"Surprisingly, Tail Emission Is Not Inflationary" -- A post by Peter Todd

[garlonicon]

Sidechain is a "child" of the main layer. Therefore, it inherits the same consensus algorithm.

Yes, it is based on the same consensus algorithm. But it can extend it, by adding more features, that are not present on the main chain (for example by using homomorphic encryption, then things can be first encrypted, then executed in a trustless way, and then decrypted and broadcasted to the main chain).

Sidechain blocks' hashes are included in the main layer's blocks' headers.

Some of them are, some of them are not. Because if the sidechain contains (tracks, traces, it has to be aware of it) the heaviest chain of SHA-256d headers, then it can be used to decide, how much work is needed to assign 0.01 BTC to some sidechain miner. It should be as hard as on Bitcoin, so (unlike Namecoin) it should be possible to 51% attack any sidechain only if you can 51% attack Bitcoin. Also, the sidechain can contain more block headers than Bitcoin, then each Bitcoin header is a valid sidechain header, but not the other way around, so only some sidechain headers push the whole sidechain forward, by adding commitments to the main chain.

Therefore, to mine from sidechain, you need to provide computational power to the main layer.

That is true, this is what Merged Mining is about: you want 0.01 BTC tail emission? No problem, just mine Bitcoin, and instead of receiving 7 BTC (6.25 BTC plus 0.75 BTC in fees), mine 700 times easier block, and get 0.01 BTC on the sidechain.

Miners either find a hash that's lower from sidechain's target and higher from the main layer's target (and can only propagate it to the sidechain network), or find a hash that's lower from both and propagate their success to both networks.

Exactly.

So miners can mine on one chain, and the "wasted" hashes are used to secure another chain.

Also true. Currently, those "wasted" hashes are passed to centralized pools for no reason, because technically, that problem could be solved in a pure P2P way, and that's what decentralized mining is about (using sidechains is just an option, you can decentralize mining by receiving rewards in LN as well, there are many possible solutions to that problem).

It's reasonable to work as long as there's enough reward from the main layer.

Not exactly, because you can get some sidechain fees, LN fees, or whatever fees there are in other networks. And if you are a small miner, it is reasonable to get for example 100 satoshis, by confirming some coffee-buying transaction, and it is not strictly necessary to push all of such transactions to the main chain directly. This is why other networks are needed: to allow further scaling, and to allow batching N small transactions into one huge mainchain transaction.

[1714323649]

1714323649

[1714323649]

1714323649

[1714323649]

1714323649

[BlackHatCoiner]

These two seem contradictory:

Sidechain blocks' hashes are included in the main layer's blocks' headers.

Some of them are, some of them are not.

it should be possible to 51% attack any sidechain only if you can 51% attack Bitcoin.

If some blocks are included in the main chain's block headers and some other represent "exclusively" sidechain's block headers that are not included in the main chain, then attacking the sidechain (by reversing sidechain "exclusive" blocks) is definitely easier to accomplish.

Currently, those "wasted" hashes are passed to centralized pools for no reason

"Wasted" hashes aren't passed to centralized pools for no reason. They work as shares, so that if one of the miners solves a block, the reward is distributed accordingly to the shares. Unless you meant those that don't work that way.

and that's what decentralized mining is about (using sidechains is just an option, you can decentralize mining by receiving rewards in LN as well, there are many possible solutions to that problem).

Decentralized mining does sound very cool. But, how will Lightning or a sidechain contribute to it? You still pass your shares to a third party which pays you via Lightning; isn't this the general idea?

Not exactly, because you can get some sidechain fees, LN fees, or whatever fees there are in other networks.

But, that's true as long as the system is sustainable. Sure, I can make a few sats by either staking or merged-mining in a sidechain, but since everything depends on the main chain, these are irrelevant to sustainability.

[garlonicon]

If some blocks are included in the main chain's block headers and some other represent "exclusively" sidechain's block headers that are not included in the main chain, then attacking the sidechain (by reversing sidechain "exclusive" blocks) is definitely easier to accomplish.

