Bitcoin Forum

This might be better off in a different section, but I'm sure that it's going to go all over the place.

Recently, there has been much discussion in many different threads about how the transaction fees as they exist are a "tragedy of the commons".  Even though they are not such a type of resource commons, those threads seem to have awakened a real future concern about whether or not transaction fees will be enough of a reward for miners once the block reward drops to trivial levels.  The part that really got me wondering is about the lack of "demurrage" in Bitcoin's algorithum.  Many will immediately attack me here as advocating for inflation, but let me say first off that I am not advocating for any change that would actually make Bitcoin inflationary.  However, for those who do not know what demurrage is, it is the intentional introduction of fees into an artificial monetary exchange system intended to replicate the 'storage costs' that a commodity money would have.  For example, when physical gold was the primary medium of exchange between nation-states and silver the primary medium of exchange between private entities; both commodities imposed relatively high transaction fees in the form of transportation costs.  This kind of fee structure Bitcoin replicates well with it's transaction fee schedule.  However commodity money also imposed storage fees upon the long term holder of these mediums of exchange, usually in the form of the costs of building a vault or renting a safety deposit box inside the much larger vault of a bank or other highly secure institution.  It's these storage fees that demurrage is intended to replicate, and for which Bitcoin does not have a corrolary.  I don't know if it could even be done, and still keep everything else straight, but I want to ask for ideas about how demurrage could be introduced into Bitcoin under the following ideal conditions...

1)  Miners should receive the demurrage fees relative to their hashing contributions, as transaction fees and the block reward are now.

2)  Only transactions older than, say 6 months, should be affected by demurrage fees

3)  Demurrage fees should be very small, but should be assessed with each block, or perhaps with each retarget block.

4)  Demurrage fees should favor transactions with large collective amounts, probably the best way to do this is to asses the demurrage fee by each elderly transaction and not by how much it contains.  (a safety deposit box costs the renter the same if there is 100 ounces of gold in it or just one)


The astute observer will immediately notice that this will not likely result in actual demurage fees, but instead in savers periodicly moving their funds to keep them fresh.  This is part of the point, as if it's economicly better for the savers to freshen their funds and potentially pay a transaction fee instead, they still contribute to the security of the blockchain with the side benefit that their old transctions can be pruned from the blockchain once that becomes possible as well as encourage the condensation of many small transaction balances into fewer and smaller transactions.

I'm sure that an exception can be added to the demurrage fee system for the genesis block, so that Satoshi can keep his legacy intact for this heirs.

Any thoughts on how this could be accomplished, or why it shouldn't?  I'm open to being proven wrong about this concern.

Fuck that. Somehow you realize it's shitty to do to him, but not the rest of us?

I don't think that it's "shitty", just that the genesis block is unique. 

whatever, all my coins are unique and i'm not running anything that takes them for being old.

This is just a tax on savings. The average early adopter is going to be strongly against this as well they should be). You are suggesting that we impose an artificial storage cost in order to make bitcoins more like a physical commodity as if that were a worthwhile goal. We don't want "digital gold"--we want a good medium of exchange. Why on earth would holders of BTC want to pay to store them when they cost (virtually) nothing to store?

Okay, sorry for the hostility.

There is a sense in which is already baked in. Miners can 'charge' whatever they want based on whatever they want. It isn't unreasonable that they could require higher payment for tx with dependencies that were way back in the archives, right? Is it actually a tiny bit costlier to look farther back?

Even if there isn't extra costs, miners can still charge for it if they think that is a good idea.

If bitcoins that have been held for a long time actually cost more to spend, then there's no need to create an artificial storage cost. Miners can simply charge higher transaction fees for older coins.

That's what I meant.

Long term storage of capital is not free for the network, even though it might seem that way.  The network does suffer an uncompensated cost.  Namely, the ongoing replication of those deep transactions as new clients bootstrap and the ongoing disk storage costs, however small those might be individually, multiplied by the number of nodes.  What I'm suggesting is an incentive for capital accumulators to consolidate their holdings into fewer/newer transactions, allowing the network to 'compact' the blockchain.  Currently there is no incentive for early adopters, or anyone else with any substantial holdings, to spend their oldest transactions first.  This is the default action of the client, and this might be enough, but sooner or later someone is going to mod the client to allow users to spend newer coins first, because the deeper the transactions are the more secure they are.  There does need to be a cost for that kind of long term security, particularly if those holdings are spread across numerous transactions that cannot be pruned.  I do like the proposal of a miners' choice and rear-loading the fees.  It permits the well heeled bitcoiner to contribute to the security of the blockchain in a less direct manner, for the only miner that is likely to accept his old transaction without the demurrage fee is one that he owns or is otherwise closely associated with anyway.  If he is owner of a bitcoin bank, his old transactions can be spend or freshened without fee only if his own bank is doing the processing; implying that his financial actions directly benefit the security of the blockchain because that would have to be true for his transaction to be accepted for free in any reasonable period of time.

I have a proposal.  Using the rear-loaded, miners' choice model.  A minimum fee rule for any new transaction with inputs that are older than a year (in blocks) will have an alternative minimum fee based upon demurrage of one Satoshi ( .00000001 BTC) per retarget cycle (2016 blocks) for every input that exceeds one year since it's transaction was recorded.  This means that each input is charged for demurrage from it's inception, not the end of the first year, and the minimum fee for a new transaction with a single transaction exactly a year old would be at least .00000026 BTC.  This isn't much at all, but would still incentivise some savers to either freshen their savings once each year, consolidating their many transactions down to one while doing so, and potentially paying a transaction fee for the effort; or resolve to pay for the network storage costs upon release of funds.  This even gets demurrage upon off-network transactions wherein the private keys are traded instead, because no one saves money to never spend it, so sooner or later that has to happen.

This rule need not go into effect until the block reward is cut to 25 coins, giving the early adopters plenty of time to plan out their best course of action, most of whom will be consolidating numerous 50 BTC transactions into a single (bytewise small but BTC-wise large) transaction; permitting the network to prune even the block reward transactions from the old blocks, perhaps all the way down to the headers alone.

Also, this rule would be an alternative minimum fee, so if some other rule required a higher mimimum fee, those fees would not be additive.  It's just whichever minimum fee is highest that is required; or a miner willing to process your transaction for free.

Alright, I'm ready.  Tell me what you think, but please leave my mother out of it.

I heard your mother charges a minimum fee.

Isn't the minimum fee just a default setting too? Won't people mod around that just as easily as the oldest first rule? Or do you mean to make the default client consider blocks with tx that have less than the minimum fee invalid?

I mean put the rule into the default fee structure for inclusion into the fee paying section of the block.  Any transaction that pays less than the minimum is just a tip and still must wait to be included into the free section, if at all.  Not that a transaction that expects a minimum fee fails a validity check and fails to propagate.  Although that could be a form of enforcement of demurrage.

Yes, the minimum fees can be ignored by users, but it is not in the self interests of miners to accept transactions that should be paying a minimum fee based on published fee schedules agreed to by miners.  Some will always accept the transactions regardless, but they are a charity, contributing to blockchain security without expectation of compensation.

And your mother said you couldn't afford it.

This entire idea is based on the premise that the market can't price transaction fees "properly" for some reason. What is that reason?

The premise is that unless static holders pay something for the service they are receiving from the growing block chain, the resources allocated to maintaining the system will be less than the social optimum.  It's a good idea.

Miners are free to charge more to process older coins. Besides, that "premise" is actually an assertion, and a vague one at that. (Does "social optimum" have a concrete definition, or is it just a rhetorical device?)

You touch only one aspect of this "storage fee" problem: disk space cost.

But there is subtle and much more important problem completely absent in commodity money. The BTC value depends on the safety of Bitcoin transaction system which depends mostly on difficulty. There is no analogy in gold. It's just like the value of gold depended on how well guarded are other's people gold.

A hoarder that nicely keeps all his coins in one place and costs the whole network just a few hundred bytes benefits from large difficulty. But pays nothing to keep this difficulty high enough. Without any mechanism for paying for this protection, the difficulty will be set on a level that is too low to protect this collective wealth.  And since nobody has any motivation to voluntarily pay for this protection (because you cannot pay for protection of just your money, you can only pay for protection of everyone's money) the Nash equilibrium will be such that nobody pays and everybody expect everybody else to pay. And one cannot expect that a few billion worth of BTC (let's be optimistic) will be properly guarded by a difficulty level corresponding to a few million dollar compute system.

Yes, that was part of the suggestion.

Yes, that's what "premise" means.


Yes, it does.  It is the allocation of resources where the sum is of individual returns is maximized.  Tragedy of the commons is well known (simple) example where the equilibrium is a not a social optimum.

In this particular case, imagine that all transactions are priced equally, but the volume of current transactions slows for whatever reason (say BTC2 replaces BTC in active usage).  Holders of BTC would like to see mining continue so the chain can stay ahead of attackers, and they would pay miners to do it, but there needs to be some mechanism by which they collectively compensate miners, otherwise it won't happen.  

It means no externalities.  You're not depending on me to do anything for you, and vice-versa.  Raulo hit the bigger issue, though, which is that your storage of Bitcoins depends upon constant energy usage by the network, which isn't free and which isn't covered by transaction fees.

But it should be easy for miners to impose a higher fee on older coins, right?

