WWhy Stake When You Can Borrow?
Tarun Chitra and Alex Evans Gauntlet Networks, Inc. [email protected] Placeholder [email protected]
Abstract
As smart contract platforms autonomously manage billions of dollars of capital, quantifying theportfolio risk that investors engender in these systems is increasingly important. Recent work illustratesthat Proof of Stake (PoS) is vulnerable to financial attacks arising from on-chain lending and has worsecapital efficiency than Proof of Work (PoW) [1]. Numerous methods for improving capital efficiencyhave been proposed that allow stakers to create fungible derivative claims on their staked assets. Inthis paper, we construct a unifying model for studying the security risks of these proposals. This modelcombines birth-death P´olya processes and risk models adapted from the credit derivatives literature toassess token inequality and return profiles. We find that there is a sharp transition between ‘safe’ and‘unsafe’ derivative usage. Surprisingly, we find that contrary to [2] there exist conditions where derivativescan reduce concentration of wealth in these networks. This model also applies to Decentralized Finance(DeFi) protocols where staked assets are used as insurance. Our theoretical results are validated usingagent-based simulation.
Introduction
Proof of Stake (PoS) is a Sybil resistance mechanism that aims to replace the scarce physical resource usageof Proof of Work (PoW) by using consensus-enforced scarcity of a digital asset. Moving from PoW toPoS has promised to reduce mining’s energy usage, increase scalability, and improve network participation.PoS achieves this by minting cryptographically-secured tokens according to a fixed monetary policy. Tokenholders receive a pro-rata portion of inflation by staking , or locking up their tokens in a smart contract,which lets them validate transactions that the network processes. If the entire token supply is staked, thecost of performing a double-spend attack becomes proportional to 33% (Byzantine Fault Tolerant, BFT) or51% (longest-chain) of the token supply. Therefore, if the value of a PoS token (relative to a num´eraire) islarge and a large fraction of the outstanding tokens are staked, the network is safe against adversaries withcapital proportional to the token’s market capitalization [1].PoS’s threat model is, however, more complex than that of PoW as the usage of capital as a scarceresource leads to novel financial attacks that do not exist in PoW [2, 3]. First, the compounding effects ofPoS assets, which do not exist in PoW, make it difficult to design incentive compatible monetary policies [2].Moreover, as PoS assets require both market capitalization and staking participation to be high for security,scenarios that keep the market capitalization high, while staking participation remains low can be dangerousto these networks. The attacks of [3] arise in such a scenario, which occur when the system’s users andvalidators are rational profit seeking agents. One enters this scenario when alternative yields (e.g. lending)exceed PoS returns. In such scenarios, rational actors unstake their assets and migrate them to alternativevehicles to maximize individual profit, while reducing network security. This behavior also leads to capitalflight and can cause deflationary spirals [4].The time value of capital that is lost from locking up an inflationary monetary instrument in a smartcontract can be significant, which disincentivizes staking when there exist alternative yield-generating oppor-tunities. In order to incentivize validator participation, staking protocols have proposed staking derivatives,1 a r X i v : . [ q -f i n . GN ] J un hich allow validators to borrow against their staked assets [5, 6, 7, 8]. This borrowing, which resemblessecured lending from fiat finance such as home equity loans, provides a mechanism for validators to gainpartial liquidity on their staked capital. By having the protocol provide lending services (in the form ofstaking derivatives), one can potentially mitigate the capital flight issues of [3]. For instance, a validatorwith 1000 tokens of a digital asset X locked in a staking contract can use a staking derivative to mint 750tokens of a synthetic asset Y , representing a borrow of 75% of stake. At the beginning of the lien, thesynthetic asset could be redeemed one-to-one for the underlying asset. However, if the validator is slashed,the synthetic asset will redeem for less. In this case, if the validator is slashed and loses 50 tokens, then theymay only be able to redeem 1 Y for 0.5 X .In practice, validators share default risk with other borrowers, which is typically the case when a PoSprotocol issues fungible derivative assets, i.e. when all borrowing obligations are denominated in a commonasset. Such constructions involve issuing staking derivatives backed by the collective obligations of thevalidator base. Similar aggregations are also common to DeFi lending protocols. In the MakerDAO [9]protocol, loans are denominated in a single fungible asset, Dai, whose value depends on a pool of non-fungible loans called “Vaults.” Similarly, lenders in Compound [10] are issued tokens (called “cTokens”) thatentitle holders to a proportional share of the interest generated by all borrowers (for example, lenders of Daiwould be issued “cDai,” whose redemption price depends on the interest accrued from all Dai-denominatedloans originated by Compound). In both PoS and DeFi, we argue that aggregating obligations from aheterogeneous pool of borrowers into a single asset can be analogized to securitization [11]. The analogy ismore than skin-deep, as shown in § Inequality : We extend the specialized P´olya urn model of [2] to a generalized process that representsderivatives. Recent advances in probability allow us to analytically estimate how derivatives impactinequality.2.
Returns and Portfolio Optimization : Under the assumption of rational validators, we study the returnson portfolios of staked, lent, and derivative assets. We liken staking derivatives to secured loans whosereturns depend on staking yields and provide intuition via existing models from quantitative finance.We will also evaluate these models via numerical simulation and agent-based modeling.
Agent-Based Model
We extend the agent-based framework of [3] to consider rational actors who hold portfolios of staked, lent, andderivative assets. Participants rebalance their portfolios by maximizing a utility function, which representsthe best portfolio that one can hold given current market prices and yields. Each participant has a differentrisk preference leading to non-trivial dynamics as riskier borrowers will rebalance their portfolios to bederivative heavy, whereas risk-averse borrowers will have their portfolios be staking coin heavy. Note thatadding a derivative instrument, which represents a leveraged long claim on the underlying PoS token, addsnovel risks for validators. In particular, validators begin to default on these liens when they are slashed foractivities that are antithetical to consensus. Constructing such an instrument involves having the consensusalgorithm be aware of the current value of a validator’s debt when adjusting the monetary policy of the2etwork. This is different than the situation of [3], where the lending rates are independent of the consensusalgorithm used for the PoS asset.The main machinery that we add to allow consensus to keep track of debt prices and positions is aconstant function market maker (CFMM) [12, 13]. CFMMs are smart contracts that act as an exchange forthe staked coin and the derivative asset. The usage of CFMMs in cryptocurrencies began with Uniswap [13],which was used for token-to-token exchanges mediated by a CFMM. Uniswap has had close to $75 millionof digital assets locked in it, demonstrating practical CFMM viability. However, CFMMs have also beenused for other financial applications such as portfolio rebalancing [14], margin trading [15], and stablecoins[16, 17]. These simple and versatile mechanisms are parametrized by a convex function that maps assetquantities to an implied price. This also allows them to be utilized in consensus sensitive matters. Celo [17]incorporates a Uniswap-style CFMM in consensus to adjust the PoS protocol’s monetary policy based ontransaction demand and money velocity. When the main venue for trading a PoS asset against a lien is anon-chain CFMM, a PoS protocol can adjust its monetary policy and execute margin calls on overleveragedvalidators. Ideally, the lending activity related to a PoS token mainly comprises of validators borrowingagainst their staked assets, allowing consensus to intervene and avoid the scenarios posed in [3].If there are a number of defaults in the synthetic asset — validators borrow against their staked quantity,but cannot repay their loans — then synthetic asset holders often share the default risk pro-rata. As a simpleexample, suppose that we have 10 validators with an equal staked quantity and all of them have borrowedagainst their stake. If 20% of validators default on their loans, then the remaining 80% have their borrowedassets get 25% more expensive to close in order to cover the losses of the defaulted loan. This means thatif at time t , the synthetic asset and the PoS asset have the same price in a CFMM, then at time t default ,when both defaults happen, the prices of the synthetic asset should be 75% that of the PoS asset. Thus,the exchange rate between the underlying coin and the derivative asset should represent the expected futuredefaults that the derivative will have to absorb.We model on-chain lending in the same manner as [3] by using the Compound protocol [18]. On-chainlending pools, where lenders share default risk pro-rata, are common in cryptocurrency financial productssuch as Compound [18], Uniswap [13], and in PoS itself [3]. Such protocols rely on cryptographic propertiesof smart contracts to ensure that participants are incentivized to avoid malicious behavior. This model usesa scoring rule to price the interest rate for borrowing one cryptoasset in exchange for another as collateralbased on supply and demand. If S t and D t are the supply and demand (in tokens) for borrowing a tokenat time t , these mechanisms furnish a function f : R + × R + → [0 ,
1] such that f ( S t , D t ) is the interest ratechanged to borrowers. The loans are overcollateralized, like home-equity loans, and the demand is driven bycrypto-asset holders who want to borrow fiat currency against their cryptocurrencies for liquidity. The largeston-chain lending pools on Ethereum are MakerDAO [19] and Compound [18], growing to hold hundreds ofmillions of dollars by early 2020. These pools have proven to be resilient and provide arbitrageurs with ampleopportunity to provide price discovery between lent assets as well as for swaps between pairs of assets.By combining CFMMs with on-chain lending pools, we are able to focus on how rational agents rebalancetheir portfolios based on information that is endogenous to the blockchain itself . Our usage of CFMMs impliesthat as long as one rational arbitrageur exists, on-chain prices will match external prices [12]. Moreover,the usage of on-chain lending pools implies that all participants can see the same rates for borrowing versusthose of staking, allowing for a direct optimization problem to be constructed. As CFMMs are parametrizedby their scoring function φ , it is instructive to consider whether such systems exist in practice. Staking Derivatives outside of PoS
Existing research on staking primarily focuses on its use as a Sybil resistance mechanism in consensus.However, Decentralized Finance (DeFi) applications have found novel ways to use staking outside of PoS.DeFi applications utilize staked capital as ‘insurance funds’ and ‘security pools’ for algorithmic stablecoins,on-chain lending, and margin trading.Algorithmic Stablecoins are tokens with dynamic monetary policies that adjust to maintain a peg toanother asset, such as the US dollar. These assets increase their token issuance when the synthetic asset isabove the peg and decrease it by buying back the stable asset and destroying it (‘burning’). Protocols such3s Celo [16] and Terra [20] utilize a staking token that represents both on-chain transaction fees as well asa debt instrument. In these protocols, stakers earn interest for transaction validation, but can have theirassets diluted in order to buy back the stable asset when it is trading below its peg. Celo [16] and Terra [21]use CFMMs to handle this dilution process. This usage of CFMMs to enforce protocol constraints fits intothe framework presented in § § § φ . Takeaways for PoS & DeFi protocol designers
We highlight the main results that are relevant for DeFi and PoS protocol designers. First, the results of § § § § § φ on a per-user basis. Designers canembed a notion of a ‘credit score’ in φ that allows for borrowers with good borrowing histories to mintderivatives with lower fees. Given that a number of DeFi protocols have proposed including similar benefitsto active participants [31, 32], it is important to correctly value these embedded options when choosingpricing curves. Claim 5 provides a technique for a wide class of staking derivatives (including all proposals inDeFi and PoS known to the authors) for approximating the risks associates with such options. The resultsof § φ . Outline
The remainder of the paper will focus on describing the staking derivatives framework. We note thatmathematical notation and details about the assumptions made about the Proof of Stake model, based onthose from [3], can be found in Appendices A and B. The main new mathematical object introduced in thispaper, the derivative pricing function φ for CFMMs, will be introduced in §
1. We construct derivative pricingfunctions for both PoS networks and for DeFi protocols that utilize staking mechanisms. The main differenceis that DeFi protocols rely on different boundary conditions than those of PoS networks. Subsequently, wewill construct two models that utilize φ to price derivatives: an urn model and a portfolio risk model.The urn model of § L to L norms of the stakedistribution. Subsequently, we use a simulated agent-based model to numerically verify this result undermore realistic conditions and verify that the Gini coefficient indicates a less concentrated stake distribution.Portfolio risk is assessed in § φ and the monetary policy of thenetwork. When in the safe regime, we show that this model can be interpreted in a manner similar to creditderivatives with embedded options. This interpretation allows for us to compute the expected returns forboth the validator and the protocol, as they hold portfolios of staked and borrowed assets. We further showthat in the safe region, the results of [3] on capital flight due to lending still hold. The main object of study in this paper is the derivative pricing function for validator i , denoted ϕ i . Thisfunction allows for pricing synthetically minted assets in terms of an underlying asset. In order to understandhow to construct ϕ i , we will first need to study the function of staking derivatives. Consider the Tezos PoS network [34], which has been live since 2018 and whose XTZ token is the largestPoS coin by market capitalization. Suppose that Tezos validators were allowed to borrow up to 75% oftheir staked assets in the form of a synthetic XTZ, sXTZ, with value equal to the market price of XTZ atinception. In order for a validator to recover their stake and earned block rewards, they need to buy backtheir XTZ with sXTZ. Such a synthetic asset is known as a staking derivative , as it represents a lien against5igure 1: ϕ i constructed from φ ( s ) = s k ∧ k . The x -axis is the ratio π stake ( h ) π stake ( h issued ) .This ratio only decreases when a validator is slashed in PoS or if a price moves against a direction in DeFi(e.g. sUSD/SNX price goes down, even though a staker is long). The dotted line represents a collateral factorof c i = 0 .
75. The loan is liquidated, represented by φ ( c i π stake ( h issued )) = ∞ . The steepness in the changesin φ from the different exponents control how leveraged a validator is as they are increasingly slashed.staked assets [5]. Unlike other on-chain liens, this liability is known to the consensus protocol, which canensure that if a validator has less stake than what they borrowed, they lose their assets. Note that validatorswho use such liens to gain liquidity are taking leveraged long positions on the underlying asset (e.g. XTZ),akin to a “Vault” in MakerDAO [19].For example, suppose that a validator has 10,000 XTZ staked in the network with a collateral factor of75%, meaning they can borrow up to 7,500 XTZ worth of sXTZ. If the current price of sXTZ is 1.01 XTZ,then a validator borrowing maximally against 1,000 XTZ would receive 1 , × . × .
75 = 757 . h issued be the block height that validator i minted a staking derivative against their stake at thattime π stake ( h issued ) i and let h closed be the block height they closed their loan. Moreover, let c i ∈ [0 ,
1] bethe i th validator’s collateral factor . This represents the fraction of stake that can be borrowed against, e.g. c i π stake ( h ) is the fraction allowed to be borrowed. For a staking derivative to be economically sound or solvent , the following properties are necessary: Property 1.
Default if overleveraged . If a validator borrows at block height h issued , but at height h (cid:48) > h issued , π stake ( h (cid:48) ) i < c i π stake ( h issued ) i , then the network can reclaim the validator’s stake and redistributeit as fit. In MakerDAO, Compound, and Synthetix, the protocol pays liquidators to buy defaulted liens, whereas a PoS currencycan simply burn a validator’s stake roperty 2. Repayment amount bounded below . If a validator mints x sXTZ at block height h issued then no matter what, they will always at least pay x sXTZ to regain their collateral. This ensures that thesXTZ/XTZ price will be greater than or equal to 1, meaning that the synthetic will never be worth more thanthe underlying asset. Property 3.
Monotonically increasing payment . Suppose a validator borrows x sXTZ at block height h issued . Suppose they have to pay back x ( i ) sXTZ if they are slashed i times. The borrowing mechanism issaid to be monotonic in payment if x ( i ) is increasing in i — the more you are slashed, the more you haveto repay. Property 4.
There exists an on-chain synthetic-to-real market . In the previous example, we requirethe sXTZ to XTZ price to mark the loan and to figure out much a validator needs to repay. In order for theconsensus algorithm to execute a default, it needs this market price. Moreover, borrowers need access to thismarket to purchase sXTZ to close their liens.
These conditions ensure that the protocol mints derivatives that are always solvent. Note that theseconditions are analogous to those required by over-collateralized lending contracts [18] and by debt-drivenalgorithmic stablecoins [4, 19]. The first condition ensures that the system’s assets (e.g. the staked coins)are always greater than net liabilities (e.g. the derivative). The second condition ensures that there is noeconomic abstraction of the underlying asset by the synthetic asset. In particular, this implies that marketwill never find sXTZ to be more valuable than XTZ, which could lead stakers to borrow sXTZ againsttheir staked XTZ and then default. Monotonically increasing payments ensure that bad borrowers (e.g.validators who are repeatedly slashed) have to pay the network more to borrow against their stake, as theyare providing riskier collateral to the network. Finally, the last condition ensures that borrowers can easilybuy sXTZ to repay their debt and ensures that the protocol can correctly adjust the monetary supply uponrealizing a default.Note that while it is possible to replace the final condition with the existence of a decentralized oracle[35] instead of an on-chain market, we argue that this is not feasible for staking derivatives. Firstly notethat decentralized oracles such as Augur [35] or Chainlink/DECO [36] rely on smart contract protocols fortheir execution. Since staking derivatives are used for the base protocol’s staking asset, the smart contractwould need to run on the same network, which would cause a variety of issues. For instance, the oraclecontract could be censored by validators who have large liens that are in default, which is a form of ’minerextractable value’ [37]. Moreover, if an oracle were used, the PoS consensus protocol would be subject tomanipulation from this oracle, as it will have security under a different threat model. Finally, we note thatwhile CFMMs can be manipulated, it is expensive to do so. The cost of manipulating a CFMM is linear inthe size of the liquidity pool, whereas oracle manipulation has a constant cost [13, Appendix E].How can we enforce these constraints within the protocol? Constant function market makers (CFMM) [13,12] provide on-chain mechanisms for pricing baskets of assets based on quantities deposited by participants.These mechanisms rely on two principal agents: liquidity providers (LPs) and traders. Liquidity providerslend their assets to a smart contract and upon each trade executed by a trader, receive a pro-rata share oftransaction fees. The main parameter needed to configure a CFMM is a scoring rule Φ : R k + → R + thatmaps a vector of quantities of assets q ∈ R k + to an invariant. Provided that Φ is closed and convex, one cancompute the prices of any pairs of assets. For staking derivatives, we require a function Φ : R → R thatcan provide the price of the synthetic asset relative to the underlying asset (e.g. sXTZ/XTZ) and satisfy theabove constraints. We note that when constructing two-asset CFMMs, it is sufficient to provide a pricingcurve ϕ : R + → R + to construct a CFMM Φ [13]. We provide an explicit example of such a construction inthe sequel. ϕ Before constructing ϕ , let us first look at how it is used to close out liens. Suppose that we have a validatorwho has staked assets π stake ( h ) i at block height h , then the validator is allowed to use ϕ to mint up to7 i π stake ( h ) i in synthetic assets. Therefore, each validator can be thought of as holding a portfolio Π( i, h ) =( π stake ( h ) i , − δ i ) of staked assets at block height h π stake ( h ) i and synthetic borrowed assets δ i . In order toclose out the − δ i ( h ) position, the validator has to pay the borrowing contract ϕ ( π stake ( h ) i ). The first threeconditions from the previous section are represented as follows: • Default if overleveraged : If ϕ ( π stake ( h )) i < c i ϕ ( π stake ( h issued )) i then Π( i, h ) = (0 , • Repayment bounded below : For all h > h issued ϕ ( π stake ( h ) i ) ≥ δ i • Monotonically increasing payment : If for h, h (cid:48) > h issued we have π stake ( h ) i < π stake ( h (cid:48) ) i then ϕ ( π stake ( h ) i ) ≥ ϕ ( π stake ( h (cid:48) ) i )Recall that in Assumptions 3 and 4, we assume that each validator has their own collateral factor c i andprobability of being slashed p i . This means that each validator should have a pricing function ϕ i that dependson their collateral factor and likelihood of being slashed. To make the borrowed asset fungible (e.g. similar toCompound’s wrapped tokens, such as cDAI ), we will need to construct ϕ as an aggregation of individual val-idator’s pricing functions ϕ i . Note that this is analogous to the ‘non-fungible’ CDPs in MakerDAO which giverise to a ‘fungible’ synthetic token Dai. The precise form of the aggregation, such as the bounded mean aggre-gation ϕ ( π stake ( t )) = n (cid:80) i ( ϕ i ( π stake ( t ) i ) ∧ ϕ max ) or ϕ ( π stake ( t ) = Median ( ϕ ( π stake ( t ) ) , . . . , ϕ n ( π stake ( t ) n )),does not affect our results and for the remainder of the paper we will focus on dealing with ϕ i .We can think of the synthetic asset as “shares” collateralized by the assets staked in the network. Theseshares, which are tradeable against the underlying staked asset provide the validator with liquidity thatdepends on their collateralization ratio c i and their current stake. Thus, ϕ i takes in a validator’s currentstake and the stake they had when they borrowed and returns the number of shares need to buy a singlestaking token. Intuitively, when a validator has more stake in the network (inclusive of rewards earned sincethe loan was issued) than when she initially minted shares, the validator should be able to redeem one sharefor one staking token. Moreover, when a validator has defaulted — their current stake is less than c % of thestake when the shares were issues — the price should be infinite. Thus, if we let h issued be the block heightat which a loan was issued, we have the constraints ϕ i ( π stake ( h ) i ) = 1 if π stake ( h ) i > π stake ( h issued ) i ϕ i ( π stake ( h ) i ) = ∞ if π stake ( h ) i < c i π stake ( h issued ) i (1)The specified boundary conditions encapsulate properties 1 and 2.In order to fully specify the model, we have to describe ϕ i that satisfy the boundary conditions (1) andproperty 3. We will assume that for all validators i, ϕ i ( s ) = φ ( a i s + b i ) where φ is a ‘mother’ valuationfunction and a i , b i are coefficients that are chosen to ensure that we satisfy (1). Furthermore, we willassume the following properties of φ : R + → R + :1. φ is continuous on its domain, e.g. φ ∈ C ( R + )2. φ restricted to (0 ,
1) is smooth, e.g. φ | (0 , ∈ C ∞ ((0 , φ is decreasing in its argument, ∀ x ∈ [0 , ∞ ) , φ (cid:48) ( x ) ≤
04. Boundary conditions: φ (0) = ∞ , φ (1) = 1Note that the second property, φ (cid:48) ( x ) ≤ φ is φ ( s ) = max( s − ,
1) = s − ∨
1. The former assumption ensures that outside of the boundaryconditions, we have a relatively easy to deal with valuation function whose expectation can be computedeasily. Other the other hand, the latter encodes the idea that as a validator has more stake in the network, The form of the aggregation chosen will affect liquidity and fees, but as long as the aggregation satisfies the necessary andsufficient conditions of [12], we can still use ϕ as a CFMM This terminology is adapted from the wavelet literature, where there is a ‘mother’ wavelet function that determines all ofthe spatiotemporally localized basis functions [38] a i and b i as follows: a i = 1 π stake ( h issued ) i ( c i −
1) (2) b i = c i − c i (3)Note that with these parameters, a i s + b i = 0 when s = c i π stake ( h issued ) i and a i s + b i = 1 when s = π stake ( h issued ) i . Figure 1 provides an example of this for φ ( s ) = s k ∧
1, where you can see how the coefficients a i , b i shift the the curve φ to the curve ϕ i , with c i = 0 . φ provides exposure to a pool of stake-collateralized loans represented by φ i . This form of the pricing function provides a general model of a redemption curve for synthetic liens thatcan be adapted to support a variety of applications. For completeness, we illustrate with some examples ofreal-world staking applications, including both PoS protocols and DeFi applications (where staking is notused for consensus).In the Synthetix protocol, users stake Synthetix Network Tokens (SNX) which serves as collateral for theissuance of synthetic assets. The sum of all outstanding synthetic assets represents the debt of the systemthe risk of which is shared among all SNX staked [30]. The security of the Synthetix protocol thereforebenefits from maintaining both higher value and staking participation in SNX. In exchange for serving asthe counterparties for synthetic asset exchanges, SNX stakers are rewarded with transaction fees generatedfrom the Synthetix exchange as well as new inflation. In addition, to encourage liquidity for synthetic assets,Synthetix rewards users who contribute synthetic tokens to CFMMs such as Uniswap and Curve [32]. Thescenario where SNX stakers borrow synthetics against their staked supply and ‘lend’ these to an on-chainCFMM corresponds to the model in §
4. In this scenario, φ i is simply the ratio of the price of SNX tothe price of the synthetic asset times a user’s stake. The liquidity reward is added to the return on lendingmarket, in this case the CFMM. From Synthetix’s smart contracts [40], one finds that ϕ i ( π stake ( h ) i ) = P SNX P synth when the agent is sufficiently collateralized, where P SNX and P synth are the prices of SNX and the syntheticrespectively. Mean lending return is γ t = γ b t + R λ i λ where γ b t is the expected return offered by the CFMM,R is the absolute SNX liquidity reward and λ i λ is the relative amount lent by agent i to total lent assets.Note that with this choice of φ , we need to relax the first boundary condition of equation (1) to allow ϕ i ( π stake ( h ) i ) ≤
1. This difference in boundary condition does not mutate any of the formal results in § § ϕ i that has been studied and found to have stable Nash equilibria [42].In the Tezos protocol, stakers (termed “bakers”) may choose to provide their assets to on-chain CFMMswhile retaining a portion of their staking rewards [43]. In effect, forgone staking returns can be seen as aninterest rate for borrowing against staked assets in order to supply them to on-chain lending (the CFMM).For positive reductions in staking reward, φ i is a submartingale whose positive drift is determined by foregonestaking return. In the Polkadot [44] PoS system, staking derivatives are managed by an independent protocolthat accepts deposits of staked PoS tokens (DOTs) and issues staking derivatives (L-DOTs) in exchange [45].Staking-as-a-service businesses wherein users delegate their stake and outsource staking operations to a thirdparty may also issue staking derivatives to their clients, as discussed in [46] in the case of the Harmony PoSprotocol. Such examples are simpler to analyze, as default risks are concentrated in the customer base ofthe service provider.A construction of an explicit redemption price between synthetic and staked assets for second-layerproof-of-stake protocols on Ethereum is considered in [47]. Such protocols may include L2 sidechains, DeFi9igure 2: Figure of a P´olya urn sample process [50]. The initial distribution of balls follows a Dirichlet (2 , , Dirichlet (2 , ,
1) comes from [51, § φ , which is typically growing uniformly with time. When the staking derivative asset is undervaluedrelative to the target price, staking revenues from the CFMM’s reserves are diverted to purchasing thesynthetic. Similarly, if the synthetic is overvalued relative to the target, reserves are sold to the CFMM torestore the price. Note that in this work we study the resulting price process φ and our approach is agnosticto the particular enforcement mechanism.DeFi lending protocols have begun to offer credit using reserves supplied to CFMMs as collateral. Forexample, Aave allows a user who has supplied reserves to a Uniswap pool to gain partial liquidity on their as-sets by borrowing using liquidity pool shares as collateral [31]. While these examples do not explicitly involvePoS and are thus outside the scope of this work, our results can easily be adapted to similar applications. We will first consider a two-component model where each agent is represented as a validator whose assets areeither staked or borrowed. This model will provide a stochastic process that evolves the stake distribution π stake ( h ) ∈ ∆ n and the derivative distribution δ ( h ) ∈ ∆ n . We extend the simple PoS models of [3, 2] for eachvalidator i and block height j , where a single validator is chosen as a block producer and given a reward. Inour extension, we assume that a validator loses a fraction ι ∈ (0 ,
1) of their stake when slashed.
In order to describe the probabilistic nature of slashing and how it affects defaults, we define a probabilityspace via the state transitions that occur when a validator is slashed. Let p i be the probability that the i th validator is slashed (c.f. Assumption 3 in Appendix B). For our scenario there are four outcomes forvalidator i at block height h :1. Rewarded and Not Slashed, E : This leads to a π stake ( h ) i = π stake ( h − i + R h and occurs withprobability Pr h [ E | i ] = (1 − p i ) · π stake ( h ) i
2. Not Rewarded and Not Slashed, E : This leads to no change in stake, π stake ( h ) = π stake ( h −
1) andoccurs with probability Pr h [ E | i ] = (1 − p i )(1 − π stake ( t ) i )3. Slashed but no default, E : This leads to a change in stake of π stake ( h ) i = (1 − ι ) π stake ( h − i andoccurs with probability Pr h [ E | i ] = p i (1 − π stake ( h ) i 10e denote the set of possible outcomes for a validator as E = {E , E , E , E } . As the probabilities of theseevents change as a function of block height, we have an infinite sequence of probability measures Pr h on E .Note that if you are slashed, it overrides whether you won a reward or not, matching the policies of the twolargest staking networks, Tezos and Cosmos.Unlike the compounding block rewards of [2], there are a number of differences when slashing is intro-duced. Without slashing, the stochastic evolution of π stake ( h ) is increasing in that the money supply atheight h, S h = (cid:107) π stake ( h ) (cid:107) , is increasing in block height h . With slashing, this is not true, as the stake lostdue to slashing makes the monetary supply non-monotonic. However, the model contained in [2] considers asituation where a selfish mining adversary causes the monetary supply to be non-increasing as a function ofheight. The authors of [2] analyze this by considering the evolution of π stake ( h ) as a P´olya urn process andadd in adversarial behavior via what is termed ‘time-dependence’. In order to handle slashing, we generalizethis P´olya urn model to handle the removal of stake in a manner that is a superset of the adversarial scenarioof [2, § Urn models were first introduced by P´olya and Eggenberger in 1923 [52] to study contagions in epidemiology.These models have been used in a variety of fields, including in the analysis of randomized branchingalgorithms [53, 54] that are common in blockchains. The simplest urn model considers an urn filled with r red balls and g green balls. A ball is drawn from this urn and another ball of the same color is added. Forinstance, if a red ball is drawn with probability rr + g , then another red ball is added, so that the probabilityof a subsequent red draw is r +1 r +1+ g (see figure 2 for a reference). The sample paths of this process exhibit the‘rich-get-richer’ phenomenon for certain initial conditions, where the urn ends in a state with one dominantcolor. Urn models have been studied with systems that have n balls and such that the sampling processis enriched with more complex replacement strategies. Moreover, these models serve as the prototype forexchangeable random processes, which are permutation-invariant but not uncorrelated stochastic processes. In [2], the authors model a PoS system as an urn with balls of n different colors. Each ball represents avalidator and the initial stake distribution π stake (0) represents the number of balls of each color at the chain’sgenesis. When a ball of color c is selected, R h c -colored balls are added to the urn. In the adversarial scenarioof [2, § c can cause the monetary supply to remain unchanged even though a new block is mined. The selfish validator coerces the sampling procedure into giving theselfish validator 2 R h c -colored balls while removing R h c (cid:48) -colored balls, where c (cid:48) is the color of an honestvalidator. This occurs when a selfish validator publishess two blocks whose root is at height h current − h current as the selfish validator’schain is longest.Generalized urn models allow for balls of color c to affect the concentrations of balls of other colors. Thesemodels are specified by a replacement matrix R ∈ Z n × n . The entry R c,c (cid:48) is the number of balls of color c (cid:48) to add when ball c is drawn. When R c,c (cid:48) < 0, we remove R c,c (cid:48) balls of color c (cid:48) from the urn when a ball ofcolor c is drawn. This allows for the urn model to act like a birth-death process, where certain draws of onecolor reduce the likelihood of other colors being drawn in the future. In the previous adversarial validatorexample, if we only have two validators ( n = 2), then the replacement matrix for the selfish mining strategyis, R = (cid:20) R h − R h R h (cid:21) = R h (cid:20) − 10 1 (cid:21) (4)where the first row represents an adversary’s draw, while the second row represents the honest participant. This ‘time-dependence’ can be characterized by a P´olya urn that allows for the removal of balls, as in the model presentedin the next section de Finetti’s theorem says that all exchangeable stochastic processes are representable via a sequence of urns with a particularreplacement strategy [55] This is because the selfish mining adversary causes an honest participant’s block to become an orphan, leading to a loss ofblock reward for the honest miner and a gain for the adversary π stake (0) ∈ Z n . At block height h , a validator v ( h ) is selected based on the stake distribution, e.g. v ( h ) ∼ ˆ π stake ( h ). Then, we update the stake distributionas: π stake ( h ) = π stake ( h − 1) + R v ( h ) (5)where R v ( h ) is the v ( h )-th row of R . With this framework, there are a number of results that provide limitlaws for the distribution of terminal stake, ˆ π stake = lim h →∞ ˆ π stake ( h ), which depend on R . For instance,if R = sI , e.g. a constant multiple of the identity matrix, then π stake ( h ) hs → Dirichlet ( π stake (0)), where theconvergence is in distribution [55, 56]. On the other hand, if we perform this update with the replacementmatrix of eq. (4), then most of the results of [2] (e.g. the stochastic domination results for certain strategies)are direct corollaries of the birth-death limit laws of [57, Theorems 1, 2].As described in § random and respect the probabilitiesdescribed in § i th row of a replacement matrix with slashing has the form: R i = Pr h [ E | i ] δ R h + Pr h [ E | i ] δ + Pr h [ E | i ] δ − ιπ stake ( h − i + Pr h [ E | i ] δ − π stake ( h − i (6)where δ x is the Dirac measure (point mass) on x ∈ R . It was recently shown by [58, 59] that undermild conditions, measure-valued replacement matrices such as eq. (6) have similar convergence results totraditional P´olya urn schemes. This allows for us to prove properties about the concentration of stake in thepresence of staking derivatives, extending the analysis of [2]. We further study this model by more realisticMonte Carlo simulation in § We will prove some formal properties about the distribution of terminal staking distributions based on theupdate rules of equations (5) and (6). In order to prove these results we will need to make some furtherassumptions on the growth of the money supply and epoch lengths, which are detailed in Appendix B.2. Wefirst note that the results of [58, Theorem 1.4] and [59, Theorem 1.3] guarantee that under the evolutionof equation (5), there exists a stationary measure ν on the set of probability distributions on ∆ n such that ˆ π stake = lim h →∞ ˆ π stake ( h ) ∼ ν . Note that all proofs of claims made can be found in Appendix D.First, we make a claim about the survival probability of a validator: Claim 1. Let γ be the probability that a validator eventually loses all of their stake. Then γ = Pr [ ˆ π stake,i =0] = p i − p i Note that if the slashing probability is less than 50%, then a validator will be guaranteed to survive (e.g.have positive stake if p i < as γ is increasing in p i and γ | p i = = 1). Next, we consider the distributionof stake of an individual validator at block height h . We study this using continuous-time embeddings ofurn proceses. These methods, pioneered in [61, V], take a discrete time trajectory X i (such an urn process)and embed it into a continuous time process X ( t ). Events τ , . . . , τ n , . . . are drawn independently from amemoryless distribution such that X ( τ i ) represents the i th birth-death event. If X ( t ) is constructed correctly,then the laws of { X i } i ∈ N and { X ( τ i ) } i ∈ N are equal in distribution. Using a construction for an embeddingfrom [62], we are able get an explicit distribution for π stake ( h ) i under the assumptions of this section. Claim 2. If p i < , let β i = − p i − p i For all h > , π stake ( h ) i = e ( R h − (1+ ι ) p i ) h X i , X i ∼ (1 − γ )Γ(1 , β i ) + γδ where Γ( k, θ ) is the gamma distribution. We note that [60] first proved results for infinite color P´olya urns which [58] extended to general measure-valued replacementmatrices. However, both of these papers assume as ‘balancing’ condition, akin to that of detailed balance in the MCMCliterature, that effectively forces ∀ i, (cid:80) j R ij = B for a constant B ∈ R . [59] removes this condition, which allows for the processdefined by equation (6) to be well-defined. p i > , we should expect a validator’s stake to decay exponentiallytowards zero. Moreover, if all validators have the same slash probability, e.g. ∀ i, p i = p , then the expectedconcentration of the stake distribution is controlled by the variance of the random variable X as, ℵ = E (cid:20) (cid:107) π stake ( h ) i (cid:107) (cid:107) π stake ( h ) i (cid:107) (cid:21) = E [ (cid:80) ni =1 X i ] E [ (cid:80) ni =1 X i ]= σ X + µ X µ X = σ X (cid:18) σ X µ X (cid:19) + µ X (7)where X i are i.i.d. copies of X and µ X , σ X are the mean and variance of X , respectively. For this X distributed via the law in Claim 2, µ X = β, σ X = (1 − γ ) µ X so ℵ = β (1 + (1 − γ ) ). This effectively saysthat the default probability has a sizeable effect on concentration, such that when it is difficult to default( γ = 0), we expect higher concentration than when validators have a higher likelihood of ruin. Note thatthe ratio of the L to L norm of a non-negative vector is a dissimilarity measure akin the Gini coefficient,with high concentration meaning high ℵ and low concentration occurring when ℵ = n .We note that one can remove constant block reward assumption of assumption 11 and have inflationaryrewards (in the sense of [3]) with an increase in complexity to the distributional equation of the claim.Finally, we consider how the synthetic price, ϕ i ( π stake ( h ) i ) behaves under certain regularity conditions: Claim 3. Suppose ∃ s ∈ (0 , such that φ is L -Lipschitz on I = [ s, and ∃ x ∈ I such that φ ( x ) = x . Thenfor all i , ρ ( L ) = Pr (cid:20) lim h →∞ ϕ i ( π stake ( h ) i ) = x (cid:12)(cid:12)(cid:12)(cid:12) ∀ i, π stake ( h ) i ∈ I (cid:21) > with ρ ( L ) decreasing in L . Further, ∃ (cid:15) > such that an (cid:15) -sized neighborhood of the fixed point x will bevisited infinitely often. This claim says that if the stake distribution stays in a ‘safe’ regime (which is defined by the Lipschitzparameter L ), then the price of the synthetic will infinitely often visit a fixed point of φ . In the case of astaking derivative, this condition is guaranteed to hold as φ (1) = 1. However, for DeFi uses, such as theSynthetix curve in § L ), then the price process should oscillate around a fixed point of φ . If the fixed point is a peg value (e.g.