Engineering Economics in the Conflux Network
aa r X i v : . [ ec on . GN ] A p r Engineering Economics in the Conflux Network
Yuxi Cai ∗ , Fan Long † , Andreas Park ‡ , Andreas Veneris ∗†∗ Dept. of Electrical and Computer Engineering, University of Toronto † Dept. of Computer Science, University of Toronto ‡ The Rotman School of Management, University of Toronto [email protected], [email protected]@rotman.utoronto.ca, [email protected]
Abstract —Proof-of-work blockchains need to be carefully de-signed so as to create the proper incentives for miners to faithfullymaintain the network in a sustainable way. This paper describeshow the economic engineering of the Conflux Network, a highthroughput proof-of-work blockchain, leads to sound economicincentives that support desirable and sustainable mining behav-ior. In detail, this paper parameterizes the level of income, andthus network security, that Conflux can generate, and it describeshow this depends on user behavior and “policy variables” such asblock and interest inflation. It also discusses how the underlyingeconomic engineering design makes the Conflux Network resilientagainst double spending and selfish mining attacks.
Index Terms —Token Economy, economic design, miner incen-tives.
I. I
NTRODUCTION
Blockchain technology allows peer-to-peer electronic valuetransfers without the involvement of trusted third parties. Trustabout the completion of financial transactions in the traditionalworld of finance rests on the economic principle that thetrusted (third) party has too much to lose from negligence orcheating (e.g., regulation penalties, loss of reputation, reducedfuture income revenue streams, etc). Blockchain networks likeBitcoin [1] and Ethereum [2] use a different mechanism thatdecentralizes the financial ledger among all participants of thenetwork. As long as a majority of the network participantsbehave honestly, the fidelity of the ledger is guaranteed bytheir underlying consensus algorithms.Both Bitcoin and Ethereum employ Proof-of-Work (PoW)schemes to secure the networks and to defend against Sybilattacks [3]. In PoW, miners compete to solve a cryptographicpuzzle that requires excessive computational random guessing(aka “work”). The winner has the right to generate a new blockand receives a reward for generating the block in the nativecrypto-currency. The PoW mechanism accomplishes severalthings simultaneously: it creates consensus as to who proposesa new block, and it introduces sufficient uncertainty as to whogets to propose one next. This implicit randomness is subjectto resource expenditures, i.e., the more one spends/works, themore likely that person wins. Since PoW involves expenditureof resources, the rewards that miners receive are directlyrelated to the security of the network: the more miners earn,the more they computationally compete to secure the network.In PoW, participants in the network agree on the “longestchain” as the transaction history of the blockchain ledger.To make the transaction history secure and irreversible, newblocks are expected to be appended at the end of the longestchain to make it even harder and hence economically costly to revert [1]. Notably, users have to wait for a sufficientnumber of blocks after the transaction so that the state changeis irreversible. This serial processing of blocks puts severeconstraints on network throughput, which limits the usabilityof the platforms in day-to-day real-life monetary transactions.Aside from the performance challenge of the limitedthroughput when compared to traditional financial networks(VISA, SWIFT, etc), blockchain networks face two eco-nomic challenges. First, the long-term economic sustainabilityof blockchain networks like Bitcoin and Ethereum remainsunclear. Bitcoin is currently secure because miners receivesubstantial block rewards. Several studies argue, however, thatas the block rewards phase out, Bitcoin will be much morevulnerable to double spending attacks [4]. Second, the cost ofmaintaining a blockchain network grows as the network addsusers and transactions. For example, Ethereum supports thedeployment of decentralized applications through the execu-tion of “smart contracts.” Users pay only a one-time inclusionpayment for their smart contract code, but following this, thesmart contract occupies state storage without further costs. Assuch, inactive smart contracts (that is, the majority of smartcontracts in Ethereum today) lead to inefficient usage of spaceand drive up the cost of maintaining the network.Notably, blockchain networks with sequential ledgers arealso vulnerable to fairness attacks. A network participant withmore than 23.21% computation power can employ a specialblock mining strategy to launch selfish mining attacks to obtainblock rewards that are disproportional to its computationpower [5]. Because PoW mining is a winner-take-all game forminers to compete on including blocks into the longest chain,a malicious participant can strategically withhold some of hermined blocks to gain the advantage of exclusively mining onthe longest chain [6]. Such fairness attack strategies put smallminers into a disadvantage and may cause the blockchain net-work to become increasingly centralized, therefore exploitingfairness and undermining the fidelity of the blockchain ledger.Conflux [7] is a new PoW network with a Turing-completesmart contract language similar to this of Ethereum. The Con-flux network provides significant performance improvementswith its processing of parallel blocks in a directed acrylicgraph (DAG) structure, which lowers confirmation times andincreases transaction throughput substantially.This paper focuses on the economic engineering and theincentive mechanism design of the Conflux network. To ad-dress the space congestion challenge, Conflux requires usersto stake native tokens as storage bonds to occupy space, whichimplicitly creates a disincentive to occupy space unnecessar- A Tx2 : X sends 8 to Y
