Hi Jeremy, Thanks for the reply. I do find the semantics of mempool and block org interesting (although there's a lot on the topic I don't know). > E.g., suppose: > > Block N: Fees = 10, reward = 1 > > Mempool: Fees = 2 > > Mining block N+1 with the mempool leads to reward 2+1 = 3, reorging > leads to reward of up to 10 + 1 + c, (c < 2, where c is the extra > transactions that fit). If I'm reading this correctly, Block N was already mined, but the miner who mined block N+1 repacks the transactions from block N because they have more to gain. Wouldn't such a situation be resolved in the same way as two miners who find a block at a similar time? E.g the network will choose depending on when block N+2 is created. > Assume instead your reward is 8, leaving 3+c on the table. Mining block N+1 with the mempool leads to reward 2+8 = 10, reorging leads to 10 + 8 + c? Wouldn't that leave 8+c? > If you assume all other miners are tip miners, and there are two > conflicting tips, they should pick the one with the more profit for > them, which is the new one you made as a non-tip miner since you > "shared" some fee. I'm curious how the "fee sharing" would be organized. To see if I understand, You're asking what would happen if one of the two miners incentives (bribes in this case) the next miner (block N+1) to choose one of the competing tip miners? > You aren't particularly more likely to remine block N or N+1, before > someone builds on it, as opposed to deeper reorgs (which require > larger incentive). Agree. > However, as many have pointed out, perhaps not following the simple > "honest tip mining" strategy is bad for bitcoin, so maybe we should > expect it not to happen often? The idea that people won't do something because it's "bad for Bitcoin" doesn't fit an adversarial model. Even in the above examples (which I think wouldn't expect to happen often), I would argue the network still conforms to a Nash Equilibrium without requiring trust. Although It's mostly speculation without some empirical data. Cheers, -Yancy On 2022-10-17 21:10, Jeremy Rubin wrote: > Building on the most work chain is perhaps not rational in many normal > circumstances that can come up today under the stated reference > strategy: > > 1) Take highest paying transactions that fit > 2) Mine on tips > > E.g., suppose: > > Block N: Fees = 10, reward = 1 > > Mempool: Fees = 2 > > Mining block N+1 with the mempool leads to reward 2+1 = 3, reorging > leads to reward of up to 10 + 1 + c, (c < 2, where c is the extra > transactions that fit). Assume instead your reward is 8, leaving 3+c > on the table. > > If you assume all other miners are tip miners, and there are two > conflicting tips, they should pick the one with the more profit for > them, which is the new one you made as a non-tip miner since you > "shared" some fee. > > You aren't particularly more likely to remine block N or N+1, before > someone builds on it, as opposed to deeper reorgs (which require > larger incentive). > > However, as many have pointed out, perhaps not following the simple > "honest tip mining" strategy is bad for bitcoin, so maybe we should > expect it not to happen often? Or other strategies to emerge around > selecting transactions so that the next M blocks have a similar fee > profile, as opposed to picking greedily for the next block. > > -- > @JeremyRubin [1 [1]] > > On Sun, Oct 16, 2022 at 3:03 PM wrote: > > The proof-of-work also solves the problem of determining > representation in majority decision > making. If the majority were based on one-IP-address-one-vote, it > could be subverted by anyone > able to allocate many IPs. Proof-of-work is essentially > one-CPU-one-vote. The majority > decision is represented by the longest chain, which has the > greatest > proof-of-work effort invested > in it. If a majority of CPU power is controlled by honest nodes, > the > honest chain will grow the > fastest and outpace any competing chains. To modify a past block, > an > attacker would have to > redo the proof-of-work of the block and all blocks after it and > then > catch up with and surpass the > work of the honest nodes. We will show later that the probability > of a > slower attacker catching up > diminishes exponentially as subsequent blocks are added. > It's interesting that Nash Equilibrium isn't mentioned here. Since > each miner has the option to either contribute to the longest chain > or not, even if the miners know what strategy the other miners will > use, they still wouldn't change their decision to contribute to the > majority. > > For example, if I run a shop that takes rain checks, but I sell an > item to a higher bidder who didn't have a hold on the item, that > is > not honest, but it may be selfish profit maximizing. > It would be honest if the store policy said ahead of time they are > allowed to sell rain checks for more in such an occurrence. > Although this is a good example of the difference between honest and > rational. I think this means it's not a Nash Equilibrium if we > needed to rely on the store owner to be honest. > > Satoshi said an honest majority is required for the chain to be > extended. Honest is not really defined though. Honesty, in my > definition, is that you follow a pre specified rule, rational or > not. > My take is that "rational" is probably a better word than honest. > In terms of a Nash Equilibrium, each participant is simply trying to > maximize their outcome and honesty doesn't matter (only that > participants are rational). > > It seems a lot of the RBF controversy is that Protocol developers > have > aspired to make the honest behavior also be the rational behavior. > This is maybe a good idea because, in theory, if the honest > behavior > is rational then we can make a weaker assumption of