Strategic Behavior in Cryptocurrency Protocols with Matt Weinberg | a16z crypto research talks

Transcript

all right um so welcome everyone today we have uh Matt Weinberg from Princeton uh telling us about selfish pineapples also thanks um so let me start uh by just taking one read a cover in this haul so the first half I don't know how many people here were at um the block I gave last week but first bit is going to be destroying so what I want to talk about first are just incentive challenges that arise when mining incentives vary our mining rewards vary so what I'll do first is uh we'll discuss kind of like why that might happen and I'll actually pause in case people have questions or just want

to contribute to that part of the policy I will uh sorry a lot now we'll just go into some examples of um what can go wrong and I'm going to postpone the formal model till the second part the second part is going to follow up on the talk I gave last week on selfish mining um I will give a very quick recap of the relevant stuff from last week but it is definitely going to build on that and what I'm going to focus on are just like all these other models besides the core Bitcoin model and all the different ways in which strategic mining so let me uh dive into what happened to my online work area so like I said I am

going to pause on this slide in case people want to either ask questions or contribute their own example of why this might arise so um okay so in classic uh Bitcoin right so Bitcoin is not a trend complete cryptocurrency so that means that the way that miners got rewards they get rewards only from the transaction fees or the block reward and the classic Bitcoin that um you know when this the work I did uh what's happening the transaction fees were also very normal so kind of like the plastic model is you have this blocker board now it's 6.25 Bitcoin you got 6.25 Bitcoin um and what we want to look at is what

happens if different blocks are worth different amounts for whatever reason so for example maybe some block is worth one some block is worth 10. and the main conclusion that I'm gonna the main conclusion um that I want to draw on this part of the talk is that strategic mining is way more of a problem when the block rewards vary so right now I'm just going to give some examples of that um but first first okay I will um just kind of quickly discuss why do mining rewards vary so I'm aware of like two main driving reasons which is just

the ones I put up on the slide um one is just that uh the intent even for um protocols like Bitcoin the intent is eventually there is not going to be a block report right and maybe um the next time the block reward halves maybe the transaction fees will finally start dominating the block Rewards um so the and then just by nature of you know the mempool looks different at different points in time and so the set of available transactions is going to be different at different points in time when you create a block depending on what the medical looks like it's going to be worth different amounts so um that's one reason why the block rewards might vary and this was the um uh the main uh the original motivation for this work

and uh all right so we can get this um okay so um the um another reason that might happen now so I learned the terminology of motivation um a little bit more precisely from Tim recently um but you know on ethereum or any other term complete um cryptocurrency just by the nature of the transactions there's all this interaction with various smart contracts and who knows what's going to happen but that it could be that based on who includes those transactions in their block that's going to trigger something in a smart contract and if you're the miner who notices that and

you're the one who can access that money then maybe you get um some reward from that so my understanding is a term that's used for this it's minor extractable value and it just refers to the concept that it could be because of the specific nature of the smart contracts and the transactions that you're including in your blog there is some value that you as a first person who noticed that or you is the person who controls the contents of the block can get for yourself and this is outside the official transaction team um so maybe before going on I will quickly pause here in case there are either questions about this motivation um or um in case someone else wanted to add um another reason and I'll just pause for a second just in

case and otherwise I will now move on okay so hopefully that um uh hopefully that is convincing so I guess I'm just to clarify so like one thing that could be happening is if the black reward is changing that would be like the Bitcoin story uh the transaction piece who does what they're doing another one will be the Blackboard is fixed the transaction fees maybe grow a lot over time that's also integrated both of those cases would be sort of in a different region than we've been in historically is that that's correct yeah sorry let me just um uh repeat what um that he's saying is um one thing that could change as it does on bitcoin is the block reward is happening it's getting lower over time

so by that happening the block reward is getting smaller even if a transaction fees don't change they're just going to become the main source of Revenue and separately it could just be that the transaction fees go up for some reason due to high demand but the transaction fees themselves will just naturally change over time that once you start having reward coming from a transaction fees there's no reason to expect that every time a block is created the mempool has exactly the same set of transactions all the time that you should expect it all right see something in the chat yeah uh okay that's a really good question so

I guess sorry the question is is MVB only meant to uh only meant to mean incidental sources of additional Revenue Does it include intentional or bribes um so I don't know uh Tim if you want to give an answer after me but I guess I was imagining the interesting distinction being between something that every person can obviously recognize as like this is intended part of the protocol this person um clearly intended to pay any any person who creates this block I would count that in the the transaction fees whether it was like a bribe or you know like at that point I would say

like why not just add a like include it as a transaction fee um for the Mev I was imagining stuff like anything that's not kind of like like anything that that like failed to have that property where it's sort of like it's part of the protocol everyone accepts that you're supposed to pay something to be included in the blog any minor will easily recognize that or any onlooker will easily recognize that this is um so I guess that's maybe the distinction I had in mind I don't know if um that was his name okay uh Mev could also Target uh yes so yeah could also part so sorry the question

with Mev could also Target specific minor I would also include um that I guess maybe the the the thing that I would want to happen is that like um whether or not you can collect that nav should depend on sort of like the set of transactions somehow it shouldn't be that there's this transaction out there that you can collect no matter when you find it it's just someone's paying to like Advocates it's not really related to me you don't need to be strategic about it we'll just get that one okay I'm imagining something like um it could be specific to a minor but it should somehow depend on like they need to put their transactions together in a certain way they need to mind this block now instead of later they need to find

