Cryptoeconomics In 30 Minutes by Vitalik Buterin (Devcon5)

I wanted to we're gonna start this presentation with a kind of symbol a question which is just what did Satoshi in events anyway right so who here a sort of Bitcoin who here is aware of the fact that Satoshi created Bitcoin okay so Satoshi created Bitcoin right but what makes Bitcoin interesting now the way that you might hear a lot of people describing it is that Satoshi is the first person who solved this long elusive 25 year old computer science problem called the Byzantine generals problem right you did you can find a bunch of people saying things like this that the solution to the Byzantines generals problem was invented developed by a mian group open bracket identity unknown cause bracket who goes by the name situation Nakamoto the business a generals problem was quote unsolvable until Satoshi sidestepped it many authors have written in the about the decay of Western civilization and how the loss of power causes societies to disintegrate and so we she fixes this problem apparently so this is not true the Byzantine generals problem was solved by am a wonderful fellow named Melissa oil import in 1982 so in the paper that introduced the Byzantine generals problem he basically provided algorithms for how a set of parties that all wants to agree on some piece some piece of data some and if I a choice between some large set of choices can do so and can do so fairly easily even under assuming up to a third of them are malicious and even assuming like no assumptions about Network synchrony and all of these things right so there's a bunch of different solutions to the Byzantine generals a problem in the visiting generals problem paper and I encourage people to read it so if visited generals problem was solved at the very beginning and if there were whole bunch of ways of doing decentralized consensus for 25 years before Bitcoin and 15 years before proof of work started to be used for anything then what did Satoshi really invent Satoshi she invented crypto economics so what is crypto economics sorry crypto economics is basically use of economic incentives to provide guarantees about applications so you can view it can crypto economics us being and if the use of appended economics and game theoretic reasoning as a kind of appendage to cryptographic reasoning I mean so cryptographic reasoning allows you to and if believe certain things conditional on some assumptions that basically claim that the adversary does not have a computer that's bigger than the size of the observable universe and that's all really nice but crypto economics allows you to have other kinds of guarantees that cryptography can't provide but because of the types of guarantees that groups we can economics us trying to provide there they're not cryptographic guarantees instead they're guarantee is conditional on certain kinds of economic assumptions so for example the assumption that a platform will continue running liveness a also known as censorship resistance is something that can be provided by economics cannot be provided by cryptography even the assumption that a decentralized consensus system will come to consensus is something that cannot be guaranteed by cryptography it can only be guaranteed by some kind of model that says things about the motivations of participants in the plan the platform so what chains are crypto economic protocols here's a blockchain you have blocks and five of those blocks are in one chain one of those blocks is kind of off to the side and the wrong chain and in a blockchain you wants to encourage more miners to create blocks that extend the correct chain and you do not want to encourage pea able to create blocks that just go off to the side to the side and make a different chain and confuse people so how do we do this with economic incentives now it's actually a bit more subtle than just talking about incentives right Bitcoin uses group to economics to solve two problems what the first problem that is what I call the waitest assignment problem but you might also have heard about basically the same problem under the name civil resistance so here's the problem right we've had these PFT algorithms for a long time these algorithms that say you could get together 15 nodes have them send a bunch of messages to each other and as long as less than five of them are malicious then the system is going to come to consensus and if you can make assumptions about the maximum amount of time that messages can will take to pass between these nodes that instead of tolerating up to four militias you can tolerate up to seven militias and that's like even better and it turns out that if you can allow even stronger like really strong security assumptions you can tolerate all the way up to thirteen being malicious but that's a topic for another day so we've had these algorithms for a long time right and so we had these centralized consensus what's the problem what why hasn't this taken off and the reason is ultimately that even in a system that has say 15 different parties you have to have some mechanism for choosing who these 15 parties are right you could say oh it's like the 15 big major banks who here trusts at least 11 of the top 15 major banks it could be 15 of the top world governments who here trusts at least 11 of the top 15 world governments so this is this is a challenge right if he wants to create a system that actually will be a kind of accepted by large constituencies around around world then it's hard to kind of create this set of 50 of 15 people that everyone will agree then you actually can't trust that we still love them it's hard to come up with a set of actors running the system that actually is kind of credibly neutral right and this is the problem that proof-of-work and proof of stake so cleverly solve right basically what proof of work and proof of stage do as they say well instead of pre-selecting 15 people that will be run this system what we're going to kind of de facto do is we're going to say anyone who publishes a certificate that kind of Matt cryptographically proves that they've keep I computed some large amounts of mathematical work gets to join the set so if you can solve like some extremely complicated mathematical problem and you published a solution to this problem said ah you're part of the set I mean proof of stake if you have a bunch of coins and you send those coins to the deposit contract that I you're part of the set and so instead of the kind of pre selecting 15 people that everyone trusts we create this kind of open permissionless system where anyone can join and participate but then we we wait the birth of participants by the number of economic resources that they contribute right so in proof of work the the kind of the weight of the impacts that you have on the consensus is proportional to the amount of computing power that you're bringing to the table and in proof of stake it's proportional to the number of coins and both of those things take a lot of economic resources to get the reason we can't just allow everyone to join in give them one vote is because well on the internet nobody knows you're a dog and on the internet nobody knows you're a virtual machine inside of a computer with 10,000 virtual machines where that computer is run by a dog so like this is the problem that we're trying to solve right so economics actually does do a very good job of solving this problem of kind of creating this said of actors and this kind of set of assignments of voting power to basically an open permission Allah set of actors that actually is very economically difficult to kind of take over and become 51% of so this is what perfect work solves and this is basically the innovation that made vic when possible the innovation that makes theory impossible and proof of stake is and it fundamentally in the exact same spirit except instead of burning a bunch of your tricity to to prove that you have economic resources you just like points to the address where you deposited some coins into your contract so this is the first problem and the second problem is the incentive problem right you have a bunch of permissionless actors and some of them might be wonderful people and some of them might might be people in some country that can mind really cheaply that you have and you have like no you don't really understand what their psychology is some of them might be like big big corporations some of them might might be hobbyist some some of them might be like hackers that gain and gain access to computing resources and like these are kind of disparate groups of people and we can know and of fairly little about what motivates them well what's the thing that motivates a lot of people economic incentives right like we know that people in all these disparate regions like money and wants the game more it's generally people that don't like money and what to gain more are not going to be the ones that have you know the economic resources to make up 51% of the network in the first place so we can infuse economic incentives as a way of driving over and of driving this wide disparate group of participants to participate in the network in good ways instead of participating in the network in bad ways so these are both kind of crazy uses that use cases of crypto economics and they're used in Bitcoin they're used in aetherium they're used in basically an every main major public watching so incentives pretty clear if you make a block that's part of the main chain you get a reward and you have to pay some electricity costs to make a plug but the rewards gonna be a bit bigger than the cost and if you make a block that's not part of the main chain you have to pay a cost and so if you're making blocks you have an incentive to kind of continue to extend the chain that everyone else's who here understands this yay so crypto economics is great because cryptography lets us prove things with very minimal assumptions about behavior actually without assumptions about behavior group to economics allowed us to approve things with kind of minimal assumptions about participants so this an assumption that they're motivated by economic incentives and actually systems can even work even if people are not willing to kind of just motivated by economic incentives all you need to assume is just an upper bound on like basically how much money attackers have that they're willing to burn and both of these assumptions are pretty ideal for decentralized and trust me to my systems so what are the security goals that we have in corruptive economic systems right so first of all we want the correct execution of the protocol to be a robust equilibrium so you have Nash equilibriums that basically say if everyone is following the protocol it should be in each individual participants interest to also follow the protocol well we need something that's even more robust we wants the incentive to follow the protocol honestly to be pretty substantial and we want the equilibrium to survive even if some sort of significant percentage of other participants start doing nasty things take into account kind of games that are perturbed by third parties like attackers making bribes and also ideally to just maximize the cost of a successful attack so if a successful attack happens then someone who who caused the attacks to happen who is a lot of money there's different security models that you can have so for example you can have different kinds of assumptions about participants you can assume participants are honest you can assume that they're rational but they're not coordinated so they want to make money but they're not kind of colluding with each other to make as much money as possible you could assume they are coordinated do your assumptions apply to a super majority of participants your majority adjust to a minority assumptions about the network is the network synchronous our message is guaranteed to get across within some very strict time bound is there partial synchrony is there a complete a synchrony where you have no idea how long messages will take to arrive outside influences so if there's an attacker that's willing to make economic rewards to participants already in the system is there a balance on the budget the amount they need willing to pay is there a bound on the email that they actually have to pay if an attack happens so one common kind of critique of the crypto economic approach which focuses on incentives rather than focusing on honest majorities is basically like what about attackers that just have this really large extra protocol incentive like participants that basically just wants to watch the world burn right this could be a keep eating blockchain this could be a government saying this could be the just hackers that take over and want to have some fun so the the critique here basically says well we're assuming that you have these participants that are motivated by economic incentives and what if there's people that just wants to break the thing regardless of how of how much money is on the table if they don't break the thing so there's two replies to this right one of them is that the traditional kind of honest majority driven approach actually is even more realistic because it assumed even more unrealistic because it assumes that the majority of the participants are kind of altruistically honest they're honest even if they have incentives to be dishonest which is even more unrealistic than the economic approach right it's basically saying that like more than half of this network that that in order to get into you have to like put in a huge pile of money with the expectation of getting more money and more than one half of these participants are going to just voluntarily forego forgo opportunities to save money and this has already been falsified right so for example a couple of years ago there was this fork that happens on the Bitcoin blockchain where miners stopped verifying blocks because they just assumed that everyone else was verifying blocks and so one invalid block got in and a bunch of other blocks but built on top of it and about six blocks had to get thrown out right so we know for a fact that participants in these networks are willing to be lazy if they can get away with it and the second argument here is that well pushing the cost of attack as high as possible matters right because the higher the cost of an attack the lower the risk that there is an attacker with enough resources they're not just incentive if you also need resources and enough will to kind of actually attack the system actually exists so another kind of version of this critique basically says well you can't assume that people don't have an incentive to break the chain because if they have an incentive to break the chain then you can just like hedge on financial markets and you can kind of have you basically make money on derivatives from like watching the watching the coin price drop and so does it really matter if like two million of your eath get burned if you make your two million he's back by doing a short on bid Finex and like a lot of people say this right as an argument for why kind of the economic model that's broken but the problem with this is right that first of all there is a man there is some maximum amount that you can earn by breaking the chain right there like finding financial markets are not infinitely cheap and the attacker is motivated to already have taken this maximum trade the attack if an attacker is gonna try to break the chain they're gonna be motivated to like Meek not just enough money to cover their losses but as much money as possible to benefit from the attack and there is kind of some fixed number that the is the amount of money that they can make and so if the cost of attack is higher than this number then you've won and if the cost of attack is lower than this number well the lower it is then the more of a risk that this kind of attack actually will happen right so there is an a very significant benefit to you increasing the cost of attack and so increasing the amount of like basically kind of course but outside the system incentives you know you need to have in order to actually be willing to attack the chain so like for example if you're going to attack the chain then it's going to be fairly easy to make say a few thousand worth of even profits anonymous way on decentralized markets but if the cost of attack goes up to a million if then making the corresponding amount on financial markets anonymously and getting away with it is gonna be vastly harder right so the more you but you push up the requirement for how much money they need to make to offset the cost of an attack then the harder and attack the more unrealistic an attack becomes so we can look at proof of work in a kind of cryptic economic context right so you can look at like models that say the majority of the network is honest or the majority of the network is uncoordinated or we can talk about the amount of budget an attacker needs to have to be able to make an attack or we can talk about the cost of an attack if it succeeds and then we can also talk