[This post was first published on Medium].
\nThis is part III in a series of posts (which was not intended to be a series) on the consequences of Bitcoin’s declining block rewards to the security of the network.
\nPart I: Bitcoin Security: a Negative Exponential. Tweetstorm.
\nPart II: Bitcoin Security in One Chart. Tweetstorm.
\nIn the first post I argued that the attack cost (and therefore security) of proof-of-work systems like Bitcoin is ultimately determined by miner revenue — the “security budget”.
\nTo illustrate this relationship I used a simplified model-cryptocurrency with constant miner pay-out and no ASICs. I did include a second, shorter example with ASICs, but I didn’t spend much time on it.
\nIt seemed to me that ASICs change the attack cost profile (by “front-loading” attack cost) but that security budget still dominates the attack cost equation — which is all that mattered for my argument.
\nBut, to close out the trilogy I felt I needed to go down this avenue and find out for sure whether attack cost is ultimately determined by security budget — ASICs or no ASICs!
\nSo you want to 51% attack Bitcoin (or any ASIC-mined PoW system). First you need to buy the hardware. How much will that cost?
\nSuppose the network is producing 10TH/s. Worst-case scenario you must also buy 10TH/s worth of hardware, then you have 50% of total hash power. In reality less efficient miners will drop-out as you add hash power and kill their margins, so in the best-case you could buy as little as ~5TH/s.
\nBut we care about cost, not absolute hash power. How do miners decide how much capital should be tied-up in ASICs at any given time?
\nMiners are funded by the income stream that the protocol provides (block rewards + tx fees). They care about the dollar amount of this stream. This is the security budget that I talked about in the previous posts.
\nThe magnitude ($/time) of this stream is determined by coin price, inflation rate, and block space demand. Miners have no impact on the income stream unless they affect the factors mentioned — they simply split the income stream (whatever it is) based on their respective hash power contribution.
\nMiners buy ASICs in order to capture some sliver of the income stream. If they are rational they do not spend more on hardware than the present value of the expected income stream sliver (costs deducted) that they plan to capture with the hardware.
\nNote: These income streams and cost streams are projections into the future. Expected profit from these streams must be heavily discounted to account for various risk-factors and uncertainties (see appendix).
\nThe present value of some income stream can be determined with the… present value equation:
\nVariables: PV is the present value of the income stream. S(t) is the income stream. The limits of integration, O and M, define the time-span, and r is the going interest rate (5% or whatever).
The equation tells how much money you would need now, such that by the end of some period, you were just as well-off as someone who had the income stream — it really does give the present value of the income stream.
\nApplying this equation to the miner situation we get:
\n* Hardware spend is based on a projection of the future. If the projection is wrong miners can over-spend or under-spend on hardware. This uncertainty is factored into spend however, and will tend to smooth out over time. See appendix.
\n** Assuming hardware is upgraded continuously the average unit will be middle-aged, so tH may be too wide — overestimating cost. On the other hand newer units may represent majority hash power, and it’s possible a new hardware release just occurred and most units are very young.
If ASIC advancement plateaus then miners only need to buy hardware once, then can mine forever. tH is then infinite. Does H get huge? Does this break the bound?
No. When tH is infinite the expression converges:
Variables: S*(t) is actual total revenue. t0 is when the attack starts, tA is when the attack ends.
But if the attacker has half the hash power, don’t they get half the revenue — half of S*(t)? If so, honest miners would have half of S*(t) to spend on operations and upgrades. Then the attacker could match their spend with his “attack-income”. Then this whole term would become zero.
I’m not sure how this would actually play out, but I don’t think this income can be counted on, and it doesn’t matter for my argument. So, I’ll assume the attacker gets no income and use the safe upper bound of S*(t).
* It seems unlikely that miners would upgrade hardware while being attacked — difficulty is now much higher, and long-term confidence is low — but I’m assuming worst case for the attacker.
\nCombining the initial hardware investment cost (the first integral) with the operational and upgrade cost (second integral) we get:
\n