the point to this is something good um thanks for the question okay so now I will move on and okay so um what I am going to do I'm gonna um just to show you kind of like what the context was like six years ago um I was working on this I just decided to copy the slides I added um so the motivation for this right is that um at the time the current state of Bitcoin was uh this is even before the most recent happened so this was a 12

and a halfway point that was a block reward and maybe there was a little bit of variance in the transaction fees but they were pretty nominal and so you really got pretty close to 12 and a half everybody and then what is supposed to happen eventually is the block reward will get all the way down to zero and what that means is that now the transaction fees if it differs from block to block instead of just you know like changing one or two percent of the revenue you get now it's changing a very significant fraction of the revenue that you're getting so um at the time there was like this huge debate about like what block size uh Bitcoin

and part of that debate like one of the motivating factors for that they was like well you know the block size needs to be somewhat small in order to make sure that people have to pay something and so that was like a very passionate discussion and what was like not at all discussed at the time was like well you know let's say if you get the transaction fees to rise and be stable so maybe I really believe that there's going to be you know like a steady stream of people who are willing to pay the right amount of fees over time and I really believe that in expectation every block is going to be worth 12 and a half I really believe that the miners are comfortable maximizing their expected rules

um the general sense in the community was it is really was not an ideal deal and you know there is some possible justification for that which is like it is true that if the miners are using the same strategy and then I tell you in one model you're being paid 12 and a half deterministically every block in another model I tell you you're being paid 12 and a half in expectation if there's some variance the miners are risk neutral they really don't care right similarly you know this is the whole point is this is going to happen over a very long period and just like due to the law of large numbers they'll basically get the same thing anyway right so if they use the same strategies there's really no difference and

um the oops okay um but kind of like the main point is that there's no reason you should expect these are two different games there's no reason you should expect people to use exactly the same strategies and the biggest takeaway is this Bullet at the bottom which is that now you can use strategies that are different depending on the fees that are included in a block okay so I'll elaborate on the next couple slides all these different ways in which you can do this um but there's there's lots of different ways that you can do this there's lots of richer stuff you can do and and uh you know like basically the point is it's really really really different than when the reward is just fixed

um so I see that there's something in the chat I'm just kind of trying to quickly read that okay I think the what's in the discussion is a little bit sophisticated enough that I need energy to process it so let me get back to that maybe at the next one but I would definitely um Okay so let me give you now um some of these examples so okay so um remember that like you know the basic um uh mortgage chain protocol says whenever you're trying to build a block please point to the furthest you know please point to the longest chain and the there's this default high-breaking rule which says please just break prize

in favor of the person you've heard about right so forth for example um if you were to find yourself in this situation let me just quickly explain the picture in the picture this means that this block has seven transactions seven uh whatever is of transaction fees in it this has 15 this has 10 and this means in the uh mempool there's five uh fees worth of transactions left and here there's 10 because there's five fewer included here than in here and if you heard about the block on the top before the block on the bottom this tie breaking rule asks you to create uh this block it says you can include all these fees that's fine but you're

supposed to point to this block the maximum fees you can include is five because that's all that's there um instead I think a pretty I don't know somewhat reasonable thing to think that people might do is you say well I mean you know like no one can really verify what's the first node you heard about and you know like you're maybe in something you should do is you should just tie break in favor of the one that lets you build the biggest block of your arm right so it's it's barely you know like this tiebreaking thing is not even really like considered part of the core Bitcoin protocol it's like a suggestion that people should do so you're not even really violating the protocol and you know like that alone is not a

huge problem right to say fine it's still you're still going to have consensus highs happen on their you know incidentally fine I mean I work in a different ways fine um the the problem is you have to think the next level right which is what if you know that the other miners are going to tiebreak in this way right so now if we happen to be in this situation where there's not yet been created this block down here so everything is good there's a single longest chain what you're supposed to do is you're supposed to you know build on top of the unique longest chain and you're going to get at most five when you do that instead what you can do is you can build a block worth 10 on top of seven

so this is a real violation of the longest chain protocol right you're not building on top of the longest chain and why would you do that well if the next Miner is going to use this Petty tie breaking which we just said we didn't consider on its own to be a huge deal and on the other and they're also going to get more money by doing it then now they're going to build on top of your block and so you're going to get 10. if of course yeah I understand like the picture yes so so I should think of it being basically like after the seven block I should think of like the total mempool had like 20 transmission correct that 15 is some minor taking 15 of the 20x5 left and then B is like

parallel universe with a 15 block hasn't happened correct and now you're saying if you include less than 15 of that you're gonna accent that's okay correct let me just repeat uh I don't know if everything the audience has is audible but just to repeat um the idea is that at this point in time the idea is that after the seven block there are 20 total um 20 uh Bitcoin worth of transactions in the mempool when this 15 block gets created that consumes 15 of the 15 worth of fees of the uh what's in the mempool and if you continue on this chain there's five left if instead you tried to Fork to a fork where this 15 didn't

exist there's still the full 20 left and so so I guess like the simplest thing would be literally just copy the 15 block though in a single track correct yeah so that would be yes so something else you can do is rather than 10 you could do like 14.999 or whatever you could just take out the least valuable transaction and then the petty tiebreaker if they're really really Petty and they would change the tie breaking for the 0.001 they would still point out so okay so um so this so at this point I just to be clear I'm not like uh I'm personally not like a doom and gloom predictor and I'm not saying I think this is absolutely what's going to happen in any system with transaction fees but I definitely