about kind of different assumptions about network synchrony assaut or do messages arrive immediately do they arrive after one minute to the arrive after 10 minutes so the first column is just the usual kind of 51 percent argument and the longer there the network latency the more the percentage goes up because the honest network like sometimes accidentally make stale blogs the second column uncoordinated the reason why that column what kind of looks much harsher is because you have selfish minding and the cost of an attack is zero because well if you make an attack and you succeed then sure you have to grind a bunch and like pay for a bunch of the electricity it's to create the plea attacking blocks which is what the budget is but you get you get paid a block reward for all of the attack for all of the blocks that you make and so actually the total cost of the attack after you factoring the rewards becomes either 0 or negative so we can look at different consensus algorithms in this way and proof of stake is actually kind of in a large part about trying to take this chair improve on it one important concept encrypt of economics is this distinction between and if attributable or uniquely attributable false and not uniquely attributable false so I am not uniquely attributable fault is a fault where you know that some mistake happened but you have no idea who is responsible right so for example if you have a blockchain and you have two different Forks then one of the two sides here is responsible right one of the two sides here builds on top of an old block instead of building on top of a newer block but you don't know which one you don't know whether the top chain came first or or whether in the bottom chain came first like some people might know if they're watching the network closely but there is no way of proving who did what first cryptographically and so the fault here is not uniquely attributable and the problem with them not uniquely attributable faults is that there's a limit to how much you can penalize them because if you penalized on a non unique way to your variable faults too much then there's a risk that innocent people will get caught and so you're making the system much was attractive to participate in unique way attributable faults are faults where if some actor misbehaves it can be unambiguously shown that it was their fault so if some protocol requires you to shell the result of a calculation and someone shouts 2+2 equals 5 then that's something that you can kind of point to and say look at this guy over here and clearly it's definitely this guy over here who me who made a mistake and published a false statement and you can given them a pretty large in protocol penalty so this kind of gets us to the goals of proof of stake right so in proof of stake validators have to make deposits they have to put their eath into a smart contract in order to participate and the reason why those coins have to be locked up is so that if validators make uniquely available faults if validators do wrong things that they that can be identified as specifically them doing wrong things then you can have in protocol penalties touch these deposits and take away than the deposits and this is what weeds - in extremely my cost of attacking purpose take that you just do not get any proof of work system so finality a block is finalized basically if validators kind of make a series of messages supporting a blog in such a way that in order to also finalize a competing block the valid at least one third of validators would basically have to publicly contradict themselves so the kind of naive way to think about it is for a block to be finalized two-thirds of people have to vote for it and so for a competing block to be finalized then two-thirds of people would also have to vote for the competing block and so one-third of validators would have to contradict themselves and if a validator contradicts themselves you can take the evidence of that and you can use that to penalize them in a reality it's more complex than one round of voting it's kind of at least two rounds of voting using this clever algorithm called Caspar FFG I encourage people to learn more about Caspar FFG by reading the paper on archive yay so proof of stake is all about crypto economics at the core proof of work is all about crypto economics at the core there is a lot of other things that are also about crypto economics at the core one interesting thing is that crypto economics can sometimes compete with cryptography right so for this one useful example to think about is interactive computation so interactive computation is this kind of scalability primitive that basically is trying to allow block chains to learn the results of complex facts about computations without actually doing the entire computation on the blockchain so for example suppose you have some function y equals f of X and it turns out that f it can be decomposed into this format where it's like you start with X then you apply f 1 then you apply F 2 then you apply F 3 blah blah then you apply F 99 and then you apply F 100 and basically you have a small value and you go through a series of small values and you get Y at the end so here is a protocol for kind of how the blockchain can warn the result of this computation without executing all of it on chaining so yes you set the problem you said here is f here is X we wants to learn why then you have a smart contract that contains some reward and the smart contract implements this protocol anyone has the ability to submit a sequence of values basically X 1 X 2 X 3 so all of the intermediate steps of the computation of all and you can you can have the individual steps have quite a bit of computation in them right you just basically each individual step has to be small enough that you can execute it inside of a block so the proposer submits a sequence of values X 1 X 2 X 3 all the way up to X 100 along with a deposit so this is step one step two you wait right and there's a challenge period so suppose for example that as a kind of quote as a simple example the the channel the problem that we're going to make the blockchain try to solve is we're gonna try to calculate 2 to the power of 10 in suppose we live in a universe where multiplying by 2 is really hard and so you can only multiply by 2 once inside of a block so how do you do an interactive computation to compute 2 to the power of 10 right basically you would have to submit all the intermediate values right you would submit these 10 intermediate values you would submit 1 2 4 8 16 blah blah blah and you would submit these values and then you would have this challenge period and in this challenge period basically anyone has the ability to kind of points to one particular value and say wait this value actually isn't 2 times the value before so in this case so like suppose we have this kind of evil smiley face guy and the evil smiley face guy is just really really tired of this stupid idea that that aquila byte is a thousand and 24 bytes instead of being a thousand bytes and so this guy wants to solve the problem by convincing the world that two to the power of 10 is not a thousand 24 it's actually a thousand and the evil smiley face guy is going to do this by well submitting these 10 values right these are the powers of two 1 to 4 eight 16 32 64 128 - and 250 500 1000 there the powers of two each one is twice the other the thing at the end is a thousand what's the big deal so within this challenge period a challenger can say hmm someone is wrong on the blockchain I disagree well I disagree with that 250 there I think of hundred twenty eight times two it's two hundred and fifty six and the the Challenger can submit a transaction that points to this index and when that happens the calculation actually runs on the blockchain that particular multiplication by two 128 times two is run on the blockchain and the block chains like wait the actual inserts 256 and this guy submitted 250 so this guy's fraud and so the original submitters deposit gets destroyed and part of the deposit is given to the Challenger as a reward so this is a crypto economic protocol right because the ability of this protocol to work relies on incentives it relies on the penalty that the submitter gets if they submit a set of values though where one of those values is wrong and it also relies on this reward and that the sum that the Challenger can get if the detects that one of these values is wrong and they send a transaction that we've kind of for show us up watching which transaction is wrong allows it to be verified and allows the submission to get rejected now this crypto economic protocol basically is in some ways the core of how optimistic roll-up works right so if anyone has seen am optimistic roll-up like the the unipeg exchange thing that's been floating around recently like this is the kind of fundamental crypto economic math and that that protocol works on and basically how it allows scalability to happen by just doing computation off chain by default unless someone complains about some particular transaction in some particular block being incorrect so notice that interactive computation does the same thing as GK snarks right Ziqi snarks are about doing computation off chain being a proof on chain and allowing everyone else to just verify the proof instead of running the entire computation themselves interactive computation does the same thing a few people run the computation off chain and they run the scripts of economic interactive protocol and the fact that this crypto economic interactive protocol happens in the clear on chain and everyone saw this happening it can convince people that the results of the computation is correct without them having to run the entire computation themselves and this is kind of the the schism between ZK roll up versus optimistic roll up which is better well they have different advantages right so snarks do not require a challenge period so with a snark you can know the answer immediately whereas within up an optimistic or interactive computation game you have to kind of wait for some period of time to make sure that nobody challenged the computation snarks are less efficient so a zero knowledge proof have a very high computational overhead and with general purpose of your virtual machine execution the overhead goes way higher all optimistic computation does not have this problem an interactive computation is also easier to implement so if you do not want to have a challenge period if you do not want to have this fraud proof dependency then snarks are better but otherwise kind of especially in the short term and especially for more complicated general purpose applications then you can also look at this optimistic approach so crypto economics is used in a theory emily and for lots of things it protects the base layer of the protocols that we all know and love it protects our white clients it protects the security of our glorious and sacred layer to games plasma channels optimistic roll-up trivet it can be used for das vs. dots resistance such an improved security of option messaging protocols and so much more so this really is kind of the bedrock of what large parts of our ecosystem are based on and since we're by kind of planting the seed in 2009 Satoshi Aaron have created a really interesting and great and now we're here building great things on top of it thank you [Applause] you