$1 for a stablecoin), then this claim suggests that choosing φ such that L is small and s is as close to 0 aspossible, then one can bound the maximum deviations from the peg value (e.g. the fixed point x ). In order to provide a more realistic understanding of how the urn model behaves, we turn to Monte Carlosimulation. We relax Assumptions 9, 10, 12, and 11 and allow for agents to have a borrow probability, β , that represents their likelihood to borrow against their staked assets. Our simulations use four idealfunctionalities that do the following functions:1. update borrowers : For each borrower i , flip a coin with probability β i to decide if a loan is needed. If i hasn’t borrowed more than c i π stake ( h ) i , borrow a random fraction of our stake that is less than thecollateral limit.2. mark loans at current height : Compute ϕ i using φ and equation (2) If π stake ( h ) = S h δ i,j , e.g. there is a dictator, then E (cid:104) (cid:107) π stake ( h ) i (cid:107) (cid:107) π stake ( h ) i (cid:107) (cid:105) = 1. If π stake ( h ) i = S h n , for all i , then E (cid:104) (cid:107) π stake ( h ) i (cid:107) (cid:107) π stake ( h ) i (cid:107) (cid:105) = n . This ratio’s similarity to the Gini coefficient can be viewed as a reasonable proxy for Gini [63] f ( a, b ) = E h [ Gini ( π stake ( h )) | λ borrow = a, λ slash = b ]. (Right) A heatmapof f ( a, b ) = E h (cid:104) (cid:107) π stake ( h ) (cid:107) (cid:107) π stake ( h ) (cid:107) (cid:12)(cid:12) λ borrow = a, λ slash = b (cid:105) . The phase transition line between highly concentrated(yellow) and more uniform (blue) stake distribution is more clear in the Gini coefficient plot.Figure 4: (Left) A heatmap of g ( a, b ) = (cid:112) Var h [ Gini ( π stake ( h )) | λ borrow = a, λ slash = b ]. (Right) A heatmapof g ( a, b ) = (cid:114) Var h (cid:104) (cid:107) π stake ( h ) (cid:107) (cid:107) π stake ( h ) (cid:107) (cid:12)(cid:12) λ borrow = a, λ slash = b (cid:105) . We can see that there is a quantitative similaritybetween the standard deviation for the Gini coefficient and the norm ratio. The main feature to observe isthat there is a sharp transition from no variance to a sizeable amount of variable.3. clean defaulted loans : Find loans that have defaulted (e.g. ϕ > ϕ max ) and zero the stake and theborrowing balance of the borrowers. Note that the network burns assets when this happens, reducingthe money supply.4. update stake distribution : Draws slashes (sampling p i ) and block producers (via π stake ) to update thecurrent stake distribution and increase the money supply.Full algorithmic descriptions of these functionalities and parameters can be found in Appendix C.1. When avalidator defaults on a staking derivative — π stake ( h ) i < c i π stake ( h issued ) i — we set their stake to zero. Thishas the effect of reducing the money supply and effectively giving all other validators an increase in futureexpected rewards, as ˆ π stake ( h ) j increases for all validators j (cid:54) = i . We made this choice of default policy basedon those discussed within existing proposals [5]. These functionalities are combined into a main simulationloop, which performs Monte Carlo sampling of trajectories for π stake ( h ). The two most important variablesare λ slash and λ borrow , which represent the average probability for a validator to get slashed and to borrowvia a staking derivative, respectively. 14n Figure 3, we see a heatmap of the expected Gini coefficient as a function of λ slash and λ borrow for aninflationary monetary policy with λ = 1. The left-hand figure of the expected Gini coefficient shows a starktransition between highly concentrated stake distributions and much more diffuse stake distributions. Thistransition line, which roughly corresponds to λ slash = λ borrow − 1, shows that at high borrowing demandand relatively high slashing rates, one should expect to see a more diffuse stake distribution. An explanationfor this reduction in inequality is that once borrowing demand is high, even the larger participants end upminting staking derivatives and when they are slashed, they effectively redistribute their stake to smallervalidators.Above the critical line, λ slash = , we see that the two measures are similar and report similar amountsof concentration. As we move away from the critical line, we see that the Gini coefficient continues to stayconcentrated, whereas the norm ratio disperses. This difference between Gini and the norm ratio is expectedamongst exponential family distributions [63]. However, both figures clearly illustrate that when there is ahigh borrowing demand and non-trivial slashing, staking derivatives can reduce inequality substantially.Figure 4 shows the standard deviation of the Gini coefficient and the norm ratio as a function of λ borrow , λ slash . Note that the scale is between [0 , . 5] since the maximum variance for measures that takevalue in [0 , 1] is in this range. We again see a phase transition between no variance and positive variancearound the lines λ borrow = (1 − λ slash ) and λ borrow > . 5, suggesting that there are large qualitative shiftsin the evolution of π stake along this line. While the norm ratio figure doesn’t have as sharp of transitionas the Gini coefficient, it is clear that there is still an indication of increased turnover in this metric. Thissuggests that once borrowing demand is high enough and slashing likelihoods go up, we should expect lessconcentration and we should expect there to be sizeable variance in the level of concentration that exists.Combined, these results suggest that if there is a non-negligible likelihood to be slashed and a fairamount of borrowing demand, then one should expect more uniform stake distribution. This suggests thatPoS protocol designers hoping for a fairer token distribution can utilize staking derivatives to achieve thesegoals. Moreover, the results for the norm ratio confirm the analysis of equation (7), which says that higherslashing probabilities lead to more uniform stake distributions. A natural question to ask about staking derivatives regards their effect on expected staking returns. In orderto study how derivatives impact rewards, we model the returns process of the derivative. We then use thismodel to study how returns are affected when validators only borrow from the protocol (e.g. all lending ishandled by the PoS protocol) and when there are external lending opportunities (akin to [3]). These resultsare compared to traditional pricing models for fixed-income derivatives with embedded options to providesome economic intuition for the financial trade-offs faced upon the introduction of derivatives. In this section we study the return dynamics of staking derivatives and their dependence on the stakingreturns described in § i at block height h with r s ( h ) i ,such that an agent that has staked π stake ( h − i in the previous epoch will begin the current epoch with π stake ( h ) i = ( r s ( h ) i + 1) π stake ( h − i . For example, returns will be positive if the agent is rewarded andnegative if the agent is slashed. We define ψ ( r s ( h ) , h ) = φ i (( r s ( h ) i + 1)) π stake ( h − i )= φ i ( π stake ( h ) i ). This emphasizes that the value of the staking derivative is a function of the stake in thecurrent epoch and the incremental staking return. We assume agents select mean-variance-optimal portfolios[64] consisting of positions in staking and derivatives. The staking returns process can be derived from theassumptions in § t by r d ( t ) i , and write r d ( t ) i = ψ i ( r s ( t + 1) i , t + 1) ψ i ( r s ( t ) i , t ) − ψ smooth, we can estimate the mean return to the derivative with the second-order approximation µ d ( t ) i ≈ B i ( t ) + σ s i C i ( t ) (9)where B i ( t ) = ψ i ( µ s ( t + 1) i , t + 1) − ψ i ( µ s ( t ) i , t ) ψ i ( µ s ( t ) i , t ) C i ( t ) = 1 ψ i ( µ s ( t ) , t ) ∂ ψ i ( µ s ( t + 1) , t + 1) ∂r s Equation (9) states that one can estimate the mean derivative return by a “base-scenario” return componentgiven by B i ( t ) (for example, this can be a fixed interest rate that the borrower pays the protocol forborrowing against stake) plus a correction factor proportional to volatility. This factor is driven by C i ( t ),which, following fixed-income terminology, we refer to refer to as the “factor convexity” of ψ . The adjustmentterm in (9) can therefore be thought of as the “cost of convexity” [65, Chapter 11] and is proportional tothe square of volatility. For example, for a variance in staking returns of σ s i = 20%, each unit increase inthe factor convexity results in a 10% gain in µ d . This term captures the impact of non-linear effects onthe derivative from staking. The most common example involves liquidation as a result of slashing, whichproduces a nonlinear loss to derivative borrowers. In most practical applications, the cost of convexity will bepositive as liquidations compound losses from slashing. The expected losses from liquidation are increasingin the volatility of staking returns, which may indicate, for example, a higher probability of slashing.We can also think of the cost of convexity as capturing the net of effect of embedded options in thestaking derivative. An instructive analogy is that of bond options in fiat finance. We analogize φ to a bond,maturing at the end of the epoch, that the borrower issues to the protocol. If the validator is slashed withinthe epoch, the protocol may enforce early prepayment of the outstanding principal by seizing the validator’sstake. This functions similarly to a put option on the staking asset that protects the protocol from downsidelosses (and produces a non-linear loss for the validator). Other examples of non-linearities may involve formsof “credit scoring” as suggested in [66] that increase costs if borrowers become riskier during the epoch. Ingeneral, when the protocol has the right to change the terms of the loan within the epoch, the value of φ will have a positive cost of convexity for the borrower. On the other hand, if the borrower has the rightto close out their loan before maturity, one can think of φ as embedding a call option for the borrower (a“callable bond” is one that the issuer has the right to redeem prior to its maturity). If unfavorable stakingreturns result in higher borrowing costs during the epoch, the borrower is protected as they can buy backthe derivative and close their loan. This would reduce the cost of convexity of the derivative. In this section,we only allow borrowers to rebalance at the start of the epoch and assume the protocol enforces liquidations.This results in a positive cost of convexity that leads the mean return in (9) to exceed the base return B i ( t )due to the value of the “options” held by the protocol. While we expect network participants to directlyprice these options in practice, in this work we are content with approximating their impact through thecost of convexity term in (9) and leave explicit pricing to future work.For the variance terms in the derivative asset, we use a second-order approximations for the covarianceterm σ sd and a first-order approximation for the variance, σ d : σ d i ≈ σ s i D i ( t ) σ sd i ≈ σ s i D i ( t ) where D i ( t ) = − ψ i ( µ s ( t ) i , t ) ∂ψ i ( µ s ( t + 1) i , t + 1) ∂r s which we refer to as the “factor duration” of ψ with respect to the staking returns. It captures the sensitivityof ψ to changes in r s . Intuitively, duration measures the percentage change in ψ of an infinitesimal changein r s . Given the restriction that φ be declining in its arguments, D i ( t ) will be non-negative, meaning thestaking derivative will have positive factor duration. In the portfolio selection context, D i is best understood16s a risk measure. When D i = 0, the derivative has no dependence on staking return and functions similarlyto a risk-free asset with a deterministic growth given by B i ( t ). The derivative asset will offer higher volatilitythan staking when D i > D i < 1. Informally, this can also be thought of as aleverage effect, dampening or magnifying exposure to volatility in staking returns. We note that the resultsin the following sections assume D i (cid:54) = 1. We first consider the case where agents seek to maximize their wealth in terms of a two-component portfolioof staked and derivative assets. Agents are assumed to have varying risk preferences and asset endowmentsand optimize their portfolio allocations based on observed mean and variance characteristics of staking andderivative assets. We assume agents select an optimal weight vector w i = [ w s i , w d i ] T that maximizes thestandard quadratic utility function f ( w i , µ i , λ i , Σ i ) = w Ti µ i − λ i w Ti Σ i w i (10)where λ i is an agent-specific risk-aversion parameter and µ i ( t ) = (cid:20) µ s ( t ) i µ d ( t ) i (cid:21) Σ i ( t ) = (cid:20) σ s i D i ( t ) σ s i D i ( t ) σ s i D i ( t ) σ s i (cid:21) (11)We consider the constrained case where agents are restricted to solutions that satisfy w T = 1. Notethat this models differs from that of [3] where returns to PoS and on-chain lending are assumed to beindependent. Here, we explicitly model covariance between the staking and derivative returns. Furthermore,this covariance term depends on the duration of ψ , which can be tuned by the PoS protocol. Claim 4. The change in portfolio weights satisfies (cid:107) w i ( t + 1) − w i ( t ) (cid:107) ≤ | U ( D i ( t )) || ∆ µ s ( t ) + ∆ µ d ( t ) | + (cid:12)(cid:12)(cid:12)(cid:12) ∆ D ( t )( D i ( t + 1) − D i ( t ) − (cid:12)(cid:12)(cid:12)(cid:12) × | µ s ( t + 1) + µ d ( t + 1) + 1 | where ∆( x ( t )) = x ( t + 1) − x ( t ) and U ( D i ( t )) = (cid:40) D i ( t ) D i ( t ) − , if D i ( t ) > D i ( t ) − , if D i ( t ) < D is small), rebalancing will be drivenprimarily changes in mean returns. When ∆ D is large in proportion to D ( t ), the sensitivity of the derivativeto changes in the staking returns will create the possibility of a large rebalancing event. For example, D may jump as the validator approaches the collateralization ratio, since a small change in staking returns maywipe out the validator’s stake. This may prompt the validator to rebalance to avoid liquidation. Overall,when duration is either very large or close to zero and is stable then the worst-case rebalancing will be nogreater than the change in the mean returns to the two assets. These changes in mean vectors will resultfrom changes in the PoS protocol’s policy vis-a-vis the agent. Assuming the PoS network’s monetary policyis consistent, the change in mean staking return for a given quantity staked is likely to be minimal. Note17hat from (9), the change in the derivative is given by ∆ µ d ( t ) = ∆ B i ( t ) + σ s ∆ C i ( t ), which is the change inthe static return plus the change in convexity. This illustrates two approaches that the protocol can take toa change in the borrower’s risk level. For example, if a borrower becomes riskier, the protocol may charge ahigher ‘interest rate’ (increasing the base return B i ( t )) or alternatively may increase cost of convexity for theborrower, for example by increasing collateral requirements. In isolation, either action may prompt riskiervalidators to rebalance to safer weights. We incorporate an on-chain lending into the model of the preceding section, extending the model in [3] tothree-asset portfolio selection. Agents select an optimal weight vector w i = [ w s i , w d i , w (cid:96) i ] T that maximizesthe convex objective function f ( w i , µ i , λ i , Σ i ) = w Ti µ i − λ i w Ti Σ i w i where µ i ( t ) = µ s ( t ) i µ d ( t ) i µ (cid:96) ( t ) i Σ i ( t ) = σ s i D i ( t ) σ s i D i ( t ) σ s i D i ( t ) σ s i 00 0 σ (cid:96) i (13)where µ (cid:96) , σ (cid:96) are the mean and volatility for on-chain lending respectively. Staking and derivative returnsare assumed to be independent of lending returns ( σ s(cid:96) = σ d(cid:96) = 0). In this case, we have the following claim Claim 5. The agents allocation to the lending asset is given by w (cid:96) ( t ) i = σ (cid:96)i λ i (cid:16) IR i ( t ) D i ( t ) − + µ (cid:96) i ( t ) (cid:17) where IR i ( t ) = B i ( t ) − D i ( t ) µ s ( t ) i + σ si C i ( t )The term IR i ( t ) can roughly be viewed as approximation of the “instantaneous return” of ψ as shownin [67, P3]. Note that the instantaneous return varies subtly from the mean return in (9). The formerapproximates the return to the derivative over an infinitesimal period, re-scaled to the length of the epoch.For example, if one were to simplify r s to a continuous-time process dr s = µ s dt + σ s dB ( t ) where B ( t ) isa Brownian motion, then applying Itˆo’s lemma and taking the expectation E (cid:104) dψ ( r d ( t ) ,t ) ψ (( r d ( t ) ,t )) (cid:105) will generate theinstantaneous return. IR i ( t ) is comprised of a base return component given by B i ( t ), a drift return givenby D i ( t ) µ t ( t ), and a diffusion term given by σ si C i ( t ). In the case where D > 1, lending will be increasingin µ d and decreasing in µ s . As lim D i ( t ) →∞ w (cid:96) ( t ) i = σ (cid:96)i λ i ( µ (cid:96) i ( t ) − µ s i ( t )) (users avoid the derivative andlending competes only with staking). In the case where D < IR i ( t ) is positive, the staking derivativereduces on-chain lending demand. If D = 0, then the derivative becomes akin to risk-free instrumentand w (cid:96) ( t ) i = σ (cid:96)i λ i ( µ (cid:96) i ( t ) − µ d i ( t )). Finally note that in the case where IR i ( t ) = 0, on-chain lending isunconstrained by staking and derivative returns w (cid:96) ( t ) i = µ (cid:96)i ( t ) σ (cid:96)i λ i . φ -specific results By restricting the functional forms of φ , one can better classify the ‘safe’ and ‘unsafe’ regimes for a stakingderivative. First, we relate the rate of growth of φ to the staking volatility σ s i . We find there is a regimewhere the derivative’s price does not affect the expected mean returns. When in this regime, in-protocolborrowing via φ can be easily managed by the protocol and liquidations (e.g. borrower defaults) do notsignificantly affect the net capital staked. Claim 6. Suppose that ∃ I ⊂ [0 , , I compact such that φ, ∂φ, ∂ φ are L -Lipschitz on I . Furthere, supposethat Pr [ | ∆ µ s ( t ) i | + | ∆ µ (cid:96) ( t ) i | > L(cid:15) ] = 1 − − O ( (cid:15) ) . Then with probability − − O ( (cid:15) ) , the change in mean return, µ i ( t + 1) − µ i ( t ) can be uniformly bounded by a function that doesn’t depend on µ d ( t + 1) , µ d ( t ) when L < σ si The condition L < σ si can be though of as a ‘liquidity’ condition. Intuitively, this corresponds to highvolatility in returns increasing the likelihood of liquidations. When liquidations are large and happen fre-quently, the system tends to be more equal, which means large changes to the ROI of validators whose18take is slashed (akin to § φ ( s ) = s k and φ (cid:48) ( s ) = − ks k +1 .With some algebra, Claim 6 then implies that ROI is unaffected if all borrowers take out loans of sizeless than s ∗ ≈ (cid:32) kk + σ si (cid:33) k +1 . When σ s i (cid:29) , s ∗ → 1, which corresponds to validators being extremelyovercollateralized and capital inefficient (see App. 2, Figure 1).Note, however, that when we are outside of the region L < σ si , the derivative begins to be more importantto validators to hold. The main reasons for this are:1. Validators would rather get leverage and liquidity via the derivative (which is in-protocol rather thanexternally, when φ is constructed such that L > σ si )2. The derivative is more important for validator portfolios in volatile regimes (e.g. σ s i (cid:29) φ can be chosen in a way such that most lending of a PoS asset takes place viathe derivative as opposed to an out-of-protocol lending mechanism. This allows protocol designers to avoidthe pitfalls of [3], where out-of-protocol lending could drain the security of a PoS network.Claim 6 effectively says that a choice of φ for a staking derivative effectively places a prior belief onthe maximum value that σ s can achieve. For specific φ , we conjecture that there is a sharp transition as afunction of the gradient of φ : Conjecture 1. Suppose that we are in the two-component model (e.g. (10) ). Let σ s i > , φ ( s, k ) = s k ∧ .Then w d ( t ) > ⇐⇒ k ≤ . This conjecture shows a sharp transition: When k > 1, validators do not use the borrowing facilities ofthe staking derivative. We next numerically validate this conjecture and expand it to the three-componentmodel via agent-based simulation. We extend the simulations of § cvxpy tosolve the Markowitz problem [68]. First, we simulate the two component model of (10), eliding r (cid:96) ( t ). Precise details on the simulation algorithmand parameters used can be found in Appendix C.2. In Figure 5, we see a heatmap of E t [ w s ( t )] as a functionof the slashing probability λ slash and the exponent k . This simulation lends support to Conjecture 1 andillustrates that even in high slashing regimes, borrowing becomes attractive. Note that as λ slash increases,the stake weight decays. This is because each slash causes a liquidation (e.g. loss of the stake), leading to adecayed stake weight. Simulations of this form can also be used to set and estimate borrowing fees, as theprotocol can design fees taken upon issuing a loan to be such that E t [ w s ( t )] ≥ . Assume we start at s = 1. Then the ∂φ Lipschitz condition gives, for s (cid:48) ∈ (0 , ∂φ ( s (cid:48) ) − ∂φ (cid:48) (1) = k (cid:18) − s (cid:48) k +1 (cid:19) ≤ σ s i (1 − s (cid:48) )Approximating a maximum s (cid:48) by elision of terms of order s (cid:48) k +2 and higher yields the approximation. E t [ W s ( t )] (left) and (cid:112) Var t [ W s ( t )]. The phase transition suggested in Conjecture 1 is clearlyapparent and we can see that there is high uncertainty until we reach the low slashing and/or degree regimes. The algorithmic description of the simulation model that includes both lending and derivatives can befound in Appendix C.1. Figure 6a illustrates heatmaps of the expected stake weight, w s ( λ slash , k ) = E [ w s ( t ) | λ slash , k ] and expected lent weights, w (cid:96) ( λ slash , k ) = E [ w (cid:96) ( t ) | λ slash , k ]. Note that the x -axis is logarith-mic. We can see that there is a sharp transition along a curve λ slash = a (log k ) c for some a > , c > w d ( λ slash , k ) = E [ w d ( t ) | λ slash , k ]can be seen in Figure 6b. In this figure, we see that as we flatten φ ( s ) = s k by decreasing k , we incentivizerational validators to start borrowing against their stake in an increasingly aggressive manner. This aggres-sive borrowing leads to a high number of defaults (Figure 6b). We quantify this further by looking at the supply ratio s ( h ) which is equal to s ( h ) = (cid:107) π stake ( h ) (cid:107) S h . This represents ratio of the total money supply atheight h relative to the maximum possibly supply S h . In Figures 7a, 7b, 7c this is illustrated for deflationary,constant, and inflationary monetary policies, respectively. Firstly, note that when the slashing fraction ι ishigher, we have a higher supply fraction for most values of λ slash and k . This is because the higher slashfraction ι leads to validators moving more assets to lending due to the higher default risk when using thestaking derivative. One can see this directly by noting that the lending weights in Figure 6a are higherwhen ι = 0 . 