Ethereum founder Buterin: Inflation, transaction fees and cryptocurrency strategy

The main cost of a blockchain is the cost of its security. A blockchain must pay miners or validators to participate in the consensus protocol through economic means. This cost is unavoidable whether it is a proof-of-work or proof-of-stake mechanism. There are two ways to pay for these costs: inflation and transaction fees. Currently, the two most important blockchains are Bitcoin and Ethereum, and both pay for their security costs through high inflation. The model adopted by the Bitcoin community is to gradually reduce inflation over time and eventually rely entirely on transaction fees. Futurecoin, a larger proof-of-stake currency, relies entirely on transaction fees for its security costs, but because some functions require the destruction of some Futurecoins, Futurecoin actually has negative inflation; the current total supply of Futurecoins is 0.1% less than its original supply of 100 million. So the question is, how much "defense expenses" does a blockchain need to pay for its security? If there is a specific total amount of expenses, what is the best way to get it?

The absolute size of Proof of Work/Proof of Stake (PoW/PoS) rewards

In order to provide empirical data for the next chapter, we will analyze Bitcoin as an example. In the past few years, Bitcoin transaction fees have ranged from 15 to 75 Bitcoins per day, or 0.35 Bitcoins per block (1.4% of the current mining reward), with transaction fees varying greatly with the level of Bitcoin adoption.

The reason is not hard to see: as the popularity of Bitcoin increases, the total amount of transaction fees denominated in US dollars will also increase (either due to an increase in transaction volume, or an increase in transaction fees, or both), yet the same amount of US dollars will exchange for fewer Bitcoins, so it makes sense that, excluding the block capacity crisis, changes in Bitcoin's popularity will not lead to changes in the underlying market structure, and the total amount of transaction fees denominated in Bitcoin will not change much.

In the next 25 years, the mining reward for Bitcoin will be almost gone. Therefore, the 0.35 Bitcoin transaction fee per block will become all the revenue. At today's prices, this revenue is about $35,000 per day, or $10 million per year. We can estimate the cost of purchasing enough computing power to take over the network through different methods.

First, let's look at the network's hashrate and the cost of consumer-grade miners. The network's current hashrate is 1,471,723 TH/s, and the optimal miner cost is $100 per TH/s, so the cost of buying so many miners is $147 million. If you don't count mining rewards, then mining revenue will be reduced by one-thirty-sixth, so in the long run, the Bitcoin mining ecosystem will be reduced to one-thirty-sixth of what it is now, so the purchase cost becomes $4.08 million. And this is assuming you buy new miners. If you buy existing miners, you only need to buy half of them, and the cost of attacking Tim Swanson's so-called "Maginot Line" drops to $2.04 million.

Moreover, the cost of professional mining farms is much lower than that of consumer-grade miners. Let's take a look at the relevant data of Bitfury's $100 million data center, which has a total power consumption of 100 MW. This mining farm uses 28nm and 16nm mining chips. The 16nm chip can achieve an energy efficiency of 0.06 joules/g. Because we are concerned about the cost of attack, we assume that Bitfury only uses 16nm chips. 100 MW can obtain 1.67 billion GH/s of computing power at an efficiency of 0.06 joules/g (0.06 joules/g=1 watt/GH/sec), or 1.67M TH/s of computing power. Therefore, Bitfury's computing power cost can be achieved at the level of $60 per TH/s. In this way, through calculation, it can be obtained that the cost of attack from the "external" is $2.45 million, and the cost of attacking by purchasing existing computing power is $1.22 million.

So, the cost of breaking the Maginot Line for a network that is entirely powered by transaction fees is somewhere between 1.2 and 4 million, and cheaper attacks (e.g., renting hardware) are 10 to 100 times cheaper. As Bitcoin scales, its value increases, and the volume of transactions managed by the network increases, which increases the incentive for attacks. Will this level of security protect the blockchain against attacks? It's hard to say, and my view is that it's too risky to guarantee the security of the blockchain, and this level of security that cannot be improved is very dangerous to the blockchain protocol (note that Ethereum in its current proof-of-work mechanism does not fundamentally improve this situation, which is why I don't want to set a total supply of ether at this point).

In the case of Proof of Stake (PoS), security is much higher. To explain why, we can look at the ratio between the cost of taking over the Bitcoin network and the annual mining revenue ($932 million at current prices). It is very low: the cost is equivalent to two months of mining revenue. Under the Proof of Stake model, the cost of the deposit should be equal to the total discounted returns in the infinite future; the risk-adjusted discount rate is 5%, and the cost of funds is equal to the total returns in 20 years. Note that if ASIC miners have no electricity consumption and last forever, then this balance of PoW is the same as PoS (except that PoW is more wasteful in economic terms and is more difficult to recover from a successful attack), while the electricity consumption and hardware depreciation of ASIC mining are its biggest contradictions. Therefore, using the Proof of Stake mechanism, the cost of attacking a network of the size of Bitcoin is between $20 million and $100 million. It seems that this level of security should be sufficient, but there is still uncertainty.