Why? You have one Bitcoin block with 7 BTC reward, and you have 700 sidechain blocks, 0.01 BTC each, and doing 51% attack to revert this 7 BTC should be as hard on that sidechain, as it is on Bitcoin. So, it is about tracking the difficulty, and about the same security for a given amount. You can measure that simply by relying on difficulty and amount: a combination of those two things should give you an answer about the security budget, and about the amount of work you need, if you want to reorg that.

On NameCoin, it is completely separated, where it should be joined: Merge-Mined chains should track the chain of the heaviest Proof of Work, and their block rewards should reflect that. So, NameCoin is an example of Merged Mining done wrong, because you can have a few percent of Bitcoin's hashrate, and they don't track all Bitcoin headers, but only those that are properly constructed, so you can attack them, even if you don't have enough power to attack Bitcoin. And that should be changed, to prevent that attack.

The same mistake was made by chains like BCH: if they have 1% of the BTC hashrate, then they should receive 1% of the coinbase amount, if that's what they need to maintain 10 minutes block time. Another mistake is that they splitted monetary base completely, instead of making transactions, that would be also valid on BTC, but would be just confirmed later, because of the block size limit.

"Wasted" hashes aren't passed to centralized pools for no reason.

I mean there is no reason to do that in a centralized way. There were some alternative ways, like P2Pool, and things should go further in that way, maybe also into LN rewards, sidechain rewards, and things like that.

But, how will Lightning or a sidechain contribute to it? You still pass your shares to a third party which pays you via Lightning; isn't this the general idea?

The difference is that it should be cryptographically secured. I thought about things like "pay to block hash address", when you could lock some coins on some address, and they could be taken, only by performing block validation. And I thought about compressing repeated parts, so something like that:

Code:

/---------------------------------------------------------------------------------------------------------------------------------------\
| normal address -> pay to block hash -> pay to merkle tree     -> pay to merkle proof    -> ... -> pay to transaction -> pay to output |
|                   (80-byte header)     (64-byte merkle proof)    (64-byte merkle proof)           (transaction data)                  |
\---------------------------------------------------------------------------------------------------------------------------------------/

But that's too heavy, so it should be simplified to some proofs that are more compressed, and take less space on-chain. Also, because transactions in mempools are similar, it is possible to validate repeated parts once, and then only track changes in some deterministic way. The main problem is about data compression, because technically it is possible to perform such "delayed validation" (and burn coins if someone will pass a fake block header hash or something). So, I can see two options:
1) validating basic things, and assigning coins to miners (or burning if they lied and are unable to provide a proof)
2) validating everything, and assigning coins to miners (if there are enough resources to validate everything on time)

but since everything depends on the main chain, these are irrelevant to sustainability

If you count all traffic on the main chain, all traffic inside LN, all traffic inside sidechains, and all Bitcoin-related traffic in general, and it is still not enough, then there are two options:
1) we live in a strange world, where there are no transactions at all, in any other monetary systems, because 99% people died or something
2) there are transactions in other networks, so we should think, if Bitcoin still has all needed features, and why people don't want to use it

[larry_vw_1955]

So a respected bitcoin developer is now putting out the idea that there should be more than 21 million bitcoin. Guess bitcoin's fixed supply is maybe just a pipedream...because as peter todd points out,

"An intuitive explanation for this result is that in the long run, the initial supply N0 doesn’t matter, because approximately all of those coins will eventually be lost."

too bad for people that thought the solution is just to subdivide bitcoin into smaller parts. those will eventually be lost too. and so on.

[garlonicon]

because approximately all of those coins will eventually be lost

Even if all coins will be lost or burned, then still, the system could work. By extending Script, you can treat Bitcoin as the source of Proof of Work, and execute any contract on that. Also, if all coins will be lost, then it is still possible to put "<amount> OP_DROP" inside zero satoshi outputs, and handle them correctly. And you can go far beyond that, you can use OP_ADD to sum amounts, you can execute the whole "a coin in a coin" scheme. So, losing all coins is not a limitation to the protocol.

But I think it is very unrealistic assumption that all single satoshis will be lost, and there will be no coins at all. Another thing is if we assume that, then it is possible to build another protocol on top of that, where burned coins will be treated as a one-way-ticket from Bitcoin to some altcoin, if it will be based on Proof of Burn. Because if someone is worried about matching lost coins properly, then that person should have any algorithm to predict, how many coins are truly lost. Counting OP_RETURN, taking less coins in the coinbase, and other obvious things is simple. But what about trap addresses? What about coins that didn't move for N years? It is an open question to those altcoin creators, how they want to count that.

[tadamichi]

Guess bitcoin's fixed supply is maybe just a pipedream...because as peter todd points out,

Its not, there will be enough nodes that will never accept this change, so there will always be a fixed supply Bitcoin.

"An intuitive explanation for this result is that in the long run, the initial supply N0 doesn’t matter, because approximately all of those coins will eventually be lost."

too bad for people that thought the solution is just to subdivide bitcoin into smaller parts. those will eventually be lost too. and so on.

Bitcoins are backed up in a physical way(Steel, paper, whatever) and stored like any other valuable item. Is all gold lost, if we stopped finding new one? I dont think so. There is maybe 2 kinds of different people, the people that dont manage to take care of it well enough, and people that find ways to do it, and never/barely lose anything.

Backups can also be found again/stolen, or Coins can be transfered into a new wallet with a new backup, if the backup was lost but theres still access to them. This assumption will probably fail in practice, lets prove it, instead of claiming the species that is hoarding the most ridiculous things, is unable to hoard Bitcoin back ups at all, that are actually valuable.

So then we also have new ways to eliminate single points of failure trough multi sig, you can store seeds in different places and it doesnt matter if you lost however many seeds you specified beforehand. This is something not even gold or anything else has, imagine you could recover a full 5 ounces of gold, if you just need to manage to store 3 of them safely(or 3 of 5 access keys, if we want to be more accurate). And then its always possible to update the security model by just transfering coins into another wallet for example, if you have already noticed that 1 seed is lost/ compromised.

If theyre backed up digitally, its also likely for them to get into some hand that knows how to store them safely, after enough tries.

Bitcoins success wil likey depend on the properties it offers and not on the amount of coins in circulation. It can store the same amount of value, no matter if theres 15 million or 5 million coins in circulation, then it just incentivises people to even take more care of their satoshis, as the value of each individual satoshi rises. And rewards the people that keep them secure. Bitcoin is highly divisible, the circulation can actually be handled by subdividing it into smaller parts, this wont mess people up, that didnt mess up themselves, that is the subtle difference to inflation.

A tail emission is like debasing a currency, if we start to mix copper into gold, we can act like we have gold more coins, but once people realise this they will switch into alternatives again and the value of each individual coin falls in value. And the properties of your currency changed, so more and more people might not even want it anymore. There has been many attemps troughout history to fix problems trough debasement, but it never brought desirable results for the majority of users and never lead to a ultimately successfull currency.

[fresheneesz]

The way I see it:

* tail emission of a fixed number of bitcoin trends towards 0 inflation and is therefore not different in the long run from a fixed supply.
* tail emission as a fixed percent of bitcoin is forever inflation. This does have an effect, but as noted by many in the "Bitcoin covenants are inevitable" email thread on the dev mailing list (which went off the rails as a discussion of blockchain security and targeting/funding of that security), doing this does increase the amount of security (all other things kept equal). However, choosing an arbitrary forever-inflation-rate does not ensure that blockchain security will always be sufficiently funded, unless we can find some upper bound on required blockchain security (in terms of percentage of total coin supply).
* Some have mentioned that people lose coins. I don't think this fact is worth considering - ie its not significant. The future rate of lost coins will decrease towards 0, and is likely already nearly 0 today.

If for some reason we determine that we *can't* sufficiently fund miners with fees alone (which I think is a very real, but unlikely possibility), then adding a percentage-based tail emission would be basically our only option. However, I agree with most that until we find that to be the case, its likely a very dangerous thing to attempt to do to bitcoin. Even tho there are reasons of economic efficiency for holders to pay some of the cost of bitcoin's security (via inflation) in addition to transactors (via fees).

[BlackHatCoiner]

Why? You have one Bitcoin block with 7 BTC reward, and you have 700 sidechain blocks, 0.01 BTC each, and doing 51% attack to revert this 7 BTC should be as hard on that sidechain, as it is on Bitcoin.

Oh. So sidechain's difficulty is based on main chain's difficulty. That makes sense.

I mean there is no reason to do that in a centralized way. There were some alternative ways, like P2Pool, and things should go further in that way, maybe also into LN rewards, sidechain rewards, and things like that.

P2Pool.io? I'll have to study further as I'm not knowledgeable enough on this field. My understanding goes as following:

• Pool gathers shares, until one of them is below the target.
• Miners work on hashing block headers that reward pool's address.
• Once a miner finds it, he sends it to the pool, and the pool rewards everyone accordingly to their shares.

Can't think of a decentralized alternative, but I'll read the link.

If you count all traffic on the main chain, all traffic inside LN, all traffic inside sidechains, and all Bitcoin-related traffic in general, and it is still not enough, then there are two options:
1) we live in a strange world, where there are no transactions at all, in any other monetary systems, because 99% people died or something
2) there are transactions in other networks, so we should think, if Bitcoin still has all needed features, and why people don't want to use it

That was not my point. My point was: For sidechain X to work properly, there has to be activity in the main chain. But, the usage of the sidechain X reduces the activity of the main chain, and therefore contributes to make itself useless.

For example, if every bitcoin user eventually switched to Lightning and made nearly zero transactions on-chain, the fees wouldn't be sufficient for the system's security. And if there's no security, there's no Lightning utility either.

Guess bitcoin's fixed supply is maybe just a pipedream...because as peter todd points out,

Just because we're criticizing it, it doesn't mean it's a "pipe dream". We're making discussion here.

[garlonicon]

then adding a percentage-based tail emission would be basically our only option

Why? Miners enforce fees, and they can make transactions with too low fees non-standard, it is a matter of changing some parameters in the Core client, no forks are needed at all to make fees lower or higher. Any node operator can do that, and any mining pool can enforce that. Then, whales will be forced to sell some of their coins, to invest into mining.

Another thing is that tail supply can be reached by taking coins from people, without increasing 21 million coins limit. Then, it will be obvious to everyone, what this proposal is truly about. Because if more coins will be produced, then it is more sneaky, because many people don't understand, how inflation works, but if they will start losing satoshis, then they will see that in a crystal clear way.

For sidechain X to work properly, there has to be activity in the main chain.

True, there will be some activity, related to peg-ins and peg-outs, in the same way, as LN channels are opened and closed. The same will happen in the sidechain. You can imagine a sidechain as a one, huge, N-of-N multisig, where you have a single sidechain output that is pushed forward. But it is not the whole picture, because more things are needed, to allow making the whole flow, without always interacting with all participants (because if someone has 1 BTC on the sidechain, and if that amount is left untouched, then no activity from that person should be needed to make changes in the sidechain).

But, the usage of the sidechain X reduces the activity of the main chain, and therefore contributes to make itself useless.

Not really, because even if you can see zero on-chain reward in the coinbase transaction, then the whole block is still needed as a Proof of Work confirmation for everything, that is attached into it. So, if the coinbase reward on-chain is zero, it doesn't mean that there is no activity. It could mean as well, that the whole activity is in connected networks, and then, if you reorg it, you will make all people angry, that are inside those networks, so the total security budget is the on-chain coinbase reward, plus all rewards from all connected networks.

To put it in other words: if you have a chain, where there are no coins at all, zero coin supply, only zero amounts are allowed by consensus rules (because some network started in that way, or because all coins were burned or lost, it doesn't matter), and you have block headers with 80 zero bits, then tell me: is that network strong? Because I think it is, even if it is just a source of the Proof of Work for things that are attached into it. Because to reorg a block, you need to mine another block with 80 zero bits. And it is hard, no matter if the coinbase reward is zero or one million coins. And imagine that those zero satoshi outputs could just trigger things on other chains, just by requiring a valid signature for that output. Is it safe? Because I think it is.

Just because we're criticizing it, it doesn't mean it's a "pipe dream". We're making discussion here.

True, and I think it will be easier to resist that "tail supply attack" than make it real. Or maybe people will be forced to make it in some less obscured way, when all additional coins will be explicitly listed, or when all additional coins will be explicitly taken from users, and passed to miners in a direct way, because that's what this proposal is about.

[BlackHatCoiner]

Miners enforce fees, and they can make transactions with too low fees non-standard

Miners can't force you to create transactions, though. That's what this problem is all about in the end. Not having enough transactions in the main chain.

