Proof-of-Work, Risk Aversion and Collusion

The Proof-of-Work protocol, which specifies how payments are allocated to miners who maintain and update the blockchain, was introduced by Nakamoto (2008) and is currently adopted by most major cryptocurrencies.1 Together with the longest-chain rule, it has so far proved to be resilient to attacks.2 However, does it provide the right incentives to miners? We answer this question using recent research and, in particular, the paper of Chen et al. (2019).

Introduction to Proof-of-Work

We first provide a very brief description of the elements of the Proof-of-Work protocol that are important for this analysis.3 Whenever a list of transactions needs to be appended in the blockchain, a group of miners solve a difficult cryptographic puzzle. It is difficult because the only way of solving it is by trying many different guesses. The miner who solves it first has the right to write the new block of transactions in the blockchain, allocating 12.5 Bitcoins (BTC) to his public address.4

Τhe probability that a miner is the first to solve the puzzle is directly proportional to the hash power that they have committed. The hash power is measured by the number of guesses to the puzzle that can be tried every second. If a miner doubles his hash power (for example by doubling the computers they have), they will double the probability p of being the first to solve the cryptographic puzzle. This means that the Proof-of-Work protocol generates a proportional payment rule that computes the expected payoff of each miner, p*12.5 BTC, given the hash power that they commit to solving the puzzle.5 If the hash power doubles, then the probability and hence the expected payoff double as well.

Properties of the Proof-of-Work Payment Rule

This proportionality of the payment rule is generated because there are constant returns to scale: by doubling the input (computers), the output (hash power) is also doubled. However, within the Proof-of-Work protocol there could be many other payment rules that are not proportional.6 Is this proportionality good and how does it influence the incentives of miners?

To answer these questions, we consider properties of payment rules, such as the following ones. Recall that a payment rule provides an expected payoff to each miner, given the hash power they have committed to solving the puzzle.

  1. Non-negativity. Each miner gets a zero or strictly positive payment.
  2. Strong budget-balance. All 12.5 BTC are paid to the miners, so that nothing is left out.
  3. Symmetry. The payment rule cannot depend on the identity of the miners. For example, a “dictatorial” rule would always give the 12.5 BTC to a miner with a specific public key, thus violating symmetry.
  4. Sybil-proofness. No miner can increase his expected payoff by creating multiple identities and splitting his hash power among them. This would occur, for example, if a miner with 10 computers created 10 different public keys, assigning one computer to each of them. A rule which allocates payments by randomly picking public keys violates Sybil-proofness.
  5. Collusion-proofness. Two or more miners cannot increase their expected payoffs by pooling their resources and creating a mining pool that submits one solution to the puzzle and then distributes the payoff to its members.

How good are these properties?

The first two properties are straightforward. Symmetry expresses a notion of fairness because it does not allow for some miners to get a special treatment due to irrelevant factors, such as their public key. Symmetry is effectively imposed by the decentralised nature of the blockchain, where all participants are pseudonymous and their identity is hidden.  Sybil-proofness is one of the fundamental innovations of the Bitcoin blockchain and the Proof-of-Work protocol. By not rewarding the creation of multiple identities, the protocol creates “digital scarcity”, which in turn allows for controlling the supply of bitcoin. Finally, collusion-proofness is desirable because a big enough mining pool could attack the blockchain in order to falsify the transactions or exclude other miners from getting any rewards, thus making the system centralised. The most famous is the 51% attack, which requires a mining pool that controls 51% of the hash power.7

The proportional rule, which is the one used by the Proof-of-Work protocol, obviously satisfies the first four properties. However, Chen et al. (2019) show that it is the only rule that satisfies all five properties simultaneously. In other words, if you consider these five properties to be desirable and important, then there is no other rule available but the proportional one.

This is good news for the Proof-of-Work protocol. However, this result makes one important assumption: that all miners are risk-neutral. This means that they only care about their expected payoff and are indifferent to risk. To provide a simple example, consider the following two bets. The first bet increases one’s wealth by £1000 with probability 0.5 and decreases it by £1000 with probability 0.5. The second bet pays £0 with probability 1. A risk-neutral decision maker would be indifferent between the two bets because the expected payoff is £0 for both. However, a risk-averse decision maker would prefer the second bet, because it has less risk than the first one. A risk-averse decision maker is always willing to pay (in terms of reducing expected payoff) to avoid risk.