HDC EF J I KGenesis
Tx0 : Mint 10 coin to X
Tx1 : Mint 10 coin to Z B Tx3 : X sends 8 to Z
Tx4 : Z sends 8 to Y G Tx4 : Z sends 8 to Y
Besides
Genesis , A , B , G , other blocks contain no transaction.Epoch of Genesis
Epoch of A Epoch of C Epoch of E Epoch of H New Block
Parent edge:Ref. edge:
Figure 1: TreeGraph structure example in Conflux. Yellow blocks corresponds to the pivot chain.ily. The disincentive stems from the payment of interest onexisting tokens in the system. The interest on the storagebonds is payed to miners instead of the users to create along term income to the miners. To address the fairness attackchallenge, Conflux assigns the block reward in a way thateliminates the winner-take-all characteristic of mining. Insteadof competing for the longest chain, miners in Conflux receiveblock rewards for all the blocks that they generate, albeitwith some penalty mechanisms that encourage following theconsensus protocol. Competing blocks are jointly penalizedso that selfish mining is not profitable and different minersare incentivized to cooperate along the protocol to keep thenetwork stable and secure.This paper makes the following contributions: 1) we analyzethe economic impact of the proposed token rules for Conflux;2) we show that an optimal selfish mining strategy is not prof-itable on Conflux; 3) we show that a double-spending attackon Conflux is more difficult compared to legacy blockchainnetworks with sequential ledgers.The remainder of the paper is organized as follows. Sec-tion II presents Conflux with the focus on its economicand incentive mechanisms. Section III derives a calibratedeconomic model for miner income to analyze the long termsustainability of Conflux. Section IV shows that Conflux hasa stricter requirement for potential attacker than sequentialsystems. Section V concludes.II. A N O VERVIEW OF THE C ONFLUX N ETWORK
The section presents an overview of the Conflux net-work [7], [8]. Similarly to Ethereum, Conflux operates withan account-based model that every normal account associateswith a balance and each smart contract account contains thecorresponding byte codes as well as an internal state. Confluxsupports a modified version of Solidity (the main contractlanguage in Ethereum) and Ethereum Virtual Machine (EVM)for its smart contracts, so that smart contracts from Ethereumcan migrate to Conflux easily.A transaction in Conflux refers to a message that initiatesa payment transaction, or deploys/executes smart contractcode. Each block consists of a list of transactions that areverified by the proposing miner. Each node maintains a pool ofverified, received transactions that have not yet been includedin a block. Miners compete with one another by solvingPoW puzzles to include transactions into blocks. Similar toBitcoin and Ethereum, Conflux adjusts the PoW difficulty soas to maintain a stable block generation rate. Each node alsomaintains a local state constructed from the received blocks.
A. Consensus with TreeGraph
The Conflux consensus algorithm operates with a specialdirected acyclic graph (DAG) structure called TreeGraph.Figure 1 presents an example of the TreeGraph structure thatthe Conflux consensus algorithm uses to organize blocks.Unlike Ethereum which only accepts transactions on a sin-gle chain into its ledger, the Conflux consensus algorithmsafely incorporates and processes transactions in all concurrentblocks [7], [8]. There are two kinds of edges between blocks, parent edges and reference edges. Each block (except thegenesis) in the TreeGraph has exactly one parent edge to itschosen parent block ( i.e., solid edges in Figure 1). Each blockcan also have multiple reference edges to refer previous blocks( i.e., dotted edges in Figure 1). All parent edges form a treeembedded inside a directed acyclic graph (DAG) of all edges.At a high level, Conflux uses the novel Greedy HeaviestAdaptive SubTree (GHAST) [8] algorithm, which assignsa weight to each block according to the topologies in theTreeGraph. Under this weight assignment, there is a deter-ministically heaviest chain within the graph called pivot chain ,which corresponds to the relatively most stable chain from thegenesis to the tip of the parental tree. For example, in Figure 1the pivot chain contains blocks Genesis, A, C, E, and H. Togenerate a new block, a miner will choose the last block of thepivot chain as the parent of the new block. The new block willalso reference all blocks that have no incoming edge (parentor reference edges) as shown in Figure 1. This is similar to theidea of extending the longest chain. The goal is to make thepivot chain even more stable so that everyone in the networkcan converge and agree on the same pivot chain.Parent edges, reference edges, and the pivot chain togetherenable Conflux to split all the DAG blocks into epochs . Asshown in Figure 1, every block in the pivot chain correspondsto one epoch. Each epoch contains all blocks that are reachablefrom the corresponding block in the pivot chain via thecombination of parent edges and reference edges and thatare not included in previous epochs. Conflux then derivesa deterministic total order of blocks as follows: 1) first sortblocks based on epochs (e.g., A is ahead of F); 2) for blocks inthe same epoch, sort them based on the topological order (e.g.,J is ahead of H); 3) use block id to break ties. Because allparticipants will converge and agree on the same pivot chainover time, they will also derive and agree on the same totalorder of blocks. Participants therefore process all transactionsbased on the derived block total order. For duplicate andconflicting transactions, Conflux will only process the firstoccurrence and discard the remaining as no-ops.
Experimental results have shown that Conflux is capableof processing , tps for simple payment transactions [7],at least two orders of magnitude higher throughput thanEthereum and Bitcoin. The improvement in throughput is aresult of the DAG structure and the consensus algorithm, sothat the network can operate with a much faster block genera-tion rate, no forks are discarded, and with a higher utilizationof block space. According to the technical specification [8],the main net of Conflux (expected in the second quarter of2020) will run under a fixed block generation rate at twoblocks per second. The daily block generation rate is therefore · · × , blocks per day. B. Conflux Token and Interest
There is a unique native token on the Conflux network,hereafter referred to as
CFX . Each CFX contains Drip ,the minimum unit of the native token. CFX plays a similar roleas the native tokens in the Ethereum networks. Users submita contract with a gas limit and a gas price where the latter isdenominated in CFX.The issued CFXs exist in two forms: liquid and illiquid .In the liquid form, they can be immediately transferred/usedon the Conflux network while the user does not receive anyinterest payment. Illiquid tokens cannot be transferred unlessthey are “unlocked”. There are two forms of illiquid tokens:1)
Locked tokens:
Tokens can be locked up so as to earnthe user interest, and2)
Storage bonds:
Tokens can be set as storage bondsto rent space on the network ( e.g., for running smartcontracts). The required storage bonds are proportionalto the amount of space that the contract occupies.All illiquid CFXs generate interest in the Conflux network.Users receive tokens from locked tokens. Miners receive theinterest payment from storage bonds as maintenance fees forstoring contract data.In this paper, we use r c for the system base interest rate,expressed in annual terms, and interest is compounded perblock. Therefore, a user that stakes for b blocks receives aninterest payment of (cid:18) r c , , (cid:19) b − per staked token. For instance, if the annual interest is r c =2% , a user that stakes for 15,768,000 blocks (around a fiscalquarter) will receive interest of around . per staked token.In calculations, interest payments are rounded down to thenearest one ( ) drip.The economic mechanism is straightforward: paying interestleads to an increase in the number of tokens (the “monetarybase”). Since users only receive payments from illiquid tokens,the interest payments implicitly shift value from those who donot stake to those who stake. C. Mining Rewards
Network maintainers (miners) of the Conflux network re-ceive income from three sources: transaction fees, blockrewards, and interest income that arises from users “renting”space on the blockchain, as follows. 1)
Transaction Fees:
In the long run, transaction fees willmake up the major portion of rewards because of thehigher transaction throughput of the network. With manytransactions, even very small fees add up to a substantialincome.2)
Block Rewards:
As the common practice in PoW net-works, the miner of a block receives a coin-base reward.Over time, these rewards increase the monetary baseand lead to inflation. Ignoring any market-driven pricechanges, economically coin-based rewards are a transferof wealth from existing CFX holders collectively to thewinning miner.3)
Storage interest:
As mentioned in Section II-B, whentokens are used as bonds for storage, the interest paidon those tokens is passed on to miners. Similar to theblock reward, the total amount of interest from storagebonded tokens will be distributed according to the blockweights for each miner.
