Ethereum's Vitalik Buterin examines the rewards and punishments of crypto-economics

Vitalik Buterin, Ethereum's chief scientist, kicked off the two-day EDCON developer event in Paris with what he called a "back to basics" discussion of crypto-economics. He analysed contexts in which algorithms for methods like proof of stake and sharding operate and discussed how to ensure these are safe.

Buterin started by pointing out that the economic incentives of Bitcoin are limited to reward only; that in order to move beyond a system which calculates mainly just the state of how much money everyone has, requires rewards and penalties – with the complexity that accompanies that.

During his talk, Buterin touched on the issue of selfish mining and made specific mention of recent developments in China with regard to Bitcoin and proof of work, to illustrate problems implicit within the "holy book of Satoshi".

He mentioned data availability as an example. "It should be possible to see all the data associated with a block," said Buterin. "So you could imagine if a mining cartel really wanted to, it could start mining a chain of blocks where all the blocks are completely valid, but the cartel only publishes the headers to the blocks. It doesn't publish anything else about the blocks and all the rest of the data it just keeps to itself. This actually would be a failure of a system because no one else would know what the state is, and that's bad."

Bitcoin solves this problem because full nodes only accept blocks where they can personally download everything and verify everything; in the case of the light node protocol there is an implicit trust of the miner.

Buterin continued looking at Bitcoin's potential shortcomings. "Basically if you send a transaction then that transaction should be able to get quickly included if it pays a sufficiently high fee," he said. "Now, as people who have followed the Bitcoin blockchain in the last couple of weeks know, sufficiently high fee ... emmm ..."

He said if you have a transaction and it really wants to get included the system then it should not be discriminated against and not allowed to get in. This becomes very important if you are using payment channels like the Lightning Network where a violation of availability in this sense, a censorship attack, can be translated into a theft attack on the channel system.

The incentives in Bitcoin are fairly simple: the miner of a block currently receives a reward of 12.5 BTC if they get that block included in chain. "The miner also has the ability to extract a kind of economic rent because the miner is in some sense a temporary dictator over the right to include transactions in the chain during the scope of that one particular block that they are creating," said Buterin.

"A block that doesn't get into the chain gets nothing so rewards are marginally around zero-sum. If you can make people get less money then that translates into you getting more money. This is in some ways the source of the selfish mining attack."

In terms of economics, there are a couple of types of incentives that can be applied. The first and most commonly discussed is using tokens or protocol-defined cryptocurrencies, which are assigned to actors to incentivise them. This allows for rewards as balances can go up, and penalties where tokens are deleted and the protocol makes balances go down.

A less discussed type of incentive is privileges, said Buterin. "This means you can incentivise actors by giving them decision-making rights when those decision-making rights can be used to extract rent. A simple example is if you create a block then you have a certain amount of space, you have the ability to include transactions. Because you have the decision-making power over whether or not to include transactions, other people can basically bribe you to do what they want you to do with that space, which is to include their transactions, and this is a source of revenue for you.

"This is actually a kind of desired behaviour and it serves a dual purpose incentivising people to participate in the protocol and also creating a kind of efficient market for transactions."

"If they do something bad, you can deny future privileges. If an actor does something bad then you can kick them out of a validator pool and they can't create blocks anymore."

Buterin said protocol faults can be divided into faults of individual actors not doing what they are supposed to be doing, and faults of the network, which are basically latency.

In some cases you can mathematically determine how faulty a system is from inside the system, he said. But sometimes it's not possible to directly measure protocol faults. "Censorship is a difficult one, right. So actively denying transactions the ability to get included in blocks.

"Let's say all of the Bitcoin miners decided – we are no longer going to accept transactions from certain addresses, or we are going to try and extort from everyone, and not accept any transactions unless they pay a 20% fee to us.

"That's not really something where you can actually tell there is a fault going on. Because one thing that the miners could do, for example, is just spoof a bunch of transactions and include their own transactions and so it's very difficult to tell if anything bad is even happening."

In terms of penalty assignment, if you find a protocol fault and you can unambiguously prove that one specific party is faulty, "then you should kick them – and kick them as hard as you can", said Buterin.

"Ideally, in order to be able to kick them really hard you would want them to have a security deposit at stake. You want them to have put up money in order to participate in the protocol and the higher their security deposit is, the more you can kick them. So one principle is basically – why not punish more?

"The second principle involves situations where you can't choose. If a fault assignment tells you one of 'N' parties is guilty but you can't tell exactly which one, then you should punish all of them – but you should only punish all of them lightly.

"If you punish all of them too much then you get a protocol that is a bit too inhospitable to regular nodes. So an honest node could potentially get punished just because they kind of fell in with the wrong crowd, in some crypto-economic sense."