2y ago

22 Views

2 Downloads

934.06 KB

67 Pages

Transcription

The Economics of CryptocurrenciesJonathan Chiu11Thorsten Koeppl2Bank of Canada2Queen’s UEconomics of Payments IXNovember 2018Disclaimer: The views expressed are those of the authors and do not necessarily reflect the views ofthe Bank of Canada.Chiu & Koeppl – Cryptocurrencies1

IntroductionWhat We Do1) We formally model a cryptocurrency system according to theBitcoin protocol.IA ledger of digital balances updated in a decentralized fashion.Chiu & Koeppl – Cryptocurrencies2

IntroductionWhat We Do1) We formally model a cryptocurrency system according to theBitcoin protocol.IA ledger of digital balances updated in a decentralized fashion.2) We show that cryptocurrencies cannot achieve immediate and finalsettlement.IWhy? Need to avoid a double spending problem.Chiu & Koeppl – Cryptocurrencies2

IntroductionWhat We Do1) We formally model a cryptocurrency system according to theBitcoin protocol.IA ledger of digital balances updated in a decentralized fashion.2) We show that cryptocurrencies cannot achieve immediate and finalsettlement.IWhy? Need to avoid a double spending problem.3) We evaluate the efficiency of a cryptocurrency system.IPositive inflation is optimal while transaction fees should beminimized.ICurrently, welfare loss in BITCOIN of 1.4% of consumption,but potentially as low as 0.08%.Chiu & Koeppl – Cryptocurrencies2

Why Cryptocurrency is Special?

CryptocurrenciesWhy Cryptocurrency is Special?Chiu & Koeppl – Cryptocurrencies4

CryptocurrenciesWhy Cryptocurrency is Special?Physical TokensImmediate and Final SettlementChiu & Koeppl – Cryptocurrencies4

CryptocurrenciesWhy Cryptocurrency is Special?Digital TokensSubject to double‐spending problemsChiu & Koeppl – Cryptocurrencies5

CryptocurrenciesWhy Cryptocurrency is Special?Digital Currency with Trusted Third PartyB sends 1 to SChiu & Koeppl – CryptocurrenciesIntermediary6

CryptocurrenciesWhy Cryptocurrency is Special?Digital Currency without Trusted Third PartyB sends 1 to SminersNo central authority to keep recordChiu & Koeppl – Cryptocurrencies7

CryptocurrenciesHow Cryptocurrency works1. Consensus Protocolcompetition in the form of mining: “miners” compete to updatethe public ledger (i.e. Blockchain)the prob. of winning is proportional to the fraction ofcomputational power owned by a miner2. Reward Schemereward winning miners by seigniorage and transaction fees3. Confirmation Lagsdouble spending is discouraged by confirmation delayif a seller waits for N validations before delivering the goods, thebuyer needs to win the mining game N 1 times to revoke thetransactionChiu & Koeppl – Cryptocurrencies8

CryptocurrenciesHow Cryptocurrency works1. Consensus ProtocolIcompetition in the form of mining: “miners” compete to updatethe public ledger (i.e. Blockchain)the prob. of winning is proportional to the fraction ofcomputational power owned by a miner2. Reward Schemereward winning miners by seigniorage and transaction fees3. Confirmation Lagsdouble spending is discouraged by confirmation delayif a seller waits for N validations before delivering the goods, thebuyer needs to win the mining game N 1 times to revoke thetransactionChiu & Koeppl – Cryptocurrencies9

CryptocurrenciesBlockchainChiu & Koeppl – CryptocurrenciesA book containing the ledgerof all past transactions10

CryptocurrenciesBlockchainminersblock,Transactions broadcastedto the miners forvalidationChiu & Koeppl – Cryptocurrencies11

CryptocurrenciesBlockchainThe miner who firstcompletes the proof‐of‐work can updatethe blockchainminersblockChiu & Koeppl – Cryptocurrencies,12

