Re: [bitcoin-dev] Surprisingly, Tail Emission Is Not Inflationary

From: vjudeu@gazeta•pl
To: "Peter Todd <pete@petertodd•org>,
	Bitcoin Protocol Discussion"
	<bitcoin-dev@lists•linuxfoundation.org>,
	bitcoin-dev@lists•linuxfoundation.org
Subject: Re: [bitcoin-dev] Surprisingly, Tail Emission Is Not Inflationary
Date: Sun, 10 Jul 2022 09:08:49 +0200	[thread overview]
Message-ID: <165002130-e93e1ef73ec867025cbf3ea9b2d142bc@pmq2v.m5r2.onet> (raw)
In-Reply-To: <Ysl4t9K8lfxRSsNM@petertodd.org>

> Adding tail emission to Bitcoin would be a hard fork: a incompatible rule change that existing Bitcoin nodes would reject as invalid.

It won't, because we have zero satoshis. That means, it is possible to create any backward-compatible way of storing amounts. And if we will ever implement things like hiding amounts, then using zero would be a good way to maintain this backward compatibility.

> Ultimately, as long as a substantial fraction of the Bitcoin community continue to run full nodes, the only way tail emission could ever be added to Bitcoin is by convincing that same community that it is a good idea.

Not really, because people that run full nodes, just accepted Segwit and Taproot. They had no choice. And in case of zero satoshis, it could be the same: you would see zero if you look at raw bytes, but you will see non-zero values, if you use some upgraded client, that will support amount hiding, or other features.

Segwit: old nodes see no new signatures, new nodes see all signatures
Zero satoshis: old nodes see new zero amounts, new nodes see all amounts

It is that simple.

On 2022-07-09 14:47:14 user Peter Todd via bitcoin-dev <bitcoin-dev@lists•linuxfoundation.org> wrote:
> New blog post:

https://petertodd.org/2022/surprisingly-tail-emission-is-not-inflationary

tl;dr: Due to lost coins, a tail emission/fixed reward actually results in a
stable money supply. Not an (monetarily) inflationary supply.

...and for the purposes of reply/discussion, attached is the article itself in
markdown format:

---
layout: post
title:  "Surprisingly, Tail Emission Is Not Inflationary"
date:   2022-07-09
tags:
- bitcoin
- monero
---

At present, all notable proof-of-work currencies reward miners with both a block
reward, and transaction fees. With most currencies (including Bitcoin) phasing
out block rewards over time. However in no currency have transaction fees
consistently been more than 5% to 10% of the total mining
reward[^fee-in-reward], with the exception of Ethereum, from June 2020 to Aug 2021.
To date no proof-of-work currency has ever operated solely on transaction
fees[^pow-tweet], and academic analysis has found that in this condition block
generation is unstable.[^instability-without-block-reward] To paraphrase Andrew
Poelstra, it's a scary phase change that no other coin has gone through.[^apoelstra-quote]

[^pow-tweet]: [I asked on Twitter](https://twitter.com/peterktodd/status/1543231264597090304) and no-one replied with counter-examples.

[^fee-in-reward]: [Average Fee Percentage in Total Block Reward](https://bitinfocharts.com/comparison/fee_to_reward-btc-eth-bch-ltc-doge-xmr-bsv-dash-zec.html#alltime)

[^instability-without-block-reward]: [On the Instability of Bitcoin Without the Block Reward](https://www.cs.princeton.edu/~arvindn/publications/mining_CCS.pdf)

[^apoelstra-quote]: [From a panel at TABConf 2021](https://twitter.com/peterktodd/status/1457066946898317316)

Monero has chosen to implement what they call [tail
emission](https://www.getmonero.org/resources/moneropedia/tail-emission.html):
a fixed reward per block that continues indefinitely. Dogecoin also has a fixed
reward, which they widely - and incorrectly - refer to as an "abundant" supply[^dogecoin-abundant].

[^dogecoin-abundant]: Googling "dogecoin abundant" returns dozens of hits.

This article will show that a fixed block reward does **not** lead to an
abundant supply. In fact, due to the inevitability of lost coins, a fixed
reward converges to a **stable** monetary supply that is neither inflationary
nor deflationary, with the total supply proportional to rate of tail emission
and probability of coin loss.

Credit where credit is due: after writing the bulk of this article I found out
that Monero developer [smooth_xmr](https://www.reddit.com/user/smooth_xmr/)
also observed that tail emission results in a stable coin supply
[a few years ago](https://www.reddit.com/r/Monero/comments/4z0azk/maam_28_monero_ask_anything_monday/d6sixyi/).
There's probably others too: it's a pretty obvious result.

<div markdown="1" class="post-toc">
# Contents
{:.no_toc}
0. TOC
{:toc}
</div>

## Modeling the Fixed-Reward Monetary Supply

Since the number of blocks is large, we can model the monetary supply as a
continuous function $$N(t)$$, where $$t$$ is a given moment in time. If the
block reward is fixed we can model the reward as a slope $$k$$ added to an
initial supply $$N_0$$:

$$
N(t) = N_0 + kt
$$

Of course, this isn't realistic as coins are constantly being lost due to
deaths, forgotten passphrases, boating accidents, etc. These losses are
independent: I'm not any more or less likely to forget my passphrase because
you recently lost your coins in a boating accident — an accident I probably
don't even know happened. Since the number of individual coins (and their
owners) is large — as with the number of blocks — we can model this loss as
though it happens continuously.

Since coins can only be lost once, the *rate* of coin loss at time $$t$$ is
proportional to the total supply *at that moment* in time. So let's look at the
*first derivative* of our fixed-reward coin supply:

$$
\frac{dN(t)}{dt} = k
$$

...and subtract from it the lost coins, using $$\lambda$$ as our [coin loss
constant](https://en.wikipedia.org/wiki/Exponential_decay):

$$
\frac{dN(t)}{dt} = k - \lambda N(t)
$$

That's a first-order differential equation, which can be easily solved with
separation of variables to get:

$$
N(t) = \frac{k}{\lambda} - Ce^{-\lambda t}
$$

To remove the integration constant $$C$$, let's look at $$t = 0$$, where the
coin supply is $$N_0$$:

$$
\begin{align}
    N_0 &= \frac{k}{\lambda} - Ce^{-\lambda 0} = \frac{k}{\lambda} - C \\
      C &= \frac{k}{\lambda} - N_0
\end{align}
$$

Thus:

$$
\begin{align}
    N(t) &= \frac{k}{\lambda} - \left(\frac{k}{\lambda} - N_0 \right)e^{-\lambda t} \\
         &= \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} \right)e^{-\lambda t}
\end{align}
$$

## Long Term Coin Supply

It's easy to see that in the long run, the second half of the coin supply
equation goes to zero because $$\lim_{t \to \infty} e^{-\lambda t} = 0$$:

$$
\begin{align}
    \lim_{t \to \infty} N(t) &= \lim_{t \to \infty} \left[ \frac{k}{\lambda} + \left(N_0 - \frac{k}{\lambda} \right)e^{-\lambda t} \right ] = \frac{k}{\lambda} \\
                   N(\infty) &= \frac{k}{\lambda}
\end{align}
$$

An intuitive explanation for this result is that in the long run, the initial
supply $$N_0$$ doesn't matter, because approximately all of those coins will
eventually be lost. Thus in the long run, the coin supply will converge towards
$$\frac{k}{\lambda}$$, the point where coins are created just as fast as they
are lost.

## Short Term Dynamics and Economic Considerations

Of course, the intuitive explanation for why supply converges to
$$\frac{k}{\lambda}$$, also tells us that supply must converge fairly slowly:
if 1% of something is lost per year, after 100 years 37% of the initial supply
remains. It's not clear what the rate of lost coins actually is in a mature,
valuable, coin. But 1%/year is likely to be a good guess — quite possibly less.

In the case of Monero, they've introduced tail emission at a point where it
represents a 0.9% apparent monetary inflation rate[^p2pool-tail]. Since the number of
previously lost coins, and the current rate of coin loss, is
unknown[^unknowable] it's not possible to know exactly what the true monetary
inflation rate is right now. But regardless, the rate will only converge
towards zero going forward.

[^unknowable]: Being a privacy coin with [shielded amounts](https://localmonero.co/blocks/richlist), it's not even possible to get an estimate of the total amount of XMR in active circulation.

[^p2pool-tail]: P2Pool operates [a page with real-time date figures](https://p2pool.io/tail.html).

If an existing coin decides to implement tail emission as a means to fund
security, choosing an appropriate emission rate is simple: decide on the
maximum amount of inflation you are willing to have in the worst case, and set
the tail emission accordingly. In reality monetary inflation will be even lower
on day zero due to lost coins, and in the long run, it will converge towards
zero.

The fact is, economic volatility dwarfs the effect of small amounts of
inflation. Even a 0.5% inflation rate over 50 years only leads to a 22% drop.
Meanwhile at the time of writing, Bitcoin has dropped 36% in the past year, and
gained 993% over the past 5 years. While this discussion is a nice excuse to
use some mildly interesting math, in the end it's totally pedantic.

## Could Bitcoin Add Tail Emission?

...and why could Monero?

Adding tail emission to Bitcoin would be a hard fork: a incompatible rule
change that existing Bitcoin nodes would reject as invalid. While Monero was
able to get sufficiently broad consensus in the community to implement tail
emission, it's unclear at best if it would ever be possible to achieve that for
the much larger[^btc-vs-xmr-market-cap] Bitcoin. Additionally, Monero has a
culture of frequent hard forks that simply does not exist in Bitcoin.

[^btc-vs-xmr-market-cap]: [As of writing](https://web.archive.org/web/20220708143920/https://www.coingecko.com/), the apparent market cap of Bitcoin is $409 billion, almost 200x larger than Monero's $2.3 billion.

Ultimately, as long as a substantial fraction of the Bitcoin community continue
to run full nodes, the only way tail emission could ever be added to Bitcoin is
by convincing that same community that it is a good idea.

## Footnotes
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev@lists•linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev