I would count myself in the camp who believe that cryptocurrencies could do to finance what TCP/IP did to communications. Yet I also believe that Bitcoin and most of its current variations suffer from a fatal economic design flaw that will not survive the evolution of cryptocurrencies. That flaw is logarithmic money supply growth, and in this post I will explain why it is flawed. My argument is a microeconomic analysis of cryptocurrency and has nothing to do with the much debated “deflationary bias”. As far as I am aware, the argument in this post has not been made before.
In a recent post Tyler Cowen adapts an old chestnut of the money literature to cryptocurrencies. Cowen’s argument is based on some false assumptions, but it has the virtue of starting from the right microeconomic principles, so it’s an excellent point of departure.
Once the market becomes contestable, it seems the price of the
dominant cryptocurrency is set at about $50, or the marketing costs
faced by its potential competitors. And so are the available rents on
the supply-side exhausted.There is thus a new theorem: the value of WitCoin should, in
equilibrium, be equal to the marketing costs of its potential
competitors.
In defence of the dominant cryptocurrency, Bitcoin, one might accept this argument yet object to its pessimistic conclusions by pointing out that Cowen is ignoring powerful network externalities. After all, coins residing on different blockchains are not fungible with one another. Cowen seems to treat these things as if they’re near substitutes, but maybe it’s a Visa/Mastercard sort-of-thing.
I want to dismiss this objection right away. We should be sceptical of ambitious claims about the network externalities of any one cryptocurrency. The network externalities of established fiat currencies are, of course, enormous, but this is largely due to their having a medium-of-account (MOA) function (to say nothing of legal tender and taxation), as well as a medium-of-exchange (MOE) function. Transactions settled in a cryptocurrency consult the exchange rate at the time of settlement and therefore piggy-back off the numeraire of an established fiat currency. Cryptocurrencies are not MOA, they are MOE only.
And given the near-frictionless fx between cryptocurrencies themselves, it’s not difficult to imagine a payment front-end for routine payees like on-line retailers that accepts a wide range currencies as MOE. And multi-coin wallet software for payers is a no-brainer.
So, for the sake of argument, I’m going to assume that the network externalities of any given cryptocurrency are close to zero. On Cowen’s analysis, this would imply that the marginal cost of cryptocurrency is near-zero. And this means:
Marginal cost of supply for the market as a whole is perhaps the
(mostly) fixed cost of setting up a new cryptocurrency-generating
firm, which issues blocks of cryptocurrency, and that we can think of
as roughly constant as the total supply of cryptocurrency expands
through further entry. In any case this issue deserves further
consideration.
This is a long-time objection to the workability of competitive, privately issued fiat currencies. The cost structure of their production cannot be rationalised with their value. A market of competing fiat currencies with “stable” purchasing power will generate too much seigniorage to their issuers, inviting more competition until the purchasing power of these media rationalise their cost of production.
If we can’t lean on the economics of network externalities, what’s wrong with this argument?
The marginal cost of new coins is the cost of hashing a block
First of all, Cowen speaks of a “cryptocurrency-generating firm” that issues “blocks of cryptocurrency”. The idea here seems to be that the marginal costs of creating a crypto coin are close to zero (it’s just data after all), most costs being the fixed costs of setting up the cryptocurrency system.
But this has things the wrong way round. Creating a new crypto currency is as easy has forking the Bitcoin source code, hacking it, and throwing the fork up on a code repo. Fixed costs are practically zero. Marginal costs, however, equal the electricity costs (and amortised hardware costs) of solving a new block of transactions, as each new block contains a mining award for the peer whose hashing finds a solution to the system’s hash problem. This is how new coins are created.
Mining in equilibrium
To compensate a peer for the costs of doing this costly hashing work, he is allowed to pay himself a certain number of new coins in a special coinbase tx each time he solves the hash problem on a block. But the protocol ensures that the expected value of this mining award is offset by the cost of the requisite kilowatt hours needed to do the hashing. There are no issuers here “collecting rents”; it’s as if the seigniorage is sacrificed to the entropy gods.
Miners (the peers who choose to do the hashing) will work on new blocks only when the expected value of the mining award exceeds the cost of electricity required to run the hashing hardware. There are no restrictions of entry to mining, and the equilibrating mechanism is the protocol’s hashing difficulty. If the coin’s exchange value increases, making mining profitable at current difficulty, more miners will join the hashing effort and because of this, after 2016 blocks the protocol will adjust the difficulty upward making expected value of mining = costs of mining again. The same process works in reverse in the scenario where exchange value decreases. In the creation of crypto coins, MC = MP.
(It should be noted that this is a stochastic rather than deterministic equilibrium, as the difficulty resets approximately every two weeks. Furthermore, the miner is paying for electricity today for an award he will get at some point in future, so it’s really more of a case of MC = E[MP]. But these details are not relevant to the conclusions we want to draw in this post, so I’ll continue to speak as if the marginal cost of making new coins equals the exchange value of coin at any given point in time.)
Why isn’t it obvious that MC = MP?
There are two properties of hash-based proof-of-work that obscure these microeconomics. The first is the multi-factored economics of mining difficulty. Improvements in specialised hashing hardware increase mining difficulty but do not increase its cost. (These improvements should eventually converge to a Moore’s Law function of time when the mining rig manufacturers exhaust all of the low-hanging fruit and run into the same photolithography constraints faced by Intel, etc.) The efficiencies merely result in a higher hashing difficulty, a sort of digital Red Queen Effect.
Similarly, increases (decreases) in the price of electricity will decrease (increase) the difficulty without changing the costs of mining. (It should also be noted that mining will gravitate towards regions like Iceland where it is cold and electricity is relatively cheap.) The only variable that does change the cost of mining is the exchange value of the currency itself.
And this is the other barrier to realising that MC = MP. In Bitcoin and most of the alt-coins, money supply is a logarithmic function of time. As money supply growth is deterministic, changes in money demand are reflected in the exchange value of the coin, raising or lowering the cost of producing the next coinbase as the protocol adjusts the difficulty up or down in response to the entry or exit of hashing power. So the exchange value of the mining award determines the marginal costs rather than the other way round. An economist might find that pretty weird, but that is how it works.
Network security and the crypto money demand function
It costs nothing to fork Bitcoin, hack the source, and create your very own alt-coin. But by itself, such a system is broken and has no bearing whatsoever on the economics of working cryptocurrencies. To make your alt-coin a working system, a sufficiently diverse group of miners must burn some costly kilowatt hours mining each block of transactions. Someone has gotta spend some capital to keep the lights on.
And the more kilowatt hours burned, the better, as the demand for a given cryptocurrency is a function of that system’s hashing costs (among other things, of course). The reason this is so has to do with the integrity of the most recent blocks on the distributed tx ledger, the blockchain. The amount of capital collectively burned hashing fixes the capital outlay required of an attacker to obtain enough hashing power to have a meaningful chance of orchestrating a successful double-spend attack on the system.
A double-spend is an event whereby the payee sees his payment N blocks deep and decides to deliver the goods or services to the payer, only to have this transaction subsequently not acknowledged by the network. Payments in cryptocurrency are irreversible, but double-spends are possible, and in economic terms they have the same effect that fraudulent chargebacks have in conventional payment systems like Visa or Paypal. The mitigation of this risk is valuable, and the more capital burned up hashing a crypto currency’s network, the lower the expected frequency of successful double-spend attacks.
Given that such events undermine confidence in the currency and drive its exchange value down (harming all holders, not just the victims of a double-spend), it should be axiomatic that a cryptocurrency’s hash rate is an argument of its money demand function.
This is also why it doesn’t make sense to speak of new cryptocurrencies expanding the aggregate crypto money supply without limit (or limited only by the fixed costs of creating one). What matters is how the aggregate hashing power, which is scarce, gets distributed over the set of extant cryptocurrencies. The obove reasoning predicts that hashing power will not spread itself arbitrarily thinly, keeping MC well-above 0. (The distribution currently looks more like a power law.)
Who pays to keep the lights on?
From the perspective of mitigating double-spend risk, the more capital that is burned hashing the better because the frequency of double-spend attacks is inversely related to the amount of capital burned. But the marginal benefits of hashing are at some point diminishing and the cost of hashing is linear, so for the end-user of a cryptocurrency, there is some level of hashing that is optimal.
In our argument above for why MC = MP, we made a simplification in saying that the mining award consisted entirely of coinbase. In fact, it consists of coinbase plus tx fees. In a protocol like Bitcoin’s where money growth is logarithmic, most of the early hashing costs are paid for out of new money supply, but as time goes on, tx fees become a greater and greater proportion of the mining award (currently, tx fees are about 1/3rd of Bitcoin’s mining award).
Now here we do see a genuine network externality. Imagine that all hashing costs are paid out of tx fees (as will eventually be the case with Bitcoin). There will be a natural tendency for demand for crypto MOE to gravitate towards the system with a higher tx volume, as it will have lower fees per-transaction for a given level of hashing.
Now imagine that we have a range of cryptocurrencies along a spectrum. On one end of the spectrum is the logarithmic money supply protocol–we’ll call these “log coins”. On the other end of the spectrum is a protocol with perfectly elastic money supply–we’ll call these “growth coins”. Growth coins have a non-deterministic money growth rule, an algorithm that enlarges the coinbase just enough to offset any increase in money demand, so the exchange value is roughly stable as long as money demand is not in decline. (In a future post, we will outline a protocol that can actually implement something approximating this.)
Where can we expect demand for MOE to gravitate along this spectrum of cryptocurrencies? This is where the logarithmic money growth rule hits the skids. At the margin, seigniorage for the log coins is eaten up by hashing costs, but as money demand outpaces the (rapidly declining) growth rate of money supply, the exchange value of the currency increases and existing coin holders are the recipients of the seigniorage on all of the existing, revalued coin.
Growth coins, by contrast, generate most of the seigniorage in the form of a larger coinbase rather than revalued coin, meaning that most of the seigniorage is spent on hashing. The result is lower tx fees for the those who use growth coins as a MOE.
Given that tx fees will be shared between payer and payee, it’s hard to see how magic network economics will maintain the dominance of the log coins in the long run. Money demand coming from the transaction motive will gravitate towards the MOE with the lowest tx costs.
Free-riding not gold buying
The scenario gets worse when we relax the monetarist assumptions (latent in the above analysis) of stable money velocity and demand proportional to tx growth. You don’t have to be a Keynesian to see how a large quantity of Bitcoin balances are held for speculative reasons. The high level of coin dormancy in the Bitcoin blockchain is as conclusive empirical evidence of this as there can be.
Bitcoin, therefore, has a free rider problem, whereby speculative coin balances, which benefit from the system’s costly hashing rate are effectively subsidised by those who use bitcoins primarily as a MOE. These speculative balances repay the favour by adding a toxic amount of exchange rate volatility, providing yet another reason for the transaction motive to run away from log coin MOE. As time goes on and the coinbase declines, this inequitable arrangement only gets worse.
Optimal cryptocurrency
As long as the growth rate of a growth coin’s money demand is sufficient to generate enough seigniorage in coinbase to cover the hashing rate demanded of its MOE users, transactions in growth coin are basically free. Some negligible fee will likely be required to deter DoS attacks (which has the interesting consequence of putting the goals of Adam Back’s Hashcash back into the cryptomoney that appropriated its designs), and its hard to see how one who wishes to hold crypto coin balances for the purpose of actually making transactions would prefer a log coin over a growth coin.