CryptocurrenciesHow Cryptocurrency works1. Consensus ProtocolIcompetition in the form of mining: “miners” compete to updatethe public ledger (i.e. Blockchain)Ithe prob. of winning is proportional to the fraction ofcomputational power owned by a miner2. Reward Schemereward winning miners by seigniorage and transaction fees3. Confirmation Lagsdouble spending is discouraged by confirmation delayif a seller waits for N validations before delivering the goods, thebuyer needs to win the mining game N 1 times to revoke thetransactionChiu & Koeppl – Cryptocurrencies13

CryptocurrenciesHow Cryptocurrency works1. Consensus ProtocolIcompetition in the form of mining: “miners” compete to updatethe public ledger (i.e. Blockchain)Ithe prob. of winning is proportional to the fraction ofcomputational power owned by a miner2. Reward SchemeIreward winning miners by seigniorage and transaction fees3. Confirmation Lagsdouble spending is discouraged by confirmation delayif a seller waits for N validations before delivering the goods, thebuyer needs to win the mining game N 1 times to revoke thetransactionChiu & Koeppl – Cryptocurrencies14

CryptocurrenciesHow Cryptocurrency works1. Consensus ProtocolIcompetition in the form of mining: “miners” compete to updatethe public ledger (i.e. Blockchain)Ithe prob. of winning is proportional to the fraction ofcomputational power owned by a miner2. Reward SchemeIreward winning miners by seigniorage and transaction fees3. Confirmation LagsIdouble spending is discouraged by confirmation delayif a seller waits for N validations before delivering the goods, thebuyer needs to win the mining game N 1 times to revoke thetransactionChiu & Koeppl – Cryptocurrencies15

CryptocurrenciesNo confirmation lag (N 0)Time TGoods delivered on the spotSeller gets payment afterconfirmationminersChiu & Koeppl – Cryptocurrencies16

CryptocurrenciesNo confirmation lag (N 0)Time TGoods delivered on the spotSeller gets payment afterconfirmationminersminersBuyer perform secret miningto undo the paymentChiu & Koeppl – Cryptocurrencies17

CryptocurrenciesNo confirmation lag (N 0)Time TminersminersIf successful, buyer gets goodswithout paying the sellerBuyer perform secret miningto undo the paymentChiu & Koeppl – Cryptocurrencies18

CryptocurrenciesOne confirmation lag (N 1)Time TTime T 1minersGoods delivered after oneconfirmationSeller gets payment afterone confirmationChiu & Koeppl – Cryptocurrencies19

CryptocurrenciesChiu & Koeppl – Cryptocurrencies20

CryptocurrenciesOne confirmation lag (N 1)Time TTime T 1minersminersminersNeed tosecretlymine forN 1 2periodChiu & Koeppl – Cryptocurrencies21

CryptocurrenciesHow Cryptocurrency works1. Consensus ProtocolIcompetition in the form of mining: “miners” compete to updatethe public ledger (i.e. Blockchain)Ithe prob. of winning is proportional to the fraction ofcomputational power owned by a miner2. Reward SchemeIreward winning miners by seigniorage and transaction fees3. Confirmation LagsIdouble spending is discouraged by confirmation delayIif goods are delivered after N validations are observed, then thebuyer needs to win the mining game N 1 times to revoke thetransactionChiu & Koeppl – Cryptocurrencies22

CryptocurrenciesHow Cryptocurrency works1. Consensus ProtocolIcompetition in the form of mining: “miners” compete to updatethe public ledger (i.e. Blockchain)Ithe prob. of winning is proportional to the fraction ofcomputational power owned by a miner2. Reward SchemeIreward winning miners by seigniorage and transaction fees3. Confirmation LagsIdouble spending is discouraged by confirmation delayIif goods are delivered after N validations are observed, then thebuyer needs to win the mining game N 1 times to revoke thetransactionChiu & Koeppl – Cryptocurrencies23

CryptocurrenciesQuestionsTake as given the design of the cryptocurrency system:1. How well does it function as a payment system?2. How to optimally set policy parameters?e.g. currency growth, transaction fees3. How best to use it for different types of transactions?e.g. retail vs large valueChiu & Koeppl – Cryptocurrencies24

Model

ModelEnvironmentBased on Lagos and Wright (2005)Time is discrete: t 0, 1, 2, .Three types of agents.IB buyersIσB sellersIM minersBuyers and seller use balances recorded in a ledger to finance bilateraltrade.Balances in the ledger grow at rate µ and there are transaction fees τ .Chiu & Koeppl – Cryptocurrencies26

