First of all, Cowen speaks of a “cryptocurrency-generating firm” that issues “blocks of cryptocurrency”. The idea here seems to be that the marginal costs of creating a crypto coin are close to zero (it’s just data after all), most costs being the fixed costs of setting up the cryptocurrency system.

But this has things the wrong way round. Creating a new crypto currency is as easy has forking the Bitcoin source code, hacking it, and throwing the fork up on a code repo. Fixed costs are practically zero. Marginal costs, however, equal the electricity costs (and amortised hardware costs) of solving a new block of transactions, as each new block contains a mining award for the peer whose hashing finds a solution to the system’s hash problem. This is how new coins are created.

To compensate a peer for the costs of doing this costly hashing work, he is allowed to pay himself a certain number of new coins in a special coinbase tx each time he solves the hash problem on a block. But the protocol ensures that the expected value of this mining award is offset by the cost of the requisite kilowatt hours needed to do the hashing. There are no issuers here “collecting rents”; it’s as if the seigniorage is sacrificed to the entropy gods.

Miners (the peers who choose to do the hashing) will work on new blocks only when the expected value of the mining award exceeds the cost of electricity required to run the hashing hardware. There are no restrictions of entry to mining, and the equilibrating mechanism is the protocol’s hashing difficulty. If the coin’s exchange value increases, making mining profitable at current difficulty, more miners will join the hashing effort and because of this, after 2016 blocks the protocol will adjust the difficulty upward making expected value of mining = costs of mining again. The same process works in reverse in the scenario where exchange value decreases. In the creation of crypto coins, MC = MP.

(It should be noted that this is a stochastic rather than deterministic equilibrium, as the difficulty resets approximately every two weeks. Furthermore, the miner is paying for electricity today for an award he will get at some point in future, so it’s really more of a case of MC = E[MP]. But these details are not relevant to the conclusions we want to draw in this post, so I’ll continue to speak as if the marginal cost of making new coins equals the exchange value of coin at any given point in time.)

There are two properties of hash-based proof-of-work that obscure these microeconomics. The first is the multi-factored economics of mining difficulty. Improvements in specialised hashing hardware increase mining difficulty but do not increase its cost. (These improvements should eventually converge to a Moore’s Law function of time when the mining rig manufacturers exhaust all of the low-hanging fruit and run into the same photolithography constraints faced by Intel, etc.) The efficiencies merely result in a higher hashing difficulty, a sort of digital Red Queen Effect.

Similarly, increases (decreases) in the price of electricity will decrease (increase) the difficulty without changing the costs of mining. (It should also be noted that mining will gravitate towards regions like Iceland where it is cold and electricity is relatively cheap.) The only variable that does change the cost of mining is the exchange value of the currency itself.

And this is the other barrier to realising that MC = MP. In Bitcoin and most of the alt-coins, money supply is a logarithmic function of time. As money supply growth is deterministic, changes in money demand are reflected in the exchange value of the coin, raising or lowering the cost of producing the next coinbase as the protocol adjusts the difficulty up or down in response to the entry or exit of hashing power. So the exchange value of the mining award determines the marginal costs rather than the other way round. An economist might find that pretty weird, but that is how it works.

It costs nothing to fork Bitcoin, hack the source, and create your very own alt-coin. But by itself, such a system is broken and has no bearing whatsoever on the economics of working cryptocurrencies. To make your alt-coin a working system, a sufficiently diverse group of miners must burn some costly kilowatt hours mining each block of transactions. Someone has gotta spend some capital to keep the lights on.

And the more kilowatt hours burned, the better, as the demand for a given cryptocurrency is a function of that system’s hashing costs (among other things, of course). The reason this is so has to do with the integrity of the most recent blocks on the distributed tx ledger, the blockchain. The amount of capital collectively burned hashing fixes the capital outlay required of an attacker to obtain enough hashing power to have a meaningful chance of orchestrating a successful double-spend attack on the system.

A double-spend is an event whereby the payee sees his payment N blocks deep and decides to deliver the goods or services to the payer, only to have this transaction subsequently not acknowledged by the network. Payments in cryptocurrency are irreversible, but double-spends are possible, and in economic terms they have the same effect that fraudulent chargebacks have in conventional payment systems like Visa or Paypal. The mitigation of this risk is valuable, and the more capital burned up hashing a crypto currency’s network, the lower the expected frequency of successful double-spend attacks.

