Bitcoin Forum

Consider for now, we're in the future, and miners only gain from transaction fees. I assume now that including a transaction is cheap, and generating a block is, in comparison, expensive. (Is that true?)

Any single, small miner intends to maximize profit. His decision on what transactions to include doesn't create a big change in the height of fees. Thus, the miner will include all transactions that pay any fee, even very low fees, to have maximum profit.

This results in the price for transactions dropping. In turn, those miners who already were hardly profitable have their earnings further reduced and quit. This reduces hashrate, difficulty drops, and the circle repeats. By this reasoning, difficulty is likely to drop close to zero.

Is this a problem? Will Bitcoin break down if we have very few miners?

Edit: This has been answered by epii a few posts below. The maximum block size limits the amount of transactions, so if Bitcoin has a decent market size, there will be competition for acquiring a transaction slot. This competition will drive transaction prices.

Edit 2: The thread is beginning to show something I find frightening. There exists no generally accepted model or even set of rules for Bitcoin in the future. A portion of people claim that removing the transaction limit will do no harm, the others use it as the last argument why Bitcoin will not enter the failure scenario described.

Please join in on the discussion and let us find a consensus on this. User opinion is important, if people suddenly agree on a rule change it might happen too fast to be stopped.

Big miners will probably wait to start generating until some amount of BTC is waiting to be claimed in queued transactions. This will encourage people to pay higher fees, since doing so will have a real effect on how quickly the next block is generated. Maybe people will even send high-fee dummy transactions after their transaction is included so it gets 6 confirmations in only a few minutes.

If the fee is pushed to 0.00000001, transaction spammers will start sending transactions at that negligible level, which will push fees higher on normal transactions.

What is the advantage of spamming transactions? Can this money sustain Bitcoin?

Edit: assuming big miners in relation to system size is a problem. Bitcoin did not require single large organizations in the past. I am not convinced this can be ascertained on a macroscopic system.

Today, it costs the entire network something like $0.001 to process each transaction (http://bitcointalk.org/index.php?topic=3332.0).

The limiting factor is checking to see if the transaction is valid or not (the CPU cost of ECDSA signature verification).  When the transaction volume gets high enough miners will have to start prioritizing which transactions they check, and they will use transaction fees as a quick initial check to see if they should invest CPU cycles to include transactions in a block.  Yes, miners want to include as many transactions with fees as possible in their blocks, but it won't be economical for any miner or mining pool operator to include an infinite number of them.

And speaking of mining pools... they are a lot more efficient than individual miners because they allow transactions to be verified once instead of requiring that all of the miners in the pool do that work.  Very small miners will be driven to join a mining pool, and the big mining pools will be competing to have the lowest fees and highest payouts (and so will be optimizing their ECDSA verification code and will figure out which transactions are profitable and which aren't).

So:  I don't think bitcoin will have very few miners.  I think it will have lots of miners connected to a smaller number of mining pools, and the whole system will optimize itself to be wonderfully efficient.

Wait, these points are not exactly reassuring.

The transaction network cost is not something the miner pays. If there's a pool checking the transactions for him, this gets even worse: the miner has to pay close to nothing to include a transaction; the price is paid by the network! If he is running his own node, including the transaction will cost the miner a tiny bit of space and traffic -- and everybody else in the network will have to pay the same, but will not receive the fee!

The ECDSA signature cost, does it scale with the difficulty? If it doesn't, Moore's law will make things worse over time!

So now, in addition to miners profiting from dumping prices, they can flood global node bandwidth and HDD space in the process? Not reassuring at all!

Hmm, I fail to see why the fees would drop with time.  The upper limit on the rate of transaction processing should drive the fees up.

From this post (of mine) http://bitcointalk.org/index.php?topic=5758.msg84788#msg84788

The demand for performing transactions will presumably continue to increase, but the supply is constant, ~18k/hr.

That! I just didn't know that. There is a fixed limit for the amount of transactions?

I was totally not expecting that. I guess I have to read up some more now.

Edit: interesting thread. The limit on the amount of transactions will mean that micro-transactions will happen in Paypal-like services. (Mybitcoin?) It's a little disturbing to have a hard limit though, making Bitcoin change behavior depending on the size of the network, and ultimately limiting its size. But my fears of a crash or dDoS destruction are no longer valid.

Thanks for the answer. I was getting nervous there, and totally didn't know about this.

The current 1MB block size limit caps bitcoin at 463 transactions/minute, or ~7 transactions per second.

Though it seems generally agreed that this limit will be raised, when it needs to be raised.

The death spiral failure mode seems plausible.

Putting a floor under fees by artificially limiting the scalability of the network leads to the obvious question of how to set those limits? Today they are chosen rather arbitrarily just as a hack around the lack of client mode. If they are the answer to how the entire system supports itself later there'd need to be some real logic behind it.

Indeed how do you even value network difficulty? Difficulty is a commons and those can fall tragically. If miners don't hash until there are sufficient fees, you can get a staring match. Do consumers blink first and start paying high fees to get a block mined quickly? Or do they just wait a few weeks until the network adapts to that and block time becomes reasonable again? The miners bluff only works for a short time.

When inflation drops significantly, we'll end up with this nasty dynamic whereby the only way to get a more secure network is to lower the artificial limits and so force people to pay more, but that makes BitCoin less attractive as a competitor to existing systems. You can choose either adoption or security but not both. That seems like a recipe for failure.

I think we'll learn more about this aspect of BitCoin at the start of next year, when inflation will halve. At that point we should see a fairly dramatic slow down followed by a drop in difficulty as miners who aren't profitable at the new price point stop mining. That slowdown would be only temporary, but it might well last long enough for people to start including fees right away instead of waiting for the delays to blow over. It feels like a timing issue. If people get tired of waiting for blocks and include big fees, fewer miners would drop out and difficulty would not fall so much. The remaining people who were hoping to get free transactions back would give up and start including fees too.

I think there is a model that lets us solve this problem without any artificial scalability limits.

I've been thinking of fees as paying for inclusion into a block. But that's not what they are really about. Fees are what you pay to secure your transaction against reversal and thus the amount you pay should really depend on the price of megahashes/sec vs the computational power you believe your untrusted counterparty may have access to. If you trust your counterparty, you don't need any confirmations to make a trade, and so you shouldn't need to pay any fees.

Say you're selling your car. You don't know the buyer and they're about to get in and drive off with their new purchase. You don't want them to drive away, press a few buttons on their smartphone and have some rented black market mining rig knock out a few blocks to get the money back. So after receiving the coins (zero confirms) you immediately spend them again but this time with a fee high enough to make you feel safe.

Let's say MikeMine Corp sells 10 gigahashes of work per Ⓑ1 of fees. My mining rigs are idle until they see a transaction which has at least that much in the fees of all pending dependent transactions. I start work on the current block but only include transactions that meet my (publically announced) minimum fee. Other transactions are left out. If I successfully solve the block containing the transaction, I keep mining on the next blocks until 100 gigahashes of work has been done and a few more blocks have been found. It doesn't matter if I get unlucky and don't actually find any of the next blocks myself, I already claimed the fee in the first block which was for work done not blocks found.

The death spiral argument assumes that I would include all transactions no matter how low their fee/priority, because it costs me nothing to do so and why would I not take the free money? Yet real life is full of companies that could do this but don't, because they understand it would undermine their own business. Consider a bus driver. He waits at point A until he has a few passengers who paid his fee and then starts driving to point B. If at the moment he's about to leave you run up and say you'll pay half price or walk, it doesn't matter ... he won't let you on board even though the marginal cost of including you is nearly nothing.

Note that fees are calculated recursively over all dependencies. If I send Ⓑ50 to my brother, we don't need any votes done on that transaction. We trust each other so the tx can be free. Now my brother wants to buy something online with those coins. He sends another free transaction spending those coins, and the seller then immediately sends them on to another of his own addresses, but this time with a fee attached. Now there are 3 transactions pending in the memory pool which depend on each other, and summing up the fees results in work being done on all three. Even though the first two were free, they'll still be included in order to claim the fees on the last.

Thanks Mike. It's awesome to learn whole new angles after reading and thinking about Bitcoin for 9 months. It's truly an amazing system.

Why does this keep getting worse and worse and even worse?

Now, you suggest a large miner that splits the block chain for profit! To prevent people from placing their transactions into the chain before the large miner has gathered enough funds to start his lengthening burst, the miner is interested in splitting the block chain at a point in the past. This is the only way his clients get the fast transaction but cheap transactions published around the same time, included by a cheap miner, don't. If the miner does not use this method, he has no sale argument and will fail!

We have only one version of your model remaining: a single miner killing all other block chains, constructing a natural monopoly. (Man, are you serious? What a decentralized currency!) The dynamics of that? (Edited here, error removed) The one miner gaining full control of the price and the ability to split any concurring miners out of the chain. That is the very definition of a vulnerable state! Now, we have eliminated all cases except going back to microscopic parties. Return to my first post to see why statistics ruin prices.

Your proposal is the apocalypse! If this is the future, the earlier I'm off this boat, the better!



Let me say this loud and clear:

DO NOT remove the transaction limit before someone has applied the relevant statistics, mathematics and game theory to describe transaction fee equilibrium at all times in question! People stupidly doing this has now risen into my top failure scenarios of Bitcoin.

And please think your scenarios through, this thread is becoming a nightmare. Who is responsible for modeling system dynamics when making Bitcoin design decisions? I'd feel a lot better if those people had a word here. If people agree on removing the transaction limit, we might enter a path of no return, so I'd be very happy if someone laid out current plans and consensus, if one exists.

I agree with you, I'm not convinced by mike's model and I believe it will ultimately boil down to a community decision about the block size limit with an obvious trade-off:
Tight limit = high transaction fees, high network security
Relaxed limit = low transaction fees, low network security

I don't think you should worry too much. I think there are quite a few people here with the training required to model the dynamics, and big changes like this should only be made with community acceptance. You can stir dialogue about this, as you have in this post, to make sure we are ready ahead of time. There's still plenty of time, though. As mike says, the drop to 25BTC/block will be an important observational study.

Glad to see someone agree, I was beginning to feel a little crazy here.

I don't think 25 BTC/block is a problem, we'll just see some miners disappear, but the reward will still sustain things.

But the issue should be solved in advance to demonstrate that Bitcoin is meant to work on the long run. We may be faced with bribing of developers to achieve higher or lower fees if we don't carve a sustainable solution in stone early enough. Arbitrary limits in a changing protocol are a magnet for corruption. And imagine the chaos and loss of trust in Bitcoin when a fraction of the network has the rules changed against their will. The protocol rules should be finished and fixed, hopefully never to be touched again afterward.

That said, I have run into an entirely new question: do we need a lot of hashing power at all times? Maybe we can solve the attack problem with very few miners and a smart protocol! I've opened a new thread to ask this question, since this thread is confusing enough already:

http://bitcointalk.org/index.php?topic=6363.0 (http://bitcointalk.org/index.php?topic=6363.0)

Maybe we've been afraid for no reason -- maybe we're best off with very few miners! If security against attacks can be increased without increasing processing power, we're good, and we'll have super-low fees! Everybody would win.

I think it would work even if miners only made money on transaction fees. The thing to remember is that ANYONE can mine. There may be a point when statistically blocks are made by only a few large pools but they wouldn't be able to monopolize it. IF the fees got high it would motivate more to try making blocks themselves. Other mining pools may not be as powerful but they could have 'alternative' prices. Some may even be free. If you want speed you add the fees so it gets accepted by miners who make a lot of blocks. If you want cheap, you wait for a pool with lower fees to create a block with it. IF the fees got high I'd pretty much bet that someone would create a pool for the sole purpose of allowing cheap transactions. People who think cheap transactions are good for Bitcoin will join and donate their computers power. Price everywhere drops. In other words I expect a fair price to evolve and be self correcting.

We all love a bit of drama, but I think you're over-doing it.


No, I did not. You're the one suggesting that, and putting words in my mouth to boot.

There is no point at which miners would want to split the block chain. Unless they can dominate the network attempting to split the chain is quite likely to fail meaning they've burned a lot of electricity and claimed no fees at all. See the table of probabilities in Satoshis paper for reference.

Miners don't wait around for fees to accumulate before starting. A transaction that comes with a fee is worth doing some work on immediately, even if it's not very much. In a network with decent transaction rates you would be hashing constantly but adding and removing transactions from your current block depending on how much work was done on them. If you do some work on a tx, remove it because the fee was not high enough to carry on with and then another miner claims it, no big deal - that's the nature of the business. With equal costs that miner had just as much chance as you did to find the block unless they are operating under the "take everything they can get" model, which is inherently self destructive (unless they're not mining for profit).

I believe you're over thinking this. Claiming BitCoin can't work without artificial scalability limits is like claiming governments should mandate minimum bus sizes to support ticket prices (that is until the public transport network has been analyzed by game theorists). Oddly enough that never happened, and yet I've never heard of a countries public transit suffering death by game theory before.

@[mike]
I took the closest-to-stable configuration I understood from your post, and that included the splits. The second version is discussed afterward. As I understand from your reply, what you actually meant only works if the vast majority of miners abide to your rules. Otherwise, they will include all transactions with a small fee, and whenever someone pays larger fees, he pays to confirm all these transactions as much as his own, and the reduce in waiting time is only his own fee on a global scale, which is close to no benefit! Also, imagine half of miners follow your rules. (You wish, I don't see that happening.) Then calculate the average time to 6 confirmations for a low-fee payer and a high-fee payer. It's useless! The benefit is totally not worth the fee unless you're in a real hurry.

You make a claim that requires both macroscopic behavior (a cartel to enforce fees dominating block generation) and microscopic (no cartel exists that could split the block chain) at once. That is incoherent, I don't see Bitcoin balancing on some fine line between small and big miners, especially if small miners who don't follow the rules can make more profitable blocks. Your suggested configuration is not stable. End of story.

BTW, I don't see how one can "over-think" things. It's possible to make errors, true, but making some extra checks doesn't hurt, as I think this thread demonstrates neatly. It may be that the problem is not a problem, for the nice reason that Bitcoin code is open to minor adaptions if the majority agrees -- or, if it doesn't, the current block size limit solves the problem for us.

But that doesn't mean it's good to wipe a potential problem off the board, especially before it's analysis is finished. There is still no consensus on the final network configuration. We might end up with a sub-optimal solution, especially one that is too open for attacks or wastes processing power. There is currently no force that ties the wanted result (a level of security for the network) to the means that achieve it (transaction fees within a large network). If that's not worth discussing, what on the whole technology is worth discussing?


@bitlotto:
Please read the first post. If you did, please read it again.

You make an assumption (trade fees rising) that appears to not happen in the context at hand. First solve that problem, otherwise whatever follows "IF the fees got high" has no relevance. Again, remember I assume a Bitcoin system with a large maximum block size, so this does not determine fees as it would with the current limit and a larger market.

Well, I can't predict what all miners will do. But I can look at real world businesses that are much like mining - large fixed costs with low marginal costs.

I've been using buses as an example but there are lots of others. To name just two, a football stadium doesn't sell tickets by auction but rather sets a fixed price and if not enough people buy at that price, the game plays to a half empty stadium. A bakery bakes cakes in the morning and sells it throughout the day, but if at the end of the day it wasn't all sold then they (usually) just throw them away. If they reduced prices towards the end of the day, they could get lots more customers but everyone would just buy their cakes after dark at unsustainably low prices.

In any market there are participants who could supply all demand at low or zero prices and suck up every bit of revenue possible. But in practice that rarely happens because it's irrational and not sustainable. In cases where a business does that and uses some unrelated business to keep themselves afloat it's called dumping and they usually do it with an eye to raising prices again once the competition is gone. Governments (sometimes) investigate it.

The argument is that there will be miners who effectively "dump" their hash power, by working on transactions that wouldn't be profitable in a block by themselves, because they are included along with higher-fee transactions that are. As you note that would be irrational because it creates a free rider problem. Why should I be the one to subsidize everyone elses transactions? Yet when I look at the world around me I see markets with hundreds or thousands of participants where all of them are rational and none of them allow free riders.

I think mining will evolve in that direction .... a reasonable but not huge number of essentially rational economic actors, who understand that allowing free riders will ultimately undermine the source of their own wealth. It's possible there will be miners who behave irrationally because they are actually interested in a different chain (dns or voting or whatever) and mine on BitCoin just because they can. In such a case regulation might be the answer, or moving to a system of non-anonymous miners so the irrational participant can be kicked out.

These issues are worth thinking about, but it's easy to end up with analysis paralysis. Kind of like if we were back in the stone age debating the newly invented 'capitalism' concept, and somebody said "What stops somebody dumping until they've cornered the market?" and somebody else said "Hmm I guess you're right, capitalism can't possibly work". Whereas the actual answer is that capitalism does work, mostly, because people figured out solutions to these problems along the way.

I'd compare with different examples: fishing in the ocean, polluting the environment, wasting tax money, supporting a bad natural monopoly, quickly claiming and using up natural resources. Clearly, in those examples individual behavior is damaging to the community, and they are closer to the Bitcoin example than the examples just provided, because they don't include a highly local market. Bitcoin mining is not highly local, unlike any shop or stadium.

A football stadium has fans who want to see exactly that game at exactly that place, it is known to its customers. The feedback goes to the stadium in a large fraction. A small miner, though, is practically unseen by his customers -- meaning he's not as afraid of the feedback. If you don't like the assumption of the miner being small, we're back at the case I discussed in the first reply to your model.

@last paragraph: In capitalism, limited funds stop someone from cornering a market of goods that can't be cheaply stored with lasting value. As seen with subsidies, e.g. US cotton against third world markets, the cornering happens the moment the limited funds loose weight. As you said yourself, in local markets with a very large player, price dumping is indeed a problem and has to be handled by authorities. (On goods with lasting value but no high storage cost, dumping a sales price is idiotic, because it turns you into supply to competitors. Example: dumping BTC in USD terms might get you another trader buying your BTC to later sell them in your place.)



We're still without a configuration that keeps a constant high mining rate while assuming a high tx limit and no further changes to the protocol. I like to emphasize that it has not been proven that this outcome is a problem. Also, maybe the block size limit shouldn't be set too high for the obvious reason of a gigantic block chain being costly to handle.

All in all, I propose trying to find a way to secure the block chain against fraud without wasting large amounts of processing power. A little to throw out cheap spam might be good, but the current mega-energy-burning sounds increasingly bad, and possibly unnecessary, to me.

You're misusing "irrational". Accepting low-fee transactions is very rational for the one who accepts them, because the profits are all his own, while the free rider problem is everyone's. This is assuming the agent is selfish. The problem is that if everyone acts selfishly everyone will suffer, which is the studied-to-death "prisoner's dilemma" or "tragedy of the commons".

You may ask how to stop players from acting selfishly. If there are few players they can collude to fix prices, and they might even do it without any spoken agreement out of fear of a snowball effect. But this doesn't work when there are thousands of players and the barrier of entry is low. Someone who doesn't currently mine can rent some hardware, swipe all the low fees and exit. With these dynamics, the only transactions that will be excluded are those whose fees are less than the cost of inclusion. If a block size limit is placed, the cost of a transaction is the opportunity cost of not including a higher-fee transaction.

Some sort of regulation is another way to ensure non-selfish play, but I doubt that's the direction we want.

Let me stop you there.
Before I read on I have to warn you that if this hypothetical future does not contain Sexy Robot Slaves I will be very disappointed ....

Maybe I should use the word "reasonable" or "smart" rather than rational then, which is a loaded word in economics. Again just look around and you won't find very many companies selling their product using auctions. The exceptions are those where the thing they are selling is naturally finite and they can't really increase supply. AdWords is one such example because there are only so many ad slots that can fit on a screen, and demand often outstrips supply.

I'm not sure that the locality of the market makes much difference. Probably in future fees would be calculated by client software algorithmically. If a miner enters the market who behaves irrationally (ie, allows free riders) and has significant amounts of hash power then fees would drop dramatically and very quickly. They'd immediately undermine their own business as well as everyone elses and that would be very visible. For one guy using his GPU so what? But by the time fees drive mining it'll be in the hands of large, professional businesses. You wouldn't be able to get funding for hardware if your business model boiled down to undermining the market.


They can do that if they spend enough in electricity to find some blocks, and then make enough profit on fees to pay for the cost of hardware rental. It only works for them if there are lots of low fee transactions sitting in the memory pool all the time waiting to be collected and they don't make it into blocks.

But the big miners using the "smart/long term thinking" model are still working on these transactions. It's just not for very long. And because they are running a sustainable business they are probably bigger and have more hardware than you. Once a high-fee transaction that depends on a bunch of low-fee or free transactions come along, those miners will be working on all of them anyway in order to collect the entire groups fees. So at any given time the dregs of the market aren't worth very much. The people creating them didn't care much about confirmation time. You could mine them yourself but you wouldn't get much money and the bigger miners wouldn't care as the extra profit from them is pretty small anyway. It's the high-fee transactions that drive the system, the low-fee transactions just get pulled along behind.

Low-fee transactions will be much more numerous than high-fee, and I wouldn't be surprised if their total fee will be higher.

Suppose there's a pool that includes all transactions. It will be much more profitable per hash than pools that play hard-ball, and thus will enjoy lots of participants.

This has already been talked about here: https://www.bitcoin.org/smf/index.php?topic=1847.0

To summarise, the miners will from some sort of self-regulating cartel to make sure that the fees don't go to 0.  The cartel will reject block that have too many 'free/low-fee' transactions in it.

The will set their own rules like:  A transaction that has a fee less than 0.0001 BTC must wait at least 4 blocks before being accepted.

If the cartel becomes too profitable, some members will leave it and accept transactions under their own rules.

Overall, it should work out that the system naturally balances to the security required by the network.

@da2ce7, [mike]:

Can you please debunk the exact failure modes I described for your suggested system, and provide the suggested equilibrium of the miner network size? In my eyes, the system configuration proposed has a macroscopic and a microscopic configuration, and both fail and both provide no reassuring equilibrium estimation. This has been handled before in a logic argument, with no part of the argument shown wrong so far! Why are we going over this again, with just claims again? (In fact, I just found a minor error in my end state of the macroscopic "cartel" configuration -- but I don't find any configuration that splits the block chain in standard operation good, and no other stable state has been provided so far. I'm still editing the post for clarity now. I'm still worried nobody noticed the error, it feels like nobody is checking my posts, no wonder I don't get arguments against them.)

My suggestion is that we move on from the "arbitrary fee height agreed on by miners" model. It doesn't get the discussion anywhere, unless someone can back it more strongly. Especially, I want to note that the model does not even provide any equilibrium difficulty at all, so even if we'd take it as true, there is no reason to believe this equilibrium would be at a good value for the system. This is building on sand, investors will not be satisfied with such an answer. We're not doing a trial-and-error game here, we want a solid currency for the future!

@da2ce7: You claim there is a link between required security and fee height. I do not see a substantial link. Can you explain where this claim comes from?

I guess I don't fully understand your position. The natural equilibrium of the model I proposed has security as strong as the participants require and no stronger. That model does not collapse down to nothing even if there are no block size limits at all. The fees are not arbitrary.

I'll try explaining again. Perhaps I have a problem in my thinking, but I don't understand your current criticisms so it's hard to say.

Let's start with the base case. If the recipient trusts the sender absolutely, then they don't need any confirmations to make a trade. Zero blocks is sufficient because the sender isn't going to try and reverse the transaction (by doing a Finney attack). They pay no fees because they don't need the services of miners ... they are perfectly happy with using the memory pool as just a public scoreboard. In fact they don't even need the p2p network at all, the sender can make the transaction and send it via email to the recipient, bypassing the public infrastructure entirely.

In many trades the recipient does not fully trust the sender. There is risk of fraud and the recipient can probably estimate that risk based on the reputation of the sender, size of the transaction and cost of reversal. However reversal risk is born by the recipient not the sender (who "knows" he is trustworthy). Instead the risk premium is built into the product price, just like today where merchants add on a risk overhead to deal with credit card fraud. The sender sends his BTC to the recipient with no fees (via the network). The recipient immediately broadcasts another transaction spending that money back to himself but this time including a fee.

The fee pays for a certain amount of computation. Consider 10 miners each of which own 10% of the networks hashing power. Each one can do 100 Gigahashes/sec and it costs them $1000 a day to mine continuously. A single miner can find a block in (on average) 100 minutes (10 mins per block * 10x harder than when everyone works on it).

If all miners were to mine on an empty network, there would be 1 Terahash/sec of work done at a cost of $10,000 per day globally. But nobody would do that so in fact there is 1TH/sec lying idle waiting for transactions (let's pretend we just entered this model so the difficulty is really high).

I wish to buy from you something very valuable which costs 20,000 BTC and let's assume 1:1 dollar:btc conversion. I sent the coins to you with no fees and as a result no miner starts work on it. You immediately spend them back to yourself, but how many fees to include? If you include none I can mine a new block with my CPU and reclaim the coins.

If you include a 1 BTC/$ fee, each miner can afford to spend 1/1000th of a day (86.4 seconds) working on it before their costs would be higher than any potential gain. Because there are 10 miners each one works on it for 86.4 seconds in an attempt to find a block with that transaction in - probably not enough to find any block unless you get lucky. With a 10 BTC fee, miners will work on it for around 14 minutes which will hopefully be enough to find a block but probably not two. Whichever miner finds a block with the transaction in will immediately start work on finding the next (empty) block and do however much computation is left based on how much of the fee was spent so far. Eg, if a miner finds a block after 3 minutes then the next block will be worked on for 11 minutes by that miner alone (the others shut down). So you'd get one block but probably not another one.

What if you want two blocks? A 100 BTC fee would buy you 1/10th of a day (2.4 hours) of computation. The first block would be knocked out within a few minutes as the entire network tries to claim it. The second block would take much longer but would still be found as the miner who claimed the fees lives up to their end of the bargain.

This buys you as much security as you paid for it .... 100 BTC fee means the sender has to spend at least 100 BTCs worth of computation to split the chain and reclaim his coins. Not a great deal given the size of the trade.

But in reality there will be many overlapping transactions. Let's imagine 30 mins after you send your tx somebody else does the same thing. Now all miners try to find a block including that second tx (including the one which was already mining to finish the work you paid for). A different miner claims the second tx and starts work. Now there are two miners working on securing your transaction .... but at some point your miner will shut down whilst the second keeps on going. The later transaction re-inforces the earlier but that's OK because it's not free riding - both senders are paying the same price for the same amount of work done.

In practice at high transaction rates no miner would ever fully shut down. They might do partial shutdowns in which some of their hash power lies idle some of the time, but the flow of transactions would always be enough to keep the chain moving .... though it might move a bit faster during the daytime than at night, it'd still move.

No miner would include free transactions at this point because to do so would immediately make lots of previously fee-paying transactions entirely free, yet that miner wouldn't get any greater share of the remaining fee paying ones. It'd kill their own bottom line.


[edited to clarify a few points]

I too have posted the same scenario as Vandroiy and can't say I have been satisfied by any attempt to answer i've seen.



The recipient is not going to be able to spend the coins until confirmed, because the transaction doesn't have an ID that anybody can reference.  As far as anybody knows, the coins still belong to the original holder.


I have disputed this assertion in the past, see "tragedy of the commons".  It's like suggesting that no one would fish more than his fair share at a lake, or let his cattle graze more than his fair share in the field.  So long as it's beneficial in the short term for one person to take a little extra at the expense of the community - and especially if he can do so anonymously - people are going to do it.  The suggestion that "no miner would include free transactions" means Bitcoin is forever dependent upon miners anonymously sacrificing personal short-term gain for the good of the community.  Human nature shows that's pretty much impossible - were it not so, we could always just trust our Federal Reserve to act in our best interests too.

The cartel will naturally charge as much as the market can withstand: If there is a serious thread from double spending then the market will accept higher fees.  If there isn't much of a threat to double spending, then the transaction cost will and should go down to virtually zero.

Vandroiy and casascius have it right. There are two tragedies of the commons here; one with the miners and one with the users.

Each miner gets the full benefit of including low-fee transactions but the loss from lower fees are shared by all miners.

Each user pays the fee on its own transaction but the resulting protection is shared by all users.

This will inevitably push fees towards zero.

I can think of a few things that might not make this as bad as it sounds.

Transaction fees are also the opposite of a tragedy of the commons (comedy of the commons?). Each user gets the full benefit of each fee. Only a few substantial fees are needed to protect everyone. Maybe the whole thing can be run on donatins?

If volumes are high enough, maybe even extremely tiny fees will add up to provide enough double-spending protection. But if not?

If not then there will be competition among double spending scammers. Only about six double spending scams can be done per hour. With lots of transactions the risk for each transaction will be very low and the double spenders will push up difficulty.

You are forgetting that there are (at least) three players in the bitcoin economy:  miners, users... and merchants.

If transaction fees are driven to zero so miners start dropping out, then merchants have an incentive to step in and start mining themselves so their transactions get processed in a timely manner.  Otherwise they don't get paid.

That's also a tragedy of the commons. It won't work. Every individual merchant has an incentive to free ride on everyone else, not to contribute themselves. If one does take the cost and makes an effort to generate it won't benefit that merchant personally.

The merchants will therefore have an incentive to spend as little as possible on it. But if very few mine, mining will be easy and costs will go down. So even if there was a 'staring contest' between merchants where each waited for the next one to be the 'sucker' to turn on their mining rig first, the opportunity cost of waiting will quickly overtake the cost of just running the rig.

Merchants could also form a guild and purchase mining hardware that way. Membership in the guild (one of many, perhaps) gets your transactions confirmed.

It seems to me that there's some disagreement in this thread about one particular technicality of the bitcoin system.  It boils down to this question:

Does including a transaction in a block also require including all previous unprocessed transactions for those same bitcoins or doesn't it?  

[mike] seems to think that it does and bases his models on that.  The OP claims that instead, miners can just include the transaction w/ the fee and forget about the rest.  So who's right?

You can't include transactions in the block chain if their dependents aren't also in the chain, obviously, otherwise that block would be invalid.

I don't think it's worth arguing about this any more right now. This thread is going round in circles. If you're convinced miners will all undermine the entire market in return for tiny short term profits then you probably aren't going to change your mind based on analogies to real world markets where it doesn't happen.

Let's say I send some newly generated BTC to a friend. I create transaction A with no fee, which signs ownership over from my address X (represents private key X) to their address Y. They create transaction B with a fee, which signs ownership from their address Y to their address Z.

If B makes it into a block, but A doesn't, the transaction will be invalid. This is because the previous output of the transaction is not in the block chain. The network (as it exists today), along with my client, would consider me the owner of the coins transferred in transactions A and B, as there exists no transaction in the block chain signing from X to Y or X to Z.

A transaction is only valid to the network if it's inputs are transactions already in the blockchain.  I think that it is actually impossible to referrence an input transaction without it's permanent block number.  (transaction hash + block number, I believe,  Someone correct me if I'm wrong)  So any other transactions sent after the first one, fee or no fee, would be rejected by the sender's peers as invalid and never even forwarded to a miner.

What casascius said, AFAIK you can't reference a transaction if it's not in a block. The block chain establishes a timeline of transactions and each transaction builds on those in previous blocks.
That's not a problem though, it just means the sender will need to include the fees after all.

You can't find a block on a CPU in reasonable time, fees have nothing to do with this.

The time to find a block follows the exponential distribution, which is memoryless. If it's profitable for me to try to solve a block now, it will still be exactly as profitable after 1000 seconds of trying. Nobody will suddenly stop mining after some arbitrary time, unless there's a mining police that monitors when someone tries to mine beyond the quota.

Also (a moot point in light of the above), if 10 miners each spend 1 BTC to try find this block, the total spent is 10 BTC which isn't covered by the fee.

And why would the miner want to work on a new block that has no fees? He's more likely to just say "I kept mining and didn't find any blocks. Honest."
And who does he report to anyway? The mining cartel police, or the sender who paid the fee? Does everyone who sends a transaction need to know the miner that collected his fee? Does the miner send difficulty-1 shares to the police to prove he's done his due work?

Also, someone who wants multiple blocks wants it in reasonable time, not the 100 minutes it takes to 1 miner out of 10 to find it, or the week it takes 1 miner out of 1000.

I have no idea what your model is for multiple transactions per block. There are supposed to be thousands of them.

Miners spend computing power to try solve a block, and choose which transactions to include in it. If they succeed, they collect all the fees for transactions they included. More included transactions = more fees = more revenue per hash = profit. The only way they would reject transactions out of fear of encouraging free-riders in the long term, is if they both expect their individual actions to significantly affect the market (which is suspect, given its size and complex dynamics) and intend to stay in the market long-term (which is even more suspect, given the low barrier of entry). See also Prisoner's dilemma (http://en.wikipedia.org/wiki/Prisoner%27s_dilemma).

And what if the mining cartel uses FUD, vendor lock-in, lobbying and bullying to prevent people from forming an efficient market? Well, I thought that was one of the things Bitcoin was supposed to be against.

As was already explained, those analogies have few players and high barriers of entry so it's not even a remotely valid comparison. Also, your model is wrong for several reasons as I've explained above.

I don't see how all miners suffer from lower transaction fees, since it's presently provable that free transaction fees are possible with a working Bitcoin economy.


They are already zero, but you are overlooking time preferences.  Space in a block is effectively of zero value, since there is presently plenty that a zero fee transaction can get into the next block.  However, if Bitcoin ever reaches mainstream acceptance comparable to PayPal; the space inside a block (which is limited by convention) will start to command a premium.  As such, users who have a need/want to see their transaction included in the next block will be motivated to provide a fee towards that end.  And forcing all transactions that pay a fee less than them to wait until the next block or longer.  Such traders will be relatively rare, such as buying/selling a car from a dealer or stranger, or other high value transaction wherein confirmations are the only acceptable risk limiting mechanism.  Even relatively rare, such transactions are likely to justify enough of a transaction fee to motivate miners to incude as many of them as they can find.  Perhaps even motivating miners with marginal profits to jump into and out of mining based upon the collection of fees in the transactions in their queue.  This would create a short term "flexability" in the processing of transactions, as blocks would come faster than six an hour under high demand and slower than 6 per hour during off peak times; still averageing out to 6 per hour over the two week adjustment period.
Then we are back to where we were about four months ago, when transaction fees were rare.

I'm not even sure how you get to this conclusion.

No, transaction inputs are phrased as txhash:output index. You can easily reference transactions that were not included in a block yet.

I think there's some confusion here about how this part of BitCoin works. Any number of transactions can be in the memory pool and they can depend on each other (grep main.cpp for mapDepends). The block chain is not valid unless a transactions dependencies are also in the chain, but BitCoin will happily accept transactions that depend on things it has not seen before. These are referred to as orphan transactions and they wait in the memory pool until their dependencies have been satisfied. Then they are laid out in the block in dependency order.

Mining (in the future) will not have low barriers to entry. The barriers to entry are already non-trivial .... if you want to mine at anything approaching a competitive hash rate you need to either have lots of people in your pool, or build clusters of a very particular type of graphics card. In future you'll need to invest in special hardware (mining ASICs), contract out datacenter floor space and power capacity etc. It will cost you time to set up. In the long run it will be at least as expensive as buying a few buses.

Big miners will understand the dynamics of their own business. There is no need for "mining police" for the same reason there's usually no need in other markets.

@creighto - If the block size limit is maintained there's no problem. The premise of this thread is that there will be a problem if this limit is lifted.

Also, currently there are no fees because what could be gained by them is negligible compared to generation reward. In the future that will change.

You still haven't explained what stops someone from renting capacity for a short time. It doesn't have to be cutting-edge mining-specific efficiency, the bulk of low-fee floating transactions can make up for the inefficiency.

If you are right and this will be impossible, it means Bitcoin has failed its role as a decentralized currency.

Renting capacity from who? Somebody who has 100,000 unused cpu cores kicking around and will happily rent them to you for a very short time?

I doubt there'd be a big pile of transactions with fees higher than zero but low enough that they never successfully get into a block. I mean that's a possible outcome of my proposed model but there isn't much incentive for anyone to actually create such transactions. If you trust your counterparty just exchange a transaction outside of the network and avoid fees entirely. If you don't then send a fee high enough to buy enough computation to get into a block (you can send this one in a bundle with some free transactions if you need to). It should be easy to calculate such a fee.

Let me state my assumptions clearly:

• Artificial scalability limits will have been removed because most users are on SPV/light clients and BitCoin usage will be growing.
• By the time inflation is low enough that fees become the main driver of the network, mining will have largely consolidated into a number of professional mining conglomerates (this has already happened).
• Individual miners at home with their gaming rigs will cease to exist even in pooled operators because the difficulty will be so high that the returns aren't worth it (same as for CPUs today).
• Mining companies will be legitimate, regulated organizations that choose to locate in developed countries for the usual reasons.
• Mining companies will be using clusters of specialized hardware housed in professionally managed datacenters.
• These firms will be like many others: they will have startup costs (purchase of the ASICs and supporting hardware) and ongoing costs (power, salaries). They will be run in a sustainable manner if only because that'll be a requirement to get the credit needed for setup.

In such a world I see no obvious reason why mining would behave differently to other businesses. People have proposed various arguments for why mining will be different to running a bus company, like "mining isn't local" (so?) or "mining has no startup costs" (it already does). But I don't buy it.

I suppose you haven't heard about AWS and similar cloud services? That was rhetorical, of course you have and of course now they're a terrible way to mine, but I don't think that will necessarily remain the case.

I think I understand your argument now and my disagreement with it is off topic for this thread, so I'll leave it at that.

I think that this premise is wrong.  I don't believe that individual miners will ever cease to exist no matter how corporate or consolidated professional mining becomes.  For a couple of notable reasons.

First, and foremost, because mining does not have to be profitable to be rational.  I use the example of the lone gaming geek in a cool climate, who lives in a small flat that is heated entirely by electro-resistive heating.  This geek doesn't have to live in a cold climate, just one that has a fairly long heating season.  He is going to own a high-end gaming rig regardless of the existance or success of Bitcoin, and has to pay the electric bill to heat his tiny apartment anyway.  So why not mine while away?  The capital costs are covered by other endeavors already, any bitcoins said lone geek were to get from mining are effectively free.  This doesn't consider the wear that heavy usage imposes upon a GPU, but odds are high that his GPU is going to get upgraded before it dies anyway.

Second, in a successful Bitcoin future, financial institutions are not all going to be into mining for the profits of mining, but also for the digital equivalent of a bank spending half a million on a bank vault.  For the security this contributes for their own membership.  Nor will all these institutions be banks, as credit unions and non-profit institutions exist now and therefore it's reasonable to expect them to exist in the future.  These institutions will participate in the Bitcoin infrastructure for their clients' comfort and benefit moreso than the possibility of (direct) profits.  And these same institutions are likely to develop interlinking agreements to process the transactions of each other's clients for free even if they were to refuse to process free transactions in general.

I contest this premise as well.  The only requirements a mining operation for profit will be reliable and relatively cheap Internet access and electric service.  Both conditions favor developed nations presently, but I can foresee no reason that such operations couldn't cluster in developing nations if the economies of scale would permit said mining operations to bring
these things with them.

How about this one: Mining fees are subject to first degree price discrimination (http://en.wikipedia.org/wiki/Price_discrimination#First_degree_price_discrimination), whereas bus fees are subject to third degree price discrimination (http://en.wikipedia.org/wiki/Price_discrimination#Third_degree_price_discrimination). In plain English: When a bus driver lowers his price he lowers it for a whole group of people (standard, senior, children, etc.), so at some point the additional revenue from more passengers is less than the lost revenue from lower rates for his existing passengers. In contrast, a miner can accept transactions with lower fees without losing any revenue from transactions with higher fees.

Generally the factors acting against price discrimination are product heterogeneity, market frictions and high fixed costs. (Shamelessly copied from Wikipedia ;)) Product heterogeneity applies to Bitcoin (tx with higher fees get accepted faster), as do high fixed costs.

That said, price competition does not care how secure the Bitcoin network is. It will be purely a function of the factors stated above and it will lead to some price, which may or may not be high enough to make Bitcoin robust against takeovers.

My prediction is that the ratio of the network hash rate to the size of the Bitcoin economy will lower quite a bit each time the minting rate lowers. Once minting ends it will be at a level dramatically below where it is now. That alone does not mean however that it will be so low that block chain takeovers become viable. That depends on way, way too many factors to predict decades in advance. We don't know what the overall size of the Bitcoin economy will be, how large the biggest transactions will be, whether large transactions will use new, additional methods of confirmation, what the incentives of taking over the block chain will be, whether there will be terrorists/governments with enough resources to shut down Bitcoin for purely ideological reasons, etc, etc. It is downright ridiculous to speculate on whether the hash rate 50 years into the future will be sufficient imho.

However, what we can predict is that the block chain size limit provides a mechanism for future generations of Bitcoin users to intervene if the security is deemed too low. There will likely be different clients and their developers will likely disagree on the exact security/fee tradeoff (lower block size limit => higher security, but also higher fees), but they will have a very strong incentive to find a compromise. Otherwise whatever client doesn't agree to the consensus will end up running on a separate block chain.

TLDR; Either it won't be a problem, or if it does become a problem, it will be solvable.

This is only true if there is no block size limit.

This is true up to the block size limit.

That's exactly my point. The last statement is not true because once a miner does that, fees will fall across the board (assuming they are significant enough to be noticeable). Why pay more when you'll get security anyway?

Bus drivers set one price to get on their bus which is not negotiable because that's the best way to run their business. If they have a big bus (so capacity is not a constraint) then they could easily do what you're suggesting miners will do and accept passengers regardless of how much they're willing to pay. After all they'd be making the trip regardless so once they fire up the engine, extra passengers are just extra profit. But that would be commercial suicide so nobody does it.

I've explained this as clearly as I'm able to several times now, so I won't be trying again. I've satisfied myself that BitCoin will be fine in the long run and haven't been convinced by the arguments otherwise, it's now up to others to decide if they want to continue with the project or not based on the arguments they've read here.

Bus drivers will not drive around empty buses while their competitors take all the passengers. We don't see infinitesimal bus fares on real bus markets because there are few practically infinite buses around.

Also, look at all the airlines selling last-minute and price discrimination seats at below operating costs.

Ok, let me untwirl this - I disagreed with you in the first sentence only to agree with in my next sentence: Product heterogeneity and capital requirements will ultimately produce a stable price, you are correct in saying that miners won't drive themselves out of business.

However you miss a more important point: Miners can lower fees substantially in a sustainable fashion. Why? Because other miners who are less efficient will go out of business, which lowers the hashing rate and gives the remaining ones a larger chunk of revenues. Just like competition ensures that there aren't ten bus companies servicing the same route, miners will compete until the equilibrium number of miners is reached.

That means: The invisible hand will make sure 1. all transactions get processed and 2. as cheaply as possible. But there is no intrinsic mechanism to take network security (hash rate) into account. That means the hash rate will be whatever it will be, it could be high enough or it could be too low. If it is too low a mechanism to raise it is provided via the block size limit.

I'm kind of relieved to see more people agree we do have a problem.

Now, while I'm glad this thread is being used to clarify a part of the situation, this is touching a topic on which a theoretical discussion no longer suffices. IMO, we need a clear, widely accepted statement on the issue.

Sorry for making yet another thread, but I feel a serious need to do so; here I want to discuss possible solutions:

http://bitcointalk.org/index.php?topic=6576.0 (http://bitcointalk.org/index.php?topic=6576.0)

I think that you are projecting now.  I guess I'll say that I don't understand what you think the problem is.  Could you restate your prediction?

I like this statement:

Either it won't be a problem, or if it does become a problem, it will be solvable.

Being one of the people who agrees with him, I'd say it's this:

If the limit on block size is lifted (or relaxed too much), the equilibrium reached with respect to transaction fees, and consequentially the incentive to mine, will be such that the total hashing capacity of the network, and thus its resistance to being undermined by rewriting the block chain, will be too low.

And why do you think they will be too low?

Probably because there will be no competition for space in blocks, as it would be eliminated.  There would be no reason for anyone to reject any transactions, they may as well accept all transactions because there's no incentive to only fill a limited amount of space with the highest paying transactions.  Someone could come along and accept all transactions regardless of fee, which in turn would lower people's willingness to pay fees.

Others including [Mike] have made a fairly good point worth considering as a counter-argument to "tragedy of the commons" I brought up before: that a "cartel" of miners who collectively do more than 50% of the mining can simply reject blocks that are too generous in terms of low fees.  They could effectively make it impossible for miners to include transactions on terms they didn't like, because if they did, they would find their blocks quickly undone.  There is possibly no analogy to bus driving or airlines, except perhaps to suggest that if the majority of buses go empty, the operators of those buses have magic powers that could automatically teleport riders on the "cheapo" bus company back to where they started from as a way of forcing people to pay for rides.  A potentially scary power on one hand, especially if future ASICs raise the barrier of entry to mining so high that only well-connected people can get in...kind of like banking now...

I don't know much about ASICs, but I can't think of any reason they can't be put on a PCI-e card and sold to consumers to add to their home computer, allowing them to mine with a pool.

Wait, are we talking about raising the hard blocksize limit, or the free transaction size limit?  Or eliminating the fee scale?


Assuming that this is a correct assesment of the situation, there are other reasons that people mine than direct profit.


A cartel isn't required, as this is how things function right now.  It would take at least 50% of the generators to agree to a rulechange (by upgrading) in order to lift the limit at present.  Even if Gavin Anderson said, "I'm raising the blocksize limit" and changed it in the vanilla codebase, if more than 50% of the miners (by hash power) just refused, there would be nothing that Gavin could do.  I don't agree that eliminating the blocksize limit would create a "tragedy of the commons" scenario, but nor do I expect that the Bitcoin mining collective are going to simply decide to drop the only source of artificial scarcity in the system without great consideration.

Basicly, this could only be a problem if the future miners were generally inclined to act contrary to their own interests.


ASIC's wouldn't raise the barriers to entry in the long term.  Only increase the overall security of the system for roughly the same cost.  ASICs continue to exist in the modern world because they are cheap in quantity.

My prediction was correctly restated by Holy-Fire, so I continue without a repetition.


We are talking about a high block size limit with large amounts of low-fee transactions allowed to be processed by miners. I would call it "eliminating the arbitrary magic value linking market size to transaction fees", but your proposal sounds good too.

Holy-Fire:
I think the argument was that if the transaction confirmations make up a large portion of power demand, a large miner is at a massive advantage. He gets to use his confirmations more often, since he finds more blocks. Competing small miners have to calculate them too, but they find fewer blocks and thus have to throw them away most of the time.

An ASIC by definition is a custom piece of silicon.  It's not something you can go pick up at Radio Shack.  If someone goes and creates an ASIC for mining, and decides to keep the design private, then the only people who can compete with him are those with the resources to go design ASICs as well.  Wikipedia puts it nicely: "the non-recurring engineering cost of an ASIC can run into the millions of dollars".  Compare to an ATI 5970, at a current retail cost of about $650.

If the someone who doesn't share the design is the only one with a design then yes, but that doesn't seem likely.

And just because they can cost millions doesn't mean one that does some hashing will.

Exactly, designing the GPU for ATI 5970 cost millions of dollars but ATI still sells them to me at $650 because they return their investment many times over by selling to millions of consumers. Similarly, someone will find it profitable to design a mining ASIC and sell it. Also, in the same way that some manufacturers allow their products to be rebranded and sold by other companies, I don't find it at all unlikely that a mining company who designed an ASIC for their own use would eventually sell it as a product to diversify their revenue sources and reduce risk.

Wow, that's a nightmare scenario. We know that someone with >50% capacity can damage Bitcoin by reversing transactions, but I never imagined this hostile agent would be the supposedly "normal" miners. To prevent this from happening it's important to make sure that most of the capacity will belong to pools, who need to answer to their participants and thus less likely to carry such an attack.

Just to be perfectly clear: I don't think it's a problem. If it ever becomes a problem, client developers will get together and figure out a reasonable block size limit.

There is no point in trying to preempt the problem now, because we can predict neither what the hash rate will be, nor what it needs to be.

Also note the timescales - the problem will be foreseeable well in advance because the transition from minting to fees is gradual.

I agree, but the same applies for difficulty. We don't and can't know what it should be so it self adjusts, would be cool if max block size could do something like that.

There is probably a way to do this.  What if the client were to track the average number of blocks that a fee paying and free transactions were to persist in it's own queue, and increase the blocksize limit by 25% when it adjusts difficulty if the average wait blocks for fee paying transactions were over 6, and the free transaction section limit if free transactions averaged over 30.  And a client wouldn't reject an oversized block if it's own calculations put the averages over half of those numbers. 

I just pulled those numbers out of my rear, so I'm not suggesting they are ideal, just throwing out an idea.  If transaction congestion became a problem, this metric could stretch the blocksize to accommodate without undermining the scarcity value of the blocksize limit, and it would take months to grow significantly.

Likewise, if the average block wait for a fee paying transaction were under 2, or the average wait for free transactions were under 10, those same size metrics could be reduced by the same factor until they returned to the current limits.

How about if hardcoded max block size were removed completely (other than to prevent obvious gigantic spam), but then options were added into the client so that other miners (the human operator) can put in parameters to decide whether to accept new blocks into the chain or attempt to reject them.  That way all of the miners can sort it out amongst each other and adjust these parameters collectively as needed, allowing the 50% rule to enforce a consensus.  Those deviating from the agreed upon norms will find it hard to have their blocks accepted.

Settings to enforce on other miners' blocks might include: maximum block size, maximum free transactions KB, minimum transaction fee %, minimum transaction fee (absolute).

It's actually worse than you think. See my posts in this thread http://bitcointalk.org/index.php?topic=2227.0

I did a lot of simulation and I didn't post the results because they were complex and required a lot of explanation. The basic result is that a miner or group of miners with >40% of the hashing power can mine more than their fair share of blocks under very reasonable expectations.
Someone with 46% of the hashing power can win 51% of the blocks.

I seem to remember that by tweaking the strategy, "hostile mining" can be profitable at 33% of the hashing power. In all these cases the overall difficulty goes down considerably as many blocks (half?) are wasted both by the hostile miners and the normal miners they are attacking.

I'm unhappy with the current effectively GPU-only mining scheme and the popularity of mining pools as I believe that they provide a suitable environment for "hostile mining" to start. Fortunately, chronic hostile mining seems difficult to conceal.

If there were occasional transactions with huge fees then there would be an incentive for miners to not accept a competitor's block which claimed the fees but to try and generate their own block which claims the fees for themselves and then generate a subsequent block that ensures that their chain is the longest. This is "hostile mining" in a nutshell.

ByteCoin

Interesting. But the fact that 46%->51% is not nearly as disastrous as the fact that 51%->100%.

Lots of people have GPUs, that's not the problem. The problem is that whatever the mining substrate used, a single at-home miner can't hope to generate a block solo when there are so many other miners in the world (where mining companies are counted by multiplicity). I don't think mining pools are a problem, they're not very prone to forming a cartel.

I haven't managed to read the entire topic, so sorry if I'm repeating somebody else. But I saw some people worried with the need to pay higher fees in order to have more security.
Please understand that now, with this high inflation phase bitcoin is going through, every bitcoin holder is already paying a lot in the form of inflation-fee to have the network secured. The thing is that, as politicians have long found out, inflation is not easily perceived. But you do pay for it.

So, even if the fees go up, I hardly think they will ever be comparable to something like 50% annual inflation. Individually, we are probably paying much more expensively right now for network security than we will pay in the future when more people join, even if we have to pay more transactions fees.

Regarding the psychological effect - people being less inclined to join bitcoin due to the visible transaction fees annoying them more than the "invisible" inflation-fees we have now -, it could be avoided by letting the transaction fees to be payed mostly by the banks. Actually, that's how I think it will work.

Yes, the transaction fees will be relatively light on the average consumer, because the costs of maintaining the security of the network will be spread across many more users.  But we have a ways to grow, and a couple of years of high inflation, before we get to a reasonable level of costs.

Well, banks and individuals transfering large sums.

The long term returns from mining solo with a GPU are equal to and often better than those of joining a pool. A pool gives a more constant payout; that is all.


Mining pools concentrate the administration of a lot of mining power in a few hands - those of the people running the pool. If everyone were mining individually, to form a cartel, they would have to all unite and arrange a way of communicating which blocks they would accept and which they would shun. They would also have to distribute the profits of their collusion among the participants who did not win blocks. With a mining pool, both these problems are solved. I can't imagine a plausible mining arrangement more prone to cartel formation.

I'm confident that when the reward for block generation becomes small in comparison to the fees in some blocks that we will see cartels being formed and evidence of hostile mining activity.

ByteCoin

You're preaching to the choir. You might be interested in my thoughts about this here (http://bitcointalk.org/index.php?topic=5264.0).

But you don't seem to appreciate the huge variance solo mining will have in a Bitcoin world. The standard deviation of the monthly payout can easily be 1000 times the expectation. The "long term" you speak of could be hundreds of years. For all intents and purposes at-home solo mining will be futile.

Mining pools can be required to be transparent about the blocks they build on, so they can only do hostile mining if their participants condone it.
If the participants are mining corporations then sure, they can use a pool as an administrative tool to organize the cartel. But if the participants are individual miners, they will for the most part not condone hostility.

Are you confident that this will happen if we don't find a solution, or that we won't find a solution?

Spotting the non-intuitive fact that fixed weight pool payouts are unfair was a good catch. Good job for working out how to price the work fairly (I haven't checked it yet!)

I agree about the large variance and your analysis. Whether or not home mining makes sense depends on the motivations of the miner though. I can imagine a home miner motivated by supporting the bitcoin network, not really bothered by the reward but perhaps wanting the very occasional pleasant surprise. Admittedly, most are driven by profit and want to see an immediate return on their "investment".

To clarify, in my previous article I was objecting to you saying "can't hope to generate a block solo". Lottery players can hope to win the lottery even though the odds are even more unlikely than solo mining.
Only if you don't participate can you not justifiably hope to win.

Agreed, and when mining pools were being developed I posted a framework which would have forbidden certain types of fraud. I almost certain nobody has adopted it or a secure alternative.  From this apparent indifference, I surmise that pool contributors will tacitly condone hostile mining (at least initially) as it doesn't harm them and indeed possibly raises their return.

I hope you are right and people will object to behaviour that benefits them personally but is generally harmful. Unfortunately, I see this very rarely.

Good question. I can expound (on request) in more detail what I see are the necessary preconditions to hostile mining by cartels and what might happen incidentally in future to preclude it. The recent sharp increase in the national currency value of Bitcoins is a powerful new force behind cartel formation and attendant misbehaviour and that makes me concerned.

I'd like to answer your question the following way which is more general.
A solution is unlikely to be found until it has already become a problem and caused some damage. The solution found, although it solves the problem, is not the best solution and causes further problems in future and so on ad infinitum.

To digress:
I would argue that various Bitcoin design decisions which I have noted in many of my previous posts have caused, are causing and will cause many problems because they are successful attempts to solve other problems but they solved them in the wrong way.

Sometimes the best way to improve things is to undo certain bad or suboptimal decisions and redo it the right way rather than patching holes indefinitely. I'm concerned that the community seems to have an irrationally negative reaction to talking about beneficial incompatible changes.

ByteCoin

Yeah, I meant "a world after the Bitcoin revolution has completed, in which Bitcoin is ubiquitous." I edited to "a Bitcoin world", though that sounds to me like "a world where Bitcoin exists", which is now.

I can only hope that as time passes and issues relating to the present reality of Bitcoin are solved, the community will be more receptive to preventing possible future attacks.

I found the thread very interesting and I hope that it will go on.

But maybe due to the limitation on my knowledge of the subject or my limits in the understanding of the English language I humbly ask to elaborate this sentence because I can't get its meaning:
Thanks in advance!

Those who agree with me, skip this post, it's ugly meta-arguing, but may be useful.

There's something I'd like to point out now. In this thread, what is the consensus? Apparently, if there'd be a simple yes/no vote, I'd be wrong. But look one step deeper; what are the exact statements and models? I'll go through the thread again, and things said in the follow-up thread.