So maybe here is a new theorem: the value of a cryptocurrency will converge to its optimal level of hashing costs?
Fiat money via hash-based proof-of-work breaks new ground and we need to give the concept the attention and analysis it deserves. After all, we can dispense with the barbarous relic of logarithmic money supply and keep the good bits.
cryptonomics 
Pingback: The marginal cost of cryptocurrency — does the price of Bitcoin have to fall so much from contestability?
Nice analysis, I’m looking forward to your post about “growth coin.”
One thought: a new coin can be designed so that hashing power for security may be shared using “merged mining” — Namecoin, for example, is merge-mined with Bitcoin. I haven’t tried to think through how that might change your analysis.
Thanks Gavin. Your point about merged mining is important and I was ignoring it in this post, assumption being that a hash could only be computed one chain at a time. Initial thoughts: can’t decide whether this makes Tyler’s argument go through, or whether it renders the coin that supports shared mining (Namecoin) go to zero in the absence of network externalities whilst leaving the coin that doesn’t support it (Bitcoin) unaffected. Need to think about it.
I’ll post a sketch of the ‘growth coin’ protocol soon.
Very interesting post and the impact of merged mining on competition between cryptocurrencies is also an interesting angle, in a low-network-effect world it can lead to a race to the bottom of transaction costs / seigniorage. I’ve just published a note on this, you may find it interesting and relevant to this discussion. http://wp.me/p4gZ0U-a
Great post. I larn’d plenty.
What about crypto phenomenon like Ripple that don’t use the Bitcoin/alt-coin proof-of-work but rely on consensus for maintaining the integrity of the block chain? If Ripple can maintain the same level of security for a fraction of the costs, doesn’t this change the economics of the entire crypto universe?
Ripple is interesting and I’ve always thought it’s decentralised credit model is a promising alternative payments network for national fiat payments and fx.. If it can get critical mass and keep the gateways from being regulated as banks. Unlike BTC, et all XRP does have long-run network effects that aren’t tied to hashing costs.. If the Ripple network is used, there must be demand for XRP. I must confess to being puzzled by the founders marketing strategy, which hasn’t done a great job in building confidence around what seems to be a very sound idea with an unusually strong first-mover advantage.
Maybe this is what you’re saying already, but I’d like to add this observation: if people start using Ripple because of its ability to make Bitcoin-like payments with state-backed currencies across borders, that by itself will create demand for XRP. Ripple will automatically use its built-in foreign exchange component to convert from a source currency to a destination currency. And because XRP is the only currency in the Ripple network that doesn’t need gateways and consequently doesn’t have counterparty risk, XRP will become the main countercurrency and the order books against XRP will have the greatest depth. Any time anyone makes an international payment, they’ll likely be converting from their source currency to XRP and from XRP to their destination currency without even needing to be aware of it. I think this is a master stroke on the part of the creators of Ripple.
Endogenous demand certainly helps. You need USD to pay US taxes, you need XRP to use the Ripple payment system. But I do think the hash-based currencies serve demands that will not be met by XRP, like anonymity features, and especially the many tx types that scripting make possible.
Robert, my most recent post mentions this one. Cheers.
http://jpkoning.blogspot.ca/2014/01/bitcoins-bootstraps.html
It would be interesting to see Ripple included in the discussion as it’s not hash-based and could provide nearly frictionless conversion between all currencies, both official state currencies and cryptocurrencies. And of course, Ripple has its own XRP which could piggy-back on the success of others, given its special status within the Ripple system as a bridge currency.
First!
A fascinating post. Thank you. I’m still digesting it. In the mean time, could I trouble you to make an RSS link to your blog available? It would make it much easier for me (and presumably others) to follow you.
Added to the sidebar. RSS is enabled btw, you can also just add cryptonomics.org/feed to your feed reader.
Robert,
Thanks or the tons of useful frameworks questions and concepts. I am puzzled, though, by your distinctions between growth and log coins and the conclusions you draw from them.
I assume for you a growth currency means simply a class of coins that will continue forever to create new items as a result of mining, as opposed to BTC’s post 2140 scenario. Also, I assume for the sake of simplicity, that the algorithm is such that it (sort of) keeps the exchange rate vs fiat (or bread) constant.
Under such scenario, MOE users will be happy because they do not pay any tx fees. Since they are high churners, they do not care for currency appreciation. It’s a bit like holding gold ingots in the basement while using Zimbabwean dollars to buy smokes, since the latter are easier to store and carry and you do not plan to keep them long enough to suffer devaluation. You might see this as a portfolio allocation issue for individuals rather than as a distinction between two classes of holders.
The thing that puzzles me, tough, is that the rate of appreciation of a log coin and rate of expansion of a non-deflationary coin are by no means constant nor irrelevant to this argument. BTC is in monetary expansion today, and yet it is increasing in value because demand oustrips supply. This is hardly a permanent state of affairs. If there were perfect information about BTC future value, its demand and value today would reflect this info and, while supply expands, maybe decline in value somewhat. Conversely, after 2140 increases in BTC demand would only come from (shorthand) economic growth.
At the same time, a growth coin, assuming you could create an acceptable algorithm, could be pegged to, say a value of $1k or maybe to 200 Whoppers. In moments of high economic growth, that might mean juicy new coin mining rewards, and in moments of crisis, no reward at all. Would you even design a negative reward to accommodate the required monetary contraction?
I could think of more issues, but this is just a commentary. I look forward to your further thoughts.
“In moments of high economic growth, that might mean juicy new coin mining rewards, and in moments of crisis, no reward at all. Would you even design a negative reward to accommodate the required monetary contraction?”
You’re totally thinking along the right lines. This post focused on the micro, so the discussion of the log coin / grown coin spectrum was very stylised and I explicitly assumed a “normal” state where money demand is always increasing in the medium run.
What to do with the macro scenario of decline in money demand? In the absence of a central bank willing to buy back supply in exchange for some other asset, the options are limited.
You could code a type of demurrage (like Freicoin, but dynamic so only kicked in when demand dropped) but shrinking supply that way would be self-defeating, reducing demand even further. By its anarchic design, a cryptocurrency cannot offer something else of value to the market when mkt decides it doesn’t want to hold so much of it; a central bank can sell the bonds and fx reserves it has on its balance sheet.
The only practical thing is to take the growth end of the spectrum, but not go all the way. So code the protocol to allow some fx appreciation with increased demand (so the speculators have a reason to buy when demand drops) but not too much.
The goal is to reduce volatility, as that will attract the tx demand which is more predictable than spec demand and gives rise to a virtuous feedback loop.
But we mustn’t forget, this is fiat money, so the whole edifice rests on confidence and nothing can save a fiat money from the scenario where few want to hold it. My point is that confidence is more likely to be had by a system that punishes spec demand with more supply and rewards tx demand with fx stability.
Very insightful analysis. Thank you.
I suspect that log coins will hold their dominance (over growth coins) purely because they allow for faster nominal appreciation of Cryptocurrency to Dollar value. In my opinion, the major property of Bitcoin that will drive its adoption is its rising price. If this is true, currency that optimizes for fast rise in nominal value should prevail over other currencies with more favourable transaction costs (especially as a MOV).
I would be interested in your opinion regarding Proof of Stake systems. Proof of Work systems, as you pointed out, seem to have an extreme power law relationship for market capitalisation. As proof of stake systems are “supposed” to require less hashing power to support to network, should we expect a less extreme winner take all effect in competing proof of stake systems?
Pingback: Merged Mining and Cryptocurrency Competition |
Why do you call Bitcoin and its clones log-coins? Their money supply isn’t logarithmic, but exponentially declining to a fixed cap.