think it's a serious concern right that like if you ask me to guess whether miners will tie break you know we'll do this Petty tie breaking I really would say kind of like why not like they're they're just gonna get more money when they do that and definitely if they're the only ones doing it it's not a big deal they're definitely going to do it um you know and then of course the problem is if everyone does it then you allow for the possibility of like really bad actors to try and get more money um I guess the question for me is more I I mean I agree with you that in in a scenario like this it seems quite clear that people would would do this Petty

tie breaking I guess the question is more how how big the variance really is it's like this 20 to 5 situation in mental difference is that just um oh I guess that just came because of the 15 block um yeah I guess like is is this like you know is this realistic uh you know or or do we assume mempools are so things and you know blocks are always full and you know we get to some equilibrium of transaction fees that's a great question um so uh I would so I would interpret the main the main point of the question is is there

actually variance in practice in the the most valuable block you can create from the steady state level so uh that I don't know the um I don't know the answer to for Bitcoin that would be like uh that would be like a chain oh sorry that would be like a change specific um question so the uh the most important thing though is that um clearly you would need for that to possibly be true you definitely need to have the block size be constraining right like if the block size is not constraining and for the most part most people who want to be included can be included and the mempool is going to kind of fill up and drain fill up and drain fill up and drain

right and if you if that is happening there is definitely going to be variance and for this you don't even need a lot of variants you just need it to be like let's say that the mempool is uh filling up and then it drains with every block then as long as it filled up by you know it you know the previous block was 10 and it filled up until nine before I found the next one then I would want to do this attack right um so so I think that the the bigger the the main question behind that is sort of like is the total fees in the mempool really like completely static over time for like the maximum value block you could create or is there any variance in that if there's any variance in that then you can do this attack

did that uh did that answer the question cool um so there's another one in chat um I'll just repeat um I'll just repeat what Joe was saying is that as far as he knows um there's no large Bitcoin miners that will workplace um it will take replaced by feed transactions which is even smaller variation um than the pedagogies chain so I was just saying that perhaps the profit is just too small today to go against convention switch so I think that's totally possible and then I just want to be clear again that I'm not a empiricist that I don't um I'm not uh trying to claim that anything is happening or like absolutely should happen I think I'm more like trying to present

I would phrases like causes or concern or like things that could happen or like trying to introduce Concepts or possibilities but I still think that it's good to stop and pause and talk about like what is the actual implication um I'm just not the I'm not the source of that knowledge that you know okay so the um next kind of simple thing you might imagine right is um of all this like peacemaking it's different than different than other products there's like for whatever reason so maybe there's like this huge Meb opportunity or for some reason someone includes a huge transaction fee for one transaction

there's some transaction in the medical that's just worth like a thousand Bitcoin and or some small set of transactions or something like that right and that happens to be valuable for whatever minor includes and let's say that some mine are not you is the next minor and they include that transaction either one and let's say you have uh significantly less than 50 of the total cash rate right so yeah like 10 percent then right so if there was just a block reward right so so there's so this a thousand this thousand T transaction doesn't exist everything everything's just based on the Block report then you would maximize your reward by just continuing to mine on top of their

work right like your your mining power is 10 you're not going to be able to successfully like mine something and override theirs that that's not you know this is below the range for a selfish mining process we should just be following the longest game um but now you know with only your 10 of the hash rate you can still go through and say like well you know like if I find the next block it's possible that I'll get lucky and find the one immediately after that that's really unlikely which is why I don't want to do something like selfish mining but like man if I succeed I'm gonna get a thousand I'm gonna get me I'm gonna steal this thousand Bitcoin transaction right so even though you're very unlikely to succeed you have a 10 chance

you actually still want to do that right and the way the numbers worked out for this example even if you're two blocks behind you'd have a one percent chance of catching back up you would actually still want to do that in that case um right so this is just the last goal is just working out the numbers that you you know significantly increase your expected reward by trying to undercut even though you're not likely to succeed because of this huge anomalous um okay so um I'm going to um wrap up this first part of the talk so I have a pause for a discussion slide coming immediately after this in case um uh you know people wanted to revisit

some of the uh applications to practice uh that came up um earlier or discuss new ones but just to summarize right so prior prior to this work it really was not a whole lot of concern at all in the community about the distinction between getting deterministic block Rewards or block rewards and expectation and um you know the main point so I didn't touch on um the selfish mining stuff yet I'm going to mention that um when I got to the selfish mining path of the thought but I did show you um this uh I talked about this undercutting and you can also imagine if minors think that other miners are going to try and undercut them they may intentionally leave out transactions so they don't want to be hungry because they want to make sure that they

leave enough stuff um so the next Miner prefers to mine on top of them instead of trying I think and the intuition is just that there's this way richer strategy space that previously you didn't it didn't make sense to have a strategy that depended on the contents to block because you were getting 6.25 no matter what now you can have really rich strategies that depend on the contents of the block so the slightly more refined intuition right that what we saw is that you may want to chase an unusually high value transaction or just like Chase IPS that happen to be sitting in the temple and then um what we will see in the selfish mining is that it may make sense for you to just kind of like waste an unusually low value block and just kind of like

