Abstract— The current economic incentives of the Bitcoin network result in a tragedy-of-the-commons that could result in transaction fees eventually falling to zero. This is because the marginal cost of mining each transaction is zero for the individual miner (assuming O(1) block propagation), but non-zero for the network. If all miners are capable of externalizing the cost of mining ‘spam’ transactions, and if anyone can mine, then nothing within the consensus protocol today exists to establish a market price for transaction fees. As a result, miners must either rely on charity, or form cartels outside of the consensus protocol to enforce transaction fees. One solution to this problem is to require a local difficulty correction for each block based on the size of the block in bytes. Blocks that are larger or smaller than the network average would require a slightly more or less difficult proof-of-work respectively. The result would be that less efficient miners with a higher marginal cost of mining would be required to mine only the highest fee transactions in smaller than average blocks, and leaving lower fee transactions for more efficient miners. Those most efficient miners will be able to mine larger blocks at a net discount per byte when compared with their less efficient counterparts. If the difficulty correction per byte is sub-linear, then very large block will always become profitable eventually, so that even extremely low fee transactions will eventually be mined, although with significant delay. No-fee transactions will always cost miners in the form of increased difficulty, and therefore will only be mined as charity. A localized block difficulty does not need to change the block interval, the coinbase schedule, or alter any of the economic incentives that have made Bitcoin successful up to the present time, although attention must be given to the special (current) case where the coinbase is larger than the transaction fees. It would, however, require the addition of a block size field in the header. Localized block difficulty would be ideally suited for a sidechain where there is no block reward.
I. INTRODUCTIONIf proposals for O(1) block propagation are successful, then the cost of mining will be dominated by hashrate. However, there is no correlation between the amount of data published to the blockchain and the hashing required to publish it. As a result, a spam-miner can mine all transactions irrespective of their transaction fees with no additional cost to themselves. A small minority of miners could impose a situation where all transactions are mined, even no-fee transactions. If no-fee transactions are mined, then only charity remains as the motivation for including a transaction fee.
One possible solution to this is to keep the block size limit low enough to cause a market to form which causes users of the network to bid for space in each block. The difficulty with this approach is that it requires a central planner to correctly guess the growth rate of the network and determine the ‘correct’ size based on a subjective opinion of the legitimate uses of the blockchain (i.e. store of value vs. microtransactions).
Another possible solution is for the majority hashrate to form a cartel and censor spam-miners. This is undesirable because it encourages consensus outside of the consensus algorithm, which ultimately is not public and cannot be audited. The best solution to incentivizing the payment of transaction fees would conform to the following principles:
- The mechanism for creating a transaction fee market should be built into the consensus algorithm as much as possible so that it is public, auditable, and enforceable by all individual node (i.e. wallets and holders of bitcoin).
- The solution should not assume the growth rate of the network, and should work equally well regardless of the use cases of Bitcoin that develop.
- The solution should be as conservative as possible with respect to making changes to the protocol, and should not change any fundamental parameters of the inflation schedule or block time.
II. INDIVIDUAL BLOCK DIFFICULTYLet D be the global difficulty of the network, and d be the target difficulty for an individual block based on its normalized size in bytes (s) relative to the average size for the network, calculated every 2016 blocks. We can define d as
https://i.imgur.com/iLm0MID.jpgIn this case, the average difficulty (d) is equal to the global difficulty D, therefore the block rate remains constant at 10min on average. The function is well behaved and should not cause divergence away from the mean block time and size.
The validity of each block would be determined by the POW hash meeting d, not D. If computational resources are extremely limited, it may be desirable to create a lookup table every 2016 block for valid d values to avoid numerous floating point operations. In order to preserve self-validating headers, the header must contain a new field to capture s.
III. ECONOMIC CONSEQUENCES OF VARYING BLOCK DIFFICULTY https://i.imgur.com/nVaRQqn.jpgThe first thing to note is that if a block is smaller than average, the difficulty to mine this block is less than the average difficulty. For simplicity, the following discussion assumes minimal block reward, which is the condition under which a robust fee-market is required. However in the interim the implications of the block reward must be addressed. For this discussion see section IV.
In the absence of a block reward, a miner can mine small blocks at a reduced difficulty. The marginal cost per block (in hashrate) would be higher, so that only the highest paying transactions would be profitable to include in a small block. Assuming a roughly power-law distribution in fees paid, the cutoff for transactions included in the block will depend on the marginal costs of the miner. Efficient miners will be able to produce larger blocks profitably, while less efficient miners will need to be selective and will produce smaller blocks on average.
The pool of unconfirmed transactions is unlikely to follow any simple distribution because as blocks are mined, the highest fee transactions will be pulled from the pool first, causing the tail of low-fee transactions to grow relative to the high-fee transactions. Eventually, the pool of low-fee transactions will grow large enough that it will become profitable to mine a super block (i.e. 10x the normal network size) due to the decreasing difficulty per byte. As long as a transaction pays a fee greater than the marginal cost of the most efficient miners, it should always be picked up in a superblock.