ModelProof-of-WorkM miners compete to update the ledger by solving a costlycomputational task with a random success rate.Miner i chooses computer power qi to maximize profitsρ(qi )R qi αwhereI R mining reward in real termsI α price of computer powerI ρ probability of winning given byqiρ(qi ) PMm 1 qmResults:PM1) Higher R induces higher mining activities m 1 qm M Q.2) As M , all rents R are dissipated.Chiu & Koeppl – CryptocurrenciesMicro27

ModelTradingDayN ighttbuyer:seller:IIDayt 1sell hbuy xsell xbuy hPreferencesIBuyer: εu(xt ) ht , where ε FISeller: c(xt ) htTradingIDay: buyer sells h to acquire balances zINight: spends d z to buy x from a sellerINext day: the seller uses d to buy hChiu & Koeppl – Cryptocurrencies28

ModelNight TradingDay MarketNight Markettn 0IIn 1n 2. . . .t 1n N̄In session 0, a buyer meets with a seller and makes atake-it-or-leave-it-offer (x, d, N )Iimmediate payment d in real balancesIx goods to be delivered after confirmations of the payment in Nconsecutive blocksAfter trade, the buyer can attempt to double spendChiu & Koeppl – Cryptocurrencies29

Incentives to Double Spend

Double SpendingTransactions in Lagos-Wrightn 0n 1 n 2. .n N. .n N̄start with(zb , zs )buyer offers(x, d)sellerrejectsacceptsChiu & Koeppl – Cryptocurrencies(zb , zs )(zb d, zs d)31

Double SpendingDouble-Spending Problemn 0n 1 n 2. .n N. .n N̄start with(zb , zs )buyer offers(x, d, N )sellerChiu & Koeppl – Cryptocurrencies32

Double SpendingDouble-Spending Problemn 0n 1 n 2. .n N. .n N̄start with(zb , zs )buyer offers(x, d, N )rejectsseller(zb , zs )accepts buyer chooses q0{zDouble Spending Problem}Chiu & Koeppl – Cryptocurrencies32

Double SpendingDouble-Spending Problemn 0n 1 n 2. .n N. .n N̄start with(zb , zs )buyer offers(x, d, N )rejectsseller(zb , zs )accepts buyer chooses q0secret mining fails(zb d, zs d(1 τ ))succeeds{zDouble Spending Problembuyer chooses q1}Chiu & Koeppl – Cryptocurrencies32

Double SpendingDouble-Spending Problemn 0n 1 n 2. .n N. .n N̄start with(zb , zs )buyer offers(x, d, N )rejectsseller(zb , zs )accepts secret mining failsbuyer chooses q0(zb d, zs d(1 τ ))succeeds{zDouble Spending Problembuyer chooses q1secret mining fails(zb d, zs d(1 τ ))succeedsbuyer chooses q2}Chiu & Koeppl – Cryptocurrencies32

Double SpendingDouble-Spending Problemn 0n 1 n 2. .n N. .n N̄start with(zb , zs )buyer offers(x, d, N )rejectsseller(zb , zs )accepts secret mining failsbuyer chooses q0(zb d, zs d(1 τ ))succeeds{zDouble Spending Problembuyer chooses q1secret mining fails(zb d, zs d(1 τ ))succeedsbuyer chooses q2secret mining fails(zb d, zs d(1 τ ))succeedsbuyerchooses qN}Chiu & Koeppl – Cryptocurrencies32

Double SpendingDouble-Spending Problemn 0n 1 n 2. .n N. .n N̄start with(zb , zs )buyer offers(x, d, N )rejectsseller(zb , zs )accepts secret mining failsbuyer chooses q0(zb d, zs d(1 τ ))succeeds{zDouble Spending Problembuyer chooses q1secret mining fails(zb d, zs d(1 τ ))succeedsbuyer chooses q2secret mining fails(zb d, zs d(1 τ ))succeedsbuyerchooses qNsecret mining fails(zb d, zs d(1 τ ))succeeds(zb , zs )}Chiu & Koeppl – Cryptocurrencies32

