Surprisingly, Tail Emission Is Not Inflationary
24 messages, 9 to 13 Jul 2022. Started by Peter Todd.
Peter Todd (6), Eric Voskuil (2), naman naman (2), Anthony Towns (2), John Tromp, Tobin Harding, vjudeu, Jacob Eliosoff, +8 more
New blog post:
https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary
tl;dr: Due to lost coins, a tail emission/fixed reward actually results in a stable money supply. Not an (monetarily) inflationary supply.
...and for the purposes of reply/discussion, attached is the article itself in markdown format:
--- layout: post title: "Surprisingly, Tail Emission Is Not Inflationary" date: 2022-07-09 tags: - bitcoin - monero ---
At present, all notable proof-of-work currencies reward miners with both a block reward, and transaction fees. With most currencies (including Bitcoin) phasing out block rewards over time. However in no currency have transaction fees consistently been more than 5% to 10% of the total mining reward[^fee-in-reward], with the exception of Ethereum, from June 2020 to Aug 2021. To date no proof-of-work currency has ever operated solely on transaction fees[^pow-tweet], and academic analysis has found that in this condition block generation is unstable.[^instability-without-block-reward] To paraphrase Andrew Poelstra, it's a scary phase change that no other coin has gone through.[^apoelstra-quote]
[^pow-tweet]: [I asked on Twitter](https://twitter.com/peterktodd/status/1543231264597090304) and no-one replied with counter-examples.
[^fee-in-reward]: [Average Fee Percentage in Total Block Reward](https://bitinfocharts.com/comparison/fee_to_reward-btc-eth-bch-ltc-doge-xmr-bsv-dash-zec.html#alltime)
[^instability-without-block-reward]: [On the Instability of Bitcoin Without the Block Reward](https://www.cs.princeton.edu/~arvindn/publications/mining_CCS.pdf)
[^apoelstra-quote]: [From a panel at TABConf 2021](https://twitter.com/peterktodd/status/1457066946898317316)
Monero has chosen to implement what they call [tail emission](https://www.getmonero.org/resources/moneropedia/tail-emission.html): a fixed reward per block that continues indefinitely. Dogecoin also has a fixed reward, which they widely - and incorrectly - refer to as an "abundant" supply[^dogecoin-abundant].
[^dogecoin-abundant]: Googling "dogecoin abundant" returns dozens of hits.
This article will show that a fixed block reward does **not** lead to an abundant supply. In fact, due to the inevitability of lost coins, a fixed reward converges to a **stable** monetary supply that is neither inflationary nor deflationary, with the total supply proportional to rate of tail emission and probability of coin loss.
Credit where credit is due: after writing the bulk of this article I found out that Monero developer [smooth_xmr](https://www.reddit.com/user/smooth_xmr/) also observed that tail emission results in a stable coin supply [a few years ago](https://www.reddit.com/r/Monero/comments/4z0azk/maam_28_monero_ask_anything_monday/d6sixyi/). There's probably others too: it's a pretty obvious result.
<div markdown="1" class="post-toc"> # Contents {:.no_toc} 0. TOC {:toc} </div>
## Modeling the Fixed-Reward Monetary Supply
Since the number of blocks is large, we can model the monetary supply as a continuous function $$N(t)$$, where $$t$$ is a given moment in time. If the block reward is fixed we can model the reward as a slope $$k$$ added to an initial supply $$N_0$$:
$$ N(t) = N_0 + kt $$
Of course, this isn't realistic as coins are constantly being lost due to deaths, forgotten passphrases, boating accidents, etc. These losses are independent: I'm not any more or less likely to forget my passphrase because you recently lost your coins in a boating accident — an accident I probably don't even know happened. Since the number of individual coins (and their owners) is large — as with the number of blocks — we can model this loss as though it happens continuously.
Since coins can only be lost once, the *rate* of coin loss at time $$t$$ is proportional to the total supply *at that moment* in time. So let's look at the *first derivative* of our fixed-reward coin supply:
$$ \frac{dN(t)}{dt} = k $$
...and subtract from it the lost coins, using $$\lambda$$ as our [coin loss constant](https://en.wikipedia.org/wiki/Exponential_decay):
$$ \frac{dN(t)}{dt} = k - \lambda N(t) $$
That's a first-order differential equation, which can be easily solved with separation of variables to get:
$$ N(t) = \frac{k}{\lambda} - Ce^{-\lambda t} $$
To remove the integration constant $$C$$, let's look at $$t = 0$$, where the coin supply is $$N_0$$:
$$
\begin{align}
N_0 &= \frac{k}{\lambda} - Ce^{-\lambda 0} = \frac{k}{\lambda} - C \\
C &= \frac{k}{\lambda} - N_0
\end{align}
$$
Thus:
$$
\begin{align}
N(t) &= \frac{k}{\lambda} - \left(\frac{k}{\lambda} - N_0 \right)e^{-\lambda t} \\
&= \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} \right)e^{-\lambda t}
\end{align}
$$
## Long Term Coin Supply
It's easy to see that in the long run, the second half of the coin supply equation goes to zero because $$\lim_{t \to \infty} e^{-\lambda t} = 0$$:
$$
\begin{align}
\lim_{t \to \infty} N(t) &= \lim_{t \to \infty} \left[ \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} \right)e^{-\lambda t} \right ] = \frac{k}{\lambda} \\
N(\infty) &= \frac{k}{\lambda}
\end{align}
$$
An intuitive explanation for this result is that in the long run, the initial supply $$N_0$$ doesn't matter, because approximately all of those coins will eventually be lost. Thus in the long run, the coin supply will converge towards $$\frac{k}{\lambda}$$, the point where coins are created just as fast as they are lost.
## Short Term Dynamics and Economic Considerations
Of course, the intuitive explanation for why supply converges to $$\frac{k}{\lambda}$$, also tells us that supply must converge fairly slowly: if 1% of something is lost per year, after 100 years 37% of the initial supply remains. It's not clear what the rate of lost coins actually is in a mature, valuable, coin. But 1%/year is likely to be a good guess — quite possibly less.
In the case of Monero, they've introduced tail emission at a point where it represents a 0.9% apparent monetary inflation rate[^p2pool-tail]. Since the number of previously lost coins, and the current rate of coin loss, is unknown[^unknowable] it's not possible to know exactly what the true monetary inflation rate is right now. But regardless, the rate will only converge towards zero going forward.
[^unknowable]: Being a privacy coin with [shielded amounts](https://localmonero.co/blocks/richlist), it's not even possible to get an estimate of the total amount of XMR in active circulation.
[^p2pool-tail]: P2Pool operates [a page with real-time date figures](https://p2pool.io/tail.html).
If an existing coin decides to implement tail emission as a means to fund security, choosing an appropriate emission rate is simple: decide on the maximum amount of inflation you are willing to have in the worst case, and set the tail emission accordingly. In reality monetary inflation will be even lower on day zero due to lost coins, and in the long run, it will converge towards zero.
The fact is, economic volatility dwarfs the effect of small amounts of inflation. Even a 0.5% inflation rate over 50 years only leads to a 22% drop. Meanwhile at the time of writing, Bitcoin has dropped 36% in the past year, and gained 993% over the past 5 years. While this discussion is a nice excuse to use some mildly interesting math, in the end it's totally pedantic.
## Could Bitcoin Add Tail Emission?
...and why could Monero?
Adding tail emission to Bitcoin would be a hard fork: a incompatible rule change that existing Bitcoin nodes would reject as invalid. While Monero was able to get sufficiently broad consensus in the community to implement tail emission, it's unclear at best if it would ever be possible to achieve that for the much larger[^btc-vs-xmr-market-cap] Bitcoin. Additionally, Monero has a culture of frequent hard forks that simply does not exist in Bitcoin.
[^btc-vs-xmr-market-cap]: [As of writing](https://web.archive.org/web/20220708143920/https://www.coingecko.com/), the apparent market cap of Bitcoin is $409 billion, almost 200x larger than Monero's $2.3 billion.
Ultimately, as long as a substantial fraction of the Bitcoin community continue to run full nodes, the only way tail emission could ever be added to Bitcoin is by convincing that same community that it is a good idea.
## Footnotes
Quoted text (1 line)
> Due to lost coins, a tail emission/fixed reward actually results in a stable money supply. Not an (monetarily) inflationary supply.
This observation is not a proof of lost coins, that is an assumption. It is the provable consequence of market, as opposed to monopoly, production.
https://github.com/libbitcoin/libbitcoin-system/wiki/Inflation-Principle
Mises’ unfortunate error in the application of the Cantillon Effect to gold perpetuates this misperception. One could imagine applying this theory to all goods, not just money, and conclude perpetual loss of value in everything produced, as a consequence of production. One might then be tempted to attribute the fact that this is not observable to loss/depreciation/consumption. While it is certainly possible that the amount of gold produced every year is offset by the amount lost, this of course implies that all of it is lost.
“Circulation” does not determine demand, all money is always held by someone. Changing hands only changes who owns the money, not its purchasing power. See Rothbard’s critique of monetary “velocity”.
e
Quoted text (201 lines)
> On Jul 9, 2022, at 05:47, Peter Todd via bitcoin-dev <bitcoin-dev@lists•linuxfoundation•org> wrote: > > New blog post: > > https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary > > tl;dr: Due to lost coins, a tail emission/fixed reward actually results in a > stable money supply. Not an (monetarily) inflationary supply. > > ...and for the purposes of reply/discussion, attached is the article itself in > markdown format: > > --- > layout: post > title: "Surprisingly, Tail Emission Is Not Inflationary" > date: 2022-07-09 > tags: > - bitcoin > - monero > --- > > At present, all notable proof-of-work currencies reward miners with both a block > reward, and transaction fees. With most currencies (including Bitcoin) phasing > out block rewards over time. However in no currency have transaction fees > consistently been more than 5% to 10% of the total mining > reward[^fee-in-reward], with the exception of Ethereum, from June 2020 to Aug 2021. > To date no proof-of-work currency has ever operated solely on transaction > fees[^pow-tweet], and academic analysis has found that in this condition block > generation is unstable.[^instability-without-block-reward] To paraphrase Andrew > Poelstra, it's a scary phase change that no other coin has gone through.[^apoelstra-quote] > > [^pow-tweet]: [I asked on Twitter](https://twitter.com/peterktodd/status/1543231264597090304) and no-one replied with counter-examples. > > [^fee-in-reward]: [Average Fee Percentage in Total Block Reward](https://bitinfocharts.com/comparison/fee_to_reward-btc-eth-bch-ltc-doge-xmr-bsv-dash-zec.html#alltime) > > [^instability-without-block-reward]: [On the Instability of Bitcoin Without the Block Reward](https://www.cs.princeton.edu/~arvindn/publications/mining_CCS.pdf) > > [^apoelstra-quote]: [From a panel at TABConf 2021](https://twitter.com/peterktodd/status/1457066946898317316) > > Monero has chosen to implement what they call [tail > emission](https://www.getmonero.org/resources/moneropedia/tail-emission.html): > a fixed reward per block that continues indefinitely. Dogecoin also has a fixed > reward, which they widely - and incorrectly - refer to as an "abundant" supply[^dogecoin-abundant]. > > [^dogecoin-abundant]: Googling "dogecoin abundant" returns dozens of hits. > > This article will show that a fixed block reward does **not** lead to an > abundant supply. In fact, due to the inevitability of lost coins, a fixed > reward converges to a **stable** monetary supply that is neither inflationary > nor deflationary, with the total supply proportional to rate of tail emission > and probability of coin loss. > > Credit where credit is due: after writing the bulk of this article I found out > that Monero developer [smooth_xmr](https://www.reddit.com/user/smooth_xmr/) > also observed that tail emission results in a stable coin supply > [a few years ago](https://www.reddit.com/r/Monero/comments/4z0azk/maam_28_monero_ask_anything_monday/d6sixyi/). > There's probably others too: it's a pretty obvious result. > > > <div markdown="1" class="post-toc"> > # Contents > {:.no_toc} > 0. TOC > {:toc} > </div> > > ## Modeling the Fixed-Reward Monetary Supply > > Since the number of blocks is large, we can model the monetary supply as a > continuous function $$N(t)$$, where $$t$$ is a given moment in time. If the > block reward is fixed we can model the reward as a slope $$k$$ added to an > initial supply $$N_0$$: > > $$ > N(t) = N_0 + kt > $$ > > Of course, this isn't realistic as coins are constantly being lost due to > deaths, forgotten passphrases, boating accidents, etc. These losses are > independent: I'm not any more or less likely to forget my passphrase because > you recently lost your coins in a boating accident — an accident I probably > don't even know happened. Since the number of individual coins (and their > owners) is large — as with the number of blocks — we can model this loss as > though it happens continuously. > > Since coins can only be lost once, the *rate* of coin loss at time $$t$$ is > proportional to the total supply *at that moment* in time. So let's look at the > *first derivative* of our fixed-reward coin supply: > > $$ > \frac{dN(t)}{dt} = k > $$ > > ...and subtract from it the lost coins, using $$\lambda$$ as our [coin loss > constant](https://en.wikipedia.org/wiki/Exponential_decay): > > $$ > \frac{dN(t)}{dt} = k - \lambda N(t) > $$ > > That's a first-order differential equation, which can be easily solved with > separation of variables to get: > > $$ > N(t) = \frac{k}{\lambda} - Ce^{-\lambda t} > $$ > > To remove the integration constant $$C$$, let's look at $$t = 0$$, where the > coin supply is $$N_0$$: > > $$ > \begin{align} > N_0 &= \frac{k}{\lambda} - Ce^{-\lambda 0} = \frac{k}{\lambda} - C \\ > C &= \frac{k}{\lambda} - N_0 > \end{align} > $$ > > Thus: > > $$ > \begin{align} > N(t) &= \frac{k}{\lambda} - \left(\frac{k}{\lambda} - N_0 \right)e^{-\lambda t} \\ > &= \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} \right)e^{-\lambda t} > \end{align} > $$ > > > ## Long Term Coin Supply > > It's easy to see that in the long run, the second half of the coin supply > equation goes to zero because $$\lim_{t \to \infty} e^{-\lambda t} = 0$$: > > $$ > \begin{align} > \lim_{t \to \infty} N(t) &= \lim_{t \to \infty} \left[ \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} \right)e^{-\lambda t} \right ] = \frac{k}{\lambda} \\ > N(\infty) &= \frac{k}{\lambda} > \end{align} > $$ > > An intuitive explanation for this result is that in the long run, the initial > supply $$N_0$$ doesn't matter, because approximately all of those coins will > eventually be lost. Thus in the long run, the coin supply will converge towards > $$\frac{k}{\lambda}$$, the point where coins are created just as fast as they > are lost. > > > ## Short Term Dynamics and Economic Considerations > > Of course, the intuitive explanation for why supply converges to > $$\frac{k}{\lambda}$$, also tells us that supply must converge fairly slowly: > if 1% of something is lost per year, after 100 years 37% of the initial supply > remains. It's not clear what the rate of lost coins actually is in a mature, > valuable, coin. But 1%/year is likely to be a good guess — quite possibly less. > > In the case of Monero, they've introduced tail emission at a point where it > represents a 0.9% apparent monetary inflation rate[^p2pool-tail]. Since the number of > previously lost coins, and the current rate of coin loss, is > unknown[^unknowable] it's not possible to know exactly what the true monetary > inflation rate is right now. But regardless, the rate will only converge > towards zero going forward. > > [^unknowable]: Being a privacy coin with [shielded amounts](https://localmonero.co/blocks/richlist), it's not even possible to get an estimate of the total amount of XMR in active circulation. > > [^p2pool-tail]: P2Pool operates [a page with real-time date figures](https://p2pool.io/tail.html). > > If an existing coin decides to implement tail emission as a means to fund > security, choosing an appropriate emission rate is simple: decide on the > maximum amount of inflation you are willing to have in the worst case, and set > the tail emission accordingly. In reality monetary inflation will be even lower > on day zero due to lost coins, and in the long run, it will converge towards > zero. > > The fact is, economic volatility dwarfs the effect of small amounts of > inflation. Even a 0.5% inflation rate over 50 years only leads to a 22% drop. > Meanwhile at the time of writing, Bitcoin has dropped 36% in the past year, and > gained 993% over the past 5 years. While this discussion is a nice excuse to > use some mildly interesting math, in the end it's totally pedantic. > > ## Could Bitcoin Add Tail Emission? > > ...and why could Monero? > > Adding tail emission to Bitcoin would be a hard fork: a incompatible rule > change that existing Bitcoin nodes would reject as invalid. While Monero was > able to get sufficiently broad consensus in the community to implement tail > emission, it's unclear at best if it would ever be possible to achieve that for > the much larger[^btc-vs-xmr-market-cap] Bitcoin. Additionally, Monero has a > culture of frequent hard forks that simply does not exist in Bitcoin. > > [^btc-vs-xmr-market-cap]: [As of writing](https://web.archive.org/web/20220708143920/https://www.coingecko.com/), the apparent market cap of Bitcoin is $409 billion, almost 200x larger than Monero's $2.3 billion. > > Ultimately, as long as a substantial fraction of the Bitcoin community continue > to run full nodes, the only way tail emission could ever be added to Bitcoin is > by convincing that same community that it is a good idea. > > > ## Footnotes > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists•linuxfoundation•org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
Quoted text (2 lines)
> New blog post: > https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary
A Tail Emission is best described as disinflationary; the yearly supply inflation steadily decreases toward zero.
Quoted text (1 line)
> Dogecoin also has a fixed reward
It started out with random rewards up to 1M doge per block, with the maximum halving every 100K blocks, until the fixed reward of 10K doge kicked in at height 600K.
Quoted text (1 line)
> If an existing coin decides to implement tail emission as a means to fund security, choosing an appropriate emission rate is simple: decide on the maximum amount of inflation you are willing to have in the worst case, and set the tail emission accordingly.
Any coin without a premine starts with infinite inflation. Bitcoin in its first 4 years had yearly inflation rates of inf, 100%, 50%, and 33%. So deciding on a maximum amount of inflation is deciding on a premine.
While in the long term, a capped supply doesn't meaningfully differ from un uncapped supply [1], the 21M limit is central to Bitcoin's identity, and removing this limit results in something that can no longer be called Bitcoin.
[1] https://john-tromp.medium.com/a-case-for-using-soft-total-supply-1169a188d153
On Sat, Jul 09, 2022 at 04:57:57PM +0200, John Tromp via bitcoin-dev wrote:
Quoted text (5 lines)
> > New blog post: > > https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary > > A Tail Emission is best described as disinflationary; the yearly > supply inflation steadily decreases toward zero.
_Apparently_ inflation. True monetary inflation includes lost coins - both intentionally and accidentally lost. It's quite possible that even with tail emission Monero is currently a monetarily deflationary coin, as the lost coin rate might be higher than the 0.8% apparent tail emission rate.
We just don't know. Doubly so in the case of monero where its privacy features hide coin activity.
Quoted text (6 lines)
> > If an existing coin decides to implement tail emission as a means to fund security, choosing an appropriate emission rate is simple: decide on the maximum amount of inflation you are willing to have in the worst case, and set the tail emission accordingly. > > Any coin without a premine starts with infinite inflation. Bitcoin in > its first 4 years had yearly inflation rates of inf, 100%, 50%, and > 33%. So deciding on a maximum amount of inflation is deciding on a > premine.
Hence why I specified an *existing* coin.
Quoted text (4 lines)
> While in the long term, a capped supply doesn't meaningfully differ > from un uncapped supply [1], the 21M limit is central to Bitcoin's > identity, and removing this limit results in something that can no > longer be called Bitcoin.
Personally I think basing your identity on a technical point that isn't even correct is stupid. And I suspect than when push comes to shove, if in ~10 years or whatever Bitcoin turns out to be unstable without a reward, the market as a whole will be happy to redefine Bitcoin to remove the 21M limit. Whether or not it can do that fast enough to avoid Bitcoin dying first is an open question.
On Sat, Jul 09, 2022 at 07:26:22AM -0700, Eric Voskuil wrote:
Quoted text (3 lines)
> > Due to lost coins, a tail emission/fixed reward actually results in a stable money supply. Not an (monetarily) inflationary supply. > > This observation is not a proof of lost coins, that is an assumption.
To be clear, are you claiming that there is no proof that coins are lost?
To clarify, price inflation is not caused by market production. Attributing the observed lack of inflation (eg fee %) to loss is an assumed relation.
Even if the amount of loss was known (which it is not), there remains an assumption in the correlation of non-lost coins to price. Demand determines price, not the amount of something in existence, hence the folly of S2F (1/monetary-inflation).
e
Quoted text (11 lines)
> On Jul 9, 2022, at 08:15, Peter Todd <pete@petertodd•org> wrote: > > On Sat, Jul 09, 2022 at 07:26:22AM -0700, Eric Voskuil wrote: >>> Due to lost coins, a tail emission/fixed reward actually results in a stable money supply. Not an (monetarily) inflationary supply. >> >> This observation is not a proof of lost coins, that is an assumption. > > To be clear, are you claiming that there is no proof that coins are lost? > > -- > https://petertodd.org 'peter'[:-1]@petertodd.org
On Sat, Jul 09, 2022 at 08:24:51AM -0700, Eric Voskuil wrote:
Quoted text (1 line)
> To clarify, price inflation is not caused by market production. Attributing the observed lack of inflation (eg fee %) to loss is an assumed relation.
My article is a mathematical proof that has nothing to do with observations of inflation.
What I did is prove that if there is tail emission/fixed supply, the coin supply will converge towards a fixed amount because the coin supply dependant rate of coin loss balances out the fixed rate of coin production.
That proof has nothing to do with market dynamics and would happen in any system, economic or not, with similar underlying dynamics.
Hi,
This approach raises the obvious question : If someone hasn't had access to their coins in a long time (yrs, decades, however you want to define it) - and they wish to access/move them after such a time - isn't your proposal simply taking away their ability to do so? Some might call it : stealing their coins.
How does one conclusively prove that "lost" coins are "lost forever"?
Regards, thenoblebot
On Sat, 9 Jul, 2022, 7:31 pm Peter Todd via bitcoin-dev, < bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (24 lines)
> On Sat, Jul 09, 2022 at 08:24:51AM -0700, Eric Voskuil wrote: > > To clarify, price inflation is not caused by market production. > Attributing the observed lack of inflation (eg fee %) to loss is an assumed > relation. > > My article is a mathematical proof that has nothing to do with > observations of > inflation. > > What I did is prove that if there is tail emission/fixed supply, the coin > supply will converge towards a fixed amount because the coin supply > dependant > rate of coin loss balances out the fixed rate of coin production. > > That proof has nothing to do with market dynamics and would happen in any > system, economic or not, with similar underlying dynamics. > > -- > https://petertodd.org 'peter'[:-1]@petertodd.org > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists•linuxfoundation•org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >
On Sat, Jul 09, 2022 at 09:43:49PM +0400, naman naman wrote:
Quoted text (9 lines)
> Hi, > > This approach raises the obvious question : If someone hasn't had access to > their coins in a long time (yrs, decades, however you want to define it) - > and they wish to access/move them after such a time - isn't your proposal > simply taking away their ability to do so? Some might call it : stealing > their coins. > > How does one conclusively prove that "lost" coins are "lost forever"?
Re-read the article: https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary
It has nothing to do with re-assigning ownership of coins.
Hi Peter,
Interesting blog post.
On Sat, Jul 09, 2022 at 11:31:26AM -0400, Peter Todd via bitcoin-dev wrote:
Quoted text (12 lines)
> On Sat, Jul 09, 2022 at 08:24:51AM -0700, Eric Voskuil wrote: > > To clarify, price inflation is not caused by market production. Attributing the observed lack of inflation (eg fee %) to loss is an assumed relation. > > My article is a mathematical proof that has nothing to do with observations of > inflation. > > What I did is prove that if there is tail emission/fixed supply, the coin > supply will converge towards a fixed amount because the coin supply dependant > rate of coin loss balances out the fixed rate of coin production. > > That proof has nothing to do with market dynamics and would happen in any > system, economic or not, with similar underlying dynamics.
I'm not a mathematician but I think your models assumption that coin loss is proportional to number of coins misses something, correct me if I'm wrong but as value of coins goes up is it not reasonable to expect coin loss to go down as people are more careful (not to mention improvements in tooling and education).
Is it really possible to model coin loss as exponential decay considering such things (I'm not being facetious, that is a real question, like I said I'm not a mathematician)?
Cheers, Tobin.
Hello ,
Thanks for the correction - it however boils down to the same principle : diluting other holders, possibly excessively, if you miscalculate the coins "lost".
Which boils down to the same question again : How would you definitively know that coins are "lost" or simply not accessed for x amount of time?
Regards, thenoblebot
On Sat, 9 Jul, 2022, 9:48 pm Peter Todd, <pete@petertodd•org> wrote:
Quoted text (21 lines)
> On Sat, Jul 09, 2022 at 09:43:49PM +0400, naman naman wrote: > > Hi, > > > > This approach raises the obvious question : If someone hasn't had access > to > > their coins in a long time (yrs, decades, however you want to define it) > - > > and they wish to access/move them after such a time - isn't your proposal > > simply taking away their ability to do so? Some might call it : stealing > > their coins. > > > > How does one conclusively prove that "lost" coins are "lost forever"? > > Re-read the article: > https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary > > It has nothing to do with re-assigning ownership of coins. > > -- > https://petertodd.org 'peter'[:-1]@petertodd.org >
Quoted text (1 line)
> Adding tail emission to Bitcoin would be a hard fork: a incompatible rule change that existing Bitcoin nodes would reject as invalid.
It won't, because we have zero satoshis. That means, it is possible to create any backward-compatible way of storing amounts. And if we will ever implement things like hiding amounts, then using zero would be a good way to maintain this backward compatibility.
Quoted text (1 line)
> Ultimately, as long as a substantial fraction of the Bitcoin community continue to run full nodes, the only way tail emission could ever be added to Bitcoin is by convincing that same community that it is a good idea.
Not really, because people that run full nodes, just accepted Segwit and Taproot. They had no choice. And in case of zero satoshis, it could be the same: you would see zero if you look at raw bytes, but you will see non-zero values, if you use some upgraded client, that will support amount hiding, or other features.
Segwit: old nodes see no new signatures, new nodes see all signatures Zero satoshis: old nodes see new zero amounts, new nodes see all amounts
It is that simple.
On 2022-07-09 14:47:14 user Peter Todd via bitcoin-dev <bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (1 line)
> New blog post:
https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary
tl;dr: Due to lost coins, a tail emission/fixed reward actually results in a stable money supply. Not an (monetarily) inflationary supply.
...and for the purposes of reply/discussion, attached is the article itself in markdown format:
--- layout: post title: "Surprisingly, Tail Emission Is Not Inflationary" date: 2022-07-09 tags: - bitcoin - monero ---
At present, all notable proof-of-work currencies reward miners with both a block reward, and transaction fees. With most currencies (including Bitcoin) phasing out block rewards over time. However in no currency have transaction fees consistently been more than 5% to 10% of the total mining reward[^fee-in-reward], with the exception of Ethereum, from June 2020 to Aug 2021. To date no proof-of-work currency has ever operated solely on transaction fees[^pow-tweet], and academic analysis has found that in this condition block generation is unstable.[^instability-without-block-reward] To paraphrase Andrew Poelstra, it's a scary phase change that no other coin has gone through.[^apoelstra-quote]
[^pow-tweet]: [I asked on Twitter](https://twitter.com/peterktodd/status/1543231264597090304) and no-one replied with counter-examples.
[^fee-in-reward]: [Average Fee Percentage in Total Block Reward](https://bitinfocharts.com/comparison/fee_to_reward-btc-eth-bch-ltc-doge-xmr-bsv-dash-zec.html#alltime)
[^instability-without-block-reward]: [On the Instability of Bitcoin Without the Block Reward](https://www.cs.princeton.edu/~arvindn/publications/mining_CCS.pdf)
[^apoelstra-quote]: [From a panel at TABConf 2021](https://twitter.com/peterktodd/status/1457066946898317316)
Monero has chosen to implement what they call [tail emission](https://www.getmonero.org/resources/moneropedia/tail-emission.html): a fixed reward per block that continues indefinitely. Dogecoin also has a fixed reward, which they widely - and incorrectly - refer to as an "abundant" supply[^dogecoin-abundant].
[^dogecoin-abundant]: Googling "dogecoin abundant" returns dozens of hits.
This article will show that a fixed block reward does **not** lead to an abundant supply. In fact, due to the inevitability of lost coins, a fixed reward converges to a **stable** monetary supply that is neither inflationary nor deflationary, with the total supply proportional to rate of tail emission and probability of coin loss.
Credit where credit is due: after writing the bulk of this article I found out that Monero developer [smooth_xmr](https://www.reddit.com/user/smooth_xmr/) also observed that tail emission results in a stable coin supply [a few years ago](https://www.reddit.com/r/Monero/comments/4z0azk/maam_28_monero_ask_anything_monday/d6sixyi/). There's probably others too: it's a pretty obvious result.
<div markdown="1" class="post-toc"> # Contents {:.no_toc} 0. TOC {:toc} </div>
## Modeling the Fixed-Reward Monetary Supply
Since the number of blocks is large, we can model the monetary supply as a continuous function $$N(t)$$, where $$t$$ is a given moment in time. If the block reward is fixed we can model the reward as a slope $$k$$ added to an initial supply $$N_0$$:
$$ N(t) = N_0 + kt $$
Of course, this isn't realistic as coins are constantly being lost due to deaths, forgotten passphrases, boating accidents, etc. These losses are independent: I'm not any more or less likely to forget my passphrase because you recently lost your coins in a boating accident — an accident I probably don't even know happened. Since the number of individual coins (and their owners) is large — as with the number of blocks — we can model this loss as though it happens continuously.
Since coins can only be lost once, the *rate* of coin loss at time $$t$$ is proportional to the total supply *at that moment* in time. So let's look at the *first derivative* of our fixed-reward coin supply:
$$ \frac{dN(t)}{dt} = k $$
...and subtract from it the lost coins, using $$\lambda$$ as our [coin loss constant](https://en.wikipedia.org/wiki/Exponential_decay):
$$ \frac{dN(t)}{dt} = k - \lambda N(t) $$
That's a first-order differential equation, which can be easily solved with separation of variables to get:
$$ N(t) = \frac{k}{\lambda} - Ce^{-\lambda t} $$
To remove the integration constant $$C$$, let's look at $$t = 0$$, where the coin supply is $$N_0$$:
$$
\begin{align}
N_0 &= \frac{k}{\lambda} - Ce^{-\lambda 0} = \frac{k}{\lambda} - C \\
C &= \frac{k}{\lambda} - N_0
\end{align}
$$
Thus:
$$
\begin{align}
N(t) &= \frac{k}{\lambda} - \left(\frac{k}{\lambda} - N_0 \right)e^{-\lambda t} \\
&= \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} \right)e^{-\lambda t}
\end{align}
$$
## Long Term Coin Supply
It's easy to see that in the long run, the second half of the coin supply equation goes to zero because $$\lim_{t \to \infty} e^{-\lambda t} = 0$$:
$$
\begin{align}
\lim_{t \to \infty} N(t) &= \lim_{t \to \infty} \left[ \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} \right)e^{-\lambda t} \right ] = \frac{k}{\lambda} \\
N(\infty) &= \frac{k}{\lambda}
\end{align}
$$
An intuitive explanation for this result is that in the long run, the initial supply $$N_0$$ doesn't matter, because approximately all of those coins will eventually be lost. Thus in the long run, the coin supply will converge towards $$\frac{k}{\lambda}$$, the point where coins are created just as fast as they are lost.
## Short Term Dynamics and Economic Considerations
Of course, the intuitive explanation for why supply converges to $$\frac{k}{\lambda}$$, also tells us that supply must converge fairly slowly: if 1% of something is lost per year, after 100 years 37% of the initial supply remains. It's not clear what the rate of lost coins actually is in a mature, valuable, coin. But 1%/year is likely to be a good guess — quite possibly less.
In the case of Monero, they've introduced tail emission at a point where it represents a 0.9% apparent monetary inflation rate[^p2pool-tail]. Since the number of previously lost coins, and the current rate of coin loss, is unknown[^unknowable] it's not possible to know exactly what the true monetary inflation rate is right now. But regardless, the rate will only converge towards zero going forward.
[^unknowable]: Being a privacy coin with [shielded amounts](https://localmonero.co/blocks/richlist), it's not even possible to get an estimate of the total amount of XMR in active circulation.
[^p2pool-tail]: P2Pool operates [a page with real-time date figures](https://p2pool.io/tail.html).
If an existing coin decides to implement tail emission as a means to fund security, choosing an appropriate emission rate is simple: decide on the maximum amount of inflation you are willing to have in the worst case, and set the tail emission accordingly. In reality monetary inflation will be even lower on day zero due to lost coins, and in the long run, it will converge towards zero.
The fact is, economic volatility dwarfs the effect of small amounts of inflation. Even a 0.5% inflation rate over 50 years only leads to a 22% drop. Meanwhile at the time of writing, Bitcoin has dropped 36% in the past year, and gained 993% over the past 5 years. While this discussion is a nice excuse to use some mildly interesting math, in the end it's totally pedantic.
## Could Bitcoin Add Tail Emission?
...and why could Monero?
Adding tail emission to Bitcoin would be a hard fork: a incompatible rule change that existing Bitcoin nodes would reject as invalid. While Monero was able to get sufficiently broad consensus in the community to implement tail emission, it's unclear at best if it would ever be possible to achieve that for the much larger[^btc-vs-xmr-market-cap] Bitcoin. Additionally, Monero has a culture of frequent hard forks that simply does not exist in Bitcoin.