35. Finally, observe that we can increase the supply ratio by having an increasingly inflationarymonetary policy. Combined, these results show that while we can reduce inequality as in § In this paper, we have explored how staking derivatives affect network security for both PoS and DeFi. Wefirst constructed a general framework for defining staking derivatives that encompass most of those seenin PoS and DeFi. Then, we were able to analyze this model by using analytical techniques (with stricterassumptions) and via agent-based modeling. We found that inequality in PoS systems can sometimes be mitigated by the existence of staking derivatives. The phase transition between the concentrated and non-concentrated regimes can be studied via measure-valued P´olya urn processes, presenting new avenues tomeasure inequality under more realistic scenarios.Subsequently, we estimated validators’ return on investment and found that the return profile of aportfolio of derivatives and staked assets resembles a portfolio of bonds and options on bonds. In thisanalysis, we found that when the derivative pricing curve was smooth and in a ‘safe’ region far away fromliquidation, we could compute the expected returns and the convexity correction. This implies that there20 a) Portfolio weights for staked, w s (top) and lent, w (cid:96) (bottom). These simulations were performed with a constantreward monetary policy and a ι = 0 . 05 (left) and ι = 0 . 35 (right). One can see the sharp transition, where borrowingdominates (transition happens around λ slash ∝ (log k ) c ). Note that the higher slash fraction ι , leads to more diffuseweights.(b) Portfolio weights for derivative borrowing (top) and the fraction of defaulted validators (bottom). We see thesame transition from the other weights and it is clear that the higher slash fraction leads to a larger optimal region(e.g. parameter area where w d ≈ . a) Supply Ratio with a deflationary monetary policy and a ι = 0 . 05 (left) and ι = 0 . 35 (right). We see that thehigher slash fraction (right) leads to less burning of stake and a much smaller unsafe region (e.g. where the supplyratio is 0, which means that the entire money supply was burned via bad derivative lending)(b) Supply Ratio with a constant monetary policy and a ι = 0 . 05 (left) and ι = 0 . 35 (right). We note the same trendin ι as the previous figure, but note that the supply ratio is higher with a non-deflationary policy. This mirrors andconfirms the results of [3](c) Supply Ratio with a inflationary monetary policy and a ι = 0 . 05 (left) and ι = 0 . 35 (right). Again, notice theincrease in the magnitude of supply ratio, similar to [3] 22s an embedded option that the PoS protocol holds when derivatives are issued. This embedded optionprovides many avenues for protocol developers to shape their network. For instance, it can be tuned (via thederivative pricing function) to collect fees on derivatives, reward ‘good’ validators, and as a form of insuranceagainst capital flight. In particular, our results show that there are scenarios under which the derivativesmarket (which is in-protocol) can become the primary borrowing market for a staked asset. This providesa mechanistic way for a protocol designer to avoid the capital flight of [3], provided that they can choose aviable derivative pricing function.The work presented here opens up further investigations in a number of directions. First, the observedphase transition between the ‘concentrated’ and ‘diffuse’ stake distributions can likely be formally character-ized. The tools of measure-valued P´olya processes are likely the key to proving these types of transitions andwe suspect they will be of Galton-Watson type [61, III]. Secondly, we did not probe the estimated returns inthe ‘unsafe’ regime (e.g. when expansions such as equation 9 do not hold), which is likely where one expectsto see more dramatic fluctuation in returns of the derivative. Thirdly, we do not explore how validatorsand market participants explicitly price credit risk in the staking derivative and are instead satisfied withapproximations for mean and variance that suffice to describe portfolio dynamics. A barrier to using thetraditional credit models of [69, 70] is that the probability of default and the value that the PoS protocolcan recover from the validator following default are highly dependent in the case of PoS derivatives. It islikely that the model we develop in § We would like to thank Yi Sun, Fabian Trottner, Matteo Liebowitz, Mario Laul, Haseeb Qureshi, Hasu, LeoZhang, Guillermo Angeris, Michael Jordan, and Hsien-Tang Kao for helpful comments and feedback. [1] G. Fanti, L. Kogan, and P. Viswanath, “Economics of proof-of-stake payment systems,” 2019.[2] G. Fanti, L. Kogan, S. Oh, K. Ruan, P. Viswanath, and G. Wang, “Compounding of wealth in proof-of-stake cryptocurrencies,” in International Conference on Financial Cryptography and Data Security .Springer, 2019, pp. 42–61.[3] T. Chitra, “Competitive equilibria between staking and on-chain lending,” Cryptoeconomic Systems ,March 2020.[4] A. Klages-Mundt and A. Minca, “(in) stability for the blockchain: Deleveraging spirals and stablecoinattacks,” arXiv preprint arXiv:1906.02152 URl:https://makerdao.com/en/whitepaper , 2019.[10] ——, “The dai stablecoin system,” URl: https://makerdao. com/whitepaper/DaiDec17WP. pdf , 2017.[11] J. P. Kravitt, Securitization of Financial Assets . Wolters Kluwer Law and Business, 2012. [Online].Available: https://books.google.com/books?id=jkTkVx63CtMC[12] G. Angeris and T. Chitra, “Improved price oracles: Constant function market makers,” arXiv preprintarXiv:2003.10001 , 2020.[13] G. Angeris, H.-T. Kao, R. Chiang, C. Noyes, and T. Chitra, “An analysis of uniswap markets,” arXivpreprint arXiv:1911.03380 , 2019.[14] F. Martinelli and N. Mushegian, “Balancer: A non-custodial portfolio manager, liquidity provider, andprice sensor,” Sep 2019. [Online]. Available: https://balancer.finance/whitepaper/[15] “Futureswap: 20x leverage on ethereum,” Apr 2020. [Online]. Available: https://medium.com/futureswap/futureswap-20x-leverage-on-ethereum-f27a2a9ed59a[16] cLabs Team, “An analysis of the stability characteristics of celo,” 2019. [Online]. Available:https://celo.org/papers/Celo Stability Analysis.pdf[17] S. Kamvar, M. Olszewski, and R. Reinsberg, “Celo: A multi-asset cryptographic protocol for decentral-ized social payments,” 2019.[18] H.-T. Kao, T. Chitra, R. Chiang, and J. Morrow, “An analysis of the market risk to participants in thecompound protocol,” Third International Symposium on Foundations and Applications of Blockchains ,May 2020.[19] A. Klages-Mundt and A. Minca, “While stability lasts: A stochastic model of stablecoins,” arXivpreprint arXiv:2004.01304 Mortgage Valuation Models: Embedded Options, Risk, and Uncertainty arXiv preprint arXiv:1501.01042 , 2015.[36] F. Zhang, S. K. D. Maram, H. Malvai, S. Goldfeder, and A. Juels, “Deco: Liberating web data usingdecentralized oracles for tls,” arXiv preprint arXiv:1909.00938 , 2019.[37] P. Daian, S. Goldfeder, T. Kell, Y. Li, X. Zhao, I. Bentov, L. Breidenbach, and A. Juels, “Flash boys2.0: Frontrunning, transaction reordering, and consensus instability in decentralized exchanges,” arXivpreprint arXiv:1904.05234 , 2019.[38] I. Daubechies, Ten lectures on wavelets . Siam, 1992, vol. 61.[39] J. Pinto, “The Economics of Securitization: Evidence from the European Markets,” Cat´olica PortoBusiness School, Universidade Cat´olica Portuguesa, Working Papers de Economia (Economics WorkingPapers) 02, Apr. 2014. [Online]. Available: https://ideas.repec.org/p/cap/wpaper/022014.html[40] J. J. Moses, “Synthetix smart contracts,” https://github.com/Synthetixio/synthetix, 2020.[41] G. Danezis, D. Hrycyszyn, B. Mannerings, T. Rudolph, and D. ˇSiˇska, “Vega protocol,” 2019. [Online].Available: https://vega.xyz/papers/vega-protocol-whitepaper.pdf[42] D. Siska, “Incentives for model calibration on decentralized derivatives exchanges: Consensus in con-tinuum,” Available at SSRN 3534272 , 2020.[43] camlCase, “Dexter,” Jul 2019. [Online]. Available: https://medium.com/@camlcase/dexter-27ae69ac79ed[44] D. G. Wood, “Polkadot: Vision for a heterogeneous multi-chain framework,” https://github.com/w3f/polkadot-white-paper/raw/master/ PolkaDotPaper.pdf , 2016.[45] B. Chen, “Homa liquid dot,” Acala, Tech. Rep., Apr 2020. [Online]. Available: https://github.com/AcalaNetwork/Acala/wiki/7.-Homa-Liquid-DOT[46] N. Kostopoulos, “The first hrc20 is live on harmony — seed,” May 2020. [Online]. Available:https://medium.com/harmony-one/the-first-hrc20-is-live-on-harmony-seed-7b8325a8f9ae[47] M. Egorov, “Sip 15: Snx liquidation mechanism,” Feb 2020. [Online]. Available: https://blog.curve.fi/building-liquid-staking-with-curve/2548] M. Luongo and C. Pon, “The keep network: A privacy layer for public blockchains,” Oct 2017.[Online]. Available: https://docs.keep.network/tbtc/index.pdf[49] M. Egorov, D. Nu˜nez, and M. Wilkison, “Nucypher: a proxy re-encryption network to empower privacyin decentralized systems,” Jun 2018. [Online]. Available: https://github.com/nucypher/whitepaper[50] R. Zandie, “God doesn’t play dice! god creates dices: Dirichlet dis-tribution (pt.2),” Dec 2019. [Online]. Available: https://medium.com/@hilbert.cantor/god-doesnt-play-dice-god-creates-dices-dirichlet-distribution-pt-2-f2a7daece672[51] J. K. Ghosh and R. Ramamoorthi, Bayesian nonparametrics . Springer Science & Business Media,2003.[52] F. Eggenberger and G. P´olya, “ ¨Uber die statistik verketteter vorg¨ange,” ZAMM - Journal ofApplied Mathematics and Mechanics / Zeitschrift f¨ur Angewandte Mathematik und Mechanik , vol. 3,no. 4, pp. 279–289, 1923. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/zamm.19230030407[53] A. Dembo, S. Kannan, E. N. Tas, D. Tse, P. Viswanath, X. Wang, and O. Zeitouni, “Everything is arace and nakamoto always wins,” arXiv preprint arXiv:2005.10484 , 2020.[54] U. Roesler and L. R¨uschendorf, “The contraction method for recursive algorithms,” Algorithmica ,vol. 29, no. 1-2, pp. 3–33, 2001.[55] H. Mahmoud, P´olya urn models . CRC press, 2008.[56] S. Janson, “Rate of convergence for traditional p´olya urns,” arXiv preprint arXiv:1911.09569 , 2019.[57] M. Kuba and A. Panholzer, “On death processes and urn models,” arXiv preprint arXiv:1110.2425 ,2011.[58] C. Mailler, J.-F. Marckert et al. , “Measure-valued p´olya urn processes,” Electronic Journal of Probability ,vol. 22, 2017.[59] S. Janson et al. , “Random replacements in p´olya urns with infinitely many colours,” Electronic Com-munications in Probability , vol. 24, 2019.[60] A. Bandyopadhyay, D. Thacker et al. , “P´olya urn schemes with infinitely many colors,” Bernoulli ,vol. 23, no. 4B, pp. 3243–3267, 2017.[61] K. B. Athreya and P. E. Ney, Branching Processes . Springer-Verlag, 1972.[62] E. Th¨ornblad, “The dominating colour of an infinite p´olya urn model,” Journal of Applied Probability ,vol. 53, no. 3, pp. 914–924, 2016.[63] P. D. Allison, “Measures of inequality,” American sociological review , pp. 865–880, 1978.[64] H. Markowitz, “Portfolio selection,” The journal of finance , vol. 7, no. 1, pp. 77–91, 1952.[65] F. Fabozzi, Advances in the Valuation and Management of Mortgage-Backed Securities , ser. Frank J.Fabozzi Series. Wiley, 1999. [Online]. Available: https://books.google.com/books?id=iALatC2PohoC[66] D. Harz, L. Gudgeon, A. Gervais, and W. J. Knottenbelt, “Balance: Dynamic adjustment ofcryptocurrency deposits,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer andCommunications Security , ser. CCS ’19. New York, NY, USA: Association for Computing Machinery,2019, p. 1485–1502. [Online]. Available: https://doi.org/10.1145/3319535.33542212667] A. Marco, Quantitative Analysis In Financial Markets: Collected Papers Of The New York UniversityMathematical Finance Seminar (Vol Ii) . World Scientific Publishing Company, 2001, no. v. 2.