HaPPY-Mine: Designing a Mining Reward Function

Abstract

In cryptocurrencies, the block reward is meant to serve as the incentive mechanism for miners to commit resources to create blocks and in effect secure the system. Existing systems primarily divide the reward in proportion to expended resources and follow one of two static models for total block reward: (i) a fixed reward for each block (e.g., Ethereum), or (ii) one where the block reward halves every set number of blocks (e.g., the Bitcoin model of halving roughly every 4 years) but otherwise remains fixed between halvings. In recent work, a game-theoretic analysis of the static model under asymmetric miner costs showed that an equilibrium always exists and is unique [4]. Their analysis also reveals how asymmetric costs can lead to large-scale centralization in blockchain mining, a phenomenon that has been observed in Bitcoin and Ethereum and highlighted by other studies including [11, 16].

In this work we introduce a novel family of mining reward functions, HaPPY-Mine (HAsh-Pegged Proportional Yield), which peg the value of the reward to the hashrate of the system, decreasing the reward as the hashrate increases. HaPPY-Mine distributes rewards in proportion to expended hashrate and inherits the safety properties of the generalized proportional reward function established in [9]. We study HaPPY-Mine under a heterogeneous miner cost model and show that an equilibrium always exists with a unique set of miner participants and a unique total hashrate. Significantly, we prove that a HaPPY-Mine equilibrium is more decentralized than the static model equilibrium under a set of metrics including number of mining participants and hashrate distribution. Finally, we show that any HaPPY-Mine equilibrium is also safe against collusion and sybil attacks, and explore how the market value of the currency affects the equilibrium.

We thank the anonymous reviewers and Yonatan Sompolinsky for their helpful comments. The first author was supported by a Facebook Fellowship and Dfinity Scholarship. This work was also partially supported by NSF grant CCF-1909363. This work was initiated when the first author was at an internship at DAGlabs.

Introduction

Existing cryptocurrencies rely on block rewards for two reasons: to subsidize the cost miners incur securing the blockchain and to mint new coins. Miners in major cryptocurrencies like Bitcoin and Ethereum participate in the protocol by packaging user transactions into blocks and incorporating those blocks into the blockchain (the global record of all transactions that have taken place in the system). Creating a block involves significant computational power where the miner preforms iterations of some kind of computation, the proof of work, generally iterating over a hash function. This work, whether on a CPU, GPU or other specialized hardware, comes at a cost to the miner. To compensate miners for incurring this cost and to incentivize more miners to join, miners collect a block reward of newly minted coins for each block that gets added to the blockchain. In expectation, miners are rewarded in proportion to the resources they contribute. This computational work is also what cryptographically ties each block in the blockchain together and makes it so that anyone wanting to fork the blockchain, i.e. erase transactions by creating their own version of a subset of the chain, would have to redo an equivalent amount of work. The more resources miners invest in the system, the greater the system hashrate, the more expensive this attack becomes. In effect, the computational work of miners secures the blockchain system by making the blockchain immutable.

There are two common frameworks for the block reward function in terms of distribution of supply. Bitcoin’s protocol has a set maximum number of coins that will ever be minted, therefore the mining reward diminishes over time. The mining reward halves every 210,000 blocks (approximately every 4 years). For now, miners continue to profit since the value of each Bitcoin has increased over time making up for the decrease in reward with increases system hashrate. Eventually though, the mining reward will reach zero and miners will be repaid solely in transaction fees for the transactions they include in the blocks they mine. Another cryptocurrency, Ethereum, currently has in its protocol a fixed mining reward of 5 Ethers for all blocks ever. This means that the supply of Ether is uncapped and the mining hashrate can grow linearly in the market value of Ether.

In general miner costs are asymmetric [1] with miners with access to low-cost electricity or mining hardware being at an advantage. This has led to large centralization in both Bitcoin and Ethereum mining, with a significant portion of the hashrate being controlled by a few mining pools [2, 3, 11]. This prevents other players from having a share of the market. We ask the question, can we design a mining reward function that alleviates these problems?

Main Contributions

In this paper, we develop a novel hashrate-based mining reward function,HaPPY-Mine, which sets the block reward based on the system hashrate. HaPPY-Mine is defined so that as the system hashrate increases, the block reward smoothly decreases. We now outline the main contributions of this paper.

• 1. We introduce the notion of a hashrate-pegged mining reward function, and formally argue that it can help in decentralizing the blockchain by reducing the hashrate that a new miner is incentivized to buy.

• 2. We present HaPPY-Mine, a family of hashrate-pegged mining reward functions that dispense rewards in proportion to the expended hashrate. We conduct a rigorous equilibrium analysis of the HaPPY-Mine family under general miner costs. We establish that equilibria always exist, and are more decentralized than an equlibrium under the static reward function: in particular, HaPPY-Mine equilibria have at least as many participating miners as and lower total hashrate than an equilibrium for the static reward function.

• 3. We show that HaPPY-Mine equilibria (as well as that of a static reward function) are resistant to any collusion attack involving fewer than half the miners, and that a Sybil attack does not increase the utility of the attacker.

• 4. We finally consider the scenario where rewards are issued in the currency of the blockchain and study the effect of the change in the currency’s value on the equilibrium. We show that in HaPPY-Mine, an increase in the value of the cryptocurrency allows more higher cost miners to participate, again resulting in greater decentralization as compared to an equilibrium under the static reward function.

Outline of the Paper. We begin in Sect. 2 with a description of the equilibrium analysis of [4], which provides a basic game-theoretic framework that we build on. We also describe the properties satisfied by the generalized proportional allocation rule of [9], of which our function is a special case. In Sect. 3 we introduce our hash-pegged mining reward function and in Sect. 4 we analyze its equilibria. We analyze other factors that impact the equilibria in Sect. 5. We conclude with a discussion on the practicality of implementing the hash-pegged mining reward function in a system and with future and related work in Sects. 6 and 7.

Background

In this paper, we follow a miner model of asymmetric costs with rewards being awarded in proportion to expended resources(hashrate). Our study builds on an analysis framework developed in [4]. In this section, we first summarize the model of [4] and their equilibrium analysis of a static reward function for mining. We next review proportional allocation, used in both the static reward function and HaPPY-Mine, and state salient properties established in [9].

Equilibrium Analysis of Static Reward Function. The simple proportional model introduced in [4] has n miners with costs $c_1, c_2,\dots , c_n$ where $c_1 \le c_2 \le \dots \le c_n\le \infty$. A miner i who invests $q_i$ hashrate at a cost of $c_iq_i$ has mining reward and utility given by

$$ x_i(q)= \frac{q_i}{\sum _j q_j} \text{ and } U_i(q) = x_i(q)- c_iq_i, $$

respectively. The main result of [4] is that there is a unique pure strategy equilibrium where each miner invests

$$q_i = \frac{1}{c^*}\max (1-c_i/c^*,0)$$

for the unique value $c^*$ s.t. $X(c^*) = 1$ where

$$X(c) = \sum _i \max (1-c_i/c, 0).$$

The value $c^*$ thus serves as a bound for which miners participate, with a miner i participating if $c_i<c^*$. They also show that the number of miners must be finite for there to be an equilibrium strategy and that even countably infinite miners would not have an equilibrium strategy.

Properties of Proportional Allocation. In [9], the authors define a set of properties that allocation rules can satisfy: non-negativity, budget-balance (strong- means all the reward is allocated, weak- means less or all of the reward is allocated), symmetry (two miners with equal hashrate get equal reward), sybil-proofness (can’t split hashrate and get more reward) and collusion-proofness (can’t join hashrates and get more). They prove that the proportional allocation rule is the only rule that satisfies all of the above properties. They also define a generalized proportional allocation rule as

$$x_i(q)= f(\sum _j q_j)\frac{q_i}{\sum _j q_j}$$

for some function f which takes in the sum of hashrate and returns the amount of reward that will be allocated. The static reward function is an example of the generalized proportional allocation rule with $f(\sum _j q_j) = 1$. In HaPPY-Mine, we provide a family of functions for f. These functions follow the generalized proportional allocation rule and, hence, satisfy all of the above properties with a weak budget-balance as, by definition, the full reward value is not always rewarded (i.e. $f(\sum _j q_j)\le 1$).

Hashrate-Pegged Block Reward

We now introduce the notion of a hash-pegged mining reward function. We consider a miner’s decision of how much hashrate to purchase when they are joining the system. In this section, we consider a simplified model where the network currently has hashrate 1 with network operational cost c and mining reward of 1 per block such that mining is profitable, i.e. $c<1$ and the system’s utility is $U = 1-c$. Given the network hashrate $H= \sum _j q_j$, we consider block reward

$$r(H)=\left( \frac{1}{H}\right) ^\delta $$

for a given parameter $\delta \ge 0$ such that any additional hashrate added to the system decreases the block reward¹.

The focus of this section is on answering the following question: Given a new miner with cost $c_i$, how much hashrate is this new miner incentivized to buy? That is, what $q_i$ maximizes their utility

$$ U_i(q) = \frac{q_i}{1+q_i}r(1+q_i)-c_iq_i?$$

Case: $\delta = 0$, Static Reward. First consider the fixed reward system where the reward is always 1. A new miner joining the system with hashrate $q_i$ will have utility $U_i(q)= \frac{q_i}{q_i+1}-c_iq_i$ which they want to maximize. By solving for $U_i'(q)=0$ with $q_i>0$ and $c_i<1$, we find that the miner maximizes their utility by buying hashrate $q_i = \sqrt{\frac{1}{c_i}}-1$.

Case: $\delta = 1$, Linear Decrease in Reward. With $r(H)= \frac{1}{H}$, a miner now wants to maximize $U_i(q)= \frac{q_i}{(q_i+1)^2}-c_iq_i$. We can’t easily solve for $U_i'(q) = \frac{1}{(q_i+1)^2}-\frac{2q_i}{(q_i+1)^3}-c_i=0$. What we can observe is that $U_i$”$(q)=\frac{6q_i}{(q_i+1)^4}-\frac{4}{(q_i+1)^3}$ and that $U_i$”$(q)<0$ for $q_i<2$, i.e. $U_i(q)$ is concave down when a miner buys less than double the current hashrate of the system. Since $U'_i(q_i=\sqrt{\frac{1}{c_i}}-1) = 2c_i(\sqrt{c_i}-1) < 0$ for $c_i<1$, we obtain that for a miner that’s acquiring less than twice the current system hashrate, the hashrate bought by the miner under a linearly diminishing reward ($\delta = 1$) is less than that bought under a static reward ($\delta = 0$). (For a miner buying more than twice the hashrate ($q_i\ge 2$), $c_i$ would have to be sufficiently small for this to be profitable i.e. $c_i<\frac{1}{(1+q_i)^2}<\frac{1}{9}$.)

General $\delta$. We now analyze the impact of a more drastic decay function (larger $\delta$) on the optimal hashrate bought by a new miner joining the system. When a new miner joins with additional hashrate $q_i$, the mining reward becomes $(\frac{1}{q_i+1})^\delta$, where $0\le \delta < \infty$. The utility function is now $U_i(q) = \frac{q_i}{q_i+1}(\frac{1}{q_i+1})^\delta -c_iq_i = \frac{q_i}{(q_i+1)^{\delta +1}}-c_iq_i$.

Proposition 1

The optimal hashrate for a new miner decreases with increasing $\delta$.

Our proof proceeds in two steps. We show that (1) the utility is a concave function at the maxima and (2) the derivative of the utility w.r.t. $q_i$ is decreasing in $\delta$. We then obtain that the utility maximum (i.e. the $q_i$ s.t. $U_i'(q) = 0$) is decreasing with an increase in $\delta$. Due to space constraints, we defer the proof to the full version of this paper [14].

Thus, if we increase the $\delta$ exponent in the total block reward, we decrease the hashrate that a new miner is incentivized to buy. While this may not have an effect for smaller miners who do not have the resources to purchase their maximal utility hashrate, Proposition 1 demonstrates that a hash-pegged reward function can be a useful decentralization tool that disincentivizes rational big miners from joining the system with a large fraction of the hashrate.

Note that Proposition 1 does not take into account the dynamic game between different miner’s choices. We now formally define the above family of hash-pegged mining reward functions for arbitrary system hashrate as HaPPY-Mine and analyze the equilibria given a set of miners with asymmetric costs.

HaPPY-Mine Equilibrium Analysis

Building on the model of [4] we define a non-cooperative game between m miners with cost $c_1\le c_2 \le \dots \le c_m$ where each miner i with hashrate $q_i$ has utility

$$ U_i(q) = x_i(q)-c_iq_i.$$

In HaPPY-Mine we set the maximal block reward to be 1 and have the reward start to decrease after the system’s hashrate surpasses Q, for a parameter $Q > 0$. We define the reward for miner i as

$$ x_i(q)=\frac{q_i}{\sum _j q_j}r(q) ~~\text {where}~~ r(q) =\min \left( 1, \left( \frac{Q}{\sum _j q_j}\right) ^\delta \right) $$

for system parameter $\delta \in [0,\infty )$.

The main results of this section concern the existence and properties of pure Nash equilibria for the above HaPPY-Mine game. We begin our analysis by differentiating r(q) and $x_i(q)$ with respect to $q_i$, and finding the derivative of $U_i(q)$ w.r.t. $q_i$.

$$\begin{aligned} U_i'(q)= {\left\{ \begin{array}{ll} \frac{\sum _jq_j-q_i}{(\sum _j q_j)^2}-c_i &{}\text {if}~\mathop {\sum }\nolimits _j q_j < Q\\ \frac{Q^\delta }{(\sum _j q_j)^{\delta +2}}[\mathop {\sum }\nolimits _jq_j-(\delta +1)q_i]-c_i ~~~~~~&{}\text {if}~\mathop {\sum }\nolimits _j q_j > Q \end{array}\right. } \end{aligned}$$

Recall that for equilibria we need that $U_i'(q) \le 0$ with equality for $q_i > 0$. (For the case $\sum _j q_j = Q$, we need the left and right derivatives to be nonnegative and nonpositive, respectively.)

Examples with Diverse Cost Scenarios

We work through some cost examples to gain intuition for the equilibrium analysis of the above reward function.

Example 1. First we consider a general 2-miner case with $\delta$ and Q set to 1. In this model we have 2 miners with costs $c_1,c_2$ s.t. $c_1\le c_2$. See the full version of this paper [14] for the full analysis. If $c_1+c_2>1$ we use the analysis of [4] with reward 1 and obtain that the equilibrium hashrate is $q_1+q_2<Q=1$ with $q_i = \frac{1}{c_1+c_2}(1-\frac{c_i}{c_1+c_2})$. If $c_1+c_2 \le 1$, then there are multiple equilibria where $\alpha +\beta =1$ with $\frac{1-c_1}{2}\le \alpha \le 1-c_1$ and $\frac{1-c_2}{2}\le \beta \le 1-c_2$. Note the equilibria system hashrate with two miners is always $\le Q=1$.

Taking $c_1 +c_2 \le 1$, let us consider the total utility of an equilibrium.

$$\max _{\alpha ,\beta }(U_1+U_2) = \max _{\alpha ,\beta }(1-c_1\alpha -c_2\beta )= \max _{\alpha }(1-c_2+(c_2-c_1)\alpha )$$

Thus, a utilitarian equilibrium is one where $\alpha$ is maximized, i.e. $\alpha = 1-c_1$. The utilitarian equilibrium is thus the one with maximal utility for the miner with least cost and lowest utility for the miner with most cost.

Example 2. $c_i = \frac{i}{i+1}$ We now consider an example from [4] where the cost function $c_i = \frac{i}{i+1}$, still considering $\delta = Q = 1$. This case is interesting because in the static reward case (i.e. $U_i(q)=\frac{q_i}{\sum _i q_i}-q_i c_i$) the equilibrium strategy has that $\sum _i q_i>1$ and that only the first 7 miners participate. This equilibrium point would have less reward in HaPPY-Mine and thus may no longer be the equilibrium point. We solve this in the full version of this paper [14] and find that

$$ q_i = \frac{1}{2}\sqrt{\frac{n-2}{\sum _{j=1}^n \frac{j}{j+1}}}(1-\frac{(n-2)i}{\sum _{j=1}^n \frac{j}{j+1}(i+1)}) $$

for all miners that participate in equilibrium. We can iterate over n to find that with this strategy, equilibrium exists at $n=25$, i.e. for $n>25$ only the first 25 miners participate otherwise all miners participate. Thus HaPPY-Mine with $\delta =1$ results in an equilibrium with more miners participating than in the equilibrium under a static reward function.

Example 3. $c_i = c$ for All i. The next example we consider is the case of homogeneous cost with m miners, $Q=1$ and any $\delta$. See the full version of this paper [14] for the full analysis. For $c> \frac{m-1}{m}$, we can use the analysis of [4] and obtain $q_i = \frac{m-1}{m^2c}$ with $\sum _i q_i = \frac{m-1}{mc} < 1$. For $\frac{m-\delta -1}{m}\le c \le \frac{m-1}{m}$, an equilibrium exists at $\sum _i q_i = 1$ where $q_i = \frac{1}{m}$. Finally for $c<\frac{m-\delta -1}{m}$ we get an equilibrium strategy with $\sum _i q_i >1$ where $q_i = \frac{1}{m}\root \delta +1 \of {\frac{m-\delta -1}{cm}}$. In each case the equilibrium hashrate for HaPPY-Mine for any $\delta$ is less than or equal to that of the static reward equilibria. In Corollary 2 below, we show this in fact holds for any set of costs.

General Analysis of HaPPY-Mine

We now analyze the equilibria for the general case of HaPPY-Mine with $m>\delta +1$ miners with costs $c_1\le c_2\le ...\le c_m< c_{m+1}=\infty$. Recall the utility function

$$\begin{aligned} U_i(q)= {\left\{ \begin{array}{ll} \frac{q_i}{\sum _j q_j}-q_ic_i &{}\text {if}~\mathop {\sum }\nolimits _j q_j \le Q\\ \frac{q_i}{\sum _j q_j}(\frac{Q}{\sum _j q_j})^\delta -q_ic_i &{}~~~~~~~\text {o/w} \end{array}\right. } \end{aligned}$$

In the propositions below we first derive necessary conditions for an equilibrium to exist in different cases depending on how the system hashrate $\sum _i q_i$ compares with Q. Taking these propositions we derive lemmas proving the existence of equilibria given any set of miner costs. The lemmas also prove the impossibility of equilibria to exist simultaneously for different values of $\sum _i q_i$, i.e. the uniqueness of the equilibria. We finish this section with our final theorem statement defining the equilibria values given a set of costs, as well as corollaries on the properties of the equilibria.

Proposition 2

(Necessary condition for equilibrium with total hashrate less than Q, [4]). If $\sum _i q_i<Q$ at equilibrium then there exists a $c^*>1/Q$ such that $X(c^*)=1$ and all miners i with $c_i < c^*$ participate with $q_i=\frac{1}{c^*}(1-c_i/c^*)$.

Proof

If $\sum _i q_i<Q$ then miners have utility function $U_i(q) = \frac{q_i}{\sum _j q_j}-q_ic_i$ which is the same as the simple proportional model of [4] where there is an equilibrium strategy with $q_i = \frac{1}{c^*}\max (1-c_i/c^*,0)$ for $c^*$ such that $X(c^*)=1$. In this analysis $\sum _j q_j = \frac{1}{c^*}$, and so for $\sum _j q_j <Q$ we have $c^*>1/Q$.    $\square$

Proposition 3

(Necessary condition for equilibrium with total hashrate equal to Q). If $\sum _i q_i=Q$ at equilibrium then all miners with cost $c_i < 1/Q$ participate and satisfy

$$\frac{1}{\delta +1}(Q-c_iQ^2)\le q_i \le Q-c_iQ^2$$

Proof

Assume there is an equilibrium strategy such that $\sum _i q_i=Q$. The utility of a miner i is given by

$$U_i(q) = q_i(\frac{1}{Q}-c_i) \le 0$$

so miners with cost $c_i>1/Q$ will not participate; those with $c_i < 1/Q$ will.

We take the n miners for which $c_i \le 1/Q$. $\sum _i q_i = Q$ is an equilibrium iff,

$$\begin{aligned} U_i'(q)= {\left\{ \begin{array}{ll} \frac{1}{Q^2}[Q-q_i]-c_i\ge 0 &{} \text { for } \mathop {\sum }\nolimits _j q_j < Q\\ \frac{Q^\delta }{Q^{\delta +2}}[Q-(\delta +1)q_i]-c_i\le 0 &{} \text { for } \mathop {\sum }\nolimits _j q_j > Q \end{array}\right. } \end{aligned}$$

and thus, any equilibrium strategy satisfies

$$\frac{1}{\delta +1}(Q-c_iQ^2)\le q_i \le Q-c_iQ^2 $$

Note that $c_i = 1/Q$ implies $q_i = 0$, so a miner with cost 1/Q does not participate. Thus, exactly those miners with $c_i<1/Q$ participate in an equilibrium.    $\square$

Proposition 4

(Necessary condition for equilibrium with total hashrate more than Q). If $\sum _i q_i>Q$ at equilibrium then there exists a $c^{\dagger }<1/Q$ such that $X(c^{\dagger })=\delta +1$ and all miners with cost $c_i <c^{\dagger }$ participate with

$$q_i = \frac{\root \delta +1 \of {Q^\delta }}{(\delta +1)\root \delta +1 \of {c^{\dagger }}}(1-c_i/c^{\dagger })$$

Proof

Assume first there exists an equilibrium where miner $i+1$ participates and miner i does not with sum of hashrate H. This means

$$ U_{i+1}'(q) = \frac{Q^\delta }{H^{\delta +2}}[H-(\delta +1)q_{i+1}]-c_{i+1} = 0, $$

and thus $c_{i+1} = \frac{Q^\delta }{H^{\delta +2}}[H-(\delta +1)q_{i+1}]$. For $q_i =0$ we get $U_i'(q) = \frac{Q^\delta }{H^{\delta +1}}-c_{i} \le 0$ which means $\frac{Q^\delta }{H^{\delta +1}}\le c_i$, putting both together we get

$$\frac{Q^\delta }{H^{\delta +1}}\le c_i\le c_{i+1} =\frac{Q^\delta }{H^{\delta +2}}[H-(\delta +1)q_{i+1}],$$

which implies $q_{i+1}\le 0$, a contradiction to miner $i+1$ participating. Thus in any equilibrium, if miner $i+1$ participates, then miner i must also participate.

Letting $H=\sum _i q_i >Q$, for a miner i that participates in equilibrium

$$ U_i'(q) = \frac{Q^\delta }{H^{\delta +2}}[H-(\delta +1)q_{i}]-c_{i} = 0 \implies q_i = \frac{H}{\delta +1}(1-\frac{H^{\delta +1}}{Q^\delta }c_i).$$

Assuming that only the first n miners participate in equilibrium, we solve for H

$$ H = \sum _{i=1}^n q_i = \sum _{i=1}^n \frac{H}{\delta +1}(1-\frac{H^{\delta +1}}{Q^\delta }c_i) = \root \delta +1 \of {\frac{Q^\delta (n-\delta -1)}{\sum _{i=1}^n c_i}}.$$

This also means player $n+1$ must have $U_{n+1}'(q) \le 0$ at $q_{n+1} =0$, so we get

$$ U_{n+1}'(q) = \frac{Q^\delta }{H^{\delta +1}}[H-(\delta +1)q_{n+1}]-c_{n+1} = \frac{Q^\delta }{H^{\delta +1}}-c_{n+1} \le 0,$$

$$\implies \frac{Q^\delta }{H^{\delta +1}} = \frac{\sum _{i=1}^n c_i}{n-\delta -1} \le c_{n+1}.$$

Let $c^{\dagger }$ be the bound for which miners participate, i.e. miner i participates iff $c_i < c^{\dagger }$. Then from the above we get that $c^{\dagger } = \frac{\sum _{i=1}^n c_i}{n-\delta -1}$. Rewriting this and using the fact that $c_i/c^* \ge 1$ for $c_i\ge c^{\dagger }$, we obtain

$$ \sum _i \max (1-c_i/c^{\dagger },0) = \delta +1,$$

co-opting the X(c) equation for $c^{\dagger }$ s.t. $X(c^{\dagger })=\delta +1$. Since $c^{\dagger } = \frac{Q^\delta }{H^{\delta +1}}$ it must be that $c^{\dagger }<1/Q$. Lastly we plug $c^{\dagger }$ into the equation for $q_i$ and get

$$q_i = \frac{\root \delta +1 \of {Q^\delta }}{(\delta +1)\root \delta +1 \of {c^{\dagger }}}(1-c_i/c^{\dagger }). $$

   $\square$

We now use Propositions 2, 3, and 4 to establish the following lemmas, which will help prove our main theorem. We first define $c^*$ as the value for which $X(c^*)=1$ and, for $m>\delta +1$, $c^{\dagger }$ as the value for which $X(c^{\dagger })=\delta +1$. Note that X(c) is a continuous increasing function in c and thus $c^*<c^{\dagger }$.

Lemma 1

(Equilibrium when $c^*>1/Q$). If $c^*>1/Q$, then there exists a unique equilibrium strategy with $\sum _i q_i<Q$

Proof

We know from Proposition 2 that there is an equilibrium strategy with $\sum _i q_i = \frac{1}{c^*}<Q$. Since $c^*>1/Q$ that implies $c^{\dagger }>1/Q$ so by Proposition 4 there is not an equilibrium strategy with $\sum _i q_i >Q$. Finally, lets assume there is an equilibrium strategy with $\sum _i q_i = Q$. Recall from Proposition 3 that all miners with cost $<1/Q$ participate, so let n be those miners s.t. $c_i < 1/Q$ for $i\le n$. From the definition of X(c) we have that $\sum _{i=1}^n 1-c_i/c^* \le 1$ which we can solve to be $c^*(n-1)\le \sum _{i=1}^n c_i$ and we get $\frac{n-1}{Q} < \sum _{i=1}^n c_i$. From Proposition 3 we have that $q_i \le Q-c_iQ^2$ for all $i\le n$. Thus $\sum _{i=1}^n q_i \le \sum _{i=1}^n Q-c_iQ^2$ which solves to $\sum _{i=1}^n c_i \le \frac{n-1}{Q}$, and thus there is no equilibrium at $\sum _i q_i = Q$.    $\square$

Lemma 2

(Equilibrium when $c^*\le 1/Q \le c^{\dagger }$). If $c^*\le 1/Q \le c^{\dagger }$ then there exists at least one equilibrium at $\sum _i q_i = Q$ and any equilibrium strategy has $\sum _i q_i = Q$ with a miner i participating iff $c_i < 1/Q$.

Proof

First, since $c^*\le 1/Q$ we know from Proposition 2 there is no equilibrium at $\sum _i q_i < Q$, and since $c^{\dagger }\ge 1/Q$ we know from Proposition 4 there is no equilibrium at $\sum _i q_i > Q$. Finally from Proposition 3, for there to be an equilibrium at $\sum _i q_i = Q$ we need for each miner i with $c_i < 1/Q$, $q_i$ must satisfy

$$\frac{1}{\delta +1}(Q-c_iQ^2) \le q_i \le Q-c_iQ^2.$$

Summing over all n s.t. $c_i <1/Q$ for $i\le n$, and simplifying, we derive

$$ \frac{n-\delta -1}{Q} \le \sum _{i=1}^n c_i \le \frac{n-1}{Q}$$

Taking the fact that $c^* \le 1/Q$ we get $\sum _{i=1}^n 1-c_i/c^* \ge 1$ which simplifies to $c^*(n-1)\ge \sum _{i=1}^n c_i$. Taking the fact that $c^{\dagger } \ge 1/Q$ we get $\sum _{i=1}^n 1-c_i/c^{\dagger } \le \delta +1$ which simplifies to $c^{\dagger }(n-\delta -1)\le \sum _{i=1}^n c_i$. Putting these together, we obtain

$$\frac{n-1}{Q}\ge \sum _{i=1}^n c_i \ge \frac{n-\delta -1}{Q} $$

   $\square$

Lemma 3

(Equilibrium when $c^{\dagger }<1/Q$). If $c^{\dagger }<1/Q$ then there exists a unique equilibrium strategy with $\sum _i q_i > Q$.

Proof

We know from Proposition 4 that there is a unique equilibrium strategy with $\sum _i q_i = \root \delta +1 \of {\frac{Q^\delta }{c^{\dagger }}} > Q$. Since $c^*<c^{\dagger }$ we know from Proposition 2 there is not an equilibrium strategy with $\sum _i q_i <Q$. Take the n miners s.t $c_i < c^{\dagger }$ for $i\le n$. From the definition of X(c) we have

$$\sum _{i=1}^n 1-c_i/c^{\dagger } = \delta +1 \implies \sum _{i=1}^n c_i = c^{\dagger }(n-\delta -1)< \frac{n-\delta -1}{Q}.$$

Assume there is an equilibrium with $\sum _i q_i = Q$. By Proposition 3, miner i s.t. $c_i<1/Q$ participates with $\frac{1}{\delta +1}(Q-c_iQ^2)\le q_i$. If there are n miners s.t. $c_i<c^{\dagger }$,

$$ \sum _{i=1}^n \frac{1}{\delta +1}(Q-c_iQ^2)\le \sum _{i=1}^n q_i \le Q \implies \frac{n-\delta -1}{Q} \le \sum _{i=1}^n c_i$$

which is a contradiction. Thus, there is no equilibrium with $\sum _i q_i = Q$.    $\square$

We can now put together the above lemmas to get our main result:

Theorem 1

For any $\delta \in [0,\infty )$ and $m\ge 2$ miners with costs $c_1\le c_2 \le ... \le c_m< c_{m+1}=\infty$, let

$$X(c) = \sum _i \max (1-c_i/c,0)$$

and $c^*$ s.t $X(c^*)=1$ and (if $m>\delta +1$) let $c^{\dagger }$ s.t. $X(c^{\dagger }) = \delta +1$. HaPPY-Mine with $Q>0$ has equilibria as follows with system hashrate $\sum _i q_i = H$:

• (a) if $c^*>1/Q$, there is a unique equilibrium with $H = \frac{1}{c^*} < Q$ with

  $$ q_i = \max (\frac{1}{c^*}(1-c_i/c^*),0)$$

• (b) if $c^*\le 1/Q\le c^{\dagger }$ or $c^*\le 1/Q$ and $m\le \delta +1$, there exists an equilibrium and every equilibrium satisfies $H=Q$, with $q_i = 0$ for $c_i\ge 1/Q$, and otherwise

  $$ \frac{1}{\delta +1}(Q-c_iQ^2)\le q_i \le Q-c_iQ^2$$

• (c) if $c^{\dagger }<1/Q$, $m > \delta + 1$, there is a unique equilibrium with $H= \root \delta +1 \of {\frac{Q^\delta }{c^{\dagger }}}>Q$,

  $$ q_i = \max (\frac{\root \delta +1 \of {Q^\delta }}{(\delta +1)\root \delta +1 \of {c^{\dagger }}}(1-c_i/c^{\dagger }),0)$$

Proof

The case $c^*>1/Q$ follows directly from Lemma 1. Next we consider $c^*\le 1/Q$ and $m\le \delta +1$. Since $c^*\le 1/Q$ we know from Proposition 2 there is no equilibrium at $\sum _i q_i < Q$. For equilibria with $\sum _i q_i=H > Q$ we need that $U_i'(q) = 0$ for all miners who participate which gives us that $q_i = \frac{H}{\delta +1}[1-c_i\frac{H^{\delta +1}}{Q^\delta }]$. Assuming only the first n miners participate, we get $H = \sum _i^n q_i = \sum _i^n \frac{H}{\delta +1}[1-c_i\frac{H^{\delta +1}}{Q^\delta }]$. We can simplify this to be $\frac{H^{\delta +1}}{Q^\delta }\sum _i^n c_i = n-\delta -1<0$ which is not satisfiable. The only option for equilibria is then for $\sum _i q_i = Q$ which we get from Proposition 3 iff $\frac{1}{\delta +1}[Q-Q^2c_i]\le q_i\le Q-Q^2c_i$ for all miners with $c_i< 1/Q$. Summing over all miners $i\le n$ s.t $c_i<1/Q$ we get $\frac{n-\delta -1}{Q}\le \sum _i^n c_i\le \frac{n-1}{Q}$ must be satisfied. Notice that the left-most expression is negative so the left expression is satisfied. We know $c^*\le 1/Q$ thus $X(1/Q) = \sum _i^n 1-c_iQ \ge 1$ which simplifies to $\sum _i^n c_i \le \frac{n-1}{Q}$. Finally for $m>\delta +1$, the case for $c^*\le 1/Q \le c^{\dagger }$ follows from Lemma 2 and the case for $c^{\dagger }<1/Q$ follows from Lemma 3.    $\square$

In the following two corollaries we examine how the equilibria of HaPPY-Mine changes with the parameter $\delta$ in terms of miner participation and the system hashrate. In particular we show that any HaPPY-Mine equilibria has at least as many miners participating (with at most the same system hashrate) as in the static reward function equilibria.

Corollary 1

For any m miners with costs $c_1\le c_2 \le ... \le c_m$, HaPPY-Mine with any $Q,\delta$ has equilibria with at least as many miners participating as the static reward function. Furthermore, the number of miners participating in equilibria for HaPPY-Mine monotonically increases in $\delta$.

Proof

By the analysis of [4] under the simple proportional model, the static reward function has a unique equilibrium with all miners whose cost $c_i<c^*$ participating s.t $X(c^*) = 1$. HaPPY-Mine has at least all the same miners participating in 3 scenarios: $c_i<c^*$ for $c^*>1/Q$, $c_i<1/Q$ for $c^*\le 1/Q$ and $m\le \delta +1$ or $1/Q\le c^{\dagger }$ and $c_i<c^{\dagger }$ for $c^\dagger <1/Q$ where $c^*<c^{\dagger }$, i.e. in all four cases, all miners with $c_i<c^*$ are participating and possibly additional miners.

For the general statement, take any $\delta$-HaPPY-Mine equilibrium. If $c^*>1/Q$, regardless of how you change $\delta$, $c^*$ remains fixed so by Lemma 1, the equilibrium remain the same with the same miners. Suppose instead $c^*\le 1/Q \le c^\dagger$, as $\delta$ increases $c^\dagger$ increases. Thus for a larger $\delta$, the equilibrium remains at $\sum _i q_i = Q$ with the same miners of cost $c_i<1/Q$ participating. If $c^\dagger <1/Q$, then since $c^\dagger$ acts as an upper-bound for which miners participate, as $\delta$ increases, this upper bound increases. This upper bound caps at 1/Q; then we switch to the second equilibrium case where all miners with $c_i< 1/Q$ participate.    $\square$

Corollary 2

HaPPY-Mine has equilibria with hashrate at most that of the static reward function. Furthermore, HaPPY-Mine equilibria hashrate is monotonically non-increasing with an increase in $\delta$.

Proof

We prove the second part of the statement and note that the static reward function is HaPPY-Mine with $\delta = 0$, so the first statement follows. Given a set of costs, we consider the possible values of $c^*$ and $c^\dagger$. (a) If $c^*>1/Q$, then for any $\delta$, H is always $1/c^*$. (b) If $c^*\le 1/Q \le c^\dagger$ for some $\delta$, then the equilibria hashrate for that $\delta$ is $H=Q$. As $\delta$ increases, the value of $c^\dagger$ increases so the equilibrium hashrate will continue to be Q for any $\delta '>\delta$. (c) If $c^\dagger < 1/Q$ for some $\delta$, we that $H>Q$ and we have two cases to consider for $\delta '>\delta$. Since $c^\dagger$ increases as $\delta$ increases, either it increases s.t. $c^\dagger _{new}$ becomes $\ge 1/Q$ or $m<\delta '+1$, in either case the new equilibrium hashrate would be $H'=Q<H$. The last case is that $c^\dagger<c^\dagger _{new}<1/Q$ and $m\ge \delta '+1$. In this case we first assume $H<H'$, i.e.

   $\square$

The previous corollaries together say that as $\delta$ increases, the number of miners who participate in equilibrium increases with the total hashrate of the system at equilibrium decreasing. We now explore what the impact of this is on the market share of miners. In particular we want to check that the new equilibrium does not disproportionately advantage lower cost miners. Unfortunately we can’t make such a strong statement, owing to the presence of multiple equilibria when the sum of hashrates equals Q. Instead, we get the following corollary which states that for most cases, a miner’s relative market share to any higher-cost miner does not go up. Formally, given two miners i, j with costs $c_i<c_j$ and $\delta$ s.t. $q_i,q_j>0$ at equilibrium (i.e. both miners participate at equilibrium), we define the relative market share $r_{ij}(\delta )$ as follows. If $\sum _i q_i \ne Q$, then there is a unique equilibrium, so we define $r_{ij}(\delta )$ to be $q_i/q_j$. Otherwise, there may be multiple equilibria and we define $r_{ij}(\delta )$ to be the ratio of the maximum value of $q_i$ to the maximum value of $q_j$ in equilibrium (defining it to be the ratio of the minimum values yields the same ratio).

