Last week the Bank of England published its Quarterly Bulletin, which contained two detailed papers on digital currencies. The Bank deserves credit for writing such a thoughtful review of this space, which was clearly the product of thorough and open-minded research.
One of the two papers titled Innovations in payment technologies and the emergence of digital currencies is noteworthy for pointing out the potential applications of decentralised crypto ledger systems for financial services. Given that I’m co-founder of a new company devoted to such applications, I’m delighted to see that a G10 central bank has the foresight to see this. There will be many points of intersection between private sector innovation here and the regulatory mandate of a central bank.
But you, my readers, are interested in the cutting edge of cryptonomics thinking, so I want to instead discuss the Bank’s second paper, The economics of digital currencies, because I take issue with parts of its analysis. In brief, I believe that the authors have incorrectly analysed the cost structure of digital currency systems and, as a result, incorrectly generalise some problems faced by digital currencies like Bitcoin to digital currencies in general.
The Costs of Mining and Transaction Fees
Ok, first a quick review of mining. We’ll assume the Bitcoin protocol as our template. The micro economics of mining are actually quite simple. To win the mining award (currently, a 25 bitcoin “coinbase” award + block’s TX fees), you have to solve a hash-based proof-of-work problem, which involves using a machine to compute the double sha256 hash of a block of TX over and over until you hit a value below a certain target, which is defined by the protocol’s current difficulty. Difficulty resets every 2016 blocks, increasing if the average duration between solved blocks is below 10 minutes, decreasing if the average duration is above 10 minutes. The scheme insures that average time between blocks approximates 10 minutes.
Now, the probability that a given hash “solves” the problem is precisely defined by difficulty. So, mining profitability is a function these four variables:
- Current difficulty
- The efficiency of mining (converting electricity into hashes)
- The price of bitcoin (market value of mining award)
- The price of electricity
The efficiency of mining really boils down to this simple ratio: GHs/kWh. How many Gigahashes per second can your hardware compute for a given unit of electricity (including electricity consumed in cooling the machines, etc).
And the dynamic reset of difficulty basically ensures that only those running machines with the highest GHs/kWh ratio and paying the lowest cost per kWh will mine in the long run, as everyone else will be mining unprofitably and drop out of the network. It’s almost a textbook model of perfect competition.
Now, what I think often gets missed here is that the costs of mining bitcoin are entirely a function of the price of bitcoin. If the price of bitcoin goes up, mining becomes profitable and more nodes join the network, which drives up difficulty making mining no longer profitable again. If the price goes down, mining becomes unprofitable at current difficulty, more nodes drop off the network, which drives difficulty down, making mining profitable again.
This dynamic is obscured by the fact that investments in mining hardware have driven GHs/kWh up relentlessly over the last few years, so difficulty rarely declines with bitcoin price, but the dynamic still applies: the price of bitcoin determines the cost of mining.
Failure to appreciate this fact leads to arguments like this one in the BoE paper:
Moreover, to the extent that miners’ expected marginal revenue exceeds their expected marginal costs, miners’ costs are likely to increase over time. This should occur even if no additional people start to mine and independently from any increase in the number of transactions per block. This is because distributed systems involve a negative externality that causes overinvestment in computer hardware. The negative externality emerges because the expected marginal revenue of individual miners is increasing in the amount of computing power they personally deploy, but the difficulty of the problem they must each solve (and hence their marginal cost) is increasing in the total amount of computing power across the entire network. Individual miners do not take into account the negative effect on other miners of their investment in computing resources. Economic theory would therefore suggest that in equilibrium, all miners inefficiently overinvest in hardware but receive the same revenue as they would have without the extra investment.
Can you spot the error? It’s right there in the first sentence: “to the extent that miners’ expected marginal revenue exceeds their expected marginal costs, miners’ costs are likely to increase over time.” This is a fallacy of composition.
What we really have here is the familiar pattern of Knightian uncertainty faced by entrepreneurs. The miner must make a capital outlay in advance for his mining equipment (to get an edge over the competition with new kit delivering a higher GHs/kWh ratio), but he doesn’t know what the price of bitcoin will be once he starts winning blocks, nor does he know what the difficulty will be, which will be a function of Bitcoin price and the capital investment of his competitors.
Boom, bust.. it’s all the same, the fixed costs of mining hardware are internalised by the miner, those costs are not an externality as the author’s argue. The cost of mining will be dictated by the price of bitcoin, that is, the market value of the mining award, and difficulty reset enforces the long-run equilibrium condition whereby hashing costs = market value of mining award. Even changes in the variable costs of mining (the price of a kWh, basically), don’t change the long-run costs of mining, as an increase in electricity prices ceteris paribus should cause difficulty to decline and a decrease should cause difficulty to increase. The cost of mining a block will converge to the market value of the mining award.
I’m not an economist, but back in January I suspected that the economics profession would have trouble with this implication of the Bitcoin protocol, when I wrote:
So the exchange value of the mining award determines the marginal costs rather than the other way round. An economist might find that pretty weird, but that is how it works.
And that is how it works. Economists are used to thinking in terms of prices (ephemeral market stuff) being a function of costs (stuff that is “material” and “real”, like a production function). But the way the Bitcoin protocol works, the hashing costs of the network are a function of the mining award’s market value. I’m not saying it’s a nice feature of the protocol. But it is what it is.
And that’s why all that investment in mining equipment is not a negative externality, at least from the perspective of mining costs.
But there is different way in which capital investment in mining equipment creates an externality, a way that the authors did not address.