Although it’s difficult to model the behavior of such a system, it seems reasonable that a natural frequency would start to emerge where a distribution of small and average sized blocks are mined continually until enough hashing power is incentivized to mine a super block, which might start to occur at roughly regular intervals. Individual behavior of wallet users might start to predict this and pay lower fees as the expected super block approaches. However, because the marginal cost per transactions is continually changing as the pool size changes, it is not clear that any one mining strategy will emerge as the only strategy.
Under no circumstances will it ever be more profitable to mine lower-fee transactions and not higher-fee transactions. However, if the miner experiences real costs associated with increasing the block size, their expenses measured in electricity and equipment will place an absolute floor on the minimum transaction fee that will not result in a loss for the miner.
IV. VARIABLE BLOCK DIFFICULTY AND BLOCK REWARDSIn a setting such as a sidechain where there is no block reward, equation 1 would work well. However, if the block reward is much greater than the transaction fees, there is an incentive to mine the smallest block possible because of the reduced difficulty of blocks smaller than the network mean. This will create a race to zero block size. To prevent this, the block difficulty should be limited such that
https://i.imgur.com/1PtIAKM.jpgwhere m starts at 1. It may be wise to have m decrease by 0.1 every block reward halving so that there is a known schedule for the reduction in the minimum difficulty.
V. BEHAVIORAL IMPACT TO VARIOUS PLAYERS- The spam miner – The spam miner is a minority miner who wants to include all unpaid transaction in the blockchain. This miner could accomplish this by including only small amounts of spam, and would always do so at their own expense because their increased block size will result in increased difficulty for themselves only. The more spam they mine, the more uncompetitive they become at producing blocks.
- The greedy miner / cartel of miners – This miner or cartel of miners refuse to mine any transactions except for transactions above some artificially high price. In this case, the cost of mining the average-fee transaction decreases as the transaction pool grows, so that eventually the greedy miner will need to pass up a large number of profitable transactions to maintain his artificial requirement.
- The fake-transaction miner – This is the miner who pads his transaction with fake data to increase the block size. In this case, the miner will be hurting himself because he will artificially increase the difficulty of his own blocks.
- The cheapskate – This is the bitcoin holder who refuses to pay a fee comparable to his peers. If his fee is simply too low, the added difficulty/byte will never reach a profitable point for a miner to include it in a block. The cheapskate will need to rely on charity of a miner to get his transaction published.
VI. ATTACKS- Increased risk of 51% attack and double spends - If the polynomial chosen for block difficulty vs. size gives a discounted difficulty for blocks less than the mean size for the network, then an attacker wanting to perform a 51% attack could inflate their effective hash power by generating small blocks during the attack. For instance, if a double-spender controls 15% of the hash power, their effective hashing power with blocks 1/10th the network average size would be 1.82 times larger, making it appear for the attack purposes that they control 27.3% of the network hashrate. However, this behavior would be mitigated by the fact that the miner would need to perform this attack by mining smaller blocks, which would result in them leaving profitable transaction fees un-mined for other miners. In the case where the dishonest miner can achieve an effective hashrate above 51%, they may be able to recoup this loss at the end of their chain. This attack would need to be mitigated by choosing a polynomial that does not provide significant discount for small blocks, or by a simple min(f(D),l) limit. [Credit to jonny1000 for this contribution to the discussion]
VII. THE SLOW DRIFT PROBLEMOne scenario that isn’t solved is the slow drift problem. What happens if the average transaction fee slowly drifts lower and lower such that eventually the bitcoin network is no longer secure yet everyone is paying the average transaction fee? This seems like a rather hypothetical situation, and there is no obvious reason to insist this will necessarily happen. However, in the event that his happens, equation 1 can be generalized such that
https://i.imgur.com/GXkK4M9.jpgwhere i is the inflation rate of the hash power desired to maintain 10min block time. Adjusting i to 1.02 will require a 2% increase in the hash power such that D remains constant. If i were ever to be adjusted, it could be adjusted through some proof-of-holding mechanism, although such a process would need to be reserved for a case in which no other mechanism exists to secure the network. The meaning of this would essentially be the network demanding that “the hashrate might increase by 2% per 2016 blocks regardless of the fees paid.” The failure to meet this imposed growth in hashrate would be that the block time would slowly drift slower and slower until more hashpower is added to restore the blocktime.
VIII. Closing ThoughtsIt is my belief that the block size must increase, and therefore something in the consensus algorithm must change. However, increasing the block size indefinitely could very likely remove the only existing incentive (except for charity) to pay a transaction fee. There is no relationship between the amount of data being securely stored on the block chain and the cost of securing it. This leads to a scenario where transaction fees could go lower than the marginal cost of mining, essentially destroying the security of the Bitcoin network.
As a user of the network, I should be purchasing security. If the addition of my transaction requires additional hash power, then the miner now has a need to require a fee of me. This need can be built into the consensus algorithm such that all participants in the network know the origin of nature of the mechanism that gives rise to the fees.
EDIT 02-16-2015: The equations were copied wrong. Pointed out by gmaxwell
EDIT 02-17-2015: Changed some title headings for clarity and added a comment about the risk of 51% attack.