Corollary 3

For any two miners i, j with costs $c_i < c_j$, parameters $\delta , \delta '$ such that both miners participate in equilibrium at parameter $\delta$, and $\delta ' > \delta$, $r_{ij}(\delta ')$ is at least $r_{ij}(\delta )$.

Proof

Consider a miner who participates at equilibrium with a certain $\delta$. Given a set of costs, we consider the possible values of $c^*$ and $c^\dagger$. (a) If $c^*>1/Q$, then for any $\delta$, the equilibrium stays the same. (b) for $c^*\le 1/Q \le c^\dagger$, any increase in $\delta$ does not change this inequality and thus the equilibrium conditions do not change and thus maintain the same equilibria maximum and minimum ratios (i.e. $r_{ij}(\delta )= r_{ij}(\delta ')$ for all $\delta '$).

The only interesting case is thus (c) $c^\dagger <1/Q$, as $\delta$ increases $c^\dagger$ increases. Given a $\delta '>\delta$, we compare the relative market share of two miners i, j where $c_i<c_j$ as $r_{ij}(\delta ')=\frac{c^{\dagger }_{new}-c_i}{c^{\dagger }_{new}-c_j}$ which is decreasing with an increase in $c^{\dagger }_{new}$ (i.e. increasing $\delta '$). Thus, while $c^{\dagger }_{new}<1/Q$, a miner’s relative market share to any higher cost miner is decreasing.

The only case left to consider is a $\delta '>\delta$ s.t. $c^\dagger _{new}\ge 1/Q$. The new equilibrium hashrate $q_i'$ for miners participating is bounded by $\frac{1}{\delta +1}(Q-c_iQ^2) \le q'_i \le Q-c_iQ^2$. If we compare $q'_i,q'_j$ at the bounds we get $r_{ij}(\delta ') = \frac{1-c_iQ}{1-c_jQ}$ which is less than the old relative market share of $\frac{1-c_i/c^\dagger }{1-c_j/c^\dagger }$ since $c^\dagger <1/Q$.    $\square$

Impact of Attacks and Currency on Equilibria

Our equilibrium analysis in Sect. 4 assumes that the number of miners and their costs are known, and that the miner costs and rewards are in the same currency unit. In this section, we analyze certain attacks and events that may impact equilibria. We begin with the question: if miners are able to collude (two miners pretend to be a single miner) or duplicate themselves (a single miner pretends to be multiple miners), can they increase their own utility? In other words, are HaPPY-Mine equilibria resistant to miner collusion and sybil strategies? We show that HaPPY-Mine equilibria are resistant to collusion and Sybil attacks. We also study the effect of variable coin market value when reward is given in the coin of the blockchain. Due to space constraints, we state the main results for collusion resistance and the effect of variable coin market value, and refer the reader to the full version of this paper [14] for Sybil resistance and the missing proofs in this section.

Collusion Resistance. We consider the case of m homogeneous miners.

Lemma 4

Suppose m miners with uniform costs participate in HaPPY-Mine with parameters $\delta ,Q$. If $k \le m/2$ of the miners collude and act as one miner (so the game now has $m-k+1$ miners), with each colluding miner receiving 1/k of the colluding utility, the utility achieved in an equilibrium with collusion is at most that achieved without collusion, assuming m is sufficiently large.

In the heterogeneous cost model, it is unclear what collusion would mean for two miners with different costs, but one could imagine models where there are some miners with the same cost and they choose to collude. We leave this further analysis for future work. The general intuition we get from Lemma 4 is that with fewer miners, the equilibrium hashrate decreases thus the reward may increase as the cost decreases. So for the miners who don’t collude, the equilibrium utility increases. But for miners who collude, they must then share the increased utility with all colluders, and it is unclear if the increase is enough to make up for splitting the utility into k parts.

Variable Coin Market Value. In Sect. 4, we view the miner cost and reward in terms of the same currency unit. In reality, the reward is given in the coin of the blockchain being mined while cost is a real-world expense generally paid in the currency of the country where the mining is taking place. To bridge this gap we must understand how to convert real-world change in the price of the cryptocurrency to the relationship between the reward and the cost to miners.

Consider the equilibrium analysis to be saying that a hashrate of 1 for miner i costs $c_i$ unit of cost (say dollars) and that one coin of the reward has 1 unit of worth (i.e. $\$1$). Now, say the value of the currency changes by R, so one unit of currency is now worth $\$R$. We are now interested in understanding what happens to the equilibrium of the system, i.e. which miners would now participate at equilibrium and with what hashrate?

Lemma 5

In the static-reward model, an increase in the value of the cryptocurrency by a factor of R results in a new equilibrium strategy where the same miners participate with $Rq_i$ hashrate where $q_i$ is the previous equilibrium hashrate. The new system hashrate thus increases by a factor of R.

Lemma 6

In HaPPY-Mine, an increase in the value of the cryptocurrency by a factor of R results in the participation cost threshold to increase (allowing higher cost miners to participate), and the system hashrate to increase by a factor of R until it reaches Q, then increase by a factor of $\root \delta +1 \of {R}$.

Discussion

In this paper we’ve presented a novel family of mining reward functions which adjust to the hashrate of the system. Our functions fall in the class of generalized proportional allocation rules of [9] and thus inherit the properties of non-negativity, weak budget-balance, symmetry, sybil-proofness and collusion-proofness. These properties are defined based solely on the expectation of the reward of a miner and not under any equilibrium. In this work we’ve shown that for all $Q>0$ and $\delta \ge 0$ HaPPY-Mine has an equilibrium at a unique hashrate and set of miners, and if that hashrate is equal to Q there may be multiple equilibria at Q. We further show that the equilibrium includes at least as many miners as the static-reward function and is at a hashrate at most that for the static-reward function. We also discuss collusion and sybil-proofness in equilibrium and that as the market value of the coin increases, the equilibrium shifts to include more miners at an increased hashrate that is sub-linear in the value of the coin after the system hashrate surpasses Q (unlike the static-reward function whose equilibrium hashrate increases linearly indefinitely).

We show that by relaxing the budget-balance property from [9], we are able to improve upon fairness properties of a mining reward function. A question for future work is whether we can generalize this into an axiomatic framework for mining reward fairness and if there exists other functions in the generalized proportional allocation family that can improve upon our fairness results.