Ramsey's Law

Let's assume that purely relying on the current transaction fees is not enough to maintain the security of the network. There are two ways to increase miners' income. One is to constrain the total amount at an effective level and increase transaction fees. The other is to increase inflation. How do we choose the right way? In other words, what is the ratio between them?

Fortunately, there is an existing law of economics that solves this problem by minimizing the additional economic loss. This is the so-called Ramsey Pricing Principle. The original use of the Ramsey Principle is this: suppose there is a regulated monopolist that requires a specific profit target (perhaps break-even after paying fixed costs), and competitive pricing (for example, the price of a good is set to the marginal cost of producing one more good) is not enough to achieve this requirement. Ramsey's Law states that price increases should be inversely proportional to the elasticity of demand. For example, if the price of good A increases by 1% and demand decreases by 2%, and the price of good B increases by 1% and demand decreases by 4%, then the socially optimal approach is for the price of good A to increase by twice the price of good B (you should notice that this essentially makes the decrease in demand uniform).

The reason for this compromise, rather than an overall price increase for most inelastic goods, is that the harm of charging above marginal cost is the square of the price increase. Suppose a good costs $20 to produce and you charge $21. Some people may value the good between $20 and $21 (we can assume that the average is $20.5). These people will not buy the good, even though the buyer has more benefit than the seller, and this is a social loss. There are not many such people, so the net loss ($0.50 on average) is small. Now, if you charge $30, the number of people with a "reservation price" of $20 and $30 will increase tenfold, and their average valuation will be around $25. This will increase the number of people tenfold, and the average social loss per person will increase from $0.50 to $5. Therefore, the net social loss has increased 100 times. Because of this superlinear growth, it is better for everyone to bear a smaller price increase than for a small group to bear a larger price increase.

In the case of Bitcoin, the current transaction fee of Bitcoin is maintained at about 50 Bitcoins per day, 18,000 Bitcoins per year, accounting for about 0.1% of the total Bitcoin volume. Using the first approximation, we can estimate that if the transaction fee of Bitcoin rises to twice the current level, the transaction volume will be reduced by 20%. In fact, the current transaction fee of Bitcoin is twice that of a year ago. Compared with the development range that should have been achieved if the transaction fee did not increase, it seems that 20% of the transaction volume has been hindered (see figure). Although this estimate is very unscientific, it is an orthodox estimate based on the first approximation.

Now assume that 0.5% annual inflation will likely reduce the interest in holding Bitcoin by 10%, let's conservatively set this number at 25%. If at some point, the Bitcoin community decides to increase security spending to 200,000 Bitcoin/year, under this estimation method, assuming that transaction fees are optimal before increasing security spending, then the best practice is to push transaction fees up 2.96 times and add 0.784% annual inflation. Other estimation methods may give different results, but the optimal level of transaction fees and inflation in any case cannot be zero increase. The reason I use Bitcoin as an example is that it is a case of a fixed total amount that inhibits its development, and the same parameters apply to Ethereum.

Game strategy attack

There are other arguments that support this inflationary case as well. For example, relying too heavily on transaction fees opens the door to larger and more difficult to analyze game-theoretic attacks. The underlying reason is simple: if you can use a method to prevent another block from entering the blockchain, then you can steal the transactions in that block, so the incentive for validators to benefit themselves at the expense of others becomes large. This is even more direct than selfish-mining attacks, because selfish-mining harms a specific validator and benefits all other validators, which gives the attacker an opportunity to monopolize the benefits.

In the proof-of-work (PoW) mechanism, a simple attack could be this: you see a block with a high transaction fee, and you try to mine a sister block containing the same transaction, and then give a bitcoin as a reward to stimulate the next miner to mine on top of your block, so that the subsequent miners have an incentive to package your block instead of the original block. Of course, the original miner can follow up with a higher reward and start a bidding war, and this miner can preemptively launch the same attack by giving up most of the transaction fees to the creator of the next block; the final result is difficult to predict, and it is difficult to say whether a network is efficient. In the proof-of-stake mechanism (PoS), such attacks are also possible.

How to allocate transaction fees?

Even if the distribution of revenue from inflation and transaction fees follows a specific distribution scheme, there are still other options for collecting transaction fees. Although most current protocols use a one-way approach, there is actually quite a bit of freedom here, and the three main options are:

1. Transaction fees go to the validator/miner who created this block

2. Transaction fees flow fairly to all validators

3. Transaction fees are burned

It is worth discussing that the first and second options have the biggest difference; the difference between the second and third options can be described as the difference in target market selection strategy, which we will discuss separately in a later chapter. The difference between the first two options is: if the validator who creates the block gets these transaction fees, then this validation has a huge motivation to try to include more transactions. If the validators are all equally divided into transaction fees, then this motivation is minimal.

Note that 100% of transaction fee redistribution (or any fixed percentage of transaction fees) is not feasible due to "tax evasion" attacks via side-channel payments: instead of increasing transaction fees using the standard mechanism, transaction authors set a zero or near-zero "official fee" and pay validators directly in some other cryptocurrency (or PayPal), allowing validators to collect 100% of the proceeds. However, we can get the desired result by other means: set a minimum fee that transactions must pay in the protocol, and the protocol "confiscates" this fee, while miners can keep everything above (or, miners keep all transaction fees, but miners in turn pay gas to the protocol for each byte/unit of transaction; this is a mathematical equivalent). This eliminates the incentive to evade taxes, and although a portion of transaction fees is controlled by the protocol, it allows us to use transaction fee-based issuance rights without incurring the game-theorizing attacks of the traditional pure transaction fee model.

A possible algorithm for setting the minimum transaction fee is similar to the difficulty adjustment process, with the goal of medium-term gas usage being equal to one-third of the protocol's gas limit. If the average usage is less than this value, then the minimum transaction fee is reduced, and if the average usage is higher than this value, then the minimum transaction fee is increased.

We can extend this model to get some interesting properties. For example, it can be applied to flexible gas limits: a blockchain does not have a hard gas limit that cannot be exceeded. Let's set a soft limit G1, and a hard limit G2 (G2=2*G1), assuming a protocol fee of 20 shannon/gas (in non-Ethereum platforms, other cryptocurrencies use different names, "bytes" and other block resource limits). Transactions within G1 must pay 20 shannon/gas, and above this limit, the fee will rise to: at (G2 + G1) / 2, the marginal unit of gas will cost 40 shannon, at ((3 * G2 + G1) / 4), it will cost 80 shannon, and so on, until it is infinitely close to G2. This gives the blockchain a limited ability to scale to meet sudden surges in demand, reducing price shocks (some critics of the "transaction fee market" will welcome this feature).

What is Strategy?

Let’s assume we agree with the above, but there are still some questions: How do we define our policy variables and specific inflation? How do we set a fixed share for the staking mechanism (PoS) (for example, 30% of all ether) and adjust the interest rate level to adjust it? Do we specify a fixed level of total inflation? Or do we just set a fixed interest rate and allow inflation and share to adjust moderately? Or do we need a compromise, a combination of inflation, share growth, and low interest rates that are driven by larger stakeholders?

In general, the tradeoffs when specifying rules are fundamental tradeoffs that determine what uncertainty we will accept and what variability we want to mitigate. Specifying a fixed level of shares allows for a certain level of security to be associated with it. Specifying a fixed level of inflation is to meet some predictable replenishment needs of token holders while having a weaker but still viable security guarantee (theoretically, 5% of ETH inflation could achieve this balance, but this would result in a high interest rate and localized counter-pressure). The main reason for specifying a fixed interest rate is to minimize the risk of self-interested validation, because then a validator cannot profit by harming the interests of other validators. Hybrid paths in proof-of-stake can combine these guarantees, for example, while providing self-interested mining protection, if possible, while also adding a hard minimum 5% stake limit.

Now, we can discuss the difference between redistributing and burning transaction fees. Clearly, and unsurprisingly, the two are equivalent: redistributing 50 ETH per day to inflate 100 ETH is the same as burning 50 ETH per day to inflate 100 ETH. Once again, the tradeoffs diverge, if transaction fees are redistributed, then we have more certainty about the supply, but less certainty about the level of security, because we know exactly how much incentive validators have. If transaction fees are burned, we lose certainty about the supply, but gain validator incentives and this level of security. Burning transaction fees also has the benefit of minimizing cartel risk, because validators cannot artificially raise transaction fees to make more money (e.g., through censorship, or through a capacity-limiting soft fork). Once again, a hybrid path is possible and may be the best choice, although it currently seems to be heading towards burning transaction fees, so accepting an uncertain supply of the cryptocurrency may be better off seeing low net decreases during periods of high usage, and low net increases during periods of low usage, which is best. If usage is high enough, this approach may lead to a generally low deflation.