Double SpendingNo Double Spending ConstraintFor any contract (x, d, N ), the expected payoff from a DS attempt is!Nn 1XYβqnD0 (d, N ) max P [d R(1 N )] αqnµQM qn{qn }Nn 0n 0t 0whereP N Yn 0R qnQM qn is the prob. of successZ(µ 1) Dτare the rewards form miningN̄ 1LemmaIf D0 (d, N ) 0, then the contract (x, d, N ) is double-spending proof.Chiu & Koeppl – Cryptocurrencies33

Double SpendingDouble-Spending Proof ContractsPropositionSuppose M . A contract (x, d, N ) is double-spending proof (i.e.settlement is final) ifd R(N 1)N .Otherwise, the settlement is final only with probability1 P (d, N ) qN 1dR. (N 1)Results:ISettlement cannot be both immediate (N 0) and final (P 0).IRewards help discourage double spending and improve finality.IThere is a trade-off between trade size d, settlement lag N andfinality 1 P .Chiu & Koeppl – Cryptocurrencies34

Double SpendingKey Trade-off1Finality (1-P)0.80.60.40.201085000640003000420002delay (N)100000trade size (d)Figure: Trade Size vs. Settlement Lag vs. FinalityChiu & Koeppl – Cryptocurrencies35

Double SpendingCryptocurrency EquilibriumDefinitionA DS-proof cryptocurrency equilibrium with (µ, τ ) and M isgiven by contracts (x(ε), d(ε), N (ε)), money demand z(ε) and amining choice q such that1. the contracts satisfy the No-DS-constraint,2. the money demand and the offer maximizes a buyer’s utility,3. the mining choice maximizes a miner’s utility4. and markets clear.TheoremProofA DS-proof cryptocurrency equilibrium exists for B sufficiently large.Chiu & Koeppl – Cryptocurrencies36

Double SpendingOptimal Reward SchemeDefine social welfare asZβW B [σδ N (ε) εu(x(ε)) x(ε)]dFε (ε) R(N̄ 1)µ{z} {z}trade surplusmining costsPropositionThe optimal reward structure sets transaction fees to zero and onlyrelies on seignorage: τ 0 and µ 1.Chiu & Koeppl – Cryptocurrencies37

Double SpendingOptimal Reward SchemeDefine social welfare asZβW B [σδ N (ε) εu(x(ε)) x(ε)]dFε (ε) R(N̄ 1)µ{z} {z}trade surplusmining costsPropositionThe optimal reward structure sets transaction fees to zero and onlyrelies on seignorage: τ 0 and µ 1.IIThe reason is that the inflation tax is shared by all buyers whiletransaction fees are paid only by the active ones who have a highvaluation of money. levying reward costs upfront in terms of inflation allowsdistortions to be smoothed out across all buyersChiu & Koeppl – Cryptocurrencies37

Double SpendingOptimal Reward SchemeDefine social welfare asZβW B [σδ N (ε) εu(x(ε)) x(ε)]dFε (ε) R(N̄ 1)µ{z} {z}trade surplusmining costsPropositionThe optimal reward structure sets transaction fees to zero and onlyrelies on seignorage: τ 0 and µ 1.IIIThe reason is that the inflation tax is shared by all buyers whiletransaction fees are paid only by the active ones who have a highvaluation of money. levying reward costs upfront in terms of inflation allowsdistortions to be smoothed out across all buyersImplication: long-run zero currency growth is suboptimalChiu & Koeppl – Cryptocurrencies37

Quantitative Assessment

QuantitativeCalibration – Basic 250.00008868734280.01781targetsperiod length 1 dayblock time 10 minmoney growth (9.6% p.a.)total fees/vol per blockmax. # of average-sized transactionsvol per day/total BTCnormalizedSource: 2015 data from Blockchain.infoIWe use log utility.IWe use data on the distribution of transactions.IConfirmation lags cannot be observed directly.DetailsChiu & Koeppl – Cryptocurrencies39

