Growth in total token supply imposes a cost on all token balances, since purchasing power of tokens is eroded over time. This effect is analogous to the well-known concept of “inflation tax” in conventional economic systems. Validators (recall that we group validators together with block proposers) are the beneficiaries of this “tax,” since they collect the newly minted tokens in the form of block rewards. As far as valuation goes, block rewards effectively raise the fees collected by the validators. This can be seen from the steady-state valuation equation (7.5): holding all else equal, raising \(kr\), where \(r\) is the rate of flow of block rewards, is equivalent to raising the transaction fee parameter \(c\). The precise breakdown between transaction fees and token-based rewards matters, however, because it determines who exactly pays for network operations.

Both types of rewards, transaction fees and block rewards, ensure that all those enjoying the benefits of the network contribute resources to running it. This arrangement closely resembles the funding of commonly used infrastructure in conventional economic systems: for instance, a highway network may be supported through toll fees, paid directly by the drivers, and through public funds, contributed by the broad base of tax payers enjoying the indirect benefits of the highway system. In the context of the electronic payment system, transaction fees are paid by the consumers whenever they use tokens for retail transactions, and accrue to the validators who support operations of the payment network that enables such transactions. In turn, block rewards expressed in newly minted tokens are effectively paid for by all network participants who hold token balances, whether or not they use their tokens for transactions. Importantly, all those who hold tokens as a store of value or for speculative purposes end up bearing some of the cost of such block rewards.

Spreading the burden of funding network operations across a broad range of users, from frequent transactors to long-term holders of tokens, is more than an issue of fairness. All else equal, making speculators pay for some of the block rewards reduces the required level of transaction fees, which generally enhances token adoption and growth of the network. It is reasonable to expect that, in a new system, the volume of retail transactions starts at a relatively low level, grows over time. In contrast, speculative trading may be very active from the start, when future prospects of the network are highly uncertain, declining eventually as the network settles into its steady-state dynamics. Under such expectations of the network’s growth, distributional considerations dictate that one should initiate the network with a relatively high initial block reward rate, so resources needed to support network function at this early stage are contributed primarily by speculators, and gradually reduce block rewards as the volume of retail transactions rises. In the long run, funding of network functions would then increasingly rely on the transaction fees, rather than block rewards.

Consider the steady-state solution for token valuation, (7.4, 7.5). Validators earn an expected rate of return equal to \(λ_f + ησ\), which is their opportunity cost of taking on the risk of the flow of transaction fees and block rewards. Note that the equilibrium expected return of the validators is neither affected by the level of transaction fees nor the block reward rate. Rather, validators’ expected rate of return is determined by the opportunity cost of holding tokens. In equilibrium, each validator decides how many tokens to stake. As validators stake more tokens, they collectively drive down the equilibrium rate of return each of them earns; conversely, their rate of return rises as validators stake fewer tokens. As a result, the level of transaction fees \(c\) and block reward rate \(r\) affect the combined value of the validators’ stakes, but not the equilibrium expected rate of return they earn. Specifically, the combined value of the validators’ stakes is

All else equal, the value of validators’ token holdings increases in the level of transaction fees \(c\) and the block reward rate \(r\). The fraction of the overall token pool held by the validators is also increasing in these two parameters.

Rewarding validators with new tokens thus offers them a claim on the proceeds from seigniorage in the PoS system. Those network participants who hold balances and do not act as validators have no such claim –– they maintain token balances because of their convenience value or for speculative reasons. This creates a wedge, \(λ_f + ησ - g_Y + r\), between expected returns earned by the validators and returns earned by other holders of tokens. Thus, while not affecting the equilibrium expected rate of return of validators, the rate of growth of token supply \(r\) lowers the expected return earned by other network participants. A higher rate of block rewards thus discourages network participants from passively holding tokens and not acting as validators. This mechanism becomes particularly meaningful when we account for various additional costs faced by validators, including physical costs of running validator nodes and losses due to stake slashing (triggered by accidental violations, e.g., validator nodes being off-line).

In the stylized model of this chapter, the volume of consumer-merchant transactions using tokens is exogenous, and consumer holdings of tokens are inelastically related to this transaction volume. In a more realistic description of network dynamics, consumer demand for token balances should be elastic with respect to the expected rate of return earned on such balances, in addition to the liquidity benefits of holding tokens. By penalizing token balances, higher block reward rates reduce consumer demand for token balances, ultimately translating into lower adoption of tokens by consumers and merchants. In other words, by reducing expected returns on passive holdings of tokens, higher block reward rates may eventually hurt user adoption of the cryptocurrency. Such considerations inform our thinking about the qualitative aspects of the desirable block reward schedule. More formal analysis of user adoption requires further research, and is beyond the scope of this chapter.

Our analysis of economic implications of block rewards provides some guidance for how to design block reward schedules with desirable properties. A well-chosen block reward schedule should ensure long-term economic viability of the payment network, including sufficient incentives for user adoption and for participation in performing network functions (block proposals and validation), while also enforcing fairness among validators and proposers. We currently envision a design with a reward rate that starts at a relatively high level at the launch of the network, and decays over time as the network matures.

A high initial rate of block rewards is in line with the design of many existing cryptocurrencies. This encourages participation of token holders in the validation pool during the early period of network development, when the volume of consumer transactions, and thus the volume of transaction fees is low. During this early period, it is imperative to reward proposer and validator nodes for their efforts; without such nodes, the system cannot operate.

As adoption increases, initial growth in token supply will gradually decline. In the long run, the desirable rate of block rewards is subject to the tradeoffs discussed in Section 7.2.1 above. Higher reward rate distributes the financial burden of running the network over a broader base of token holders. At the same time, higher reward rate effectively taxes passive token balances, hurting user adoption. Depending on which of these forces dominates, the long-run block reward rate may remain positive or possibly converge to zero. We are still in the process of selecting a block reward schedule.

For reference, Figure 7.1 shows caricatures of reward rate schedules that have been adopted in existing cryptocurrencies. ‘Halving’ refers to reward schedules that maintain a constant reward over a long period (e.g. years), and periodically reduce the block reward by half. This approach is used in Bitcoin and several cryptocurrencies derived from it. ‘Smooth decay’ is used in Monero, and gives a smooth approximation of the reward function in Bitcoin. Notice that the smooth decay curve is lower bounded by a fixed minimum block reward; this is a detail specified by Monero’s monetary policy. In our case, that minimum rate of growth in token supply need not exist.

We show in the next section (7.2.3) that choosing large initial block rewards (compared to the initial stake pool) can lead to substantial and irreversible wealth imbalance in PoS systems. For example, Bitcoin started with a stake pool of 50 BTC and initial block rewards of 50 BTC per block; in a PoS system, such parameter choices could very easily lead to substantial wealth concentration. Starting with a large initial stake pool compared to the block reward size is an easy way to counter these effects. At first glance, this directive seems to counter the earlier conclusion that we need high initial inflation to encourage adoption. Indeed, there is a tradeoff between choosing inflation high enough to encourage adoption and keeping it low enough to prevent severe wealth imbalance. To this point, notice that to prevent stake imbalance, the inflation rate does not need to be excessively small. In practice, our simulations suggest that if the block reward is less than, say, a thousandth of the initial stake pool, then stake imbalance remains mild [68]. For example, if Unit-e begins with an initial stake pool of 1.5 billion tokens, then this rule of thumb suggests a block reward of at most 1.5 million tokens per block. Aggregated over all the blocks in a year at a (conservative) block rate of 30 seconds per block, this imposes an upper bound on annual inflation of around 100,000%. Such an inflation rate is orders of magnitude higher than any we would set in practice, even in the early days of Unit-e. Hence, the apparent tension between encouraging equitability and adoption is weak; for a large enough stake pool, we can choose inflation to be very high without affecting equitability.

In this section, we study one of the tradeoffs involved in choosing a block reward function: equitability. At a high level, equitability means that a party that begins with a certain fraction of stake cannot unduly amplify its fraction of stake simply by participating in block proposal or validation. Perhaps surprisingly, standard PoS implementations can exhibit extreme inequitability if system parameters are chosen naively. For example, consider a PoS blockchain that awards the full block reward to the user that proposes each block. This is a standard assumption that is used in almost every PoS cryptocurrency today. Suppose further that block rewards are immediately incorporated into each party’s portion of the proposal stake pool. Now let us initialize such a system with parameters comparable to Bitcoin’s initial state: 50 initial tokens and a block reward of 50 tokens. If party A owns \(\frac 1 3\) of the initial stake, a simple Polya’s urn argument shows that as the block length tends to infinity, the limiting stake of party A converges almost surely to a random variable with distribution Beta\((\frac 1 3, \frac 2 3)\), visualized in Figure 7.2 by the blue solid curve labelled ‘Constant Rewards, PoS’.

An important and troublesome property of this Beta distribution is the high probability mass near 0 and 1. Effectively, this means that party A can end up with extremely high or low stake percentages, simply through the natural randomness of the PoS leader election protocol. Moreover, this convergence occurs quickly in practice. In contrast, the black dashed curve illustrates the stake distribution for PoW after T = 1,000 blocks, using the same constant block reward function as Bitcoin. Notice that the PoW curve is substantially more concentrated around party A’s initial stake deposit. A natural question is whether any block reward function can produce a limiting stake distribution comparable to the black curve in a PoS setting. Our objective in this section is to explore this phenomenon more formally; we theoretically demonstrate how compounding affects fairness in PoS systems, both as an effect of the block reward function and the initial conditions of the system. To this end, we introduce a new metric called equitability, which intuitively measures how much a party can augment or decrease their fractional stake over time. We show that no block reward function can achieve the same degree of equitability as PoW, while also introducing a new geometric reward function that is maximally equitable over all reward functions. Figure 7.2 illustrates the empirical stake distribution of geometric rewards over T = 1,000 slots as a green histogram; notice that it is closer, but not the same, as the PoW baseline. This is a fundamental price we pay for the efficiency of PoS. Despite the fact that PoS cannot achieve the same equitability as PoW, we find that through proper system initialization, these effects can be dramatically mitigated. In particular, our findings give concrete guidelines for choosing the size of the initial stake pool, and the amount of rewards that should be disseminated over time, in order to ensure an acceptable level of equitability.

Model We begin with some notation modeling a simple chain-based proof-of-stake system. We consider \(m\) parties: \(\mathcal{A}\)\(= {A_1,...,A_m }\). We assume that all parties keep all of their stake in the proposal stake pool, which is a pool of tokens that is used to choose the next proposer. As before, we consider a discrete-time system, \(n = 1,2,...,T\), where each time slot corresponds to the addition of one block to the blockchain. In reality, new blocks may not arrive at perfectly-synchronized time intervals, but we index the system by block arrivals. For any integer \(x\), we use the notation \([x]:= {1, 2, ..., x}\). We call the time interval \([T]\) an epoch: a period of time (blocks) during which a pre-specified number of inflation tokens should be dispensed. In Bitcoin, for example, an epoch lasts about four years, or 210,000 blocks; this is the time period over which the block reward function remains constant prior to the halving events.

For all \(i \in [m]\), let \(S_(A_i) (n)\) denote the total stake held by party \(A_i\) in the proposal stake pool at time \(n\). We let \(S(n) = \sum_{i=1}^m [S_(A_i) (n)]\) denote the total stake in the proposer stake pool at time n, and \(\upsilon_{A_i} (n)\) denotes the fractional stake of node \(A_i\) at time \(n\): \(\upsilon_{A_i} (n) = \frac {S_(A_i) (n)} {S(n)}\). For simplicity, we normalize the initial stake pool size to \(S(0)=1\); each party starts with \(S_{A_i} (0) = \upsilon_(A_i) (0)\) fraction of the original stake.

At each time slot \(n \in [T]\) ，the system chooses a proposer node \(W(n) \in \mathcal{A}\) such that

Upon being selected as a proposer, \(W(n)\) appends a block to the blockchain. As compensation for this service, \(W(n)\) receives a block reward of \(r(n)\) stake, which is immediately added to its allocation in the proposer pool. That is,

The reward \(r(n)\) is freshly-minted at each time step, so it causes the total number of tokens to grow. We assume the total reward dispensed in time period \(T\) is fixed, so \(\sum_{n=1}^{T} r(n) = R\).

Consider a closed PoS system where no stake is taken out of or put into the proposal stake pool over a fixed period of time T. The only changes to the stake of each party during this interval are due to the compounding effects of the rewards earned in proposing new blocks. At each (discrete) time step, a block reward is dispensed according to the randomized proposer election in Eq. (7.6). This is immediately added to the stake of the elected proposer. We focus on the scenario where every party follows protocol as a starting point.

Common reward functions Between checkpoints, we can choose any block reward schedule \(r(n)\) that respects the total reward constraint of R. A natural choice, famously adopted in Bitcoin, is the constant block reward function, defined as:

Perhaps surprisingly, we find that \(r_c\) introduce inequitability to the block reward scheme if initialized improperly. Critically, this can happen without any strategic behavior from any of the participants. Rather, it is the combined effect of compounding stake and randomized leader election that causes this effect. A main result of this work is that a geometric reward function, defined as

provably minimizes inequitability and exhibits a number of other desirable properties. Although geometric rewards may not be appropriate for deployment in a real cryptocurrency for various practical reasons, this work helps us to methodically choose system parameters, such as initial stake pool size.