The side denying a problem (I re-write arguments as good as I can in short form. Frankly, I see them all nonsensical, but I'm doing my best. Sorry if some are oversimplified, I have to keep them short. This list is being edited a lot due to the expected complaints about exact statements.)

• People will add fees to accelerate mining temporarily (theymos)
• Global transaction cost will be spread, generating minimum fees (gavinandresen)
• Limits will not be removed (epii, I agree this would work, though it's ugly)
• Companies will start mining due to orders from customers to secure their current transactions ([mike])
• Many miners will not accept low fees to ensure the price. [This is saying Tragedy of the Commons doesn't exist] (Bitlotto) (revoked)
• The miners will from some sort of self-regulating cartel to make sure that the fees don't go to 0 (da2ce7, BitterTea, vladimir (slightly different wording))
• Merchants will come and fix the system because they need it (gavinandresen, stillfire)
• Inclusion of previous unprocessed transactions will make inclusion expensive enough for miners to live on margins [debunked by own side] (nextnonce)
• Once minting ends it will be at a level dramatically below where it is now. (...) Either that won't be a problem, or if it does become a problem, it will be solvable. (justmoon, FreeMoney, I partially agree but would rather like to be on the safe side.)

There are more, [mike] wrote a lot of them, some of which I think are wrong and some I'd say go into the right direction... but I think the list is long enough now.


The side seeing a problem (if transfer limits are removed, thus epii is on both sides now.)

• Without limits on fees or block size, difficulty falls due to a Tragedy of the Commons. (Vandroiy, Holy-Fire, casascius, db, asdf, gim, probably epii?)

caveden agrees but also stated he doesn't see it as a big problem, I'm waiting for an answer from him to put back into the list. Sorry I added you with a wrong statement.


I know there may be something wrong in the details and I may have unconsciously twisted things to fit. Let me assure you, I seriously tried to be fair in handling both sides and merging opinions. Even if I messed with things a lot, it shouldn't be this extreme. Am I really imagining things here, failing to see the common ground of others? How good are an open source system's dynamics probably if nobody even knows them? If you start reading the actual arguments, things get worse -- because in my eyes, all but three of the upper models have been debunked, two of those three are considered ugly and the remaining means to postpone the problem.

I know I'm not using an actual argument in this post. Feels strange to do that, too. But I think it's safe to say that a solid consensus should not produce this outcome. There is no consensus. There is no generally accepted operating model for Bitcoin after minting becomes negligible. We better find one.

Ya, you can take me off the list.  ;) I'm starting to understand what your getting at. I'm not too sure what to think now...

What is the shared limited resource to be depleted in the case of mining?


What are you talking about? This is a free market, without regulation or central planning. Bitcoin cannot work, post generation subsidy, unless it is centrally planned?

Why?  Thats years and years away.  I don't think any of us can predict exactly what is going to happen 10 or 15 or 20 years from now; I don't think it is possible to get a consensus now because there has never been a system like bitcoin before, so predicting how merchants, miners, and users will interact in 10 years seems to me to be impossible.

So:  do you think this supposed problem will happen all at once?  Or will it happen slowly over time?  If you think it will happen all at once, would there be any warning signs?  If it is a problem that we can clearly see coming, then there will be time to react.

I'm much more worried on the problems I see coming in the next year or two or three-- bitcoin-specific viruses and trojans, poorly coded bitcoin web services, and maybe bitcoin service operators getting charged with financial crimes that they didn't know they were violating.

Hrm, if I said that, I was not aware of it. I said merchants will pay for mining, even if it's at a loss versus 'verification cost', and even if it would be cheaper to wait for someone else to do it, just because waiting is not free.

No, this does not prevent difficulty from falling as profits drop, but I was specifically arguing against those saying the network would stop due to near zero profits from mining in an unlimited block size world and a 'staring contest' between merchants to see who'd blink first and burn money by turning on their rigs.

Exactly.  And this is why I brought up Wal-Mart and it's competitors.  If Wal-mart accepts Bitcoin, it has a strong incentive to directly participate in the security of the network.  And then so does all it's competitors.  And the reverse is also generally true.  The mom&pop  vendors may not feel motivated to participate in the mining directly, but they are going to want to see their transactions processed in a timely manner as well.

Why have you put me there?
Transactions fees being mostly payed by banks will only made them lower, as most people will make their transfers without the block chain.

I do think the block size limit must create artificial scarcity to push up the transactions fees. My comment saying that we are already paying a lot to miners in the form of inflation was exactly to argue with those who don't want to pay such fees.

I defend an automatic adjustment of the maximum block size exactly for creating such artificial scarcity. Something like, at each X blocks (maybe at the same time we have a difficult adjustment), the maximum block size is set to be 110% of the average size of the last X blocks.

On the other hand, Gavin has a point when he says that you seems too much desperate with an issue that will not manifest itself in the next 15 or 20 years at least. It's true that we'd better worry with it before going mainstream, when such a change would need a blockchain split, but there is some time yet and maybe other more important priorities to be dealt with.

The willingness of transactioneers to pay fees. When you include transactions with low fees in a block, you consume this resource.

We are talking about how to design the Bitcoin protocol to ensure it achieves a healthy free market equilibrium. The same way Satoshi designed some other pieces of the protocol.

Tragedy of the commons again. Wal-mart also has incentive to sit it out while others subsidize the mining. The only way I see to make Wal-mart pay its share is with some sort of union which will defeat Bitcoin's aspirations of being decentralized.

The Bitcoin community is fairly large, there's no reason some participants shouldn't debate one problem while others debate another. Also, having a plan for what will happen 10 years forward will encourage people to join now.

Phew... please try to cut me some slack on your exact formulation, or provide a corrected short version. It's hard to write in exactly the style someone might want.


@gavinandresen:

I think it is important that Bitcoin protocol becomes independent as soon as possible. You're doing a great job, so no offense really, but there is no guarantee anyone will be able to control the project once it takes a truly macroscopic scale. At that point, trying to change the protocol can generate disputes, splits, loss of trust, central authorities, so many unforeseen complications could happen! If the protocol is carved in stone and commonly accepted as "finished for all eternity", we might be able to avoid such problems.

An attack would be likely to happen within the months following one of those sharp reward drops, where minting is cut in half. It might happen that half the miners leave at once when this happens.

I agree that it's unlikely to be a problem until minting is down to 12.5 BTC or less, and that the immediate dangers lie elsewhere. But please don't neglect the future the way it's common in politics. The amount of confusion if the protocol is disputed is not to be underestimated. It's mainly psychology and politics, but we should know better than to let a financial system be controlled by such forces. Imagine nodes being mainly run by miners, and they all agree they take the easy "problem solution" and re-start minting the way Timothy Lee suggested! A catastrophe in which miners can damage the entire system to their advantage. There might be many more such scenarios, maybe infinitely many, if major changes in the protocol might happen at any time. We have no safe way out of a protocol dispute!


@stillfire:

Sorry. I added you with the merchants' theory.

Frankly, I think the original statement is wrong no matter how I interpret it, so I was having difficulty re-phrasing it. You say that some merchant would rather keep a rig running than wait for his competitor to do the same... the best more general re-phrase I can think of is either "Tragedy of the commons does not apply to merchants having to pay for the security of all merchants without being forced to" or "I don't believe in Tragedy of the Commons". Both are false, I can't help that, unless there's a cartel or everybody is a convinced communist.

Try to look at the bigger picture -- either why the statement is wrong, or that even with the re-phrased statement, you don't exactly have a model that's solid or generally agreed on.


@caveden:

Oh, sorry, I did indeed fail to understand what you said. Should I put you on the other side or with the "agree, but wait first" guys?

Please keep in mind what might happen when a later try to change the protocol starts a collusion war! If bitcoin becomes a currency, we can expect bribes on the order of dozens or hundreds of millions of dollars to push a protocol change one way or the other. Better act while the system is still controlled by sane people.


@Holy-Fire: Thanks for continuing to answer so much in my place. (Unless I state otherwise, I agree with posts by Holy-Fire.)

We don't' know what will happen without a proper game theory analysis of the system... You never know, Satoshi may have been a game theory expert and knows that the miners can set their own max block size and the system will still maintain a reasonable security.

Until we (or somebody) puts the effort in for a formal game theory analysis, we will not know, and this is pointless speculation.

+1
(see http://bitcointalk.org/index.php?topic=7496.0)

There is a commons issue, but it's not a 'Tragedy of the Commons' for several reasons repeatedly pointed out to yourself.  In the case of Wal-Mart and it's competitors, or any other large retailer and it's direct competitors, Wal-mart does benefit from the generic security of the blockchain that it's competitors contribute to, and vice versa; but what motivates Wal-Mart to contribute directly (by running or sponsoring mining clients themselves) or indirectly (by paying transactions fees to motivate third party miners) because Wal-Mart's competitors can ignore Wal-Mart's transactions whether they are fee paying or not.  Wal-Mart can do the same to it's competitors.  Granted, it wouldn't be easy to isolate the transactions produced by Wal-Mart's competitors from those of the network at-large, but if anyone has the ability to do it, Wal-Mart does.  I can think of a number of ways that a competitor's addresses could be automaticly identified, with varying degrees of success.  Even if this were not possible, if Wal-Mart is running their own miners then they can simply ignore any transaction below a certain fee and still have an economic incentive to run miners in order to process their own transactions for free.  Wal-Mart's competitors have the same incentives.

This is not a 'cartel' problem because Wal-MArt isn't a cartel itself, and the fees that they would charge others for transactions would exist primarily to hamper the successes of it's competitors, not collude to increase the price.  Independent miners would still be able to set their transactions fees lower than Wal-Mart, collecting all the transaction fees that Wal-Mart and it's competitors forgo, but this would not really undercut Wal-MArt because they are not in the game for direct profit but to defend their business model.  Wal-Mart alone has enough transactions per second to justify running some major miners just to process their own transactions; all others aside.

And they are just an example of how this would work.  This is an example of any market player who has an outsized interest in the system, there are many others that would have similar motivations to process transactions beyond direct profit.  Another such example is the "Bitcoin Bank", which has a motivation to sponsor miners, directly or indirectly, in the same fashion that present banks have the motivation to spend a million dollars on a bank safe.  In the case of a bank, however, direct profit is also a motivation.

I do agree with this. If anything is to be changed, it better be changed early. However, that requires there to actually be a problem to fix first.


In a "tragedy of the commons" the self interested individual actions deplete or destroy the commons even as the group loses. This is not so in the scenario I have described. The self interested, for profit actions of the merchants actually replenish the commons.

Yes, they would perhaps had been more pleased had someone else paid, but my point is that trying to maximise your Bitcoin savings versus other merchants infinitely has a price much higher than just diving in. At some point you'd be working on savings fractions of a penny and the cost of doing so (the staring contest, loss of business) is measured in dollars.

The merchants actually pay for the existence of the commons, like a park before their storefront, rather than just the use of them. If they did not they would lose more profit than the small sums they pay for commons maintenance. They will mine at a loss because as a whole it makes their business more profitable.

The few biggest merchants forced to mine at a loss? What makes you think they won't rather quit Bitcoin? Whether they do one or the other is merely a question of how lossy mining is, and that's dependent on attacker size, which is practically an external factor. You risk that, depending on some external quantity, exiting Bitcoin is an intelligent decision. Very dangerous.

That's what I meant with the convinced communist solution... works only if you can force people to not evade into a different setup. Which we can't, not now and not when Bitcoin is the super world currency; people can always quit.

While re-reading this thread, I realized something. I didn't read it completely, so it may already have been implied by others, though.

When I pay a transaction fee, I pay for a level of security, like explained by Mike. If I don't fear reversal of my transaction, I have little incentive for getting it in the blockchain. However, security here consists of several things:

• 1. Gettting your transaction included in the block chain
• 2. Getting the chain your transaction is in to be extended
• 3. Getting this chain to grow as fast as possible

Your fee goes to the one who puts your transaction in a block, so you pay for #1. However, you don't pay any reward to those who extend that chain. The miner who put your transaction is a block has all incentive to keep mining on this chain, since it gave him a reward that would be reverted by a split, but this is not true for other miners. So you only pay partly for #2. Finally, you don't pay for #3 at all - as explained here earlier, one possibility is that miners turn off their hardware if not enough fees are accumulated. However, every second that mining hardware is off, gives attackers one second's worth of catching up.

I feel that this is at least part of the problem: we only pay for inclusion in a block, not for getting it buried in the block chain. The cost for burying it is carried by all who want additional transactions processed.

I wonder if this could be solved by modifiying the fee system. A miner cannot take all fees for himself, only N% of it (for example, 5% of it). Miners are however allowed to also take the difference between the previous blocks' input+coinbase and outputs as additional fee. This causes the actual fee paid by someone issuing a transaction to be distributed in an exponentially decreasing way over the miners of the first many blocks to come.

This might be possible, but I don't see a real gain to doing this.

I've also been thinking about that, but...
 - It won't completely solve the problem because people issuing many transactions still pay for the security of the whole network. It might be preferable for them to use a chain secured by inflation as they mostly don't care about inflation.
 - From the technical point of view, progressive dispatching of fees would add a huge amount of complexity to the current chain format.

This topic has also been discussed in this thread:

   http://forum.bitcoin.org/index.php?topic=8363.0

As they should - they're the one who need it.


It wasn't a serious suggestion, but just trying to find enforceable solutions to the presented problem. On the other hand, technically it's quite simple to implement actually. The difficulty would be getting the changed rule accepted by the network.

Everyone needs some amount of security.
If the mining rate falls too much, and an attacker has let's say twice the global hashing power...
then it's completely impossible to receive coins safely. Waiting for hundreds or thousands or more confirmations is just pointless.

So, the global value accorded to a given chain will fall very quickly if its hashing rate falls under a certain threshold.

50% of the fee goes to the miner that solves the block. 50% goes to the miner that solves the next block. This way, txfees approach the cost including a transaction x2.

The miner covers his tx inclusion costs by including transactions with fees that are at least double the cost of inclusion and the profits from the half the fees collected in the previous block.

problem solved?

What would it change, really?  Maybe if the transaction fees are shared with a block that is 2016 blocks behind it, so that it's in a relative spot in the next difficulty retarget.

I've started a new thread related to this one in economics section.

Mining will be profitable, absent block rewards.

The 50% from the previous block acts as a kind of replacement for the block reward.

I think the passing forward will eventually happen. Imagine the future with no fixed block reward. A block with a bunch of fees is found and hardly any fee tx remain. There is not much reason to build on that block even though the block finder and the recipients of transactions in those bocks would like you to, I think a fee will be paid. When I thought about this before I thought the equilibrium would be 50% under the assumptions I was using.

I don't understand this at all.  Fee sharing doesn't change the dynamics, nor increase the likely total fees, of transactions.  It's just wealth transfer serving no obvious purpose.

It doesn't make sense as long as people still follow the rule of "build off of whichever version of a block you see first", but if some people stop doing that then some possibilities open up.

Imaging the slow version was offering the finder of the bock who built on top of it 1BTC. Why not switch over once you get the slow block? This could move the slow blocks chance of staying from 5% to 50% if half of miners were looking for this and it would be well worth it to pay that 1BTC.

Once something like this is in place you have the option of working on the current block which has very few fees in it or redoing the previous block to get all those fees and paying people to work on yours instead. If the offering you'll need to pay (just enough to outbid the other finder) is less than the extra fees then this is what you do.

I don't think people will keep working on old blocks and waste a ton of work, I think an equilibrium fee of about half the average fees in a block will emerge. At half there is no incentive to work on an old block because you'll have to pay more than half to outbid the other guy who is making the standard offering.

I think this is cool because your tx fee would now indirectly go to pay for more and more work getting piled on instead of just the one block of work as it is now.

it does change the dynamics.

If we agree that transaction fees will approach the cost of including a transaction (you're in the Vandroiy's "The side seeing a problem" category), then fees will only cover the cost of including transactions. Miners have other costs, this is the problem.

Under my proposed scenario, fees will approach double the cost of including a transaction. This leaves some meat for the miners.

As other have pointed out, it also creates an incentive to re-process a block with low fees that proceeds a block with high fees rather than building on that block. I didn't consider this; it is an unintended consequence, which I consider undesirable. To mitigate this bad incentive you could make the algorithm more complicated. For example: 10% of the last five block fees + 50% of the fees from the current block.

The core idea is that there is some reward that doesn't depend on just the transactions that the miner accepts.

I just asked the same question several days ago here

http://forum.bitcoin.org/index.php?topic=24854.0

the question is .. will it survive ?

As for mining economy:

* Huge mining bounty.
* Huge mining community.
* Huge overall network security.
* Tiny neglect-able transaction fees.

BUT, for transaction economy:
* Will the transaction fees stay low enough to continue using this commodity as a sub-dollar Hawala medium ?

If yes then huge miners will cash-out leaving the system vulnerable to attacks can be made by them or any hacker network that can offer to utilize couple mining pools that we have right now.

If NO then the system will be less-business attractive with: no advantage in lower transaction fees, questionable anonymity, less security backed up by smaller mining community, delayed transactions, volatile sub-hour pricing .. etc.


* Will the mining community continue to be this large providing this amazing network safety ?


I am a BTC man ... and these questions to know more or to pin point near less-than-a-year issues.

If more than one blockchain-based currency exists, and they are compatible to the extent that using one or another of them is trivially simple, maybe something like having a default high security high transaction cost one and a default low security low transaction cost one potentially for each locale in the locales system there should be less worry about free riders in the high security high transaction fee blockchain(s) because they will have other chains to ride that offer them a greater chance of obtaining a free ride.

Exchanging back and forth between chains should be pretty simple, hopefully far simpler than trying to exchange back and forth with fiat currencies.

-MarkM-

Economics professor who sees a serious problem here.  I have a background in industrial organization which is the relevant subfield.

Recommendation: Hire an academic economist specializing in Industrial organization to model the problem and propose possible solutions.

No one will trust me so hire someone at random.

Mike Hearn, if you can chat with Hal Varian at google, do so. He has the appropriate expertise. I think they pay him a mint though so it may be hard to get some of his time.

Final comment: This is a complez system. Analysis requires a formal mathematical model. Don't trust hand-waving and argument by analogy.

I doubt this is a problem anyone can single-handedly solve, even if he has credentials. And while I'm not much familiar with the field of industrial organization, I'm sure it provides only one piece of the puzzle and that many other fields have to be involved.

A discussion among several people with relevant skills, in a venue with higher signal-to-noise ratio than this forum, seems more appropriate.

And I'll take this opportunity to say that I think the inclusion of proof-of-stake to augment proof-of-work will be key to the resolution, by allowing a high level of security without much mining.

I like an idea where EVERYONE mines to ensure EVERYONE has secure transactions. the fees should be low, only high enough to stop large amounts of spam and to cover the costs of electricity and in the long term ~3-6 months, pay off a rig.

A lot depends on what iratio of rewards for mining to bitcoin market cap is defined as secure. The current level could never be supported using txn fees.

