An Incentive Analysis of some Bitcoin Fee Designs
aa r X i v : . [ c s . G T ] N ov An Incentive Analysis of some Bitcoin Fee Designs
Andrew Chi-Chih Yao ∗ Abstract
In the Bitcoin system, miners are incentivized to join the system and validatetransactions through fees paid by the users. A simple “pay your bid” auctionhas been employed to determine the transaction fees. Recently, Lavi, Sattath andZohar [8] proposed an alternative fee design, called the monopolistic price (MP)mechanism, aimed at improving the revenue for the miners. Although MP is notstrictly incentive compatible (IC), they studied how close to IC the mechanismis for iid distributions, and conjectured that it is nearly IC asymptotically basedon extensive simulations and some analysis. In this paper, we prove that the MPmechanism is nearly incentive compatible for any iid distribution as the number ofusers grows large. This holds true with respect to other attacks such as splittingbids. We also prove a conjecture in [8] that MP dominates the RSOP auction inrevenue (originally defined in Goldberg et al. [5] for digital goods). These resultslend support to MP as a Bitcoin fee design candidate. Additionally, we exploresome possible intrinsic correlations between incentive compatibility and revenue ingeneral. ∗ Institute for Interdisciplinary Information Sciences, Tsinghua University, Beijing. Introduction
Bitcoin , and more broadly blockchain systems, rely on the willingness of honest playersto participate in the system. A good blockchain system should have simple, practicaldesigns with suitable security guarantees against cheating. The incentive compatibility (IC) concept which seeks to incentivize the participants to be truthful is playing anincreasingly central role in the design of distributed financial systems.Recently, Lavi, Sattath and Zohar [8] started a study of the subject of
Bitcoin FeeMarket design. In this market, there are two kinds of players: the users who havetransaction records that need to be certified and registered in the bitcoin system, andthe miners who create new blocks to include the transactions and get them certified.Each user declares the maximal amount she is willing to pay for her transaction, andthe miners use a mechanism to decide which transactions to include and how much feeto charge each user. A primary focus of their study is the
Monopolistic Price (MP) mechanism, which is a natural and practical mechanism, although not IC in the strictsense (see Section 2 below). Their extensive simulations indicate that the mechanismdoes not deviate too much from being IC for most iii distributions, as the number ofusers n grows large. An analysis was given for the special case of discrete distributionsof finite size. They suggest that MP might be a good alternative to the “pay your bid”auction, which is subject to low bids and revenue. It is posed as a conjecture that theMP mechanism is nearly-IC for general iid distributions.We will prove that MP is nearly-IC for any iid distribution as n grows large, thusmathematically validating the strong simulation results obtained in [8]. Note that thestandard IC criterion (in auction market) only addresses one kind of attack, namely,the reporting of an untruthful bid value. There are other possible attacks by Bitcoinusers: for example, in the multiple strategic bids (MSB) attack discussed in [8], a usercould gain advantage by splitting his transaction into several transactions and biddingseparately. This strategy could even enable a losing transaction to be included in theblock. We will also prove the nearly-IC conjecture for MP with respect to the MSBattack.We consider another mechanism, called the RSOP (Random Sampling OptimalPrice) auction, which was first defined by Goldberg et al. [5] in the digital goods contextand shown to be truthful. We prove that the RSOP revenue is always dominated bythe MP revenue, as conjectured in [8]. In fact, the revenue difference can be arbitrarilylarge for some distributions, prompting us to look more deeply into possible correlationbetween IC and revenue in general (Theorem 6-8).The contributions of the present paper are two-fold. First, we prove the Monop-olistic Price mechanism to be nearly-IC, confirming the previous strong experimentaldata. This holds true against the MSB attack as well. We also show MP to dominatethe RSOP auction in revenue. These results lend support to MP as a Bitcoin fee de-sign candidate. Secondly, the methodology used in our proofs involves sophisticatedmathematical analysis. It demonstrates that theoretical computer science can providepowerful tools to complement system design for blockchains. Finally, we believe thatthe emerging area of incentive compatible blockchain design is an exciting research areawith many intriguing problems to solve, for theorists and system designers alike. Related Work:
The basic model for Bitcoin fee market introduced in [8] in fact resemblesthe maximum revenue problem for
Digital Goods as considered by Goldberg et al. [4][5].The MP mechanism is similar to the optimal omniscient auction in [5]. However, The2itcoin fee market differs from digital goods in its additional features: such as theauctioneer may delete or insert bids, or the users may split bids. This makes the Bitcoinfee design a rich and relevant new research subject for auction theory and mechanismdesign. Among those work closely related to the current subject include Babaioff et al.[1], Kroll et al. [6], Carlsten et al. [3], Bonneau [2], Huberman et al. [7]. To formulatemeaningful incentive models, there is much research work in Bitcoin which providesimportant ingredients for consideration. A more complete survey of related work canbe found in [8, Section 1.3].
We first review the Bitcoin fee model and several mechanisms defined and studied in[8]. A miner acts as a monopolist who offers n users to include their transactions inthe miner’s next block for a fee. Each user i has one transaction that needs this serviceand is willing to pay a fee up to some value v i . The miner’s problem is to design amechanism to extract good revenue. The standard Bitcoin mechanism in use is a pay-your-bid system, where the miner simply takes the highest bids to fill the capacity ofthe block. This mechanism may not receive good revenue, since some bidders may notreveal the true value of the fees they are willing to pay. In view of this, some alternativemechanisms are proposed in [8] and their security properties considered, which we willreview below. Suppose user i bids v i for 1 ≤ i ≤ n . Sort v , · · · , v n into a decreasing sequence b ≥ b ≥ · · · ≥ b n . Define the monopolistic price as R ( v ) = max k ∈ [ n ] k · b k . Denoteby k ∗ ( v ) the k maximizing R ( v ) (in case of ties, k ∗ is taken to be the maximal one).The miner will include all users with the highest bids b , b , · · · b k ∗ ( v ) and simply chargeeach one of them the same fee b k ∗ ( v ) . Call this the monopolistic price p mono ( v ) = b k ∗ ( v ) .This mechanism gives the miner revenue R ( v ), which is obviously the maximum revenueobtainable if all accepted bids must be charged a single price.The above MP Mechanism is not truthful. [8] analyzed how serious the non-truthfulnesscan be; we review their results below.Consider any user i and the vector of bids v − i = ( v , · · · , v i − , v i +1 , · · · v n ) of theother users. Let p honest ( v i , v − i ) = p mono ( v i , v − i ), and p strategic ( v − i ) = min { b i ∈ R | p mono ( v i , v − i ) ≤ v i } .To measure how much temptation there is for the users to shade their bids, define the discount ratio δ i for user i : δ i ( v i , v − i ) = ( − p strategic ( v − i ) p honest ( v i , v − i ) if v i ≥ p strategic ( v − i ) , . This ratio captures the gain a user can obtain by bidding strategically (instead of truth-fully).A major theme of [8] is to investigate how large the discount ratio will typicallybe. Assume all true values v i are drawn iid from some distribution F on [0 , ∞ ). Two3easures are defined: the worst-case measure and the average case one. For the former,let δ max ( v ) = max i δ i ( v i , v − i ) , ∆ maxn = E ( v , ··· ,v n ) ∼ F [ δ max ( v )] . For the latter, let ∆ averagen = E ( v , ··· ,v n ) ∼ F [ δ ( v , v − )] . Clearly, for every F and n , we have ∆ maxn ≥ ∆ averagen , since δ max ( v ) ≥ δ i ( v i , v − i ) for any v . An analysis was given in [8] for the special case of discrete distributions of finite size. Theorem A [8, Theorem 2.3]For any distribution F with a finite support size, lim n →∞ ∆ maxn ( F ) = 0. (This impliesalso lim n →∞ ∆ averagen ( F ) = 0 for such F .)Based on extensive simulations done for a variety of distributions, the authors madethe following conjecture that MP is nearly IC for general iid distributions as n gets large. Nearly IC Conjecture for MP [8, Conjecture 2.5]1. For any distribution F , lim n →∞ ∆ averagen ( F ) = 0. Specifically ∆ averagen ( F ) = O ( n ).2. If F has a bounded support, lim n →∞ ∆ maxn ( F ) = 0. Specifically ∆ maxn ( F ) = O ( n ).3. There exists a distribution F with an unbounded support such that lim n →∞ ∆ maxn ( F ) >
0. In the O -notation above, the constants may depend on F . Part of the basis fortheir conjecture 3 is the Inverse distribution F where P r F { X > x } = x (for x ∈ [1 , ∞ )). Experimentally, it appears that for this F , lim n →∞ ∆ averagen ( F ) = 0, whilelim n →∞ ∆ maxn ( F ) > Multiple Strategic Bids (MSB) Attack
It was shown in [8] that a user could gain advantage by splitting his bid into severaltransactions with separate bids. This strategy could even enable a losing transaction tobe included in the block. Let p multi ( v − i ) = min n u · v ( u ) i | v (1) i ≥ · · · ≥ v ( u ) i ≥ p mono ( v (1) i , · · · , v ( u ) i , v − i ) o ,δ i ( v i , v − i ) = ( − p multi ( v − i ) p honest ( v i , v − i ) if v i ≥ p multi ( v − i ) , We consider another mechanism, called the RSOP (Random Sampling Optimal Price)auction, first defined by Goldberg et al. [5] in the digital goods context.4 efinition. [RSOP auction]Upon receiving n bids v = ( v , · · · , v n ), the auctioneer randomly partitions the bids intotwo disjoint sets A and B , and computes the monopolistic price for each set: P monoA , P monoB (with the monopolistic price for an empty set being set to 0). Finally, the set ofwinning bids is A ′ ∪ B ′ , where A ′ = { i ∈ A : v i ≥ P monoB } and B ′ = { i ∈ B : v i ≥ P monoA } .The bidders in A ′ each pays P monoB , and the bidders in B ′ each pays P monoA .Note the revenue obtained in this auction is RSOP ( v ) = | A ′ | · P monoB + | B ′ | · P monoA . Theorem B (Goldberg et al. [5])The RSOP auction is truthful. For any v = ( v , · · · , v n ) with v i ∈ [1 , D ] (where D is aconstant) for all i , we have lim n →∞ max v R ( v ) RSOP ( v ) = 1 . In [8], several variants of RSOP were examined and simulation carried out which ledto the following conjecture.
Dominance Conjecture of MP over RSOP [8, Conjecture 5.4]For any v and all choices of A and B , the RSOP revenue is at most the monopolisticprice revenue. That is, RSOP ( v ) ≤ R ( v ).The MP Dominance Conjecture has relevance to the robustness of RSOP againstadding false bids or deleting bids by the auctioneer (see discussions in [8]). In thepresent paper we prove the MP Dominance Conjecture to be true. In this paper we settle the Nearly-IC Conjecture (even allowing for the MSB attack)and the MP Dominance Conjecture mentioned above: the former in Theorem 1-4, andthe latter in Theorem 5. Additionally, we investigate the possible correlation betweenincentive compatibility and revenue. In this regard, we demonstrate that distributionswith unbounded support can exhibit different characteristics from the bounded ones,and these findings will be presented in Theorems 6-8.
We prove that mechanism MP is nearly incentive compatible for large n in Theorems1-3. Theorem 1.
For any distribution F on bounded support, lim n →∞ ∆ maxn ( F ) = 0. Theorem 2.
For any distribution F , lim n →∞ ∆ averagen ( F ) = 0. Remark 1.
The proof in Theorem 1 can be refined to show that ∆ maxn ( F ) = O ( n β )where β > F , while the constant in the O -notation is F -dependent. Similarly, Theorem 2 can be strengthened to ∆ averagen ( F ) = O ( n β ) when5 satisfies sup x x (1 − F ( x )) < ∞ . The analysis follows the same outline as the proofsfor Theorems 1, 2 above but the details are more complicated. They will be left for alater version of the paper.Recall that the distribution Inverse is defined as P r F { X > x } = x for x ∈ [1 , ∞ ). Theorem 3.
For F =Inverse, lim n →∞ ∆ maxn ( F ) > c for all n , where c > Theorem 4.
With respect to the MSB attack, the Monopolistc Pricing Mechanism isnearly incentive compatible, i.e., Theorems 1-2 are still valid.
Theorem 5.
For any v , RSOP ( v ) ≤ R ( v ).Theorem B of Goldberg et al. [5] says that, RSOP yields asymptotically the samerevenue as the monopolistic price mechanism when the distribution F has a boundedsupport [1 , D ]. We point out that this is not always true when F has infinite support. Theorem 6.
For F =Inverse,lim n →∞ n E v , ··· ,v n ∼ F [ R ( v )] = ∞ , whilelim n →∞ n E v , ··· ,v n ∼ F [ RSOP ( v )] = 1 . Let r F = sup x x (1 − F ( x ). For example, r F = 1 for F = Inverse. A key differencebetween RSOP and the monopolistic price mechanism is that, the former is incentivecompatible (and thus cannot extract revenue more than r F n ), while the latter is notincentive compatible.Suppose we are given F = Inverse as value distribution. Theorem 6 above showsthat Monopolistic Price can extract an unbounded revenue in this case. Is the propertyderived in Theorem 3 lim n →∞ ∆ maxn ( F ) > c in fact a necessary condition for all suchmechanisms? The following theorem shows that the answer is more complex.For any mechanism M and bid vector v , let M ( v ) be the revenue collected. Theorem 7.
Let F = Inverse.(a) There exists a mechanism M such that lim n →∞ ∆ maxn ( F ) = 0 andlim n →∞ n E v , ··· ,v n ∼ F [ M ( v )] = ∞ . (b) Let η < M such that δ max ( v ) < η for all v must satisfy lim n →∞ n E v , ··· ,v n ∼ F [ M ( v )] < ∞ . Note that δ max and ∆ maxn are not the only ways to quantify a mechanism’s closenessto being incentive compatible. Two standard ways to define being ǫ -close to IC (or moregenerally, to Nash equilibrium) are(1) Additively ǫ -close: p ( v i , v − i ) − p monoi ( v − i ) ≤ ǫ , or(2) Multiplicatively ǫ -close: p ( v i , v − i ) − p monoi ( v − i ) ≤ ǫ ( v i − p ( v i , v − i )).6e will show that, adopting the “multiplicatively ǫ -close” definition, one can obtainnearly IC mechanisms that derive infinite revenue under the distribution F = Inverse.This is in contrast to the previous discount model defined in terms of δ max .Let M be any IC mechanism (such as RSOP). For any bid vector v , let p i ( v ) bethe fee paid by user i (if i is a winner), and u i ( v ) = v i − p i ( v ) be the utility . For any0 ≤ ǫ <
1, let M ǫ be the mechanism that uses the same allocation rule as M , with thefee modified to be p ′ i ( v ) = p i ( v ) + ǫ ǫ u i ( v ). The following theorem is easy to prove. Theorem 8. (a) M ǫ is multiplicatively ǫ -close to IC;(b) lim n →∞ n E v ∼ F [ M ǫ ( v )] = lim n →∞ n E v ∼ F [ M ( v )] + ǫ ǫ lim n →∞ n E v ∼ F ( X i u i ( v )) . Theorem 8 implies that RSOP can be easily modified to become a multiplicatively ǫ -close-to-IC mechanism such that, like MP, its revenue is infinite under F = Inverse.We will prove Theorems 1-3, 5 in the following sections. The proof for the MultipleStrategic Bids model of Theorem 4 is similar in essence to the basic model, and hencewill be omitted. We also leave out the proofs of Theorem 6-8. Theorem 1 is the most difficult to prove. In this section we give some intuition and anoverview of the proof.Let F be a distribution over [0 , D ]. Let v , · · · , v n be generated according to iid F , and denote by b ≥ b ≥ · · · ≥ b n the sorted list of the v ′ i s . By Claim A9 in [8], δ max ( b ) = δ ( b , b − ), i.e. the maximum discount ratio is achieved by the user with thehighest bid. This leads immediately to a necessary condition on w , the optimal strategicbid by the highest bidder, as we state below. Lemma 1. [Optimal Strategic Bid (OSB) Condition]Let k ∗ = k ∗ ( b ). If δ max ( b ) ≥ η , where 0 < η ≤
1, then there exists w ∈ [0 , (1 − η ) b k ∗ ]such that i w · w ≥ k ∗ · b k ∗ − D , where i w is defined by b i w ≥ w > b i w +1 .Lemma 1 states that, in order to have a sizable η , there has to exist a w somedistance away from b k ∗ such that i w · w is only a constant D smaller than the sampledmaximum R ( b ) = k ∗ · b k ∗ . We will prove Theorem 1 by showing that a random b isstochastically unlikely to satisfy the OSB necessary condition.As a start, we prove Theorem 1 when the distribution F has a unique α > A = sup α α (1 − F ( α )) is achieved. The law of large number implies that, forlarge n , every w ≤ α (1 − η ) satisfies i w · w < ( A − ρ ) n (where ρ is some fixedconstant) with overwhelming probability. Coupled with the fact b k ∗ − α = O ( √ n ) and k ∗ · b k ∗ = A · n + O ( √ n ) probabilistically, we see that the OSB condition in Lemma 1cannot hold. Hence we have shown Theorem 1 for the case when sup α α (1 − F ( α )) hasa maximum achieved at a unique point α = α .The above argument does not apply when sup α α (1 − F ( α )) achieves maximum valueat multiple points. As an extreme case, consider the Inverse distribution modified as7ollows: Inv ( D ) ( x ) = ( − x for 1 ≤ x < D, x = D. In this case, x (1 − Inv ( D ) ( x )) = 1 for all 1 ≤ x < D .Hence the challenge is to prove that, even for extreme cases like the above, the OSBcondition in Lemma 1 cannot be met except with vanishingly small probability. Atthe top level, we wish to show that, in any two subintervals I, J ⊆ [0 , D ] separatedby a non-negligible distance, the maximum values A I = max { j · b j | b j ∈ I } and A J =max { j · b j | b j ∈ J } cannot achieve perfect correlation to allow | A I − A J | = O (1) exceptwith negligible probability for large n . This claim takes a non-trivial proof since intervals A I and A J , being taken from the sorted version b of v , are correlated to a certain degree.Before proving Theorem 1, we first recast Lemma 1 in an new form which does notreference the quantity w . The main advantage of Lemma 1A is that, the condition nowrefers only to the quantities b , · · · , b n , thus making it easier to analyze how likely thecondition can be satisfied stochastically. Lemma 1A. [Optimal Strategic Bid (OSB) Condition]Let k ∗ = k ∗ ( b ) and 0 < η <
1. If δ max ( b ) ≥ η , then there exists b j ∈ [0 , b k ∗ (1 − η )]such that j · b j ≥ k ∗ · b k ∗ − D η · b k ∗ . Proof.
Take the w as specified in Lemma 1. The following constraints are satisfied:write i = i w and B = k ∗ · b k ∗ , then b k ∗ − η · b k ∗ ≥ w, (1) i · w ≥ B − D. (2)Let ∆ j = b k ∗ − b j for j ∈ { i, i + 1 } . Let 0 ≤ λ < w = λb i + λ ′ b i +1 where λ ′ = 1 − λ . It is easy to verify from Eq. (1), (2) that λ ∆ i + λ ′ ∆ i +1 ≥ η · b k ∗ , (3) λ ( i · b i ) + λ ′ (( i + 1) b i +1 ) ≥ B − D. (4)Note that Eq. (4) implies max { i · b i , ( i + 1) b i +1 } ≥ B − D. (5)We now prove Lemma 1A.Case 1. If ∆ i > η · b k ∗ , then choose j ∈ { i, i + 1 } depending on which gives the larger j · b j . This j satisfies Lemma 1A, as a consequence of Eq. (1) and (5).Case 2. ∆ i ≤ η · b k ∗ . Eq. (3) implies λ ′ D ≥ η · b k ∗ , and thus λ ′ ≥ η · b k ∗ D . (6)From Eq. (4) and the fact i · b i ≤ B , we have λ ′ (( i + 1) b i +1 ) ≥ λ ′ B − D. Using Eq. (6), we obtin ( i + 1) b i +1 ≥ B − D η · b k ∗ . Taking j = i + 1 satisfies Lemma 1A. 8 Proof of Theorem 1
For simplicity of presentation, we assume that F has support [1 , D ]. Without loss ofgenerality, we can assume that F ( x ) < F ( D ) = 1 for any x < D . Some additionalarguments are needed for the general case [0 , D ]; we omit them here.We will demonstrate that for a random b , the condition stated in Lemma 1A occurswith probability at most O ( (log n ) √ n ). That is, stochastically, the pair ( b j , b k ∗ ) with thestated property rarely exists. First some notation. Let H F ( x ) = P r z ∼ F { z ≥ x } =1 − F ( x − ). To start the proof, we pick a point D ∈ [1 , D ] with the following properties: P1: ( D , D ] is a forbidden zone for b k ∗ . Precisely, for a random b , the probability of b k ∗ ∈ ( D , D ] is e − Ω( n ) . P2:
P r x ∼ F { x ∈ [ D , D ] } > Fact 1 D exists. Proof.
Let α max be the maximal α achieving sup α { α · H F ( α ) } .Case 1. If α max = D , then ( D , D ] is empty and P r x ∼ F { x ∈ [ D , D ] } = D · H F ( D ) > α max < D , then choose any D ∈ ( α max , D ). Choose ∆ = ( D − α max ).Then for large n , the probability of b k ∗ ∈ [0 , α max + ∆] is 1 − e − Ω( n ) , satisfying P1 . Wealso have P r x ∼ F { x ∈ [ D , D ] } ≥ − F ( D ) >
0, thus satisfying P2 .Divide [1 , D ] into disjoint intervals of length ǫ , that is, write [1 , D ] = ∪ mℓ =1 I ℓ where I ℓ = [1 + ( ℓ − ǫ, ℓǫ ) for 1 ≤ ℓ < m , and I m = [1 + ( m − ǫ, mǫ ]. Take a random b , which is the sorted list of iid v , · · · , v n ∼ F . Let A maxℓ denote the random variablemax { i · b i | b i ∈ I ℓ } . Let A max>ℓ be the random variable max { i · b i | b i ∈ I ℓ +1 ∪ · · · ∪ I m } .Let W ℓ denote the event that A max> ( ℓ +1) − D ǫ ≤ A maxℓ ≤ A max> ( ℓ +1) . Now note that, for δ max ( b ) > ǫ , the OSB condition for ( B j , b k ∗ ) in Lemma 1A can holdonly if either 1) b j ∈ I ℓ and b k ∗ ∈ I ℓ +2 ∪ · · · ∪ I m for some ℓ , or 2) b k ∗ ∈ ( D , D ]. Lemma 2.
P r { δ max ( b ) > ǫ } ≤ P m − ℓ =1 P r { W ℓ } + e − Ω( n ) . Proof.
Immediate from property P1 and Lemma 1A.The rest of this section is devoted to the proof of the following lemma, which indicatesthat A maxℓ and A max> ( ℓ +1) are not correlated to be nearly identical. Lemma 3. [Weak Correlation Lemma] For each 1 ≤ ℓ ≤ m − P r { W ℓ } = O ( (log n ) √ n ).There are two cases to consider.Case 1. P r x ∼ F { x ∈ I ℓ +1 } > P r x ∼ F { x ∈ I ℓ +1 } = 0.We give the proof of Case 1. The proof for Case 2 uses the same general idea, andwill only be sketched with details omitted here. Assume we have Case 1. Let G be thedistribution (normalized) when F is restricted to the interval L ≡ I ℓ +1 ∪ I ℓ +2 ∪ · · · ∪ I m ∪ [ D , D ]. Let ρ = P r x ∼ G { x ∈ I ℓ +1 } > , and ρ = P r x ∼ G { x ∈ [ D , D ] } > . b in the following alternative (but equivalent) way.Phase 1. Generate a random integer N so that P r { N = s } = (cid:18) ns (cid:19) q s (1 − q ) n − s for 0 ≤ s ≤ n , where q = P r x ∼ F { x ∈ L } .Phase 2. Generate n − N iid random numbers v , · · · , v N − n ∼ F | I ∪···∪ I ℓ , and sort theminto decreasing order b N +1 , b N +2 , · · · , b n . (Note that A maxℓ is already determined afterthe completion of Phase 2.)Phase 3. Generate v , v , · · · , v N ∼ G one number at a time. After step t , we sort thenumbers v , v , · · · , v t into decreasing order b ( t )1 ≥ b ( t )2 ≥ · · · ≥ b ( t ) t . Let A ( t ) = max { i · b ( t ) i | b ( t ) i ∈ I ℓ +2 ∪ I ℓ +3 ∪ · · · ∪ I m } . At time t = N , A ( N ) is exactly the same random variable as A max> ( ℓ +1) .We prove two facts below, from which Lemma 3 follows immediately. Fact 2
In Phase 1, N ≥ q n with probability 1 − e − Ω( n ) . Proof.
Chernoff’s bound.After Phase 1 and 2, we have N and K = A maxℓ decided. To prove Lemma 3 we onlyneed to show that, in Phase 3, there is enough randomness so that A ( N ) is unlikely tohave a value within an additive constant D ǫ to K .Let us examine the evolution of A ( t ) as a random process of infinite length. Therandom sequence A ( t ) satisfies A (0) = 0, and A ( t ) = A ( t − with probability ρ , ≥ A ( t − + 1 with probability ρ , ≥ A ( t − otherwise , for t ≥ Fact 3 At t = N , we have P r {| A ( N ) − K | < D ǫ } = O ( (log N ) √ N ) = O ( (log n ) √ n ) . Proof. (Sketch). Let s be the total number of times in the above process when eitherthe second or third selection is made by A ( t ) , for 1 ≤ t ≤ N . Let A ( t ) , A ( t ) , · · · , A ( t s ) be the projected sequence. Note E ( s ) = (1 − ρ ) N , V ar ( s ) = Θ( N ), and in fact P r { s = u } = O ( √ N ) for any u . Relabel A ( t i ) as B ( i ) , and consider the random sequence B (1) , B (2) , · · · . Let B ( i ) , B ( i +1) , · · · , B ( i ′ ) be the portion of the sequence in the range[ K − D ǫ , K + D ǫ ]. It is easy to verify that, for the random sequence B (1) , B (2) , · · · ,P r { i ′ − i + 1 ≥ D ǫ (log N ) } = O ( N − log N ) . (7)To see this, note that there is at least a constant φ = ρ − ρ probability to increase thenext B ( j ) value by 1 (or more). Thus, to increase the value by D ǫ , it takes only D ǫ φ steps on average, rarely requiring a (log N ) factor more steps.10s P r { s = u } = O ( √ N ) for any u , we conclude that P r { B ( s ) ∈ [ K − D ǫ , K + D ǫ ] } ≤ O ( (log n ) √ n ). This completes the proof of Case 1.In Case 2, P r x ∼ F { x ∈ I ℓ +1 } = 0. We have lost the source of randomness criticalfor the above argument since ρ = 0. Yet the source of randomness can be obtained bysplitting I ℓ into I ′ ℓ ∪ I ′′ ℓ suitably, so that I ′′ ℓ does not contain any b j with j · b j anywhereclose to the level of A max> ( ℓ +1) . (This will rely critically on the fact P r x ∼ F { x ∈ I ℓ +1 } = 0.)We omit here the details of implementing this plan, as well as the necessary handling ofdiscontinuities in distribution F . This finishes the proof of Lemma 3 and thus Theorem1. . For any 1 > ǫ >
0, we show that ∆ averagen ( F ) ≤ ǫ (8)for all sufficiently large n . First pick D > F ( D ) > − ǫ/
3. Take n iid v i ∼ F and let q n,m be the probability of exactly m of the v ′ i s falling into [0 , D ]. Let ǫ ′ = ǫ/ N such that for all n ≥ N , X m ≤ (1 − ǫ ′ ) n q n,m < ǫ/ . (9)Consider the distribution G , obtained from restricting F to [0 , D ]. By Theorem 1, thereexists N > averagem ( G ) < ǫ/ m > N . We are now set for proving Theorem 2. By definition of ∆ averagen , wehave ∆ averagen ( F ) ≤ X m> (1 − ǫ ′ ) n q n,m (cid:20) mn ∆ averagem ( G ) + n − mn (cid:21) + X m ≤ (1 − ǫ ′ ) n q n,m . Using Eq. (9)-(10), we obtain for all n > max { N , N } ,∆ averagen ( F ) ≤ ( ǫ ǫ ′ ) + ǫ ǫ. This proves Eq. (8) and Theorem 2.
Consider n iid random variables v , · · · , v n distributed according to the Inverse distri-bution Inv , and let b ≥ · · · ≥ b n be their sorted sequence. Let λ = 40, λ ′ = 1, andlet T n be the event ( b > λn ) ∧ ( b < λ ′ n ). Let V n be the event (max ≤ i ≤ n i · b i ≤ λn ).Theorem 3 is an immediate consequence of the following two lemmas. Lemma 4. If v satisfies event T n ∧ V n , then δ max ( v ) ≥ − λ ′ λ .11 emma 5. P r { T n ∧ V n } ≥ λ e − λ ′ − e − λ . . Lemma 4 and 5 imply ∆ maxn ( Inverse ) ≥ c, where c = (1 − λ ′ λ ) · (cid:18) λ e − λ ′ − e − λ (cid:19) > . This proves Theorem 3.To prove Lemma 4, note that when T n ∧ V n occurs, the highest bidder has a monop-olistic price b and a strategic price less than λn . Thus for the highest bidder i , we have δ i ( v ) ≥ − λnb ≥ − λ ′ λ . This proves Lemma 4.Lemma 5 follows from the following facts: Fact 4
P r { T n } ≥ λ e − λ ′ . Proof.
P r { T n } = (cid:18) n (cid:19) λn (cid:18) − λ ′ n (cid:19) n − ≥ λ e − λ ′ . Fact 5
P r { V n | T n } ≤ e − λ . Proof.
Let y , · · · , y n be iid distributed according to G , where for t ∈ [1 , n ], P r z ∼ G { z > t } = 11 − n ( 1 t − n ) . Define Y maxn = max ≤ i ≤ m { i · b i } , where b ≥ · · · ≥ b n is the sorted sequence of y , · · · , y n .Clearly, P r { V n | T n } ≤ P r { Y maxn ≥ λn } . To prove Fact 5, it suffices to prove:
P r { Y maxn ≥ λn } ≤ e − λ . (11)For any t ≥
1, let M t be the number of y i ’s satisfying y i ≥ t , and B t be the event that t · M t ≥ λ n . Let t k = k n for 1 ≤ k ≤ ⌊ log n ⌋ . As the event Y maxn ≥ λn implies ∨ ≤ k ≤⌊ log n ⌋ B t k , we have P r { Y maxn ≥ λn } ≤ ⌊ log n ⌋ X i =1 P r { B t k } . (12)Observe that E ( M t ) = (1 − n ) nt . Using Chernoff’s bound, we have P r { B t } ≤ e − λ nt . (13)Equation (11) follows from (12) and (13) immediately. This completes the proof of Fact5 and Theorem 3. 12 Proof of Theorem 5
Without loss of generality, we assume that A , B are non-empty and that p monoA ≤ p monoB .Let A consist of y ≥ · · · ≥ y m and B consist of z ≥ · · · ≥ z ℓ , with y s = p monoA and z t = p monoB . Let A ′ = { y , y , · · · , y s ′ } and B ′ = { z , z , · · · , z t ′ } be the winners from A and B respectively. By definition of RSOP, y s ≤ z t ′ ,t ′ z t ′ ≤ t z t . It follows that
RSOP ( v ) = t ′ y s + s ′ z t ≤ t ′ z t ′ + s ′ z t ≤ t z t + s ′ z t . Now by definition R ( v ) ≥ ( t + s ′ ) z t . Theorem 5 follows. References [1] M. Babaioff M, S. Dobzinski, S. Oren and A. Zohar. On Bitcoin and red balloons.In
ACM Conference on Electronic Commerce, EC ’12, Valencia, Spain, 2012 , pages56-73.[2] J. Bonneau. Why buy them when you can rent- bribery attacks on Bitcoin-styleconsensus. In
Financial Cryptograpphy and Data Security - FC 2016 InternationalWorkshops, BITCOIN, VOTING and WAHC, Christ Church, Barbados, 2016 . Re-vised Selected Papers, pages 19-26.[3] M. Carlsten, H. A. Kalodner, S. M. Weinberg nd A. Narayanan. On the instabilityof Bitcoin without the block reward. In
Proceedings of the 2016 ACM SIGSACConference on Computer and Communications Security, Vienna, Austria, 2016 ,pages 154-167.[4] A. V. Goldberg, J. D. Hartline and A. Wright. Competitive auctions and digitalgoods. In Proceedings of SODA 2001, pages 735-744[5] A. V. Goldberg, J. D. Hartline, A. R. Karlin, M. E. Saks and A. Wright. Competa-tive auctions.
Games and Econommic Behavior , 55(2): 242-269, 2006.[6] J. K. Kroll, I. C. Davey and E. W. Felten. The economics of Bitcoin mining, orBitcoin in the resence of adversaries. In