selfishness > maximizing a parameter. > I'm curious, can RBF can be described by a Nash Equilibrium? If > yes, then it also shouldn't matter if participants are honest? > > Overall, it might be nice to more tightly document what bitcoins > assumptions are in practice and what those assumptions do in terms > of > properties of Bitcoin, as well as pathways to weakening the > assumptions without compromising the behaviors users expect the > network to have. An "extended white paper" if you will. > White paper 1.1 :D > > A last reflection is that Bitcoin is specified with an honest > majority > assumption, but also has a rational dishonest minority assumption > over > both endogenous (rewards) and exogenous (electricity) costs. > Satoshi > did not suggest, at least as I read it, that Bitcoin works with an > rational majority assumption. (If anyone thinks these three are > similar properties you can make some trivial counterexamples) > My take is the opposite unless I'm missing something. Participants > are always incentivized to choose the rational solution (Not to > waste electricity on a minority chain). > > Cheers, > -Yancy > > On 2022-10-16 19:35, Jeremy Rubin via bitcoin-dev wrote: > > The Bitcoin white paper says: > > The proof-of-work also solves the problem of determining > representation in majority decision > making. If the majority were based on one-IP-address-one-vote, it > could be subverted by anyone > able to allocate many IPs. Proof-of-work is essentially > one-CPU-one-vote. The majority > decision is represented by the longest chain, which has the > greatest > proof-of-work effort invested > in it. If a majority of CPU power is controlled by honest nodes, > the > honest chain will grow the > fastest and outpace any competing chains. To modify a past block, > an > attacker would have to > redo the proof-of-work of the block and all blocks after it and > then > catch up with and surpass the > work of the honest nodes. We will show later that the probability > of a > slower attacker catching up > diminishes exponentially as subsequent blocks are added. > > This, Satoshi (who doesn't really matter anyways I guess?) claimed > that for Bitcoin to function properly you need a majority honest > nodes. > > There are multiple behaviors one can describe as honest, and > economically rational or optimizing is not necessarily rational. > > For example, if I run a shop that takes rain checks, but I sell an > item to a higher bidder who didn't have a hold on the item, that > is > not honest, but it may be selfish profit maximizing. > > Satoshi said an honest majority is required for the chain to be > extended. Honest is not really defined though. Honesty, in my > definition, is that you follow a pre specified rule, rational or > not. > > It seems a lot of the RBF controversy is that Protocol developers > have > aspired to make the honest behavior also be the rational behavior. > This is maybe a good idea because, in theory, if the honest > behavior > is rational then we can make a weaker assumption of selfishness > maximizing a parameter. > > However, Satoshi did not particularly bound what aspects of > honesty > are important for the network, because there isn't a spec defining > exactly what is honest or not. And also as soon as people are > honest, > you can rely on that assumption for good effect. > > And sometimes, defining an honest behavior can be creating a > higher > utility system because most people are "law abiding citizens" who > might not be short term rational. For example, one might expect > that > miners would be interested in making sure lightning closes are > "accurate" because increasing the utility of lightning is good for > Bitcoin, even if it is irrational. > > It seems that the NoRBF crowd want to rely on an honest majority > assumption where the honest behavior is not doing replacement if > not > requested. This is really not much different than trying to close > lightning channels "the right way". > > However, where it may be different, is that even in the presence > of > honest majority, the safety of 0conf isn't assured given the > potential > of race conditions in the mempool. Therefore it's not clear to me > that > 0conf working well is something you can drive from the Honest > Majority > Assumption (where honest includes first seen). > > Overall, it might be nice to more tightly document what bitcoins > assumptions are in practice and what those assumptions do in terms > of > properties of Bitcoin, as well as pathways to weakening the > assumptions without compromising the behaviors users expect the > network to have. An "extended white paper" if you will. > > It's somewhat clear to me that we shouldn't weaken assumptions > that > only seem local to one subsystem of Bitcoin if they end up > destabilizing another system. In particular, things that decrease > "transaction utility" for end users decrease the demand for > transactions which hurts the fee market's longer term viability, > even > if we feel good about making an honest policy assumption into a > self > interested policy assumption. > > A last reflection is that Bitcoin is specified with an honest > majority > assumption, but also has a rational dishonest minority assumption > over > both endogenous (rewards) and exogenous (electricity) costs. > Satoshi > did not suggest, at least as I read it, that Bitcoin works with an > rational majority assumption. (If anyone thinks these three are > similar properties you can make some trivial counterexamples) > > Cheers, > > Jeremy > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists.linuxfoundation.org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev Links: ------ [1] https://twitter.com/JeremyRubin Links: ------ [1] https://twitter.com/JeremyRubin