It would be interesting to come up with the scale of device needed just to store one person's wealth and process that person's transactions throughout her lifetime.  Saying that something like a 10w solar panel, rechargeable battery and $20 FPGA could replace your banker would be an interesting talking point.

Won't your proposal have the same effect as a small inflation?

Most of you probably know that I'm an advocate of demurrage for different reasons, but the point that the security of the network can rely on it because of this tragedy of the commons in storage is new to me and an interesting concept.
I've been learning a lot about austrian economics lately because I realize that I lack some knowledge that most people have in this forum, and that my discussions here would be much productive for everyone.
I just saw a video that explains very well the austrian fears of reducing interest:

http://www.youtube.com/watch?v=jFqtTj7TeO0

What I claim is that a small demurrage will increase investment without decreasing saving.
Demurrage would move the interest curve down (but just vertically). Of course, if the demurrage is too high, money would not only not suitable for hoarding but also for lending, because no borrower would demand that money.
When reducing interest by printing, the central bank is competing in the credit market against the real savers, but these new savings are stolen from every owner/lender through inflation. Inflation discourages lending and the interest rates (of the real savers) go up. If they can't compete with the central bank, they will get out of the credit market.
On the other hand, demurrage is a fee on hoarding, so spending and lending are promoted while giving the borrower an advantage to negotiate the interest.

-How users benefit from demurrage?
Through a more secure network and lower transaction fees.
-Is demurrage a fee on saving?
No. It is a fee on hoarding. You can save by lending, investing or just storing goods for your future consumption.
-Is demurrage inflationary?
Yes and no. With the same monetary base, prices would be higher with demurrage than without it because velocity is greater. But with a fixed monetary base prices would drop with growth too. Also, as interest rates are lower, the cost of production would be reduced.
-Who would want to use money with demurrage more?
Entrepenuers that borrow to invest, because they would benefit from the lower interest rates without paying much demurrage fees, because they would spend the money from the loan quickly.
-Why merchants would accept money with demurrage?
Because they have potential clients with that kind of money willing to pay with it.
-Wouldn't they prefer to be paid in a similar currency without demurrage?
Of course. They would also prefer to be paid the double of the offered price instead of just the price they ask for the good. The prices for the demurrage currency would be just higher, but they would accept it.

Note that my proposal for demurrage is different than the one of creighto.
He proposes that the current miner charges the demurrage fee at the moment of the transaction and only in certain situations.
I propose the demurrage fee to be charged every block to every account and the total demurrrage paid to be added to the reward.
This distributes the payment to the miners for their collective storage service in a more uniform and predictable fashion. The block reward is kept while having a stable monetary base (after the demurrage fees equal the reward). The monetary base would in fact be more stable that without demurrage because the lost wallets would eventually evaporate through it.

At the cost of increased risk.

Which eventually negates any perceived gains that can be attributed to demurrage.

And which in the end only serves to transfer wealth from everyone, to risk takers.

Does any of this sound familiar?

I don't get why. Can you explain it?

I assume is increased risk for the lender. As I see it, the risk premium is still there in the interest. The demurrage would be subtracted from the basic interest (liquidity premium) first. The lenders would still charge for the risks taken.
The demurrage fee is paid for liquidity, not for not taking risk. If the demurrage rate equals the liquidity premium, the (ideal) totally safe investments would have zero interests, but the saver could still avoid risks. What he cannot do anymore is profit without taking risk, but you don't need profit to save. You just need to postpone consumption.
If you save with a demurrage currency you gradually lose value, just like Robinson's fishes rot. It's not a stupid thing for him to lend them without interest. He has to value the risk of not being paid back too.


I think the transfer is from "everyone" to miners. They get directly the same amount that is charged to holders.

Loans aren't always paid back.  Forcing someone to make a loan alters the interest rate and the risk premium, you say so yourself.


Why is profiting without risk a bad thing?

If we each start off with an ounce of silver, and you eat yours on the theory that it will protect you from disease, while I put mine in a sock drawer, why should I be punished for profiting by not taking risk?


Yes, but miners perform the integral function of preserving the integrity of the block chain, and (according to the proposal of market-based fees at least) if they don't, no one will be willing to transfer wealth to them.

Instead what you're proposing is that we force everyone to transfer wealth to investors who might as well spend it on hookers and blow for all you know.

Loans aren't forced. One can store goods for future consumption, buy IOUs to his providers, invest the money in their own business. Demurrage, if lower than or equal to liquidity premium (if you allow me to use that term) won't affect the risk premium.

Purchasing any asset has risk. If the price of silver goes up, you're profiting from arbitrage, but the demand for silver could drop and make you lose money, so that's a risk.


There's no transfer to investors. Their financial costs would drop, but as competitors force them to reduce profit, the prices of their products will drop accordingly. Miners would perform the same function but they would rely less on transaction fees because of their demurrage fee inputs.
Borrowers can always spend their money on hookers, even with high interest rates.

Okay so I somehow glossed over this.  You want a uniform demurrage that's based on, what exactly?  Per account?  Balance?  I don't really see any justification for either...


Then how do you calculate the liquidity premium and build that into your centrally-managed system?

Regardless, doing so would just create an arbitrary magic number that is actually worse than centrally-managed interest rates.  It would bear no connection whatsoever to the real economy, let alone the problem at hand which is the ongoing cost of storage and block processing proportional to threats against the network.

I don't see what the problem is with a market-based approach.


Doesn't holding Bitcoins qualify as risk?


Or they will collude, make riskier investments and simply lose more often.  But since I now understand you technically want to subsidize miners rather than investors, this argument is somewhat moot.  None of your assertions about reduced cost of borrowing would pan out, since all the demurrage fees would be spent by miners competing for new blocks.  You'd just be subsidizing mining hardware.

I don't get what all the excitement is about. A coin that is held on for a long time is a coin that is not part of the market. As such, it increases the value of all the coins that are effectively in circulation. The logic behind hoarding is that the coins keep on valuating so they should be held on for as long as possible. And that on its own helps valuate the each other BTC in circulation even more. So stop panicking already.

Also that demurage idea is worthless. You impose that on me and ima make myself some nice and tidy stacks of 100 BTC per private key and just trade the keys directly while I fill in the smaller amounts with coins from a spending account which are freshly traded...

As you say, the problem would be that magic number for the demurrrage rate. I don't know what would be enough to "subsidize miners". I think that it shouldn't go above the liquidity premium, which I doubt is even possible to calculate accurately. You'd need a perfect risk calculating machine to then subtract the premium risk from the interest. Also a perfect index for "general prices". It would be definitely easier to calculate the minimum "needed" reward for the miners, but that would have to be done somehow for the market based proposal too.

Instead of subsidizing miners, I would say you're getting them paid for a service they're providing collectively.

One problem I see with the market-based approach is that the fees are paid depending on time, but are received by miners as transaction fees, with blocks giving more fees than others in terms of demurrage. It would be distributed less uniformly between blocks.

Yes. With competing currencies, holding one of them has a risk. I lately tend to think about money as if it were only one currency with a stable monetary base. My fault.

Although demurrage fees go to the miners, they benefit borrowers (and consumers indirectly) because the advantage for the lender of money being time resistant disappears from negotiations.
I don't think that many of you would agree with me in that demurrage would have desirable effects beyond improving the security of the network by warrantying a minimum reward for miners. But I would be happy if at least you don't see any undesirable effects neither.

A coin held reduces the velocity of money. Hence less fees for the miners (any increased BTC valuation does not help because due to competition with mainstream banking, the fees has to be competitive with mainstream banking and cannot go up in dollar terms). Therefore, less difficulty, with less difficulty Bitcoin network is more prone to attack, less stable and less valuable.

No hoarder has any individual incentive to pay the fees and therefore, the fees will indeed be small, difficulty low, BTC valuation low, and everybody loses. This is known as tragedy of the commons.

If Bitcoin remains a simple store of value, speculation over it's exchange rate will maintain a decent level of transactions. At the same time, anyone who needs to realize his profit will have to exit out of BTC. Same goes for hoarders. Unless you support the deflationary spiral baloney where hoarders just hold onto their coins forever.

If Bitcoin has a vendor base, then this problem is moot. What do you think vendors will rather support? 1% fee taken off of their profit to sell in Bitcoin, or the 4-7% credit card companies charge to use mainstream banking? Don't you think vendors would be naturally attracted to Bitcoin since the low fee and reduced intermediaries allows them to beat their concurrence?

BTC is a far superior currency than the mainstream fiat is, so it deserves a higher tx fee. But let's assume the fee has to remain in line with fiat txs, then we still have a huge margin in front of us, since it seems you are grossly underestimating the transaction fees and delays imposed by that system.

Lastly, the market will simply adjust one way or another. Include demurage and miners will lower their fees, while hoarders will counter it with private key trading.

This doesn't work because:

a) it requires the recipient to trust you not to double spend, and

b) the future transaction fee on those 100 BTC will devalue the private key you are trading.  Even with trust, no one would accept an "old" BTC key that's going to pay a transaction fee to circulate at face value (unless they wanted to pay a premium to keep the transaction completely hidden from the world -- that's a different issue).

Feel free to do so.  If you can trade keys off network you are not a burden to the network, and someone is going to pay the demurrage fee eventually for them and you.

That's the issue in a nutshell.  I don't really believe that it's a near term problem, as this probably can't even become an issue until the block reward is pretty tiny.  We are talking about 40 years at least.  Still, by that time the system will be too entrenched to introduce any demurrage.  I'm trying to predict a possible issue, long range.

No.  Inflation is really the limitless growth of the monetary base, and works like a tax upon the currency's user base.  This hits savers the hardest, and is not relative to their costs.  Demurrage does not devalue the currency overall, and I'm trying to compensate the miners/network for the unfunded costs of long term storage of capital accumulation.  It's not a high cost, really.  But there is a cost, and it would be ideal to have a mechanism that can approximate the costs of capital storage found for other sound money systems.

I think hitting every account for every block is a bit excessive.  Perhaps every account every retarget block instead.  Still, I think that there should be a delay of some kind.  Transaction fees already imply some period of storage.  At least a month, even credit cards give you 30 days "grace".

That said, if there were some way to asses this in an ongoing fashion, that would be preferable from an economic standpoint; I just don't think that is possible from a technical standpoint.

Hoarder: Someone who has done some work for the Bitcoin community and not asked anything in return.

a) No problem.

b) Still not a problem. If you can establish enough trust between traders to swap around private keys, you already have enough information to calculate the demurrage on the coin anyways. If I've got a 100 BTC coin with 2 BTC demurrage on it, then ima trade it as a 98 BTC face value coin, and as long as this coin is widely accepted, everyone in the process can skip the demurrage fee. I'm seeing talks of some long term cap on the maximum demurrage fee, once you got a coin that hit the cap, you certainly have no interest whatsoever in spending it through the block chain anymore if you can find someone that'll take the private key instead.


I don't think it's that simple. My understanding is that demurrage will naturally impact on fees. Miners can and will charge lower fees for "live" coins since they have some sort of "guaranteed" profit through old coins. This is shifting a larger amount of the network cost on long time holders, who by definition have a low motivation to trade their coins. I don't think it's a good idea to lower their trading incentive even more.

This system shouldn't have demurrage because your coins are safe in your wallet. They are exposed when you trade them. The analogy with gold stands in that it costs much less to hold on your gold in some safe place than to move it around. You want hoarders to participate to network fees, then have the fees scale based on tx size AND volume. I move more BTC around, I pay more.

Hitting every block with a small fee would be the same as hitting every retarget block with a proportionally higher fee. If you charge for each block the fee just have to be smaller for the storing cost to be the same.
The advantage of calculate the demurrage taking into account each block instead of every x blocks is that the storage costs are charged in a more grained (and more fair) fashion.    
The "grace period" it seems logical. Do you have to wait for six confirmation to be able to spend the newly received funds?
The problem would be again that the demurrage reward wouldn't be constant with each block.


In fact I think my proposal is easy to implement.
The demurrage fees would be payed (calculated removed from circulation) with each transaction.
The miners would receive the fees not directly from the payer but as "newly created" coins.
It doesn't matter that the holder hasn't pay the demurrage fee yet when a miner receives it, it will be payed with the next transaction so the monetary base remains effectively constant.
In the meantime, your client would discount the demurrage fees from your balance.  

The demurrage will increase their trading incentive, not only with fees for holding but through lower transaction fees.


This would discourage transactions the same way to every holder no matter how long they hold their money. This do not discourage to hold money but to trade with it.
This would charge traders instead of hoarders.


Yes.
Does the Bitcoin community have to wait indefinitely until he decides how he wants to be compensated?
He is locking part of the total liquidity of the trading system (money) in the meantime.   
Liquidity is a service provided by the trading system.
Why the hoarder have to enjoy that service for free?
Why the lender can charge for that service to borrowers (who probably would enjoy it for little time before he invest his loan) instead of being charged to the holders (who enjoy it) by the maintainers of the trading system (who provide it)?

No it won't. You'll simply sit on a coin with capped fee and swap the private keys around, enjoying lower fees on your everyday spending wallet. Overall this will reduce network security long term, because it forces people to design ways to altogether avoid the block chain.



What discourages transactions is trying to buy a cup of coffee for 20 cents with 1 cents fee when you could buy 100 of them for 20 BTC, with the same 1 cent fee.


Traders are the ones who use the system intensively, somehow they should pay less for a service they use the most?

Traders already pay transaction fees.


I realize English is not your native language, but lender/borrower/loan is not the correct terminology.  You would do better to substitute, eg. lender=saver, borrower=trader, loan=Bitcoins.

I'm not sure I get.
If you don't need the block chain, maybe you don't need bitcoin in the first place.


Maybe I should say that discourages trade instead of transactions. If you buy 100 cofees for 20 btc you're trading more than if you buy just one.
The point is that your proposal doesn't take time into account. If you buy one coffe with a 0.20 btc you just have recently acquired you will pay the same fees as another one that uses 0.20 btc that aquired a year ago.


As creighto points out, storing "older coins" is more expensive for the network than storing "newer coins". Why only traders have so pay for storing everybody's account?
Since transaction fees will still exist, traders will still pay more than other users for the service the use the most, only they will pay lower fees because they don't have to cover the cost of "storing".

No, English is not my native language, so I appreciate any correction in my use of it.
But, but as far as I know...
savers = hoarders + people who store goods for future consumption + investors who don't borrow money + lenders
You don't need to borrow money to be a trader.

Then I'm a little confused as to what this discussion has to do with lending/borrowing.  Can you explain that?

The Demurrage rate would be substracted from the interest rates, thus leading to cheaper loans for borrowers.
That's an effect that most people in this forum consider undesirable. On the other hand, I consider that effect (provided that the demurrage rate is lower than the "liquidity premium" and therefore does not affect the risk premium) desirable.

It's going to be a problem much sooner than that. Would you buy gold now if you knew that it would likely turn into lead in 40 years?

Even if we somehow collectively solve this problem, there is another one. Contrary to what Satoshi wrote at the beginning, Bitcoin is a quite expensive system to maintain. At the current difficulty and BTC price, miners are paid 25-30 million USD a year (by block inflation) to protect 40-45 million USD Bitcoin market value. The current BTC price/difficulty may be abnormally high but the electricity alone costs a cool 1-1.5 million USD a year and equipment depreciation is 2-3 times of that and it will rise when BTC price/difficulty drops. And Bitcoin is barely safe to an attack because Bictoin need to maintain this capacity constantly and attackers can just use short bursts. I'm not sure that the mainstream banking costs for transaction system and money supply are so high percentwise for the same amount of money supply and trading that Bitcoin offers. The bailouts (which were indeed expensive) went for fixing the lending hole which Bitcoin is not doing.

Bitcoin will either be expensive or attack prone. Both outcomes are not good for the BTC value.

I don't really get why you think it is possible to artificially manipulate the risk-free interest rate without affecting the risk premium.  When a borrower has the option of default, there is no distinction between risk-free interest rate and risk premium -- they are inextricably linked.  And since Bitcoin isn't going to be building debtor's prisons or enforcing wealth redistribution, it would be irresponsible to build such assumptions into the system.

Okay, so you just want to tax savers which would indirectly benefit borrowers.  We get that.  But if the demurrage is close to the actual cost of securing the network, then the effect is nil.  So couching your argument in terms of borrowing and lending just seems out of place.


The lending hole was caused by inflation and fractional reserves subsidizing investors.  Bitcoin eliminates that.

This is not quite what I intended.  Older coins are not more expensive than newer coins.  Several dispersed transactions holding one person's funds is ore expensive than fewer transactions holding that same total.  It just tends to be more likely for older transactions because savers who have more bitcoin in total than is required for regular trade have a security incentive to spend the most recent matured coins before the older coins.  The default client behavior is to spend the oldest transactions first, but this can be changed; and thus it will if the incentive for savers to keep the bulk of their funds in many older transactions as compared to a few consolidated transactions.  I don't want the costs of storage to be very high, because I still want Bitcoin to favor capital accumulation.  It's just that there still needs to be some incentive for those early adopters to consolidate their holdings rather than keeping 400,000+ BTC in 8000+ transactions of 50 BTC apiece.

A max limit doesn't make any sense, however.  The fee needs to be roughly equivalent to the problem in order to encourage the desired behavior; which means that it needs to increase relative to the age of the transaction.

The block chain secures the network. But it doesn't HAVE to be used to trade, it's merely the main frame. If you enforce rules on the block chain that people regard as unfair, they will naturally stray away from it, using escrows or key swapping to trade instead, and that will reduce the traffic on the block chain, thus reducing miners' fee, and reducing the security overall. As it stands, use of the block chain is voluntary, so you can't go around pushing rules on it.


You miss the point. Right now whether I pay .20 BTC or 20 BTC, I'm paying the same fee. Fee is based on transaction size, not volume. What is charged is the amount of data that needs to be added to the block chain for the transaction to take place. That is of course logic. But if you feel you need to modulate fees based on another criteria than block chain load because the payout is too low, then I say let things settle naturally and watch miners charge fees based on volume too.

My point still stands, flat fees always hurt small trades. Once again that will push people towards escrows, who will offer cheaper transfers while not paying a cent to the miners.


I do not think time of entry is a legitimate cause for higher fees. You people are presenting hoarders as some sort of free loaders on the economy that only take and don't give anything in return... The network has grown to what it is thanks to long time holders. Not thanks to miners, not thanks to speculators, but thanks to long time investors alone, who took a chance and invested into Bitcoins. You are offering to chastise these people for the very action that bears the economy.



Maybe you should take a little more time in reading the people you refer to. Traders are the ones making the block chain heavier, certainly not hoarders.

Nevertheless, the whole idea that hoarders just sit on their money and NEVER participate in the economy is preposterous.

How is that an issue?

It's only so expensive now because the economy that it represents is so small, and the inflation rate is so high.  That ratio will change with the growth of the economy and the first block reward cut.

Traders are also already charged for this privilege.


I don't contest that, which is why I thought the idea (someone else's) to charge the demurrage rear-loaded upon eventual spending was brilliant.

While I don't particularly like the conclusion, I understand the argument.

Does it not come back down to the market?  If I understand it correctly, miners will eventually produce diverse rulesets for the trades they are willing to process and the fees they will be charging.

If it becomes an issue, the client can integrate a feature which allows choice between ruleset pools upon transaction.  Miners can switch between ruleset pools as they please.

Because as the network grows, the resources required to store those many old transactions grow at least as much.  New clients must download and verify each of those transactions for as long as they persist.  A single transaction with 400,000 BTC costs exactly the same amount to store as the same transaction with 50 BTC; but one person with holdings totaling 400,000 BTC spread across 8000 transactions imposes 8000 times as much burden of resources upon the network.  The idea is to encourage that person to consolidate his holdings into fewer transactions, without forcing him to do so, as he can still choose to leave them where they are if he is okay with 8000 times as much storage fees as is necessary.  It also has the effect of partially compensating the miners for the resources that those many transactions consume; not just 8000 times as much disk space, but 8000 times as much bandwidth for every new client that connects to that node to download the existing blockchain.  Currently, it still doesn't matter; because the miners are more than compensated for these things with the block reward and blockchain pruning is not yet implemented anyway.  I'm just thinking ahead.

That's fine, but it would still be ideal if everyone knew in advance what those rulesets are likely to include.  This means that it would be wise to include storage fees/demurrage sooner rather than later.  It needs to be part of the status quo before the economy grows so large as to solidify that status quo, which in practice means that it needs to be included into the standard clients and miners as a default condition.  Miners could then choose to opt out of charging that fee at their own will, just like they can opt out of limiting the size of the free transaction section of the block now.

The ability to select rulesets now would be nice, since it would allow us to choose between free pools and non-free pools with reasonable estimates of time-til-confirmation.

Unfortunately, it's easier said than done, so unless people are willing to pony up the Bitcoins now to incentivise and empower Gavin et al., I'm not sure it's going to happen soon.

That doesn't make much sense. They should charge less, precisely because including transactions with old coins help them pruning the chain.

Can someone define "hoarding" in a way that is incompatible with "saving"? In my opinion, the two are one in the same. Hoarding is just what one person calls another's saving "too much".

Doesn't a demurrage charge upon spending actually discourage the consolidation of multiple outputs into a single one?

I don't think "encouraging" investing is a good goal for a money. Doing is only an attempt at modifying people's preferences to bring about and end result that you prefer, as opposed to one they prefer.

Here you imply that someone could have "billions worth" of profit by exploiting the >50% vulnerability, but as I said multiple times, that is not that simple.

You can't steal all bitcoins by having control of the chain. All you can do is double-spend. And that's fraud. You'd be vulnerable to the same risks anyone has when committing fraud. If you try to fraud a billion worth contract of any kind, you'll probably sleep with the fishes. And the amount doesn't even need to be that high. The chances of making profit out of such kind of attack are extremely low.

And a non-profit oriented attacker couldn't steal billions worth of money either. It could temporarily pause the network until developers and miners find a way to get around him. The more money at stake, the stronger the incentive to get this scumbag government ostracized from the network.


There really should be a FAQ about the true risks of a >50% attack.

What I understand for liquidity premium is this: Interest rate = liquidity premium + risk premium + inflation premium
What I claim is that if demurrage rate < liquidity premium, then risk premium won't be affected by demurrage.
The liquidity premium emerges from the fact that historically monetary systems have defined money to be (nominally) time resistant. If money was made of carrots, for example, instead of gold, money would have a built in demurrage without enforcing it. If time resistance is a necessary quality of money or not is another discussion.
With risk-free loans, the lender still can (and therefore will) charge the liquidity premium and the interest won't be zero, preventing investments that economically viable (in terms of resources although not in terms of capital yield) from happening.
What prevents houses from being treated as consumer/producer goods? Liquidity premium.
If houses were consumer goods, the rent from the entire "life" of the house should just be enough to cover the cost of production (plus profit). If hoses are treated as capital, their price depends on the yield of the house (rent) compared to the yield of money (excluding the risk premium) or the liquidity premium. If a type of capital have a greater yield than money, more of that type of capital will be produced until the yield drops (by competition between the capital of the same type) and equals the yield of money. If a type of capital have a lower yield than money, no more capital of that type will be produced until its yield increases (by increasing demand) and surpasses the yield of money. Therefore the yield of money is the reference (and the limitation) for every capital accumulation. No new house will be built (even if there's demand and enough resources for it) if it won't be at least as profitable as money.
That's a feature built in and "enforced" in dollars, gold and bitcoins.
For Gesell, that liquidity premium built in "regular" money is the only "evil force in capitalism". Most pains come from regulations from the state.
I know I've repeated it many times, but you libertarians and austrians should give a chance to Gesell because his ideas are not incompatible with libertarianism. If they are, I think no Austrian economist have made a serious critique of them.
Please anyone let me know if you have read that.


If you think the effect of a demurrage close to the actual cost of securing the network is nil, then I don't need to convince you that demurrage won't have evil effects (at least not in this thread), but not everybody here think that way.

No, because demurrage would have to scale depending upon the number of existing transactions.  It's the avoidance of demurrage, with the inclusion of a 'grace' period, that encourages major savers to consolidate their holdings.

You say you want to prune the chain? How would you deal with lost coins then? Do you intent to simply replicate old transactions in newer blocks? Wouldn't that hinder the demurrage fee calculation? The light weight client will eventually see the day so I don't think the whole block chain download will remain a problem in the mid term. The only reason a person with 50 BTC imposes less on the network than someone with 400k BTC is the flat fee. Reflecting volume on the fee would help against that in a better fashion imo.

From my understanding, spread out long term holdings will still have a small impact compared to live, broken down transactions constantly creating new coins to pay for odds amounts. I agree that "traders" are already paying for that service, but so have hoarders. Technologically, the spot these people have "purchased" in the block chain doesn't require further maintenance. The idea of demurrage has been brought up as an alternative to lacking fees, but I think the very concept of "simulated maintenance fee " vs actual maintenance costs needs a thread on its own before we can really figure out where to go with demurrage.

At any rate, we can't establish now that fees won't be reward enough to maintain adequate security in a few decades from today. Miners already have control over transaction inclusion, I think it is wiser to first wait for a tangible hint of whether or not the market can maintain high security naturally before we talk of modding the source.

Considering the proposition of demurrage itself, I don't like it very much, for the following reasons:

• All it does it does is that it forces people to move money around, so that transaction fees are collected and the chain is pruned. If the transaction fees remain near a satoshi, that doesn't add much to miners. It would be better to make sure transaction fees won't go that low.
• It introduces a completely new and big feature/constraint to a system that doesn't necessarily need it. (transaction fees and maximum block size are already there)
• I can't see a way to make it automatically adjustable or "market-adaptive"... and hard-coded, arbitrary rules are not good.
  

I still prefer an adaptive maximum limit to the block size, that creates some artificial block space scarcity on peak hours of the day or peak days of the week/month/year. It is not a major new feature, and although the formula to be defined is arbitrary, there are no arbitrary constant values. And it may guarantee a minimum incentive to miners.

Concerning the whole chain size, I don't think that will be a major problem, compared to the bandwidth required.

And if it ever becomes annoying for some miners, they can try offering bounties to the owners of the oldest coins to move them to a new address. It can be done without the owner of the coins having to identify himself.

There is one major barrier though: some private keys are lost. These coins won't ever be moved again, and there isn't anyway to verify that the coins are really lost or someone is just lying about it. Considering that people probably lost private keys from the early days of bitcoin, when the coins were mostly worthless, I'd say there isn't much room for pruning the chain.

I don't know how to deal with lost coins, or even if it's possible.
Yes, it does.  That's my point.  It may not require much, but it does require some resources.
That's why I started this thread, to have that conversation.

Miners don't have as much control as you think.  There is a market that they have to respond to, so there needs to be published expectations.  This is not an unpredictable issue, it's a very definable economic issue.

This is how we can keep it from "going that low"

It necessarily needs it, in some form or fashion.  And the max block size is going to go away.  Too many people are opposed to the artificial scarcity that it imposes, and want to remove it and let it become a true free market.

An adaptive max block size is fine for it's own reasons, if a system can be agreed upon, and that really would have to be code enforced.  But that would not solve the problem.  There is little evidence that such compensation will be appropriate to overcome the 'free storage' problem, and much economic theory that suggests that over the long term free storage of old transactions will distort the market.

This whole thread is based upon a false premise: there is a global storage cost for old transactions.  This is untrue.

The miners only need to keep the root hash of every block to verify transactions.  However the owner of the old coins needs to keep an complete copy of the old block.

To spend the old coins. The owner announces both the transaction, and provides the old coin's block for upload.  The miners (who wish to) will see this transaction an 're-download' the old block. (and compare the root Merkle hashes)

The miner only need to keep the more recent blocks, old blocks can be downloaded when needed.  Only some of the miners will bother to download the old block, others will just focus on bitcoins in recent blocks.

This extra work of checking old blocks can adequately and naturally attract higher transaction fees. (but not demurrage, as there was no 'storage costs')

The whole concept of demurrage doesn't isn't economically logical.  Just like always issuing new coins always isn't economically logical.  The COST involved isn't to secure old coins - but to secure NEW TRANSACTIONS.  When all the Bitcoin's are mined, securing transactions moves to a user-pays model.  (as it should be, the user pays for the cost)

There is no cost in 'not using' Bitcoin.

The cost is requiring that the block chain continue to grow to stay ahead of attackers.  Otherwise eventually an attacker can reverse the entire chain, including the old transactions.

It's provably true that there is a cost to maintaining old transactions, however small that it is.


If this were universally true, where would the miners download the old blocks from?  The miners is where those blocks are most likely to be kept.

I see this as an unintended consequence of the network providing for free storage indefinitely, and I don't agree that it would be a workable solution, or even generally a positive consequence.


Once again, there is a provable degree of storage costs suffered by the network.  If you don't believe that is true, then just consider what you think would happen if transactions stopped.


Old transactions are indeed 'using' Bitcoin.  The only way to not be using bitcoin is to sell out all that you have so that someone else is using what you once had.  If you have a positive balance in bitcoin, you're using the system by defintion.

I've changed your proposal to this:

1) Miners would receive the demurrage fees relative to their hashing contributions, like the block reward is now.

2) Demurrage fees should be very small, but should be assessed with each block.

3) The block reward by demurrage would be proportional to the number of "out of date" (and not empty) addresses.
  
4) Only transactions older than, say 6 months, should be affected by demurrage fees.

5) The demurrage would be discounted from the payer's address when he makes a transaction (but it is effectively charged when the miner receives it).

This, by the way, also solves "the problem of the lost wallets" since lost wallets will eventually be completely spent on demurrage fees. Actually I didn't though it was a technical problem until now. I wasn't very concern with the economic impact of lost wallets neither.

Again, I think a demurrage fee that depends on the money quantity too and not only on time would be financially beneficial for the money users and won't punish all the savers. Just hoarders and lenders.
Lending would still be more interesting than storing while the liquidity premium were positive, or even zero because most goods aren't as time resistant as a safe loan.
More investing (another way of saving) would be more interesting than today in this "saving market" and in general.
Note that you can invest with borrowed money so investing is not always saving.    
But the reason why malinvestments are done before crises is because of an "unexpected" increase in the monetary supply (note that this had happened with gold being money too), not because need to charge the liquidity premium in order to lend wisely.
My proposal would remove the point 4 and change the 5:

5) The block reward by demurrage would be constant. To accomplish this, the reward would be equal to the demurrage percentage charged on each account but applied to the total targeted supply.

If you want a reasonable demurrage rate with this proposal you need to change either the 21 M or the 50 btc. I think the issuing curve would be different too, so it cannot be applied to bitcoin.
I think we should focus on the proposal for bitcoin and discuss the supposedly evil financial effects of demurrage and freicoin in another thread.

Another thing that creighto's proposal accomplish is preventing other applications from "burning bitcoins" to have storage forever (like a dns address in the destination field).
The applications that introduce information for free (or for fee) but without burning bitcoins could still be used with this proposal, but when a block dosn't contain active transactions it doesn't have to be stored and sent (right?). So the service bitcoin provides can be timestamping, but not storage if we apply demurrage.
You just need to burn bitcoins to get "everlasting storage" right now.

Unless you can define "hoarding" in a way that does not also include "saving", please stop using this bullshit term.

"Hoarding" is just shorter than "holding money". I still don't know what you don't like about my definition of hoarding: is a way to save. But it doesn't mean that I should always use save instead of hoard, because sometimes I mean save in a more general way, not necessarily hoarding, without specifying the way to save.

Ok, so we agree that hoarding and saving are exactly the same thing? Then why use the word hoarding, which has a distinctly negative connotation?

This is specifically the part of your post with which I take issue:


You imply that hoarders are a subset of savers, and that it is less detrimental to punish them compared to the savers. I don't understand this view at all.


I'm merely taking issue with your biased terminology, which seems to be at the core of your argument for the use of demurrage in the first place.

How do you propose to do this?  My understanding of the system doesn't allow for discounting of transactions (or accounts, if you prefer) without significant changes to the technical aspects.


This would likely introduce other perverse incentives than what I was trying to prevent, and I would have to oppose that on principle and on economic grounds.  Any demurrage system must scale relative to the real costs to the network scale, and that means per transaction and not per transaction value setting.


This is neither economicly sound, nor relevant to Bitcoin.  It's not remotely relevant to the problem I'm trying to avoid.


I don't even think that this is possible.


No.  Absolutely not.  I would much prefer to leave the potential problem unaddressed than proceed in this manner.

I'd like this demurrage on very stale coins, as in lost coins. If you don't move coins for 8 years, they start disappearing slowly.

It is totally reasonable for BTC holders to refresh once in 8 years. This gives a small fee to miners, and with what I learned about nodes not accepting blocks that split the block chain too far back... with little change to the protocol, we might not need many miners to keep things going.

I find the idea of having exactly 21M coins much nicer than the risk of "suddenly, surprise market crash caused by ancient million bitcoin deposit". Also, you can pretty much rely on coins getting lost somewhere, so this will always secure a minimum amount of mining.

Nice part: nobody complains, since everybody can prevent demurrage by just doing a single transfer to himself every 8 years. The client could remind people, too.

I think that it's totally reasonable for users to refresh once a year.

I'm still waiting for any of the developers to chime in and tell me how demurrage could be done, or if it's even possible, beyond the early idea of an alternate minimum fee upon eventual transfer.  I still can't grasp how lost coins could even  be 'rotted'.

Is there a single word that means "money holder"/hoarder without negative connotations (that I don't need) and other than "saver"?


With demurrage some savings would move from "money holding" to lending, storage of goods or direct investment
Some savings could also move from lending to direct investment. Before direct investment becomes "too risky", savers would prefer storing to lend.
Some of the investments are not done not because they're not economically feasible due to a lack of real resources, but because the saver can demand the liquidity premium or just hold their money at zero cost for them.
This forces all investments to be at least as profitable as the liquidity premium.
The risk premium is an "insurance" from the lender to the borrower, that's why it gets smaller with collateral.
If the capital was only the investments, nothing would prevent the yields of capital to tend to zero as the different investments compete between them for profits. But while the capital is investments plus money, there's an artificial (yes, money being time resistant is an agreement between the money users) low limit for the capital yields. When investments yields are below the liquidity premium (instead of when they're below zero), the capital price of the investments is recalculated and investment "stops" until the cost of production of the real capital at least match (through comparison with the yield of money on liquidity premium) the rent that can be earned in the market with that real capital.
While lenders and other capital owners take the extra profit from the liquidity premium, the more saving is made by holding instead of lending, the more investments won't be done to "compete with the rest of the capital for profits".
The money holders don't benefit from all this, nor they are the ones to blame for anything. We should not blame no one for this. It's just the result of the agreement of letting money be time resistant. The players just follow the rules of the game. But as we can create new moneys we can change those rules. If people find more interesting that money is not everlasting, they can agree with each other in trading with that money. Actually there's people doing it right now.
I think is not a semantic issue, but an economic one.
Since I'm pretty sure no one is going to agree on the financial gains of demurrage, I think we should move to another thread. For example this one:

http://forum.bitcoin.org/index.php?topic=6549.0

I would like to know any flaws on my reasoning, but I don't want to keep on discussing it here because it goes beyond the topic of the thread.

The creation of bitcoins to pay the miners would be as simple as the creation of the current reward and equal to:

flat_demurrage_fee * number of old transactions

All nodes would have to know that it is allowed to "create" bitcoins this way accept those blocks.

The later destruction of the already payed fees could be implemented through a third field (apart from payment and transaction fee) for registering the amount "destroyed" in the transaction. That field isn't even necessary since the content of that field can be calculated like this:

 ((previous_tx_block_num + expiration_time) - current_tx_block_num) * flat_demurrage_fee

All nodes would have to know that the "old" accounts contain less money than they say to reject transactions from accounts with not enough funds.
The lost wallets are just ignored like empty accounts when they've spent all they content in demurrage fees.


The "creation" is constant and not related to the number of old transactions

For the "destruction":

 (previous_tx_block_num - current_tx_block_num) * demurrage_rate * amount_in_account

I suppose that would work, if we were starting over or starting a new fork of code, but this problem doesn't justify a breaking change.

Ultimately you are paying for the security of the present transaction.

Even if a million BTC were to sleep in an account for a hundred years, it is only when they are spent that the security is important (and paid for).

If I keep 10 BTC for 10 years, but one day before I spend them the blockchain is tempered with (in a way as to render the network worthless), I don't see why I should have paid the miners all this time.

I repeat: the security is only useful when you use your BTC. I would even add that the current transaction need the transaction history to validate itself.
Everything in-between transactions is irrelevant. 

Please don't destroy a key characteristic of Bitcoin (and ANY money); for now it is durable - as durable as the network. Doing so would undermine the entire project.

This is not correct.  The cost is nothing more than what would need to be kept anyway even with culling. Please see: Merkle hash trees (https://secure.wikimedia.org/wikipedia/en/wiki/Hash_tree)


The person who owns the old coins needs to maintain a archive of the blocks that contain those coins... Again moving to a 'user-pay' system.  When the owner of the old coins wants to spend the coins that owner must provide a copy of the full old block.

The owner makes a transaction and provides the old block for download.  (if the miners who offer this service don't already choose to keep the old blocks)


There is no global cost, (aka a user-pays system), then there is no 'unintended consequence' - the few miners who wants to secure old blocks (by downloading old blocks or keeping a archive), can charge a premium for the service.  This is why it is a 'transaction fee' for 'processing the transaction.'  If it requites more work to process old transaction, then those transactions will attract higher fees.  (again a user-pays system).


Again, yes there is, See: Merkle hash trees: negligible cost for verifying old blocks without long-term storage.  (other than the owner of the coins providing the block for upload)


This, again, is incorrect.  Nobody is compelling any miner to process old transaction... The miners can choose to reject old transactions for whatever reason they want.  Including their age.

Actually, this made something click for me.

Isn't it he recipient, not the sender, the one to gain the most from the protection of the block chain? Past six confirmations (or however many before the recipient provides the good or service), the sender couldn't care whether or not the transaction is reversed.

Is there some way to take this into account without breaking Bitcoin?

Yes.  You should read that link you posted.  Again, an unspent transaction does impose an ongoing resource cost upon the greater, collective network, however small that cost may be.  It's right there.  The merkle hash tree is intended to permit the block to be pruned of spent transactions but unspent transactions cannot be pruned.  Hence the cost.  I'm beginning to get annoyed.  I started this thread to have an educated conversation with intelligent peers, and I find myself spending too much time pointing out the basic errors of understanding of others instead.

If the (only|most available) copy of an old block is the one that the spender has, this introduces an attack vector not present in Bitcoin now.  The obvious one that I can think of is that Bitcoin depends on the independently verifiable blocks that are provided by multiple sources not connected to the parties involved in the trade, or at least enough sources that it's extremely unlikely that all those peers are connected to either party in the trade.  If the only copy available to the miner of the input block is the one provided by the sender himself, a spoofed block is then possible.  How hard do you think it would be to fake a block and transaction set that could hash to match the merkle root of one block too old for miners to keep?  It might take a malicious node a few days to find the right combo of extra-nonce and false transactions to match the merkle root, but time is of little concern in such an attack.

Spending coins in this way is the only way to have a decent risk assessment while using two lightweight clients while offline, but this can never be the norm.


Your core premise is false.  Easily proven as such, and you even use some of that evidence to support your false premise.  I find that amazing.

You can safely prune both spent and unspent transactions, in fact you can prune entire blocks with spent transactions (for everyone except those those who own the coins in the given old blocks).

• Each miner keeps a list the root hashes of all the previous block, from the genesis block. (e.g. 256bit per block)
• A hash of all the past hashes is included in every block. (a slight modification to the block chain, but trivial) e.g. a Merkle hash tree root
• When an old transaction is announced, the miner downloads the block that contains these old coins.
• The miner compares the hash of the block downloaded to the known good hash of the block
• The miner then can check if the transaction is valid or not.
• When a block is announced with containing a very old block, the network will re-download that block and check if the transaction is correct
• (most) of the network forgets the old block once the new block is verified

See with one small change to the block-chain, (to contain a 2nd root of the hashes of all the past blocks), you can have secure on-demand downloading of old blocks.

So I believe your premise is incorrect.

It's not only the market value of the bitcoins that is being protected, it's the integrity of the transaction record, and therefore market value of the transactions that occurred that year.

Today for example, 7.4% of bitcoins were transferred. That means $3.3 million worth of BTC. In one year, assuming similar ratios as today (which I've looked through the data and it doesn't seem atypical), that comes to $1.215 billion worth of transactions. Keep in mind a lot these are international transfers which are typically much more costly in classical banking. The amount paid to miners comes to 2% of that, which replaces the cost of all the security that classic banks have to spend on when transferring money, and all of the other transaction costs as well.

Also, a successful >50% attack would not lead to a complete security breach where all bitcoins can be stolen. It would only open the possibility of double spends by an attacker, so the value of such an attack does not equal the market value of bitcoins. This suggests the risks of lower difficulty/market-cap could be low.

Furthermore, operating profit margins right now are quite high for miners. It will decrease significantly once bitcoin inflation slows and the market stabilizes, approaching close to the cost of electricity, which I've seen that you've noted at the moment is $0.75 million a year. This is only about 0.06% of the market value of transactions. There will need to be some profit, so even if we triple that, to 0.2%, that's still very low cost.

From whom? The assumption has been that miners will be the ones storing the full blocks.

Perhaps it is feasible for a division of labor, where block chain storage could be a separate business?

Well either the owner of the old transactions keeps the old blocks himself, or he pays another company to keep the old block for him.
The owner of the old coins understands that his old coins will be un-spendable if the old blocks are completely forgotten.

This is a user-pays system.  That is a good thing.

Two points. The amount displayed in, e.g., bitcoinwatch is completely bogus. A transaction contains a change. If you transfer $10 to a third party from an account that has $100000, the banking system transfers $10, not $10 + $99990, while Bitcoin does the latter. Wouldn't you be rather pissed off if Paypal charged you 2.9% on $100000 when you moved $10? So the percentage of the cost in Bitcoin is way higher than what you calculated. Secondly, there are so many transactions because they are mostly free. When the fees become a norm, the transaction volume will slow down.



I know that but a lot of people here downplay the consequences of the >50% attack. It is true that there is rather little to gain for the attacker compared to being honest. Therefore, I think we may never see a ">50% attack for profit". But for attackers that only want to make damage (for example a competition to Bitcoin), it can really make havoc. It's the mother of all DoS attacks. A >50% attacker can:

1. Completely halt all confirmations.
2. Reverse all transactions (so halt retroactively) and put them on hold.
3. Annihilate recently mined coins and all transactions where the coins were used (if the chain fork is longer than 120 blocks).
4. Double spend his coins.

And the point that is frequently missed:

5. Allow anybody to double spend. When the chain is forked, all transactions go into a memory pool of the miners. The attacker can be "nice" enough to remove them from his memory pool and allow anybody to connect, submit a new double spend transaction and confirm it. It can allow some non-fraudulent transaction and you will not know what is right and what is wrong.

If you think that it won't crash the BTC value, you are very optimistic. It would create such a mess that it will be very hard to untangle.  And do it a few times and nobody will trust the Bitcoin blockchain for anything larger that a few dollar transactions and Bitcoin returns to its amateur status.


As I wrote above, the value of transactions is bogus. The only think non-bogus is the total BTC value (money supply). Relatively to money supply, Bitcoin is expensive.

I don't think is a breaking change.
For the miners to receive the fees, they should just agree that these fees are legit: just as hard as changing the block reward.
For the holders to pay the fees, the miners should just reject transactions from accounts that are not enough funded (due to demurrage fees payments): just as hard as requiring a minimum fee for accepting transactions or removing the maximum block size.

If miners prune not empty accounts, when a payment from that account is made, they would:

A) Ask for the missing blocks and verify they are correct.
B) Simply reject those transactions.

The miners have an incentive to just ignore old accounts to save storing (or computing power and bandwidth) so this whole thing is a more dangerous situation than I first thought.

I didn't know that. I wonder how much of the transaction volume is change. This definitely changes the ratio, but it's difficult to know to what.


I agree with this.


Yes, the attacker can disrupt transactions, but cannot steal other people's bitcoins, so the monetary gain from such an attack is relatively small. As for an attack for competitive reasons, there is good reason to assume this would also not be perceived as being profitable by a potential attacker, because a disruption to bitcoin would benefit all competing currencies, not just the attacker's, so the attacker would be paying a large expense, to help not just himself, but his competitors as well, thus minimizing the benefit to himself.


I agree that given I assumed the transaction volume reflected transfers between parties, my calculations are not applicable.

I'll add though that the difficulty does not need to scale with total BTC value. There will come a point where an attack will simply not be feasible by any party due to the level of difficulty, and after that point difficulty does not need to increase much with further increases in market capitalization.

No, not really. If you have "infinite" block space, it doesn't matter that you're forcing people to move around their coins once in a while, the transaction fees to do so will probably be only 0,01µBTC each transaction. They would remain "that low".


Why not? With limited space, transactions would compete for it, and the only way to do so is by offering higher fees.


I'm not sure that's such an issue... comparing with bandwidth and processing power efficiency, storage space will probably not be such a problem.

That's a better idea. People implementing light-weight clients should take that in consideration, and store at least the blocks from which they have money on their wallets. People providing offline bitcoins like bitbill should also either encode the entire block on the bill, or at least allow the block to be downloaded from a server of them.

Is this really feasible? One thing is to produce a hash that has a certain number of zeros in its beginning, another thing is to produce an exact hash from something else. To me it sounds as likely as brute forcing against cryptography, but well, I don't really understand all these cryptography stuff so I'm asking....

If processing old transactions becomes expensive, then miners will start charging transaction fees to include them in their blocks.

Speculating about exactly HOW the miners will charge (will they subscribe to an 'old transaction service' or somehow contact the old-transaction-spender for the merkle branch of the old transaction?) is a waste of time, in my humble opinion.

Gavin, what do you think about including a second root-hash in the block hash tree.  This hash is the merkle root of a tree containing the root hashes every block before it?

This will be a useful feature for thin clients; once the clients have downloaded all the root hashes of the previous blocks, any new block can be used to check if the downloaded root hashes are correct.

This will enable secure arbitrary block download.

It is a miner modification to a block... I don't see it containing a large overhead,  it involves a extra sha256 of 3.2 MB / 100,000 blocks. It adds ~256bit to the block size.  I think that it's benefits out weigh the costs.

Main concern about this would be giving it all to the person who found such a block. If at all possible, it should track unspent blocks and start returning them at the eight-year span.

You actually could do true demurrage as a backward-compatible change. At least 50% of the mining power would need to agree to follow the same rules, but all other clients would have their transactions restricted by these rules regardless of whether they update. The miners could, for example, agree that all outputs must have their spendable value reduced by x BTC per retarget. Any transaction that violates this rule would never be accepted, just as if it was invalid. Furthermore, an output reduced to a sub-zero value could be safely forgotten by the network, since any spend using it would be invalid.

If miners with your rules don't have >50% of the network, you can't safely forget unspent transactions. If you are unable to find the transaction when it is needed for verification, you have only two bad choices:
- You can accept the transaction without checking it after it gets in a block. Every time one of these blocks ends up getting rejected by the majority of the network due to its invalid transaction, you will lose all of your hashing work since the last block. (This is even worse if you wait a few blocks before accepting it.)
- You can reject the transaction. Some important part of the network might accept the transaction, and you will be isolated from them unless you have more than 50% of the network.

I don't think fee-based demurrage will happen. Why would miners disincentivize people from allowing old transactions to be forgotten? Maybe spending old transactions will actually give you a fee reduction. More likely, you'll be charged an extra fee for turning a small transaction into a large transaction. You'll get a fee reduction for spending the last output of a transaction and turning a large transaction into a smaller one.

The strict demurrage I described at the beginning of this reply could happen if old transactions become a large burden, though I wouldn't like it. Hopefully other methods will be found.

I see.
So miners would just ignore old transaction unless a high enough fee is paid for renewing it.
This would also solve the storage problems from burned transactions and lost wallets.
Although feasible, creighto's proposal is not necessary to solve potential storage problems.

But...what happens if no one stores a block with not empty accounts?
Will some accounts become invalid because of time?
This could be an additional source of monetary base shrinking.

Why would the "winner miner" apply that fee reduction?
He can get the whole fee while enjoying the saving in storage caused by the transaction.

Promoting smaller transactions is good for the miner unless he plans to quit mining soon.

No-one mentioned the checkpoints, blocks that the client code knows enough about to realise the blockchain it is downloading is corrupt if any of those checkpoint blocks fail to match the values hard-coded into the client.

An attacker with >50% of the processing power cannot automagically convince the lesser percent of the network's processing power that those hardcoded checkpoints are wrong, so the attacked network will know for sure that any node trying to tell it a checkpoint block that does not match its own hard-coded checkpoint values is to be regarded as an attacker.

Thus, ancient (as in pre-existing the latest hard-coded checkpoint) coins are protected by those checkpoints. Do they still need constant adding of new blocks? Surely not? The entire network could simply stop completely and only transactions after the last hard-coded checkpoint will be at risk.

It seems to me to make a lot of sense that if "hoarders" (long term savers saving in actual unspent bitcoins rather than by investing or whatever) and "traders" (people making new transactions) have even slightly divergent goals that is an excellent reason for having at least two complementary blockchain-based currencies in use at any given time: one for saving and one for spending.

This whole thread seems kind of "moot" in an ecosystem of more than one blockchain-based currency. Get over the whole "there can be no blockchain but bitcoin's original blockchain" hangup and this whole problem can go away naturally.

From time to time a new blockchain can be started, with an explicit understanding/announcement that processing power is going to start moving toward the new chain, leaving the old chain to be secured primarily by means of the hard-coded checkpoints.

Eventually everyone interested in making new transactions and having them verified relatively fast will move to the new blockchain. People leaving their coins to their great great grandchildren will probably not worry too much that the Smithsonian, archive.org and other long term historical-storage facilities might take more than ten minutes to eventually release those coins come the century that their heirs finally choose to prepare to use them.

Announcements could even be made of at which block of both the old and the new chains the old chain will receive it's "final" checkpoint, after which no attempt to process a block every ten minutes will be made with the old blockchain. How to work out any later transactions on the old chain with the historical archive institutions need not even be detailed if this whole changeover is allowed a lot of time to happen, maybe even telling people that if they do want to leave their stash to their great great grandchildren they should in fact exchange it over to the new blockchain rather than depend on anyone being interested in buying ancient coins from ancient blockchains at some far future date.

Maybe we could simply add a -savingsnet flag like the -testnet flag for those wanting coins to save instead of (the default?) coins to spend...

-MarkM-

So why would miners promote (by reduced fees) transaction that save storage space instead of smaller transactions?
I feel I'm missing something in your point.

In fact if miners tend to be major investors in hardware as compared to non-miners, wouldn't at least some miners figure the vaster the blockchain the better, since they can better afford "vast" storage space (due to "economies of scale") than smaller players can?

-MarkM- (Isn't it typical in many or most industries to actually *want* {|such} "barriers to entry"?)

Basically you're saying that miners would want maintaining the block chain to be more expensive to prevent others to compete with them.
Isn't it bad for the network users?

It's an interesting point.  Maybe some miners will restrict themselves to coins which they consider "hot" e.g. younger than X blocks and expect lower fees or (maybe?) expect that they can optimise their hasher for upcoming transactions, while archivers may charge higher fees or experience less pressure in the processor department while profiting from providing access to a longer history of the block chain.

I think this might be a form of miner speciation, separating the quick agile aggressive piranha-miner fighting for the most recent tranactions from the slow long-memoried whale-miner filter feeding through the older or lower priority transactions.

This of course requires a sufficient increase in the profitability of mining to begin the whole competitive and co-operative industry.

This is doable even in the current state of affairs.  A blockchain that doesn't mine, and has many connections to miners.  But that same blockchain server has to be compensated somehow, and this functionally means that those who use the blockchain server are going to have to pay that service directly.  In fact, I've been thinking about doing this exact business model, and charging a small monthly access fee for users.  The primary users, in my view, would be thin clients that use a redacted blockchain as a matter of course.

It's difficult to know the ratio, but the point is valid.  The standard behavior of the client is to total up as many inputs as necessary to pay the intended his due, and then the change returns to the sender.  Since the default behavior of the client is not to consolidate vast holdings into fewer transactions (the very behavior I'm trying to address) it's reasonable to assume that any transaction with more than one input is sending the larger of the two outputs.  So an average can be derived from the transaction records.

I'm suggesting an alternative minimum fee rule, for which any fee offered less than that the miners simply regard that transaction as among the 'free' class.  Either they pay the minimum fee expected for that transaction, based on this rule or any other minimum fee rule that is larger, or the transaction receives no priority bump compared to a free transaction and is not valid for the fee paying sections of the block.  By 'that low' I'm simply saying that I'm trying to establish a standard price floor that (profit minded) miners are likely to honor in general, so that users in general know to pay it.


Because I'm trying to address the (admittedly very small) costs to the network for very old transactions.  The blocksize limits might pay for it fine, but that still wouldn't have a direct relationship to the costs of old transactions, but for the new transactions competing for space.  It wouldn't have any effect of encouraging the desired behavior from capital savers, namely the active reduction of resource usage.


It's not much of an issue.  I've already admitted this.  The costs to the network required by any one old transaction are tiny, indeed.  But they do exist, and are cumulative in nature.  This cost isn't directly addressed in the current fee structure directly.  I'm proposing, and asking for better proposals, that directly address this long term cost.  The fees need not be large, and certainly shouldn't be large, to have the intended effect on user behavior overall.  I suggested an alternative minimum fee that would have expected only .00000026 BTC per year per input.  That's damn tiny, and it will be decades before this is either a value of any significance or even before the other minimums in effect are smaller than this.

This will happen anyway, so that lightweight clients can communicate with other lightweight clients offline.

I don't disagree.  I'm trying to create a standard for this that miners can turn to, and in this way also allow capital accumulators to plan out their best course of action before this point arises.  If my proposal, or something similar, is generally accepted by the miners as workable now, then current users will already begin to alter their behavior in a manner that limits their own costs in the future.

Now I get what Gavin said.
The archivers would have an incentive to also ignore lost wallets and burned coins, although the first may be sometimes hard to know.
I still find the demurrage rule for the miners interesting.

Say that there are three transactions of 200 bytes with one spent output and one unspent output each. If someone spends all three of those unspent outputs in inputs in a 300 byte transaction, then the network has saved 300 bytes. I think miners will like this behavior enough to give a small fee reduction. Size-based fee rules would also promote this behavior somewhat.

Oh, I see. Blocks that don't follow size-based fee rules would be rejected by other miners.
I guess the fee reduction would be a function of the space save to the network.
But aren't then you punishing the archivers mentioned before? The old transactions would be "forgotten" faster.
Also you're not restricting the user from paying a higher fee (that compensate the enforced reduction) to persuade the archiver to "remember" his previous transaction.

By the way, as accounts can be forgotten by the network I guess the lost wallets and burned bitcoins aren't a technical problem that demurrage fees solve anymore. Is not a problem because miners can prune old transactions without introducing more rules to the network.
The demurrage fees would in effect "force" every miner to become an archiver while putting a rule to "forget" collectively.
"Force" with an incentive and "forget" after exhausting the account.
Also renewing transactions would require a transaction fee, or miners would just prefer to keep earning demurrage fees for the old transaction. In this sense, demurrage subsidizes indirectly (and artificially?) transaction fees like the max block size.
One through a limit in the "bandwidth" of transactions and the other through a limit on the store time of transactions.

I think you are trying to fix something that isn't broken and have no way of knowing if it is going to be broken or not. A lot of assumption. There is a danger here. Unintended consequences. This is why we have the saying, "If it ain't broke, don't fix it". You might end up doing more harm than good.

You could say that about inaction too.  In fact you could say that about having a bias in favor of inaction.

There is hardly any track record at all to say that bitcoin as it exists today "works" on a large scale over a long period of time.  It might, but there is no emperical reason to prefer the current implementation or policies in that problem space over anything else that also might work in that problem space.  The only real reason to prefer the status quo is that it costs nothing to implement, but that's a fairly small factor usually.

Any reasonable argument about long term success has to be based on some sort of analysis methodology (a simulation model for example) that is applied BOTH to status quo policies as well as some proposed alternative on more or less equal footing.

The empirical reason to prefer the current implementation is that it's working. It seems to be working quite well.

We haven't tested the current implementation without inflation driven mining which was the point smooth was making. We just don't have empirical evidence. We have nothing. There is no more reason to think this will work than something else without analysis.

We shouldn't change anything unless we have good reason to, but neither should we blindly cling to what we have without reason.

That could be done, but I'm not in favor of rejecting blocks based on fee rules (and that's not what I meant in my reply). Both fee reduction based on "old transaction deletability" and fee increase based on new transaction size can be optional.

I am speculating on what miners will do later as a free-market response to problems. I'm not proposing that any changes like these be made now, and certainly not in a way that would become permanent.

Correct.  We also haven't tested it with millions or billions of users, over a period of years.

When you look at the dynamics of very long term successful open source projects such as Linux or others, you don't see an "if it ain't broke don't fix it" approach to every proposed change. There is a healthy reluctance to break existing code for no reason but there is a also a willingness to invest in improvements that have no immediate benefit but are expected (and sometimes analyzed) to help longer-term future of the project (scalability, portability, maintainability, etc.).

In addition to the usual open source project management issues, bitcoin faces very significant additional challenges in terms of creating the right set of economic incentives that are likely to lead to a desired equilibrium outcomes in a large multiagent system.  For example, it's already the case that mining is too concentrated in the hands of some very large pools (and there are reasons to suspect this might actually become worse in the future), which suggests that something is broken about the current set of incentives.

Unfortunately, I don't really see the necessarily expertise within the project team to tackle these sorts of issues right now, but perhaps the continued success will attract it.

I don't know for certain, this is true.  But I do know economics.  I know incentives.  And I know praxeology.  The ultimate test of any science is the ability to make repeatable predictions about the future, otherwise the theory is flawed.  Economics has many theories, but in my opinion, Austrian Economic Theory is more accurate at ongoing predictions than any other theory.  And the reason for this is that Austrian Economic Theory is based upon the concept of the rational economic actor, and the study of how changes in the economic environment effects those rational economic actors and their behavior.  I look at the system as it is, and I see a small oversight in the picture.  I see an "externality" to use the lexicon of the modern world.  It probably will never be a problem.  I've admitted this.  And as such I have made a proposal that would only affect the system if it were ever to become a problem.  That's why I suggested an 'alternative minimum' miners' choice type fee, and not a hard rule.  If it's in place, and never really needed, it would cause no harm.  If in the future without any significant block reward, if it turns out that this really is a concern; those miners would have the choice of enforcing this known rule in order to establish a price floor.  I intentionally thought it out in order to limit the possibility of unintended consequences, another reason to have it as a miners' choice rule and not a hard|validity type rule.  If it were to have some unintended consequence show up, the miners' could simply stop honoring the rule, announcing their intent to do so.  Users won't object to the removal of a counter-productive fee, but they are likely to resist the imposition of new fees.

Sounds right to me.

I'm sure you can say it for any system that is working OK even though it is on a known collision course.

I'm convinced the current implementation of Bitcoin is unsustainable.It's not going to work when the inflation incentive to the miners is gone. The inflation is what makes hoarders currently pay for the service and when it's gone, the transfer fees will not be enough to pay for a proper miners support. The equilibrium will be a network of amateur miners working non-profit just for fun. With BTC valuation that corresponds to this "for fun" part.

I am yet to be convinced the system is fixable. And even if it is fixable, strong opposition to any changes is what makes me doubt it will be fixed.

I think no miner would reduce its own profits to benefit all miners.

Even if the storage externality is not a problem in the future, we don't harm the system when discussing possible solutions.

Here again I think getting over the fixation/hangup of only ever having one blockchain could help.

Maybe it is possible that by the time the minting of new bitcoins has decreased a lot, bitcoins will also be worth a lot.

Maybe even they could be worth enough that, like $10,000 notes-aka-bills, those who actually use such large denominations instead of exchanging them for smaller denominations will be relatively willing to wait longer and longer times for validation, maybe ultimately to a point where one does not consider a transaction verified until at least one hardcoded-in-clients checkpoint has been reached, fossilising the blockchain past the point where the transaction occurred.

Maybe if we start each next "denomination" (aka blockchain) each four years, when the previous "denomination" (aka blockchain) halves its minting-rate, the inauguration of a whole new blockchain that does give its miners 50 coins per block could help divert some of the frustration some miners - especially newcomers to the industry - might feel at the halving of coins minted in the earlier blockchain.

Wherever the miners focus should be useful for transactions needing relatively rapid verification and wherever the miners drift away from people can either exchange out of into the blockchain the miners move to or simply rely more and more upon actual human observations and checks, possibly including fraud investigations, computer-network attack charges, conspiracy to mess up international currency transfer investigations and so on, to arrive at "final" verification of transactions, ultimately fossilised by hardcoded checkpoints...

Miners having huge hoards of older "denominations" (aka blockchains) might prefer to mine the older blockchain{|s} in order to "secure" their wealth, at least up until the next client-version ith the checkpoints hardcoded that secure their wealth, while those more prepared to exchange their wealth into a new blockchain, or lacking significant wealth in old blockchains, might more readily jump onto the new chain...

-MarkM-

A known collision course? You have proof that there won't be enough transfer fees to provide incentive to mine?

I doubt the miners will resist if it is required to sustain the network. Users may object, but unless you are user/miner, it's moot.

It might be useful to keep this thread on topic, namely creighto's proposal of demurrage and its advantages and disadvantages.


If you want a longer discussion about this, see http://forum.bitcoin.org/?topic=6284.0 (http://forum.bitcoin.org/?topic=6284.0)

But be ready for a long discussion with a handful of twists in it. Long story short, this is not as easy as most people like to think. The system isn't proven broken, but it looks like difficulty will fall unless for block size limits etc. Especially, the system is not proven stable. The topic is more of academic interest though, since I don't know whether we will need a lot of miners later on... I think it is best if we keep that discussion separate from the suggestion in this thread here.



@Topic:

Apart from the technical benefits, I think that a demurrage system might have a few more general advantages that mainly stem from the ability to tell stale coins from lost coins. Also, the higher incentive to spend is often named as an argument for inflation, and it's not entirely false. But I think demurrage should be really low, far below inflation, and not apply to people who spend their BTC in time -- or else a good portion of the current user base, those hating inflation, might be gone in the blink of an eye. So, the main argument against demurrage is psychology. People don't like their BTC disappearing, they might shy away from a cost even if it's reasonably low. It's another part of the protocol the users need to understand.

I believe demurrage has an advantage over the current situation technically, but I don't know whether it's better than the current system. Yes, it's nice to keep mining up, gather up lost coins, allow getting rid of old parts of the block chain. But Simplicity on the user side is a feat of its own, and stale coins don't do anything until they stop being stale coins. Mostly, I just dislike the idea of the total amount of BTC shrinking without re-mining of lost coins, but maybe that's just my personal opinion on aesthetics confusing my mind.

Most likely, the question will not be of importance, since it might be too hard to change the protocol now -- then we'll have to cope with current rules one way or the other.

After theymos has explained me some things here:

https://forum.bitcoin.org/index.php?topic=7219.msg150688#msg150688

I don't think the argument "demurrage fees are not necessary because miners will forget old transaction" is valid.
If there's no hashing power incentive to forget, why miners would do that?
The fast miners/archivers specialization won't happen.

Am I missing something?

Either you agree that old transactions have a 'cost' to the network, so there would be a benefit for some miners to forget these coins...
Or there is no 'cost' to old transactions... there for the entire idea of demurrage is stupid.