Proof-of-Work and Risk Aversion

If we assume that miners are risk-averse, then Chen et al. (2019) show (what is called in economics) an impossibility result: there is no rule that satisfies these five properties simultaneously. This is bad news for the proportional rule of the Proof-of-Work protocol. Since we know that it satisfies the first four properties, it must violate collusion-proofness.

We already know, from numerous experimental studies, that decision makers are in general risk-averse, as discussed in Eckel and Grossman (2008). We also know that there is collusion in the Bitcoin blockchain. Below is a graph of the hashrate distribution of the major mining pools, the largest controlling around 18%.

Figure 1: Bitcoins Mining Pools

Source: https://www.blockchain.com/en/pools, retrieved on 21/12/2019.

One justification of mining pools, also consistent with risk-aversion, is that they enable miners to insure each other in order to avoid risk. Another justification is that forming a mining pool could be a way of planning an attack in the future. The impossibility result of Chen et al. (2019), however, proves that the existence of mining pools is the inescapable implication of risk-aversion, hidden identities (symmetry) and digital scarcity (Sybil-proofness). The first is a ubiquitous human trait, whereas the other two are fundamental design characteristics of the Proof-of-Work protocol. In that sense, some form of collusion cannot be avoided in Proof-of-Work protocols that implement a proportional payment rule, even if the other two justifications were eclipsed.

One justification of mining pools, also consistent with risk-aversion, is that they enable miners to insure each other in order to avoid risk. Another justification is that forming a mining pool could be a way of planning an attack in the future. The impossibility result of Chen et al. (2019), however, proves that the existence of mining pools is the inescapable implication of risk-aversion, hidden identities (symmetry) and digital scarcity (Sybil-proofness). The first is a ubiquitous human trait, whereas the other two are fundamental design characteristics of the Proof-of-Work protocol. In that sense, some form of collusion cannot be avoided in Proof-of-Work protocols that implement a proportional payment rule, even if the other two justifications were eclipsed

Bibliography

Chen, X., Papadimitriou, C. and Roughgarden, T., 2019, October. An axiomatic approach to block rewards. In Proceedings of the 1st ACM Conference on Advances in Financial Technologies (pp. 124-131). ACM.

Eckel, C.C. and Grossman, P.J., 2008. Men, women and risk aversion: Experimental evidenceHandbook of Experimental Economics Results1, pp.1061-1073.

Nakamoto, S., 2008. Bitcoin: A peer-to-peer electronic cash system. Unpublished white paper.

Footnotes

1 Ethereum is scheduled to adopt the Proof-of-Stake protocol, although there is no firm date yet.

2 Although some small (in terms of value) blockchains have been attacked, Bitcoin has not. In the Attacks on the Blockchain, we analyse some of the attacks that are possible, such as the 51% attack and selfish mining.

3 A more detailed exposition can be found in the report An Introduction to the Distributed Ledger Technology.

4 The Bitcoin reward halves every 210,000 blocks.

5 In Economics, a payment rule is usually called an allocation rule.

6 Chen et al. (2019) describe several alternative payment rules.

7 In the Attacks on the Blockchain, we discuss more types of attacks, such as selfish mining.

Disclaimer

Aaro Capital is the trading name of Aaro Capital Limited (“Aaro”), a private limited company, registered in England and Wales with number 11419585, whose registered office is at 62 Wilson Street, London, United Kingdom, EC2A 2BU. Aaro is not authorised or regulated by the Financial Conduct Authority ("FCA")

The material provided in this article is being provided for general informational purposes. Aaro Capital Limited does not provide, and does not hold itself out as providing, investment advice and the information provided in this article should not be relied upon or form the basis of any investment decision nor for the potential suitability of any particular investment. The figures shown in this article refer to the past or are provided as examples only. Past performance is not reliable indicator of future results.

This article may contain information about cryptoassets. Cryptoassets are at a developmental stage and anyone thinking about investing into these types of assets should be cautious and take appropriate advice in relation to the risks associated with these assets including (without limitation) volatility, total capital loss, and lack of regulation over certain market participants. While the directors of Aaro Capital Limited have used their reasonable endeavours to ensure the accuracy of the information contained in this article, neither Aaro Capital Limited nor its directors give any warranty or guarantee as to the accuracy and completeness of such information.

Please be sure to consult your own appropriately qualified financial advisor when making decisions regarding your own investments.