[Online]. Available: https://books.google.com/books?id=CF VCgAAQBAJ[68] S. Diamond and S. Boyd, “Cvxpy: A python-embedded modeling language for convex optimization,” The Journal of Machine Learning Research , vol. 17, no. 1, pp. 2909–2913, 2016.[69] R. C. Merton, “On the pricing of corporate debt: The risk structure of interest rates*,” The Journal of Finance , vol. 29, no. 2, pp. 449–470, 1974. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1111/j.1540-6261.1974.tb03058.x[70] R. Jarrow and S. M. Turnbull, “Pricing derivatives on financial securities subject tocredit risk,” Journal of Finance , vol. 50, no. 1, pp. 53–85, 1995. [Online]. Available:https://EconPapers.repec.org/RePEc:bla:jfinan:v:50:y:1995:i:1:p:53-85[71] S. Peluso, A. Mira, and P. Muliere, “Reinforced urn processes for credit risk models,” Journal of Econometrics , vol. 184, no. 1, pp. 1–12, 2015. [Online]. Available: https://ideas.repec.org/a/eee/econom/v184y2015i1p1-12.html[72] D. Cheng and P. Cirillo, “A reinforced urn process modeling of recovery rates and recoverytimes,” Journal of Banking & Finance , vol. 96, no. C, pp. 1–17, 2018. [Online]. Available:https://ideas.repec.org/a/eee/jbfina/v96y2018icp1-17.html[73] ——, “An Urn-Based Nonparametric Modeling of the Dependence between PD and LGD withan Application to Mortgages,” Risks , vol. 7, no. 3, pp. 1–21, July 2019. [Online]. Available:https://ideas.repec.org/a/gam/jrisks/v7y2019i3p76-d246367.html[74] M. Sipser, Introduction to the Theory of Computation . Cengage learning, 2012.[75] J. Bonneau, “Why buy when you can rent?” in International Conference on Financial Cryptographyand Data Security . Springer, 2016, pp. 19–26.[76] A. Dr˘agulescu and V. M. Yakovenko, “Evidence for the exponential distribution of income in the usa,” The European Physical Journal B-Condensed Matter and Complex Systems , vol. 20, no. 4, pp. 585–589,2001.[77] S. L. Heston, “A closed-form solution for options with stochastic volatility with applications to bondand currency options,” The review of financial studies , vol. 6, no. 2, pp. 327–343, 1993.[78] R. Pemantle, “When are touchpoints limits for generalized p´olya urns?” Proceedings of the AmericanMathematical Society , vol. 113, no. 1, pp. 235–243, 1991.[79] T. Zhu, “Nonlinear p´olya urn models and self-organizing processes,” Unpublished dissertation, Universityof Pennsylvania, Philadelphia , 2009.[80] J. Sherman and W. J. Morrison, “Adjustment of an inverse matrix corresponding to a change in oneelement of a given matrix,” The Annals of Mathematical Statistics , vol. 21, no. 1, pp. 124–127, 1950.[81] W. W. Hager, “Updating the inverse of a matrix,” SIAM review , vol. 31, no. 2, pp. 221–239, 1989.27 Notation We will use the following mathematical notation: • ∆ n is n-dimensional probability simplex, ∆ n = { ( x , . . . , x n ) ∈ R n : (cid:80) ni =1 x i = 1 , ∀ i, x i ≥ }• For any x ∈ R n , we define the p -norm as (cid:107) x (cid:107) p = ( (cid:80) ni =1 | x i | p ) /p . • We turn any nonzero vector x ∈ R n with x ≥ x = x (cid:107) x (cid:107) ∈ ∆ n . • We let R h be the block reward at height h and the total money supply at time t is defined by S t = (cid:80) th =0 R h − B t , where B t is random variable describing the total burned token supply at time t • π stake ( t ) ∈ S t ∆ n is the unnormalized stake distribution, where π stake ( t ) i is the i th validators stake attime t • S n + ⊂ R n × n is the cone of positive definite, symmetric matrices • ∨ , ∧ are the standard join and meet of two elements of a lattice. For example if a, b ∈ R , a ∧ b =max( a, b ) , a ∨ b = min( a, b ) • We use standard Landau notation [74] on totally ordered sets D : Given functions f : D → R , g : D → R ,we use the following asymptotic notations: – f ∈ O ( g ) ⇐⇒ ∃ C > , ∀ d ∈ D, f ( d ) ≤ Cg ( d ) – f ∈ Ω( g ) ⇐⇒ ∃ c > , ∀ d ∈ D, f ( d ) ≥ cg ( d ) – f ∈ o ( g ) ⇐⇒ lim d → sup D f ( d ) g ( d ) = 0 – f ∈ Θ( g ) ⇐⇒ f ∈ O ( g ) and f ∈ Ω( g )We also note that the title of the paper is inspired by Bonneau’s “Why buy when you can rent?” [75].This paper details attacks against PoW currencies that occur when there are liquid hash power derivatives(“renting”), which are the PoW equivalents of a staking derivative. B Assumptions B.1 Common Assumptions The assumptions described in this section are those that apply throughout the paper. The first two assump-tions match those from previous work on PoS [2, 3]. Assumption 1. There is a deterministic money supply function S h that is the money supply at block height h . This supply function is known to all participants ahead of time and the height h block reward, R h , is suchthat S h = (cid:80) h (cid:48) ≤ h R h (cid:48) . Assumption 2. There are a fixed number of validators, n ∈ N , for all time. The next assumption says that a validator’s likelihood of being slashed is static. This simplifying as-sumption ignores correlation between validator behavior, but does allow for variance in the likelihood ofeach validator being slashed. Note that this is not a particularly strong assumption, as we can relax thissignificantly by assuming that all validators have upper bounds on their slashing probabilities. Assumption 3. Each validator i has a static (e.g. not changing in time) slashing probability p i Assumption 4. Each validator i has a static maximum collateral factor c i ∈ (0 , , which means that thevalidator can borrow at most c i % of their stake There is also a global assumption on the slashing percentage: Assumption 5. There exists a static slashing percentage ι ∈ (0 , that represents the percentage of avalidators stake that is burned upon a slash Next, we assume that validators are weakly rational in that they only commit resources to the networkif they have a positive expected return: Assumption 6. We assume that validators are weakly rational in that they only have non-zero stakecommitted to the network at block height h iff their expected returns for block h are non-negative We utilize epoch-based staking derivatives as staking derivatives for Cosmos [5] and Tezos [43] do this.We also note that the liquidation period for Synthetix is a fixed time window [30], which provides a similareffect to this assumption. Assumption 7. Validators can only borrow from the network at the beginning of an epoch and they mustrepay their loans by the end of the same epoch Finally, we utilize the simple PoS model of the staking and lending paper: Assumption 8. We will assume a simple PoS model akin to what was used in [3], albeit slashing ratesdefined on a per validator basis. B.2 Assumptions for § The following technical assumptions are needed to utilize generalized P´olya urn results directly. They canbe relaxed, at the cost of making the replacement matrix significantly more complex. Assumption 9. The epoch length η is (e.g. one epoch, one block) Assumption 10. All validators are maximizing their staking derivative borrows (e.g. ∀ h, δ ( h ) = c i π stake ( h ) i ) Assumption 11. We assume that R h is constant and for all h, R h > (1 + ι ) p i Assumption 12. Validators can only be slashed when they are selected to be a block producer Note is a somewhat realistic assumption, as a number of staking protocols have reduced their slashingpenalties for being offline (which is the most common infraction) and increased their penalties for doublesigning and/or equivocation. C Simulation Algorithms C.1 Model from § The parameters used in our Monte Carlo simulation are: • Initial stake distribution: π stake (0) ← ( (cid:100) π (cid:101) , . . . , (cid:100) π n (cid:101) ) where π i ∼ Exp ( λ stake ). • Stake distribution at beginning of the loan: ˜ π stake ( h issued ) • Collateral Factors: c ∈ [0 , n where c i ∼ Beta ( λ collateral , Borrow Probability: β ∈ [0 , n where β i ∼ Beta ( λ borrow , • Slash Probability: p ∈ [0 , n where p i ∼ Beta ( λ slash , • Outstanding Loans: (cid:96) ∈ R n ≥ that keeps track of the outstanding quantity of derivatives minted by avalidator. • Maximum Block Height: h max ∈ N is the maximum block height that a simulation was run • Monetary policy parameter: λ ∈ R We used disinflationary and inflationary monetary policies charac-terized by S h = O ( e λh ) for inflationary policies and S h = − λ h − λ for disinflationary policies. • Derivative Pricing Function: k ∈ R + is the degree in the function φ ( s ) = s k ∧ , e.g. Gini ( π stake (0)) = . This distribution of wealth has beenobserved in western countries, including the US [76]. Moreover, the simulations we ran were run un-til block height h max = 200 , 000 and we generated 100 trajectories for each combination of parameters( λ stake , λ collateral , λ borrow , λ slash ). The generative model uses four ideal functionalities:1. update borrowers mark loans at current height clear defaulted loans update stake distribution The ideal functionalities do the following: Algorithm 1 update borrowers ( (cid:96), β, c, π stake ) for i ∈ { , . . . , n validators } do X ∼ Binomial( β i ) if X == 1 ∧ (cid:96) i < c i π stake ( h ) i then ξ ∼ Unif ([0 , borrow_amt_as_percentage_of_stake ∼ (cid:16) c i − (cid:96) i π stake ( h ) i (cid:17) × ξ(cid:96) i ← borrow_amt_as_percentage_of_stake × π i end ifend forAlgorithm 2 mark loans at current height ( c, π stake , (cid:96), ˜ π stake , h ) for i ∈ { , . . . , n validators } doif (cid:96) i > then b ← c i − c i a ← π stake ( h issued ) i ( c i − h issued is the last epoch height, e.g. (cid:98) hη (cid:99) ϕ i ← φ ( aπ stake ( h ) i + b ) end ifend for lgorithm 3 clean defaulted loans ( ϕ, π stake , h ) for i ∈ { , . . . , n validators } doif ϕ i > ϕ max then π stake ( h ) i ← β i ← end ifend forAlgorithm 4 update stake distribution ( π stake , p, h, ι, R h ) s ← ∈ R n + Vector of validator slashings for i ∈ { , . . . , n validators } do s i ∼ Binomial ( p i ) Sample slashes from slashing probability distribution end for i ∼ ˆ π stake if s i == 0 then π stake ( h + 1) i ← π stake ( h ) i + R h Add block reward to winning validator end iffor j ∈ { , . . . , n validators } doif s j > then π stake ( h + 1) j ← (1 − ι ) π stake ( h ) j end ifif j (cid:54) = i ∧ s j == 0 then π stake ( h + 1) j ← π stake ( h ) j end ifend for lgorithm 5 Main Simulation Loop h ← n ← Number of Agents π stake ← π ∼ Exp ( λ stake ) Initial token distribution π ˜ π stake ← π stake Stake distribution at last epoch η ← Epoch Time (cid:96) ← ∈ R n c ∼ (cid:81) ni =1 Beta ( λ collateral , 1) Sample collateral factors β ∼ (cid:81) ni =1 Beta ( λ borrow , 1) Sample borrow probabilities p ∼ (cid:81) ni =1 Beta ( λ slash , 1) Sample slashing probabilities ι ← Bond Size Percentage of stake is slashed ϕ ← ∈ R n R h ← Block Reward emission function T max while t < T max doif t ≡ η then update borrowers ( (cid:96), β, c, π stake )˜ π stake ( h issued ) ← π stake We annotate ˜ π stake with h issued for clarity end if mark loans at current height ( c, π stake , (cid:96), ˜ π stake , h issued , h ) clear defaulted loans ( ϕ, π stake ) update stake distribution ( π stake , p, ι, R h ) update block reward ( h )h += 1 end while C.2 Model from § We model the returns vector as follows r ( t ) i = r s ( t ) i r (cid:96) ( t ) i r d ( t ) i = ˆ π stake ( t ) i γ tψ i ( r s ( t ) i ,t ) ψ i ( r s ( t − i ,t − − (14)where γ t is defined in [3, § • Risk aversion parameter, λ i ∼ χ ( n ): By having λ i (see (10)) as χ , we allow for the expected numberof risky agents to increase linearly in n . • Staking return variance, σ s i : We model the staking return variance via a stochastic process, akin to a‘volatility of volatility’ model from mathematical finance. We use