The 999 part is my addition and is what Decrits attempts, if I understand it correctly. But you need to be exceptionally careful who you give the new coins to. If random addresses then you have a guaranteed interest for simply holding money. People stop spending and start watch their accounts rise, deflation and instability ensues: the more you try to fight it by issuing new coins the more profitable it becomes to hold currency until the whole bubble pops violently as people crash the exchange market looking to "cash in". Familiar ?

New created money (except for what goes to miners) should go to a charity the user selects from a predetermined list. So If I have 100 inflationary coins and the yearly inflation is 2%, it's as if I had 100 stable coins and I'm forced to donate 2 coins per year to a charity. Inflation tax goes to the charity instead of the government. This makes me reluctant to hold coins and prevents deflationary expectations.

It's important for this stability thread to note that even 0% inflation (complete stability) is a counter productive goal. Sometimes a real 0% return is above what market has to offer, for example during a recession. If you try to guarantee a 0% risk free return, you kill trade because people prefer to hold money and wait for better times. Money are held, trade stops, better times never arrive and a 0% real return looks even better, reinforcing the crunch. So it's either inflationary and money, or it's Bitcoin - a speculative unstable commodity for the internet geek and closet anarchist.

I can see how something like the brick standard would work, since bricks are widely used and the central bank can convert money back to bricks. If money loses it's value you go to the Fed, take your bricks and build a home. So it's a good inflation hedge and technical advances to brick making won't be very dramatic. Approached from a public choice point of view it could be worthwhile because it massively cuts the rulers' freedom to fuck with the ruled; unlike other monetary policies which are optimal if only Jesus was head of the central bank.

But tie monetary policy to something like "Kommey normalized million SHA256 hashes" ? Which can jump a whole order of magnitude in price during a year or two ? And which are useless in themselves ? (and either way we won't have a way to transform a coin back to it's component hashes). That doesn't bode well on the stability front. It's rather sad if it's all we can do because it makes stability impractical, not a mere tradeoff.

I can follow the GED proposal, it's the straightforward way to do something like this. My take on it: the number of coins is unbound, and anyone can create new coins by performing a "certain amount" of computing work. This puts a clamp on deflation and speculative appreciation, the market can see at all times what is the maximum price a coin can command before it becomes profitable to mine and create more of them. For each mined coin you can randomly distribute 999 free coins, so that the whole scheme does not become a MordorCoin; mining is just a way to convey price information into the system, not the way most coins are born. That "certain amount" of computing work per coin is set to increase following Koomey's law, so that inflation doesn't takes hold because of future technical advances.

This is straightforward and easy to understand, but as I said, it's less than good. Moore's or Koomey's laws are valid on the long run average, but technical advances come in powerful waves, for example the jump from GPU to ASIC mining will dramatically increase the Bitcoin mining efficiency in the next few months. For GED it would trigger rapid inflation. Or some years pass without major advancement in mining chips, then Kommey correction slowly creeps in and it makes coins hard to mine with existing gear, low supply on the market, thus short term deflation. The GED market would jump like a yoyo on the news that a new mining chip was planned or has failed.

Both of you are alluding that you made the next step:

So how do you move from hashes/coin which is a direct extension of Bitcoin, to something like 1KWh=coin without relying on external information ? And additionally :


It is to me an apparent contradiction: either you have external information or you have a distributed algorithm that can compute it's own energy use. There doesn't seem to exist another way to reliably move from hashes to KWh. Something as generic as Moore's or Kommey's laws can't provide stability in the short run.

I started this as a reply to the "zero-confirmation is not safe" thread, but i believe it warrants it's own thread.


This is generally a solid design principle: when something is to break, you should make the failure visible and document it clearly so the user understands this is not the intended use of the software.

However, in this particular case zero confirmation can be fixed so they are almost as secure as 1-confirmation payments with minimal tweaks to the client rules, a much more worthy goal than breaking them completely.

Tweak 1. Don't silently discard double spend transactions. Forward them along to other peers, marked as double spends^(*. This is essentially the same solution as in the Two bitcoins for the price of one paper. They suggest hijacking the Bitcoin "alert" for this purpose, but I think the marking need not be explicit: you just need to always prefix the doublespend with the first spend when forwarding along to other peers, implicitly communicating the correct order. So if they haven't seen any of the transactions yet, they will inherit the same order as you, just as it happens today.

This kills in the bud all race attacks, where the merchant is unaware that a fraction of the miners have received and are actively extending a double spend. After you received the first zero-conf transaction, you listen 10 seconds for another txn attempting a double spend and if none is received you have a very high certainty that all honest miners have received that transaction and are actively mining it. The propagation time is on the order of 3 seconds so if the attacker sends the 2nd spend after 10 seconds the probability it would reach any miner first is zero.

So we are down to a Finney attack. (or an involuntary Finney where the attacker interferes with a miner's network connectivity so as to present it a different spend order)

Tweak 2. Don't obliviously extend blocks containing a double spend. When selecting the longest subchain to extend, blocks containing a known double spend should be assigned a zero or negative difficulty. All other things being equal, a miner would chose to extend a 2 blocks subchain rather than a 3 block subchain the first of which contains what he can recognize as a double spend.

This will not fork the chain: if what we believe to be the double-spend subchain grows faster than our original choice, at some point we will concede that we were wrong and the network has a different view of what was the legitimate spend, so convergence will eventually be reached. The "some point" where this happens is determined by the negative difficulty we assign the double spend block. A small negative value will allow the work from the Finney attack block to simply be ignored by the majority of honest nodes, making the attack very costly in terms of resources and BTC potentially lost. ^(**

It's also stable in the Byzantine-Altruistic-Rational paradigm: if we are confident on our determination regarding what is the legitimate spend, then we are confident most other miners have the same idea because of tweak 1. Thus it's rational for us not to extend the block containing the double spend, due to the negative difficulty impact it would have on our work for the point of view of most other miners. When enough miners are altruistic and implement Tweak 2, it becomes irrational not to implement it and a rational majority will maintain the status quo.

Together, tweaks 1 and 2 rise the bar immensely for zero-confirmation attacks,. When 10 seconds have passed since the initial broadcast, we are fairly certain the vast majority of miners are on our side and will actively fight a Finney attack because it's profitable for them to do so. When the attacker gets the merchandise from the store and broadcasts it's Finney block, all nodes learn about the double spend within it and rationally chose not to extend it (they should also carve out the 2nd spend from the Finney block and broadcast it, so the merchant learns about what just happened).

To surpass the penalty, in the small negative penalty scenario, the attacker needs to mine two blocks, the first of which is the Finney block. The probability for this to happen is  on the order of (his ratio of hash power)^2, forcing him to do many double spends at the same time to have any chance of recovering the costs. So any vending machine could accept the zero confirmation payment with no risk and no need for observers or bribing miners to get on their side.

*) Naive implementation could open a potential denial of service, a rogue node sending over and over double spends of the same transaction. So you need to forward just one 2nd spend, not any of the following. The merchant needs to know that a double spend is in progress, not it's details, so races among 2nd, 3rd... spends are irrelevant. If any of the racing doublespends arrive at him, he fails the sale and holds the merchandise.

**) What about a large negative penalty, worth one or more blocks average difficulty ? It would make double spends attacks even harder requiring private mining of 3 or more chained blocks; but at some point reorgs are slower and deeper with many orphans, negating the benefits.

Leaving the information issue aside, I was saying that tying the value to something like hardware and electricity cost is still not a good solution. Energy shocks and rapid technical changes would influence the value of money. 3D chips, war with Iran, nuclear fusion, and many other similar things would open the door wide to speculators looking to extract value from the users of the currency.

If you target the costs of producing a certain computational work, then yes, you don't need external information. But that cannot be a stable coin, or can it ? Can you explain briefly how are you going about regaining  stability ? It's not clear from your proposal because there are allot of low level technical details.

I'm pretty sure you've made that proposal:


It can be done but it's not the ideal target and it still requires external information.

Something like that. 100$ -150$ stable over long term is less plausible because it requires something like 300.000 - 400.000$ fresh funds to enter the economy each day as mining revenue, profits + cost. When ASICs become the norm, profits will drop and even miners that are long in bitcoins will put cashflow pressure on the exchanges (miners seeking only USD profits are already doing it). In october - november the whole daily trading volume was around 500.000$, so I really don't see how the market can sink 400.000$ worth of BTC long term without dumb money caused by quick appreciation and media exposure.

Bottom line, nothing fundamental really changed in the last few months. If BTC price was stable around 5-10$ with a 50 BTC block reward, it should be stable at 10-20$ with a 25BTC reward. I'm willing to grant an extra 50-100% for the increased visibility, and I'm being generous. So 20$ to max 40$ could be stable long term, 100$ can't be.

So it's either another bubble or a slow death with a capitulation in the 20s (realistic) to 30s (optimistic).

The general idea is that geeks on the internet have invented a currency that has a variable value and you should probably avoid it, unless you want to buy drugs. A few seasoned daytraders and potheads might find the segment interesting but the vast majority of the viewership will take it as a joke. There's no inducement to investment so don't expect a tsunami of money to hit mtgox from Joe Sixpacks and housewives.

Everybody is expecting to catch another falling knife, and profit from the differential when it goes back up, that's why all the bids are there. That doesn't mean the fundamental problem with the bubble (irrational overvaluation) has disappeared. If price steadily drops over the next few weeks and the promised influx of buyers fails to materialize, which I think they will, the bid wall will vanish.

If you look at the google trends data, the interest peak becomes more and more clear a thing of the past, so there's nothing to salvage the situation short of a rapid valuation over 250$, so that reporters and news outlets are interested in the story again and dumb money starts flowing again.

Constant 50 coins per block is deflationary in the long run. 50 years from now the yearly expansion drops under 2%, sufficiently low to make people today go bonkers about their future fortune. It's also incentivizes people to waste useful stuff in order to get currency (MordorCoin), not a nice thing IMO.

@Impaler, Red: the in-block futures market where a certain proportion of coins is "frozen" for some time has a major drawback: if I can prove that I own the frozen money (using the private key), then I can still spend them out of chain. I can deposit the frozen block to a bank, earn interest, and the bank has 100% certainty that at the unfroze date it has access to the money. The mere promise of future money is money too (near-money), this is how banks operate. So the bidders don't give up anything by having the money frozen, other than the convenience of intra-blockchain transfer. The bid price will collapse as soon as reliable out-of-block transfers are available (like checking accounts drawn on StableCoins) and you won't discover any real-world information.

You really need access to some real currency market. Like the built in market in Ripple for example. Since anyone can create an IOU and tilt the market, maybe a distributed graph analysis can detect the "real" price that most of the network agrees too. Something like PageRank where links between a subnet of pages (IOUs traded by related entities) cannot manipulate the global importance of that subnet.


Yes, that's a restatement of the stability problem. "The production cost of money" should be zero because money is information. So my chain of thought is as follows:

1. A StableCoin needs to maintain it's value in reference to a basket of common goods, otherwise it's unstable by definition; speculation, bubbles, etc.
2. We have no chance to compute the value of that basket with a distributed algorithm
3. There is no monetary law that can guarantee intrinsic price stability, it's an economic impossibility
4. Therefore we need to find some proxy of SC's CPI, and peg it's long term value to it; if the long term value is credible, the market will do the short term and price stickiness will appear
5. What CPI proxy to use ?

It seems that real world central banks have a pretty good grip on this problem and regular currencies are more or less stable, so pegging to a real world currency, be it USD, EUR, GBP, or a basket like SDR, is probably the best we can practically achieve. It's also a single number that we need to discover or be told, so it seems a reliable distributed algorithm, be it a vote from the users or an internal market, can agree to it's value.

On the other hand, pegging to energy or hardware costs is not an optimal idea because energy is relatively volatile. Energy should be just a component of SC's CPI. I don't want to sound patronizing towards your proposal, I just think it's an objectively worse CPI than simply leveraging the USD rate. Nor is it possible to find out the energy costs without external information. So if we need external information either way, why not use the best CPI proxy we can find, the exchange rate ?


Let's not get ahead of ourselves. Like the Bitcoin speculators do when they claim  prices will be stable once everybody is using their currency. Well if prices vary 100% on a daily basis, we will never get to the "everybody is using it" part.

I think a cryptocurrency that stays within a 20% band for a few months relative to the USD dollar and allows people to make instant transactions around the world with small fees and good privacy would be a glorious achievement. We can build from there.

I think we talked about this two years ago. You can target the hash rate easily using only internal information. Unfortunately that's very unstable do to Moore's law etc. To target the electricity cost you need external information (no algorithm can find out the energy consumed by the computer who is running it, let alone it's cost). At that point it's better to target a major world currency directly, since electricity prices are quite volatile too.

Also, I hope you are not proposing the currency of Mordor scenario where each coin requires it's value in resources to be destroyed. That's worse than Bitcoin, where at least the energy waste drops after a few decades when coin production slows.

The notion of CPI is not arbitrary, it's by definition the index that you look at to judge the stability of StableCoin. You might not like the US government's CPI and it's implementation in US monetary policy, that's quite another issue. But the CPI of StableCoin, the amount of real life stuff you can buy with a coin, determines it's inflation by definition.

The only way economists know how to that is by watching a certain basket of goods, compute the CPI and control the monetary variables to that effect. It's simply absurd to think a distributed currency could compute a distributed version of the CPI. And there's no way to design the currency to be intrinsically stable, because the value of money is entirely driven by external factors. You cannot preordain that enough currency be made available to cover rapid demand rise due to sudden media exposure, the only way to absorb that shock is to have a central bank with enough currency reserves make the market. This is exactly what small countries do, sometimes holding a 1:1 foreign reserve vs outstanding currency at the target rate.

A more practical goal than a distributed CPI is to simply target a long term value of the fiat exchange rate. Since fiat currencies already have their CPI and are certainly more stable than bitcoin, we need to somehow incorporate that information into the blockchain and act on it. If you don't trust the USD inflation, you can target a lower rate, say by 1-2%. So in the first year the rate is 1USD, in the fifth year the rate is 1.1USD etc. (a high rate could potentially open a whole can of deflationary worms but if don't believe in the CPI you probably don't fear deflation either).

If, due to such a mechanism, the market believes the long term rate of 1 stablecoin follows 1 USD, then the exchange rate would self stabilize in the efficient market hypothesis. Traders know that a 1.05 rate is a good price during a demand shock, and will dump their inventory supplanting the role of the central bank. A few percent swings of the exchange rate per month is enough for them to make a healthy yearly profit and convince them to hold cryptocurrency inventory or contribute "foreign reserves" during lows and buy the cryptocurrency at what they can ascertain is a cheap rate.

I think Impaler might be onto something in regards to exchange rate discovery using some internal tradeable commodity, but I can't quite put my finger on it. As I've said previously, blockchain transaction rate, "coin days destroyed" or other such folly are not good signals because they can be controlled by speculators. A direct way to incorporate the price information is to use a vote and I tend to believe all other schemes can be reduced to this - it they form a majority users would just fork the chain and modify the inflation rate algorithm.



This should be beyond questioning in a thread dedicate to achieving stable prices. The deflationary design is bad, and the "store of wealth" promise of bitcoin is attracting speculators. This is the main problem causing volatility in bitcoin, people wanting to strike it big by simply holding currency. Since this is a self defeating prophecy (if people hold it, it cannot circulate, thus cannot fulfill the promise) a positive feedback loop is formed and the price will tend to move randomly as the rational market tries to guess it's next move.

I believe simply applying Friedman's k% rule (increase the money supply by say 4% each year) is probably enough to stabilize long term prices. But in the short run you still have a possible deflation during initial adoption, when the economy is growing much faster than 4% a year. That's why I think some way to discover the exchange rate and set expansion using it is key for initial stability.

Disclaimer: I'm not an economist, but I am a convincing M2 near-economist.

It doesn't, XRP transactions are just like BTC irreversible. An account cannot be "frozen" unless we are talking about a bug.

On a another note, a 40.000 XRP/BTC means 500XRP/USD. Since they have 100 bln XRP, that put the valuation of Opencoin at 200 million dollars. A tad high maybe ?

The difficulty has dropped for everyone. So while it may be easier to mine a single block double spend block, so it is for the other miners to extend the real block. The exponential disadvantage an attacker accumulates each block is still in force, as explained in the original Satoshi paper; it does not depend on wall clock.

You don't get more security with longer confirmation periods, you just get... slower confirmation. It still takes 50%+1 of the network hashrate to forcibly build a 6 confirmation chain fork, regardless of the time interval dedicated to it. The downside is that chain reorganizations and races are much more frequent at fast speeds and the network is unstable and prone to splits. A broadcasted block needs a few seconds to reach all mining nodes and during high load a very fast block discovery rate would trash the network completely.

A few minutes is probably an acceptable compromise.

It's the same chicken and egg problem as in Bitcoin, not a different one. What makes miners compete ? The fact that a coin has a market value. Mining does not create value, it's the market value that puts a price on mining. And just like BTC, coins gain value because they are scarce and useful for trade.

So the whole "wasted resources" versus "doing useful work" comes at a later stage; the bootstrap is similar to Bitcoin and there's no debate charities would sell the coins dirt cheap into the hands of the early adopters, just like early miners gained coins almost free.

There's is nothing wrong with Satoshi's strategy, I've called it "clever" above. Bitcoin is a profound insight and a game changer, but you must take it for what it is, an experimental early design. Now that the game is changed and cryptocurrency proven, the charities would more than likely accept the keys, and if not it's their loss; you don't have to cover all charities, just a representative set so that most people owning currency can find some cause they can support. The idea is simply to spend the money into existence without a single point of failure (Opencoin) and without burning resources.

It's no task I can realistically accomplish on my own, we're just debating the principle, is Bitcoin "wasteful" or not, and if it is, in reference to what.

The worst thing they can do is steal the money, that's why you have a say in which charity receives the money and the initial list contains reputable well known names like Unicef, Doctors without borders, Wikipedia, FSF, EFF, OXFAM etc. It's just as in the real world, if they don't have a good reputation they don't get money.

@Timo: except for the lack of mining, XRP is a step back across the board, a "retrogression" so to say.

Mining is a competitive lottery, the more you invest the better chances you have. But it need not be. If we hardcode in the genesis block 100 special addresses belonging to 100 real charities, the whole socialist identity verification affair can be done by a single person in a few days. Then one of those addresses is randomly selected to receive the money during each block. The users agree the initial list is fair by using that chain, that is buying coins from the charities on the market.

You could affect the probability in favor of "Saving the pigmy people" by including a small charity id in your transactions, so high worth individuals can affect the distribution; "KKK of America", assuming it's the initial list, doesn't get much of the money. It's as if instead of trading certificates for burned energy (bitcoins) we trade certificates for donation to charities (charitycoins; yes, that is a stupid name). Both are scarce and impossible to fake.