Zcash & the founder incentive trilemma
Reorganizing the firm presents new principal-agent problems
The Zcash founder’s reward is likely the best founder-alignment mechanism that has been designed in the (brief) history of crypto-networks.
The majority of participants in today’s cryptocurrency ecosystem weren’t around for the initial launch of most of these networks — a time where any project launching without a fair mining process was controversial, before the gold rush of ERC-20 “token generation events.”
The latest round of controversy in this discussion stems from this week’s disclosure from the Zcash Company’s presentation on burn rates and founder’s reward allocations at Zcon0:
As networks start to move away from run by founding teams to “gradually decentralized”, the idea of long-term community and founder incentivization is top-of-mind. Leaving the definition of decentralization to a riveting future SEC case, we can think about the goal of any team working on an open-source crypto-network in simple terms: create a network and community that can grow long after the initial team stops working on the project.
To date, the “founder incentive problem” has operated in a trilemma, trading off between creating a satisfying Gini coefficient at equilibrium, incentivizing the dozens or hundreds of people needed to bring a base layer protocol off the ground, and paving a path to decentralization. This leaves prospective cryptocurrency founders with a few options:
Launch a PoW-based chain that’s “fair mined” from Day 1
Here, at least one open-source client and spec would be released prior to launch, allowing many groups to start mining (and fairly coalesce around one network). Examples of this include Bitcoin, Litecoin, and even Dogecoin. While this has obvious advantages, there are a few unanticipated problems:
- There is a massive initial infrastructural need to secure the network: because of the security risks of launching with a hash function (for which ASICs already exist), there is a large up-front cost associated with this that has to be taken on by a community.
- If the network is secure from Day 1, unless already independently wealthy, it’s unlikely the founder(s) will be able to accumulate enough to sustain prolonged development of the project over time.
Despite the problems noted above, early adopters and founders of these projects have become fabulously wealthy, having had the ability to launch a fair mined token, advantaged by the relative obscurity (and low mining difficulty) of these projects when launched.
Monero, which started as Bitmonero (a Bytecoin fork), fits in this camp as well, with minor taint from the early history of the currency. Given Bytecoin’s poorly-optimized miner, some developers were able to take advantage of this early on. In spite of this, the total amount of XMR mined in this time is far less than Satoshi and Hal’s early bitcoin mining.
Launch a blockchain that has some portion allocated pre-launch
In the early crypto days, there was often no transparency around the amount and issuance of these tokens, often causing any pre-launch token allocation to be the sign of a scam. These issuance models largely take two forms:
- The “pre-mine” — an approach made en vogue by the Ethereum Foundation, in which some portion of tokens are pre-allocated (sold to external investors or reserved for the team prior to launch) by a project. Bitcoin Gold and Decred are both examples of a PoW chain that attempted to align incentives via an early pre-mine. As many of the largest projects in the world are no longer PoW chains, this is a dominant behavior of today (see: distribution of Cardano, most ERC-20 tokens, etc.).
- The “insta-mine” — an even more nefarious launch scheme pioneered by the DASH project. Due to a mining difficulty adjustment issue, over two million coins, representing about 10–15% of total tokens were mined during the first 48 hours of launch, likely by insiders.
The differences between the insta-mine and the pre-mine are purely semantic: both are early allocation schemes that attempt to align incentives for founders by giving them skin-in-the-game. The alternative is founder-as-miner or trader instead of focusing on what matters: technical and community leadership.
While it’s clear in theory that investors want founders to be motivated, in practice, the overwhelming majority of projects have very poor treasury management and often don’t have vesting schedules, leading to mis-alignment and exit scams.
Design a system that rewards founders as the project is developed
When building Zcash, the Zcash Company chose to take a slightly different approach: allocating a portion of issued Zcash to early investors and founders, distributed over the first four years of the project. Historically, they have been very transparent about this process. To summarize, the distribution mechanism is as follows:
- 80% of issued Zcash is rewarded to miners (175,000 ZEC per month).
- 3% is going to the Zcash Foundation (6,563 ZEC per month).
- 2.8% is going to the Zcash Company (6,125 ZEC per month).
- The remaining 14.2% is allocated to 44 employees, advisors, and founders. 0.9%, or 2,033 ZEC per month, is for Zooko (this works out to roughly $4.2M/year based on $170/ZEC). This was the primary point of contention for many people.