throw it away to selfish mining maybe you get lucky um so that's kind of like the intuition is it high value blocks you might want to chase them when uh otherwise you would have just liked it whatever and low value blocks you may want to intentionally strategize with them because it fail then whatever okay so I don't know if um anyone wanted to discuss kind of like the Practical relevance or um or anything like that or variance of this now but if someone would like to initiate a discussion we can do that if no one would like to do that I'll jump to the second part of the talk I'll stay here for I don't know 30 seconds or so

just in case someone has something that they want to discuss has there been any automated tooling to detect these scenarios and large chains because it seems like it's fairly easy to detect this in an automated way um that so that's a good question so I don't know if um I don't know if Joe's the right person to ask if uh Joe if you're aware of anything like that so I um so my background is like purely theoretical and I don't know myself a lot of the empirical details um I'm hoping that maybe uh Joe or someone else in the audience might know whether that's been done let me ask um Daniel I don't know if you

want to elaborate on the comment on voice recording chat I think I follow what you're saying yeah go ahead yeah I was just thinking like at least with classic like you have this huge incentive to go to one side of the chain that's like kind of outside the protocol and it seems like an extreme example of this Mev where people kind of like split into two different Forks yeah more of a social Med but I I agree with that so just to um repeat my own understanding is that you know because there was this huge like the whole youth versus each classic

discussion was over essentially this like one big transaction or a small collection of transactions um that had huge value for the person who launched the attack um so I agree that that uh that like certainly everyone involved in about the past few benefit clearly had high incentives difficulty classic or the um sorry I forgot my time I forgot which name got the split um but I think the exactly still has the money on YouTube classroom yeah um but I think a lot of the uh I don't know uh other other people

have other thoughts but I feel like a lot of the discussion around like e for this versus each classic like what other minors were interested in was not so much that like they were personally going to get rewarded on East versus East classic but more of like a philosophy as to like which version like which version of ethereum has no value like is it the version of ethereum where code is Law and this transaction even though most people recognize it it's a bug it happened so it happened or is it the version where there is a possibility for some human intervention extreme circumstances yeah

I was thinking that kind of as like speculative Mev like the Bitcoin like Bitcoin cash is not necessarily like uh there wasn't one transaction that people was very valuable but maybe miners were speculating oh I'm going on this chain because um yeah this could be the when this one will win out that makes sense I think um I think that style of Mev is um probably less related to like these specific kinds of attacks right because I feel like for um like for example it's not like I can

undercut your block and cause a social and that's going to be what causes like the social shift from code is law to human prevention yeah definitely they're definitely more clear clear-cut cases but it seems so much like a spectrum as well like um I think that's a good point after so maybe so maybe what I should refine about what I said earlier is sort of like um I guess uh like Med is a large enough term that it captures things that it captures it captures things that are kind of like not particularly related to um to what I was saying and that there's this like specific kind of Mev that has this property where it's sort of like

um you know it's directly related to the specific minor who includes that in their blogger yeah it's actually made me think if there's a way to formalize that state that more clearly but I I agree with not that there's different kinds of MPV that are more or less related all right cool thanks for uh thanks for all the discussion so I think now I'm going to go on to the second half of the talk so this is going to be a little bit of a contact switch to you know have like a mental reset um so this can be a context which I'm not going to go so the technical stuff now is going to related to selfish mind so this is going to be uh there's going to be an actual formal model if you're

here last week it's going to be similar to that from last week I'm going to quickly recap that um so I'm going to dive into that now that I've mentally excited so a quick reminder of the motivation or thinking of things like selfish my name is that you cannot you cannot successfully attack Bitcoin or ethereum by forging transactions by retroactively changing contents of blocks and that's because cryptography solves all of these problems however there are some problems that inherently have nothing to do with cryptography such as no amount of cryptography can force you to point to the longest chain no amount

of cryptography can force you to broadcast your blogs the moment you free right so these inherently are mechanism design questions you have to ask what are people incentivized to do and I will quickly remind you um that uh I'll quickly remind you of what the game looked like last week and then basically what's going to happen in the rest of this talk is going to be like tweaks to this game and I'm going to be more or less rigorous with the so as a reminder we set the setup is that every Miner has some fraction of the vocabulary slowly every minor has some fraction at the hash rate at all points in time every Miner is aware of some current blockchain right so they're aware of

some to write the tree there's a block the pointer points through different block they all share the same group and what is the actual game so at every time step a random Miner is selected to minor block proportional to their computational power what does it mean to create a block you create a node you point to any other node that you've heard of and then you can broadcast anything you want right so there's again there's no amount of cryptography that forces you to broadcast and uh to simplify the model we just said what does broadcast mean broadcast means that everyone hears about it and everyone hears about it so this is to let us really focus on the incentives and not to worry about like Network partitioning attacks and distributed systems it's hard okay and then what's the reward the

reward over time is just like well this game goes on for uh infinity and then um you know at any point in time you can say what's the longest chain and you can ask what's the fraction of blocks that you created on the longest chain so your goal uh what's written here is just a mathematically formal way of saying your goal is to maximize the fraction of blocks on the longest chain that we're created by you and last week one of the things we talked about was why was this the reward and we said this is because of the difficulty adjustment it means that the rate of growth of the longest chain is proportional to the time so I don't want to rehash those parts but I just wanted to quickly refresh that to see what we're building off of um and then what I stated last time was

that there is a in this game it was uh there is a strategy that is better than following the longest chain protocol even if you have less than 50 of the code pass rate it was a strategy but it's not called Selfish mining I'm going to very quickly remind you with a picture of what that strategy looks like okay so quick reminder what that strategy looks like is if you find a block you should hide that block so red means that block has not been broadcast you find the block find another block you keep it hidden find another block and keep it hidden when someone else finds a block that is the same height as yours you should only then release your block and if someone finds another block that