Long-Term Dynamics. As our analysis focuses on equilibria, a natural question to ask is whether we introduce any unfavorable long-term dynamics by pegging our reward to the system hashrate. One such concern is on the control of supply of the system. Two current versions of coin issuance are the Bitcoin and Ethereum models. In Bitcoin the reward per block halves every 210K blocks (approximately every 4 years until it is 0), so that half the total supply ever was mined in the first 4 years. In Ethereum the block reward is set at 5 Ethers so that the total supply will never be capped. Our proposed model is novel in that assuming a steady increase in hashrate, the issuance will decrease smoothly over time. The rate of decrease, $\delta$, is a parameter set by the system designer.

In the start of any new cryptocurrency the coins have no value, thus the miners that initially mine are speculating that the coins will have value in the future making up for the cost. During this time the hashrate is generally low so the existing miners do not incur much cost. When the currency does have more value, it appears older coins were mined for “cheap”. One could argue that those early miners mine speculatively, and for systems whose coin reward goes down over time, early miners may also control a large portion of the supply. The steeper the decline in the reward, the larger fraction of supply early miners control. As an example, it is estimated that the creator of Bitcoin, Satoshi Nakamoto, and assumed first miner, holds approximately 1 million Bitcoins², about 5% of the total supply ever, probably mined at a cost of only a few dollars [13, 18].

As a currency grows in value, new miners are incentivized to start mining in the system until the cost to mine a block becomes close to the value of the reward for that block. Since the total supply of the currency is tied to the hashrate we get the interesting phenomena that as the system gains users (miners) the projected total supply decreases, but inversely, if the system decreases in value and starts to lose miners, HaPPY-Mine works a bit like a fail safe where the reward will increase and hopefully aid in incentivizing the remaining miners to stay, stabilizing the value of the system as opposed to a death spiral of miners leaving and the reward just losing value. In this paper, we model the utility of the miner as the per-block profit. To understand the long-term dynamics at play, a future analysis of the evolving game should incorporate market share into the utility of the miner and its impact on market centralization.

Setting Q and $\delta$. We show that an increase in $\delta$ comes with an increase in good decentralization properties we want, like more miners mining at equilibrium and big miners joining with less hashrate. The more you increase $\delta$ however, the more constrained the issuance of the currency becomes, which could lead to centralization in the market control to early adopters. Setting Q and $\delta$ is thus a balancing game and involves practical considerations.

The $\delta$ exponent in HaPPY-Mine controls how quickly the block reward declines. A low $\delta$ would correspond to a gradual decrease in the block reward as the hashrate increases. Q is the threshold from which point the reward starts to decrease. One way to think of Q is as a security lower-bound for the system. When the hashrate reaches Q, any additional hashrate would lower the reward. A system designer should then choose a Q based on the mining hardware of the system (e.g. ASICs,GPUs, etc.) and some understanding of likely advancements in its performance and choose Q to be a conservative bound on the cost to amass enough hardware to attack the system (e.g. a 51% attack). Based on this and the issuance rate the system designer is targeting a $\delta$ can be set.

Since any change to parameters in blockchain systems generally require a hardfork in the code, i.e. a change that breaks consensus between adopters and non-adopters, the Bitcoin model of blockchain software development is to avoid such changes unless absolutely critical. Other, more expressive systems (e.g. Ethereum and Zcash), have relied on hardforks to implement changes and increase functionality on a more regular basis. Though setting Q and $\delta$ could be thoughtfully done only once in the inception of a new system, another approach would be to periodically update their values if the system’s growth (both miner hashrate and value of the currency) is not within the predicted bounds. One such concern would be if the target hashrate Q underestimated the growth of the system hashrate and thus stagnating the cost to attack the system. It would then be incentive compatible to increase Q as it would incentivize higher hashrates (increase security) while also increasing the reward for the miners. One idea is to set Q based on a long-term expected growth and have periodic updates (on the scale of years) to adjust Q based on miner increase and mining hardware trends.

Related Work

In this paper we’ve provided an equilibrium analysis of HaPPY-Mine, a new family of mining reward functions pegged to the network hashrate. As stated above, HaPPY-Mine is an example of the generalized proportional model of [9]. We compare HaPPY-Mine with the equilibrium of the static reward function of [4] associated with most cryptocurrencies. Other papers have looked at different games involved in mining including the game between participants in mining pools and different reward functions for how the pool rewards are allocated [20]. In [17], the authors present a continuous mean-field game for bitcoin mining which captures how miner wealth and strategies evolve over time. They are able to capture the “rich get richer” effect of initial wealth disparities leading to greater reward imbalances. [12] models the blockchain protocol as a game between users generating transactions with fees and miners collecting those fees and the block reward. They show if there is no block reward, then there is an equilibria of transaction fee and miner hashrate. Higher fees incentivize higher miner hashrate which leads to smaller block times (in between difficulty adjustments). When you introduce a high static block reward, the users may no longer be incentivized to introduce mining fees and there may no longer be an equilibrium.

In contrast, [8] also studies the case where there is no block reward, and analyzes new games in which miners may use transactions left in the mempool (pending transactions) to incentivize other miners to join their fork. Another work exploring the mining game when there is no block reward is that of [21] who introduce the gap game to study how miners choose periods of times when not to mine (gaps) as they await more transactions (and their fees). They show that gap strategies are not homogeneous for same cost miners and that the game incentivizes miner coalitions reducing the decentralization of the system.

Previous work on rational attacks in cryptocurrency mining includes [5] who study the security of Bitcoin mining under rational adversaries using the Rational Protocol Design framework of [10] as a rational-cryptographic game. Also, [6] who analyze the Bitcoin mining game as a sequential game with imperfect information, and [19] analyze selfish mining by looking at the minimal fraction of resources required for a profitable attack, tightening the previous lower-bounds and further extending the analysis to show how network delays further lower the computational threshold to attack. In [15], the authors explore the game of Bitcoin mining cost and reward focusing on incentives to participate honestly. They outline the choices different players can make in a blockchain system and their possible consequences, but their analysis does not take into account block withholding attacks. Another work related to the incentives at play in cryptocurrency mining is [7] which looks at the coordination game of Bitcoin miners in choosing which fork to build on when mining. They find the longest chain rule is a Markov Perfect equilibrium strategy in a synchronous network and explore other miner strategies, some that result in persistent forks.