mechanism design challenges in cryptocurrency and blockchains · idea: instead of depositing eth,...
TRANSCRIPT
![Page 1: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/1.jpg)
Mechanism design challenges in cryptocurrency and blockchains
![Page 2: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/2.jpg)
Why are blockchains interesting?
![Page 3: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/3.jpg)
The “academic” reasons
● Blockchains are a very “pure” playground for implementing applications that run on economic incentives, experimenting and seeing the results
● Community with existing interest in market mechanisms, auctions, welfare optimization, etc
● Very easy to test and deploy
![Page 4: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/4.jpg)
The “social” reasons
● Blockchains allow us to build an entire new class of applications that are not like anything else that existed before
● Digital institutions with no central coordinator and not bound to any single jurisdiction
● Smart contracts as special-purpose “legal system” with very low enforcement costs… in some cases
● More open, free, inclusive alternatives to centralized apps and platform monopolies
![Page 5: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/5.jpg)
Challenges in designing public blockchains
![Page 6: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/6.jpg)
What does a public blockchain do?
![Page 7: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/7.jpg)
Simple blockchain
![Page 8: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/8.jpg)
● Create a chain of blocks● Each block contains a list of transactions● As the chain grows and solidifies over time, the
network agrees on an ever-growing consistent history● The history also determines a constantly evolving state
![Page 9: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/9.jpg)
Important goal: be decentralized.
![Page 10: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/10.jpg)
Byzantine Generals Problem (Lamport, 1982)
![Page 11: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/11.jpg)
Traditional BFT consensus, eg. PBFT
![Page 12: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/12.jpg)
Important goal: really be decentralized.
![Page 13: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/13.jpg)
Challenges
● The weight assignment problem: given a set of actors, how do we assign them weights?○ Cryptographic protocols have no access to roots of
trust, legal identity, etc etc. Anyone can create as many “accounts” as they want.
● The incentive problem: how do we encourage the actors to (i) participate (as opposed to not participating), and (ii) honestly follow the protocol (as opposed to acting in some faulty manner)
![Page 14: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/14.jpg)
Nakamoto PoW chain
![Page 15: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/15.jpg)
Desired properties of the consensus layer
● Convergence: new blocks can be added to the chain but blocks cannot be replaced or removed
● Validity: only valid transactions should be included in a block
● Data availability: it should be possible to download full data associated with a block
● Non-censorship: transactions should be able to get quickly included if they pay a reasonably high fee
![Page 16: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/16.jpg)
Security models
● In traditional fault-tolerance research, we make an honest majority assumption, and use this to prove claims about correctness of algorithms
● In cryptoeconomic research, we make assumptions about:○ Level of coordination between participants○ Budget of the attacker○ Cost of the attacker
![Page 17: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/17.jpg)
Security models
● Uncoordinated majority: all actors make choices independently, no actor controls more than X%
● Coordinated choice: most or all actors are colluding, though in second-layer systems we may rely on free entry from non-colluding actors
● Bribing attacker: all actors make choices independently, but an attacker can add their own money to influence participants’ payoff matrices
![Page 18: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/18.jpg)
1. http://bravenewcoin.com/assets/Whitepapers/Anonymous-Byzantine-Consensus-from-Moderately-Hard-Puzzles-A-Model-for-Bitcoin.pdf
2. http://fc16.ifca.ai/preproceedings/30_Sapirshtein.pdf
Model Fault tolerance / security margin
Honest majority¹ ~0.5 (as latency approaches zero)
Uncoordinated majority² ~0.2321
Coordinated majority 0
Bribing attacker ~13.2 * k budget, 0 cost
Fault tolerance of Bitcoin
![Page 19: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/19.jpg)
Fault attribution
![Page 20: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/20.jpg)
Types of faults
● Outbound message omission○ “I’m not going to vote”
● Inbound message omission○ “Vote? What vote? I didn’t hear about a vote”
● Equivocation○ “I vote A!” “I also vote B!”
● Invalid message faults○ “I vote Harambe!”
![Page 21: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/21.jpg)
Speaker/listener fault equivalence
![Page 22: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/22.jpg)
How do we reward correct behavior and penalize faults?
● Under attributability● Under non-attributability
![Page 23: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/23.jpg)
Desiderata
● Define a metric of “quality of a protocol execution”● Maximize d(penalties) / d(quality)● Griefing factor of a mechanism: if some participants
can sacrifice $1 to make others to lose $k, how high is $k?
● Protect against discouragement attacks: grief other participants, cause other participants to drop out, then attack more cheaply
![Page 24: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/24.jpg)
Unsolved problem: make a complete model of a cryptocurrency economy, including the possibility of free entry and exit to the set of consensus participants, and
try to maximize the cost of attack
![Page 25: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/25.jpg)
Block size economics
![Page 26: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/26.jpg)
● Any transaction that gets included in a block has several consequences:○ Utility to the sender○ Direct processing costs to nodes○ Impacts to “decentralization”, political externalities
![Page 27: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/27.jpg)
Transaction fee market:
● Users submit transactions, each chooses fee F● Block proposer chooses a bundle of txs to include● Simple model: block proposer can include up to N
transactions, chooses highest-fee-paying txs● More complex model: block proposer utility = sum(fees) -
cost(# of txs)
![Page 28: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/28.jpg)
The protocol designer’s challenge: set the supply curve.
![Page 29: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/29.jpg)
Option 1: fixed size limits
● Bitcoin: 1 MB (now 4,000,000 “weight units”)● Ethereum: 8,000,000 “gas”
![Page 30: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/30.jpg)
Main problem: extreme volatility in transaction fees
![Page 31: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/31.jpg)
![Page 32: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/32.jpg)
![Page 33: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/33.jpg)
![Page 34: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/34.jpg)
![Page 35: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/35.jpg)
Measuring social cost
● Direct cost to nodes○ Proportional to number of nodes
● Decentralization○ Increasing block size reduces number of nodes○ Increase to mining centralization
![Page 36: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/36.jpg)
![Page 37: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/37.jpg)
Uncle rates
![Page 38: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/38.jpg)
These three things are correlated:
● Price of cryptocurrency● Number of users● Transaction fee demand curve (in USD terms)
But not perfectly correlated….
![Page 39: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/39.jpg)
Other challenges
● Any “fixed in-protocol transaction fees” must be set in a cryptocurrency, which is itself volatile
● How to set relative prices of:○ Bandwidth○ Computation○ Long-term storage (see also: rent)
![Page 40: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/40.jpg)
Opportunities in using public blockchains
![Page 41: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/41.jpg)
Trust-free markets for outsourced computation
![Page 42: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/42.jpg)
Simple idea: save intermediate states
● Suppose we can represent y = f(x) as y=fn(fn-1(...(f1(x))...))● Submitter sends intermediate states of computation:
○ S1 = f1(x)○ S2 = f2(S1)○ ...
● Each fi can be computed within a transaction● Submitter also submits a deposit
![Page 43: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/43.jpg)
Simple idea: save intermediate states
● Within some challenge period, anyone can submit a “challenge index” i
● If Si+1 != fi+1(Si), then the challenger gets the submitter’s deposit
● If no challenges are made within the challenger period, submitter gets their deposit back plus a reward
![Page 44: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/44.jpg)
Is it profitable to cheat?
(submitter, challenger) Submitter computes fairly Submitter cheats
Challenger checks and challenges if needed
(r, -c) (-D, D)
Challenger does nothing (r, 0) (r, 0)
● Let: c = cost of computing, D = deposit, r = reward
![Page 45: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/45.jpg)
Finding the Nash equilibrium
(submitter, challenger) Submitter computes fairly Submitter cheats
Challenger checks and challenges if needed
(r-c, -c) (-D, D-c)
Challenger does nothing (r-c, 0) (r, 0)
● Let: Ps = prob submitter cheats, Pc= prob challenger checks
Rs = r-c + Ps (c - DPc ) Rc = Pc(DPs - c)
Ps = c/D Pc = c/D
![Page 46: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/46.jpg)
Extended idea: multi-step game
● Submitter submits (S0, S512,S1024) + deposit● Challenger disagrees with one of these answers (WLOG
say the first), submits (S0, S256,S512) + deposit● Submitter disagrees with one of these answers (WLOG say
the second), submits (S256, S384,S512) + deposit● …..● Challenger submits (S314, S315,S316), result verified on-chain
![Page 47: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/47.jpg)
See also: markets for...
● Storage○ High volume, lower availability○ Lower volume, very high availability
● Bandwidth○ High volume and/or low latency○ Lower volume, less latency needs, but very high
value (eg. censorship resistant messaging, blockchain transaction routing….)
![Page 48: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/48.jpg)
Decentralized oracles
![Page 49: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/49.jpg)
Example: Schellingcoin
● Goal: learn some fact about the outside world● Mechanism:
○ N participants submit a vote○ Majority result forwarded as answer○ Everyone who submitted a vote equal to majority
result is rewarded, everyone else penalized
![Page 50: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/50.jpg)
![Page 51: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/51.jpg)
P + epsilon attack
You vote 0 You vote 1
Others vote 0 P 0
Others vote 1 0 P
You vote 0 You vote 1
Others vote 0 P P + ε
Others vote 1 0 P
A bribing attacker can corrupt the Schellingcoin game with a budget of P + ε and zero cost!
Base game:
With bribe:
![Page 52: Mechanism design challenges in cryptocurrency and blockchains · Idea: instead of depositing ETH, we issue a dedicated token In any controversial decision between A and B, the token](https://reader033.vdocuments.us/reader033/viewer/2022050505/5f96bc9c451b3f40ef0bd722/html5/thumbnails/52.jpg)
Extension: “Subjectivocracy”
● Idea: instead of depositing ETH, we issue a dedicated token
● In any controversial decision between A and B, the token is split into two “mirror universes”○ In one, A voters rewarded, B voters penalized○ In the other, B voters rewarded, A voters penalized
● The market separately values the tokens of each “universe”