Currently, around 200k btc are issued per month to reward miners for security. The pool of rewards from a fee is the transaction tax rate * the transaction velocity. Roughly double the monthly btc/USD trade volume is a reasonable estimate of velocity. This is about 2 million btc per month.

To maintain the current level of security using a txn fee, you would need to tax every send at a rate of 10% (actually more since the tax would decrease velocity). This would yield the requisite 200,000 btc to pay miners.

This is clearly not sustainable. I think a more realistic tax is 0.1-1%. Any higher and the technology becomes useless. The implied level of security is 10 to 100 times lower than at present. Would this be secure?

It depends on how much an attacker could profit from controlling say 75% of hashing power. I don't know the answer to this. It seems safe to assume that potential profits are proportional to txn volume and/or money supply. We need estimates of the proportions (e.g. 10% of money supply?  1% of money supply 0.1% of money supply? (if it is the last value then a 0.1-1% tax on all sends could be sufficient to secure the network.). If it is much more than this, the future of decentralization looks bleak.

Im not talking about just dedicated miners, im saying if everyone donates a few hours a day of cpu/gpu mining, of course this will only matter if bitcoin goes mainstream and replaces usd or can at least be used at a gas station or something. if that happens, then just the additional 20% of the na/euro population mining would be more than enough to secure the network and raise difficulty by a lot. it would only cost each person a few dollars a month at most. this is of course implying a lot. we don't really know how much the usd to BC conversion will be even 6 months from now, if it skyrockets, then we can drastically reduce fees and miners will still get the same amount money kind of.

@Vandroiy suggests that proof-of-stake may be part of the solution and I think he is probably right.

The current arrangement is vulnerable to short-selling/sabotage. An attacker could borrow a bunch of bitcoins, convert them to USD, execute an attack which causes the network to fail, purchase very cheap bitcoins to return to the lender.

What if proof-of-work and proof-of-stake were combined. For example, miners sends X bitcoins to an escrow blockchain account for one year. The escrowed monies cannot be traded to a new address.

The computer holding the address is allowed to contribute hashing power sufficient to mine a maximum of 0.1*X bitcoins (as new coins or fees) within the next six months. After he mines up to this limit, any additional hashing contribution from the computer is invalid. If he wants to continue mining, he will have to put more money in escrow. There would still be competition among miners who have paid escrow fees to issue the coins before their contracts run up (thus difficulty would not fall to zero). The price of contracts would be denominated in bitcoin so exchange rate movements shouldn't be a big problem.

Under a system like this short-selling/sabotage attacks would be much much more difficult to profit from (not impossible though).

The other type of attack, I think, is excess issuance (i.e. the attacker generates more money than his hashing power is entitled too). This type of attack is still viable, but it does not seem threatening under an escrow system. If the cap on escrowed money can be enforced, at most the attacker could generate 1 excess bitcoin for every 10 escrowed bitcoins per year. Failure to abide by this limit would show up directly in the blockchain unless past transactions could be rewritten by the attacker.

I have no knowledge of coding. Thus please be patient if I have misunderstood possible attack strategies or if the proposal is technologically impossible. Of course, I know that it is thinking outside of Satoshi's Bitcoin Box and don't care.

Work is already in progress on allowing bitcoins to be encumbered until a certain time has passed; search the forum for nLockTime for details.

I'm aware of the idea of encumbering coins.

Some additional technology is required to link encumbered coins to hashing, no?

More serious is the political problem of getting people to accept the change.

Adding proof-of-stake to proof-of-work would have a major negative impact on people currently invested in mining,
while benefiting those currently holding coins; Essentially some mining rights are transferred to coin holders and miners would need to buy them back or sell their equipment.

Who wins when miners and coin holders disagree?

He did? I suggested it in this thread, and this is an idea I got from QuantumMechanic.

What I had in mind is this - once in a while (say, every day) holders of bitcoins will use their private key (or a related private key) to digitally sign a recent block. A block with signatures of holders of >50% of the bitcoins at the time will trump a competing block with a longer chain but no signatures. If someone tries to sign two incompatible blocks, the earlier signature will count. This way, once a block gets >50% signatures is guaranteed to be set it stone, no matter how long a chain an attacker tries to build. Holders will be incentivized to do this because they want to protect the network security and hence the value of their holdings, and it may also be possible to include a "signature fee" in the transactions.

So, if someone sends a large transaction (large enough to be worth double-spending), he only needs to wait a day for it to be confirmed. This means mining will only be needed in a quantity sufficient to thwart casual attacks of low amounts, thus not a whole lot of it will be needed. That amount can be sustained with low transaction fees.

This is similar to the current checkpoint system, except it's clearer who decides the checkpoints and harder to fake, so can be done more frequently and automatically.

The change should have a very small short-term effect on the miners, especially if implemented while new coin generation is significant.

Sorry. Plenty of people have talked about proof of stake, in this thread and elsewhere. I didn't want to take credit for that part of the idea. I should have assigned it more carefully, however. Again, sorry.

I don't think your version will work. Because of free-riding, incentives for holders of bitcoin to monitor transactions are extremely weak. For example, large transactions are difficult to distinguish from large numbers of small transactions. The mechanism through which stake holders identify cheaters is unclear. Would identification be accurate? costly?

Much better to ensure that everyone participating in mining maintains a stake proportional to his mining activity. That way anyone with a large enough share of hashing power to mount an attack will have to simultaneously store a huge amount of escrowed wealth in bitcoin. Attacks will no longer be incentive compatible.

I want bitcoin to be a success. But if this tragedy of the commons impedes us to have a block chain without creating new money to reward miners, we still can generate forever and have a fixed monetary base. We can have demurrage instead of fees (http://forum.bitcoin.org/index.php?topic=3816).

I kind of like that idea, but if too many people decided to save BC, then you would get inflation.

Thank you !!
But I don't get it. If too many people hoard (not exactly the same as save) btc you would have (price) deflation, not inflation.
Am I missing something?
Also, demurrage is an incentive against hoarding.

yes, in the current system if too many people hoard, then the coins are almost automatically considered dead by the community if done for years at a time. then things would cost less btc because there is less of it. im sure a simple algorithm could tell how many coins are "active" based on how many blocks ago they were traded.

They don't need to identify anything. They just need to sign a block hash once a day. It's the duty of receivers of large transactions to wait until the block receives a proof-of-stake before considering the money safe.

Because the cost of proof-of-stake is close to 0, it doesn't matter much if the incentive is weak. And it should be straightforward to have mechanisms to make it easier and to deal with the contingency of a large number of coins not voting anyway.

I see, it was just a misunderstanding.
By the way, you're the second person that tells me he likes the idea of freicoin. I think it doesn't make much sense to start it right now.

The idea behind transaction fees. is that by the time 2040 rolls around Bitcoin will have already failed, or be successful enough that the transaction volume can support the network with minimal fees. Currently 201600 BTC are issued per month for Bitcoin protection. And no, the current transaction rate could not support that same amount of security, if we assume that by 2040 Bitcoin will have either already failed, or be at least have as much trade as Visa handles currently, about 2000 transactions per second. At 2000tps if each trade pays a fee of .001 BTC (about 1/10th of a cent)  that adds up to 2 BTC per second, 120 BTC per minute, so at 10 minutes per block that's 1200 BTC per block reward. Thats 24 times more "network security" than we have today, at a trivial fee per transaction.

I'll eidit this to more thorougly correct your mistakes later, but for now point out the most important one. You are assuming that the bitcoin to USD exchange rate will remain fixed even if bitcoin grows to handle as many transactions as VISA.

To help me come up with estimates... What is the limit on the number of transactions bitcoin can process per block (the limit on max block size converted into a count of txns.)

I think the current limit is 1MB (this can easily be raised). The smallest transactions are 258 bytes; while transactions can run over 1KB, especially things like pool payouts. So you're currently looking at an upward limit of around 4,000 transactions in a block.

that can be solved by only paying out when the person has reached a certain amount. they do this now, but if more considerations were taken they would take up even less space.

Thats why i measured it all in BTC, trying to guess the exchange rate is pointless, you can change all the numbers here, they scale with the exchange rate if it goes up the fee goes down, same protection, my point was that once we reach that sort of volume transaction fees can easily pay for network security at a very very low cost per transaction.

The current network hashing capacity is enough for securing a $100M economy. It is not enough to secure a $1T economy. It can be overrun by anyone with a multi-million dollar incentive to do so, be it double-spending of huge transfers, political sabotage, shorting, whatever. As Bitcoin grows its security requirement will grow, and I'm not sure it will be achievable with trivial transaction fees alone.

A $1 trillion economy does a lot more than just 2000 transactions per second. And even then, my proposal is based on everyone paying a fee of about 1/10th of a cent (exchange rate does factor in, but then the BTC numbers go down and the value stays the same) if you wanted 10 times more security with only 2000 tps you could bring the fees up to a measly 1 cent. That would pay for 240 times the security of the current network, at only 2000tps. The larger the economy, the more transactions, the more money paid for protection. It scales. 

If the fee scales down with increasing exchange rate it means that the level of protection does not scale with the total value of the bitcoins it is protecting. That makes the potential gains from attacks higher without increasing the cost.

I am assuming that in the future the only way to significantly increase the value of Bitcoin will be its use for more trade, more trade means more transactions, more transactions means more secure network. Yes hording can bring the price up as well, but by the time Bitcoin reaches a large user base and economy it will not be prone to rapid value increases as it is currently, leaving speculators to move onto other higher gain investments, as such to significantly increase the value without speculation you would have to expand the user base, an expanding user base would be a very slow increase in value, in fact it might scale protection faster than scale the exchange rate.

With merged mining, the total hashing power is not determined by incentives of Bitcoin blockchain alone, but combined incentives of all possible blockchains. Not saying that it's the final solution to any problem, but just something to keep in mind when talking about future incentives and hashing power.

This is true.
Maybe when it starts (I read is developed and will start soon) we can make more accurate predictions about how it affects security.
I think this is going to benefit mainly namecoin, but also bitcoin, since the reward for miners will be higher.
I guess it will also affect the price of both currencies.

if bitcoin were the currency in a trillion dollar economy, then the people for a few hours a day should help secure the network they use. at most it would cost each person a few dollars a month, less than what you pay out your ass in fees that visa and friends charge. as a matter of fact, the sheer volume of cpus out there alone far exceeds any means that a company would be able to buy enough gpus. if only 20million cpus were mining at 1mh/s thats close to 20th/s. if on average people only mined 4 hours a day.

according to steam, the most popular gpu is the 9800, most of them have a hash rate at or above 30, the 9800 has ~5% of all steam users.
the 8800, most have over 20, and many over 30
the gtx260 ranges from 40-70
the 5770, at ~4% gets ~200+

lets do some averaging, shall we.

ill throw in some low end gpus to even it out and do less work.

gts150 lower than 5
8800 25
260 50
5770 210
5850 300
5870 450

thats around 173mh/s per person, assuming they do gpu mining so even if only a million people were to mine, that's around 150 th/s

yes the numbers are half assed, but it does give a small taste of the untapped potential of the average consumer computer. the census says that 44million people have computers with internet access. this is with only 1 million people with less than modest machines that would cost 700-1200 usd. thats only 2% people. only 2% of the US population would need to mine to insure that bitcoin is secure against medium sized threats. but yeah it would be nice to have that hash rate number to see how much power you would need to get 50%+

Some illustrative calculations with using different assumptions:

Assumption 1: The 1 MB txn limit is binding for some reason.

Security should be measured by the ratio of the reward per block to the money supply. Currently, "security" is about 50/7,000,000= 7.1 * 10^-6
If there are 21 million instead of 7 million BTC in the money supply, the block reward will need to triple to 150 in order to maintain security, i.e. 150/21,000,000 = 7.1 * 10^-6
1 MB maximum is equivalent to about 4000 transactions per block. In order for 4000 transactions to yield 150 BTC, you would need a per txn fee of 150/4000=0.0375. Currently, 0.0375 BTC is worth about USD$0.50. This seems alright, but it could not last. With growth in the demand for txns, BTC will appreciate, leading to a much larger txn fee. For example, right now I doubt that there are even 500 txn per block.
If the # of txns per block increases by eight fold or more to reach 4000, we should expect at least an eight-fold appreciation of BTC vs. USD.  This would increase the txn fee to USD$4.00.
Such a high txn fee would greatly undermine the usefulness of the technology.

Assumption 2: Assume the txn limit can be increased so as to maximize txn fee revenue. VISA processes about 1 million txn per 10 minutes (i.e. per block).  Suppose Bitcoin makes each block 250 MB and handles the same txn velocity as VISA. Then a 150 BTC per block reward can be maintained with a txn fee of 150 BTC per block / 1 million txn per block = 0.00015 BTC/txn. This doesn't sound sound like much until you think about how much BTC will be worth under this scenario. Particularly important is the ratio of BTC's market cap to its txn volume. The more money is hoarded, the more onerous the txn fees need to be to protect security. I consider two possible BTC valuation scenarios . They are designed to represent upper and lower bounds on BTC market cap.

Worst Case Scenario: BTC continues to be used as a store of value rather than as a txn medium. This makes it hard to raise money from a txn tax. In this scenario, I assume that BTC keeps its current ratio of market cap to txn velocity. Currently, market Cap is around 100,000,000 USD. Currently, txn Velocity can be approximated as double the trade volume on Mt. Gox, or about 500 BTC per 10 minutes. Suppose that these 500 BTC of txns are made of 100 txns with an average size of 5 BTC occurring every 10 minutes. We then have 1 million USD market Cap per txn per 10 minutes. If BTC grows to handle 1 million txns per 10 minutes instead of 100 txns, then market cap would increase ten thousand-fold to 1 trillion USD. This would yield a value per BTC of 1 trillion USD / 21 million BTC = 50,000 USD/BTC. Remember that the tax per txn is 0.00015 BTC. This tax is equivalent to 7.5 USD per txn.

Best Case Scenario: BTC becomes a txn processor like Dwolla or VISA rather than a store of value. Like VISA, is BTC purchased on as needed basis to make txns. In this case, maybe we should assume that the BTC market cap grows to only VISA's market cap (~63 billion) rather than to 1 trillion dollars. This yields a value per BTC of 63 billion USD / 21 million BTC = 3000 USD/BTC. Given the tax per txn of 0.00015 BTC, this is equivalent to USD$0.45 per transaction. Slightly higher than Dwolla's rate of USD$0.25 per transaction.


In the worst case scenario, bitcoin appears doomed. Even in the Best Case Scenario, it is not clear that bitcoin will be competitive with other txn processors. Some people have proposed taxation of hoarded BTC to discourage excessive reliance on bitcoin as a store of value. Such a tax would ensure a 'best case scenario' where BTC is used like VISA/Dwolla rather than a store of value. Unfortunately, the tax on wealth holdings necessary to maintain security is exceptionally large. To generate a 150 BTC per block reward for miners, you would need to tax stored wealth at a rate of 37% per annum. Such a high tax rate is unlikely to be accepted.

This dire situation could probably be turned around using a proof-of-stake system or a hybrid proof-of-stake and proof-of-work system. The advantage of proof-of-stake or hybrid proof-of-stake/proof-of-work is that you can attain an equivalent security level using a much smaller reward.

The future (and very near term or we are bust) I consider is when tx fees are dynamically defined not by a human, but by the system itself depending on variety of factors evaluating system status. Miners will dynamically get information about that and decide if they want to participate in mining the next bitcoin block or not depending on their mining efficiency.

This bears repeating. It seems to escape much of the readership.

Why do miners need 150 btc reward with each block? It depends on the value of BTC, right?
Of course, a 37% annual demurrage rate would be unacceptable. Here (http://forum.bitcoin.org/index.php?topic=6549.0) you have some calculations assuming 3% demurrage rate for freicoin.
With any demurrage rate and any block reward, the monetary base will eventually converge to a fixed amount. Also lost wallets will automatically be recovered by the network.
With demurrage you can also have tx fees, and there's going to be more transactions with demurrage, as users are discouraged to store the money for long periods of time.

This bears repeating again, apparently.


The increase from 50 to 150 BTC per block is to accomodate the future tripling in money supply. The incredibly large fees are necessary to maintain a constant security level (e.g. a constant ratio of attack cost to market capitalization). Yes, you could use a mixture of crippling txn fees and extortionate demurrage fees (or equivalently perpetual money creation). Yes, I agree that the inflation with txn fees product is less toxic than the pure inflation or pure txn fee products. Nevertheless, a mixed product is already available here: www.paypal.com. Won't bitcoin will be late to market?

More seriously, shouldn't we be trying to create a proof-of-stake system which potentially solves the security problem without requiring truckloads of money to be distributed every 10 mins.
To get at the problem you need to leverage the money already invested in bitcoin when you motivate the txn verifiers to tell the truth. Under the current txn fee / inflation systems txn verifiers are bribed with money to stay honest. Alternatively, a well-designed proof-of-stake system could threaten the btcs holdings of people if they lie. If you can confiscate money from people who behave dishonestly, you will not need to supply a mandatory participation system with any outside payments. You will already have txn auditors by the balls, so why pay them. If participation is voluntary, you will almost certainly need some outside payments, but I'm pretty sure that you could cut these down on these dramatically. There are probably many ways of organizing this. We should be trying to figure out a system which creates strong incentives to tell the truth (that is to not attack bitcoin) with a minimum investment of outside resources (eg. txn fees / inflation levies). Everyone needs to be a little open-minded during this process because there are probably many ways of doing this (some much better than others). The first step is to agree that there is a problem (like AA). The second step is to admit that txn fees or inflation aka demurrage can't fix this problem.

I see, it would be 150 for a 21 M base.
I have to take a deeper look at the proof-of-stake thing, I'm not sure I have understand it.

But I don't understand why so much people here thinks demurrage is the same as inflation.
In the system I propose the monetary base is fixed, so there's no monetary inflation.
Do you mean that demurrage is factored in the price of the currency and a currency with demurrage would have a lower value than the same currency without it?
I still don't know how that's inflationary.

        Your problem is that you believe that network protection varies directly with monetary reward. And to a large degree your right, but out best protection against 50% attacks is not hashing speed alone, its specialized hardware. When mining was a CPU only matter your argument would have been perfect, because you can buy as many CPU's as you want, they are manufactured in high high volume, so then network security correlated directly to money. In that anyone with the funds could take over the network. But this has already changed, right now, even if you had all the money on earth, you could not preform a 50% attack within the next 3-4 months. Why? Simple hardware specialized, GPU's are many thousands of times more efficient than CPU's and you know what else, they are produced in very small quantities, the current Bitcoin mining community alone has nearly cornered the supply of high end Graphics cards that can hash effectively. And with this specialization comes a barrier to a 50% attack, the attacker can not get enough cards, even if he bough every single high end ATI card (something that would tip us off and give us ample time to prepare) it would take months to receive enough to preform a 50% attack. As the hardware specializes it creates new barriers to 50% attacks, within a year or two we will be switching to dedicated hardware, designed exclusivity for mining and many times more efficient than even GPU's  , being a small industry these dedicated devices will create even more of a hardware acquisition bottle neck than GPU's could, requiring even more of a wait, and an even more obvious warning to create a 50% attack. The more specialized mining hardware gets the less directly monetary rewards relate to network security.   

More denial.

1) the bad guys can buy the cards
2) the bad guys can construct malicious pools and use your cards without telling you.
3) if you keep buying cards AMD will make more

1) Yes they can, simply not in enough quantity within a realistic time span.

2) The only way to use cards without telling us is to have a virus, and i am sorry to say that 99% of the population does not have a graphics card capable of anything more than a couple of M/hashes , so even if they somehow make a virus capable of installing the needed drivers, and then preventing the computer from overheating, all the while having a constant enough supply of hashing power to maintain 51% reliably (difficult to estimate hashing power when your zombie pc's are being turned on and off by their users all the time). If they somehow overcome all those hurdles, your still not going to have enough hashing power to compete with the people running high-end cards with 1000 times the hashing power, and as they tend to be smart enough to not get viruses you cant hope to snag some of them in your pool (they would notice their hashing going to the wrong person nearly immediately even if they did get infected) as such the specialization creates a barrier.


3) Yes they will produce more cards, but they will not scale production to the point where they produce enough to sell enough cards to exceed 51% as the current network speed represents years worth of card production, unless they increase by a factor of 100 they can not buy that many cards in a reasonable time span. And if they did bring production up that much it would be because the miners bough the cards, hence the same situation would repeat it self as the number of cards produced goes up.

Say that you purchased enough hashing power to drive up difficulty to a break even or loss making level. Suddenly, huge numbers of cards would become available. Purchase these and you could own the network.

Right now, this kind of attack strategy is to costly given the btc market cap. In the future, if market cap grows, the strategy will offer larger and larger rewards. Essentially the cost-reward profile will increasingly favor attacks on the network rather than legit mining.

Just wait for the block reward to drop. A fall in mining profitability will follow. This will repeat itself until the network is a cheap date.

So you think that if the difficulty was pushed up artificially by one group more than 51% of the network would immediately bail and sell their cards to them?

Let's see if I'm getting this right.

(150 / 21 000 000) * 100 = 0.000714285714 % of monetary base to miners each block
So, per annum...
365 * 24 * 6 * 0.000714285714 = 37.5428571 % of the money supply.

Now, where did this 0.000714285714 came from ?

Your assumptions are invalid.  I'm not talking about your stated assumptions, but your unstated ones.

First invalid unstated assumption:  The ratio of block reward to total BTC supply is meaningful.  You actually do state this assumption, but you do it in a way that makes it look like an established fact, and not the baseless assumption that it is.  Rather than give it a cute and emotionally charged name like security, I prefer to name this ratio cerulean.  Do you have any reasons to believe that anyone should care about this ratio?

Second invalid unstated assumption:  The current value of cerulean, or security as you may still prefer to call it, is the correct value, even though this value is an accident of time.  If you had written this post a day earlier, or even 10 minutes, or for that matter 10 minutes later, the value of the ratio would be different.  Not by much, if the interval is small, but by a lot if we get into months.  What was special about yesterday that make that day's value correct?  How did bitcoin even get this far, since a month ago, the ratio was different by 3%, and a whopping 38% a year ago?

Third invalid unstated assumption:  Bitcoin needs to be the best store of value, or the best medium of transaction.  This is a false dichotomy.  There are other things it can do, and even if it were only used for those two things, it wouldn't need to be the best at either of them to be successful.

I would keep going, but in your second scenario, your thoughts get very non-linear, and I can no longer follow you.  In particular, your sentence "This doesn't sound sound [sic] like much until you think about how much BTC will be worth under this scenario." could be replaced, with no loss of clarity, by "This doesn't sound like much until you think about a unicorn appearing right in front of you.".  I think that we are supposed to assume that the name of the unicorn value of bitcoins is so horrible, in some way, that you can't even speak of it.

Here are some things you should think about.

1)  Bitcoin does not need to replace VISA.  VISA does things that bitcoin cannot do, such as providing a way to roll back a transaction.  In a bitcoin future, VISA will still exist, and still do the same things it does today, just with one more currency.

2)  Even at $4.00, a bitcoin transaction is still far cheaper than several entire classes of financial transfers, like bank wire transfers.  These types of transfers currently do happen today in the real world, even though they cost at least an order of magnitude more than $4.00.

3)  Transaction fees do not cause security any more than ATM fees do.  People with an interest in the security of the system will continue to work on the chain, to at least some extent, even if the reward is zero.

4)  Proof-of-stake is still stupid.  I'm sorry that there is no nice way to say that.  I think that you start to go off the rails when you think of proof-of-work, which is also pretty stupid when looked at in positive terms.  If you think that proof-of-work as something that the network should reward you for, then nothing else in the system makes any sense.  What you need to do is think in terms of proving that someone else has to do an infeasible amount of work to roll back the clock.  We don't care about anything else, really.

I'll note that you did not pose any kind of argument to back up your claim that anything I said was stupid.

Generally, wouldn't youink that the probability of a lock being broken is an increasing as a function of the ratio between the value of assets behind the lock and the cost of breaking the lock. This is what I am calling security. Please propose and defend a better metric.

As far as people mining at ass to defend the network. This is ridiculous. A charity vault is not where I would put my money.



As far as bitcoin not needing to be better than VISA. You are right it doesn't need to process VISA's volume of transactions. However the situation gets WORSE not better if you reduce txn volume. I agree that my assumptions were excessively optimistic.

As far as propf of stake being inequitable, i dont care. It can duplicate bitcoin's functions at lower txn costs. Does anything else matter?

Actually, yes, I did.  I'll repeat it here for you now.  Listing a few of your invalid assumptions is the polite way to say that your arguments are stupid.



A lock, sure.  But bitcoin is not a lock.  The metaphor is not the reality, it is an imaginary construct.   In reality, security is not provided by the block reward.  Security is provided by the network forcing an attacker to accumulate over 15 trillion hashes per second of computing power, and this is for a trivial attack of no consequence.  A meaningful attack would require several times that, and we can trivially extend the margin from a multiplier to an exponent if we ever want to.  The block reward provides an incentive, only.


This analysis is still based on a ton of assumptions.  Some of these assumptions have been shown to be false, and the rest are at best unproven


I never said that it was inequitable, I said that it was stupid.  Stake is meaningless.  Proving it is doubly meaningless.  Basing a system on a meaningless expression of meaninglessness is stupid.

Why is stake meaningless? Do you mean that it won't work in theory? If so, why?

When does the block reward get halved? That event will be a good test of my assumptions. If I am right difficulty should fall following the reduction in rewards. Other than that I don't see the point in arguing abput it with you. Explain to me why proof of stake won't work instead, please.

can someone fully explain the "stake" idea?

There are more than one stake ideas. Both cunicula and I described our respective stake ideas earlier in this thread (post #113, #116).

the proof of steak idea not only would be hard to implement, it also is poorly thought out, introducing more complexity into the system would only make it more difficult to use bitcoin, unless i am missing something?

What you're missing is that it may be necessary, as in Bitcoin won't be able to work without it. So the fact that it adds complexity (which has no effect on regular users) is moot.

And like I said there's more than one idea and they're all rough sketches, figuring out the optimal solution requires serious discussion.

Thank you for the numbers. I will look into these stake ideas.
But first I would like to know why freicoin's eternal reward to miners must be that high.


Or where the 37.5428571 % annual reward came from?
Why a 3% or 4% of the monetary base annual reward for miners is not enough?

Add to that, some people prefer their proof of steak on the rare side, while other would demand well done.  And then there are all the proof of A1 sauce proponents!  I'll never understand it all!

You are righ that it is poorly thought out, but that doesn't mean it can't work with more thinking. For example, I dismissed Meni's idea, but on further thought i believe that i may be wrong. His idea may be viiable. We need to have more people thinking about the issues.

I would prefer a system ith the following features:
1) the value of your vote is tied to both hashing power and your stake in a pool of voting coins
2) it is possible to destroy txn fees to take reduce the money supply if the aggregate hash rate falls or fails to grow
3) people who participate in voting receive a monetary reward if their votes match those of the majority of votes.
4) disagreement with the majority of votes can result in confiscation of your money
5) there is a significant time lag between acquiring bitcoin and being allowed to vote.
6) there is a significant time lag between ceasing to vote and being able to transfer coins used for voting.
7) money supply growth is pegged at a small fraction of txn fees
8) txn fees are a very small fraction of the median txn, say 0.1% or less
9) there is no plan to alter the system in the future

You don't need all these features in a proof of stake system, so it can be much simpler than this. However, I think all the features are useful.

the 37% is just what you need to maintain the current hash rate. It is the current amount issued by bitcoin. 3% or 4% might work, but the aggregate hash rate would probably be at least 10-fold less.
The low aggregate hash rate might be enough or it might not. Because of the "might not" scenario, it makes sense to investigate alternative solutions such as proof of stake.

if i understand proof of stake, its a system to prevent attacks on the bitcoin network. so far there have been almost no successful large scale attacks on the network.

however if you really want proof of stake, feel free to make your own client with it inside and prove us wrong.

the problem with this argument is that the system is set up to offer strong security now, and progressively weaker security later on. Apparently, most people only care about the current operation of the system. The fact that it is probably not sustainable doesn't bother anyone. I think it is just a seeing is believing issue. Depressingly similar to US gov't finances.

how will the security get weaker. if you want to continue using bitcoin you will mine for a few hours a day, its only common curtsey that you help secure the network you use.

the longest block chain is the valid blockchain. By vote i mean the ratethat a miner can add to the chain. Currently, this rate is proportional to hashing power only. I would like a system where hashing power can be leveraged with proof of stake. For example,

Currently

# of votes = # of hashes

I would prefer

# of votes = (escrowed voting bitcoins)^0.9*(# of hashes)^0.1

i believe people are motivated by profit not anonymous acts of public service.

Just because you keep saying something doesn't make it a fact.

you profit because you pay less, would you rather pay visa 20+$ a month or simply run a client for a few hours a day totaling about 5-10?

This is nonsensical.
1. If Bitcoin is successful then most people won't and shouldn't know what mining is or how to do it (this is largely the case even now).
2. Those who do know can use Bitcoin without mining. It's not like the alternatives are "use Bitcoin and mine" and "don't use Bitcoin and don't mine".
3. Mining on the CPU with the Bitcoin client is worthless. You need either a GPU or a future dedicated hashing chip, and dedicated software.
4. Mining has a cost, it will require purchasing hardware most people don't have and operating it. It also requires setting up the software. People won't do it without being incentivized.
5. If Bitcoin succeeds then attacking the network can become much more lucrative, and a whole lot of mining will be required to prevent it. A few random contributors won't be enough.
6. Currently the network security is supported by the coinbase (generation of new coins). If you want to make the case that it will remain secure when the coinbase goes away, the onus of proof is on you.

I've get it now. 37% is what you need to issue annually to have the same security (proportional to the total value) that we have today.
But that number has been always going down. With the second block was 50 * 6 * 24 *365 = 2 628 000% annual reward, with the third was 33 * 6 * 24 * 365 = 1 734 480% annual reward, etc.
But I still don't know why the security we have now is the right level.

I agree with you here. It could be that we have way more security than necessary right now. If we can get by with say 5% of the current security level than I think that everything will work out fine. The question is how low can the security level go before it attracts attackers. I don't think anyone knows the answer. I don't think the wait and see approach is the best idea. There is a considerable amount of money at stake.

                  Currently we can use our knowledge of the difficulty to estimate the total hashing power of the network and also the total hashing power of the pools by looking at how many blocks they generate over a period of time. The effectiveness of double spending attacks rely on people not knowing about the attack going on, because you need to get a merchant (or some other sap) to take your coins and exchange them for goods before you pull the rug out from under him and unspend those coins. Provided we keep alarms on the system to let people know 51% attacks would be unless. Everyone knows how many blocks are being generated per period of time, its broadcast, using this knowledge, combined with knowledge of major miners block generation rates every client could do the math on that information and determine weather 51% or more of the hashing power has been accommodated for or not. When a single entity has 51% everyone is informed by their client and Bitcoin spending stops, the moment the attacker breaches 51% everyone using Bitcoin is told not to spend or accept until such a time as the attack ceases. This is a really heavy handed move, and yes it would be bad for Bitcoin, but a 51% attack is bad regardless of what we do about it so why not take a course designed to destroy the attackers incentive. 

... Unless of course the attacker wants to destroy faith in Bitcoin (politics? Stake in current financial system? Short-selling?), in which case suspension of all Bitcoin activity would count as "mission accomplished (http://xkcd.com/810/)".

We need a mechanism to prevent attacks whatever the motivation and strategy of the attacker is.

Or they could just buy up cheap cpins during the attack. Suspend the attac. Sell the coins once prices recover. Go back to step 1.

Why do you assume prices will fall during an attack on the block chain?

what i dont understand is why the 21 million limit on bitcoins?  I mean over time bitcoins are lost anyway.... so why not continue awarding bit coins on block generation?  the number of coins awarded could be based on some metric? % of total expenditure or number of transactions..... what ever it takes to make it rewarding enough to keep the required amount of hashing needed to keep the network secure??

The aim of the target monetary base is to have it fixed and stop the initial needed monetary inflation.
What I propose is generate always the same amount and destroy a proportion of the target base, and that proportion will eventually be equal to the amount generated, having at that time the desired fixed base.

Blocks are anonymous.  How do you propose to figure out the distribution of hashing power?

take a look at http://bitcoinwatch.com/ they have a hash rate distribution monitor right on their page, its live. By keeping an eye on the rate of block production with a known difficulty they can estimate the total network power, by looking at the blocks produced by any one pool in a given period with a known difficulty they can estimate that pools hashing power, since all major pools report his information (and even if they did not they have to tell miners when they found a block) we can accurately know what portion of the total hashing power is controlled by whom.

So, the attacker is going to publish a data feed showing their hashing power prior to the attack?  Or are you suggesting that we shut down the network whenever we can't account for at least half of the network power?

Yes, take a look at the graph now, we can account for more than 85% of the hashing power, i have never seen the "other" section top 30%. Any major mining pool can be easily added to the monitor. And i highly doubt that a new non-malicious pool will sprint up and get 51% before they add it to the monitor. 

Now explain to me how you will implement this idea into bitcoin so that it is not centralized.

There are a couple of options here, clients could ping the pools themselves and ask for generation data and take a look at the block chain, then preform the percentage math locally. You may notice that having clients ping every major pool on start up would be rather resource intensive, although not too bad as major pool will have the hardware to handle it.  A better way to do it would be to get pools to 'stamp' blocks they generate, just as Santioshi included a sentence in the genesis block pools could include a 'Mined by: Deep Bit' in their blocks, allowing clients to simply look at the block chain over the past few hours and do the math locally.

You are centralizing bitcoin right there, requiring the client to ping pools and get data that could very well be forged. also how do you get the clients to ping the pools, if you tried somthing like DHT then it would be open to abuse, just open up any web server and pop in 50exohash/s and fuck up the network. and adding a stamp to the blocks would add more data to each block, and right now we are starting to see the chain getting big, in 10 years the block chain could be over 20x bigger than it is now, we don't need to put more data in it.

what i see now in bitcoin is an almost perfect system, why would you arbitrarily change it when there has never been a problem or currently have a problem. any predictions are only that, predictions. we have never had anything like this before and we will only see the problems arise when it hits mainstream and the cracks open up or over a period of more than 5 years.

I like Bitcoin as it is currently, and to be honest i really don't think a 51% attack is going to happen, i was just brainstorming hypothetical approaches to discouraging 51% attacks. Adding the data to the block chain would be just a could of bytes per block, and over the course of 100000 blocks i may add 5 or 6 megs to the size of the block chain. The stamping solution requires no change to the protocol what so ever, blocks already support custom data areas, this would just be putting them to use. I really dont think its needed, but i think its good to know its possible and it could be implemented today as no changes to the protocol is needed and the rest is comparability simple. 

Rewriting the rules will likey cause a major disruption. If this a disruption is necessary, it will be much less costly now than it will be if implemented after bitcoin takes off. Continued operation with a deeply flawed protocol may prevent the currency from ever taking off. A likely scenario is that another currency will develop better rules and supercede bitcoin.

the only flaws i can see are holding blocks back, spamming the network, and the over 50% hashing power flaws. if you know of some amazing loop hole or something then by all means, exploit the network and set it in ruins. i in fact encourage it, i do not want to use a currency with fundamental issues at the core.

but also keep in mind, if another currency were to ever grab a foothold in the bitcoin market share, then both would suffer.

That's what we're talking about.

I don't have millions of dollars to fund this experimental attack.

I should point out, yet again, that it would be trivial to change the attack protection function from a multiplier to an exponent.  If nodes refused to revert the block chain unless the change in difficulty was more than 2^(n-5) times the current difficulty when n>6, a vendor could wait a few of hours for a big transaction and be sure that all of the computing power in the galaxy would be unable to reverse it.

That is a slight exaggeration.  It would really take a day or two for that level of security, particularly considering that we are unable to estimate non-human computing power.  But 2 hours would require an attacker to have about 64 times as much power as the rest of the network combined, and 3 hours would boost it to around 4096 times as much.

And I've softened slightly in my criticism of stakeholder signature schemes.  I can see how they could be useful, in theory, but only as an addition to the current header hashing system.  But as a standalone system, it is still pointless.  Oh, and there are horrible operational problems that will turn up if you ever try to implement it.  For starters, it requires the largest wallets in the world to be online, and they are exactly the sorts of wallets that you want to keep offline.  And the problem of gathering, distributing, and verifying signatures corresponding to 3.5 million BTC (and growing every day) is hardly unsolvable, but still immense.

the 50% hashing flaw can hardly be considered. the amount of gpus being made would simply not be enough to overpower the network. simply put you would not be able to buy that many even if you had all the money in the world. and if you did have a lot of money, enough to buy a factory, it still would not be enough. not only do you need way more than 50% for a successful attack, you also have to face problems like normal network hash rate increases.

This throws away exactly what the "longest chain" rule was supposed to prevent - a node being unable to catch up with the rest of the network after a period of isolation. You'll want some way to recover by checking which branch is the real one... From a "trusted" source, whose signature you'll want. So might as well make it part of the design.

As I mentioned you don't need the private key required to sign proof-of-stake to be the same one needed to send coins. You'll keep your sending key well hidden offline, while the stake key will be online doing signatures. If someone steals your stake key, you just move the coins to a new address.

Given the distribution of bitcoins, I don't think 3.5M BTC is that many addresses.