D. Anti-cone Penalty Ratio
The final mining reward of a block is modified by an anti-cone penalty ratio in Conflux. Suppose the base reward of ablock b combining transaction fees, block reward, and storageinterest payment is B . In this paper, we define the final rewardof b as: B · max ( , − (cid:18) | Anticone( b ) | (cid:19) ) In the above,
Anticone( b ) denotes the set of blocks that arenot in the past sub-graph of b ( i.e., reachable via parent and/orreference edges from b ) nor in the future sub-graph of b ( i.e., reachable via parent and/or reference edges to b ). Forexample, Anticone( F ) = { D, G } in Figure 1. Because theanti-cone of a block may keep growing, Anticone( b ) here onlyincludes blocks that are within 10 epochs after the epoch where b resides in. Note that for simplicity, we exclude difficultyadjustment from the consideration of the formula and assumethe difficulty remains constant. We refer the interested readerto [8] for a comprehensive description of difficulty adjustment.For a new block, the base reward is the maximum blockreward the generator can possibly receive. For every anti-coneblock of the new block, a portion of the block reward willbe deducted till zero. Intuitively, this block reward formulaencourages the generator to conform with the honest behavioras defined by the consensus protocol. It encourages the gener-ator to refer as many blocks as possible to avoid unreferencedanti-cone blocks. It also encourages the generator to propagatethe new block as soon as possible to avoid anti-cone blocksdue to network delay. Unlike the winner-take-all mining gamefor the longest chain in Bitcoin, all blocks in Conflux receiveblock rewards and miners who cooperate with one anotherminimize the anti-cone. This makes Conflux secure againstselfish mining attacks which exploit the winner-take-all natureof Bitcoin mining [6].III. C ALIBRATED E CONOMIC M ODELS
Miners are essential to the security of the network, andthe computing power they contribute to secure the networkis (empirically) increasing in the revenue that they can earn.
Table I: List of Symbols
Symbol Meaning G genesis tokens D number of seconds in a day, × × d days since main-net launch B block reward b ( d ) block rewards per day r b annual inflation rate from block rewards u ( d ) user uptake rate ∈ (0 , ) u ETH estimated user uptake rate based on Ethereum u fast ( d ) , u slow ( d ) u ETH advanced/delayed by 180 days respectively T ( d ) number of transactions on day df average transaction fee F ( d ) total transaction fees paid to miners on day dα fraction of tokens that are locked r c annual rate of inflation due to interest payments R daily interest rate for compound transactions γ ( d ) fraction of gas used by computations β required fraction of tokens as storage bonds I ( d ) interest income from storage bonds for miners p ( d ) inflation adjusted price on day dG ( d ) number of coins outstanding on day dm ( d ) total revenue for miners on day d ¯ m ( d ) total miner revenue averaged over 1 year In this section, we develop an economic approach to determinethe expected revenues that miners gain from participatingin Conflux. We calibrate this model based on our technicalspecification as well as historical data from Ethereum given thesimilarity in network features. As a reference, Table I outlinesthe symbols used in this section. Each of the following firstthree subsection discusses one component of the miner rewardand the last subsection presents the overall expectation.
A. Block Rewards
Assuming a constant mining rate of blocks per second [8],there are D · blocks mined per year by Conflux. As such,if B denotes the number of newly minted tokens created asblock reward to the miners, the system needs to issue B · D · new tokens annually as block rewards. Blocks rewardsincrease the monetary base and create inflation. Specifically,Conflux’s objective is to set the block reward based on anannual inflation target rate of r b ∈ (0 , . Therefore, for targetvalue r b , the block reward must solve B · D · ≡ G · r b ⇔ B = Gr b D .
Overall, on any given day d , total block reward b ( d ) is: b ( d ) = Gr b / . (1) B. User Uptake and Transaction Fees
To model the expected transaction fees, we first developa model for the user uptake rate modeling after Ethereum.Network user adoption directly relates to the demand fortransactions and smart contract computation, the fees paid byusers, and the storage interest distributed to miners.A common feature of new technologies is that their adoptionfollows a S-shaped pattern with slowly increasing usage earlyon and then a sudden jump of activity [9]. The user adoptionrate in Ethereum, as depicted in Figure 2, indeed shows such a . . . . j an2016 01 j an2017 01 j an2018 01 j an2019 01 j an2020 usage rate of blocks fitted logistic function Figure 2: Adoption of Ethereum: a fitted logistic functionfeature. We plot the average fraction of space (or gas) occupiedin a block as a function of time, based on data from [10].We characterize the Ethereum’s user uptake sigmoid curvewith a logistic function which has the form: y = ξ e − ξ · ( x − x ) , (2)In the equation above, y is the uptake rate at time x , ξ isthe maximum value for uptake, ξ is the growth rate, and x is the time-value of when the curve reaches 50% of itsmaximum value (formally, the value of the horizontal axis atthe sigmoid’s midpoint). Following the results for the non-linear least squared regression of (2) we obtain a user uptakerate function u ETH ( d ) as follows: u ETH ( d ) = 0 .
831 + e − . · ( d − . (3)It is notable that blocks can theoretically be filled up to100% of the gas limit, yet the estimate for ξ indicates that theEthereum blockchain’s usage rate currently maxes out at 83%.There could be three explanations for this. First, miners maycollude so to not include transactions that offer low transactionfees. Next, the 83% usage rate is the “technological” upperbound of what miners can actually include accounting forvalidation and transaction submission latency. Third, it ispossible that once the network becomes congested, users nolonger send new transactions to the network because of thelong delay; this would create an endogenous upper bound onthe demand for transaction processing. Under this estimatedmodel, it will take 718 days until Conflux reaches a networkcapacity of 50% and 793 days to reach capacity of 70%.In calibrating our model, we provide an analysis under twodifferent adjustments to the estimated model as the uptake ofConflux may vary from the model described above in termsof the time needed to reach a specific adoption rate. First, weshift the adoption curve 180 days to the right, meaning thatadoption is delayed by a quarter. Second, we shift the adoptioncurve 180 days to the left, meaning that adoption is sped upby a quarter. Formally, this shift is an increase/decrease inparameter x to 870 and 510 calendar days, respectively: u fast ( d ) = 0 .
831 + e − . · ( d − , (4) u slow ( d ) = 0 .
831 + e − . · ( d − . (5) . . . . j an2016 01 j an2017 01 j an2018 01 j an2019 01 j an2020 Ethereum fitted 180 days faster fitted 180 days slower
Figure 3: The Three Calibrated Adoption RatesFigure 3 illustrates the three adoption rate models, labelled as fast ( u fast ( d ) ), Ethereum ( u ETH ( d ) ), and slow ( u slow ( d ) ).With an uptake rate of u ( d ) , the average daily number oftransactions is as follows: T ( d ) = u ( d ) · , D. At capacity, Conflux has a throughput of , tps. Witha long-run adoption rate of u ( d ) = 80% , this amounts toan expected , tps utilization. One can also argue thatthe adoption rate in Conflux may exceed the above estimates.Ethereum is arguably at capacity most of the time (see Figure 2and its mem-pool of unsettled transactions is non-empty).Since Ethereum is at capacity, there is a limited incentive fordevelopers to introduce new DApps, especially for enterprise-scale use-cases. Conflux’s higher throughput mitigates theconcerns that the transactions do not get confirmed timely,and since it is compatible with Solidity, developers face aflat learning curve. Together this should contribute to a fastadoption of Conflux.To simplify, we denominate the capacity by the numberof native token tps. We assume that users on average pay atransaction fee of value f . Therefore, average daily fees, as afunction of day d , F ( d ) , are as follows: F ( d ) := f × T ( d ) = f · u ( d ) · , · D. (6)For Ethereum, at its current block reward and hash rate, totalrewards are on the order of $2.3M daily or $840M annually,including both block rewards and transaction fees [11]. As aresult, transaction fees account for less than 3% of the rewards.In Conflux, with a similar block-usage rate, transaction feeswould provide the same total fee income as the total revenue(fees plus block rewards) in Ethereum as long as user arewilling to pay on average $0.01 per transaction, a desirablefeat. Even for a moderate willingness of users to pay fees,annual income can be substantial. In comparison, the mediantransaction fee on the Ethereum blockchain for January–February 2020 has been between $0.08 and $0.15 [12]. C. Storage Bonds and Interest payment
To characterize the size of storage bonds, we start with themodeling of transaction fees split by token ownership transfersvs. computation. Figure 4 shows the fraction of gas attributable j an2016 01 j an2017 01 j an2018 01 j an2019 01 j an2020 Figure 4: Transactions vs. Computationsto address-to-address transfers in percentiles in Ethereum. Asthe figure shows over time simple ownership transfers accountfor a decreasing proportion of transactions.We characterize the computation-rate with an OLS regres-sion for a quadratic fit in the following form: % computation gas = α + β · d + β · d + ǫ, (7)where d are the number of days since main-net launch. Thegoal here is to measure the % computation gas as a quantity ∈ [0 , .Specifically, let γ ( d ) denote the fraction of gas usage forcomputation. Following the quadratic fit, we obtain: γ ( d ) := 1 − (cid:0) − . · d + 7 . · − · d (cid:1) / − . d − , + . . (8)We note that the parameter estimated for the quadratic term, β , is very small, around . × − , owing to the sizeof the associated variable. Therefore, when there are T ( d ) transactions on day d , we say that (1 − γ ( d )) · T ( d ) of theseare token ownership transfers and γ ( d ) · T ( d ) involve smartcontract executions that require data storage on the chain.To simplify the interest payment estimation, we make theassumption that users make the decision of whether to staketokens as storage bonds each day and, therefore, that the totaltransactions fully reflect the extent of interest payments. Thisrules out a possible scenario that a user buys storage ( i.e., put tokens as storage bonds) but never executes the contracthereafter. In other words, we account for only “new” bondingof tokens. As such, the calibration model likely conservativelyunderestimates the interest income to miners.The required storage bonds are proportional to the size ofthe contract code. We assume that this amount is proportionalto the gas usage of the contract or, as one may argue, thenumber of actual transactions since each of them requires gas.For x transactions, users need to put β · x tokens as storagebonds and on day d it is γ ( d ) · T ( d ) transactions that requirestorage bonds. In total, the required amount is β · γ ( d ) · T ( d ) .We conclude that each day the miners receiving interest paidon these storage bonds is: I ( d ) := β · γ ( d ) · T ( d ) · R, (9) We derive this line as follows. We obtain from [10] the data series for dailytransactions and daily Gas used. A simple transfer of ETH transaction requires21,000 Gas, and we therefore obtain the computation-driven Gas amount bysubtracting the number of transactions times 21,000 from the total gas.
Panel A: Block Rewards Panel B: Interest Income Panel C: Transaction Fee Revenue
Figure 5: Miner Revenues over time as a Function of the Adoption Ratewhere R represents the daily interest rate for compoundtransactions. D. Total Miner Revenue
To summarize, total miner revenue, denoted by m ( d ) , con-sists of (a) the block reward from equation (1), (b) transactionfees expressed by equation (6), and (c) interest income frombonded tokens as shown by equation (9): m ( d ) = p ( d ) · b ( d ) + F ( d ) + p ( d ) · I ( d ) . (10)Absent exogenous forces that affect the market price, the priceof CFX token on day d , p ( d ) , is determined simply by the totalnumber of tokens outstanding, p ( d ) = initial price × genesistokens / ( genesis tokens + block rewards + interest payments ) .Before we present our calibration results for mining revenueon Conflux, as a benchmark we set how much Ethereumminers earn. There are around 6,500 blocks created per day,paying around 13,500 ETH so that the total average dailyblock rewards is around $3M USD (at current ETH/USDprices) [11].We use four values for average transaction fees, f ∈ { . , . , . , . } , where the highest number $.08 cor-responds to the low-end median fee paid on Ethereum in early2020, as we discussed earlier. For the uptake rate, we considerthe three benchmark rates u fast ( d ) , u ETH ( d ) , and u slow ( d ) fromSubsection III-B. For the storage bond requirement, we use β = 1% meaning that if the user occupies space on theblockchain for future computation that is equivalent to whatone virtual-machine opcode transaction occupies, then thisuser has to put 1/100 of a CFX token into bonded storage.We also assume that there are no exogenous market-drivenprice changes except where explicitly stated.Figure 5 plots the three components of miner revenue: blockrewards, interest income, and transaction fees. These figuresuse an annual interest payments of r c = 2% , and averagefees of $.01. The $-value of block rewards (Panel A) declinesbecause the price declines due to inflation; note that we assumethat the number of tokens given as a block reward is constantwithin the interval. For the remaining two panels, we set theannual block inflation rate to r b = 5% . Interest income (PanelB) rises with blockchain usage, but it is small in magnitude.Finally, transaction fee revenue (Panel C) plots fee income.The values recorded on the vertical axis indicates that thesefees are expected to be an order of magnitude larger thaninterest income or block reward income, except immediatelyafter the launch of the main-net. Figure 6: Miner Revenues over time as a Function of theAdoption RateFigure 7: Miner Revenues over time as a Function ofAverage FeesCombining these three figures, Figure 6 plots expected dailyminer revenue m ( d ) over three years following the launchof the main-net for the three different user uptake speedscenarios. This figure uses an annual block inflation rate of r b = 5% , annual interest payments of r c = 2% , and averagefees of $.01.Figure 7 shows the time series of expected miner revenuesper day with the four different average transaction fees. WhenConflux is at capacity, even for moderate fees of $.02, minerrevenue will be around $4.6M. This figure uses block inflationrate of 5%, interest payments of 2%, and Ethereum-likeadoption rates.For the sake of the argument, we also consider a situationwhen market forces lead to increases in the price of CFXtokens such that in three years Conflux has the same marketvaluation as Ethereum today, that is, roughly a $15B market-cap. Further assume that the price change follows linear Figure 8: Miner Revenues if prices would grow to ETHlevelsgrowth at some rate g such that the price at time d is p ETH ( d ) = p (0) · (1 + g ) d . The rate g that ensures that themarket evaluation of Conflux three years after launch is thesame as Ethereum at the beginning of 2020 is g ≈ . .We compute total miner revenue for the “speculative” price p ETH ( d ) , i.e., in (10), we substitute p ( d ) with p ETH ( d ) so that: m ETH ( d ) = p ETH ( d ) · b ( d ) + p ETH ( d ) · I ( d ) + F ( d ) (11)Figure 8 shows the time series of expected miner revenuesper day for this alternative price path, p ETH , where we plot onlythe first 650 days. In this Figure, we use a block inflation rateof 5%, interest payments of 2%, Ethereum level adoption rates,and willingness to pay fees at current Ethereum rates ($0.08).We also include the revenue case when there is no price growth(it corresponds to the most “optimistic” case in Figure 7) as apoint of reference. The key takeaway from this figure is thatwhen we assume that prices rise significantly, miner incomein the medium run is not affected, simply because transactionfees continue dominate.We conclude that early on, block rewards play the mostimportant role in miner income at the beginning, whereas, oncea certain adoption rate is reached, transaction fees will be themost important source of income. We emphasize, however, thatthis is not to say that interest is irrelevant for user decisions.Instead, there will be many users who each have to pay a smallbut possibly for their case significant implicit fee for storingdata on the network.IV. E
CONOMIC L IMITS AGAINST A TTACKS
In this section, we examine the limits of the Confluxnetwork under two different attacks, the selfish mining attackand the double-spending attack.
A. Selfish Mining Attacks
If a participant in Bitcoin holds more than 23.21% of thenetwork computation power, she can gain more mining profitby strategically withholding her mined block for a period oftime before broadcasting them to the network [5]. This isbecause Bitcoin only gives reward to the blocks in the longestchain. When she withholds the newly mined block, she has theexclusive privilege to mine under her new block which is thecurrent longest chain. Of course, withholding the block bringsthe risk that someone else may mine a new block concurrentlyto become the new longest chain, but the study shows thatif the participant has more than 23.21% of the network Figure 9: Penalty of attackers on different attacker ratios ofblock generation power (AP)computation power, the benefit of withholding will outweighsthe risk [5]. Because Bitcoin mining is a winner-take-all game,honest miners expect to get less reward comparing to theircomputation power when the selfish participant launches suchfairness attacks.Conflux is more resilient against selfish mining attacksbecause withholding a block leads to less reward. UnlikeBitcoin, all blocks receive a reward in Conflux and the rewardof a block is discounted by its anti-cone size. Withholding theblock will prevent future blocks from referencing it. Therefore,it increases the anti-cone size of the block and consequentlydecreases the block reward. Given all network participants arerational, honest mining is incentive compatible.Figure 9 presents our experimental results to illustrate theresilience of Conflux against selfish mining attacks. We run aConflux network simulation with 10000 nodes. One of themis the attacker which will withhold her generated block fora certain period of time. In the simulation, normal nodeshave the network delay (4.1 seconds in average). The attacker,however, has the capability of instantly receive and send itsblock to all other nodes. We run the simulation for 2000 blocksand measure the reward ratio the attacker receives comparingto the normal honest strategy for the last 1000 blocks underdifferent the block generation power and the block withholdingperiod. Our results show that the attacker consistently receivesless reward than she would with the normal honest strategy(i.e., the reward ratio is less than 1). The longer she withholdsthe blocks, the less reward she will receive. More computationpower will help the attacker to receive more reward, but evenwith 40% of the computation power of the whole network, theattacker would still get more reward if she just participates thenetwork honestly.
B. Double Spending Attacks
Several works in the economics literature highlight thatPoW networks face fundamental constraints in terms of theeconomic incentives that can sustain ongoing security of thenetwork [13]. The Conflux network is no different but in whatfollows, we argue that the constraints of Conflux are “looser”when compared to existing networks. In this section, we makethe reasonable assumption that an attacker is not capableof reversing cryptographic functions, therefore honest minersbehave correctly even with the presence of an attacker. Wefocus on double-spending attacks with selfish mining throughwithholding of blocks.
