区块链亲缘定理（英文版）.pdf

14:54 19/3/2019 RFS-OP-REVF180096.tex Page: 1662 16621715 The Blockchain Folk Theorem Bruno Biais Toulouse School of Economics, CNRS, Universit Toulouse Capitole, TSM-R and HEC Paris Christophe Bisire Toulouse School of Economics, Universit Toulouse Capitole, TSM-R Matthieu Bouvard Desautels Faculty of Management, McGill University Catherine Casamatta Toulouse School of Economics, Universit Toulouse Capitole, TSM-R Blockchains are distributed ledgers, operated within peer-to-peer networks. We model the proof-of-work blockchain protocol as a stochastic game and analyze the equilibrium strategies of rational, strategic miners. Mining the longest chain is a Markov perfect equilibrium, without forking, in line with Nakamoto (2008). The blockchain protocol, however, is a coordination game, with multiple equilibria. There exist equilibria with forks, leading to orphaned blocks and persistent divergence between chains. We also show how forks can be generated by information delays and software upgrades. Last we identify negative externalities implying that equilibrium investment in computing capacity is excessive. (JEL C73, G20, L86) Received May 31, 2017; editorial decision July 6, 2018 by Editor Itay Goldstein. Blockchains are decentralized protocols for recording transactions and asset ownership. In contrast with centralized protocols in which one authority is in charge of maintaining a unique common ledger, a blockchain operates within a network, whose participants each possess and update their own version of Many thanks for helpful comments to our editor I. Goldstein, two anonymous referees, C. Michel, V. Glode, B. Gobillard, C. Harvey, J. Hrner, A. Kirilenko, G. Laroque, T. Mariotti, J. Prat, J. Tirole, S. Villeneuve, participants in the TSE Blockchain working group, the Inquire Conference in Liverpool, the GSE Summer Forum in Barcelona, the Africa Meeting of the Econometric Society in Algiers, the RFS Fintech Workshop and Conference, the Oxford Financial Intermediation Theory Conference, the Swissquote Conference, the Digital Economics Conference in Toulouse, the BoF/CEPR Conference on Money in the Digital Age in Helsinki, the Swiss Finance Institute Research Days in Gerzensee, and seminars at University of Geneva, Sciences Po Paris, IAST Toulouse, INRIA Paris, TSE, University of Tokyo, University of Amsterdam and University of Toronto. Financial support from the FBF-IDEI Chair on Investment banking and financial markets value chain is gratefully acknowledged. This research also benefited from the support of the Europlace Institute of Finance, and the Jean- Jacques Laffont Digital chair. Send correspondence to Bruno Biais, HEC Paris, 1 Rue de la Libration, 78350 Jouy-en-Josas, France; telephone: +33 1 39 67 98 06. E-mail: biaisbhec.fr. The Author(s) 2019. Published by Oxford University Press on behalf of The Society for Financial Studies. All rights reserved. For permissions, please e-mail: . doi:10.1093/rfs/hhy095 Downloaded from by Renmin University user on 05 December 2019 14:54 19/3/2019 RFS-OP-REVF180096.tex Page: 1663 16621715 The Blockchain Folk Theorem the ledger, which is therefore distributed. The blockchain design was the main innovation underlying the digital currency network Bitcoin (Nakamoto 2008), but its potential benefits in terms of cost efficiency, speed, and security, for a variety of assets and contracts, have attracted interest from a broad range of institutions and businesses. 1 Blockchain experiments have been conducted for supply chains, trade finance, and financial transactions, for example by Nasdaq, the Australian Stock Exchange, BHP Billiton, Banque de France, and Ripple. Our focus is on public blockchains, such as Bitcoin or Ethereum, which are fully decentralized and in which participants are anonymous. Public blockchains stand in contrast to private blockchains, in which a central authority can authorize participants and certify transactions. The main issue we address is whether public blockchains can be expected to generate stable consensus: Is such consensus a necessary byproduct of the blockchain protocol? Or could the blockchain protocol lead to the emergence of different, competing, versions of the ledger? Each block, in the blockchain, offers an updated version of the ledger, taking into account recent transactions, and chained to a previous version of the ledgerthat is, a previous block. In an ideal blockchain, there is a single sequence of blocks, registering the dynamics of the ledger, on which all participants agree. In contrast to this situation, there could be forks in the blockchain. In that case there are competing branches, each registering a potentially different version of the ledger. Such forks could make the ledger less stable, reliable, and useful, as they could create uncertainty about the distribution of property rights. In practice, as discussed in the next section, there have been several forks, some of which have persisted until now. We endeavor to understand the economic forces at the root of forks, and why the blockchain protocol does not seem to always be successful at avoiding them. To study the dynamics of the blockchain, we analyze the behavior of its key participants: the miners. It is the miners who decide to which previous block a new block is chained and thus give rise to a single chain or trigger forks. We take a game-theoretic approach to analyze the strategies of the miners and the resulting equilibrium blockchain dynamics. The rules of the game played by the miners in the major public blockchains (such as, e.g., Bitcoin or Ethereum) are set by the protocol known as “proof- of-work,” which can be sketched as follows (and is described in more details in the next section): At each point in time, miners try to validate a new block of transactions. This implies solving a purely numerical problem unrelated to the blocks content, an activity referred to as “mining.” A miner who solves his problem obtains a proof-of-work, which he attaches to his block before disseminating it through the network. The instantaneous probability that a miner solves his proof-of-work problem is increasing in his computing power. In this 1 The blockchain is cost effective in that the administrative costs of running it are limited compared with those incurred within older technologies and institutions, such as notaries, banks, or depositories. 1663 Downloaded from by Renmin University user on 05 December 2019 14:54 19/3/2019 RFS-OP-REVF180096.tex Page: 1664 16621715 The Review of Financial Studies / v 32 n 5 2019 Figure 1 The blockchain At t =0, there is a genesis block B 0 and a stock of transactions included in a block B 1 , chained to B 0 . Miners work on a computational problem until a miner solves B 1 ,att 1 . B 1 is broadcast to all. Nodes check proof-of-work and transactions validity, and express acceptance by chaining the next block to B 1 . Figure 2 A fork context, at each point in time, the identity of the miner who proposes the next block is the outcome of a random draw. This ensures that miners take turns to validate blocks, and therefore no single miner has control over the whole verification process. When a new block is disseminated through the network, it becomes part of the consensus if miners chain their next block to it. As argued by Nakamoto (2008), proof-of-work generates a stable consensus, or in other words, a single chain, if miners always take the last solved block as the parent for their next block. This ideal blockchain is illustrated in Figure 1. Miners, however, may choose to discard certain blocks. Suppose, for example, that the last block solved is B n , but miner m chains his next block to the parent of B n , that is, B n1 . This starts a fork, as illustrated in Figure 2. If some miners follow m, while others continue to attach their blocks to the original chain, there are competing versions of the ledger. This reduces the credibility and reliability of the blockchain, especially if the fork is persistent. Even if, eventually, all miners agree to attach their blocks to the same chain, the occurrence of the fork is not innocuous. The blocks in the chain eventually abandoned are orphaned. They have been mined in vain, and the corresponding computing power and energy have been wasted. Moreover, the transactions recorded in the orphaned blocks could be called in question. 1664 Downloaded from by Renmin University user on 05 December 2019 14:54 19/3/2019 RFS-OP-REVF180096.tex Page: 1665 16621715 The Blockchain Folk Theorem A fork can also occur when some miners adopt a new version of the mining software that is incompatible with the current version. If miners fail to coordinate on the same software, this triggers a fork. Does the blockchain protocol rule out the occurrence of forks? In the frictionless case in which information is instantaneously disseminated in the network, and there is no attempt to double-spend (such attempts are described in the next section), it is commonly assumed that a single blockchain will prevail. To examine the validity of that “folk theorem,” we design a model that captures the key features of the proof-of-work blockchain protocol: There are M risk- neutral, rational, and strategic miners. Each time a miner solves a block, he obtains a reward in the cryptocurrency associated with the branch to which his block belongs. Miners choose to which previous block to chain their current block. They do so, observing all previously solved blocks, to maximize the expectation of their cumulated rewards at an exogenous liquidation time. We solve for Markov perfect equilibria of this stochastic game. Our analysis of this game uncovers two important economic forces at play in the blockchain. First, miners actions are strategic complements: Recall their rewards are paid in the cryptocurrency associated with the chain on which they are solving blocks. We assume the value of that cryptocurrency depends