Mining Centralisation
If there is a negative externality to the relentless quest to make mining a positive expected value lottery by investing in new gear that increases GHs/kWh, it’s that the number of mining nodes decreases as a result of this process. Mining becomes concentrated in fewer and fewer hands. To run a profitable mining operation, one must run machines with an above average GHs/kWh and below average electricity cost. This is specialised hardware with limited production runs and requiring a non-trivial capital outlay.
A network made up of a few large mining nodes is basically a centralised system with none of the benefits centralisation might bring. What Satoshi envisioned was a one-cpu-one-vote distributed system, people mining on commodity CPU or GPU hardware. That’s not what has evolved, and this is a serious problem for Bitcoin and other digital currencies with protocols designed along a similar pattern.
It might be tempting to think that the amortised cost of that hardware somehow gets baked into the cost of mining the network, as the author’s of the BoE paper do, but those costs are only faced by the miner. It may turn out that the ROI of the latest 28nm mining rigs is negative at current prices. Too bad for the miner who purchased it, but he’ll still mine if the variable costs (the electric bill) are less than the expected mining award. The market value of the hardware itself will decline to the point where the ROI is no longer negative.
And this Knightian boom/bust dynamic raises some questions about the future of mining investment. R&D in specialised mining gear can really go one of two ways. The first scenario is that there will continue to be an edge in capital investment in improving GHs/kWh, in which case capital investment in mining will continue to concentrate mining in few hands, a “bad” outcome.
The other scenario is that the gains from further optimisation’s reach a stage where they are too costly to be worth it and R&D switches to commoditizing the currently most efficient designs, in which case the centralising effects of mining investment go into reverse, a “good” outcome. Whichever way it goes, it is still the case that the mining costs of the network are determined by the market value of the mining award. That’s equilibrium.
So, if there is a negative externality inherent in Bitcoin mining, it is the negative externality of centralisation not of costs.
On the sustainability of low transaction fees
I want to focus on another dimension to this mining cost story. So far we have focused on the role that miners play in hashing blocks. But miners actually do two things: in addition to hashing blocks, they also perform transaction verification. The author’s of the BoE paper seem to conflate the two processes:
Low transaction fees for digital currency payments are largely driven by a subsidy that is paid to transaction verifiers (miners) in the form of new currency. The size of this subsidy depends not only on the current price of the digital currency, but also on miners’ beliefs about the future price of the digital currency. Together with the greater competition between miners than exists within centralised payment systems, this extra revenue allows miners to accept transaction fees that are considerably below the expected marginal cost of successfully verifying a block of transactions.
It’s that last sentence I take issue with. The “marginal cost of successfully verifying a block of transactions” is the cost of running the scripts on each TX in the block and verifying the digital signatures. The computational costs here are tiny compared to the cost of hashing the block, which plays no role in TX verification whatsoever. Hashing is there to raise the cost of a Sybil attack, nothing more.
What’s confusing about cryptocurrency is that there are these two different costs, hashing and verification, and two different sources of paying for them: seigniorage (the coinbase award) and TX fees. How the pair of costs and revenues match up is a protocol design consideration.
| Costs | Revenue |
|---|---|
| Proof-of-Work (SHA256 hash problem) | Coinbase (25 bitcoins) |
| Transaction verification | Transaction fees |
In the case of Bitcoin, a miner has no control over the size of the coinbase award, but he does control which TX’s go into the block he’s currently hashing. So basic economic theory dictates that a miner will include a transaction if and only if the expected value of the TX’s fee is greater than his marginal cost of verifying that transaction. The costs due to proof-of-work do not come into the decision at all.
It makes sense to think of proof-of-work and TX verification as two separate subsystems with their own respective sources of financing: proof-of-work financed by coinbase and transaction verification financed by transaction fees. A digital currency protocol could follow this pattern and some do (Ethereum, for example). Bitcoin, however, is different. Its protocol dictates that the coinbase award halves every two years and never exceeds a cumulative total of 21m coins, which means that at some point both hashing costs and verification costs must be paid out of TX fees alone.
I’ve pointed out before that this aspect of Bitcoin’s protocol design is self-defeating in the long run. The market for media of exchange will gravitate towards those systems with the lowest transaction costs, and in the case of proof-of-work digital currencies, that means those protocols that forever subsidise hashing costs with the coin’s seigniorage (no supply cap). And even if that were not the case and Bitcoin remained the dominant digital currency, the protocol will need to change to incorporate a mandatory minimum fee that is sufficiently large to incentivise enough hashing to secure the network. I say “mandatory” because there is a collective action problem here in that an individual miner has no incentive to exclude a transaction whose fee exceeds his marginal verification costs, even if the aggregate effect of this rational behaviour is that the total TX fees are insufficient to support a hashing difficulty that secures the network.
Which brings me to the author’s bleak conclusion:
The eventual supply of digital currencies is typically fixed, however, so that in the long run it will not be possible to sustain a subsidy to miners. Digital currencies with an ultimately fixed supply will then be forced to compete with other payment systems on the basis of costs. With their higher marginal costs, digital currencies will struggle to compete with centralised systems unless the number of miners falls, allowing the remaining miners to realise economies of scale. A significant risk to digital currencies’ sustained use as payment systems is therefore that they will not be able to compete on cost without degenerating — in the limiting case — to a monopoly miner, thereby defeating their original design goals and exposing them to risk of system-wide fraud.
This is only partly right, and partly right for the wrong reasons. First of all, it’s not digital currencies that face this problem, but a subset of them that, like Bitcoin, eventually require TX fees to shoulder the entire burden of incentivising proof-of-work. But that is an accidental rather than essential feature of digital currencies. So, the conclusion is only partly right because it does not apply to protocols that finance hashing costs with a perpetual coinbase award.
And right for the wrong reasons… this sentence “With their higher marginal costs, digital currencies will struggle to compete with centralised systems unless the number of miners falls, allowing the remaining miners to realise economies of scale” is wrong because the authors have conflated hashing and verification costs.
I’m not sure I get the “economies of scale” thing in transaction processing systems, but perhaps the author’s are thinking of the extreme redundancy that distributed systems require. Transaction verification in a distributed system is redundantly performed by every node, so if there are 5,000 nodes verifying nodes on the system, every TX is verified 5,000 times. Compared to a centralised system that only needs to verify a TX once, it would seem that there is a simple economy of scale linear in the number of nodes in system.
But a centralised system must do much more than verify TX, it must do lots of things that nodes on a distributed system do not have to worry about. The centralised system must protect the server(s) against error and attack, as a centralised system is by definition a system with a single point of failure. You don’t have to be a network security expert to appreciate that this is hostile and difficult technical territory. I can’t offer estimates on what these additional costs are, but what I do know is that they are a large multiple of transaction verification costs, and exponentially more complicated processes. TX verification–parsing the blockchain and doing a bunch of ECDSA signature verifications–is easy and cheap by comparison.
So it is by no means obvious that the total costs of TX verification are lower in a centralised system than in a decentralised or distributed one, and it may in fact be the other way round. But either way, we can say two things with confidence:
- The costs of distributed TX verification are a small fraction of the fees charged by legacy payment systems. Unlike hashing, this is not a costly computation even when multiplied by a large number of verifying nodes.
- The costs of distributed TX verification will decline over time with improvements in computational efficiency, bandwidth, etc.
But the one thing that distributed systems must do that centralised systems do not have to worry about is a mechanism for achieving consensus on the authoritative state of the ledger. For Bitcoin and many other digital currencies, this mechanism is hash-based proof-of-work, and it is crucial to appreciate the fact that verification and proof-of-work hashing are separate processes with independent cost functions.
And it may turn out that the proof-of-work blockchain isn’t the best mechanism for achieving consensus anyway. There are other decentralised consensus algorithms used in projects like Ripple, Stellar, and Hyperledger that do not rely on energy intensive hashing problems to achieve consensus.
Proof-of-Work as “manufactured scarcity”
Now that proof-of-work is liberated from the misconception that it is somehow behind TX verification we can bring some really interesting economic properties of proof-of-work into relief.
As long as there is long-term growth in demand for the coin and the coinbase award is perpetual, seigniorage should be more than sufficient to cover the costs of proof-of-work. That idea alone is, I think, really interesting. Here’s what I mean.
There is a long-standing objection to private fiat money schemes advocated by Hayek and others that goes something like this. Media of exchange are near-substitutes. (This maybe false assumption, but lets go with it and set aside the economics of network effects, etc.) And the marginal costs of producing the media are almost zero, so if a privately produced fiat money is a success, the seigniorage that accrues to the issuer will be substantial. This will invite more and more competition producing more and more media of exchange. Invoke that near-substitutes assumption and, bingo, privately produced money gets driven down to the marginal cost of its production, which is basically zero. Privately produced money is impossible because of free market competition and the the near-zero marginal cost of producing it.
In my opinion, the most important innovation of hash-based proof-of-work isn’t its solution to the problem of distributed consensus, for which there are arguably better solutions. Rather, the real innovation is the way in which this energy intensive defence against the Sybil attack makes the marginal cost of proof-of-work fiat money meaningfully non-zero, refuting the argument above. The scheme’s seigniorage doesn’t really accrue to anyone. Instead, it gets burned up in hashing blocks, where the marginal cost of producing a new set of coins equals the cost of solving the hash problem on the block that brings the new coins into existence. There is no coin “issuer”, scarcity comes into existence ex nihilo.
And this “seigniorage burning” isn’t a complete waste, as my metaphor might suggest and an economist will wrongly suspect as “inefficient”, for it has the side-effect of bootstrapping a solution to the distributed consensus problem and thereby creating a distributed payment system on which the value can be transferred (a coin can’t be scarce if it can be double spent). After all, shouldn’t seigniorage be spent on a public good? I think that this is conceptually beautiful, and it deserves to be a chapter in the micro foundations of money economics, whatever its ultimate fate ends up being. The first credible scheme for credibly rationing the supply of privately produced fiat currency.
The dominant narrative to-date has been that digital currencies like Bitcoin have value because of the utility of the distributed payments system combined with an (eventually) fixed coin supply. I think that the latter belief is unfounded. It’s not the fixed supply of a coin that makes it scarce, but rather the marginal cost of producing the coin that makes it so.
There can be demand for coin because of the expectation that it will be demanded more in future and therefore increase in price (speculative demand), and there can be demand for coin because you want to hold a coin balance to facilitate transactions (transactional demand). A coin may embody demand from both sources, but the former implies the latter or else the coin’s value rests on some sort of “greater fool” phenomena.
The entire history of monetary thinking can probably be told from the perspective of the tension between these two sources of demand, the tension created by a single object embodying the properties of both store-of-value and medium-of-exchange. The pursuit of purchasing power stability in this object isn’t some hubristic policy ideal like the taming of the business cycle or full employment. It is intrinsic to the very idea of money.
A volatile medium-of-exchange is a poor medium-of-exchange, and it is almost inconceivable that a free market would ever converge on a unit of account where the numeraire of all exchange was among the most volatile of assets. Just consider the cost of extracting relative prices in that scenario! We’d have to develop an alternative unit-of-account, which is another way of saying the market would never select such a coin as the unit-of-account in the first place. Trade requires a reliable measuring stick.