is the same height as yours and you only have one hidden block left you should release it and the reason you should do this is because now you are going to create a longest chain that everyone else is going to point to you have successfully kicked out two other blocks from the longest chain so that means that your three blocks that if you were honest you would have been three of seven in this picture your three blocks are now at three out of five so you reward goes from whatever three sentences to sixty percent okay so that's why the attack can be good why the attack can be bad is maybe you hide your block and then someone else finds a block and then oops and then someone else finds a block again so in this case if you were honest you would

have gotten one in four but because you were being um you're doing selfish mining you now get zero of three because your blog will take balance and so the um uh full point of this attack there's you know it's a mathematical analysis you have to do and it turns out that the reward outweighs the risk whenever you have at least a third of this little mining problem okay so um so all of this was just a quick recap to remind us of a model and what happened last week um one thing that I did not get to say last week is I just maybe didn't say last week but I'll quickly repeat um

is that uh this you know one way in which this model can be generalized is you can say like well initially we said that the attacker was super well connected and that they can um they have this property that whenever someone hears about an attacker block and someone else's block that everyone vibrates in favor of the attacker block they heard about it for first and then we said well what if the attacker is super poorly connected that was a model that we considered the real one with the real person and in that model where everyone tie breaks against the attacker because they heard about this honest block before the attacker block that was where all the analysis we did was and all of that can be like really easily extended to what if you win a gamma fraction what if you're kind of well connected

into the network it happens to be that this parameter abstracts away exactly who you're well connected to and exactly how well connected you are to different people it's just that the only thing that really matters for the analysis is what's the probability that if I take a random minor who's not you that they happen to have heard about your blog first and so and whatever this number is um I'm not going to maybe review this but like it's very easy to adapt the analysis I showed you last time it's like one change to the calculations um and uh and that's it so um now what I want to do um so this part I think we didn't get to last is to again pause for a quick discussion

on like what's actually happened in practice so again I'm not the empiricist but I have been through Talks by empiricists and I've heard a little bit of what they said so first question I think a lot of people ask is a selfish mining ever been detected and the answer that I've heard during all the talks was it has never been detected on bitcoin or a substantial cryptocurrency my understanding from things I heard during um talks was that they have detected it on like small random alt points where like you just kind of know I guess the implications if you take all sorts of things on small random it has been detected somewhere and there are statistical detection methods right

so you can't you know it's very hard to pick a specific account and say this account is definitely selfish mining um you know because people can spread their money across multiple different accounts but there are statistical detection methods where you can say someone in the network is probably selfish mind right so for example if you happen to see like right like this situation where for some reason there was like you know this chain of three overcoming a chain of two that's not likely in if no one is selfish minded because you would not expect there to be kind of like two ties in a row and you would not expect the you know someone to immediately find a block the moment that the second

one right so you can detect um you can statistically detect it someone is probably selfish money um and so questions I think that people should ask is why is selfish mining not happening on bitcoin if you're in our stuff um right now and I think there are good answers the reason I think it's good to know the answer is that you know everything is changing really fast and it's good to know kind of like when might you expect selfish mining to become a problem if at all so um one possible reason is just that in order for this to be profitable you need 33 of the total cash power in the network and that's a lot of hash power there must be you know like some relatively large altcoins at points in

time in Bitcoin Bitcoin Street where there were people who had enough mining power theoretically to do selfish money and it would have worked but it didn't happen um another reason that I heard is uh that you know in order to actually do this attack you need to actually change elements of Bitcoin source code right like you need to go in and write your own rules for which block you're going to buy on top of and if you want to do that there's always a chance when you do programming whatever language it is you're supposed to do your programming might introduce a bug and bugs are very costly when you know like literally if you start producing invalid blocks for whatever reason then no one's going to mine on top of your block and as soon as

you you know as soon as that starts happening you're just wasting whatever your um finding power is so I don't know I'm not in touch enough with um miners to know to what extent this is a like this is a serious um concern but that's something that had been posed on the previous Vlog I gave um the the one the answer that I find most convincing um is just that there are other impacts of selfish mining so for example if you were to start selfish mining on bitcoin with 40 of the total hash rate I think it would absolutely be statistically detected if it became public knowledge then it is very likely that somebody is selfish

mining on bitcoin I think it is likely that the exchange rate of Bitcoin would tank a little bit and people would now want to pay less US dollars for Bitcoin because there's concern that now someone has 40 of the hash rate and whoever that is they are willing to selfish mine who knows what else they're willing to do and I personally find that argument very convincing um and so personally if I happen to own 40 of the you know mining power for Bitcoin you know like that like I would definitely think twice about doing that um you know uh but I would say one one important thing about that kind of reasoning is that it at least forces I think you to acknowledge or accept that

there is something going on outside of just the raw Bitcoin source code that is very relevant to how Bitcoin operates which is that you really are relying on something called an exchange rate which has nothing to do with the Bitcoin source code and that is the reason why your protocol achieves consent consensus or your protocol does not have something like selfish money um so okay so anyways those are kind of like my thoughts I don't know um again if other people have thoughts that they wanted to share or question um any of these to the extent that you know like I'm offering my own opinion I personally find the third one to be significantly more convincing than any of the others but I also think again