Another thing is that tail supply can be reached by taking coins from people, without increasing 21 million coins limit.

Taking 1 satoshi for every 0.01 BTC (for example) is the same as having tail emission. It violates the resistance to arbitrary monetary policy.

So, if the coinbase reward on-chain is zero, it doesn't mean that there is no activity. It could mean as well, that the whole activity is in connected networks, and then, if you reorg it, you will make all people angry, that are inside those networks, so the total security budget is the on-chain coinbase reward, plus all rewards from all connected networks.

So, the idea is: Mine in the main chain with no main chain reward, but with X reward in sidechains. Therefore, we're talking about a slow transition to sidechains. So what will the sidechains' reward be if there cannot be any new coins brought into circulation?

And imagine that those zero satoshi outputs could just trigger things on other chains, just by requiring a valid signature for that output. Is it safe? Because I think it is.

What's this smell? Proof-of-Stake? 

[tromp]

Another thing is that tail supply can be reached by taking coins from people, without increasing 21 million coins limit.

The entire point of having a supply cap is to prevent dilution of one's bitcoin hoard.

Taking coins from hodlers to provide security while preserving this limit is thus sheer folly.

[garlonicon]

Taking 1 satoshi for every 0.01 BTC (for example) is the same as having tail emission. It violates the resistance to arbitrary monetary policy.

But monetary policy was never "arbitrary", when it comes to coin creation. Satoshi decided it should start from 50 coins, and be halved every four years. You agree on that by using Bitcoin, so it is not arbitrary from the very beginning. Another thing is "1 satoshi for every 0.01 BTC" or similar ideas can be introduced on transaction acceptance level, there is no need to enforce that on protocol level. So, one miner can require locking coins for future rewards, or simply demand higher fees, while another miner could require smaller fees. Then, it is all about competition.

What's this smell? Proof-of-Stake?

Well, zero satoshis have many use cases. I thought more about things like swapping coins, delaying amount calculation, or even Monero-like amount hiding. Also, any kind of P2P messaging could be built on top of that, and then only nodes supporting that will ever receive this kind of traffic.

Edit: Also, it was a general idea of "connecting scripts with AND logical operator". Because you can create dust (or better: zero satoshi) output, and take it as an input in some transaction, then you can concatenate scripts. So, it may be also about "<some> <scripts> <that>" AND "<are> <too> <long>" AND "<to> <fit> <in>" AND "<a> <single>" AND "<output>" AND "<script>". The best solution would be to just introduce OP_DO_SOMETHING, but when reaching consensus on that is hard, then there are two options:
1) use another network that is connected to Bitcoin, and execute it in a simplified way on that additional network
2) use Bitcoin directly, and pay for a longer (or just more complex) script
It is also about any protocols, when you consider dynamically changing spending conditions, based on circumstances, then you simply decide, which zero satoshi inputs you want to include in a given transaction, to decide, which conditions are signed, and which are not (and to also use UTXO to solve "require only one possible way" problem, so if some condition will be used and confirmed, then other parts will be automatically invalidated).

[BlackHatCoiner]

But monetary policy was never "arbitrary", when it comes to coin creation.

Monetary policy isn't coin creation. Coin creation is part of the monetary policy, and so is money distribution, which does not currently include a tail emission "tax".

So, one miner can require locking coins for future rewards, or simply demand higher fees, while another miner could require smaller fees. Then, it is all about competition.

But, this isn't sustainable, because part of the current reward is essentially put aside for the future. In other words, there's no continuous tail emission "taxation" similar to "inflating to infinity", because the miners informedly decide to use a finite part of their money for the future. What will the incentive be once that's re-rewarded? Nothing more than transaction fees, unless they perform some sort of "Transaction Fee Halving", which will gradually reveal weaknesses.

[larry_vw_1955]

because approximately all of those coins will eventually be lost

Even if all coins will be lost or burned, then still, the system could work.

No it couldn't. That's why a tail emission is needed, as he points out.

But I think it is very unrealistic assumption that all single satoshis will be lost, and there will be no coins at all.

It's a mathematical certainty...well almost.

Its not, there will be enough nodes that will never accept this change, so there will always be a fixed supply Bitcoin.