You need to think this scenario through a bit more.  Ask yourself what circumstances must occur for a node to be unable to rejoin the world after a network split.  I'll give you two hints.  For the network to get stuck, there needs to be mining power on both sides of the split.  And the duration necessary for the split to become permanent is directly related to the split ratio in a way that makes an honest split of sufficient size and duration to be extremely unlikely.


So, just add a second hash to each script with a stake signing key in addition to the existing spend signing key?  I'm not a big fan of that, but I can see how it would nullify that particular objection.


I bet it would be a lot more than you think, if you consider the fraction of bitcoins held in wallets that are unlikely to participate.  At any rate, like I said, hardly unsolvable either way.

I also prefer a mixed hashing-stakeholder system, but don't agree that the standalone system is pointless.

I agree with you about the large wallets online issue. However, this in itself is a serious flaw that needs to be addressed.

To solve the problem, why not allow users to specify txn limits on their wallets? For example, I create a wallet that has a user-specified send limit of 1 BTC per block. The wallet also has a user-specified emergency address where the money can be sent without limit. The wallet-specific txn limit and the safety address are recorded in the blockchain. If I detect unauthorized txns,  I can empty my remaining coins into the emergency wallet. If I'm really securing a lot of money, I can create a 'safety' chain of wallets with txn limits. To steal a reasonable amount of money, the attacker would have to control every single wallet in the chain. Voila, a large wallet can be stored online safely.

As far as gathering, distributing, and verifying... You only really need information from people with a relatively large amount of coin. You could just place a limit on the minimum investment necessary to mine. Smallholders would not need to participate in verification. Voila, the network is much smaller.

Transaction limits (roughly) triple the size of the blocks.  First, someone sends you money, then you send it to yourself again, but this time with your wallet policy information included.  Not a big deal today, but in the future...

One other objection to the stake idea.  Whatever function we make that system do is power that we are granting to major coinholders over the minority network.  The smaller the number of entities involved, the easier it will be to abuse, and without recourse.  Extreme care must be exercised.

So the blocks are 3MB instead of 1MB, extra storage and bandwidth seems like a small price to pay for avoiding regular security disasters.

The incentives to abuse power are not there. The major coinholders need to sell their coins to minor coinholders to divest themselves from the system. If they abuse minor holders, the coins they hold will lose value. The situation is very different from a typical shareholding arrangement where there are physical assets for major holders to expropriate from minor ones. For currency, trust is perhaps the principal resource that gives the holdings value. Abuse trust and the value can rapidly evaporate.

The miners on the other hand are much closer to disinterested third parties. If they commit abuses, there are no obvious consequences for them.

But what about non financial attacks? Say Bernanke trying to destroy bitcoin.

Bernanke can destroy either system with his pinkie finger. I think we should be thinking about malefactors of a lesser order.

Figuring at $1000/ Gigahash, you need maybe 7500 gigahash to control the network. Currently, that is 7.5 million USD, or 7.5% of BTC market cap. Say instead you have a system where you need approximately a 20% stake in btc wealth to control the network. Currently, that is 20 million USD (20% of market cap).  The gigahash % of market cap will fall dramatically as mining rewards fall. The proof of stake % could remain stable over time.

This is the part I'm having problems with.
You're saying the current security is 7.5%. Is that too much? Too little?
What are you basing on?
Of course it would be great to increase security without increasing costs for the network. But the stake-proof system doesn't convince me yet. Maybe is because there's still many proposals for that system.
I'm re-reading the thread from the beginning anyway, to see the stake-proof proposal a like more.

We don't know. I estimate it's higher than necessary. But the security sustainable without either coinbase or prohibitive tx fees will be much, much lower, and we don't want to roll the dice thinking maybe the sustainable amount will be sufficient.

I think you'll be disappointed, AFAIK this was mentioned late in this thread. You may want to search for the post about proof of stake by QuantumMechanic, from which I got the general idea.


I need to research this more, yes. But what I had in mind is a targeted attack against a particular node, trying to isolate it from the network and feeding it blocks distinct from those known to the rest of the network. I think it's possible to do that, and while I don't know if such an attack can be lucrative, the victim node can never recover if it adheres to your protocol rigorously.

But if it turns out to be a viable means for increasing security of large transfers (for which a day of waiting would be acceptable) then by all means, proof of stake won't be needed.

This would make undoing transfers very difficult, but you could still hold the network hostage. Short-selling strategies could still be profitable.

I'm not sure I understand about large transfers. How does this apply to them in particular? Also can't large transfers be easily disguised by breaking them up into numerous small transfers?

I just had an idea. Maybe stupid.
For large transfers maybe you want spread the risk in various blocks instead of just one. My first though was to put the same transaction in various blocks with a special condition that says that the transaction is only valid if it appears in say, 10 different blocks. The miners would share the transaction fee. But then I though that this was equivalent to just wait for more blocks to bury your transaction deeper.
If the transaction is not valid (and thus spendable by the receiver) until X block are on top of the block in which it appears, we can have slower but more secure transactions depending on the needs of the user. We just need another field with each transaction that tell the miners how many blocks have to be between this transaction and the next spend from its outputs.

Let's have an example.
I'm the attacker. I send 1000 btc to buy something expensive. The seller waits for say 6 confirmations and gives me the product. Then I (with my super-miner) cancel the transaction (by creating a parallel and bigger chain) and send it to another address (double spend). The seller is sad.
He could wait until 100 confirmations to give me the product, but then, after 3 he could take the money and run. In that case I would be sad.

Now with the confirmation counter, if I set it to 100 confirmations, we can wait for the 100 blocks and I'm not scared that he gets the funds after 3, without giving me the product.

Does this make any sense?

You're right, actually I didn't think a lot about solution to this problem, I was focusing on preventing double-spending. In any case I think solving this will be easier if we solve double-spending via other means.

If you need to receive a large transfer from someone, you know that it may be profitable for him to mount a >50% attack in other to double-spend it, so you need some sort of guarantee that the transaction is secure before you accept it.

When you receive a smaller transfer it is much less likely that the sender will be willing or able to double-spend it, and much less risky if he does.

Is intentional sabotage illegal in any wa?One scenario is that a company sabotages bitcoin in order to kill off competition. Paypal might consider this for example. What is the weakest link in terms of sabotaging bitcoin? In particular is it easier to target the.mining process or verificatoon by the bitcoin client?

No single company has the resources to kill off Bitcoin, a government with a few hundred million could build a card manufacturing plant, and pump out the cards in the needed volume. But that would take years of preparation. Even if they started today no entity on earth could take over the block chain in less than 6 months.

We don't care about one node, we care about the network.  If one node gets screwed, the operator of that one node can just delete the block chain and start over.  Or at least just the bad blocks.  And a node can protect itself by having lots of connections.

This is ridiculous. Ebay owns paypal and has a market cap of 43 billion. That is about 4000 times as much money as the appromiximate 10 million required to disrupt block processing. If they want to they could stop bitcoin within a month. It is chump change to them. If they took bitcoin as a serious threat they would probably have been killed it off already.

It would be a lot more than that





So, no one can get the cards that fast, and even if they could facility costs alone would be 10 times more than your estimate. Now assuming that the attacking group was patient they would wait for a few years while they build up the needed supply of cards, of course buying that many cards would bring attention to Bitcoin, and with that attention comes more mining, meaning that their goal becomes higher the more cards they try to buy, and there is no guarantee that the network would not move to dedicated hardware that trumps graphics cards when they where in the middle of collection.

The only way to escape this paradox and get the cards within any reasonable time spawn would be to build their own factory dedicated to the production of high end gpus or dedicated hardware.  Building a factory is complicated, they require clean rooms and millions in state of the art equipment, as well as large amounts of expensive materials to build. Producing their own cards may be the only way to preform this attack without alerting us, but it is also much much more expensive.


Both approaches require lots of prep time, one to build up cards the other to build factories.

ttk2, I am not going to respond to you anymore.

Couldn't any institution buy all the cards on the first and second hand market? This would drive up the price enticing more sellers (many probably honest miners). They would quickly buy 30,000 cards, albeit at greatly inflated prices?

Think about it. If a 6990 is going for $2000, how many people are just going to cash in their mining rig?

Not sure if i should feel victorious or insulted.

I have created this thread (http://forum.bitcoin.org/index.php?topic=32258.0) to find out if bitcoin could survive only with fees.

Alternatively they could just manufacture some structured ASICs and rely on commercial confidentiality provisions in their contracts to hide exactly what they're doing until it's too late. (If we're considering the possibility of stealthy US government attackers, it's even worse: they have deals with foundries in the US for ASIC manufacturing to handle classified projects.)

I never said an attack was impossible, yes this method would work, but like a said, it would still take a long time to make enough devices, and it would still be very very very expensive.

I guess "inflation" here means "money supply growth" because bitcoin offers a deflationary model.
Incidentally, my undestanding was that the period was four years so BTC generation will halve only at the end of next year, right ??

This thread deals with two issues, namely robustness against possible attacks AND sustainability of mining when new bitcoin generation dwindles to zero. Even if the two issues are connected I would like to focus on the second one, the economics of mining.

If K₀ is the generation rate of the bitcoins in the initial period (300 Bitcoins/hour) and P the duration of each period (4 years), according to the rules of the bitcoin protocol Qn = P*K₀/2ⁿ is the quantity of bitcoins generated in the n^th period.
In other words, the aggregate value of the money created in the nth period equals the aggregate value of the money created in the first four years (the initial period) if  the value of the bitcoins grows by an annual rate of 2ⁿ/4*n.

Now let us assume the utility of the bitcoin network is proportional to the square of N the number of users (a formula to factor in the “network effect”).
Assuming the utility of the bitcoin network correlates to the value of the bitcoins yields:
(N_n)² = k * 2^n-2/n.

The result shows that an exponential growth of the user base, i.e. a continued successful launch of the bitcoin network in line with what we are currently witnessing, ensures a steady growth of the value generated by mining at least until an inflexion point is reached.

It's roughly 4 years, but when difficulty is increasing it will be less. I think the current estimate is September 2012.

There's some network effect, but the utility still scales much slower than quadratic.

We know there's no problem as long as generation is high enough... But what happens afterwards?

My point was there is no problem as long as user base grows exponentially.
Afterwards (that is after the inflexion point), commission fees must be the partial substitute for value and could maintain the profitability of mining in the long run by virtue of deflation.

It doesn't make sense as long as people still follow the rule of "build off of whichever version of a block you see first", but if some people stop doing that then some possibilities open up.

Imaging the slow version was offering the finder of the bock who built on top of it 1BTC. Why not switch over once you get the slow block? This could move the slow blocks chance of staying from 5% to 50% if half of miners were looking for this and it would be well worth it to pay that 1BTC.

Once something like this is in place you have the option of working on the current block which has very few fees in it or redoing the previous block to get all those fees and paying people to work on yours instead. If the offering you'll need to pay (just enough to outbid the other finder) is less than the extra fees then this is what you do.

I don't think people will keep working on old blocks and waste a ton of work, I think an equilibrium fee of about half the average fees in a block will emerge. At half there is no incentive to work on an old block because you'll have to pay more than half to outbid the other guy who is making the standard offering.

I think this is cool because your tx fee would now indirectly go to pay for more and more work getting piled on instead of just the one block of work as it is now.

-DiamondPlus

I think this is not true.
I think the rule is: "hash on top of the longest chain (measured in work, not in blocks)".

Yes, but if two blocks are found with the same difficulty then they are considered equal work-wise (even if one has a smaller hash value-- the "Bits" field in the block is used to compute chain work, not the block hash).

If there are several valid tip-of-block-chain choices all of which have the same work, then miners are free to build off whichever one they like. The rule everybody (I think!) is using now is "build off the one seen first."

Thanks for the clarification.


I see. The "first seen" rule cannot be enforced in the protocol because peers cannot know what the next block solver received first. But there's no incentive to use other rule.

A recent post from Mike Hearn about how to handle this problem with network assurance contracts (https://bitcointalk.org/index.php?topic=67900.msg792199#msg792199).

Block sizes will need to get larger in time.  3000 transactions per block and one block every 600 seconds = max limit of 5tps.  To put it into perspective Paypal handles about 50 tps.  However transactions are "bursty" so daily avg peak is likely 100 tps to 200 tps.  The annual peak is probably in the 400 to 500 tps range. 

Also the 3000 transactions is based on avg current size.  As transactions get larger and more complex 1MB will result in less transactions.  At 2400 transactions you are looking at ~4tps, 1800 transactions is a mere 3tps.

Bitcoin supports larger block sizes and they will be used if Bitcoin ever scales to any significant volume.

Fees are a problem IMHO (I know Gavin disagrees).  It creates a race to the bottom. 

PROCESSING A BLOCK IS VERY DIFFICULT = high cost per block.
PROCESSING A TRANSACITON IS VERY EASY = low cost per transaction.

This creates a dynamic where it makes no economical sense for a miner to exclude paying transactions as long as there is room in the block.  Keeping the block size artificially small would drive up prices BUT it also limits the usefulness of the network (max tps) and there will be a never ending push to increase block sizes. 

So the efficient miner includes all paying transactions and excludes all free ones.  That maximizes the revenue per unit of work. Remember 99.99999999999999999999999% of the work/cost is hashing the block excluding a paying transaction drops your revenue by magnitudes more than it drops your work/cost.

So if miners include all paying transactions and block sizes will need to grow to allow the network to grow the optimal fee to pay is the lowest fee which gets you in the next block.  That will trend towards 1 satoshi per transaction.  Fees will rise as the transaction volume pushes up against the limit of block size but then fall again as block size is increased. 

At even paypal scale (50 tps) and 1 satoshi per transaction annual revenue for network is $80.00. 

Did you read Mike's recent post? In this scenario, normal transaction fees are indeed not the only/dominant motivation for mining, but rather people holding large amount of BTCs will be motivated to chip in and donate towards this public good "if enough people donate as well". It's rather elegant.

I have.  It is just unproven that it will work or on the scale that is necessary.

In 2011 terms the network annually costs ~$1 mil per TH/s.  The first thing to keep in mind is that Moore's law doesn't improve security.   Moore's law raises the nominal number but the same faster hardware available to good guys is available to bad guys too. How much security do we need?  Today likely not even half (which is why this first subsidy cut is likely that big of a deal) but someday if Bitcoin is processing billions of dollars a year we likely need much more, maybe 30 or even 50 TH/s (circa 2011 hashes) so the cost to secure the network is in the $50M range annually range.  Now depending on when that is the nominal number will likely be higher but the network isn't any more secure.  Say in 10 years the cost per TH is 1/20th the current cost well 200 TH/s in 2021 isn't any more secure than 10TH/s today.    $50M is a large annual sum to expect a small number of rich people to put up.  Even if it logically should be done the 51% attack is a "black swan" many rich people will convince themselves the network is secure enough.  They won't really understand the risk they are taking until the event occurs and then it is too low.

While I think Mike's solution is a novel one and likely useful to boost network security, if the protocol enforced a minimum fee then the amount it would need to "boost" would be less and maybe more probable.   Fees would still trend towards the minimum it would be a more meaningful amount.  Say 1/10th of a bitcent vs 1 satoshi being the lower bound on fees.*

Note free transactions would still be possible only fees between 1 satoshi and the min fee would be invalid.  Free transactions would allow micro transaction to be handled using alternate financing.  Say I run a site that needs to process large numbers of micro transaction where even 1/10th of a bitcent would be unprofitable.  I could make arrangements with a pool(s) to finance free transaction to an address(s).  I may pay a fixed monthly fee and the pool(s) includes these free transactions when space is available (think junk mail rates by postal service).  More likely some service could act as a middle man negotiating between multiple pools and multiple micro transaction enterprises.

*There are issues with a fixed fee also.  Someday 1/10th of bitcent might be $20.  Setting the minimum fee as a % of inputs is an option.

Thanks for covering this D&T. I wanted to write something similar to this, but didn't want to distract the focus from the profitability of monopoly in the other thread.

I am finding it difficult to believe in the concept that some rich people will essentially fund then network.  I'm just doing a back-of-the-envelope calculation here.  Unfortunately, this is all dependent on BTC price:  if price jumps to $100/BTC because all of online betting/gambling and MMORPG trading adopts Bitcoin, then miners would still have incentive even if generation dropped to 2.5 BTC/block right now.  I know it's not that simple, but the point is that looking at raw BTC/block generated makes for a somewhat arbitrary measure of how much miner support there will be.

But let's assume the BTC price stays constant at $5 and mining reward drops to 12.5 BTC/block in 5 years.  Then the NAC as described by Mike Hearn would have to support about 30 BTC/block of miner incentive, to guarantee that miners still find it profitable to continue mining (because at $5/BTC and 50 BTC/block, miners are incentivized, but making less than 100% profit).   That means that there needs to be buy-in for $150 per block to keep the network going.  That's $900 per hour, or about $20k per day.  That seems doable in a sense of a one-time crowdfunding effort -- but this is every day til the end of time.   If you look at how the variables change, an increase in price will require a lower BTC reward to be profitable, so I see $20k/day as a decent right-order-of-magnitude number that is needed to keep the network going at the current generation rate.  And it will get larger, though only slightly as the generation continues halving.

Although, ideally we'd have at least 3x the hashing power we do now, as I believe that governments and botnets are in range using existing resources to attack the network (but I dont' want to get distracted on that part).  The point is, I believe that for a good equilibrium to be reached, we're looking at about $50k-$100k per day to be added to fees or NACs to keep a healthy network running.

If there are 50k users who all pledge $1/day, or $30/mo, that's obviously ideal.  I'm sure some people would step up to contribute more and make it less expensive for others.  But it's still a tremendous amount of money.  And still an unsolved problem.  Mike has talked about using NACs to incentivize miners, but using OP_CHECKMULTISIG for even 1000 public keys is a lot of blockchain bloat.  And no matter how you do it, those 1000 public keys will end up in the blockchain trying to get money into an address that can fund the NAC to begin with.

Put all this together, and I feel like we would need some rich folks to fund it (which is stupid expensive for anyone), or we should be focusing on transactions fees carrying the incentive, since they are already part of the network (or somehow create out-of-band non-BTC incentives...)

IMO this is not a reasonable assumption ...

In 5, 10 or X years, when the block reward drops, Bitcoin value either rises considerablly, or drops to zero. Its value today hinges on the speculation that it becomes a major world currency "sometime in the future". If people see that this is not the case, they will exit the market. 

I don't think it's a reasonable assumption either.  But some assumption has to be made to even start putting numbers into the analysis, and using the current state is at least a feasible one (since it's currently at this state).   And in the end, it doesn't change the fact that the network may need $100k/day to maintain healthy miner participation.  I'm looking for an order-of-magnitude more than anything:  getting $100k/day of contributions may be tough, and fitting them in with NACs will be painful for the blockchain.  It might be better to focus solely on transactions fees, the way they were intended.

The argument that difficulty will tend toward zero in the absence of a block reward is something I've brought up in the past.