that it forces you to acknowledge that there is a lot going on besides just the raw code that determines what happens in the Bitcoin game and two you can also Imagine scenarios where this no longer holds right if for some reason it became possible to do you know to like short Bitcoin or something you can imagine hedging against selfish mining by Short Selling or something like that um and you know the externalities could change for all sorts of reasons so I think that if this is the main um defense which seems super reasonable to me it just means that you have to keep thinking about like how to maintain that what would change that stuff I would have maybe two things that don't actually need you to go outside with protocol so one is just difficulty adjustment right so this attack doesn't pay off until the adjustments so Bitcoin

for example you go up two weeks where as you say there's only people detect it and the community has a two-week window to decide how to respond before it adjusts um the other thing I'd say is you know you show that this is profitable assuming everybody else is doing almost money right and so there's there's this two-week period where sort of you knock things out of this pseudo-equilibrium and now people are going to best respond to you right and that doesn't respond to you by on this planet so I don't think when you think about like a fast forward to the equilibrium it seems risky to assume you're going to be a kind of higher profits if you were before even holding the price fixed so that's okay so let me um that's a good point I have um

I have maybe like one I don't know if it's really pushback but um that still does not explain why honest mining is happening right now because basically the theorem you know the theorem is that honest mining is not an equilibrium and but what we are currently seeing is honest money and so I think that does explain why we are not necessarily seeing specifically this selfish mining because it could be that once people respond in equilibrium and actually you would have been happier if you were on it some people were responding to honest it's conceivable I'm not claiming this is true it's conceivable that there is a theorem that would say honest mining is actually

parade or Superior to any natural equilibrium or any symmetric ventricular brand let's say something like that in which case it's actually this like brilliant coordination where they're actually enforcing an automated effects because I don't know if that's true you just you can't possibly I mean like if you like it's like the devil you know versus the devil you don't know I guess that's possible you're saying it could be that what's really going on is this is a repeated game in a repeating 90 you know like non-equilibrium things that wouldn't be equilibrium steady state we can somehow have because everyone's worried that potentially but I mean more I want to say is like right so you can imagine saying like do you really be careful what you wish for do you really want to be the equilibrium

I think it might be hard to make them sorry go ahead I think Tim it might be hard to make there are theorems of the form Pareto Optima dominates all equilibrium of a certain type I think it might be hard to make precise in this situation I think framing it as a repeated game May capture the effect you're describing a little bit more easily right because because what's the period of optimum coming from it's coming from like the discounted future payoff flow somehow that that sounds like a repeated game logic also so also I think just by the nature of if you if you don't have anything to do with the exchange rate of your reasoning then the total pie is fixed independent of everyone's strategies

so if there is any equilibrium besides right like someone if it's not on a splitting if it's not proportional someone has to be profiting I'm doing so that's a good point about a fixed size five but then doesn't that say that in any symmetric people they're being you would have exactly the same payout profile as you under last night so if the month yeah so if everyone had the same hash rate I think that's right but um but if but it doesn't explain why if there's a 40 minor in like six ten percent minors it doesn't explain why the 40 minor is not getting more than 40 of the rewards so is it obvious of the 40 right would do better than 40 at the

eventually yeah I agree with that so that's not um so I agree that that's not obvious well so there there's the famous uh example I mean there's now a couple years ago but um there was a mining pool G hash.io that had over 50 of the mind power and we know that then you know like uh the dominant strategy if you analyze it like this is to double spend and or like well no to exclude even if I don't double spend just to exclude all other blocks right so to um just make a monopoly out of this um and I think that really drives to the last Point here right because then you then we can't well either you know it has to be some repeated game analysis

but really it's I think they were worried about the exchange rate so what they did is they just shut down missions they like like publicly said like it was obviously very detectable um or it was very detected um I mean they could have split themselves but they didn't do that what they did is they basically told people to move away from their mining pool um and so so we know that this actually happened and I guess the my question is do you think that we have any chance of right like we're not bottling the equilibrium now with um rewards in Bitcoin but I think what we're saying here is that that is not you know how the miners utility the functions are defined the managed utility functions

are defined in dollars um so is there any chance I mean like modeling the exchange rate is really really difficult but like could we come up with models where we take the exchange rate into account and say you know like can we actually model this in dollars not in Bitcoin and maybe then get some more like not just see this as some sort of Quirk but like actually model this in some way after that form yeah um so there are two things in um Benedict's question um let me respond to the actual question first is um so I am not aware of Prior work that tries to model the exchange rate how it would react to something like selfish mining

um I think that I think that that is practical right like it you know like so for example um there is there is work where they focus more on double spend attacks and they do explicitly model a possible throughout the history thread with a success yeah and I can say for selfish mining what I think would be different right is for selfish mining you only have statistical detection right so like the only thing you have to go on is like oh every time you create um a suspicious looking Fork I mean you know that could happen on its own right so like you can't have a model

that says when there's a suspicious looking for the exchange rate tanks right so you need some model that says like well based on the frequency of certain kinds of forks this is how the exchange rate changes or something like that like that I think that um it's it should be you know tractable to formulate a model that says you know like for some event that has some probability of occurring naturally but has now occurred and is indicative of selfish mining based on the unlikeliness that it would occur naturally you have some smooth impact on the extreme trade and then you can try to solve the same you know I don't know that it would be like you know mathematically easy but like it's at least a well-formulated

mathematical problem I think that should be um I think that should be trackable um for some for something like that to happen um the other the other thing I would say though is it like um I would still say in response to that right so um let's say that you know I had 40 of the total hash rate right um what if I decided like you know I don't know one hour a week I'm going to selfish mind and like the other however many hours that is I'm not gonna selfish mine then I feel like there is a low enough selfish mining right that I'm just create I'm you know just like caught up

at the detection is really not going to be there right because the forks that happen naturally um will just happen anyway so you know what I mean so I I and that would still get some profit right I guess the flip side is that that's the the reason that I might consider doing that is exactly because it would not be detected by anyone who's looking to see if selfish mining is detected so like in theory I guess that could be happening and we but um but like this kind of reasoning I think doesn't yet explain to me why nobody is just right like self like why someone with 40 of the hash rate would not just kind of like um selfish mind um you know like for one hour a week or ten minutes a week or something like

that um the second part about the next question which is related to I think what Joe is typing um or Joe's uh first question yeah it did so I had always imagined selfish mining as being done by an individual who owns lots of cash rate not by a pool that has more than 33 a public pool that has 33 or more and I understand that once you ask for an individual to have 33 or more of the hash rate that is way less likely to happen but I can definitely imagine that like all the things that were brought up

that if you have a public pool that is going to selfish mind that is going to be blatantly obvious to um that is going to be like blatantly blatantly obvious to everyone exactly who is selfish mining right because the pool has two states to the public people who are participating that they would like them to selfish mind right and so that's very different than if you just own lots of computational power and you just call your own computational power to do it you don't put it publicly on the internet anywhere that you're doing this um that I think is the like that's what I kind of see as being like I don't know if more realistic is the right term but like

that that's what I always imagine what I I kind of like never seriously imagined that like a public pool would publicly go something like this yeah I think I just looked it up jihash.io was well it was kind of a mix I guess they they had their own Hardware they just sold shares of the hardware so really you know you can think of them as one entity so it wasn't actually possible for people like they redirected some of their own Hardware to to to other pools I think is what they did so they really had control of the hardware and could have done it but you know they were basically like a public-facing corporation um

you know still like but it wasn't like you know some covert you know State uh uh actor or something like that um but yeah I agree with that you know that that it's much more likely for an individual person to do it whereas a service provider like say it's a pool that is literally just a service provider um then it seems unlikely or your users would switch away from it automatically probably yeah yeah and let me just catch up you know right so I think this is related to um both of Joe's um points too which is just that like yeah so anyway that's maybe like an important uh point of discussion that I did mention um

I think there there is a difference between a public-facing pool where everyone knows what strategy that pool is using versus just kind of like this nebulous someone out there seems to be selfish mining because of statistical detection but it's not a public pool so we don't know what they're doing um okay maybe let me also add I think by the time we get to be at three minutes okay so um it was great oh subscription was great all right so so this is the second week in a row I didn't get to exactly the same content so

um maybe what I can do um so I don't know if there will be a third clock I guess if there is I will I will just only do this but um what I will do still is go to my conclusion slot basically um okay so so this is the so basically after whatever I was going to do in the middle there was going to be a second discussion which is like let's revisit why selfish mining doesn't happen in other settings and the big difference is in some of the results that I skipped I want to say there are um you know kind of like live protocols where I would say

the distinction between I think Bitcoin with proof of work and for example um proof of uh block reward plus proof of work let's say that bullet one so this block reward plus proof of work that's what we saw the analysis for I stated this theorem that says if you have less than 32.9 percent of the total hash rate then there's nothing you can do that's better than being on it so it actually is an equilibrium um however some of the results I was going to show was that in different models there is actually no matter how small you are there is something strictly better than being on it right no matter how smart so if you have like you know 0.1 of the total

stake in certain proof-of-state cryptocurrencies there's a way for you to get like you know 0.1005 of the the total fees or something or the total revenue or something like that if you have 10 you could probably get close to 11 through um and there are there are attacks like that they're like selfish mining I didn't uh now um what is less clear to me is like I do understand why in Bitcoin um you know there's probably not a 40 minor and I understand like you know there's probably one or two people who have the possibility of being more than 33 they're probably very invested in Bitcoin and they don't want to have you

know they're really sensitive to negative effects um but I think it's much harder for me to be like super super convinced by is that for all of these you know protocols where someone who has less than one percent of the power could um either the computational power or the stake or whatever it is is strictly profit it's harder for me to imagine why zero people you know this is basically saying that right like everyone in the network it's hard for me to imagine that there is no one in the network who is less sensitive to the exchange rate or who like is more invested in a different crypto I don't know what

um so I don't have a good answer for sort of like why stuff like this is not detected in protocols where everyone no matter how small you are could possibly profit um so I don't know if um if that kind of like well I guess it depends up anyway but anyway um that was kind of like the last discussion um that I wanted to have I was curious to hear if anyone had some idea of why it would be the case that on a cryptocurrency where I really think that literally everyone has some strategy they could do to get a little bit more revenue and yet probably no one is doing that I don't have a good understanding of why that is but

um okay so anyway so that was the takeaways but I just skipped the content um so um thanks again uh for listening and that's it [Applause] I'm not actually have a question um State why is The Benchmark of like share of you know the longest journey school like adjustment the the question was why is um fraction of lots in the longest chain for a crew folks stayed at the right center if there is no longer a difficulty adjustment so I have two possible answers to that as I've so looks like Scott walked off