Quantitative1. Welfare ComparisonRegimeWelfare Cost as % of consumptionCash (Friedman Rule)Cash (2% inflation)0%0.003%1.410%mining cost: 359.98 millions0.080%mining cost: 6.9 millionsBitcoin (benchmark)µ 1 9.5%, τ 0.0088%Bitcoin (optimal policy)µ 1 0.17%, τ 0%IWelfare loss is currently very large mainly due to the miningcost.I. can be reduced substantially by lowering money growth andsetting transaction fees to zero.ILong-run BTC design will bring money growth to 0 and is, thus,inefficient.Chiu & Koeppl – Cryptocurrencies40

Quantitative2. Best Usage of Cryptocurrency Technologyavg transaction sizeannual volumeoptimal µoptimal τconfirmation lagwelfare lossmining cost (per year)IRetail Payments(US Debit cards) 38.2959539 millions0.038%0%2mins0.00052% 4.33 millionsLarge Value Payments(Fedwire) 6552236135 millions0.53%0%12mins0.0060% 22.10 billionsDS-proof iff d R · N (1 N )IIretail: small trade size, high volumeinterbank: large trade size, low volumeretial system incurs a lower welfare loss and mining costs. requires smaller rewards. induces shorter confirmation lagsChiu & Koeppl – Cryptocurrencies41

Quantitative2. Best Usage of Cryptocurrency Technologyavg transaction sizeannual volumeoptimal µoptimal τconfirmation lagwelfare lossmining cost (per year)ILarge Value Payments(Fedwire) 6552236135 millions0.53%0%12mins0.0060% 22.10 billionsDS-proof iff d R · N (1 N )IIIRetail Payments(US Debit cards) 38.2959539 millions0.038%0%2mins0.00052% 4.33 millionsretail: small trade size, high volumeinterbank: large trade size, low volumeretial system incurs a lower welfare loss and mining costs. requires smaller rewards. induces shorter confirmation lagsChiu & Koeppl – Cryptocurrencies42

Quantitative2. Best Usage of Cryptocurrency Technologyavg transaction sizeannual volumeoptimal µoptimal τconfirmation lagwelfare lossmining cost (per year)IIIILarge Value Payments(Fedwire) 6552236135 millions0.53%0%12 mins0.0060% 22.10 billionsDS-proof iff d R · N (1 N )IIRetail Payments(US Debit cards) 38.2959539 millions0.038%0%2 mins0.00052% 4.33 millionsretail: small trade size, high volumeinterbank: large trade size, low volumeretial system incurs a lower welfare loss and mining costs. requires smaller rewards. induces shorter confirmation lagsChiu & Koeppl – Cryptocurrencies43

ConclusionWhat to Take Away1) Owing to its digital nature, a cryptocurrency is fundamentallydifferent from cash.2) One can understand the economics of such a system well bylooking at the incentives to double-spend.3) BITCOIN is not only really expensive in terms of mining costs,but also inefficient in its long-run design.4) It provides a more efficient payment system when the volume oftransactions is large relative to the individual transaction size.On-going project: Blockchain for security settlement, cross-borderpayments, .Chiu & Koeppl – Cryptocurrencies44

Thanks!

Appendix

Microfoundations for MiningInvesting computing power qm allows a miner to solve the PoWproblem with probabilityF (t) 1 e µm ·twithin a time interval t, where 1/µm D/q(m) is the expected timeto solve the problem.Hence, D is the difficulty parameter for the PoW problem.The first solution among miners, min(τ1 , . . . , τM ), is thus alsoexponentially distributed and the probability for any miner to solve itfirst is given byqn.ρn (qn ) PMm 1 qmBackChiu & Koeppl – Cryptocurrencies47

Oligopolistic Mining EquilibriumMaximizing profits by miner j yields as a FOC PN i 1 qi qj β P 2 R αµNqii 1Imposing symmetry, we obtain for the total mining costC αM Q M 1βR.M µFor M all rents are dissipated and we obtainC βRµBackChiu & Koeppl – Cryptocurrencies48

TradingDayN ighttbuyer:Dayt 1sell hseller:buy xsell xbuy hTwo marketsI centralized market in dayI decentralized market at nightPreferencesIIBuyer: εu(xt ) ht , where ε FSeller: xt htTradingIIIDay: buyer sells h to acquire real balances zNight: spends d z to buy x from a sellerNext day: the seller uses d to buy hChiu & Koeppl – Cryptocurrencies49

Day MarketDay MarketNight Markettn 0n 1n 2. . . .t 1n N̄The value of a buyer who draws ε ismax h V (z 0 ; ε)0z ,hsubject toh z z0 0where z 0 are the real balances carried to the night market.Assumption:Transactions can be perfectly monitored and there is full liability sothat double spending is not a problem.Chiu & Koeppl – Cryptocurrencies50

Night MarketDay MarketNight Markettn 0n 1n 2. . . .t 1n N̄The night market is divided into N̄ 1 trading sessions.IIn session 0, a buyer meets with a a seller w.p. σ and makes atake-it-or-leave-it-offer (x, d, N ).IThere is immediate payment d in real balances.Ix goods are to be delivered after confirmation of the payment inN consecutive blocks.The offer (x, d, N ) determines whether the buyer has an incentive toBackdouble spend or not.Chiu & Koeppl – Cryptocurrencies51

Optimal DS Proof ContractsAt the start of the night market, the buyer with z makes atake-it-or-leave-it offer (x, d, N ) to a seller.The buyer will never carry more real balances than necessary so thatz d and the offer is given by (x(d), N (d)).Requiring the offer to be double spending proof the buyer solvesmax d V (d; ε)(x,d,N )subject toβV (d; ε) σδ N εu(x) (1 σ) dµβx d(1 τ )µd R(N 1)NChiu & Koeppl – Cryptocurrencies52

Sufficient Condition for DS proofThe optimal contract is DS proof ifσ [δεmax u0 (x̄)(1 τ )E(x) 1] iwherex̄ (1 τ )2Ris the maximum trade size with N 13E(x) is the elasticity of x w.r.t. d at N 14The reason is that the tightest constraint to avoid DS is aconfirmation lag of N 1.This condition is satisfied whenI the opp. cost of carrying balances is high (i is high)Ithe matching friction is high (σ is low)Ithe marginal utility is low (ε is low)BackChiu & Koeppl – Cryptocurrencies53

Existence ProofWe use Kakutani’s Fixed Point Theorem.Fix (µ, τ ). The reward R determines the aggregate money supplyS(R) which in turn determines total rewards R0 . Hence, we need tofind a fixed point for R given aggregate money demand for acorrespondence (µ 1) στS(R).T (R) N̄ 1Aggregate money demand can be shown to be u.h.c, convex in Rwhich pins down the aggregate transaction fees and, hence, R0 .Furthermore, given B sufficiently large, we can find a lower bound onRmin 0 such that R Rmin .Hence, we can restrict the correspondence to a compact set and showthat the correspondence has a closed graph.BackChiu & Koeppl – Cryptocurrencies54

Optimal ContractsWe use data on transactions to recover the implied distribution of 00 15 10 505log(ε)Figure: Implied Distribution of Shocks100 1510 1010 5010510101010xFigure: Optimal DelayBackChiu & Koeppl – Cryptocurrencies55

Optimal Design I – Effects of Money Growth .8846102.57x 109.884730Utilityx 10Wgt. Avg. Nσ B E(x)2.5859.884600.020.049.884500.020.0400.020.046x elfare9.8844Mining Cost9.884600.020.04000.020.040IHigher inflation implies distortions and higher mining costs .I. but positive inflation is optimal due to lower confirmation lags.Chiu & Koeppl – Cryptocurrencies56

Optimal Design II – Effects of Transaction Fees56x 10Wgt. Avg. Nσ B 500.051.50.19.8849.883500.050.19.88369.885x 102002.5Mining 10.59.860.05x 1029.8750049.889.855x 1000.050.100ISame trade-off .I. but zero transaction costs seem to be optimal given µ 0.BackChiu & Koeppl – Cryptocurrencies57

buyer needs to win the mining game N 1 times to revoke the transaction Chiu & Koeppl { Cryptocurrencies 8. Cryptocurrencies How Cryptocurrency works 1.Consensus Protocol I competition in the form of mining: \miners" compete to update the public ledger (i.e. Blockchain)

Related Documents: