakamoto (2008): Longest chain rule (LCR)

To which previously solved block will miners chain their block?

“Nodes always consider the longest chain to be thecorrect one and will keep working on extending it.”

If miners follow LCR → no fork, single chain: consensus on thestate of the registry

In practice forks sometimes occur, and consensus disappears (atleast temporarily)


March 11, 2013 fork on Bitcoin

Vitalik Buterin (March 13, 2013, bitcoinmagazine.com)

“Starting from block 225430, the blockchain literally split

into two, with one half of the network adding blocks to one

version of the chain, and the other half adding to the other.

[...] The split lasted for 24 blocks or 6 hours [...]”


July 20, 2016 fork on EthereumSource: blog.ethereum.org


Can we expect miners to follow LCR?

We take a game-theoretic approach to study the strategies ofminers: to which block do they chain their own block?

We consider a frictionless environment: all miners observe blocksand transactions simultaneously, no double spending

In this perfect environment, can we expect stable and reliabledistributed consensus?

Is LCR an equilibrium of the game between miners? Yes

Is it the only equilibrium? No


What are miners mining for?

When miner solves block Bn in Bitcoin blockchain, he broadcaststhis, including his reward, in bitcoins, in block Bn

This reward can’t be spent immediately, only after sufficientlymany blocks chained to Bn (k-blocks rule)

Miners want to

• mine on chain which they think will become consensus, sotheir rewards are valuable → coordination

• protect value of reward they obtained and still hold → vestedinterest


Mining is a coordination game

Miners want to attach their blocks to the chain to which theyexpect the others will attach their blocks

=⇒ Choice of which block to mine = coordination game

=⇒ Multiple equilibria, some without forks and others with forks

Problem with forks → loss of rewards for orphaned blocks,blockchain instability, uncertainty about consensus, underminescredibility/value of cryptocurrency


Coordination issues during March 2013 Bitcoin fork

Two competing chains (0.7 versus 0.8): miners didn’t know whichchain to coordinate on

23:22 Gavin Andresen: the 0.8 fork is longer, yes? somajority hashpower is 0.8 ... first rule of bitcoin: majorityhashpower wins

23:23 Luke Dashjr: if we go with 0.8 we are hard forking23:43 BTC Guild: I can single handedly put 0.7 back to

the majority hashpower. I just need confirmation that that’swhat should be done

23:44 Pieter Wuille: that is what you should do, but we

should have consensus first

Eventually, BTC Guild chose 0.7 and 0.8 was orphaned

Reflecting uncertainty, price of Bitcoin dropped 25% during fork


Mining generates vested interest

Miner keeps rewards for solving block (k-block rule, preferredsavings vehicle)

As long as keeps rewards earned on a chain, vested interest in thatchain being consensus

→ keeps mining on that chain to make sure it is consensus

→ earns block on that chain

→ strengthens vested interest

→ persistent competing chains?


Vested interest during March 2013 Bitcoin fork

23:24 Luke Dashjr: it’s either lose 6 blocks [mined on 0.8]or hardfork [to 0.8]

23:25 Pieter Wuille: all old miners will stick to their oldchain regardless of the mining power behind the other

23:57 BTC Guild: I’ve lost so much money in the last 24hours from 0.8

By switching BTC Guild loses the work they’ve done on

0.8 since the fork started. On the other hand they are more or

less assured that the 0.7 branch will win

Source: freedom-to-tinker.com/2015/07/28/analyzing-the-2013-bitcoin-fork


Miners and pools

Miners, m ∈ M = {1, ...M}, risk neutral, rational, infinitelypatient

In practice miners work in pools, which coordinate the efforts oftheir miners, in particular as regards which blocks they mine. Mcan be interpreted as number of pools

April 20th 2017: 14 mining pools = 93% of total hash capacity →14 = reasonable order of magnitude for M

Relatively limited number of pools motivates game theoreticapproach (but coordination effects also there with competitivebehaviour)


Hash rate distribution in the Bitcoin network

Source: https://blockchain.info/pools?timespan=4days

https://blockchain.info/pools?timespan=4days


Transactions and blocks

We assume:

• Exogenous continuous flow of transactions sent forconfirmation by end-users

• Instantaneously observed by miners (removes one of thepotential causes for forks noted by Nakamoto (2008) and yetforks arise in equilibrium)

Stock of transactions available at time 0 = block B1

All participants start mining B1 at time 0


Time to solve blocks

Nakamoto (2008): time it takes m to solve block = exponentialwith intensity θm (proof of work)

We assume accordingly that probability that m solves his blockbetween t and t + dt is θmdt independently of

• how long m has been mining the block

• which block m is mining

• which block the others are mining

In practice, θm also depends on difficulty of cryptographic problem,revised every 2,016 blocks (on Bitcoin). We consider a stationaryenvironment (θm constant): appropriate for short term horizon (≤2 weeks)