but I was curious um to hear what an economist thought of this so one is that for even a proof of stake currency there's still like this difference between the active stake right like you are actually participating in the mining protocol it's not like it's not like you say well there's you know 10 000 units of the currency and all ten thousand of them are active so if I want there to be a new block every minute I just need to ask a new person to mine every minute it could be that like one percent of the network is actually paying attention if one percent of the network is paying attention then and you do this protocol then it's going to be like 100 minutes

until the next block so one answer is I don't know what is done in practice but it would not surprise me if even proof of stake cryptocurrencies had some form of activity adjustment or something like that um that's one possibility the second possibility um which I think is definitely a better question for someone with more or someone with more economics background to weigh-in is um I genuinely wonder whether even in the original model you need the difficulty adjustment to claim that really you want to maximize the fraction of Bitcoin that you own because in some sense like

you know there's 21 million Bitcoin right what if I just decided that there's now 40 there's 42 million Bitcoin I just double everyone's Bitcoin that like when I try and think of like what what do you actually own when you own Bitcoin the the unit is kind of meaningless right like what you really own is you own some fraction of this digital asset that exists that's the nominated in some arbitrary unit um so I don't I don't know like that's that's more of a question I don't know if like this could depend on the inflation rate right so you're basically saying

you know you still want to sort of maybe maximize the fraction right so your point is that suppose your selfish mind and there was no difficulty adjustment what's that going to mean that it's the longest changes you can grow more slowly yeah which means the total emissions will drop in absolute sense your share of the right will go about and so I think that's an excellent point but you know but if the equation is really small like if that's just one percent of the system it's not actually like it's going to be a pretty small effect that's a good point yeah I agree with that um so I guess foreign yeah so I guess it definitely depends on the relationship between the total existing Supply and um that new Supply that's being created Over the Horizon

that you're considering this attack do you think is that logic even say that you really started from the beginning of time there were no existing Bitcoin does that sound like Sound Logic to you or it still sounds like something's off to me the way that's it is like imagine the market cap of Bitcoin evolves independently uh kind of uh distribution right which we'll get that argue about that assumption but under that assumption I agree with what you said like the employee you just want to maximize the fraction of the the currency that's been minted so wouldn't it work wouldn't it work even if the inflation was slow right because

miners famously sell almost Credit in mind can I see stuff like that so if you can reduce the amount of Bitcoin being emitted by miners you reduce the sales records you can argue that assuming that it's the most downwards selling that you actually it is but I'm sure you're saying that you would actually you're saying that you expect that that would be another reason why the U.S dollar value of Bitcoin would go up is because other miners are becoming more desperate to sell their stuff well they can't they're not selling it because all right yeah they're selling less and 50 years at all minors are we sell them but that's that's like a large portion of that downward pressure

that's interesting so to say that sounds interesting that you get a de facto lower inflation rate right so therefore yeah think of all of the inflation basically just needing a video to sell orders that's just less Bitcoin selling these are the yeah so if you think of the inflation rate has like the inflation is okay sold off rather than like be right here sometimes lots of much damages I like I guess the main thing you're saying is sort of like if it were the case that what's really driving the price of Bitcoin is only the miners making it and selling it or something like if that's really what drives the price um and it's not like some external thing like people really want to own Bitcoin to send money overseas or whatever

yeah that makes sense yeah I buy that too um the other the other thing I would add is to like so for example for a transaction if you have a transaction fee system you don't need the difficulty adjustment and all for any of that analysis right um uh because just sort of like those transactions are going to be somewhere right so they're going to be in you know where if if uh right if there's less blocks being created then each block is going to have more transactions in it and that's without even doing the expert DNA for the transaction use and I guess like that same kind of reasoning applies to like Med right which is it like it less other people are producing blocks that stuff

has to go somewhere so that gives you more opportunities to include stuff um yeah so so I think um I would say maybe that the difficulty adjustment is like the cleanest way to just kind of say like here's a model it does model an actual system here's a very uncontroversial assumption that explains why this is the objective um but I bet I bet that um that is not a far off objective in some of the other systems without the difficulty adjustment um but it may not be like the story may not be quite as clean I think the models for

a transaction fees are cleaner where like um it's really just like exogenous to the um uh block you know the rate at which blocks are found or something are you aware empirical works that really do like I mean it feels like for something like ethereum right where the stale block rate is already kind of high like the detection heuristics would actually have to be pretty sophisticated so I'm just like we're saying oh yeah we've never detected it but it's like it's like oh good are we detecting it how much should we try so I don't know if um I don't know if you heard the question

um I guess yeah I don't I don't know if people have really looked on ethereum it also has Uncle block rewards so presumably it's there's a like you're yeah like there's certainly no papers yeah like a master's thesis but so maybe back in like 2014 this was done anecdotally and that's a good question yeah because I mean it is like a real effort to detect it right you have to be like online in the network you have to have some tool with yeah so sorry to pump all these questions like I guess maybe you need like some employee to actually process blockchain um you need to be live in the chain

right you just look at blockchain data after the fact oh you're saying all the authors are done anyway you have to be like in the network relatively well connected because all the stuff that got approved it doesn't you're not going to detect so it's like this is a real thing you'd want to see the pattern of like somebody announces several blocks in a row that were that built on each other which like wouldn't happen by chance yeah like so obvious that sounds reasonable yeah I think it's

um yeah I don't even know who the right person like I used to be that like I felt like well I can Italian email but I don't know if it's like grown Way Beyond I mean like Andrew Miller lies network analysis let's just ask whether something people did not yeah let's continue discussing yeah