Miners are nodes and miners would go along with it because it helps prop up their income. They're going to need that oneday since block rewards go to 0. They'll be advocating for this too.

Bitcoins are backed up in a physical way(Steel, paper, whatever) and stored like any other valuable item. Is all gold lost, if we stopped finding new one? I dont think so. There is maybe 2 kinds of different people, the people that dont manage to take care of it well enough, and people that find ways to do it, and never/barely lose anything.

None of that matters because **almost** all of the original 21 million bitcoins will eventually be lost oneday. Doesn't matter how they are stored, on what medium, etc. Gold is different. some gold is probably lost in landfills but you can always dig more out of the ground. you can't do that with bitcoin. block rewards eventually equal 0.

[garlonicon]

No it couldn't. That's why a tail emission is needed, as he points out.

Then tell me, why it is so hard to mine on testnet3? Those coins are totally worthless, and still, you can see quite high difficulty on that network, so it is hard to mine it on CPU, except those moments, where the difficulty temporarily drops into one. I think a chain with zero supply could be a quite good test network, and could still work, because the whole Script is complex enough to provide "a coin in a coin" functionality.

It's a mathematical certainty...well almost.

I think it is not a mathematical certainty, because even if coins will be totally burned, then if a chain will have zero coins at all, it can still be pushed forward, when the Script by itself will protect some kind of transactions. Also, imagine a coin, where all coins are always burned. Guess what: reorging the last burned coin is profitable, and splitting that last satoshi into smaller fractions is enough to keep it alive. So, I don't think miners will burn the last satoshi that easily, unless they will be convinced by profits to do that.

Gold is different. some gold is probably lost in landfills but you can always dig more out of the ground. you can't do that with bitcoin.

You can. 1CounterpartyXXXXXXXXXXXXXXXUWLpVr is a valid trap address, and it is very likely that there is some matching key. So, it is hard to "dig more out of the ground", but mathematically speaking, it is very likely to be possible in the future, when some hash functions will be broken. Also, mining by itself is a constant, ongoing attack on SHA-256. But you can mine anything, you can mine a vanity address for someone, and sell it in a trustless way. Miners gonna mine, that way or another, unless you stop their computers remotely, and ban message encryption, because that level of censorship is needed to stop CPU mining.

What will the incentive be once that's re-rewarded? Nothing more than transaction fees

I think those fees alone will be more than enough, because you can use Merged Mining, and by mining zero satoshis on Bitcoin, you can also get N satoshis from some sidechain, at the same time, for the same work. Also, if some sidechain will have a fraction of the Bitcoin power, then those miners could be rewarded in a proportional fraction of the fees, collected from sidechain transactions, and the rest can be allocated for the future. So, you have 1 BTC sidechain fees, and you mined 100 times easier block than the mainnet difficulty? No problem, just take 0.01 BTC, and lock the rest 0.99 BTC for the future.

[BlackHatCoiner]

They're going to need that oneday since block rewards go to 0.

The block subsidy going to zero doesn't mean that the block reward will ever go to zero. Since the beginning, it was well known that after 2140, miners would only rely on fees. At some point after block 1,470,000 wherein the block subsidy will be 0.39062500 BTC, I speculate that the fees will become the main source of income.

None of that matters because **almost** all of the original 21 million bitcoins will eventually be lost oneday.

Do you have a proof for that?

Gold is different.

Gold isn't a good analogy, because it doesn't require transactions to operate.

[aliashraf]

It has been abundantly clear to me that most bitcoin issues like mining centralization, scaling, slow adoption, zero/little subsidy dilemma, regulatory/gov vulnerability concerns, … are reducible to one canonical issue: the topology problem. In this thread, so many people have come to the same conclusion, somehow, it is good news.

Glad to see how this sub-forum has improved in just one year,  thanks to people like @galonicon, @vjudue, @BlackHatCoiners, etc. who have brought fresh blood, no need to mention elder hands like @EtfBitcoin, @odolvlobo, @tromp, etc. or forget Greg Maxwell, Peter Todd, others.

I just finished reading every post and followed every single reference made here and found myself motivated enough to write down a summary and a conclusion (from my own point of view, of course).

