The Parasite and the Whale
There was recently an interesting bunfight on Twitter between Paul Sztorc, author of the Truthcoin paper that laid the ground for Augur and other decentralized oracle designs, and veteran block size hawk Peter Todd.
Paul wants Bitcoin to support drivechains, a kind of second-layer system that pays miners to validate not only the main blockchain, but also a separate blockchain. Peter Todd argues that doing this will undermine the security of the original chain: Miners will be obliged to mine the the drivechain if they want to avoid being out-competed by miner who do, but this will create an obligation on miners — managing systems using large amounts of data — that they fought a bitter block size war to prevent.
Paul responds that this logic holds for anything that leverages a mining business to increase the profitability of the miner — for example, selling t-shirts.
Aside from whether Peter is right about this particular mechanism, the difficulty is that it is impossible to actually prevent other systems from doing this: If it’s in their interests, and the interests of users to use it, we need to act on the assumption that it will happen. Having fought a bitter block size war to prevent bigger miners getting a theoretical advantage over smaller miners, the delicate balance they hoped to establish risks being upset by chains parasiting off the Bitcoin system. Or miners selling t-shirts. And there’s not much Bitcoin users can do about it. Worse, the attempt to create strong bounds on the amount of data miners have to handle may end up having the opposite effect, feeding parasites that do what the host system wouldn’t.
The game outside the game
Bruce Schneier once stumbled on this episode of the gameshow Split or Steal.
The show producers created a game designed to test the participants’ greed and altruism in a classic single-round prisoner’s dilemma. But the market trader subverts it: He commits to pick the “steal” ball — to “defect” — then split the money after the show. Bringing in an action external to the game, he totally changes the other player’s incentives: Instead of having a payoff matrix where greed always gives him a better outcome, he has a payoff matrix where defecting is guaranteed to make him lose, and the only way to have a chance of winning is to cooperate.
The challenge for designers of crypto-economic systems is that there is no possible bound on the actions of players outside the rules of the game.
Indeed, the fact that these are not closed systems is the entire point of the exercise; For a system to create societal change implies that it has impacts outside of itself, wider impacts on society that are not confined to the state of a ledger.
Making friends with your parasites
There is a simple feedback mechanism in Bitcoin that as the value of Bitcoin goes up, the hashrate also goes up. The system’s security budget — the mining reward — increases as the value of the thing that it’s securing increases. But whether this continues to hold depends on how it is used.
The question of what uses can be classed as “parasitical” does not always have obvious answers. In Bitcoin, there was a low-level war about whether the system was intended to be merely financial, or whether it should support other kinds of data. To this day, users are discouraged from posting large amounts of data not only by the standard fees, but also by the isStandard() rules.
Ethereum has its own token, but it is also explicitly designed to support transactions other than those using its native token.
Augur is sometimes described as a prediction market, implying that its goal is to power its own markets. But it is also sometimes described as an oracle system, implying that other contracts should query it. Whether you get welcomed or yelled at for using Augur for data depends which of its developers you talk to.
Although the Bitcoin community has often been opposed to non-financial data, they have tended to be favourable towards layer-2 systems like Lightening.
All these behaviours — whether you consider them parasitic or symbiotic — threaten to reduce the connection between the security budget and the value of the things it secures. It is often hoped that usage will also provide revenue to token holders; Lightening continues to use some on-chain transactions, which it’s hoped will end up in a sweet spot that‘s high enough to fund miners and but low enough to make channel openings and challenges feasible.
But we can imagine the most extreme case where a system may act purely as a game-theoretical last resort that is never actually referred to at all. Imagine a world where no Bitcoin transaction was ever made, and all transactions were made with Lightening or some other off-chain system. A bitcoin like this would not work, at least in the theoretical future where there were no more block rewards, and the system had to be secured purely based on transaction fees. Martin Köppelmann makes that point here:
Augur is unusual in that it actually tries to manage its usage to make sure the cost of attacking it is more than the benefit: It attempts to actively limit the amount of value that can be staked on the system. It does this by keeping track of the money staked on its contracts (“Open Interest”), and the value of its own token. If the amount of ratio of Open Interest to token value increases beyond a security margin, it raises its fees increase the attractiveness of holding the token and discourage people from creating markets.
But as we have seen, when designing an economic game you can’t be sure that all the play will happen inside your game. In Augur’s case, an increase in fees designed to increase the value of the token could result in the exact opposite.
The parasite problem is acknowledged in the Augur whitepaper, which says
In particular, if parasitic markets attract trading interest away from Augur, then Augur’s reporters will receive less in reporting fees. This would put downward pressure on the market cap of REP. If the market cap of REP falls too low, the integrity of the forking protocol is put in jeopardy (Theorem 1). As a result, parasitic markets have the potential to threaten the long term viability of Augur, and should be vehemently opposed.
Our best defense against parasitic markets is to make trading on the Augur platform as cheap as possible (while still maintaining the integrity of the oracle), in order to minimize the reward for running a parasitic market.
Yet its attempt to preserve its security could undermine this defence. If the market cap of REP drops, fees go up to reduce open interest, and users move to a parasitical system. More users moving to parasites in turn reduces the value of REP, further increasing the fees, and driving the system into a death spiral.
Being wrong on purpose
Augur’s market resolution is fundamentally a social process, and reporters might decide to settle markets incorrectly if they see that they are being heavily parasited. But as well as potentially undermining confidence in people using the system as intended, this is liable to cause the most damage to symbiotic uses, and the least to uses that compete directly with Augur markets, and can use the same markets that are being used for Augur-native bets.
As with the bitcoin miner’s t-shirt side-hustle, there is no way to prevent games happening outside your game. Augur could be used as a trust anchor entirely undetectably; A simple parasitical bet contract like this could easily be adapted hash the information about the market that it was using, or even the entire fact that it was settling based on a market. CREATE2 makes this process even cleaner and harder to spot: You can settle based on a call to a contract address, and only deploy that contract if there’s a dispute. If it sounds unlikely that a lot of parasitism would happen like this, bear in mind that in the first large market so far, much of the money staked seems to have come from two high-rollers. Counterfactual betting like this would benefit from both lower fees and greater privacy. This seems attractive to whales even without Augur attempting to price users off itself to maintain its security, and if Augur’s fees become prohibitively expensive, it becomes a no-brainer.
So what should systems do about parasites?
Some Augur proponents have surmised that substantial markets will not be developed to be parasitic, because the strategy is ultimately self-defeating: If by free-riding off a system you ultimately weaken its security, you ultimately destroy your own system. But it is a mistake to look at this from the point of view of the market. You need to think about the incentives of each individual participant in the market. Each individual player is incentivized to do whatever gives them the best experience for the lowest cost, and if they can gain a private benefit while externalizing the cost, they will. This is why train fares are enforced with ticket collectors and turnstiles, instead of asking everyone to chip in to preserve their shared resource.
A variation on this idea is the suggestion that people will refrain from building the technology that enables parasitic behaviour. This also doesn’t seem like a promising solution. It attempts to fight against the tide where building useful blockchain systems is getting progressively easier; With our system, Realitio, a system built to work for a variety of different backstops can be trivially adapted to use Augur, if that’s what users want. And you really don’t want to have to rely on the security assumption that Ethereum developers aren’t going to BUIDL. As blockchain systems move on a trajectory from experimentation towards the mainstream, it is usually better to let things that may stress them stress them early, rather than waiting until there are vast amounts of money on top of them and then breaking.
Paul Sztorc has proposed that a system like Augur is better built on a less flexible platform, which does not, like Ethereum, allow contracts to read data from other contracts. But again, the Golden Balls Rule applies: You can’t prevent people playing games outside your game. In the case of a system built on Bitcoin, there’s nothing to stop an Ethereum contract from reading data and using it for its parasitical markets.
Natural defences: Sex and tokens
Parasitism is endemic in nature. By one estimate parasites outnumber “free-living” organisms by at least 60/40. Both parasites and hosts are constantly adapting, sometimes creating new attacks and new defences and sometimes finding ways to coexist. The antlion gets its nutrients by trapping ants in a pit and sucking out their bodily fluids. The Chalcid wasp falls into the these traps and gets itself captured on purpose so that it can lay eggs on the antlion.
Some insects threatened by parasites speed up their reproductive cycle. It has been suggested that sexual reproduction itself developed as a defence against parasites. Despite billions of dollars invested in blockchain systems, nobody has yet developed one that reproduces sexually. However, you may be able to get similar effects with a hard fork or a redeploy; If you build a parasitical system feeding off a particular contract or proof-of-work chain, your system will break if the users of the host abandon it and move to a new system. But to accomplish this, you need a native token: If Augur users all picked up and decamped to a new contract and left the old one to die, current bettors relying on that system to settle their bets in ETH or DAI would be just as screwed as users of the parasite system. If they were using Augur’s native token, this could be avoided. For crypto-economic systems, native tokens are better than sex.
What do we conclude? Parasitism seems to be a potentially critical threat to crypto-economic systems, it cannot be predicted or reliably designed for, and there is no systematic way to prevent it. However security should degrade gracefully under pressure; Attempts to build in feedback mechanisms to prevent degradation risk failing catastrophically. Micromanaging to preserve security properties is unwise if it risks feeding the parasite that avoids your micromanagement.
Crypto-economic systems need to be robust to changing circumstances. The way a crypto-economic system is used can undermine its security properties, suddenly making something that would be highly secure without a particular usage seriously insecure. Under these conditions it seems wise to vary the kinds of revenue that can be extracted from a system to secure itself. For example, we saw that there was a mode of parasitism that was devastating to a Bitcoin secured purely by transaction fees, but might work well if it was secured by block rewards. Equally, Ethereum could lose currency value, reducing the value of block rewards, but still be a viable system thanks to transaction fees.
It also implies that it is unwise to try set protocols in stone. A strong social aversion to change, while potentially protecting the system against bad social decisions, risks leaving them broken when faced with a new kind of parasite. This will seem like bad news to people sold on the idea of blockchain systems as unbreakable, unchanging monoliths, secured by the immutable laws of mathematics. But if you want your system to be secure, you also need to think about the laws of biology.