on the credibility of the corresponding chain, which is higher if more miners are active on it. Hence, miners benefit from coordinating on a single chain, which they can achieve by playing the longest chain rule (hereafter LCR), as suggested by Nakamoto (2008). This sustains a Pareto-optimal equilibrium (Proposition 1). The same coordination motives, however, sustain equilibria with forks. If at some time (e.g., when a sunspot is observed) a miner anticipates all others to fork and mine a new branch, his best response is to follow them. Indeed, he rationally anticipates that any block solved out of the equilibrium path will not be accepted by other miners and the corresponding reward will be worthless (Proposition 2). Second, we identify a countervailing force that we refer to as “vested interest”: An important feature of the blockchain is that miners cannot immediately spend or convert the cryptocurrency earned for solving blocks. Consequently, a miner who has accumulated rewards by solving several blocks on a given chain has a vested interest in this chain remaining active. In particular, the value of these rewards would drop if he moved to a different chain. Vested interests may counteract coordination motives for a group of miners, inducing them to keep mining a minority chain, and sustaining persistent forks in equilibrium (Proposition 3). Unlike temporary forks that only rely on coordination motives and would arise with atomistic miners, equilibria with persistent forks depend on miners taking into account the impact of their actions on the blockchain. It is likely, in practice, that large pools of miners, such as AntPool, 1665 Downloaded from by Renmin University user on 05 December 2019 14:54 19/3/2019 RFS-OP-REVF180096.tex Page: 1666 16621715 The Review of Financial Studies / v 32 n 5 2019 BTC, or Slush Pool, who each represent more than 10% of the computing power, indeed behave strategically. Next, we enrich the model and make it more realistic by incorporating further real world characteristics of blockchains, such as information delays, and instances in which miners have to choose between incompatible upgrades of the mining software. We show that like the sunspots in our basic model, these characteristics can trigger forks on the equilibrium path. And we show that the same fundamental interplay of coordination motives and vested interests as in the basic case underlies equilibria with forks in these more realistic extensions of the model. Finally, we endogenize the computing capacity that each miner installs. Because the difficulty of the mining process is adjusted upwards when the total computing capacity in the network increases, a miners investment in computing power exerts a negative externality on all other miners. This gives rise to an arms race in which each miner ends up overinvesting (not unlike in Glode, Green, and Lowery 2012 and Biais, Foucault and Moinas 2016). This analysis points to another source of inefficiency in the blockchain design. Early academic contributions on distributed consensus are in computer science. Since seminal work by Pease, Shostak, and Lamport (1980) and Lamport, Shostak, and Pease (1982), finding protocols that allow network participants to reach an agreement has been a major issue in computer science. In a Byzantine agreement (BA) setting, participants seek to agree on a common output aggregating private inputs, in the presence of “malicious” participants who try to attack, that is, disrupt the agreement. Nakamoto (2008) proposes the proof-of-work blockchain protocol to achieve consensus with high probability, in spite of potential attacks by malicious miners seeking to create a branch faster than the “honest” ones. Miller and LaViola (2014), Pass, Seeman, and Shelat (2017), and Garay, Kiayias, and Leonardos (2015) consider a larger set of attacks. 2 Their results suggest that the protocol is robust as long as honest miners represent the majority of computing power. 3 While these papers consider ad hoc strategies from exogenously honest or malicious participants, we study optimal strategies from rational and profit- maximizing players in a game. The computer science papers to which our analysis is the closest, by Kroll, Davey, and Felten (2013) and Carlsten et al. (2016), analyze interactions between miners as a game. Kroll, Davey, and Felten (2013) offer interesting economic intuition, but do not develop a formal game- theoretic analysis. Carlsten et al. (2016) focus on specific strategies (regarding the choice of which block to chain to, and which transactions to include in a block) and show that they constitute an equilibrium. Relative to the computer 2 Eyal and Sirer (2014) analyze a specific strategy called selfish mining, by which some miners maintain a “secret” branch of blocks and then release it to the network. 3 See Bonneau et al. (2015) for a survey of the literature analyzing Bitcoin. 1666 Downloaded from by Renmin University user on