This is my favourite paragraph from the BoE paper:
In order to address a need to respond to variation in demand, a more flexible rule would be required. For example, the growth rate of the currency supply could be adjusted to respond to transaction volumes in (close to) real time. Alternatively, a decentralised voting system could be developed. Finally, variant schemes could embrace existing monetary systems by seeking to match official broad money data or to target a fixed exchange rate, although this would require the abandonment of part of the schemes’ original ideology.
A more flexible money supply rule behind digital currencies is required. After all, even commodity money has a somewhat elastic supply function. If the price of gold hovers above the marginal cost of pulling gold out of the ground, more gold supply will hit the market. Digital currency with a deterministic money supply function is not a feature but a limitation of early, first designs. And a capped supply function like Bitcoin’s is a bug on microeconomic grounds alone, as we discussed above.
But there’s no reason to jump to the conclusion that the “original ideology” must be abandoned in order to implement certain stability schemes. For example, the coinbase award could be made a function of difficulty deflated by the change in GHs/kWh (improvements in hardware efficiency). Such a scheme would keep the coin price of a kWh roughly constant. A fixed exchange rate without abandoning the “original ideology”. Ok, it’s not a complete proposal, but you get the point. We’ve barely scratched the surface of this technology.
One of the (many) ways in which fiat money is weird and counter-intuitive is how it has value in the first place. The stock and bond markets have value because of the NPV of expected future income flows. But the aggregate value of the money stock is like value created out of nothing. It’s the value of pure liquidity.
So I want to offer a variation on the trust-less theme here: nobody can be trusted with the seigniorage generated from this value.
cryptonomics 
This is excellent. How long did it take to write all that? You should turn it into a book! 🙂
Sent from my iPhone
>
Long piece, but after making a good start describing the factors that affect profitability of mining, you make this assertion that had me really puzzled:
costs of mining bitcoin are entirely a function of the price of bitcoin.
Honestly, did you really mean to say that all the folks looking to mine or currently mining or building mining rigs, do not have to consider costs of the hardware or the operating costs, but only look at the price of bitcoin? The only thing to support your assertion is the magical belief in how we will have perfect cause and effect in the bitcoin mining market:
“If the price of bitcoin goes up, mining becomes profitable and more nodes join the network, which drives up difficulty making mining no longer profitable again”.
First let me point out that the above statement refers to price of bitcoin and profitability of mining – not cost of mining which is your original assertion. Therefore, unless you want me to use costs and profitability interchangeably, which I can’t, your assertion remains completely unsupported.
Secondly, let me say that what gives you the confidence that if bitcoin price rises, more nodes will join the network? At best this is a very simplistic assumption that leads you into making some more shaky assertions. The network today at 220PH and with the recent 20% increase is already shutting down individual miners with inefficient first or second gen ASIC rigs. According to your logic, if price of bitcoin goes to $600 a 25%+ increase from the current price, you are going to see a corresponding 25% increase in nodes join the network, pushing the hash rate up to 275PH. Which as you know is not what we have seen so far when there’s been a price increase. Even if bitcoin price jumps 50%, I doubt you are going to see a huge influx of miners jump in.
The reasons are obvious in that this is already a mature tech hardware market. At current network capacity, it remains a capital intensive game and there are lead times involved to deploy new hardware. There’s also limited supply to ASIC hardware to make this an “efficient market” that will reach an equilibrium soon. Hardware manufacturers have realized there’s little point trying to sell at retail and incur a huge backlash when your product arrives one week late or misses the stated W/GH number. But with no pre-orders to fund you, h/w manufacturers ability to keep building the mining farm is also limited. This is one market where there’s no concept of idle inventory, everything runs 24/7 throughout the year.
So the correlation between the price of bitcoin and hash rate is rather weak and nowhere approaches a perfect causal relationship like you posit. I agree with the Bank’s report that there’s a possibility of over investment when you have a bunch of individual miners as the majority. They may have loss aversion guiding their actions (similar to how individual buyers can ride a stock all the way down).
I believe that the mining market is close to functioning like a mature technology market. As you mentioned in the intro, the strong players with access to better technology or lower operating expenses will survive. If you consider this future which is only about 6-12 months away, you will likely see corporations are investing millions not thousands and they tend to be less emotional about their decisions. It would really take a 50% + price increase to influence their decisions to invest more in building new systems.
It was difficult to read past that initial assertion, but I did and came upon another doozy when you discuss profitability of systems deployed in the future:
“nor does he know what the difficulty will be, which will be a function of Bitcoin price and the capital investment of his competitors”
Not satisfied with making costs a function of bitcoin price, here difficulty has been made a function of bitcoin price as well. I’m sorry, but because of my background in research and modeling, I cringe when I see folks use terminology like “function of” and apply them in inaccurate ways. Perhaps where you are coming from is the following conventional wisdom:
Price of bitcoin increases –> more hashrate is added via capital investments –> difficulty increases
Since we are not dealing with equalities, but relationships, the transitive property doesn’t really hold. If Sam likes Alice and Alice likes Barbara, you cannot say that Sam likes Barbara. Further, you cannot collapse the above into a single statement like: Difficulty is a function of price and capital investments. It is the equivalent of saying Sam likes Alice and Barbara. Basically, we are talking primary effects and secondary effects and you have to recognize that these are not strict causal relationships. As I explained already, there’s only a weak correlation between price of bitcoin and hashrate increase and this is true of other scarce commodities like oil and precious metals (the barrier to entry is high in these mature markets). To extend that weak correlation further and bring in difficulty as well is just plain wrong.
Also to be perfectly clear, the only thing that difficulty (increase/decrease) is a function of is how quickly 2016 blocks are found. Now that is affected by how much compute capacity is online in the network (leaving the random nature of things alone). That in turn is dependent on how many $ were invested in ASIC hardware 3 to 6 months back.
In conclusion, I’d say good attempt at trying to critique the Bank of England paper, but let’s not get carried away by playing fast and loose with logic. I agree with some of your other analysis. Overall, I thought the Bank of England paper was fairly accurate in their assertions. But that’s a different topic….
Great comments, thanks. Regarding your first point, no I’m in no way suggesting that miners only look at price not their costs, they will obviously look at both, and I’m not advancing any idea of “perfect cause and effect”. What I am saying is that in the long-run, mining costs will converge to mining revenue, not the other way round. This must be the case if you accept the following:
1) miners have no control over the value of the mining award (revenue)
2) miners will not mine unprofitably for long
3) miners will increase hashing if mining is profitable
I suspect that what bothers you is my analysis of this process in equilibrium terms, hence your issue with my simple functional language. And, in answer to your second point, no I don’t think an X% change in price causes an X% change in difficulty (a quick glance at diff and price series makes that clear), which is why I said that “this relationship obscured by the fact that investments in mining hardware have driven GHs/kWh up relentlessly over the last few years, so difficulty rarely declines with bitcoin price”. What I do say is that if you held GHs/kWh and electricity prices constant, difficulty will correlate with price. Do you not agree with that?
The point of analysing it in this way is not to provide a descriptive, block-by-block (or reset-by-reset) model of the process, but to cut through all the detail in this space that seems to prevent people from seeing the forest through the trees. I agree with the Bank (and you) that there has been and always will be times of over-investment in mining HW. That is not disputed. What I do dispute is that HW over-investment will increase the cost of mining in the long run. How, exactly, would that work?
Suppose some big investment in optimisation leads to a limited production run of 10 new ASICS with a GHs/kWh vastly greater than anything else. Further, suppose that if all 10 were turned on, it would not only drive out the existing HW, but those 10 ASICS themselves would be unprofitable at the new difficulty. (We’ll hold bitcoin and electricity prices constant.) What’s going to happen? Some of those machines are going to be turned off until difficulty falls back to a level where revenue exceeds costs. To think otherwise is to assume miners will mine at a loss indefinately.
The only point where my analysis breaks down are those conditions where assumption 1 no longer holds. Miners have no control over the coinbase award, but if mining is heavily concentrated, they can influence the fees. I see it this way. If you’re a miner making up 1% of the network’s hash rate, the fee threshold below which you stop including a TX in your block will have absolutely no effect on the fee senders choose to include. So you might as well accept any TX with a fee greater than your cost of verifying the transaction. But if you’re a miner making up, say 30% of the network’s hash rate, then your fee policy will have a material effect on the confirmation times of senders and probably will influence the fees they choose to include.
Bitcoin wasn’t designed to become or tolerate a small and concentrated set of mining nodes, so its tendency to evolve towards that state of affairs is what deserves analysis, and to the extent that over-investment is an externality, it’s an externality in its contribution to the forces of centralisation, which are many and also include things like pools, electricity cost differentials, geographical temperature differentials, block propagation latency, etc. Centralisation is the issue, not some inherent tendency of proof-of-work to drive up costs, for that becomes possible (via miner’s pricing power on fees) only if there is centralisation in the first place.
Interestingly, the network’s cost of processing transactions actually declines with concentration, as those costs scale with the number of full nodes. So, in a decentralised network with many nodes (which is the design goal, let’s remember), processing costs are higher but miners have no power over fees, which will converge to the network’s processing costs. And because miners have no power over fees, hashing costs will converge to the market value of the coinbase award.
But in a concentrated system, it all goes horribly wrong. Network processing costs are lower (much fewer nodes), but miners get pricing power on fees, and this is the thin wedge through which hashing costs might start to get passed on to users, that is, revenue might start to move up with hashing costs. I say “might”, because there are many different forces at work in the concentrated scenario, the behaviour of miners becomes strategic, and so on. I’m not sure it’s even worth modelling what happens there because a proof-of-work currency with heavily concentrated miners is basically a broken system.
What is worth modelling are the forces that drive this centralisation so that protocols can be changed/designed that mitigate against centralisation.
I feel that you have a tendency to use many commonly used terms rather loos ely (and interchangeably), detracting from some of your good points. For example, you say: in the long-run, mining costs will converge to mining revenue, not the other way round.
There’s no question that the block rewards provide an upper limit on how much money is invested into mining. This is true for every industry, that I know of and everyone can agree with that. However, you confuse readers by using the term “cost” instead of “investment” and try to make bitcoin somewhat special. I realize that you are looking at the entire network and investments made and equating that with “costs of mining”, but as I mentioned in my example of Sam, Alice and Barbara, you seem to be jumping ahead. Costs refer to expenses in running a business or production and are derived AFTER an investment decision has been made (guided by profitability and difficulty of execution).
Irrespective of the language or terminology used, I do have an issue with the supposed equilibrium that you believe is a certainty. Let’s go to your 3 supporting points:
1) miners have no control over the value of the mining award (revenue)
2) miners will not mine unprofitably for long
3) miners will increase hashing if mining is profitable
1 – is not entirely accurate. Yes, miners don’t control the price of bitcoin (not directly). Also we are supposed to be getting 25btc every 10 minutes. But guess what, miners have stayed ahead of the difficulty curve and consistently mined blocks every 8.5 minutes, so they’ve boosted their bitcoin earnings significantly in the last 12+ months, by accelerating the pace of their earnings. Additionally, the market is getting centralized to the point where they will exert some pressure on tx fees to be higher. After all as you described, miners are not just verifying transactions, but they also transfer value by recording the change of ownership via Proof-of-work and block chain updates. Supply of bitcoin may be governed by Satoshi’s protocol, but even he saw block rewards as a short-term mechanism to boot strap the network and provide security while transaction volume remained low. Of course, tx volume for a variety of reasons is stagnant around 70-85k per day, while hash rate keeps increasing like crazy
2 – true
3 – Not true. If we were in the CPU mining era, maybe this would be true, but not any more. Your reasoning behind #3 is probably that bitcoin rewards are like a lottery – it would behave like your Super Lotto – as the prize money crossed a threshold, more players would enter the market even though the statistical chances of getting the reward would diminish. For the reasons I’ve outlined earlier on how this is a mature tech market and access to mining hardware or capital is restricted, things are not that elastic any more. Say even if bitcoin price goes to $1500 next year I doubt that the remaining handful of miners are going to invest tremendous capital to capture that, because the btc earned is the same although the value may be different. Mining farms are profitable today, how profitable depends on their CapEx and OpEx. In the case of Bitcoin, there’s a real downside of increasing hashing power because the only thing miners can do is hope to accelerate their earnings or gain market share with something more efficient. In that vein, I also disagree with your claim that commodity money like gold is somewhat elastic.
Which brings me to your what-if scenario about someone being able to produce ASICs that are far superior to everyone else. I don’t quite follow the logic or your assertion that: 10 ASICS themselves would be unprofitable at the new difficulty. In mature markets, it is all about the efficiency. So everyone only cares about $/GH and W/Gh. If these ASICs were vastly more efficient just on the power consumption than the competition, then of course they would be profitable even if difficulty rose in response. Everyone not as efficient would at some point have to switch off their systems or spend more in OpEx than they would make in btc (which they can’t do for long). This is how the mfr of the 10 ASICs gains market share as they would produce 10 more of those ASICs to displace the less efficient systems on the network.
In general, I don’t know of any market for scarce commodities that is in a state of equilibrium. We’ve seen some wild price swings in the oil, corn prices etc thanks to manipulations or speculation and not based purely on supply/demand. I don’t know what Satoshi intended specifically about centralization, but the truth is that in any open market, even if it is open source technology like Linux or bitcoin,….. as it matures, it is reduced to the few strong players that survive. Every free market rewards those that are more efficient and/or technically superior and are able to gain market share by innovating or driving away weaker players. Why should bitcoin be any different, especially when there’s only market forces and no regulatory forces at play? What we are seeing with ASIC mining is that the pace of consolidation is probably much faster because of shorter obsolescence cycles.
You have a good comparison of centralized and decentralized systems and I agree that verification costs might be low, but the real costs of network come from the hashing involved. Even taking into account the high level of security that the current difficulty level represents, I find it hard to make a claim that the decentralized bitcoin infrastructure will have lower transaction processing (verification and transfer) costs than a centralized system…at least not at current tx volumes.
Thanks for the reply, this is a good exchange.
First, mining “costs.” My thesis is that in the long run the variable/operational costs of mining (electricity consumption, mostly) will converge to the value of the mining award, less some risk premia to compensate miners for the capex in mining gear. It’s the variable costs that really matter. An unprofitable mining investment will still be turned on if the operational costs are less than the market value of the mining award, both of those variables are known in real time. Likewise, it makes no sense to turn on a machine if you spend more in electricity than the expected value of the mining award at current prices, no matter what you paid for the gear.
Investment in mining gear (both by the miner and the manufacturer) is a risky decision based on expectations of bitcoin price, difficulty and future energy costs. All unpredictable (the degree of unpredictability in decending order). The payoff of those decisions is impossible to predict or model in the short run. But in the long run we can say that average returns will be roughly proportional to the variability of returns in mining investments because markets tend to learn and rationalise risk and return. So hashing costs = mining award – risk premia.
I rather think that including the risk premia term in the post and explaining all that would have done much more than over-complicate my point. Point being, that the variable costs spent hashing the network will roughly double if the price of bitcoin doubles, and it’s the price that’s the driving causal factor, not investment in mining gear, etc. Yes, those investments will matter a great deal to the relative profitability of one miner vs another, the ex-post distribution of hashing power, and all that. But it’s still bitcoin price that is driving the variable hashing costs, and the fixed costs (amortised capital expenditure, since you’re a stickler for the terminology) are internalised by the miners, not the network. That is why I disagree with the author’s statement “to the extent that miners’ expected marginal revenue exceeds their expected marginal costs, miners’ costs are likely to increase over time.”
And I’m not sure it’s true that “block rewards provide an upper limit on how much money is invested into mining”, as the lag between capital outlay and operation of a mining investment means that it is inevitably based on expectations of future bitcoin price and difficulty (being expectations, bounded by hope and fear only), hence my reference to Knightian uncertainty. Only hopes and fears put limits on the capex.
Your point about the frequency of blocks averaging below 10 mins is of course correct, but is this really material? A 15% increase in mining revenue that can only be sustained with continued increases in GHs or an upwardly trending BTC market. And if we ever reach periods of difficulty declines, block frequency will start to average more than 10 mins. So whilst descriptively correct, this isn’t a factor that can affect the long-term trend of mining costs, the point is kind of misses the big picture.
I’m not really sure I understand your objection to my point 3: “Say even if bitcoin price goes to $1500 next year I doubt that the remaining handful of miners are going to invest tremendous capital to capture that, because the btc earned is the same although the value may be different.” Do you really mean to suggest that the hashing power that is currently mining profitably (or at least without loss) with BTC/USD at $400 will not increase if the USD value of the mining award more than trebles? And that’s “because the btc earned is the same although the value may be different”? I don’t get your reasoning. Maybe they won’t invest in shiny new sub 20nm machines, but they will certainly throw more kWh at extant HW.
And I’m not sure I understand your objection to my what-if scenario, either. Those 10 hypothetical ASICS. If all 10 are turned on, a certain difficulty level will emerge that will determine a certain level of electricity consumed. We agree on that right? If the cost of that electricity over the interval is greater than the market value of the mining award over the interval, the miners will be mining at a loss. Holding the market value of the mining award and the cost of electricity constant, at some point some of those machines will have to be turned off (lowering difficulty).
Great and thoughtful piece- one issue that I don’t think I agree with you on:
“The market for media of exchange will gravitate towards those systems with the lowest transaction costs, and in the case of proof-of-work digital currencies, that means those protocols that forever subsidise hashing costs with the coin’s seigniorage (no supply cap).”
You have a basic thesis the coinbase award pays for the hashing and the transaction fees pay for the verification. Therefore, currently the bitcoin network is subsidized by the coinbase fee (and those are using it for transactions are getting a [right now very large] subsidy at the expense of those who are using to store value [whose holdings are reduced in value by the inflation caused by the coinbase fee]. This process will reverse over time so that those transacting on the network will ultimately subsidize those who are storing value when the transaction fees pay all hashing and verification costs.
The problem here is the dichotomy. Most people will use the network for both purposes (storing value and transacting). Therefore, whether they are paying costs based on transaction fees or based on the reduced purchasing power of their holdings will matter depending on the relative value to them of storing value vs. transacting. In a coin that continues a coinbase fee, it could have lower transaction costs, but fewer people may use it because they won’t want to keep their holdings on a system that where their value is being inflated away. They may not mind the nominally higher transaction fees of bitcoin to avoid the loss of value of their holdings.
Great comment, thank you. There are two issues here, one detailed and about Bitcoin, the other about money in general. First point. I don’t really think it’s the case that TX fees would ever subsidies hashing under the (unlikely) assumption that mining is distributed in future. With sender-defined fees, what incentive does a miner have to not include a TX with a fee that doesn’t exceed his processing (not hashing) costs? None. So there is a collective action problem here, whereby nobody has a private incentive to actually pay for hashing through fees. So some adhoc measures are required, like much larger protocol-defined minimum fees, or maybe the block size limit would do the trick. But there’s nothing in this design that rationally address the incentive problem of financing hashing when the coinbase award dwindles away. And this is an even more powerful objection than the one you quote about competition from competing schemes with lower TX fees due to perpetual coinbase award. It might not be possible to endogenously raise the fees to finance the hashing in the first place! That is clearly a bug in the protocol, IMO.
But all that is hypothetical, because it’s predicated on distributed mining and inexorable forces are driving centralisation in Bitcoin mining, which undercuts the raison d’etre of the whole project. Few want to admit this, but Bitcoin is no longer Bitcoin with most of the hash rate carved out among a small handful of miners. The market will quite sensibly run away from a unaccountable oligarchy, where monopolistic fee pricing, TX reversibility, etc all become possible. The idea wasn’t predicated on trust, but that’s what it will require going forward unless the community pulls its socks up and demands changes to the protocol.
And all of what i just said is totally independent of my next point. I don’t think the dual motive thing (I’ll accept the coin for payment cause i think it will increase in value / I’ll accept the coin as payment because it’s a good medium of exchange, others will accept it) works the way so many Bitcoiners think it does.
No asset has significantly higher risk-adjusted returns in the long run for the simple reason that expectations about the future get pushed into today’s prices. If demand for Bitcoin TX grows at an exponential rate, that will be (already is ?) anticipated by speculative demand, so the bullish case gets baked into the price long before it materialises, and uncertainty about that future generates volatility. No gain without pain.
And this is where the wheels fall of the wagon, I think. The volatility of a growth stock probably has no bearing on the demand for the product the company is selling. But the volatility of Bitcoin very much effects the demand for it as a general medium of exchange. So the erratic changes in today’s store-of-value demand undercut the very thesis on which the demand is based.
It’s stability of purchasing power that has utility to someone using it as a medium of exchange, and to achieve that, supply needs to respond to demand. Sure, rare stamps, wine, art, etc can be bought as a pure store of value because of its scarcity, and Bitcoin does trade like a collectable. But that’s also the kind of demand that chases away demand of the transactional sort. So you’ve gotta decide whether this thing is really gonna be money/payments or degenerate into a digital collectable. Collectable, not commodity… even gold has a somewhat elastic supply curve.
Interesting- so basically you don’t think bitcoin can survive- even if solves the problem of centralized mining and raises the block size limit/ raises minimum fees. I was thinking it would eventually have the stability/volatility of something like gold but be much easier to spend when you needed to use it. I think as long as the volatility is on the upside people will be happy and spend some over time (to realize the gains) but it certainly will be susceptible to panics.