Times at which miner m solves blocks


Times at which miner m’ solves blocks


Times at which miner m” solves blocks


Stochastic maturity

At time zm (exponential with intensity λm) miner m hit by liquidityshock → must consume real goods → sells cryptocurrency earnedas reward to a new miner, who also inherits his beliefs

Exit compensated by entry → stationary environment

Before zm miner m keeps cryptocurrency obtained as reward(k-blocks rule)


Rewards for solving blocks

In block he mines, m includes his reward: G units of cryptocurrency(eg Bitcoins or ETH) (+ transaction fee, much smaller)

Value of reward (obtained at zm) for mining block in chain Bdepends on number of miners active in B

For large part of the analysis, we only require G increasing andG (0) = G (1) = 0 : when there is no miner or only one miner on achain, the rewards on that (quasi) orphaned chain are valueless


LCR is a Nash equilibrium

Proposition 1:There exists a Nash equilibrium in which, at each date, allparticipants choose to mine the longest chain.

If m follows LCR, like the others=⇒ at zm only one chain (with M active miners)=⇒ each block mined by m earns G (M)=⇒ optimal (at least weakly) for m to follow LCR


Coordination rather than competition

Miners are not really competing to solve their block before theothers

That someone else solves his block before me, does not, in itself,reduce my gains

The only thing that matters is that we all coordinate well, and allwork on the same chain, so that we all obtain maximum rewardsfor the blocks we solve


Fork with orphaned branch

So far, focus on LCR. But LCR not always equilibrium:

Proposition 3: There exists a Nash equilibrium in which all minerscreate a fork from the main chain f blocks backward, and thenfollow the LCR on that fork.

Intuition: expect all miners fork f blocks backward → expectrewards on that chain to be more valuable → also fork:coordination game - strategic complementarity (would be therealso if miners competitive)

Consequence: Fork becomes the only active chain; rewards in theabandoned chain are lost; others don’t earn more =⇒ forkequilibrium Pareto dominated by LCR equilibrium


Coordination & forks

Arvind Narayanan (2015) “Analyzing the 2013 Bitcoin fork:centralized decision-making saved the day”:

“One way to look at this is that BTC Guild sacrificedrevenues for the good of the network. But these actionscan also be justified from a revenue-maximizingperspective. If the BTC Guild operator believed that the0.7 branch would win anyway (perhaps the developerswould be able to convince another large pool operator),then moving first is relatively best, since delaying wouldonly take BTC Guild further down the doomed branch.”

http://freedom-to-tinker.com/2015/07/28/

analyzing-the-2013-bitcoin-fork

http://freedom-to-tinker.com/2015/07/28/analyzing-the-2013-bitcoin-fork

http://freedom-to-tinker.com/2015/07/28/analyzing-the-2013-bitcoin-fork


Persistent forks

Can it happen that some miners fork to new chain whose parent isnot the previously solved block while others do not?

Old chain: {B1, ...Bn−f ,Bn−f+1, ...,Bn−f+i}

New chain: {B1, ...Bn−, Bn−f+1, ..., Bn−f+j}.

t

Bn−f Bn−f+1 Bn−f+i

tBn−f

Old chain with M −K miners

Bn−f+1 Bn−f+j

tBn

New chain with K miners


Persistent fork

Vested interest: number of blocks solved by a miner on old chainat time of fork

Rank the miners by vested interest in old chain

Proposition 4: Under certain conditions, there exists a Nashequilibrium in which miners with low vested interest on the oldchain decide to fork f blocks backward and keep working on thisfork, while miners with large vested interest continue to mine onthe old chain.


Intuition for Proposition 4

For some to fork, we need K ≥ M2 : Persistent forks can occur only

if majority of miners fork

Benefit from forking = blocks mined on new chain more valuable;large if expects to solve many blocks in the future, i.e. if largecomputing power and unfrequent liquidity shock

Cost of forking = reduces value of blocks already mined on oldchain; large if vested interest large and frequent liquidity shock

Persistent fork equilibrium is Pareto dominated


ConclusionLCR equilibrium and single persistent chain with no fork cannot beruled out... but cannot be taken for granted

Coordination game: Number of miners/computing power on achain → Credibility of chain → Value of rewards for blocks minedon that chain → Attractiveness of that chain

Multiple equilibria

• Instability?

• Pareto dominated (waste of resources)

Next steps

• double spending & non instantaneous transmission: sameeffects?

• endogenous computing power: overinvestment?

• protocol design to reduce inefficiencies: communicationamong miners, reward design

The Blockchain Folk Theorem - Department of Economics...

Documents

Transcript of The Blockchain Folk Theorem - Department of Economics...