"Surprisingly, Tail Emission Is Not Inflationary" -- A post by Peter Todd

[NeuroticFish]

If there is only one way to get it right, then it would be tail emission from launch.
In gmaxwell's words, that's a pretty strong attractor in the design space, with nothing arbitrary about it.

It's the most fair possible coin distribution.
Which is exactly why many (most?) people don't like it, because they want to have an edge over later adopters.

Any such change done at a later point can disappoint greatly the early birds. I can see why any later such change can be seen as bad. And I think that you know that such a change done now in bitcoin can easily trigger a fork. Yes, it's all about money/investment, much more than we'd like to admit. The use-as-a-coin is somewhat secondary.

Whether tail emission is fairer or not compared with what Bitcoin has is highly debatable imho. I expect the two different models come with completely different models for price evolution. So imho, in a way or another, both are fair.


For now Monero seems to have its tail emission right, but I don't know the details well enough, hence I may be wrong. And they've had this from start too.

[1715180768]

1715180768

[1715180768]

1715180768

[stwenhao]

Your statement can be rephrased as "nobody likes their share of the pie to be decreased".

I can rephrase it further: Bitcoin users don't like their share of the pie to be decreased in some obscure way.

Tail supply can be used to hide the fact that users lose their "share of the pie". It is not instantly obvious to everyone. But if you introduce any fee policy, when it will be required to send some of your coins directly to the miners, or your coins will stay unconfirmed if you won't adjust to the rules (so the final effect will be the same as if they would be burned), then it is crystal clear that tail supply is taken from all accounts and given to all miners. It should be crystal clear from the very beginning, that tail supply supporters want to take single satoshis from everyone, and make a new block reward out of it. And all details would then be only about the whole algorithm that will decide, how many coins have to be taken from each account.

My point was that it's hard to get tail emission right.

Yes, and because it is hard to do it right, then it should be solved by Merged Mining. You want to get new coins? No problem, just mine Bitcoin, and get Bitcoin and BitcoinWithTailSupply at the same time. Then, you will get additional coins outside of the chain, and then all users will choose, which coin they want to use. But I expect that BitcoinWithTailSupply will have many problems, and will sooner or later burn some coins, because of overproduction. It is hard to get all amounts right, so it should be dynamically adjusted, for example by Merge-Mined sidechains.

You want more coins? No problem, just create a new Merge-Mined altcoin, and distribute coins, based on Bitcoin shares. You want less coins? Then it's even easier: just burn them.

[tromp]

For now Monero seems to have its tail emission right, but I don't know the details well enough, hence I may be wrong. And they've had this from start too.

Yes, you're wrong; they didn't have tail emission planned at launch. It was hard-forked in later.

Your statement can be rephrased as "nobody likes their share of the pie to be decreased".

I can rephrase it further: Bitcoin users don't like their share of the pie to be decreased in some obscure way.

They don't like any departure from the 21M bitcoin limit. Which makes perfect sense.
Bitcoin has always been branded as the ultimate hard money, because of its immutable supply cap preventing dilution.
Once you start changing that (even if there remains another effective cap implied by ongoing coin loss), then it's hard to take any claim seriously. Like Ethereum's "code is law", but worse, since that was never part of Ethereum's consensus model.

While I'm a big fan of Tail Emission, I'm an even bigger fan of immutability of such core properties as emission, so I disagree with Peter that Bitcoin should add one.

Bitcoin is stuck with the 21M limit no matter what. It will just have to find some way other than tail emission to deal with the future uncertainty of having possible periods of precariously low security budget.

I do think that hard forks will be made adding a tail emission, but they won't be entitled to the BTC ticker, and won't fare much better than Bitcoin Cash.

[vjudeu]

You want more coins? No problem, just create a new Merge-Mined altcoin, and distribute coins, based on Bitcoin shares.

Exactly. A chain with 0.01 BTC tail supply would need one million blocks (around 19 years) to produce 10k BTC. That should be slow enough to play it safe. The current block reward is 6.25 BTC plus fees. Let's assume that some block has 7 BTC reward. Then, you can grant miners 0.01 BTC for merged mining 700 times easier blocks on such sidechain. The difficulty of your altcoin can follow Bitcoin headers, it is that simple. And if 700 times easier difficulty is still too hard, then you can give miners less coins for mining easier blocks, and keep 10 minutes as a sidechain block time. Then, all miners will try to get tail supply of 0.01 BTC, and some of them will push your sidechain forward, if they hit a Bitcoin block at the same time.

It will just have to find some way other than tail emission to deal with the future uncertainty of having possible periods of precariously low miner incentives.

Then look again at Paul Sztorc's triangle, and choose wisely: Merged Mining or big blocks? And if something else, then what it would be?

[tadamichi]

Which is exactly why many (most?) people don't like it, because they want to have an edge over later adopters.

I don’t think it’s about having an edge over others, but about Bitcoin itself and their own piece of the pie ofc. We also don’t know what effect tail emissions would have on potential late adopters, as there will be many competing assets without it, and having some sort of inflation mechanism could make Bitcoin less competitive. Leading to less adoption again and then potentially devaluing the amount miners would have earned too(1 BTC in transaction fees only, could be worth more than the same amount in a tail emission model). We can’t assume Bitcoin will have won it all already. The value proposition Bitcoin offers now, will be huge even to late adopters, if we compare it to other assets.

Also the security budget is important, but we don’t know if the absolute amount is the only relevant metric to consider yet. The access to attractive locations and the distribution of mining should be considered too. There is places with close to 0 electricity costs, and as Bitcoin rises in adoption and the potential price increases become less. Mining might become so competitive(barely profitable) that it could just be possible for a few big players anyways, and be almost exclusive to locations like this. Which will also make attacks from the outside harder again, without access to these locations(it could make it more expensive than the security budget itself). Or even make it hard for new miners to join, as it will be hard to get access to locations like this. A tail emission also doesn’t change how mining will be distributed as it becomes more and more competitive. The more competitive mining becomes the less relevant the absolute security budget could be.

[o_e_l_e_o]

Then, that hodler will have a choice: sign those coins, and send them as fees, or not sign those coins, and effectively get them excluded from the circulation.

Leaving out the specifics of how much you would take, if you want to go down this route then you would need to create some kind of automatic mechanism to take these coins from people, and not rely on them spending them as enforced fees, as there would be an incentive for individuals to let these coins be excluded from the circulation as it would make their other coins more scarce and therefore more valuable.

Then look again at Paul Sztorc's triangle, and choose wisely: Merged Mining or big blocks? And if something else, then what it would be?

So, given that the majority of bitcoin blocks are already taking part in one or more merged mining protocols, what are the main arguments against using merged mining to create security once the block subsidy is insufficient? Is there any ongoing discussion or work on blind merged mining protocols (such as BIP 301)?

[tromp]

So, given that the majority of bitcoin blocks are already taking part in one or more merged mining protocols, what are the main arguments against using merged mining to create security once the block subsidy is insufficient?

If merge miners only make a small fraction of their revenue from bitcoin, then it becomes rather cheap to bribe them to mine censoring bitcoin blocks.
In that sense, the security of the bitcoin blockchain against censorship seems to depend on just the bitcoin block rewards.

[garlonicon]

Leaving out the specifics of how much you would take, if you want to go down this route then you would need to create some kind of automatic mechanism to take these coins from people, and not rely on them spending them as enforced fees, as there would be an incentive for individuals to let these coins be excluded from the circulation as it would make their other coins more scarce and therefore more valuable.

Yes. And this should show clearly, what tail supply is really about: it is about taking single satoshis from all accounts, no matter what, no matter if coins are burned or not, no matter if someone wants that or not. So, it is all about creating an invisible tax on all addresses. If some coins are fully burned, for example by using OP_RETURN, then they cannot be moved. But tail supply is about taking single satoshis from those addresses as well.

So, you know what is needed: zero satoshis. Then, it is possible to create some additional outputs, send zero satoshis there, and use "<anyStandardScript> <newAmount> OP_DROP" as an output script (or this "<newAmount> OP_DROP" could also be placed inside witness script, or as an input, many things are possible). It could be handled in the same way as Segwit vs NonSegwit: if it was possible to create a situation, where old nodes cannot see new signatures, then it is also possible to create a situation, where old nodes will not see new amounts (there could be many reasons, for example if hiding amounts will ever be introduced, then it is reasonable to put zero for backward compatibility, but the same solution can be used to introduce any coins to the system, because the size of the UTXO set is not limited). And then, it is all about human factor: if those zero satoshis will be really used to move real values, then they could be traded, bought, sold, and used in real life. If it is possible to create NFTs out of thin air and sell them for millions, then why producing coins out of thin air and selling them for real goods and services wouldn't work as well?

what are the main arguments against using merged mining to create security once the block subsidy is insufficient?

The main arguments are that sidechains can be unsafe. So, that means they will be created anyway, there are many options, how exactly it would happen:
1) it can be deployed on altcoins
2) it can be deployed on second layers like the Lightning Network
3) it can happen on centralized websites, like exchanges or casinos
4) it can turn out that homomorphic encryption is sufficient to deploy sidechains on the main network
5) other features can enable sidechains by mistake, just because developers can be unaware that some feature enable more things than intended
So, I think it will happen anyway, that way or another. Definitely, homomorphic encryption is a powerful tool, because it can enable new features in a permissionless way.

Is there any ongoing discussion or work on blind merged mining protocols (such as BIP 301)?

Yes, you can talk directly with Paul Sztorc and other people on Telegram.

Edit:

If merge miners only make a small fraction of their revenue from bitcoin, then it becomes rather cheap to bribe them to mine censoring bitcoin blocks.

It depends. If other networks will have 1:1 peg into Bitcoin, then even if you can see that some miner received zero satoshis on-chain, that miner could get more satoshis in other networks, and everything could be just finalized on Bitcoin. I think a situation, where there would be only 21 million coins, that could be splitted ad infinitum, and where single satoshis will be placed in many different sidechains, is a beautiful picture, definitely better than when you have a lot of altcoins, where each of them create new coins out of thin air. Then, you could create an altcoin, and have it backed up by Bitcoin, so you could avoid a speculation attack, where your coin is pumped and dumped during early days.

To sum up: currently you have coin A with feature A, and coin B with feature B. What about adding feature B to coin A instead, and have a coin A with features A and B? That's what sidechains are about, so by supporting them, you can get new features without causing too much inflation.

[abcd7890]

Break Bitcoin now because it might break at some unspecified time in the future. Great idea

[BusinessChain]

The problem with fixed reward is that you don't know whether you are actually rewarding the miners properly. What kind of politics will determine what the right amount of block reward would be? Do we even want such politics in Bitcoin? I don't.
When you have transaction fees only, it is purely the market who decides how much miners earn. I think that is the right way to go.

I quote myself here.
It's funny, I said the problem with fixed rewards is that it induces politics... and look what happened after my thread: A lengthy political discussion. 

[garlonicon]

Break Bitcoin now because it might break at some unspecified time in the future. Great idea

True. It is just another attack on Bitcoin, and it should be stopped, also by informing people, what it is truly about.

A lengthy political discussion.

Well, Paul Sztorc correctly predicted that those three options will be on the table. Block size increase was discussed many years before, increasing supply is now, so maybe it is a chance to introduce Merged Mining as the solution to kill those two ideas, before they will grow further? Also, people should be aware that tail supply is basically the same as taking single satoshis from everyone, from every address, no matter what, and passing that to the miners. It is effectively the same, just done in a more obscure way.

Fortunately, we can reject any hard-fork by default, because BTC in 2017 chose the path of rejecting hard-forks if they are unnecessary. And fortunately, any tail supply soft-fork will reveal the true nature of that change: it will require producing zero satoshis, or moving coins from users to miners, or locking coins by miners. So it will truly reveal the whole process of taking satoshis from everyone, to form future rewards.

And by thinking, what is really needed if the supply will still be fixed, and if we want to get an equivalent of tail supply, everyone should clearly see, that such change has negative impact on Bitcoin, and should be stopped. Also, fortunately, introducing counter-proposals that will burn all additional coins, is easier than creating them, so it should be enough to resist this attack.

[NotATether]

My point was that it's hard to get tail emission right.

You can't get tail emission right. A good TE value in a certain market conditions is an awful TE in different market conditions. The success of tail emission depends entirely on whether the number of miners stay almost-constant thoughout the lifetime on the coin. Just like in economics, there is a break-even point in the number of miners where more miners joining the network will not see an increased reward - as the price (which is dependent on users buying and selling) works independently from miners.

By supplying Tail Emission you constrain the network to a certain number of miners, and since there is no noticeable increase in hashrate, there is no corresponding increase in coin scarcity either, hence no price increase - miners will have to support themselves on a block reward (i.e. TE value) which has a fixed USD value forever.

EDIT: Let me also clarify that when I said "Miners will not see increased prices on their rewards", I meant the mining difficulty will continue to go up but less blocks will be found by each miner due to increased competition, hence the profits for each miner decrease as competition increases, as the block reward and price stay constant. Hence the network security and therefore the user capacity is constrained (capped). Which is why coins like monero have a small market of people.

As I hinted in my previous reply here, the userbase capacity is tied to the block reward, which must decrease gradually in order to support more users over time. Rushing it will not bring the desired user capacity faster; it must occur natually every halvening.

In this case, the user capacity you have when the block reward converges to zero is the capacity you're going to end up with forever [assuming no protocol changes are made]. At the current rate of adoption, I'm estimating this capacity to be scores higher than VISA and Paypal (scalability is a different topic altogether). But we are most likely not going to utilize all that capacity - after all, there are only so many people in the world.
[END OF EDIT]


I don't like BMM not because of any technical problems with it, but for a political reason - it will confirm the association of bitcoin with other shitcoins, on a protocol level [bad press confirmed].

edit 2: spelling

[stwenhao]

it will confirm the association of bitcoin with other shitcoins, on a protocol level [bad press confirmed].

Yes, and that's why it should be introduced in a different way. The mainchain should not know, how many sidechains there are, and if there are any sidechains at all. It should be made in the "always was possible" way, for example by signing coins. By looking at some output, nobody should know, if it is a part of the sidechain or not, in the same way as you don't know, how many parties there are in a single Taproot address.

[NeuroticFish]

My point was that it's hard to get tail emission right.

You can't get tail emission right. A good TE value in a certain market conditions is an awful TE in different market conditions. The success of tail emission depends entirely on whether the number of miners stay almost-constant thoughout the lifetime on the coin. Just like in economics, there is a break-even point in the number of miners where more miners joining the network will not see an increased reward - as the price (which is dependent on users buying and selling) works independently from miners.

By supplying Tail Emission you constrain the network to a certain number of miners, and since there is no noticeable increase in hashrate, there is no corresponding increase in coin scarcity either, hence no price increase - miners will have to support themselves on a block reward (i.e. TE value) which has a fixed USD value forever.

I will get to Monero's case. There, iirc, there's "no" block size/limit. That might affect the equation - might make it different than what we have for Bitcoin, where miners can force (by plugging out vast quantities of hashrate now and then) a cluttered mempool and bigger block rewards (I know that they have to add that hashrate back before the difficulty change/detection, I know that's overly simplified and may be wrong, but it feels possible that Bitcoin miners would do dirty tricks for more money if need be).

So you're right, tail emission size may depend on more variables than we can now think of. I don't know if it's impossible to get it right ("never say never", you know), still, close to that indeed.

[ABCbits]

Your statement can be rephrased as "nobody likes their share of the pie to be decreased".

I can rephrase it further: Bitcoin users don't like their share of the pie to be decreased in some obscure way.

They don't like any departure from the 21M bitcoin limit. Which makes perfect sense.

--snip--

Exactly. Changing total Bitcoin supply would make Bitcoin immutability questionable. And if the community let such major change happen, IMO it's just matter of time before another major change happen.

I will get to Monero's case. There, iirc, there's "no" block size/limit.

Wrong, what they have is dynamic block size. It also has minimum and maximum allowed block size limit.

[o_e_l_e_o]

Just in case anyone has missed it, there is another relevant discussion taking place on the mailing list over the last 24 hours. It starts here: Security problems with relying on transaction fees for security

I was quite interested to read this snippet from Peter Kroll:

With 3000 Lightning open/ close tx per block and 6 billion adults it's 38 years of backlog to onboard the entire adult population. That's not including corporations.

It is similar to what I said in a post last year: https://bitcointalk.org/index.php?topic=5343858.msg57236745#msg57236745

So "all" that is required to ensure the long term sustainability of the security budget is to achieve global adoption. As things currently stands, this would guarantee consistently full blocks with a competitive fee market.

[garlonicon]

With 3000 Lightning open/ close tx per block and 6 billion adults it's 38 years of backlog to onboard the entire adult population. That's not including corporations.

It is true only if you assume 2-of-2 multisigs. But since Taproot, we have N-of-N multisigs, so we can onboard N users per address. And that's also another reason to think seriously about sidechains: scalability is directly related to compression. And better compression could be achieved if some users will stay on some second layers, for example inside LN. And as long as each user has to touch the main network directly, it is a bottleneck, and it needs some solution (for example sidechains, but I think it should be done in a bit different way than Paul Sztorc proposed, it should be unlimited and permissionless, so the mainchain should only track the UTXO set, and should be unaware of the number of existing sidechains, and their internal state).

[BlackHatCoiner]

for example sidechains

A CoinPool-like sidechain could provide Lightning's efficiency squared.

This topic raises the issue of whether it is desirable to have transaction activity in the main layer or to scale with sidechains. If we have the former, the system is sustainable but not operatable. If we have the latter, the opposite. Therefore, we have to find a way to make it both sustainable and operatable, but the solution is not to rely on the main layer (as it makes it non-operatable), but neither to push people on sidechains (as it makes it non-sustainable).

And the solution can't include changes to the inflation schedule as it makes it susceptible to arbitrary monetary policy.

[garlonicon]

Therefore, we have to find a way to make it both sustainable and operatable, but the solution is not to rely on the main layer (as it makes it non-operatable), but neither to push people on sidechains (as it makes it non-sustainable).

So, what is wrong with increasing block rewards by Merged Mining? If you have sidechains, you still need to handle transactions that will put coins in and out. If someone will move some coins on the main chain, then miners will earn some fees. If someone will move coins on the side chain, then miners will use Merged Mining to mine this sidechain, and will also earn some fees. So, why not Merged Mining?

[BlackHatCoiner]

So, what is wrong with increasing block rewards by Merged Mining?

I had talked about Merged-Mining with stwenhao, but that was Proof-of-Stake based.

Correct me wherever I'm wrong:

• Sidechain is a "child" of the main layer. Therefore, it inherits the same consensus algorithm.
• Sidechain blocks' hashes are included in the main layer's blocks' headers. Therefore, to mine from sidechain, you need to provide computational power to the main layer.
• Miners either find a hash that's lower from sidechain's target and higher from the main layer's target (and can only propagate it to the sidechain network), or find a hash that's lower from both and propagate their success to both networks.

So miners can mine on one chain, and the "wasted" hashes are used to secure another chain. It's reasonable to work as long as there's enough reward from the main layer. Correct?