The Economic Limits of Bitcoin

Most critiques of Bitcoin center around its failings as a money — specifically, its high volatility and high transaction costs. Eric Budish, of the University of Chicago’s Booth School of Business, has a new NBER working paper that outlines an additional concern with Bitcoin as a long-term system, not directly related to Bitcoin’s qualities as a money, but to the limits placed on Bitcoin’s proof-of-work system.

The cost of the proof of work is a well-understood weakness, especially when considering the energy costs of running the processors. What Budish adds to the discussion is an explicit economic argument for why Bitcoin cannot become highly valuable as a system. 

He combines two straightforward economic points. First, miners of Bitcoin will not make an excess profit in the long run. Second, mining costs must be sufficiently high to prevent a so-called majority attack. These economic points involve two simple equations that lead to a third equation, which Budish argues lies at the heart of Bitcoin’s limits. Let’s unpack each a bit.

First, during each 10-minute block, one Bitcoin miner gets a prize with a value of P_block. This is a flow variable. If there are N units of overall computational power, each unit can expect to win with a probability of1/N. The total expected return is (1/N)*P_block.

There is also a cost of mining. For simplicity, assume it is an energy cost that is constant atcper unit of computational power per block. This is a flow cost of real resources paid by miners.

The lure of profit from mining implies that people will increase the total number of computational units until the expected cost of mining equals the expected return. The zero-profit equation states that P_block = cN. In a world of constant costs, the expected returns from mining are paid in energy.

To this equation Budish adds one on incentive compatibility. Here Budish incorporates the idea that the Bitcoin network becomes vulnerable if a single user controls a majority of the computational units. For the system to avoid a majority attack, it must be in no one’s incentive to control a majority of the computational units.

Suppose the value gained by attacking and manipulating the blockchain is V_attack.There are a variety of ways that attacking the blockchain could be beneficial to an attacker. The important point Budish makes is that V_attack will be larger when the value of the whole Bitcoin system is larger. 

If there are still N computational units running, the attacker needs to control N/2 at a cost of (N/2)*c. For it to not be in anyone’s incentive to attack the system, it must be true that (N/2)*c > V_attack. 

The high cost to any user of attempting to control a majority of computational units is often put forward as one of the benefits of Bitcoin’s system. However, Budish points out that avoiding a majority attack ultimately puts limits on Bitcoin’s use. 

By combining the zero-profit equation with the incentive-compatibility equation, we have P_block > 2 V_attack. The left-hand side of the inequalityis the flow payment paid to miners to maintain the blockchain. The right-hand side is proportional to the value of attacking Bitcoin’s system, which is a stock variable. Therefore P_block puts a cap on the expected value of an attack. Since the value of an attack is related to the value of the whole Bitcoin system, P_blockalso places a cap on the value of the system.

Joshua Gans, who has also written on Bitcoin, called this the “potentially fundamental contradiction at the heart of ‘proof of work’ schemes to support cryptocurrencies.” The system simply cannot become too valuable. If it does, it will trigger an attack, driving back down the value. Bitcoin proponents may be less convinced, but Budish’s paper does point out a tension that must be considered when assessing the long-term sustainability of the system.

Related Articles – Cryptocurrency