Transaction fee market without block size limit

Transaction fee market without block size limit

Abstract . This paper describes how a rational Bitcoin miner should select transactions from his node's memory pool in order to maximize profit when constructing a new block, in the absence of a block size limit. To illustrate, the paper introduces the block space supply curve and the memory pool demand curve. The former describes the cost to a miner of supplying block space after accounting for the risk of orphaning. The latter represents the reward provided by transactions in the memory pool and, by comparison, calculates the minimum block size that needs to be packed to obtain the corresponding reward. The paper explains how the supply and demand curves in traditional economics are related to the derivatives of these two curves, and proves that their intersection indicates the amount of block space produced that maximizes the miner's profit. The paper then describes an unhealthy fee market - in which miners are incentivized to produce arbitrarily large blocks - which cannot exist because it requires extremely fast communication of information. The paper concludes by considering the conditions under which rational miners produce large, small, or empty blocks and estimating the cost of spam attacks.

Keywords

1. Bitcoin 2. Block size limit 3. Transaction fee market 4. Blockchain spam attack

1. Introduction

One of the most pressing rules in the Bitcoin protocol that is being debated (or not) is the block size limit. This rule sets an upper limit on the network’s transaction capacity, or more simply, the number of transactions that can be confirmed per second. Its origins date back to the late summer of 2010, when Satoshi Nakamoto—worried about the potential for spam attacks on the fledgling Bitcoin network—modified the source ^code1 to set a maximum size for new blocks that could be added to the blockchain. The limit was set at 1 megabyte, which roughly corresponds to three transactions per second. While this is very small compared to Visa’s transaction capacity, ² at the time, it was more than 800 times larger than it actually required, ³ and Satoshi Nakamoto said that the limit could be raised in the future when needed.

Between July 8 and July 15, 2015, there was a backlog of more than 60,000 generated transactions to be ^processed5 . Block capacity is close to ^saturation6 , and the user experience is ^poor7 . At the time of writing, transaction frequency is over 300 times higher than when the block size limit was introduced8, ^and scaling is now a serious issue. However, questions have been raised about whether the network can support larger blocks. One particular concern is whether a healthy fee market can be established in which users pay the full fee to post a transaction without a block size limit or when the block size is much larger than the transaction demand. (A healthy fee market is defined in Section 7.) We worry that the failure to establish a healthy fee market would be equivalent to encouraging users to launch spam attacks, leading to a "tragedy of the commons" where the cost of maintaining the network rises dramatically or even out of control. The purpose of this article is to discuss whether a fee market can emerge if miners, rather than protocol rules, limit block size.

Many efforts have been made in this regard. Houy states that if the marginal cost to a miner of adding a transaction to a block is zero, then miners will “[include] all transactions, regardless of the fees attached to them.” He argues that it is necessary to set a minimum fee or to limit the block size. ⁹ Andresen explains, however, that the marginal cost is not zero due to the increased risk of being orphaned; a rational miner should only include transactions that include a fee that is large enough to compensate for the additional risk of being orphaned. ¹⁰ Building on Houy’s work, we take Andresen’s orphan factor into account and show that miners will not include all transactions regardless of the fees. In fact, if the block size is not limited by the protocol (although this assumption is explicitly stated in Section 10), a healthy transaction market is the expected result of rational miner behavior.

In Section 3, we derive the miner profit equation—taking into account orphan risk—a simple model for calculating miner profit per block. We then introduce two new concepts, called the memory pool demand curve and the block space supply curve, in Sections 4 and 5, respectively. We deduce how the demand curve is constructed from transactions in a node's memory pool. We also differentiate miner profits with respect to the block size, set the result to zero, and solve the subsequent differential equation to obtain the supply curve. We find that the cost of supplying block space increases exponentially with the size of the block. We explain that the supply curve is meaningful because it specifies the cost to a miner of producing a given amount of block space. We also introduce the demand curve meaningfully because it captures the maximum fee a miner can receive for producing a block of a particular size.

In Section 6, we visualize the block size that maximizes miner profits using two curves. We also show how these two curves relate to the more familiar supply and demand curves in economics. In Section 7, we show that an unhealthy fee market—one in which miners are incentivized to produce arbitrarily large blocks—is impossible because it requires communicating information over an extremely high bit rate channel, thus violating the Shannon-Hartley ^theorem.11 This result holds whether blocks are broadcast as full blocks or compressed (e.g., using reversible bloom look-up tables). In Section 8, we consider the transaction fee market in more detail; finally, in Section 9, we estimate the cost of a spam attack. Let us begin by defining the notation we use.