We first repeat the arguments from [14] which apply to serialblockchains. We assume that the mining of each block involvesa cost c (including physical equipment and electricity) and thatthere are N identical miners who compete. For the scenariowith negligible user fees, the most significant revenue is theblock reward B per block. The miners’ participation constraintrequires the expected gain to exceed the expected cost, that is:probability of winning the block × B ≥ cost ⇔ B/N ≥ c. This condition holds for all identical miners, and in equilib-rium it must hold that the aggregate cost of mining agreeswith the aggregate benefit: c × N = B. (12)Now suppose an attacker wants to double-spend a transactionof value V . The attack proceeds in the sense that the attackerbuilds an alternative chain faster than all remaining miners.Assume that to gain power, the attacker has to pay c × N ,and to gain a majority they have to pay in excess of this. If theattacker spends A × c × N on equipment, with A > , they gainan advantage of A/ ( A + 1) > ; the larger A , the largerthe advantage (and thus the faster they finish the attack). Fora successful attack, they earn value V , which is the amountthat they can double spend. Assume that, conditional on theequipment advantage A , it takes t blocks (in expectation) tocomplete the attack, that is creating a longer chain than thechain honest miners collaboratively generating. Then the costof the attack is: t × A × c × N. Once successful, however, the attacker earns not only theattack value V but also rewards for the t blocks. Therefore,for attacks to be unattractive , it must hold that: t × A × c × N > V + t × B. (13)Using equation (12), we obtain the following: t × B ( A − > V. (14)Therefore, for an expected attack time t , there exists a value V such that for all V > t × B ( A −
1) = V , and the transaction ofvalue V cannot be secured. Inequality (14) is a firm constrainton the economics (and the security) of a serial chain such asBitcoin.Conflux subjects to a different lower bound for V . First,to be successful in an attack, the attacker’s alternative chainmust become the pivot chain. Since any epoch may containmultiple blocks, not only the attacker needs to create blocksfaster, but also to generate a “heavy” chain, which will requirerelatively more time (and thus more resources). To simplify theargument, we abstract from this issue and assume, as before,that the honest chain contains a single block per epoch.Next, when creating the alternative chain, an attacker doesnot receive the full reward because block rewards are assignedbased on the block’s anti-cone size. As before, suppose thereis a single attacker in the system, who succeeds an attack in t blocks. Assume that the attacker references honest block assoon as one is seen, the attacker’s first block in the alternatechain has an anti-cone of size of at least t − , the second of t − , and so forth. Therefore, the block reward for block a sincethe start of the attack is B × (cid:16) − (min { t − a, } / (cid:17) assuming a fixed per block reward B . For the longest chain(now the pivot chain) of length t since the start of the attack,the attacker will therefore earn: B · t X i =1 − (cid:18) min { t − i, } (cid:19) !| {z } Π t < t × B. Using the same argument as above, and therefore, the eco-nomic constraint for Conflux becomes: B ( tA − Π t ) > V (15)In other words, there exists a value V ′ such that for all V ∈ ( V , V ′ ] , the following holds: B ( tA − Π t ) > V > B ( tA − t ) The implication of this relationship is that the set of transactionvalues V that can be secured on the Conflux network is strictlylarger than in “traditional” serial blockchains such as Bitcoinunder such an attack strategy.V. C ONCLUSION
The long term sustainability and economic resilience to at-tacks are critical to a decentralized, proof-of-work blockchainnetwork. When basing our economic calibration on similaruptake and usage of Conflux as of Ethereum, we observe thatas adoption increases, the significantly higher throughput ofthe network allows user fees and storage interest payment tomake up the bulk of income for miners, making the miningactivity sustainable in the long term. Our analysis resultsalso show that Conflux with its novel incentive mechanism ismore resilient when facing double-spending attacks and selfishmining attacks than sequential blockchains.R
IPTPS 01 Revised Papers from theFirst International Workshop on Peer-to-Peer Systems , 2002, pp. 251–260.[4] M. Carlsten, H. Kalodner, S. Weinberg, and A. Narayanan, “On theinstability of bitcoin without the block reward,” in , 10 2016, pp. 154–167.[5] A. Sapirshtein, Y. Sompolinsky, and A. Zohar, “Optimal selfish miningstrategies in bitcoin,” in
Financial Cryptography and Data Security: 20thInternational Conference , 05 2017, pp. 515–532.[6] I. Eyal and E. Sirer, “Majority is not enough: Bitcoin mining is vulner-able,” in
Financial Cryptography and Data Security: 18th InternationalConference , vol. 8437, 11 2013.[7] C. Li, P. Li, D. Zhou, W. Xu, F. Long, and A. Yao, “Scaling nakamotoconsensus to thousands of transactions per second,” arXiv preprint1805.03870, 2018.[8] C. Li and G. Yang, “Conflux protocol specification,” 2020.[Online]. Available: https://confluxnetwork.org/static/Conflux ProtocolSpecification 20200327.pdf[9] E. M. Rogers,