The output of the different teams and individual engineers working on Zcash is open-source software and community. There are a few nuances that make the continuous Zcash Company’s founder reward system a significant improvement from the pre/insta-mines specified above:
- The founder’s reward is baked into the protocol, rather than operating in a black box (allocated at the discretion of the founder or team): this allows stakeholders to exit with low friction via soft or hard fork, allowing the community to rally around a chain with an altered (or removed) founder’s reward.
- There is a Zcash Foundation that is governed and operates independent of the Zcash Company — in fact, their budget is derived from donations stemming from the Zcash Co. As Josh Cincinnati has specified:
Having privacy and fungibility technology on a payment system, worldwide, is a net benefit to society. Whether that work comes from zcash or monero or mimblewimble, it doesn’t matter to us in the end which coin has the higher market cap.
The difference between Zcash and other crypto-asset projects is that Zcash is operating at the cutting-edge of cryptography, requiring and producing novel research across zk-SNARKs/STARKs/etc., which is then freely shared with the rest of the ecosystem, including competitors. A point of contention here occasionally pointed out is that perhaps too much is allocated to the scientists, who largely make an up-front contribution to the effort (though the Company and Foundation can and should use their discretion).
Some of the forks of Zcash that have been launched to date have attracted fleeting community attention such as:
- ZClassic (ZCL), which hard forked away the Zcash founder’s reward and and the slow start to the money supply in 2016, ended up becoming an infamous pump-and-dump with the Bitcoin Private (BTCP) airdrop of 2017 (which ironically re-added the founder’s reward).
- ZenCash (ZEN), a 2017 fork of ZClassic, is attempting to layer on a full suite of feature-rich privacy applications (e.g. chat, file storage, etc.) on top of ZClassic. Ironically, their continuous team allocation (8.5%) when combined with their “secure node” allocation (3.5%) is even larger than Zcash’s. Recently, they suffered a 38 block re-org attack with 3 executed double spends.
None of these alternate ZKP-oriented privacy implementations have received meaningful attention from the scientific or cypherpunk community, making it clear that the value of Zcash, appropriated by the founder’s reward, is in the people: Zooko, Ian Miers, Matthew Green, Eli Ben-Sasson, and others are amongst the best cryptographers in the world.
The elegance of Bitcoin is in its simplicity: organic growth over years has led to the ecosystem that we have today. Any project that is attempting to displace Bitcoin is competing on the basis of features, e.g. Turing-complete scripting, fungibility, or stability. Given our limited understanding of these design spaces, the only way to challenge Bitcoin is to centralize, then decentralize.
Creating a “privacy” currency is especially taxing, given all-too-common associations drugs, money laundering, or terrorism. In spite of this, transparent operation and education has led the NYDFS and other authorities to speak positively about Zcash.
The path that Zcash and other next-generation blockchains (Tezos, Dfinity, etc.) have taken is to set up a incentives and off-chain governance processes to align early contributors and help guide the project from infancy to adulthood. While this trades off early on with decentralization, it allows for independence, time, resources to be committed to more intensive research questions.
The beauty of blockchains is that we can see this experimentation in open-source funding in real-time: the One True Cypherpunk Model of immaculate conception (see: Grin or Monero) v. a Zcash’s relatively more centralized start.
Acknowledging the trilemma
The crypto-founder trilemma is just the latest iteration of the long-standing principal-agent problem (explored deeply in managerial research).
Managerial innovations devised over time to align employee and founder incentives include profit sharing (at smaller firms), stock options tied to quarterly performance (at public companies), and vesting schedules (at private companies).
At their foundation, blockchains are a re-invention of the firm and will originate novel (if at times, incorrect) solutions to age old principal-agent problems.
The original trilemma presented between “fairness”, founder motivation, decentralization is a bit of a misnomer — while the topic of fairness and early-adopter holdings are heavily debated now, as an investor, I’m biased towards optimizing around founders and moving to a swift path to decentralization.
A truly decentralized network, with many options for voice (and exit) is the best check on mis-aligned incentives. While the Zcash community seems very much tight-knit and aligned to-date, it remains to be seen what will happen after the planned Sapling network update.
Note: I hold bitcoin, zcash, and monero and am very excited about privacy. My thoughts on these issues have been heavily influenced through conversation with Murad Mahmudov, Alex Hardy, Brendan Bernstein.