I was thinking of the growth rate of money supply, and the growth rate of Bitcoin’s money supply approximates the growth rate of a logarithmic function. The growth rate only goes to 0 because of the 8 decimal place resolution (which could be changed), so in principle the coinbase could keep halving forever and growth rate is always +, just declining.
I think you have the free rider problem backwards: the block reward is a temporary subsidy paid for by diluting speculative holdings. If anything it’s those who spend the currency that have a free ride because otherwise they would have to pay higher transaction fees and it’s those who hold BTC who pay for it. But that argument doesn’t really make sense either, because BTC cannot appreciate to its full potential unless it is used for actual payments.
I was thinking of the end-game, when new money supply is a negligible part of the mining award. Someone who turns over his average coin balance X times over the period is subsidising the person who is buy-and-hold, as both benefit from the hashing rate yet only the former is contributing to pay for it.
There are some more assumptions that seem highly questionable to me. I don’t understand how a “cheaper” rival coin would have any advantage at all. Since each bitcoin is divisible into 100M satoshis, the absolute price matters very little, its utility is determined by its volatility not its price. A cheaper coin is no more useful, and a more volatile one is less useful. I don’t see how this could lead to a race to the bottom, and a gradual trend towards stability of the largest coin seems more likely. And competition on price (transaction fees) is limited by hardware. It’s possible that a cryptocurrency that uses a cheaper mechanism to reach a distributed consensus for the same level of security, or at least has a sufficient level of security, could have a competitivge advantage. Ripple or clones of Ripple could be an example.
I am referring to the % of hashing costs that are paid for out of tx fees. A coin whose growth rate matches the growth rate of its demand (approximately, of course) will pay a greater % of its hashing costs out of seigniorage rather than tx fees, and in that sense is “cheaper” for those who use it as a MOE, whereas a ccy like Bitcoin will eventually pay for almost all hashing out of tx fees, so is more expensive. I completely agree that volatility of the fx rate is what matters, not its level, which by itself is meaningless.
Pingback: Life as I see it podcast episode #11 Bitcoin pt.2 | Life As I See It
Pingback: Bitcoin as Rorschach Test. Some see Traditional Currency. Others see Byzantine Generals. | Praxtime
Pingback: Interesting posts to add to your reading stack | Great Wall of Numbers
Pingback: The “pain point” of payments in the developed world | Great Wall of Numbers
Pingback: Will colored coin extensibility throw a wrench into the automated information security costs of Bitcoin? | Great Wall of Numbers
Pingback: Comment of the day: Mining Rewards | Great Wall of Numbers
Pingback: Some Crypto Quibbles with Threadneedle Street | cryptonomics
Pingback: 由英格兰银行报告，展开一些关于加密货币的探讨 | 巴比特
Pingback: Slicing data: what comprises blockchain transactions? | Great Wall of Numbers
Pingback: Bitcoin Faucet Rotator Blog Bitcoin's bootstraps
Pingback: What’s the deal about DAOs? | Great Wall of Numbers
Pingback: Book review: Blockchain Revolution | Great Wall of Numbers
Pingback: Book Review: The Business Blockchain | Great Wall of Numbers
Pingback: What's the deal with DAOs? | Test
Pingback: What Dogecoin Must Do to Survive - Cryptohub Media
Pingback: Bitcoin, Ethereum and Pigou: the economics of transaction fees | Crypto News Desk
Pingback: ¿Dogecoin en caída libre?... Tiempo de acumular • El Mercado
Pingback: Dogecoin en caída libre... ¿Tiempo de acumular? - cultura nativa | Respuestas para la gestión
Pingback: Dogecoin en caída libre... ¿Tiempo de acumular? • El Mercado
Pingback: What Dogecoin Must Do to Survive – CryptoCoinerDaily
Pingback: What Dogecoin Must Do to Survive – Vts-Block
Pingback: What Dogecoin Must Do to Survive – Crypto News BTC
Pingback: What Dogecoin must do to survive - HolyTransaction's Blog