[^btc-vs-xmr-market-cap]: [As of writing](https://web.archive.org/web/20220708143920/https://www.coingecko.com/), the apparent market cap of Bitcoin is $409 billion, almost 200x larger than Monero's $2.3 billion.
Ultimately, as long as a substantial fraction of the Bitcoin community continue to run full nodes, the only way tail emission could ever be added to Bitcoin is by convincing that same community that it is a good idea.
## Footnotes
Quoted text (1 line)
> Credit where credit is due: after writing the bulk of this article I
found out
Quoted text (1 line)
> that Monero developer [smooth_xmr](https://www.reddit.com/user/smooth_xmr/
)
Quoted text (2 lines)
> also observed that tail emission results in a stable coin supply > [a few years ago](
https://www.reddit.com/r/Monero/comments/4z0azk/maam_28_monero_ask_anything_monday/d6sixyi/ ).
Quoted text (1 line)
> There's probably others too: it's a pretty obvious result.
Fwiw, Joe Lubin, April 2014: "The expected rate of annual loss and destruction of ETH will balance the rate of issuance. Under this dynamic, a quasi-steady state is reached and the amount of extant ETH no longer grows." https://blog.ethereum.org/2014/04/10/the-issuance-model-in-ethereum/
As you say, probably an observation various people have made. (Ethereum has had some updates to its issuance model since 2014, in particular EIP-1559 and the block reward reduction coming with PoS. But they've had a fixed rather than halving block subsidy since launch so the question of whether it implied infinite supply often came up.)
On Sat, Jul 9, 2022, 7:47 AM Peter Todd via bitcoin-dev < bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (257 lines)
> New blog post: > > https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary > > tl;dr: Due to lost coins, a tail emission/fixed reward actually results in > a > stable money supply. Not an (monetarily) inflationary supply. > > ...and for the purposes of reply/discussion, attached is the article > itself in > markdown format: > > --- > layout: post > title: "Surprisingly, Tail Emission Is Not Inflationary" > date: 2022-07-09 > tags: > - bitcoin > - monero > --- > > At present, all notable proof-of-work currencies reward miners with both a > block > reward, and transaction fees. With most currencies (including Bitcoin) > phasing > out block rewards over time. However in no currency have transaction fees > consistently been more than 5% to 10% of the total mining > reward[^fee-in-reward], with the exception of Ethereum, from June 2020 to > Aug 2021. > To date no proof-of-work currency has ever operated solely on transaction > fees[^pow-tweet], and academic analysis has found that in this condition > block > generation is unstable.[^instability-without-block-reward] To paraphrase > Andrew > Poelstra, it's a scary phase change that no other coin has gone > through.[^apoelstra-quote] > > [^pow-tweet]: [I asked on Twitter]( > https://twitter.com/peterktodd/status/1543231264597090304) and no-one > replied with counter-examples. > > [^fee-in-reward]: [Average Fee Percentage in Total Block Reward]( > https://bitinfocharts.com/comparison/fee_to_reward-btc-eth-bch-ltc-doge-xmr-bsv-dash-zec.html#alltime > ) > > [^instability-without-block-reward]: [On the Instability of Bitcoin > Without the Block Reward]( > https://www.cs.princeton.edu/~arvindn/publications/mining_CCS.pdf) > > [^apoelstra-quote]: [From a panel at TABConf 2021]( > https://twitter.com/peterktodd/status/1457066946898317316) > > Monero has chosen to implement what they call [tail > emission]( > https://www.getmonero.org/resources/moneropedia/tail-emission.html): > a fixed reward per block that continues indefinitely. Dogecoin also has a > fixed > reward, which they widely - and incorrectly - refer to as an "abundant" > supply[^dogecoin-abundant]. > > [^dogecoin-abundant]: Googling "dogecoin abundant" returns dozens of hits. > > This article will show that a fixed block reward does **not** lead to an > abundant supply. In fact, due to the inevitability of lost coins, a fixed > reward converges to a **stable** monetary supply that is neither > inflationary > nor deflationary, with the total supply proportional to rate of tail > emission > and probability of coin loss. > > Credit where credit is due: after writing the bulk of this article I found > out > that Monero developer [smooth_xmr](https://www.reddit.com/user/smooth_xmr/ > ) > also observed that tail emission results in a stable coin supply > [a few years ago]( > https://www.reddit.com/r/Monero/comments/4z0azk/maam_28_monero_ask_anything_monday/d6sixyi/ > ). > There's probably others too: it's a pretty obvious result. > > > <div markdown="1" class="post-toc"> > # Contents > {:.no_toc} > 0. TOC > {:toc} > </div> > > ## Modeling the Fixed-Reward Monetary Supply > > Since the number of blocks is large, we can model the monetary supply as a > continuous function $$N(t)$$, where $$t$$ is a given moment in time. If the > block reward is fixed we can model the reward as a slope $$k$$ added to an > initial supply $$N_0$$: > > $$ > N(t) = N_0 + kt > $$ > > Of course, this isn't realistic as coins are constantly being lost due to > deaths, forgotten passphrases, boating accidents, etc. These losses are > independent: I'm not any more or less likely to forget my passphrase > because > you recently lost your coins in a boating accident — an accident I probably > don't even know happened. Since the number of individual coins (and their > owners) is large — as with the number of blocks — we can model this loss as > though it happens continuously. > > Since coins can only be lost once, the *rate* of coin loss at time $$t$$ is > proportional to the total supply *at that moment* in time. So let's look > at the > *first derivative* of our fixed-reward coin supply: > > $$ > \frac{dN(t)}{dt} = k > $$ > > ...and subtract from it the lost coins, using $$\lambda$$ as our [coin loss > constant](https://en.wikipedia.org/wiki/Exponential_decay): > > $$ > \frac{dN(t)}{dt} = k - \lambda N(t) > $$ > > That's a first-order differential equation, which can be easily solved with > separation of variables to get: > > $$ > N(t) = \frac{k}{\lambda} - Ce^{-\lambda t} > $$ > > To remove the integration constant $$C$$, let's look at $$t = 0$$, where > the > coin supply is $$N_0$$: > > $$ > \begin{align} > N_0 &= \frac{k}{\lambda} - Ce^{-\lambda 0} = \frac{k}{\lambda} - C \\ > C &= \frac{k}{\lambda} - N_0 > \end{align} > $$ > > Thus: > > $$ > \begin{align} > N(t) &= \frac{k}{\lambda} - \left(\frac{k}{\lambda} - N_0 > \right)e^{-\lambda t} \\ > &= \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} > \right)e^{-\lambda t} > \end{align} > $$ > > > ## Long Term Coin Supply > > It's easy to see that in the long run, the second half of the coin supply > equation goes to zero because $$\lim_{t \to \infty} e^{-\lambda t} = 0$$: > > $$ > \begin{align} > \lim_{t \to \infty} N(t) &= \lim_{t \to \infty} \left[ > \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} \right)e^{-\lambda t} > \right ] = \frac{k}{\lambda} \\ > N(\infty) &= \frac{k}{\lambda} > \end{align} > $$ > > An intuitive explanation for this result is that in the long run, the > initial > supply $$N_0$$ doesn't matter, because approximately all of those coins > will > eventually be lost. Thus in the long run, the coin supply will converge > towards > $$\frac{k}{\lambda}$$, the point where coins are created just as fast as > they > are lost. > > > ## Short Term Dynamics and Economic Considerations > > Of course, the intuitive explanation for why supply converges to > $$\frac{k}{\lambda}$$, also tells us that supply must converge fairly > slowly: > if 1% of something is lost per year, after 100 years 37% of the initial > supply > remains. It's not clear what the rate of lost coins actually is in a > mature, > valuable, coin. But 1%/year is likely to be a good guess — quite possibly > less. > > In the case of Monero, they've introduced tail emission at a point where it > represents a 0.9% apparent monetary inflation rate[^p2pool-tail]. Since > the number of > previously lost coins, and the current rate of coin loss, is > unknown[^unknowable] it's not possible to know exactly what the true > monetary > inflation rate is right now. But regardless, the rate will only converge > towards zero going forward. > > [^unknowable]: Being a privacy coin with [shielded amounts]( > https://localmonero.co/blocks/richlist), it's not even possible to get an > estimate of the total amount of XMR in active circulation. > > [^p2pool-tail]: P2Pool operates [a page with real-time date figures]( > https://p2pool.io/tail.html). > > If an existing coin decides to implement tail emission as a means to fund > security, choosing an appropriate emission rate is simple: decide on the > maximum amount of inflation you are willing to have in the worst case, and > set > the tail emission accordingly. In reality monetary inflation will be even > lower > on day zero due to lost coins, and in the long run, it will converge > towards > zero. > > The fact is, economic volatility dwarfs the effect of small amounts of > inflation. Even a 0.5% inflation rate over 50 years only leads to a 22% > drop. > Meanwhile at the time of writing, Bitcoin has dropped 36% in the past > year, and > gained 993% over the past 5 years. While this discussion is a nice excuse > to > use some mildly interesting math, in the end it's totally pedantic. > > ## Could Bitcoin Add Tail Emission? > > ...and why could Monero? > > Adding tail emission to Bitcoin would be a hard fork: a incompatible rule > change that existing Bitcoin nodes would reject as invalid. While Monero > was > able to get sufficiently broad consensus in the community to implement tail > emission, it's unclear at best if it would ever be possible to achieve > that for > the much larger[^btc-vs-xmr-market-cap] Bitcoin. Additionally, Monero has a > culture of frequent hard forks that simply does not exist in Bitcoin. > > [^btc-vs-xmr-market-cap]: [As of writing]( > https://web.archive.org/web/20220708143920/https://www.coingecko.com/), > the apparent market cap of Bitcoin is $409 billion, almost 200x larger than > Monero's $2.3 billion. > > Ultimately, as long as a substantial fraction of the Bitcoin community > continue > to run full nodes, the only way tail emission could ever be added to > Bitcoin is > by convincing that same community that it is a good idea. > > > ## Footnotes > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists•linuxfoundation•org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >
On Sat, Jul 09, 2022 at 08:46:47AM -0400, Peter Todd via bitcoin-dev wrote:
Quoted text (4 lines)
> title: "Surprisingly, Tail Emission Is Not Inflationary" > Of course, this isn't realistic as coins are constantly being lost due to > deaths, forgotten passphrases, boating accidents, etc. These losses are > independent:
This isn't necessarily true: if the losses are due to a common cause, then they'll be heavily correlated rather than independent; for example losses could be caused by a bug in a popular wallet/exchange software that sends funds to invalid addresses, or by a war or natural disaster that damages key storage hardware. They're also not independent over time -- people improve their key storage habits over time; eg switching to less buggy wallets/exchanges, validating addresses before using them, using distributed multisig to prevent a localised disaster from being catastrophic.
Quoted text (2 lines)
> the *rate* of coin loss at time $$t$$ is > proportional to the total supply *at that moment* in time.
This is the key assumption that produces the claimed result.
If you're losing a constant fraction, x (Peter's \lambda), of Bitcoins each year, then as soon as the supply increases enough that the constant reward, k, corresponds to the constant fraction, ie k = x*N(t), then you've hit an equilibrium. (Likewise if you're losing more than you're increasing -- you just need to wait until N(t) decreases enough that you reach the same equilibrium point) You don't really need any fancy maths.
But that assumption doesn't need to be true; coins could primarily be lost in "black swan" events (due to bugs, wars or disasters) rather than at a predictable rate -- with actions taken thereafter such that the same event repeating is no longer the same level of catastrophe, but instead another new black swan event is required to maintain the same loss rate. If that's the case, then the rate at which funds are lost will vary chaotically, leading to "inflationary" periods in between events, and comparatively strong deflationary shocks when these events occur.
Alternatively, losses could be at a predictable rate that's entirely different to the one Peter assumes.
One alternative predictable rate that seems plausible to me is if funds are lost due to people not be careful about losing small amounts; even though they are careful when amounts are larger. So when 10k BTC was worth $40, maybe it doesn't matter if you misplace a hard drive with 7500 BTC on it since that's only worth $30; but by the time 7500 BTC is worth $150M, maybe you take a bit more care with that, but are still not too worried if you lose 1.5mBTC, since that's also only worth $30.
To mathematise that, perhaps there are K people holding Bitcoin, and with probability p, each loses $100 (in constant 2009 dollars say, so that we can ignore inflation) of that Bitcoin a year through carelessness. For an equilibrium to occur in that case, you need:
N(t) + k - (100/P * Kp) = N(t)
where P is the price of Bitcoin (again in constant 2009 dollars) and k is Peter's fixed tail subsidy. Simplifying gives:
P = K * 100p/k
But k and p are constant by assumption in this scenario, so equilibrium is reached only if price (P) is exactly proportional to number of users (K). That requires you to have a non-inflationary currency (supply is constant) with constant adoption (assume K doesn't change) that maintains a constant price (P=K*100p/k) in real terms even if the economy is otherwise expanding or contracting.
More importantly, just from a goals point of view, x is something we should be finding ways to minimise it over time, not leave constant. In fact, you could argue for an even stronger goal: "the real value held in BTC lost each year should decrease", that is, x should be decreasing faster than 1/(N(t)*P).
Cheers, aj
I very much agree with AJ here. This is something I remember discussing on Bitcointalk back in 2011: I find it highly intuitive that the amount of lost coins is not a constant fraction of the supply, because people get better at keeping their coins with increasing value, distribution and technology/best practices. I also think that we have observed this effect in practice since then. The bulk of coins that are supposed to be lost (via onchain analysis) haven't been moved since at least 2010. Of course, in most cases, we'll never know, but the assumption of constant loss rate seems unreasonable.
Cheers Stefan
Anthony Towns via bitcoin-dev <bitcoin-dev@lists•linuxfoundation•org> schrieb am Mo., 11. Juli 2022, 04:32:
Quoted text (82 lines)
> On Sat, Jul 09, 2022 at 08:46:47AM -0400, Peter Todd via bitcoin-dev wrote: > > title: "Surprisingly, Tail Emission Is Not Inflationary" > > > Of course, this isn't realistic as coins are constantly being lost due to > > deaths, forgotten passphrases, boating accidents, etc. These losses are > > independent: > > This isn't necessarily true: if the losses are due to a common cause, > then they'll be heavily correlated rather than independent; for example > losses could be caused by a bug in a popular wallet/exchange software > that sends funds to invalid addresses, or by a war or natural disaster > that damages key storage hardware. They're also not independent over > time -- people improve their key storage habits over time; eg switching > to less buggy wallets/exchanges, validating addresses before using them, > using distributed multisig to prevent a localised disaster from being > catastrophic. > > > the *rate* of coin loss at time $$t$$ is > > proportional to the total supply *at that moment* in time. > > This is the key assumption that produces the claimed result. > > If you're losing a constant fraction, x (Peter's \lambda), of Bitcoins > each year, then as soon as the supply increases enough that the constant > reward, k, corresponds to the constant fraction, ie k = x*N(t), then > you've hit an equilibrium. (Likewise if you're losing more than you're > increasing -- you just need to wait until N(t) decreases enough that you > reach the same equilibrium point) You don't really need any fancy maths. > > But that assumption doesn't need to be true; coins could primarily be > lost in "black swan" events (due to bugs, wars or disasters) rather > than at a predictable rate -- with actions taken thereafter such that > the same event repeating is no longer the same level of catastrophe, > but instead another new black swan event is required to maintain the same > loss rate. If that's the case, then the rate at which funds are lost will > vary chaotically, leading to "inflationary" periods in between events, > and comparatively strong deflationary shocks when these events occur. > > Alternatively, losses could be at a predictable rate that's entirely > different to the one Peter assumes. > > One alternative predictable rate that seems plausible to me is if funds > are lost due to people not be careful about losing small amounts; even > though they are careful when amounts are larger. So when 10k BTC was > worth $40, maybe it doesn't matter if you misplace a hard drive with > 7500 BTC on it since that's only worth $30; but by the time 7500 BTC > is worth $150M, maybe you take a bit more care with that, but are still > not too worried if you lose 1.5mBTC, since that's also only worth $30. > > To mathematise that, perhaps there are K people holding Bitcoin, and with > probability p, each loses $100 (in constant 2009 dollars say, so that we > can ignore inflation) of that Bitcoin a year through carelessness. For > an equilibrium to occur in that case, you need: > > N(t) + k - (100/P * Kp) = N(t) > > where P is the price of Bitcoin (again in constant 2009 dollars) and k > is Peter's fixed tail subsidy. Simplifying gives: > > P = K * 100p/k > > But k and p are constant by assumption in this scenario, so equilibrium > is reached only if price (P) is exactly proportional to number of > users (K). That requires you to have a non-inflationary currency > (supply is constant) with constant adoption (assume K doesn't change) > that maintains a constant price (P=K*100p/k) in real terms even if the > economy is otherwise expanding or contracting. > > More importantly, just from a goals point of view, x is something we > should be finding ways to minimise it over time, not leave constant. > In fact, you could argue for an even stronger goal: "the real value held > in BTC lost each year should decrease", that is, x should be decreasing > faster than 1/(N(t)*P). > > Cheers, > aj > > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists•linuxfoundation•org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >
I think the discussion has some anecdotic interest but has zero relevance as far as any decision making is concerned.
Any extension of block rewards after the current deadline should only be done if and only if the community agrees that it is the only way to keep the network secure.
The fact that a mild inflation is sometimes compensated by coin loss is like a bonus.
On Mon, Jul 11, 2022, 11:56 AM Stefan Richter via bitcoin-dev < bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (105 lines)
> I very much agree with AJ here. This is something I remember discussing on > Bitcointalk back in 2011: I find it highly intuitive that the amount of > lost coins is not a constant fraction of the supply, because people get > better at keeping their coins with increasing value, distribution and > technology/best practices. I also think that we have observed this effect > in practice since then. The bulk of coins that are supposed to be lost (via > onchain analysis) haven't been moved since at least 2010. Of course, in > most cases, we'll never know, but the assumption of constant loss rate > seems unreasonable. > > Cheers > Stefan > > Anthony Towns via bitcoin-dev <bitcoin-dev@lists•linuxfoundation•org> > schrieb am Mo., 11. Juli 2022, 04:32: > >> On Sat, Jul 09, 2022 at 08:46:47AM -0400, Peter Todd via bitcoin-dev >> wrote: >> > title: "Surprisingly, Tail Emission Is Not Inflationary" >> >> > Of course, this isn't realistic as coins are constantly being lost due >> to >> > deaths, forgotten passphrases, boating accidents, etc. These losses are >> > independent: >> >> This isn't necessarily true: if the losses are due to a common cause, >> then they'll be heavily correlated rather than independent; for example >> losses could be caused by a bug in a popular wallet/exchange software >> that sends funds to invalid addresses, or by a war or natural disaster >> that damages key storage hardware. They're also not independent over >> time -- people improve their key storage habits over time; eg switching >> to less buggy wallets/exchanges, validating addresses before using them, >> using distributed multisig to prevent a localised disaster from being >> catastrophic. >> >> > the *rate* of coin loss at time $$t$$ is >> > proportional to the total supply *at that moment* in time. >> >> This is the key assumption that produces the claimed result. >> >> If you're losing a constant fraction, x (Peter's \lambda), of Bitcoins >> each year, then as soon as the supply increases enough that the constant >> reward, k, corresponds to the constant fraction, ie k = x*N(t), then >> you've hit an equilibrium. (Likewise if you're losing more than you're >> increasing -- you just need to wait until N(t) decreases enough that you >> reach the same equilibrium point) You don't really need any fancy maths. >> >> But that assumption doesn't need to be true; coins could primarily be >> lost in "black swan" events (due to bugs, wars or disasters) rather >> than at a predictable rate -- with actions taken thereafter such that >> the same event repeating is no longer the same level of catastrophe, >> but instead another new black swan event is required to maintain the same >> loss rate. If that's the case, then the rate at which funds are lost will >> vary chaotically, leading to "inflationary" periods in between events, >> and comparatively strong deflationary shocks when these events occur. >> >> Alternatively, losses could be at a predictable rate that's entirely >> different to the one Peter assumes. >> >> One alternative predictable rate that seems plausible to me is if funds >> are lost due to people not be careful about losing small amounts; even >> though they are careful when amounts are larger. So when 10k BTC was >> worth $40, maybe it doesn't matter if you misplace a hard drive with >> 7500 BTC on it since that's only worth $30; but by the time 7500 BTC >> is worth $150M, maybe you take a bit more care with that, but are still >> not too worried if you lose 1.5mBTC, since that's also only worth $30. >> >> To mathematise that, perhaps there are K people holding Bitcoin, and with >> probability p, each loses $100 (in constant 2009 dollars say, so that we >> can ignore inflation) of that Bitcoin a year through carelessness. For >> an equilibrium to occur in that case, you need: >> >> N(t) + k - (100/P * Kp) = N(t) >> >> where P is the price of Bitcoin (again in constant 2009 dollars) and k >> is Peter's fixed tail subsidy. Simplifying gives: >> >> P = K * 100p/k >> >> But k and p are constant by assumption in this scenario, so equilibrium >> is reached only if price (P) is exactly proportional to number of >> users (K). That requires you to have a non-inflationary currency >> (supply is constant) with constant adoption (assume K doesn't change) >> that maintains a constant price (P=K*100p/k) in real terms even if the >> economy is otherwise expanding or contracting. >> >> More importantly, just from a goals point of view, x is something we >> should be finding ways to minimise it over time, not leave constant. >> In fact, you could argue for an even stronger goal: "the real value held >> in BTC lost each year should decrease", that is, x should be decreasing >> faster than 1/(N(t)*P). >> >> Cheers, >> aj >> >> _______________________________________________ >> bitcoin-dev mailing list >> bitcoin-dev@lists•linuxfoundation•org >> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >> > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists•linuxfoundation•org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >
Quoted text (5 lines)
> > > Alternatively, losses could be at a predictable rate that's entirely > different to the one Peter assumes. >
No, peter only assumes that there *is* a rate.
Regardless of what the rate is, if it is any value for which there exists *any fixed central tendency*, tail emission is *evenually* non inflationary.
But you are correct about the other two things:
1. If people are improving custody faster than 1/(N(t)*P) than tail emission can still be inflationary. This seems far-fetched, imo.
2. The rate will be somewhat stochastic ("black swan envets"). Plausible (popular wallet loses keys in coding error), but also... "true no matter what". And not really relevant to tail-emission being non-inflationary. Over a long enough time period, even these events can be factored into a fixed central tendency. Even if it's 100 years, etc.
On Mon, Jul 11, 2022 at 12:32:47PM +1000, Anthony Towns wrote:
Quoted text (9 lines)
> This isn't necessarily true: if the losses are due to a common cause, > then they'll be heavily correlated rather than independent; for example > losses could be caused by a bug in a popular wallet/exchange software > that sends funds to invalid addresses, or by a war or natural disaster > that damages key storage hardware. They're also not independent over > time -- people improve their key storage habits over time; eg switching > to less buggy wallets/exchanges, validating addresses before using them, > using distributed multisig to prevent a localised disaster from being > catastrophic.
People clearly continue to make downright irrational decisions about coin security, doing things putting their entire crypto savings at risk for claimed 5% returns.
Even if people were rational, the coin loss rate would clearly reach a floor because as the probability of coin loss goes down, bothering to spend extra effort to decrease that already small chance is pointless. You mentioning black swan events actually strengthens my point: at low coin loss rates the true loss rate is dominated by black swan events. So it's pointless to go to extra effort to prevent them.
Finally, you're forgetting that coin loss also includes *intentional* losses from proof-of-sacrifice protocols. There are a number of examples on Bitcoin. Again, they put a floor on how much coin loss could diminish.
Quoted text (3 lines)
> loss rate. If that's the case, then the rate at which funds are lost will > vary chaotically, leading to "inflationary" periods in between events, > and comparatively strong deflationary shocks when these events occur.
Give me an example of an *actual* inflation rate you expect to see, given a disaster of a given magnitude.
If you actually do the numbers on this, you'll realize it takes absolutely catastrophic black swan events that make WW2 look like a minor conflict to make even insignificant inflation rate changes due to changes in lost coins.
On Mon, Jul 11, 2022 at 10:00 AM Peter Todd via bitcoin-dev < bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (6 lines)
> > If you actually do the numbers on this, you'll realize it takes absolutely > catastrophic black swan events that make WW2 look like a minor conflict to > make > even insignificant inflation rate changes due to changes in lost coins. >
That somewhat depends on what you mean by 'significant' and 'catastrophic' but I believe the way the model goes is that if X% of coins are lost that means that the value of all outstanding coins will go up by X%, and if the rate of breakage goes from Y% annually to Y*Z% annually then the value of all coins will go up by a factor of Z. This is of course an idealized model in steady state, but gives some idea of scale.
On Sun, Jul 10, 2022 at 3:05 AM vjudeu via bitcoin-dev <bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (11 lines)
> > Not really, because people that run full nodes, just accepted Segwit > and Taproot. They had no choice. And in case of zero satoshis, it could > be the same: you would see zero if you look at raw bytes, but you will > see non-zero values, if you use some upgraded client, that will support > amount hiding, or other features. > > Segwit: old nodes see no new signatures, new nodes see all signatures > Zero satoshis: old nodes see new zero amounts, new nodes see all amounts > > It is that simple.
I see what you mean, have the P2P messages depend on whether the peer is running old code (doesn't know about tail emission) or new code (does know about it).
I don't think this can work in this case. It worked for Segwit because the P2P differences involved only signatures (which determine whether the transaction is valid), not the *effect* of the transaction, that is, how it changes the UTXO set. Consensus requires all nodes to always agree on the UTXO set.
Larry Ruane
I believe it's foolish to attempt objective definitions of things that we define collectively, like "Bitcoin." The best any one of us can do is to be consistent with a subjective personal definition. I believe most people do that with the term "Bitcoin" and that the capped supply is intrinsic to their subjective definitions. It is to mine. Leading bodies, such as the Bitcoin core team, the Ethereum foundation, and every government, are constantly in danger of confusing objective reality with their own decisions. Since people have autonomy, the best a leading body can do is recommend their decisions. The common error is one made by governments, where they react violently to defiance of the definitions they make. Shadows of that error show up in nongovernmental leading bodies as ostracism, criticism, and even sometimes illegal activity against such defiance of decisions. What I mean here is that John is right in a sense (" removing this limit results in something that can no longer be called Bitcoin. "), but I don't think the way he expressed it is as helpful as it could be. There are many who will not call it Bitcoin, and I am among them.
On Sat, Jul 9, 2022 at 8:13 AM Peter Todd via bitcoin-dev < bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (54 lines)
> On Sat, Jul 09, 2022 at 04:57:57PM +0200, John Tromp via bitcoin-dev wrote: > > > New blog post: > > > > https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary > > > > A Tail Emission is best described as disinflationary; the yearly > > supply inflation steadily decreases toward zero. > > _Apparently_ inflation. True monetary inflation includes lost coins - both > intentionally and accidentally lost. It's quite possible that even with > tail > emission Monero is currently a monetarily deflationary coin, as the lost > coin > rate might be higher than the 0.8% apparent tail emission rate. > > We just don't know. Doubly so in the case of monero where its privacy > features > hide coin activity. > > > > If an existing coin decides to implement tail emission as a means to > fund security, choosing an appropriate emission rate is simple: decide on > the maximum amount of inflation you are willing to have in the worst case, > and set the tail emission accordingly. > > > > Any coin without a premine starts with infinite inflation. Bitcoin in > > its first 4 years had yearly inflation rates of inf, 100%, 50%, and > > 33%. So deciding on a maximum amount of inflation is deciding on a > > premine. > > Hence why I specified an *existing* coin. > > > While in the long term, a capped supply doesn't meaningfully differ > > from un uncapped supply [1], the 21M limit is central to Bitcoin's > > identity, and removing this limit results in something that can no > > longer be called Bitcoin. > > Personally I think basing your identity on a technical point that isn't > even > correct is stupid. And I suspect than when push comes to shove, if in ~10 > years > or whatever Bitcoin turns out to be unstable without a reward, the market > as a > whole will be happy to redefine Bitcoin to remove the 21M limit. Whether > or not > it can do that fast enough to avoid Bitcoin dying first is an open > question. > > -- > https://petertodd.org 'peter'[:-1]@petertodd.org > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists•linuxfoundation•org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >
On Mon, Jul 11, 2022 at 08:56:04AM -0400, Erik Aronesty via bitcoin-dev wrote:
Quoted text (3 lines)
> > Alternatively, losses could be at a predictable rate that's entirely > > different to the one Peter assumes. > No, peter only assumes that there *is* a rate.
No, he assumes it's a constant rate. His integration step gives a different result if lambda changes with t: https://www.wolframalpha.com/input?i=dN%2Fdt+%3D+k+-+lambda%28t%29*N
On Mon, Jul 11, 2022 at 12:59:53PM -0400, Peter Todd via bitcoin-dev wrote:
Quoted text (2 lines)
> Give me an example of an *actual* inflation rate you expect to see, given a > disaster of a given magnitude.
All I was doing was saying your proof is incorrect (or, rather, relies on a highly unrealistic assumption), since I hadn't seen anybody else point that out already.
But even if the proof were correct, I don't think it provides a useful mechanism (since there's no reason to think miners gaining all the coins lost in a year will be sufficient for anything), and I don't really think the "security budget" framework (ie, that the percentage of total supply given to miners each year is what's important for security) you're implicitly relying on is particularly meaningful.
So no, not particularly interested in diving into it any deeper.
Cheers, aj
Rather than get bogged down discussing the technical details of how such a change could even take place, I'll go ahead and say that modifying the 21M cap is a supremely reckless idea. Your mathematical proof aside, the idea rests on the unprovable premise that people will keep losing coins indefinitely. You could also argue that once Bitcoin is valuable or widespread enough, it'll incentivize the creation of superior storage, custody and inheritance solutions. One could also write a bunch of "proofs" to support that, but it doesn't mean much when the core idea remains purely in the hypothetical sphere.
One of Bitcoin's value propositions is having a fixed supply cap with a predictable issuance curve. People bought into Bitcoin because it promises to NOT be fiat and because it promises NOT to do what central banks are doing. The moment you start messing with that, it'll invite people to try to tinker with the protocol whenever "security" concerns demand it. Once a powerful enough adversary sees that Overton window moving, they'll probably throw everything they have at this particular weakness in an attempt to subvert the protocol further.
Alfred
Quoted text (1 line)
> your proof is incorrect (or, rather, relies on a highly unrealistic
assumption)
The assumption that coin are lost ar a constant rate is not required. Tail emission will asymptotically decrease the rate of inflation to zero, at which point the increase in coin exactly matches the amount of coin lost. The rate at which coin are lost is irrelevant.
This is easy to see. Consider no coin are ever lost. The rate of inflation will slowly decline to zero as the amount of coin grows to infinity. However, lost coin ensures that the point at which the rate of inflation becomes zero will be reached sooner.
If a black swan event destroys 90% of all coin, the constant tail emission will instantly begin to inflate the supply at a 10x higher percentage. The inflation expressed as a percentage will also immediately start to decline because each new coin will inflate the total supply with a slightly smaller percentage than the previous new coin. The rate of inflation will continue to decline until zero, at which point it again matches the coin-loss induced deflation rate.
Another scenario. Suppose that the number of coin lost becomes significantly less for instance because better wallets and a more mature ecosystem prevent many common coin loss events. A constant issuance of new coin would increase the total supply, but each new coin would add less to the total supply when expressed as a percentage. The rate of inflation would decline to zero, at which point it again has matched the rate of deflation due to coin loss.
Even when the rate at which coin are lost will not be constant, a tail emission will tend to an equilibrium.
It must be observed that tail emission causes the total *potential* supply to vary greatly depending on the deflation rate. In a low-deflation scenario, the supply will have to grow much larger before an equilibrium can be reached than in a scenario with moderate deflation rate. Not being able to predict the ultimate total supply of coin is however seems undesirable. But is it really?
The rate of inflation required for keeping Bitcoin useful highly depends on the value of the token. At US$100k, a tail emission of 1 BTC per block ensures safety within a few blocks for even large amounts. Continuing this example, 1 BTC per block would mean 5.25m extra coin per 100 years. At 21m coins and 1 BTC perpetual reward per block, the rate of inflation would be 0.25% per year.
This should put things a bit into perspective.
On Tue, 12 Jul 2022 at 01:58, Anthony Towns via bitcoin-dev < bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (36 lines)
> On Mon, Jul 11, 2022 at 08:56:04AM -0400, Erik Aronesty via bitcoin-dev > wrote: > > > Alternatively, losses could be at a predictable rate that's entirely > > > different to the one Peter assumes. > > No, peter only assumes that there *is* a rate. > > No, he assumes it's a constant rate. His integration step gives a > different result if lambda changes with t: > https://www.wolframalpha.com/input?i=dN%2Fdt+%3D+k+-+lambda%28t%29*N > > On Mon, Jul 11, 2022 at 12:59:53PM -0400, Peter Todd via bitcoin-dev wrote: > > Give me an example of an *actual* inflation rate you expect to see, > given a > > disaster of a given magnitude. > > All I was doing was saying your proof is incorrect (or, rather, relies > on a highly unrealistic assumption), since I hadn't seen anybody else > point that out already. > > But even if the proof were correct, I don't think it provides a useful > mechanism (since there's no reason to think miners gaining all the coins > lost in a year will be sufficient for anything), and I don't really > think the "security budget" framework (ie, that the percentage of total > supply given to miners each year is what's important for security) > you're implicitly relying on is particularly meaningful. > > So no, not particularly interested in diving into it any deeper. > > Cheers, > aj > > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists•linuxfoundation•org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >