Topic: "Surprisingly, Tail Emission Is Not Inflationary" -- A post by Peter Todd - page 7. (Read 2760 times)

True. It is just another attack on Bitcoin, and it should be stopped, also by informing people, what it is truly about.

Well, Paul Sztorc correctly predicted that those three options will be on the table. Block size increase was discussed many years before, increasing supply is now, so maybe it is a chance to introduce Merged Mining as the solution to kill those two ideas, before they will grow further? Also, people should be aware that tail supply is basically the same as taking single satoshis from everyone, from every address, no matter what, and passing that to the miners. It is effectively the same, just done in a more obscure way.

Fortunately, we can reject any hard-fork by default, because BTC in 2017 chose the path of rejecting hard-forks if they are unnecessary. And fortunately, any tail supply soft-fork will reveal the true nature of that change: it will require producing zero satoshis, or moving coins from users to miners, or locking coins by miners. So it will truly reveal the whole process of taking satoshis from everyone, to form future rewards.

And by thinking, what is really needed if the supply will still be fixed, and if we want to get an equivalent of tail supply, everyone should clearly see, that such change has negative impact on Bitcoin, and should be stopped. Also, fortunately, introducing counter-proposals that will burn all additional coins, is easier than creating them, so it should be enough to resist this attack.

I quote myself here.
It's funny, I said the problem with fixed rewards is that it induces politics... and look what happened after my thread: A lengthy political discussion. 

Break Bitcoin now because it might break at some unspecified time in the future. Great idea

Yes. And this should show clearly, what tail supply is really about: it is about taking single satoshis from all accounts, no matter what, no matter if coins are burned or not, no matter if someone wants that or not. So, it is all about creating an invisible tax on all addresses. If some coins are fully burned, for example by using OP_RETURN, then they cannot be moved. But tail supply is about taking single satoshis from those addresses as well.

So, you know what is needed: zero satoshis. Then, it is possible to create some additional outputs, send zero satoshis there, and use " OP_DROP" as an output script (or this " OP_DROP" could also be placed inside witness script, or as an input, many things are possible). It could be handled in the same way as Segwit vs NonSegwit: if it was possible to create a situation, where old nodes cannot see new signatures, then it is also possible to create a situation, where old nodes will not see new amounts (there could be many reasons, for example if hiding amounts will ever be introduced, then it is reasonable to put zero for backward compatibility, but the same solution can be used to introduce any coins to the system, because the size of the UTXO set is not limited). And then, it is all about human factor: if those zero satoshis will be really used to move real values, then they could be traded, bought, sold, and used in real life. If it is possible to create NFTs out of thin air and sell them for millions, then why producing coins out of thin air and selling them for real goods and services wouldn't work as well?

Quote

what are the main arguments against using merged mining to create security once the block subsidy is insufficient?

The main arguments are that sidechains can be unsafe. So, that means they will be created anyway, there are many options, how exactly it would happen:
1) it can be deployed on altcoins
2) it can be deployed on second layers like the Lightning Network
3) it can happen on centralized websites, like exchanges or casinos
4) it can turn out that homomorphic encryption is sufficient to deploy sidechains on the main network
5) other features can enable sidechains by mistake, just because developers can be unaware that some feature enable more things than intended
So, I think it will happen anyway, that way or another. Definitely, homomorphic encryption is a powerful tool, because it can enable new features in a permissionless way.

Quote

Is there any ongoing discussion or work on blind merged mining protocols (such as BIP 301)?

Yes, you can talk directly with Paul Sztorc and other people on Telegram.

Edit:

Quote

If merge miners only make a small fraction of their revenue from bitcoin, then it becomes rather cheap to bribe them to mine censoring bitcoin blocks.

It depends. If other networks will have 1:1 peg into Bitcoin, then even if you can see that some miner received zero satoshis on-chain, that miner could get more satoshis in other networks, and everything could be just finalized on Bitcoin. I think a situation, where there would be only 21 million coins, that could be splitted ad infinitum, and where single satoshis will be placed in many different sidechains, is a beautiful picture, definitely better than when you have a lot of altcoins, where each of them create new coins out of thin air. Then, you could create an altcoin, and have it backed up by Bitcoin, so you could avoid a speculation attack, where your coin is pumped and dumped during early days.

To sum up: currently you have coin A with feature A, and coin B with feature B. What about adding feature B to coin A instead, and have a coin A with features A and B? That's what sidechains are about, so by supporting them, you can get new features without causing too much inflation.

If merge miners only make a small fraction of their revenue from bitcoin, then it becomes rather cheap to bribe them to mine censoring bitcoin blocks.
In that sense, the security of the bitcoin blockchain against censorship seems to depend on just the bitcoin block rewards.

Leaving out the specifics of how much you would take, if you want to go down this route then you would need to create some kind of automatic mechanism to take these coins from people, and not rely on them spending them as enforced fees, as there would be an incentive for individuals to let these coins be excluded from the circulation as it would make their other coins more scarce and therefore more valuable.

So, given that the majority of bitcoin blocks are already taking part in one or more merged mining protocols, what are the main arguments against using merged mining to create security once the block subsidy is insufficient? Is there any ongoing discussion or work on blind merged mining protocols (such as BIP 301)?

I don’t think it’s about having an edge over others, but about Bitcoin itself and their own piece of the pie ofc. We also don’t know what effect tail emissions would have on potential late adopters, as there will be many competing assets without it, and having some sort of inflation mechanism could make Bitcoin less competitive. Leading to less adoption again and then potentially devaluing the amount miners would have earned too(1 BTC in transaction fees only, could be worth more than the same amount in a tail emission model). We can’t assume Bitcoin will have won it all already. The value proposition Bitcoin offers now, will be huge even to late adopters, if we compare it to other assets.

Also the security budget is important, but we don’t know if the absolute amount is the only relevant metric to consider yet. The access to attractive locations and the distribution of mining should be considered too. There is places with close to 0 electricity costs, and as Bitcoin rises in adoption and the potential price increases become less. Mining might become so competitive(barely profitable) that it could just be possible for a few big players anyways, and be almost exclusive to locations like this. Which will also make attacks from the outside harder again, without access to these locations(it could make it more expensive than the security budget itself). Or even make it hard for new miners to join, as it will be hard to get access to locations like this. A tail emission also doesn’t change how mining will be distributed as it becomes more and more competitive. The more competitive mining becomes the less relevant the absolute security budget could be.

Exactly. A chain with 0.01 BTC tail supply would need one million blocks (around 19 years) to produce 10k BTC. That should be slow enough to play it safe. The current block reward is 6.25 BTC plus fees. Let's assume that some block has 7 BTC reward. Then, you can grant miners 0.01 BTC for merged mining 700 times easier blocks on such sidechain. The difficulty of your altcoin can follow Bitcoin headers, it is that simple. And if 700 times easier difficulty is still too hard, then you can give miners less coins for mining easier blocks, and keep 10 minutes as a sidechain block time. Then, all miners will try to get tail supply of 0.01 BTC, and some of them will push your sidechain forward, if they hit a Bitcoin block at the same time.

Then look again at Paul Sztorc's triangle, and choose wisely: Merged Mining or big blocks? And if something else, then what it would be?

Yes, you're wrong; they didn't have tail emission planned at launch. It was hard-forked in later.


They don't like any departure from the 21M bitcoin limit. Which makes perfect sense.
Bitcoin has always been branded as the ultimate hard money, because of its immutable supply cap preventing dilution.
Once you start changing that (even if there remains another effective cap implied by ongoing coin loss), then it's hard to take any claim seriously. Like Ethereum's "code is law", but worse, since that was never part of Ethereum's consensus model.

While I'm a big fan of Tail Emission, I'm an even bigger fan of immutability of such core properties as emission, so I disagree with Peter that Bitcoin should add one.

Bitcoin is stuck with the 21M limit no matter what. It will just have to find some way other than tail emission to deal with the future uncertainty of having possible periods of precariously low security budget.

I do think that hard forks will be made adding a tail emission, but they won't be entitled to the BTC ticker, and won't fare much better than Bitcoin Cash.

I can rephrase it further: Bitcoin users don't like their share of the pie to be decreased in some obscure way.

Tail supply can be used to hide the fact that users lose their "share of the pie". It is not instantly obvious to everyone. But if you introduce any fee policy, when it will be required to send some of your coins directly to the miners, or your coins will stay unconfirmed if you won't adjust to the rules (so the final effect will be the same as if they would be burned), then it is crystal clear that tail supply is taken from all accounts and given to all miners. It should be crystal clear from the very beginning, that tail supply supporters want to take single satoshis from everyone, and make a new block reward out of it. And all details would then be only about the whole algorithm that will decide, how many coins have to be taken from each account.

Yes, and because it is hard to do it right, then it should be solved by Merged Mining. You want to get new coins? No problem, just mine Bitcoin, and get Bitcoin and BitcoinWithTailSupply at the same time. Then, you will get additional coins outside of the chain, and then all users will choose, which coin they want to use. But I expect that BitcoinWithTailSupply will have many problems, and will sooner or later burn some coins, because of overproduction. It is hard to get all amounts right, so it should be dynamically adjusted, for example by Merge-Mined sidechains.

You want more coins? No problem, just create a new Merge-Mined altcoin, and distribute coins, based on Bitcoin shares. You want less coins? Then it's even easier: just burn them.

Any such change done at a later point can disappoint greatly the early birds. I can see why any later such change can be seen as bad. And I think that you know that such a change done now in bitcoin can easily trigger a fork. Yes, it's all about money/investment, much more than we'd like to admit. The use-as-a-coin is somewhat secondary.

Whether tail emission is fairer or not compared with what Bitcoin has is highly debatable imho. I expect the two different models come with completely different models for price evolution. So imho, in a way or another, both are fair.


For now Monero seems to have its tail emission right, but I don't know the details well enough, hence I may be wrong. And they've had this from start too.

If there is only one way to get it right, then it would be tail emission from launch.
In gmaxwell's words, that's a pretty strong attractor in the design space, with nothing arbitrary about it.

It's the most fair possible coin distribution.
Which is exactly why many (most?) people don't like it, because they want to have an edge over later adopters.
In that way, Grin is the only altruistic coin...

It was an example based on a coin I knew. Right now I don't care at all neither about Dogecoin's tail emission, nor its wealth concentration.
My point was that it's hard to get tail emission right.

So you have a problem with Dogecoin's yearly inflation rate, but not with its wealth concentration?

I've thought the same in the rather early days of Dogecoin: tail emission gives everybody the chance get hands of the coin, tail emission makes it much more suitable for being an actual currency since in every currency money lost do happen.
However, in those days Dogecoin price went down and no recovery seemed to be at the horizon (I never expected the 2021 comeback, but I still don't know if it was good or just manipulation).
Now I consider Dogecoin tail emission overly big.


Is tail emission good? Maybe, but it's overly difficult to get it right. Bitcoin is better as investment and only time will tell if its lack of tail emission is a real problem or not. For now we're okay and in the near future the existence of 8 digits after the decimal point can do the job. Then we (or actually one of the next generations) will see...

Your statement can be rephrased as "nobody likes their share of the pie to be decreased".

At first sight, that's seems obvious.

But on closer inspection, it's not so obvious.

For the pie to be useful, you want as many people as possible to have some share.
And you want this pie to be more attractive to people than some other pie.

So you don't want the pie ownership to be too concentrated. Maybe, if you believe in fairness,
you want future generations to have some share of the pie as well.

That's why you want the supply to keep growing. Preferably not by too much though. Just a percent or two per year.
That makes you not lose too much of your share while allowing many more people their fair share....

I am surprised that this topic grabbed that much attention. But if that's the case, then in this triangle we can see three scenarios:

1) block size increase, a huge attack, it should be solved by compression, to be stopped once and for all, if not, then block size will be always increased, causing future problems
2) violate coin limit, another huge attack, it should be stopped by burning all coins created by the attackers
3) merged mining, it should be deployed correctly (not like NameCoin, there should be a single chain of the heaviest headers that all coins are attached into), that would stop two previous attacks

True, sidechains based on this idea are ongoing: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-June/020532.html

Which one of these would be desireable to the people, if they had to choose between them? Of course, it would be the first alternative, because nobody likes their supply converging towards infinity, hence the value of a single coin converging to 0, because this assumes that all users will continuously be subsidised by equal amounts (scams and theft alone prevent this from being possible); Just ask DOGE developers how that enterprise is doing.


I personally do not mind if the transaction fees soar exorbiantly high as long as the LN is in a standardized state by then. And at the very least, I'd like for Bitcoin Core software in the distant future, to create an LN implementation inside the daemon based on the common standard - and then all standardness problems will be solved for good. If someone goes out right now and makes another client, you just create the N+1 problem. What has to be done is to build a library based on strigent security measures, and then convince core developers to use that (like libsecp256k1: In fact, libbitcoin the consensus rules library is built as such a target. I don't see why a liblnconensus is not possible as well.)

And again, Paul Sztorc was right. But I didn't expect that any Bitcoin users will go into violating the limit that fast: https://www.truthcoin.info/blog/security-budget-ii-mm/#f-the-trilemma

There is one small difference, the block subsidy affects the circulating supply. It doesn’t matter if the total circulating supply stays under 21 million, or doesnt inflate, for this effect to take place.

As a non-miner:

• If the circulating supply increases, your piece of the pie decreases over time in this model(tail emissions).
• If the circulating supply stays constant, you missed out on some increasing value you would have gotten otherwise from deflation.
• If the circulating supply decreases, your increase in value would have been less than otherwise.

This affects all coins ever created regardless if they get used or not. In this scenario miners get enriched and have a kind of cantillon effect playing into their favour. Transaction fees might depend more on the fact that blocksize is limited and would be high anyways due to the limited space, this wouldn’t be lessened trough tail emissions. Just because we’re paying miners subsidies doesn’t mean we get cheaper fees. So i would argue tail emissions is the bigger enrichment, but the real downside is what i listed above. It affects monetary properties directly.

The Transaction fees only model doesn’t have this, that is the advantage, it’s not the enrichment that would be the danger. Even small changes can have big effects over longer periods of time.

And then we don’t even know if tail emissions would even be enough in the end. But if we as a community open the doors to trying to print our problems away, then people in the future might be tempted to take it even further. The best solution would be transaction fees only, if we want to keep Bitcoin the soundest money possible. It won’t be impossible to compensate miners when the most sound money in the world depends on it. So in my opinion keeping the original properties is more important, than trying to lessen some uncertainties now.