I'll do so in a few hours, but for the time being can't help it not to express my (well, almost) complete support for what @galonicon is advocating here.
Actually I've been busy for months, designing/prototyping a framework for integrating a bitcoin centralization/scaling solution based on side-chains concept, where the main challenge is the existence of an impedance layer and the need for a strategy and commitment for dealing with this impedance.

It is an unexplored software engineering terittory: decentralized consensus based systems, where you have almost zero authority, no order/contract/PID while the system is up and running as a mission-critical one and at the same time resistant to change. Good luck succeeding without a framework and a clear roadmap.

P.S.
I was used to avoiding the term roadmap in this context. It reminded me of VB and his “Foundation” and what they did (and still are doing) with their Ethereum project. Now, I think it is better not to surround, so let's ignore the way they (mis)understand and (mis)use a decent engineering concept: roadmap.  

[tadamichi]

None of that matters because **almost** all of the original 21 million bitcoins will eventually be lost oneday. Doesn't matter how they are stored, on what medium, etc.

It matters, its like assuming all gold in fort knox will magically disappear from earth one day. There is already high security, remote facilities/ bunkers in the swiss alps storing billions in bitcoin, safe from atomic blasts and everything, so lets just assume they didnt think of eliminating human errors from the process, but everything else(totally realistic). These locations could possibly exist in more places in the world. Regular peoples Bitcoin back ups are most likely stored in some places that are way easier to access, than digging out some new gold. Its even possible to still use backups when only some words are missing/wrong, by bruteforcing, so they dont even have to stay in perfect condition to be recoverable.

We can assume that there is also an amount of Bitcoin that is being recovered/ will be recovered. For now its true that some Bitcoin is lost forever, but as long as humanity lives in a civilization, we can probably assume that the ratio of lost/recovered Bitcoin will get close to zero one day. Or that a big enough amount of Bitcoin will simply never be lost, if no more Bitcoin will be recovered(In a timeframe that matters for civilization).

you can always dig more out of the ground.

What theoretical scenario is there where all already digged out gold would vanish from earth forever, that humanity would survive? It just doesnt matter.

block rewards eventually equal 0.

The market value amount of the block reward counts. We already counted out the possibilty of all Bitcoins being lost now, in a scenario that matters for civilization. With a tail emission you risk lowering that market value as it is debasement of the currency. In the scenario where the added tail emission doesnt have enough market value to secure the network, you could fall into the same debasement spiral as any other currency that started debasement fell into. You will need more and more debasement to pay for security, but users will start to drop out, because their currency is becoming worthless and there would be better alternatives for storing value competing in that situation. Bitcoin is competing against many assets and currencies worldwide, we cant assume it has already won forever and tail emissions will simply pay miners more in any situation. The possibility that the current Bitcoin protocol can be more profitable to miners/ more beneficial to users is there, and more likely to me personally.

[larry_vw_1955]

The block subsidy going to zero doesn't mean that the block reward will ever go to zero. Since the beginning, it was well known that after 2140, miners would only rely on fees. At some point after block 1,470,000 wherein the block subsidy will be 0.39062500 BTC, I speculate that the fees will become the main source of income.

well that's a big speculation. what if the fees are too low then what? miners can't set the fees. competition for block space sets fees. it's certainly possible that bitcoin has a problem in this area and will have to come up with a solution to it.

None of that matters because **almost** all of the original 21 million bitcoins will eventually be lost oneday.

Do you have a proof for that?

No but peter todd does. if you read over his paper he proves it. it's a mathematical certainty. something you can't avoid. simple as that. the good news is if you have a tail emission equal in rate at which coins are lost then you can stabilize the bitcoin supply. that's the way to go. as he shows in his little whitepaper.

You can. 1CounterpartyXXXXXXXXXXXXXXXUWLpVr is a valid trap address, and it is very likely that there is some matching key. So, it is hard to "dig more out of the ground", but mathematically speaking, it is very likely to be possible in the future

Well if you're relying on addresses like this one to have a discoverable private key for the supply of bitcoin to not go to 0, then that doesn't seem like a very good thing to have to do to guarantee the bitcoin supply doesn't go to 0. Just think of that address as funds that are lost forever because most likely that is what they are. And the thing is if you can hack an address like that then bitcoin is broken anyway.