2. Symbol list

In the rest of this document, the following symbols have the specified meanings:

3. Miners’ profit equation and the impact of orphan blocks

By mining blocks, miners hope to earn a profit on the hash cost 〈C 〉 for each block, generating revenue 〈V 〉

The pre-computational cost of a miner is equal to the amortized price per hash of his mining hardware, ¹² η, his computing power ℎ, and the length of time he expects to work on a block (usually the block time T). It can be expressed as the following equation:

The expected income of a miner is equal to the amount of the block he mines multiplied by his probability of mining a block. The amount he will earn is the sum of the block reward R and the transaction fee M. Assuming that all blocks are broadcast immediately, his probability of winning is equal to the ratio of his hash rate (ℎ) to the total hash rate of the Bitcoin network (H). Putting it together, his expected income 〈V 〉 = (R+M)h/H.

The problem with this equation is that it doesn't reflect the fact that a miner's chance of success decreases as he broadcasts blocks to other miners more slowly. Even if he is the first miner to find a valid block, his block is likely to be discarded if it is received after most miners have worked on another block. This effect is called an orphan block.

If the added fee income is not enough to offset the increased risk, low-fee transactions will lose their appeal. Taking this effect into account, the miner's expected income equation is greatly discounted due to the risk of orphan blocks. After considering ℙ _orphan , the formula becomes:

Intuitively, if the propagation time is short, the probability of orphaning should be low; if the propagation time is long, it should be high. Based on the fact that block times follow a Poisson distribution, Andresen approximates the probability of orphaning to be ¹⁰ :

Where τ is the time it takes for a block to propagate. Figure 1 shows this effect intuitively. It must be emphasized that τ refers to the total time from when a miner mines a block to when the block has been broadcast to other nodes and accepted. ¹³

By substituting equation (2-4) into equation (1), we can now write the miner's profit formula:

A rational miner chooses the transactions that go into his block in a way that maximizes the expected value of his profit. To better understand how he makes his choices, we will next introduce the concepts of the memory pool demand curve and the block space supply curve.

4. Memory pool demand curve

The memory pool is a set of valid transactions that miners know about but have not yet added to a block. We denote this set as N, where the number of transactions is n. Without a block size limit, miners can freely choose b≤n transactions from N to create a new block ℬ⊂N.

To construct the memory pool demand curve, we first imagine sorting from the maximum fee density (i.e., the transaction fee divided by the number of bytes of the transaction to get the fee per byte) to the minimum, and then arranging them into a list {i ∶ 1,2,…,n− 1,n}. As shown in Figure 2. A triangle represents a transaction, the height of the triangle represents its fee, the width of the triangle represents its size (in bytes), and the slope of the triangle represents its fee density.

As shown in Figure 3, this curve is drawn by stacking the triangles in Figure 2 diagonally. A point on the curve represents the maximum fee a miner can earn by producing a given block space size. This memory pool demand curve helps us simplify the multi-dimensional selection problem into a one-dimensional selection problem.

5. Block space supply curve

The block size a miner chooses to produce determines the transaction fee M(Q) he can get, as well as the risk of propagation time he chooses to take. These variables all affect the expected value of his profit.

For a more detailed study, we define the profit (or loss) gained by a miner from mining an empty block as neutral profit. We can construct a fee curve, M _supply (Q), in the M-plane where all points on the curve _return the neutral profit by requiring that the miner ’s profit ( cf. Eq. 5) remains constant for any block size: :

Formula (6) is an ordinary differential equation, which we explain in the appendix:

in

We call this the block space supply curve. It expresses the costs that miners need to compensate for supplying additional block space (Figure 4); these costs grow exponentially with propagation time. If a block is composed of coordinates above the MQ-curve, the miner has a surplus; otherwise, he is in deficit and would be better off mining an empty block. Let us next consider how he can use this curve and the memory pool demand curve to maximize his profits.

6. Maximizing Miner Profits

To maximize his profit, the miner constructs a memory pool demand curve from the actual transactions pending in his memory pool, and a block space supply curve from empirical data on block propagation latency versus block size (estimated as ). The largest block size, Q ^∗ , represents the point where profit is maximized, i.e., the miner’s surplus, M _demand − M _{supply ,} is the largest (Figure 5a). This is the block size that a rational miner should create.

