Tuesday, February 5, 2019

The Economics Of Bitcoin Transactions

Izabella Kaminska's BIS trolls bitcoin reports on analysis of the economics of Bitcoin transactions from Raphael Auer at the Bank for International Settlements. She starts:
Bitcoin aspires to take over the world. But as we all know (according to poorly sourced conspiracy forums), the world is currently run by the Bank of International Settlements (BIS), the central bank to central banks. That means Bitcoin needs to displace the BIS in the near future if it is to get anywhere.

But it takes one to know one.

So here's the dominant global payments system calling out the aspiring global payments system in an excellent piece of professional trolling this week
Auer's is indeed an excellent piece of work. Follow me below the fold for some details.

Kaminska notes the fact that each transaction is in a blind auction with all the pending transactions for inclusion in the next block:
This means you're a mug if you pay a high fee to get your bitcoin transaction processed more quickly because you can never be sure you're paying a fair price.

In the world of bitcoin, urgent transactions subsidise non-urgent transactions.

This might be justifiable if payment urgency was somehow a reflection of status, wealth or hierarchy, but it's not. Poor people need to make urgent payments just as often as the wealthy. A payment network which depends on gouging the desperate to run efficiently, while giving free gifts to the non-desperate is no basis for a system of money. It's all made worse, according to the BIS, by the fact that one's excessive payment in one block can't even guarantee settlement finality. That depends not just on your block being mined successfully but subsequent ones too, which you cannot influence at all.
That is part of Auer's analysis, which asks two questions:
First, how efficient is the fundamental architecture of deterring forgeries via costly proof-of-work? And second, can the market for transactions actually generate rewards that are valuable enough to ensure that payment finality is really achieved?

Analysing these two elements uncovers fundamental economic limitations that cloud the future of cryptocurrencies based on proof-of-work. In sum, with the current technology, it is not even clear whether such cryptocurrencies can keep functioning as they do at the time of writing. This statement is unrelated to well known restrictions on the scale of such payment systems or the volatility of cryptocurrencies. Rather, it concerns the fundamentals of Nakamoto’s updating process, which has two limitations that interact in a fateful manner.
The TL;DR is simple:
The key takeaway of this paper concerns the interaction of these two limitations: proof-of-work can only achieve payment security if mining income is high, but the transaction market cannot generate an adequate level of income. ... the economic design of the transaction market fails to generate high enough fees. A simple model suggests that ultimately, it could take nearly a year, or 50,000 blocks, before a payment could be considered “final”.
Auer's first question arrives at a similar conclusion to Eric Budish, namely that the value of transactions in a block must be low relative to the block reward plus fees:
The first limitation is that proof-of-work axiomatically requires high transaction costs to ensure payment finality ... Counterfeiters can attack bitcoin via a “double-spending” strategy, ie spending in one block and later undoing this by releasing a forged blockchain in which the transactions are erased.

This paper starts by introducing the concept of “economic payment finality” in the blockchain. That is, a payment can be considered final only once it is unprofitable for any potential adversary to undo it with a double-spending attack. ... If the incentives of potential attackers are analysed, it is clear that the cost of economic payment finality is extreme. For example, to achieve economic payment finality within six blocks (one hour), back of the envelope calculations suggest that mining income must mount to 8.3% of the transaction volume – a multiple of transaction fees in today’s mainstream payment services.
Auer's different model of an attack results in a different criterion than Budish, but the basic idea is the same:
double-spending is very profitable. In fact, attackers stand to gain a much higher bitcoin income than does an honest miner. While honest miners simply collect block rewards and transaction fees, counterfeiters collect not only any block rewards and transaction fees in the forged chain, but also the amount that was double-spent, ie the value of the voided transactions. This “attacker advantage” ultimately translates into a very high required ratio for miners’ income as compared with the transaction volume (the amount that can be double-spent).
Budish assumed, as is currently the case, that transaction fees form a small part of miners' income. Auer extends this by combining two strands of previous work:
Note that Huberman et al (2017) examine congestion in the market for transaction fees while assuming that “the mining resources are sufficient to guarantee the system's reliability and security” (see p 4), a focus very similar to Easley et al (2018). In contrast, Budish (2018) examines the economics of security, ie of double-spending attacks, but not how mining income is determined. In this paper, I combine these approaches to show how the economics of security and the market for transaction fees interact, ie how the market of transactions determines payment security and what this implies for the future liquidity of bitcoin.
As the mining rewards diminish, transaction fees would have to increase if miners' income were to continue providing reasonable security:
The second fundamental economic limitation is that the system cannot generate transaction fees in line with the goal of guaranteeing payment security. Either, the system works below capacity and users’ incentives to set transaction fees are very low, or the system becomes congested ... Underlying this is a key externality: the proof-of-work and hence the level of security is determined at the level of the block one’s transaction is included in, with protection also being provided by the proofs-of-work for subsequent blocks. In contrast, the fee is set by each user privately, hence creating a classical free-rider problem, amounting to a veritable “tragedy of the common chain”. While each user would benefit from high transaction fee income for the miner, the incentives to contribute with one’s own fee are low.
As is already evident among the smaller alt-coins, the rise of a rental market for hash power has dramatic effects on the security of the system:
Note that the economic attack vector outlined above crucially assumes that any amount of hash power can be rented at short notice. Up to December 2018, this would only have been a realistic possibility for cryptocurrencies with a modest network of users (some of which were, in fact, attacked), but not for Bitcoin. Since then, however, as the price of bitcoin has collapsed, many miners located in countries with high energy costs can no longer recover the cost of electricity and have turned off their equipment, as is evident from the decline in the total hash power of Bitcoin’s network of miners ... As a result, the surplus of mining equipment that could be switched on any time for high-return double-spending attacks might even bring an attack on Bitcoin within the realms of possibility. And this issue is set to intensify during mid-2020, when the block rewards are halved, pushing further mining equipment out of the regular mining market.

Furthermore, other forms of attack on bitcoin have become substantially cheaper in recent months. As an extreme example, consider how expensive it would be to amass equipment that, in total, would wield 101% of the hash power of all current bitcoin miners. This could then be used to launch double-spending attacks and essentially hold Bitcoin hostage. Although substantial, the cost of doing this has come down dramatically, not just because the hash rate of bitcoin’s network of miners has peaked, but thanks mainly to the steep recent fall in the price of mining equipment.
In the future, when transaction fees have displaced block rewards, the blind auction for inclusion in a block malfunctions:
from an economic point of view, the consideration in Nakamoto (2008) that waiting time adds exponentially to the security of bitcoin payments does not hold true: equation (8) shows that waiting times only add linearly to the cost of a forgery, so that the system can sustain low transaction costs only by means of extremely long waiting times. This second consideration is crucial for Bitcoin’s future, ... The key result is that the fee set on a decentralised basis is much lower than the optimal fee ... resulting in extreme waiting times.
Auer goes on to discuss the Lightning network:
There are two sets of key concerns. The first is of a technical nature and beyond the scope of this paper – it relates to what is required to deter potential attacks on this specific architecture and whether all participants need to be online all the time for payments to be routable.

The second concern relates to economic network theory on the trade-off between efficiency and centralisation. If the Lightning Network remains truly distributed, it would require substantial pre-funding. For example, if routing a payment from A to B typically involves four intermediate channels, it would in total require preloaded values five times as large as the actual payment amount. And it is uncertain whether a typical user, who might upload, say, USD 200 to finance small expenses, would also be willing to foot another USD 800 just to support the network’s routing capacity.
As I discussed in Techno-Hype part 2.5, the routing problem is far more difficult than Auer implies, and even without considering Auer's economic argument would have forced the Lightning Network into a hub-and-spoke configuration, which is where it has ended up. See also Shitcoin And the Lightning Network for the experience of actually running a Lightning hub.

Especially when combined with Eric Budish's work, this is a very important paper. And it has a very useful 3-page bibliography.


David. said...

Colin Platt's behavioral economics perspective is well worth considering. How I became a Crypto Quadrillionaire without writing a single line of code… starts:

"People that know me know that I think that most “crypto tokens” are a joke. While there certainly are innovations in this wild-world of cryptographic ledgers and even some of the coin based projects built on top of them, for each one of those there are at least 1000 absolute garbage projects. When those projects have tokens or coins, we affectionately call them “shitcoins” in the business. Their only real value in this world is to speculate on a price rise then dump on less sophisticated and unsuspecting n00bs, turning them into your bagholders who have lost so much money they only have an unshakeable belief in the vision you made up left. As my friend Tim Swanson and I have joked, those that have figured this out, and mastered this cycle become “coin nihilists”:"

He then lays out the story of PitchToken Klassic (PTK) which, thanks to a little wash trading, rose:

"from $0 to, a rather respectable, $3.6 Quadrillion after a mere 3 days."

As Izabella Kaminska points out, this is roughly 3 times world GDP.

David. said...

Nicholas Weaver's interview in Breaker makes some good points, including (my emphasis):

"The problem with cryptocurrency is it’s basically a Venn diagram: those who don’t understand economics intersected with those who don’t really understand computer security. The cryptocurrency defenders tend to attack economists with “Oh, you don’t understand the technology.” And Roubini is really willing to push back against those arguments, because, well, those arguments are irrelevant. The problems with the cryptocurrencies are really economic, not technical."

Something I've been saying since at least 2014.

David. said...

China is kicking out Bitcoin mining — what happens next is David Gerard's take on today's not-breaking cryptocurrency news. As he writes:

"This isn’t new — China started pushing the miners out over a year ago."


"The risk to Bitcoin in the longer term is other governments taking their cue from China — and taking Proof of Work more seriously as a problem that needs to be dealt with.

The hashpower that went offline in November shows how to mitigate Proof of Work’s reprehensible effects — make Bitcoin mining uneconomical."

Other governments are starting to take it seriously:

"Missoula County, Montana proposes to require that new crypto mining projects offset their energy use by funding or building new renewable projects. Trivially evadable, but may be worth setting as an expectation.

Grant County Public Utility District in Washington is allowed to charge crypto miners a 400% rate premium. This is necessary because it turns out in practice that crypto miners don’t in fact incentivise green energy, but swoop in, max out local hydro power capacity, then swoop out."

David. said...

David Gerard reports on today's release by the US Financial Crimes Enforcement Network (FinCEN) of Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies. It relates mostly to obligations under the Bank Secrecy Act incurred in the process of transmitting value using cryptocurrencies. It looks likely to apply to all possible cryptocurrency exchanges, ICOs, etc. requiring them to observe the Know Your Customer/Anti-Money Laundering laws and other restrictions that cryptocurrencies were invented to evade. And in particular it looks like a death knell for the Lightning Network:

"The FinCEN paper doesn’t mention the Lightning Network at all. But it seems obvious to me, and others, that running an intermediary node would really obviously involve money transmission, would not hit any listed exemption, and would require you to engage in anti-money-laundering compliance to the full extent of the BSA."

David. said...

Izabella Kaminska's How blockchain takes us back to medieval times starts:

"The marketing spiel about ... distributed ledger technology (DLT) often promises to liberate financial institutions from the costly burden of having to pledge billions of dollars in margin to clearing houses on the basis that trades complete instantaneously, meaning counterparty risks are eliminated.

But this, according to a new report by Greenwich Associates' Ken Monahan, is a wrong-headed way to think about things. Monahan, who in other respects is quite complimentary of DLT, notes that in most cases those savings arguments are moot. This is because what real-time gross settlement of securities offers with one hand it simultaneously takes away many times over with the other hand in terms of pre-funding costs."

The report points out the similarity between the various "blockchain instantaneous settlement" ideas and the economic disaster that ensued after the Venetian Senate mandated pre-funding of transactions in 1584.

David. said...

David Gerard notes that:

"A quarter of Lightning Network channels have closed since March 2019 — from 36,200 to 28,000. Reddit comment: “And that is what basically no one talks about. In practice, the LN channels are uni-directional. From small players like myself to large players like gatecoin, bitstamp, etc. There is no channel capacity on the receiving side. Only sending.”

David. said...

In Bitcoin’s Fatal Flaw: The Limited Adoption Problem, Franz J. Hinzen and Kose John of NYU's Stern School, and Fahad Saleh of McGill University's Desautels School have published a model of the economic behavior of Proof-of-Work blockchains that reinforces Auer's conclusions. Their abstract reads:

"Bitcoin remains sparsely adopted even a decade after its birth. We demonstrate theoretically that this limited adoption arises as an inescapable equilibrium outcome rather than as a transient feature. We establish such a result for a wide class of blockchains that employ Proof-of-Work. Our results arise due to three features: (1) an artificial supply constraint, (2) free entry to the validator network,and (3) a need for consensus. Network delay precludes relaxing the supply constraint as a solution. Nonetheless, we demonstrate that permissioned blockchains may obtain widespread adoption, thereby highlighting the need for research on alternatives to Bitcoin."

I'm skeptical that the theoretical advantages their model shows for Proof-of-Stake would be realized in practice, as the history of Ethereum shows.