(This post is part of the Understanding GHOSTDAG series)

So far, we mostly assumed that a majority of the miners is honest. That is, that they follow the protocol as we described it. But how justified is this assumption?

This point tends to be glossed over, but is actually very crucial. In cryptography, we can never expect anyone to act altruistically, or for the “greater good”. Indeed, the ideal “honest miner” we describe is just a convenience of exposition. In reality, it is the protocol designer’s responsibility to incentivize miners to act “honestly”.

This brings us into the world of game theory, and more specifically, mechanism design: the art of designing a protocol where the global interests align with the interest of the player.

The incentives are measured in terms of utility. That is, we define some quantifiable goal, and assume that a majority of miners pursue this goal. When considering a cryptocurrency, the standard incentive is to maximize income in terms of this coin. We call miners that seek to maximize this utility rational, and assume a rational majority.

The first uncomfortable reality we need to come to terms with is that, since the utility is defined in terms of coins, the mechanism design cannot be limited to the consensus layer: the consensus layer is completely agnostic to what the blocks actually represent, and in itself provides no utility to maximize.

For example, Bitcoin aligns its incentives by only providing block rewards and fees to blocks that are on the selected chain. One can then argue that rational miners are incentivized to always mine on top of the selected tip, since mining on top of a different block reduces their probability to get a reward, and whereby their expected income.

But is this enough to say that the rational strategy coincides with the honest strategy? Not quite. Recall that there is actually a second rule an honest miner is expected to follow: immediately broadcasting any discovered block. However, selfish mining strategies show that miners can increase their utility by withholding blocks. This means that even in Bitcoin, the rational strategy is different than the honest strategy. Moreover, there is no known (and arguably no existing) solution to selfish mining. So does that mean that all is lost? Not quite. Recall that even though selfish mining is a rational deviation from the honest security, it is actually really hard to pull off: it requires a huge fraction of the global hashrate. This justifies the assertion that the rational strategy is a good enough approximation of the honest strategy.

The second uncomfortable reality is that this kind of argument is prevalent throughout the theory. Rational strategies are often very complicated, and we are forced to consider simpler strategies. Hence, it is a very important part of the analysis to quantify the discrepancy between honesty and rationality, and argue that it is not detrimental. The many analyses of selfish mining show that it becomes negligible in regimes where all miners are sufficiently small.

A third unfortunate truth is that no utility function we define can capture the entire complexity of realistic systems. The statement that a miner is “rational” is a mathematical one, not a judgement of personality. Miners can have a variety of reasons to deviate from the rational strategy, the only meaning of “irrationality” is that their rationale is not manifest in our utility function.

For example, there have been cases where miners from one chain attacked a much smaller chain that uses the same hashing algo. This sort of grievance attack looses money for the sake of disturbing another chain. Is this attack profit maximizing? Answering even that is quite impossible. It could be that harming the smaller chain causes the value of the coin of the larger chain to increase, profiting the miner more than he lost. It could be that the miner has an ideological reason behind it that he considers worth the expense. To actually model grievance attacks we need to track and quantify all sorts of stuff, such as how the security of one cryptocurrency affects the value of another, and the value of damage in terms of money as well as the amount of coin the possible attacker holds. The game theory of very realistic scenarios becomes unwieldy very quickly, which is why literature is concerned with understanding the simple cases and the consequences of deviations instead of trying to capture the full complexity of reality.

Irrational strategies don’t have to be a consequence of malice. A very common example is that of opportunistic mining, where miners constantly hop to the coin currently most profitable to mine. They only seem “irrational” from the point of view of a single chain. When considering together all chains that could be mined by their hardware, they do look profit maximizing. A more subtle form of “irrationality” are miners that do work to maximize their profit, but by making assumptions outside the model. For example, a miner could throttle the chain to discourage other miners from mining, so that after they turn off their machines (or direct them to another chain) she could mine a bigger share, ultimately increasing her cut. Such a miner is not “irrational” for having a different utility, but for having different assumptions about the rationality of other miners.

There are two takeaways from this discussion:

1. It is the responsibility of a protocol designer to explain how the incentives are laid out to justify the honesty assumption.

2. No model of rationality will ever be complete, so it is better to provide evidence of some robustness. Showing that small deviations from the honest strategy do not change the strategy for other miners. This is usually done by investigating the so-called Nash equilibria of the game, and is typically an exacting and mathematically challenging endeavor.

The Pico Network: A Case Study in Poorly Aligned Incentives

Unfortunately, many projects assume that rationality coincides with honesty without providing any evidence. This sometimes results in absurd situations.

Consider a hypothetical cryptocurrency called Pico with the following outline:

• Anyone with an amount of coin beyond some small threshold is allowed to vote

• In order to be confirmed, a transaction must be accepted by more than two thirds of the votes (weighted by coins)

• Holders of any amount of coins can delegate their votes to a representative

• There are no fees. Voters do not get rewarded for participating in the voting process, and representatives do not get rewarded for aggregating votes

What is the rational strategy for this protocol? After scratching your head a bit one might come to a striking conclusion: all strategies are equally rational. Since there are no incentives, all behaviors are rewarded the same way: not at all.

However, this is not quite the case. We do have one implicit assumption: that posting transactions on Pico is a valuable service. By assuming that the average people would be willing to pay even a small amount to use Pico rather than not using it at all, an explicit equilibrium emerges.

Say that one of the representatives has 40% of the votes, and they suddenly decide that they would only confirm transactions from users who pay them a fees. Note that since two thirds of the votes are required, anyone who does not cough up a fee will forever remain unable to use the system.

“But wait,” say the Pico enthusiasts, “why would people delegate their votes to such a mean representative? If their representative has become greedy, wouldn’t they just all flock to a more considerate representative?”
The first observation is: so what if they leave? Recall that the representative is not reimbursed in any way for his representation. He has nothing to lose by enacting this policy. This is where the lack of incentives shines. This observation is key, but is not sufficient: because the delegates themselves also have nothing to lose by only delegating to non-greedy representatives. However, this could be changed: all the greedy representative has to do is to share their profit with his delegates. Now, a profit maximizing delegate would rather stay with the greedy representative. Yes, it might benefit the greater good if all delegates (or at least more than two thirds of them, weighted by coin) choose to avoid greedy representatives, but getting many individuals to give up profit so that the greater good may benefit is a very hard thing to pull off. This is known as the Tragedy of the Commons, an observation at least three millennia old and still under heated discussion.

“Okay but hang on,” say the Pico enthusiasts, “why would we even reach a situation where there is a representative with 40% of the votes? I should assume we will be much more decentralized than that.” And that might be the case, but then what prevents many small representatives from making that same decision? Again, the lack of incentives shines: yes, they might lose delegates for charging a few, but again: so what? It’s not like they are rewarded in any way for representing them, its not like this incurs a cost. They can just pose this requirement hoping that eventually the total number of charging representatives will cross the critical threshold of one third, and then charging for inclusion would be a market norm.

The chronology of it all does not really matter. What matters is that if we assume that including transactions has value, that is, that users are willing to pay for that service (if they have no choice), then the equilibrium of the market is that all representatives charge for inclusion. This is essentially a black staking market. Delegates get compensated for locking their coins for voting, except they aren’t paid from coins minted by the protocol but by other users who wish to transact. The result is actually much more cruel than PoS, since the user is the one reimbursing the delegates, they must pay at least two thirds of the delegates for posting a transaction, and not just a fee to a single block proposer.

Interestingly, this dynamic is only possible once Pico is sufficiently adopted. This is apparent if we take into account the value of Pico itself. Typically, voters would some meaningful amount of Pico, and would not want to see it devalued by the network’s failure to maintain it’s “no fees” value proposition. When the network has not extrinsic value (i.e., the only reason people want to use it is because it is feeless), this incentive might be sufficient. But if Pico ever gets adopted to a point where anyone depends on it, then the value of Pico as a coin will decouple from the value of the service of sending Pico around. This becomes even more bluntly obvious when you realize the representatives can charge their fees in any coin, even fiat.

Had Pico actually existed, this “so why hasn’t it happened yet” false sense of security could seriously mislead people to ignore this gaping hole in its game theory. However, it will either backfire if Pico is sufficiently adopted, or prevent Pico from being adopted in the first place.

The bottom line is that you can’t escape incentivizing rational players to be honest. If you try to, even the slightest externality would undermine your assumption. Incentives provide robustness against external manipulation, and any (permissionless) system that tries to circumvent them is doomed to be brittle and unreliable.

To conclude I just want to stress again that this discussion is purely hypothetical. Surely if anyone wanted to create a cryptocurrency along the lines of this design, they would pay their technical debt and properly analyze the equilibria of their market before actually launching a mainnet. Anything else would be extremely irresponsible. Fortunately, there is no actual cryptocurrency like N... erm, Pico.