With a little more work, we can draw a supply and demand curve similar to that in traditional economics. ¹⁴ A traditional supply curve represents the unit price of a good at a certain level of production, Q. However, our analysis so far has considered the price of a full block. Taking the derivative of Q gives the price per byte that a miner pays to produce a given amount of block space. ¹⁵

We can draw a graph similar to the traditional demand curve by differentiating M _demand and Q:

As shown in Figure 5(b), when the miner’s profit is maximized, the block size Q ^∗ appears at

We can

As a differential curve, M _supply and M _demand as integral curves. Both are useful. With these results in hand, let us now consider the conditions under which a healthy fee market emerges.

7. Conditions of the health fee market

For the Bitcoin fee market, we considered three market conditions: healthy, unhealthy, and nonexistent. In a healthy fee market, miners’ revenue is maximized given a limited amount of block space (Figure 6a). In an unhealthy market, miners’ revenue grows with block space, so rational miners should produce arbitrarily large blocks (Figure 6b). In a nonexistent market, adding any transaction will cause miners to run a deficit, so miners are better off producing empty blocks. (Figure 6c).

If we assume that block space is a regular commodity that is subject to the laws of the current market (i.e., block space will increase as the price per byte decreases), then we can give more detailed definition conditions for each type of market. Although we cannot prove this, a simple calculation can give a corresponding table of block supply curves and broadcast time for each type of market (Table 1)

As described in Table 1, when the block broadcast time, which grows with the asymptotic growth of blocks, grows slower than log Q , an unhealthy fee market will form. Using real-world evidence, we can show that this is impossible. Next, we exponentially

Substituting Q=0 and expanding it, we get:

The first term represents the latency of the communication channel: for the purposes of this article, it refers to the time it takes to communicate the block headers through the channel.

It has a physical lower bound, where d is the distance over which information is transmitted and c is the speed of light.

The second term, in part, is related to the carrying capacity of the channel and has a lower bound as described by the Shannon-Hartley Theorem ^11. We can see this more clearly with the following setting:

Where γ is the coding gain and C is the channel capacity (in bytes of information per second). The carrying capacity of a communication channel is limited to:

Where B is the bandwidth of the channel, S is the signal power, and N is the noise power of the channel.

The third term is the sum of terms resulting from the first and higher derivatives of Q ^2. In any practical implementation, these terms simply exist because of the messiness of the real world; however, the authors are not aware of any physical reason why they must exist. For the remainder of this article, we assume that these terms are negligible compared to the constants and linear terms, in which case we make approximations.

This equation shows that the additional propagation time is approximately equal to the size of the block produced, divided by the coding gain of the scheme that can transmit the block, divided by the effective capacity of the communication channel. Since neither C nor Q can be infinite, this term cannot be zero. Furthermore, since C is a physical property of the channel, the degree to which transaction information is compressed in the block, there is no reason to support finding a functional relationship between C or Q. This means that there is no physical communication channel whose block propagation time grows asymptotically slower than O(Q) . Because this is faster than the O (log Q ) required to achieve a healthy fee market (assuming R> 0). So an unhealthy fee market is physically impossible.

8. Big blocks, small blocks, and empty blocks

To put numbers to use in our analysis, we express Eq. (8) in terms of coding gain and channel capacity (see Eq. 9)

This equation describes the marginal fee density required for a miner to profitably add another transaction to a block of size Q. Figure 7 (R/T = 25BTC/10min, plotted) illustrates how fee density incentivizes miners to produce large blocks, small blocks, and empty blocks at different block propagation rates. The important relationships to note are: (1) if more transactions bid for block space, fees grow exponentially; (2) fees get cheaper (in bitcoins) as the propagation rate increases. (3) when faced with the minimum fee density, rational miners will produce empty blocks.

Fee density is sensitive to the assumed value of block propagation impedance. Table 2 summarizes four different estimates of propagation impedance and the minimum fee density corresponding to each estimate. In the next section, for each of the four estimates, we calculate the cost of filling a block with 128MB of spam.

9. The cost of dust attacks

We can interpret the block space supply curve as the minimum cost bound that an attacker must bear to produce a large number of blockchain spam attacks. In the case where the attacker is a miner, it represents the risk cost of being orphaned. (For example, one "sticks" ago, he may lose the block reward for spam blocks). In the case where the attacker is not a miner, it represents the minimum fee necessary to induce rational miners to pack large blocks. The spam attack cost (Equations 7 and 9) is equal to:

The cost increases exponentially with the number of junk transactions Q filled into a block. Figure 8 plots the contours for a constant number of junk transactions; it illustrates how the junk transaction attack cost increases as the attacker fills the block with additional transaction data; and how the junk transaction cost decreases as the network connectivity increases. Table 3 lists the estimated junk transaction attack costs and compares them with the minimum fee density calculated in Section 8. According to the exponent in Equation (10), producing a particularly large junk transaction attack block requires the attacker to pay an effective fee that is significantly larger than the minimum fee.

Interestingly, when the block size limit was introduced (September 6, 2010), the 4-week average floating price of Bitcoin was $0.068. The cost of a blockchain spam attack per gigabyte was a few thousand dollars, not the millions of dollars it costs today. Since the cost of a spam attack is measured in Bitcoin, Bitcoin’s high market value is an effective anti-spam measure.

10 Conclusion

We show that if miners add transactions in a way that maximizes their expected profit, a fee market will emerge with no block size limit. The key to establishing this conclusion is to account for the cost to miners of supplying additional block space by taking into account orphan risk. Not surprisingly, we show that the cost of block space is proportional to Bitcoin’s inflation rate, R/T, and the time it takes to deliver each uncompressed megabyte block to other miners, 1/γC. More interestingly, however, we show that the orphan cost is not static, but grows exponentially with block size, Q, and demand:

As Andresen observes, ¹⁰ not only is there a minimum fee density below which rational miners will not add any transactions, but also the required fee density will naturally increase if the space demand within a block increases.21 Indeed, a rational miner will not randomly include all transactions regardless ^of their fees, because urgent and more expensive transactions will inevitably kick out lower-fee transactions. The minimum fee density will grow exponentially with demand. Similarly, an attacker who wishes to produce large blocks with spam transactions—whether the attacker is a miner or a user—must pay an effective fee density far greater than the cost per byte of a moderate amount of block space. A fee market naturally emerges.

We make three important simplifying assumptions in this paper: (1) We assume that the probability of orphaning is characterized by a time parameter. This parameter is the time it takes a miner to broadcast his block and have it accepted by his peers after he has mined it. (2) In Sections 7–9, this time parameter is lower bounded, in part, by the capacity of the channel used to transmit blocks and the coding gain used to compress them, as described in the Shannon–Hartley theorem. And (3) Because of orphaning, we ignore the time cost of miners to include transactions in blocks. These simplifying assumptions make this topic worth further study:

(1) The time it takes to broadcast information to other miners is generally not constant across the network, ²² while the memory pool (the time it takes to package a transaction) is largely the same. This suggests that, assuming equal computational ^costs , miners who can broadcast their blocks faster will earn greater profits. Relatedly, recent evidence also suggests that miners may start mining before fully receiving and validating a new block.23 How do these phenomena affect the current analysis?

(2) Imagine forming a mining coalition, connected to a high-capacity relay channel and committed to standardizing pool policies (to promote dense compression of block proposals). Such a coalition could significantly reduce the time required to broadcast a block to other members. Do we expect such a coalition to form? And what would their effects be?

(3) When a miner confirms a transaction that increases the unspent output value (UTXO) set, it is equivalent to him bearing the cost of storing these new outputs indefinitely in the future with current income. In this case, will a healthy fee market emerge to charge users for the cost of expanding Bitcoin's UTXO set?

It is important to emphasize that the analysis presented in this article will not hold when the block reward drops to 0. This would imply that the block space cost is 0; however, this would also imply that the computational power is 0, which in turn would imply that transactions would never be included, and that no block space would be generated, which is self-contradictory. Fortunately, the prospect of post-block rewards can be explored slowly, and it will take another quarter century before this becomes a reality. Into the distant future, a healthy transaction fee market is expected to exist without a block size limit.

appendix

The blockspace attack curve is derived from the block size function _Msupply ( Q ) , which describes the fees required to exactly compensate for the orphan risk. Mathematically, we require that miners’ profits (see Equation 5) remain constant for any amount of blockspace, Q:

therefore

The equation

(A2) describes the cost of producing block space Q taking into account orphanization risk. For the purpose of this article, it should be interpreted as the time it takes to propagate a block header.

Acknowledgements

The author would like to thank Dr. Christopher E. Wilmer for his corrections and suggestions. The author would also like to thank the many thoughtful people on the Bitcoin forum who helped me build the foundation for this article, as well as the r/bitcoin community for their enthusiasm and encouragement.

appendix:

Please check the original text.

The doc and pdf versions of this article, as well as the pdf version of the original text, have been uploaded to Babbitt Library. You are welcome to download and read. You can also use Baidu Cloud to download: https://pan.baidu.com/s/1bz9kAE Password: e96r