i.i.d. Cox-Ingersoll-Ross processes: dσ s i ( t ) = ( κ − σ s i ( t )) dt + ξσ s i ( t ) dB ( t )where dB ( t ) is the standard Brownian measure and κ, ξ are drift and diffusion parameters. This modelhas been successfully used to model bond options (a close analogue of staking derivatives) in traditionalfinance [77].The new simulation resamples σ s i ( t ) on each time step, updates the covariance matrix, and then recom-putes the validators exposure using a Markowitz method [64]. In this simulation, we make the followingassumptions: 32 Each derivative borrower that isn’t slashed within an epoch completely repays their loan by the endof the epoch • Each on-chain loan is also repaid on epoch boundariesThe simulations of § § update borrowers functionalityof the last section with a new functionality described below. Furthermore, we introduce two new idealfunctionalities that we describe below: • update markowitz : This computes the optimal Markowitz portfolio using cvxpy [68]. • get returns and covariance : This computes the returns vector µ and the covariance Σ for agent i We also add a lending distribution π lend which represents the assets that the agent is supplying to an externallender (e.g. Compound). Note that µ ∈ R n × and Σ ∈ R n × × can be thought of an arrays of validatorreturns and covariances. The term γ t is the rate computed by the Compound smart contract, computedexactly as described in the appendix of [3]. Finally, note that we assume access to an oracle that computesa sample path from a Cox-Ingersoll-Ross process. We denote by CIR ( α, β, σ, t ) a time t sample from a CIRprocess with parameters α, β, σ . Algorithm 6 get returns and covariance ( µ prev , π stake , π lend , (cid:96), i, h, γ t ) µ ( t ) ← (0 , , if (cid:107) π stake (cid:107) > then r s ← π stake ( h ) i (cid:107) π stake ( h ) (cid:107) µ ( t ) ← r s δ ← − φ (cid:48) ( r s ) φ ( r s ) δ is duration else µ ( t ) ← δ ← end ifif (cid:96) i > then µ ( t ) ← φ ( r s ) φ ( µ prev [ i ] ) − ∃ i, (cid:96) i > (cid:107) π stake (cid:107) > else µ ( t ) ← end if µ ( t ) ← γ t Σ ( t ) ← δ δ δ 00 0 0 Σ ( t ) , ∼ CIR ( α, β, σ, t ) k ∼ CIR ( α, β, σ, t ) Σ ( t ) ← k ∗ Σ ( t ) return µ ( t ) , Σ ( t ) D Proofs D.1 Proof of Claim 1 This follows directly from [62, Lemma 2.1], once we map the setup of § c is chosen, then in their notation, with probability p lemma ,33 lgorithm 7 update markowitz ( µ prev , π stake , π lend , (cid:96), γ t , λ ) w ← ∈ R n × weight array for all agents for i ∈ { , . . . , n validators } doif π stake ( h ) i > then µ , Σ ← get returns and covariance ( µ prev , π stake , π lend , (cid:96), i, h, γ t ) w [ i ] ← MINIMIZE ( µ − λw [ i ] t Σ w [ i ]) Use convex optimizer to min. strongly convex obj. end ifend forreturn w Algorithm 8 update borrowers ( µ , π stake , π lend , (cid:96), ˜ π stake , λ )˜ π stake ← π stake γ t ← compute borrow rate ( π lend ) Algorithm from [3] (cid:96) ← ∈ R n Reset borrowers, assume anyone left repaid in full w ← update markowitz ( µ , π stake , π lend , (cid:96), γ t , λ for i ∈ { , . . . , n } do ω ← π stake ( h ) i + π lend ( h ) i wealth of i th agent ω s , ω d , ω l ← ω × w [ i ] , ω × w [ i ] , ω × w [ i ] if ω s + ω d > π stake ( h ) i then δ ← ( ω s + ω d − π stake ( h ) i ) π lend ( h ) i ← π lend ( h ) i − δπ stake ( h ) i ← π stake ( h ) i + δ end if if ω s < π stake ( h ) i ∧ ω d < π stake ( h ) i then (cid:96) i ← ω d π stake ( h ) i ← π stake ( h ) i − ω d end ifif ω l > π lend ( h ) i then δ ← ω l − π lend ( h ) i π lend ( h ) i ← π lend ( h ) + δπ stake ( h ) i ← π stake ( h ) i − δ end ifend for a ball is added of the same color, and with probability 1 − p lemma a ball is added whose color is selecteduniformly at random but is not equal to c . The first scenario represents a validator being selected andreceiving a block reward, whereas the latter scenario represents a validator being selected and being slashed.As we have made assumption 12, this maps to our scenario with p lemma = 1 − p i . D.2 Proof of Claim 2 We modify the arguments made in [62] and sketch how they apply to our scenario. The P´olya urn pro-cess π stake ( h ) embeds into a continuous time Markov branching process X ( t ) where X (0) = π stake (0) [61,v.9 Theorem 1]. This birth-death process adds R h + 1 balls (the block reward plus the ball taken out of theurn) to X ( t ) and removes one ball (the sampled ball from an urn). Moreover, this process has arrival times τ i ∼ Exp (1) [61, III], which we will denote τ , τ , . . . , τ n , . . . . At τ , we can write a recurrence equation for X : X ( t ) = t ≥ τ Y ( X (cid:48) ( t − τ ) + X (cid:48)(cid:48) ( t − τ )) + t<τ Y ∼ Bern (1 − p i ). The first term represents either a jump to zero (e.g. Y = 0) or a branching thatstarts two new processes at time t − τ . The second term represents the fact that we start the process withone ball (akin to the S (0) = 1 urn assumptions in [2]). By [61, III.9 Theorem 1], lim t →∞ X ( t ) e − αt = W and X ( t ) e − αt is a non-negative martingale for α = E [ R i ] = R h (1 − p i ) − ιp i if α > U = e − ατ Y ( U (cid:48) + U (cid:48) ) (15)We now apply [62, Lemma 2.1] to receive the result. The proof in that paper involves showing that • (1 − γ )Γ(1 , β ) + γδ satisfies equation (15) and has finite variance • Showing that the operator T (cid:15) that maps X ( t ) to X ( t + (cid:15) ) is a contraction mapping • Applying a modified Banach fixed point theorem (from [54]) yields that (1 − γ )Γ(1 , β ) + γδ is theunique distribution to satisfy equation (15) D.3 Proof of Claim 3 This result follows from mapping the staking derivative setup to the stochastic approximation of functionsof P´olya urn processes of [78, 79]. Stochastic approximation, first invented by Robbins and Monro, is thesame as stochastic gradient descent, which is commonly found in the machine learning literature. If we havean urn process X n ∈ ∆ d , stochastic approximation considers an urn evolution, X n +1 = X n + (cid:15) n ( F ( X n ) + ξ i )where (cid:15) n is a ‘step size’ and ξ i is a random vector with finite moments and F : R d → R d is a vector field.We require, via standard arguments [79, Thm. 2.2.3] that (cid:15) i = Θ (cid:0) n (cid:1) in order for this process to have a non-trivial probability of convergence for continuous F . Let ϕ ( π stake ( h )) = ( ϕ ( π stake ( h ) ) , . . . , ϕ n ( π stake ( h ) n ))and consider a stochastic approximation X n where F = ϕ . Recall that a downcrossing fixed point of afunction F : R + → R + is point p such that a) F ( p ) = p and b) ∃ I ⊂ R + such that p ∈ I and ∀ p (cid:48) < p, p (cid:48) ∈ I we have F ( p (cid:48) ) > p . Equation (1) tells us that ϕ i (1) = 1 and ∀ s < , ϕ (cid:48) ( s ) ≤ 0, implying that 1 is adowncrossing fixed point. This implies that (1 , . . . , ∈ R n is a stable point of ϕ — ∃ A ∈ R n × n such that ∃ N ⊂ R n , (1 , . . . , ∈ N such that ∀ x ∈ N, (cid:104) A ( x − f (1 , . . . , , x − (1 , . . . , (cid:105) ≥ 0. From [79, Thm. 2.2.8],if p is a stable point of a function F , then Pr [lim n →∞ X n → p ] > 0, which proves the first part of the claim.Let A n ( (cid:15) ) = {| X n − (1 , . . . , | > (cid:15) } be a Borel set in the Borel σ -algebra for an urn process. Since Pr [lim n →∞ X n → p ] > ∃ (cid:15) (cid:48) > (cid:80) n Pr [ A n ( (cid:15) (cid:48) )] < ∞ . The Borel-Cantelli lemma immediatelyyields the second part of the claim. D.4 Proof of Claim 4 We can show that agents select a portfolio given by w i ( t ) = w s i ( t ) w d i ( t ) γ = λσ s i λ i D i ( t ) σ s i λ i D i ( t ) σ s i λ i D i ( t ) σ s i 11 1 0 − µ s i ( t ) µ d i ( t )0 + = ( A ( t )) − ( µ i ( t ) + e )Define ∆ D i ( t ) = D ( t + 1) − D ( t ) and note that the time evolution of A ( t ) depends only on duration A ( t + 1) = A ( t ) + D i ( t ) λ i σ s i D i ( t ) λ i σ s i (cid:0) D i ( t ) + 2∆ D i ( t ) D i ( t ) (cid:1) λ i σ s i 00 0 0 = A ( t ) + ∆ ( t ) (16)35y the Sherman-Morrison formula for rank- k updates [80, 81], we have( A ( t ) + ∆ ( t )) − = A ( t ) − + X ( t ) (17)where X ( t ) = − ( I + A ( t ) − ∆ ( t )) − A ( t ) − ∆ ( t ) A ( t ) − (18)It can be shown from the definitions of ∆ and A (16) and (D.5) that (cid:107) A ( t ) − (cid:107) = max (cid:18)(cid:12)(cid:12)(cid:12)(cid:12) D i ( t ) D i ( t ) − (cid:12)(cid:12)(cid:12)(cid:12) , (cid:12)(cid:12)(cid:12)(cid:12) − D i ( t ) (cid:12)(cid:12)(cid:12)(cid:12) , (cid:19) (19)which is (cid:12)(cid:12)(cid:12)(cid:12) D i ( t ) D i ( t ) − (cid:12)(cid:12)(cid:12)(cid:12) when D i ( t ) > (cid:12)(cid:12)(cid:12)(cid:12) D i ( t ) − (cid:12)(cid:12)(cid:12)(cid:12) when D i ( t ) < 1. It can also be shown that (cid:107) X ( t ) − (cid:107) = (cid:12)(cid:12)(cid:12)(cid:12) ∆ D ( t )( D i ( t + 1) − D i ( t ) − (cid:12)(cid:12)(cid:12)(cid:12) (20)we therefore have (cid:107) w i ( t + 1) − w i ( t ) (cid:107) = (cid:107) ( A i ( t ) + ∆ i ( t )) − ( µ t +1 + e ) − A − ( µ t + e ) (cid:107) (21) ≤ (cid:107) A − (cid:107) (cid:107) ( µ t +1 − µ t ) (cid:107) + (cid:107) X (cid:107) (cid:107) ( µ t +1 + e )) (cid:107) (22)Substituting (19) and (20) gives the desired result D.5 Proof of Claim 5 The optimal portfolio weights are given by w i ( t ) = w s i ( t ) w d i ( t ) w (cid:96) i ( t ) γ = λσ s i λ i D i ( t ) σ s i λ i D i ( t ) σ s i λ i D i ( t ) σ s i λσ (cid:96) i 11 1 1 0 − µ s i ( t ) µ d i ( t ) µ (cid:96) i ( t )0 + = ( A ( t )) − ( µ i ( t ) + e )where γ is a Lagrange multiplier. The result follows directly by taking the corresponding entry of w i ( t ). D.6 Proof of Claim 6 As ψ i , ∂ψ i , ∂ ψ i are Lipschitz, the error term of the 2nd order Taylor expansion of φ at r is bounded by R ( r (cid:48) ) = O ( Lσ s i ). Thus for any (cid:15) > 0, if σ s i < (cid:15)L , then R ( r (cid:48) ) = | E [ ψ i ( µ s ( t + 1) , ( t + 1)] − ψ i ( µ s ( t + 1) , ( t + 1)) + ∂ r s ψ i ( t ) σ s / | < (cid:15) (23)Writing out µ d ( t ) gives: µ d ( t ) = E t [ ψ i ( r s i ( t + 1) i , t + 1)] ψ i ( r s i ( t ) i , t ) − ≈ ψ i ( µ s ( t + 1) i , t + 1) + σ si ∂ r si ψ i ( µ s ( t + 1) , t + 1) ψ i ( µ s ( t ) i , t ) − | ∆ µ s | + | ∆ µ (cid:96) | < L(cid:15) , we have | µ d ( t + 1) − µ d ( t ) | ≤ (cid:12)(cid:12)(cid:12)(cid:12) ∆ B i ( t ) + σ s C i ( t ) (cid:12)(cid:12)(cid:12)(cid:12) + 2 (cid:15) ≤ (cid:12)(cid:12)(cid:12)(cid:12) ∆ B i ( t ) (cid:12)(cid:12)(cid:12)(cid:12) + (cid:12)(cid:12)(cid:12)(cid:12) σ s C i ( t ) (cid:12)(cid:12)(cid:12)(cid:12) + 2 (cid:15) ≤ (cid:12)(cid:12)(cid:12)(cid:12) ∆ B i ( t ) (cid:12)(cid:12)(cid:12)(cid:12) + Lσ s i (cid:12)(cid:12)(cid:12)(cid:12) ψ i ( µ s ( t + 1) i , t + 1) − ψ i ( µ s ( t ) i , t ) (cid:12)(cid:12)(cid:12)(cid:12) (cid:107) µ t +1 − µ t (cid:107) + 2 (cid:15) (24)Equation (24) combined with Claim 1 of [3] yields: (cid:107) µ t +1 − µ t (cid:107) = | µ s ( t + 1) − µ s ( t ) | + | µ (cid:96) ( t + 1) − µ (cid:96) ( t ) | + | µ d ( t + 1) − µ d ( t ) |≤ C (cid:18) ∆ stake i ( t ) S t + ∆ lend ( t ) (cid:19) + (cid:12)(cid:12)(cid:12)(cid:12) ∆ B i ( t ) (cid:12)(cid:12)(cid:12)(cid:12) + Lσ s i (cid:12)(cid:12)(cid:12)(cid:12) ψ i ( µ s ( t + 1) i , t + 1) − ψ i ( µ s ( t ) i , t ) (cid:12)(cid:12)(cid:12)(cid:12) (cid:107) µ t +1 − µ t (cid:107) + 2 (cid:15) ≤ C (cid:18) ∆ stake i ( t ) S t + ∆ lend ( t ) (cid:19) + | ψ i ( µ s ( t + 2) i , t + 2) − ψ i ( µ s ( t + 1) i , t + 1) | + Lσ s i (cid:107) µ t +1 − µ t (cid:107) + 2 (cid:15) ≤ C (cid:18) ∆ stake i ( t ) S t + ∆ lend ( t ) (cid:19) + L | ∆ stake i ( t + 1) | + Lσ s i (cid:107) µ t +1 − µ t (cid:107) + 2 (cid:15) where the second inequality uses ψ ≥ (cid:18) − Lσ s i (cid:19) (cid:107) µ t +1 − µ t (cid:107) ≤ C (cid:18) ∆ stake i ( t ) (cid:18) S t (cid:19) + ∆ lend ( t ) (cid:19) + 2 (cid:15) (25)If L < σ sisi