Let’s assume that mining centralisation reverses and we go back to a distributed system. The model could work if TX velocity was always high enough that miners always had to ration TX because there are more TX than the block size limit will allow. In this scenario, marginal cost of a TX is validation costs + the fee of the i-th TX not included in the block (think of n TX sorted by fee amount, TX1,.., TXi,.., TXn). The level of hashing would be driven by TX velocity, but if that ever dropped below a certain threshold, there would be no incentive for fees to cover any hashing at all. That’s too fragile. So some sort of protocol change that fixes minimum fees over the cost of TX verification would be required. But that’s hard to do. Exchange rate fluctuates, verification costs change with technology and number of nodes, etc. Seems like a high price to pay in complexity just to avoid a perpetual coinbase award, which lacks purpose in my mind anyway. After all, a constant coinbase award is declining in % of total supply. Isn’t that scarce enough for the digital commodity crowd?
Nice post.
Any fixed schedule for coinbase rewards will eventually lead to an over-securing or under-securing of the network, depending on the coin’s price. If we make some hard rule today about the block rewards, what is the chance that the price of the coin in 20 years combined with that block reward will just happen to lead to a near-optimal level of security? The issue is the same with Ethereum — it’s just less likely to be as significantly under-secured (controlling for usage) as Bitcoin will be in the far future.
I believe that this can be solved with side-chains, because it should be possible to have an ever-inflating side-coin. So if I move 100 bitcoins to a side-chain now, then try to move them back in one year, maybe I only get 99 back because of the side-chain inflation. There can be competing side-chains with different levels of security. As long as the main chain is merge-mined with the side chains, I believe the network security of the main chain shouldn’t be lower than the security of any side chain. Since side-chains can be easily created, whenever the rules of a side-chain start leading to non-optimal levels of security a new chain can be created and people can migrate their coins there.
I agree that Bitcoin will likely never be a great unit of account as it stands now, even though volatility will decline somewhat as Bitcoin matures. The problem with trying to bake a volatility stabilizing mechanism into the network itself is that it seems very hard to do trustlessly. I think at one point you linked to a paper proposing that every time a block was mined, the miner could fill in a free parameter in the block which would act as a vote that would somehow cause the coin supply to change to reduce volatility. For example, this free parameter might be the Bitcoin/ exchange rate, then the network could know how to adjust the coin supply given that info averaged over the past X blocks. The issue is that to the miners, this is just a free parameter that they can vote on. Even if you want it to represent some exchange rate, they can start voting in any way that benefits them. Miners may coordinate (either through their votes or through other channels) to subvert anything you put into the network rules to reward miners for faithfully trying converge on the Schelling point that you’ve picked for them.
Do you agree that in the long run, the value of a bitcoin should grow at roughly the rate of gross world product? (See: the equation of exchange). If so, then I think there will be firms willing to hold Bitcoin and provide volatility-reducing services to regular people who don’t like volatility, while still paying them a positive return. Because of that, I still think Bitcoin has a good chance to be used as the backbone of our payment networks, even if it’s never a great unit of account.
Regarding your first paragraph, I completely agree. It’s not a feature to have the level of hashing costs fly around with the market value of the coinbase award.
As for sidechains, i think it’s a potential game changer that could save Bitcoin from self-destruction, provide a mechanism for the economics to adapt without repeated changes to the protocol, which are unlikely to happen given the need to win miner’s consent.
Also agree that stabilisation is a hard problem because of the difficulty of including outside market information in a trustless fashion. I’m skeptical of schemes that attempt to make reality a Schelling point. That’s a beautiful idea, but I’ve yet to see a scheme that is likely to work, and it may not be possible. My preferred approach is to extract what market information is latent in the protocol variables themselves, namely difficulty and fee levels.
As for your last paragraph, I haven’t a clue. Bitcoin demand should grow proportionally to the level of bitcoin trade, but because of that fixed supply, the coin’s valuation will reflect expectations of future trade growth rather than current growth. Given that future growth is so uncertain, the value of the coin will be volatile, and that volatility can undermine adoption and usage, so there is something self-defeating in the whole fixed supply design IMO. I don’t think 3rd party volatility reducing services are a solution. Everything has a price, and hedging volatility is expensive.
I’ve thought more about whether sidechains could save Bitcoin economically. I no longer think they can. Here’s why:
Suppose you have an inflating sidechain, where security is mostly paid for via 2% annual inflation. The problem is, people who don’t make many transactions can avoid this inflation by just keeping their coins on the main chain. You might think (as I did), that enough people will want to transact on the sidechain to generate enough security. But even when someone wants to make a transaction (a.k.a. people who transact), what reason do they have to first move their coins to the sidechain, rather than just pay the high Bitcoin transaction fee? In the end, network security is still paid entirely by transactors. Suppose Bitcoin needs one million dollars worth of security per day to be “secure enough.” Without sidechains, transactors are paying one million per day in transaction fees. In the sidechain case, people who are about to transact or who have just transacted are paying one million per day for the use of the sidechain. Either way the same burden falls entirely on transactors (although, among transactors the burden may shift around a little). These people will be looking to move to a blockchain where security costs are more equally shared.
My current thinking is that the most likely scenarios are (1) network security gets funded through altruism — donations/mining from individuals and companies (maybe even governments) who want to support the network for PR or because it makes them feel good, or (2) Bitcoin is forked into a version with perhaps a 2% inflation rate, and people slowly migrate to that version (led initially by people who actually use cryptocurrencies).
The blockchain exists to prevent double spends. The security of this system depends on the amount of $$ spent on mining. I don’t see that taken into account in the section “On the sustainability of low transaction fees”. When the mining rewards go away, either the volume of transactions or the fees per transaction will have to rise to ensure enough $$ are spent on mining to maintain double spend security.
One problem of course is that no one knows how much should be spent, i.e., how much $$ is “enough” to ensure double spend security. The makes the security of the system fairly subjective, i.e., it is difficult to objectively set or measure.