It matters, its like assuming all gold in fort knox will magically disappear from earth one day. There is already high security, remote facilities/ bunkers in the swiss alps storing billions in bitcoin, safe from atomic blasts and everything, so lets just assume they didnt think of eliminating human errors from the process, but everything else(totally realistic). These locations could possibly exist in more places in the world. Regular peoples Bitcoin back ups are most likely stored in some places that are way easier to access, than digging out some new gold. Its even possible to still use backups when only some words are missing/wrong, by bruteforcing, so they dont even have to stay in perfect condition to be recoverable.

peter todd assumed that there is a constant "loss rate" of bitcoin. so you're saying you disagree with that assumption? if it's not a constant rate then what is it exactly?

[garlonicon]

what if the fees are too low then what?

Then you have three options, where tail supply seems like the worst: you can increase block size (that is bad idea, and was discussed in the past, you can follow chains that did it, if you want), you can use tail supply (that is discussed now, but if you do that once, you will keep doing that forever, as it was done in fiat currencies), or you can use Merged Mining, create a separate chain, that will produce as many new coins as you want, and can easily follow the mainchain difficulty. So, if there are no coins, and the mainchain difficulty is X, then you can generate new_base/N coins by mining a block with X/N difficulty. It is that simple.

And then, I expect that if there will be two sidechains, one with tail supply, and one without, then the sidechain with additional coins will die. But I don't think tail supply supporters will be convinced to that: they should try, and see, how everything will play out. Fortunately, it is hard for tail supply supporters to attack the finite supply: any hard-fork can be easily rejected by not upgrading, so don't even think of it, because it will be unnecessary fork, and will quickly become an altcoin. When it comes to soft-fork, it is also hard, because then it is about taking single satoshis from everyone, including burned addresses, or about creating zero satoshis, and treating them as coins with non-zero value. And there is also a no-fork, when each miner can enforce its own fee policy, and lock as many coins as needed for the future.

miners can't set the fees

Well, they actually can. You have one satoshi per virtual byte only because it is de-facto standard, and reasonable defaults. But you can always convince miners, that they should set it to 100 satoshis per virtual byte. And if they simply change their configuration file, without changing any line of source code of the Bitcoin Core, then guess what: they will accept only those transactions! It is a matter of configuration, each node can enforce higher or lower fees, and still stay in the network. And if some node is a miner, then it can enforce that.

competition for block space sets fees

Maybe in altcoins, but not in Bitcoin, because the minimal fee is constant by default. You could have 50 MvB of transactions with one satoshi per byte. Then what? If you are in a hurry, you can pay more to increase those fees, by using RBF or CPFP. But there are alternatives: you can use LN, you can use altcoins, you can use fiat. If all of that works, then you are not in a hurry. People would be forced only if Bitcoin would be the only way to pay for something.

it's a mathematical certainty

No, it is based on assumption that coins will always be lost. And also on assumption that this is somehow bad. Guess what: we have too many coins, and new features are created on altcoins, instead of being based on Bitcoin. So, currently there are too many coins, and more can be created from a thin air. Altcoins caused a lot of inflation in the crypto world: we are not in a situation, when there are only 21 million coins in the whole world, and when all altcoins are sidechains: we are in a situation, where there are 21 million bitcoins, and where everyone can inflate that crypto world, trying to compete with Bitcoin, and lower its domination, so that sentence from Satoshi is still far from being real: "Instead of fragmentation, networks share and augment each other's total CPU power".

something you can't avoid

You can. Tail supply is just one of at least three options.

if you have a tail emission equal in rate at which coins are lost then you can stabilize the bitcoin supply

And what algorithm will be used to determine, if some coin is truly lost or not? Because producing wrong amount will result in having too much tail supply, or not enough tail supply.

if it's not a constant rate then what is it exactly?

It is random. You can track OP_RETURN outputs, you can track coinbase rewards, you can easily exclude provably burned coins. But there are a lot of trap addresses, when you don't know if someone has any access to those coins or not. You simply don't know. And you cannot assume that "this coin was not moved for 20 years, so let's grab it". It is like stealing. And producing tail supply is also stealing, the only different thing is stolen amount, and the fact that it is done from everyone.