Given that such events undermine confidence in the currency and drive its exchange value down (harming all holders, not just the victims of a double-spend), it should be axiomatic that a cryptocurrency’s hash rate is an argument of its money demand function.

This is also why it doesn’t make sense to speak of new cryptocurrencies expanding the aggregate crypto money supply without limit (or limited only by the fixed costs of creating one). What matters is how the aggregate hashing power, which is scarce, gets distributed over the set of extant cryptocurrencies. The obove reasoning predicts that hashing power will not spread itself arbitrarily thinly, keeping MC well-above 0. (The distribution currently looks more like a power law.)

From the perspective of mitigating double-spend risk, the more capital that is burned hashing the better because the frequency of double-spend attacks is inversely related to the amount of capital burned. But the marginal benefits of hashing are at some point diminishing and the cost of hashing is linear, so for the end-user of a cryptocurrency, there is some level of hashing that is optimal.

In our argument above for why MC = MP, we made a simplification in saying that the mining award consisted entirely of coinbase. In fact, it consists of coinbase plus tx fees. In a protocol like Bitcoin’s where money growth is logarithmic, most of the early hashing costs are paid for out of new money supply, but as time goes on, tx fees become a greater and greater proportion of the mining award (currently, tx fees are about 1/3rd of Bitcoin’s mining award).

Now here we do see a genuine network externality. Imagine that all hashing costs are paid out of tx fees (as will eventually be the case with Bitcoin). There will be a natural tendency for demand for crypto MOE to gravitate towards the system with a higher tx volume, as it will have lower fees per-transaction for a given level of hashing.

Now imagine that we have a range of cryptocurrencies along a spectrum. On one end of the spectrum is the logarithmic money supply protocol–we’ll call these “log coins”. On the other end of the spectrum is a protocol with perfectly elastic money supply–we’ll call these “growth coins”. Growth coins have a non-deterministic money growth rule, an algorithm that enlarges the coinbase just enough to offset any increase in money demand, so the exchange value is roughly stable as long as money demand is not in decline. (In a future post, we will outline a protocol that can actually implement something approximating this.)

Where can we expect demand for MOE to gravitate along this spectrum of cryptocurrencies? This is where the logarithmic money growth rule hits the skids. At the margin, seigniorage for the log coins is eaten up by hashing costs, but as money demand outpaces the (rapidly declining) growth rate of money supply, the exchange value of the currency increases and existing coin holders are the recipients of the seigniorage on all of the existing, revalued coin.

Growth coins, by contrast, generate most of the seigniorage in the form of a larger coinbase rather than revalued coin, meaning that most of the seigniorage is spent on hashing. The result is lower tx fees for the those who use growth coins as a MOE.

Given that tx fees will be shared between payer and payee, it’s hard to see how magic network economics will maintain the dominance of the log coins in the long run. Money demand coming from the transaction motive will gravitate towards the MOE with the lowest tx costs.

The scenario gets worse when we relax the monetarist assumptions (latent in the above analysis) of stable money velocity and demand proportional to tx growth. You don’t have to be a Keynesian to see how a large quantity of Bitcoin balances are held for speculative reasons. The high level of coin dormancy in the Bitcoin blockchain is as conclusive empirical evidence of this as there can be.

Bitcoin, therefore, has a free rider problem, whereby speculative coin balances, which benefit from the system’s costly hashing rate are effectively subsidised by those who use bitcoins primarily as a MOE. These speculative balances repay the favour by adding a toxic amount of exchange rate volatility, providing yet another reason for the transaction motive to run away from log coin MOE. As time goes on and the coinbase declines, this inequitable arrangement only gets worse.

As long as the growth rate of a growth coin’s money demand is sufficient to generate enough seigniorage in coinbase to cover the hashing rate demanded of its MOE users, transactions in growth coin are basically free. Some negligible fee will likely be required to deter DoS attacks (which has the interesting consequence of putting the goals of Adam Back’s Hashcash back into the cryptomoney that appropriated its designs), and its hard to see how one who wishes to hold crypto coin balances for the purpose of actually making transactions would prefer a log coin over a growth coin.

So maybe here is a new theorem: the value of a cryptocurrency will converge to its optimal level of hashing costs?

Fiat money via hash-based proof-of-work breaks new ground and we need to give the concept the attention and analysis it deserves. After all, we can dispense with the barbarous relic of logarithmic money supply and keep the good bits.