One thing that I had not considered at the time was the effect of merged mining, since I was spouting off this line before merged mining ever existed.

I think that to understand this issue, it's significant to consider that if Bitcoin really does end up in a situation where its difficulty tends to zero due to a lack of economic incentive to mine, something somewhere else is likely to not have that problem (inflatacoin? litecoin?).  Someone's always going to be mining something.  Bitcoin can be secured with merged mining the same way Namecoin benefits from Bitcoin mining.

Of course, it would be a huge OUCH to Bitcoin (specifically, the legitimacy of the main chain as we know it) for it to have to take a back seat to some other alt chain just to survive.  But at least it would remain secure.

Yes, merged mining lowers the security pressure for all chains.
Some proposed chains have perpetual "subsidy", like freicoin.
With 5% demurrage, the annual reward would be 5% of the total monetary base (which by the way converges better than bitcoin's because lost coins are recycled).
You seem better than me in these security requirements calculations. Say we end up with 100 M freis, will 5 M of them a year be enough to secure the network, or it will be co-dependent on other chains like bitcoin?
How many chains like this one are needed to reach the necessary security through merged mining?

I don't believe in merged mining as the answer (https://bitcointalk.org/index.php?topic=67900.msg793750#msg793750).

What do you think about perpetual reward + fixed (even more than bitcoin (http://www.youtube.com/watch?v=hlWyTqL1hFA&feature=player_detailpage#t=1137s)) monetary base?

Note that I don't consider lost coins as an important bitcoin flaw because the protocol can be easily modified to divide satoshis. I'm only saying that the monetary base is more stable with demurrage and a perpetual reward. For concerns about "elastic supplies".

Wow, only 50 million USD a year? That's really cheap for a widely used global payment system and I don't mean this as a joke! Visa has a net income of 3 billion USD - that's 60 times that!
With even only one million users, each one would pay less than she does now for bank/credit card fees. I would say a million users is plausible in the longer run, even if Bitcoin stays a niche solution.

Miners have a high incentive for the longer term survival of Bitcoin (because they need to recoup their investments), so they won't allow the hashrate to drop to dangerously low levels. Also they will be using specialized hardware (ASICs) which is useless for anything else so they will just keep mining and set their transaction inclusion policy to stay profitable.

Funnily enough, I remember well when I had to argue in the boom-days about why the hashrate will not go through the roof causing environmental disaster in the long run only because Bitcoin is deflationary :)

I think it's possible that a fixed block reward scheme will work better than Bitcoin ... we'll have to wait and see.
I don't like any demurrage proposals that simply tax Bitcoins that haven't moved in a while ... those are useless IMO.

At the current stage, it's very easy to explain to newbies that "If you buy 1000 Bitcoins for $5000, and the world happens to switch to Bitcoin in thirty years, then you'll own 1000/21,000,000 of the world". If the block reward didn't halve every four years, the explanation why investing his time and money into BTC now is worthless, would be a bit more difficult. Not impossible ... because there are still incentives even with an ever constant block reward ... but less straightforward.

The thing about changing the block reward halving scheme is that nobody knows whether that is the correct solution to the incentive problem. This is a parameter in the Bitcoin protocol that is hard to optimize before we have a good few years of market data, and pass at least a couple of block reward reductions ... so we might as well go with the current parameter (50% block reward every 4 years) until conclusive evidence shows some tweaks in this scheme are required.

Merged-mined chains are out-of-band to some extent, though admittedly not totally out of band. The fact that merged mining is not totally unrelated to and independent of bitcoin (at least not yet, though RUCoin seems to have tried to separate I suspect it was simply being too lazy to put the full merged mining code in that led them there not a policy of trying to be the primary chain deliberately) might be a good thing.

We are projecting into some nebulous future, but a future in which bitcoins matter, so there are many possibilities. It seems a waste of hashing power NOT to merged-mine as many chains as you can come up with some clever plan for. Make your own blockchain currency kits could be marketed, encouraging youths everywhere to set one up for their local Junior Chamber of Commerce and use it in school to teach economics and mathematics and psychology and gosh knows what else while also being able to use it instead of "gold star on your report card" and so on - motivational stuff.

Miners could also start refusing to accept transactions of less than a bitNicKeL into the main blockchain, insisting that such puny amounts instead use the bitNicKels blockchain. There would be leverage here if hitherto bitNicKeLs had not had enough hashing securing them to be able to withstand a 51% attack by the miners who hitherto had not seen fit to add bitNicKeLs into their merged chains mix. Anticipation of each huge pool adding it to their mix might even cause the fiat value of bitNicKeLs to rise, but if bitNicKeLs might possibly be see-able as being a twenty per bitcoin kind of coin instead of being merely a coin valued about the same as an actually made of nickel old time nickel of the fiat world, then heck, do the math, if a bitcoin is twenty bitNicKeLs and bitNicKeLs are going up in value, shouldn't bitcoins also be going up in value? If a bunch of large heavily-invested corporations such as major pools and major exchanges indicate they certainly do not plan to buy any bitNicKeLs for any more than 1/20 of a bitcoin each, well, who are you going to believe? The naysayers who are determined to prove the megacorps cannot "fix" or "peg" the price of bitNicKeLs by pushing their price up above that "cap"?

Etc... Its a Drama. Tune in next BTC block-reward-drop for the next exciting episode...

-MarkM-

EDIT: oops, I forgot to even mention things like hey we are megapools lets incorporate and each have a blockchain for our shares so people can trade them too...

EDIT 2: GRouPcoin and DeVCoin both have fixed block-rewards. Any others?

Demurrage fees aren't more tax than transaction fees. You're renting for the liquidity the network provides you.


I don't think bitcoin needs to be a winner lottery ticket nor a good long term investment to succeed.
Deflation by growth (if it's big enough) could maintain your purchasing power even with demurrage. Anyway, I want it as a medium of exchange rather than a store of value. Competent banks and a healthy financial market are supposed to be the answer for savers. Maybe p2p credit systems (http://www.youtube.com/watch?v=ClNCOSS4nGs&t=12m46s) like ripple in the future.


Devcoin doesn't seem to have perpetual reward:
http://www.devtome.org/wiki/index.php?title=Devcoin#Generation_Rate

Groupcoin does
https://bitcointalk.org/index.php?topic=24813.msg310656#msg310656

But I want to clarify that if you want to have a constant proportional reward this doesn't serve. 50 coins will become less and less meaningful with time.
You either have a constant reward and demurrage (fixed supply) or an exponentially growing supply AND REWARD.
To keep inflation constant you need to add more units each year.
To have a proportionally constant reward is either freicoin or expocoin.

https://github.com/knotwork/old-devcoind/blob/master/src/main.cpp Lines 649 through 658:

You presumably are pointing at static const int64 MAX_MONEY = 21000000000 * COIN;

However the code at no point ever adds up all the transactions of all the blocks. MAX_MONEY is merely the largest single amount it allows in individual calculations such as total of inputs of a transaction or total of outputs of a transaction or something like that.

-MarkM-

Thank you for the clarification.
As said for groupcoin, in proportion with the total monetary supply the block value gets relatively smaller with time.

Proportional to the total ever minted doesn't sound right either; proportional to number actively circulating sounds more apropos maybe. Maybe plus dark pools, but maybe activity can help guess which are lost and which are merely dark pools that have not made any moves in the last few generations or years or centuries or whatever.

-MarkM-

EDIT: Remember, I am pointing at aux chains, increased reward can arise by increased number of high difficulty chains. Whereas you seem to be imagining your proposed chain is the be all and end all, hogging all the hashing power to itself, refusing to share the bountiful potential of merged mining...

Bitcoiners sound much like all the prervious entrenched monopolists sometimes. Oh gosh we cannot allow hashing power to be spread out, we have to let it go to waste to maintain our monopoly...

I thought breaking monetary monopolies was supposed to be a good thing, that bitcoin is here to help accomplish...

FYI, I added these two entries to the wiki, you're all invited to edit:

https://en.bitcoin.it/wiki/Tragedy_of_the_Commons (https://en.bitcoin.it/wiki/Tragedy_of_the_Commons)
https://en.bitcoin.it/wiki/Proof_of_Stake (https://en.bitcoin.it/wiki/Proof_of_Stake)

If the price of a bitcoin increases, so does the incentive to attack the network (political parties and banks see it as more of a threat, more potential profit from double-spending and short-selling), hence the resources attackers are expected to muster, hence the hashrate required to secure the network. Because of this, BTC/block is a good measure for the level of security.

Exactly. And it works the other way around: "If the price of a bitcoin decreases, so does the incentive to attack the network."

Therefore, Bitcoin will never fail due to a "disturbingly low difficulty."

"Disturbingly low difficulty" would be a consecuence - not a cause - of an eventual Bitcoin failure.

Exactly, that's my point. You can't argue "the current level of security requires spending $10M / year, and that's a small price to pay for a global financial system". By the time Bitcoin is a ubiquitous global financial system, securing it will cost $1T / year, and nobody will cough that up without personal incentives. Which is precisely the "tragedy of the commons" problem we've been talking about.

It is worth pointing out that the disturbingly low difficulty is just the competitive equilibrium. The monopolistic equilibrium seems much more likely to occur. One agent will take control of 51% of hashing power, prohibit other miners from operating, raise txn fees to a renumerative level, and make sure that the currency operates as normal (e.g. no double-spends and no denial of service). He will earn a lot of money and provide a more secure payments service, benefiting users. This equilibrium seems much more plausible than frequent, isolated double-spend attacks coming from different people. Tragedy of the commons should quickly degenerate into a hostile takeover under a benevolent monopolist who will have a strong motivation to improve the security situation.


Note: Despite this, I still recognize a danger that the monopolist will have some competing outside interest (e.g. he also owns paypal). In this case, he might behave maliciously (double-spending alone is not a plausible reason, shorting isn't likely to be one either [the market won't be deep enough]). Proof-of-stake is the best mechanism for guarding against this possibility.

cunicula, I haven't seen people share in your strong belief in this scenario.

I think that there are so many ideological and practical reasons to oppose a monopoly (even a "benevolent monopoly"), that it's practically obvious to a lot of people that such a monopoly would mean the death of Bitcoin. If this were indeed the case, then forming a (public) monopoly is not profitable endevour, because if one is successful in creating the monopoly, then the value of Bitcoin will plummet.

By these arguments, miners do not have an incentive to form a monopoly, and so the scenario we'll actually end up with is indeed competitive mining. I assume that some solution to the Tragedy of the Commons issue is indeed adopted, be it Proof of Stake or Dominant Assurance Contracts.

Yes, I agree that forum members are vehemently opposed to a mining monopoly.  I think this is an irrational view which is related to the political leanings of the  current user base. I expect this view to change over time as the user base diversifies. I don't understand how bitcoin could become successful AND not attract a monopolist. There is nothing in the technology to exclude a monopolist from taking over, proof-of-stake helps but it doesn't change this. Monopoly is potentially quite profitable. People may not like this, but their feelings don't affect the situation. Bitcoin use must eventually be supported by utility as a payments system. I don't think users will abandon a useful payments system because a monopolist is verifying their txns rather than a network of competitive miners. Once demand for money transfer becomes the primary reason for use of the technology, people won't care who is verifying the txns as long as they are cheap, quick, and cash-like.  

Can you explain how a monopolized Bitcoin is better than a central currency issuer? The entire point of Bitcoin is decentralization, if we don't have that, what do we have left? And why do we need the whole proof of work/stake thing, instead of the monopolist just synchronizing transactions in its internal database?

You could take pretty much any argument in favor of Bitcoin and use it against a monopoly. What if it charges exorbitant fees of $0.3 + 3%? What if its servers are down and nobody can process transactions? What if it is attacked by some government agency? What if it goes bankrupt due to bad management? What if it starts posing restrictions on how one can use their bitcoins?

While not directly related to how high or low (I think the difficulty will be low).
I have posted a separate thread on why having a low "base load" hashing power isn't a bad thing... Rarther a good thing:

https://bitcointalk.org/index.php?topic=68218.0

Hope my above thread shows why "difficulty" isn't the be-end-all on bitcoin security.

I agree that competitive mining has some advantages. However, in other respects monopoly looks superior.  Just as importantly, mining looks like a natural monopoly. If monopolized mining is highly profitable, then bitcoin will likely become a monopoly. The system should be prepared to accommodate a monopolist. Proof-of-stake is a good way of ensuring that the monopolist will behave himself.

Transparent, psuedonymous, and irreversible txns. It is not clear how this can be maintained without an alternate currency system such as bitcoin. A company which owns the majority of bitcoins and maintains a centralized txn database is more trustworthy than a company which just maintains a centralized txn database.

The monopolist will have lower marginal costs because most of its hashing capacity could remain idle. Fees could go up or down. I think they would go down because the marginal cost savings are potentially extremely large, but it is an empirical question. Remember that implicit fees are currently outrageously high. Low fees should not to be a talking point when so much new money is being issued.

I think they would have strong incentives to keep their servers up. If they went down for a prolonged period, then private miners could take over. The monopolist would have strong incentives to recognize their txns.


Proof-of-work is just as easy to attack under centralization as it is under decentralization. If the monopolist is unable to maintain dominant hashing power, then  competitive miners or another monopolist could take over. If the gov't decides to maintain dominant hashing power, then competitive miners would be fucked anyway. Same goes for proof-of-stake, if a private actor can silently acquire a majority stake, then a gov't could do so easily.

If it ceases hashing, then competitive miners or another monopolist will take over. The blockchain will remain transparent and there will be a market for control over it.

If it does this voluntarily, it will lose a principal niche market for drugs, money laundering, etc. I don't think it would want to do this. If the government forced the monopolist to do this, then either a) another monopolist will take over who can operate more profitably in a jurisdiction without these constraints, or b) the gov't would act the same way against a p2p chain. In any case, it is not plausible for bitcoin to grow tremendously and simultaneously remain unregulated.

All this talk of a monopoly. Do you happen to work for Microsft, Adobe, the US Government, etc?

Natural monopolies are not monopolies, but temporarily dominant economic players. 

missed one :p

QFT

Wait a second.  You think that the monopoly miner will be able to leave most of their hashing power offline, as a fleet-in-being?  Won't that just make the scaling effects worse?

Are you describing the increasing-returns to scale as the scaling problem? If so, then yes it makes the scaling problem worse.

If the monopolist has say 55%, then he can reverse blocks made by other miners. Since other miners know that the monopolist plans to fire up his 55% if they try to mine, private miners have no incentive to keep mining. Therefore, private miners will take all there rigs offline. The monopolist doesn't need to keep his rigs running, he just needs to be able to credibly threaten to start them and recapture all privately mined blocks. Therefore, the monopolist can get away with powering just  2% of the networks hashing capacity and keeping the other 53% in reserve in case he faces an attempt at a competition. Like private miners, he will have a lot of capital costs (though less than they do), but he will have minimal electricity cost. This is likely a source of tremendous cost savings (and lower txn fees) under monopoly.

As a monopolist, it will make sense to pick the highest MH/$ solution for the vast majority of rigs. MH/J won't be important to him.

Proof-of-stake doesn't suffer from this additional scaling issue because everything is loaded into capital costs and electricity costs are unimportant.

I believe it is just the risk. Most people think bitcoin is a joke. No one is willing to plunk down 10 million dollars on hardware to hash joke currency. I personally would need 100 million in net worth or more to consider pursuing this individually. You could potentially lose much of the investment if monopolizing the currency causes the bubble to pop. There is a lot of legal risk too. If bitcoin is a proven technology and its valuation is supported by actual use as opposed to an expected possibility of future use, then it will look less like a joke, less risky, and more legal. Moreover, valuation will be based on fundamentals rather than emotional issues such as whether there is just one miner or a multitude of miners. In this case, people or a corporation will be willing to plunk down the money.

Plunk it down on what, exactly? CPUs? GPUs? FPGAs? ASICs?

Or will they cover the bases, so that moving our own wealth out of bitcoins into oh lets pick litecoins out of our asses to start with and see if someone is a criminal deliberately attempting to disrupt other people's networking and data recording - a computing or data crime of some sort maybe in some jurisdictions - or an honest investor honestly interested in helping us achieve the objectives of our many and various branches of the cryptocurrency movement by supporting and enhancing the value and security of everyon'es cryptocurrency holdings won't help us elude their grasping grasp?

-MarkM-

Citibank. Just kidding, but some of my classmates went to work for them.

No, I'm talking about the increasing-overhead to scale problem.  Or, at least the apparent overhead.

The bigger your mining operation is, the harder it is to ignore your overhead.  A couple hundred megahashes per second requires no infrastructure, since it is just a video card or two that you already own, and a small fraction of your monthly power and network bills.  A couple of terahashes per second is going to need its own building(s) with dedicated generators and multiple internet connections.

No I'm just curious about how some of the calculations people hav made here would apply to freicoin. Mainly because there's some people who think 5% annual demurrage is too much for giving it all to miners (http://www.freicoin.org/demurrage-should-it-all-go-to-miners-t20.html).
I think is probably too little, but I don't really have a method to calculate the security requirements.

I wanted to post there something like "According to XXXX from the bitcoin forum, 3 (or 4, or 5, I don't know) freicoin chains at 5% demurrrage (or one at 15%, 20%, etc) would be necessary for maintaining the needed security (without initial subsidy, tx fees nor merged mining with other chains)".

Seriously, guys, what's your method for estimating security requirements?


Completely agree.
Bitcoin doesn't need to be protected from altchains. Let the free market work!
Let merged mining save us all (including bitcoin) resources!

To sustain a similar level of security to that currently enjoyed by bitcoin, you would need 30.6% demurrage per annum. Similarly, bitcoin would need to generate txn tax revenue equivalent to 30.6% of demurrage per annum. Fee rates like these are incompatible with successful competition with existing technologies such as paypal. Good luck. You might consider some proof-of-stake system incorporating modest demurrage, since then you could avoid high fees.  I have no strong objection to demurrage.  In fact, since holding vast amounts of wealth in the coin creates an externality (it imposes increased security risks on other users), there is a strong theoretical argument for some modest level of demurrage in a proof-of-work or partial proof-of-work system.

I just dislike the idea of currencies that are not likely to be competitive with existing technologies except for niche uses.

Future difficulty equilibrium will be found based on three variables (among others):
1/number of miners (ie units of hashing power) mining for bitcoin transactions fees
2/number of miners mining for value-add transaction fees that one can charge to a merchant by providing value-added services (like escrow, third-party signatures, exchange rate hedging, etc.)
3/ number of miners mining for other reasons (e.g politically motivated or holding big stash of coins)

Today it's fair to say that virtually all miners fall in categories 1 or 3.
I believe in a not so distant future, category 2 will grow as well and should be factored in whatever model is put together to project the difficulty equilibrium (I assume there is one non-zero equilibrium)


I havent seen the model yet and have no time now to work on that but I would appreciate inputs from modelling experts.