 Okay, everyone. Welcome back to the Monero Village. We are starting our next talk with Francisco Cabanas from the Monero Core team. He goes by Arctic Mine. He'll be talking about the block award in Monero and what happens in a few years. So please let's quiet down in the back and let's give our attention to Francisco. Thanks. But also how it relates to a lot of the other coins. And I'm talking specifically about Bitcoin like coins and also coins such as other crypto coins. And what happens when this thing goes to zero and what are the risks? So this is kind of an overview. I will do a review of fee and block weight scaling in Monero now. This is quite unique to Monero and is very different from what people are used to. If you, for example, you're used to fees in Bitcoin. And it's also quite subtle. And for this reason, I will spend some time in it and how it relates to the penalty, etc. My next topic will be the rational miner. What is what is a rational miner in Monero and how does a fee market in Monero actually work? What is the block award goes to zero? I mean, this is a very interesting question overall. And it also, what kind of limits do we have? I mean, Sartel mentioned good enough. Implications from Monero. Monero like adapt the block, block weights and also implications for Bitcoin and Bitcoin like small and large block weights and the Satoshi fee market. So this is an overview of fees in scaling review in Monero. There are some significant changes from the last time I spoke on this in here at DEF CON in 2018. There has been some changes. I'm going to cover those for the sake of completeness or understanding how this process works. The Monero uses what's called a crypto note. It used to be the crypto note. Now I'm going to refer to it as the Monero penalty. And what essentially the Monero penalty does is it actually takes the, let me see. I can show you this here. It takes the base reward and it penalizes essentially the percentage increase in the block size over the median square. So when you mine a block that is larger than the medium over the last 100 blocks, you will pay a penalty essentially for fading part of your block reward if you're a miner. And this is the driving force for how fees work in Monero. This is the driving force for how scaling works in Monero. Now a couple of the changes is we, the median is actually capped temporarily. So there's actually two medians. One is over 100 blocks and one is over 100,000 blocks. And this is primarily to ensure that certain types of attacks cannot work in Monero. Those changes were put place this year in the last hard fork. So it's actually very recent. And this is where I will spend a bit more time covering this because it has been some changes. Okay. So what do we have here? We've got the base reward, which is basically your block reward. And then we have the reward that's paid to the miner. And essentially what you're doing is you're taking out this penalty. And then you say maximum allowed block, total block weight is twice. And essentially when you give up the entire block reward. So what happens is if you make MB, which is the MB is twice MN, then you basically end up with on you equals zero. And you've given up your entire block reward as a penalty. And what you've done if you mined a block that's twice the size of the median. The penalties only apply when you mine a larger block. And you do not get a rebate for mining a smaller block. This is very important. And so the change that we introduced in was introduced this year in the spring of this year was that we're capping the median as 50 times the long-term median, which is 100, 100,000 blocks. And then it has the scale and the much lower scale rate in order to prevent sort of out of control, out of bound scaling. So for simplicity, I will define B as this ratio, which is essentially a percentage increase in the block that you mined. And the penalty becomes RB times B square. So basically the square of B times R is your penalty. And you can think of it as the percentage increase in the block weight. Okay. So now we have what happens when we add a transaction. So let's say that we already have a series of transactions. And we add an additional transaction and we're somewhere in the penalty. And we look at what is the incremental penalty from adding that transaction. Well, it's a fairly straightforward quadratic equation. You just expand it out. And what you get is 2BBT. Now B is the increased block size percentage before adding the transaction. BT is the transaction size. So that is the key parameter that a miner has to deal with when she's looking at the transaction. Okay, if I'm going to add this transaction, how much is it going to cost me? And then the question becomes, how much fee do I get from the transaction in return? And that is the essence of what a miner has to deal with in this situation. So there's a couple of things that are done. One of them actually is that we have to define certain fee structures. And one of them is that we have to look at, okay, do we have enough space in the fees? So if you take a typical transaction at the minimum block weight of 300,000 bytes, can we actually scale it? So is there enough there in fees for a miner to actually go to add this transaction on? And that effectively is what sets the normal fee in Monero. Now, going back a minute to Reha's talk, this is a question of sort of why don't you just take a higher fee? And the answer is people don't. And in fact, at one point in the past, people weren't doing that and the blocks were just getting stuck. Because nobody was clicking on an interface and simply adding the next level fee that would have done the solve the problem. So this is part of the simplicity of design from the back end element. So this is why we have to set the normal fee at this point. Essentially, we're setting it the optimal level to add one transaction just at the penalty. Okay, so then there's a low fee and high fee that it sets. The key difference also from last year is that we're basing the fees now on the long term median as opposed to a short term median. So basically, here's the interesting, the high fee per byte. The maximum, if you max the whole thing out, it's actually twice the entire reward. And then, so it's a very high fee to twice our beta or ML. And then you get all the other fees that we pay. Okay, so the changes were the introduction of the long term median, copying the growth of 50 times, of the short term, meaning 50 times x. The long term median only grows at 1.4 times. So it's restricted, it's equivalent to keeping it restricted, effectively controls the rate of growth of the block size over time to prevent certain types of attacks. So this is kind of my review. The implication is basically that we are limiting this to prevent these, to prevent attacks. So now we're taking a close look at the rational minus. So what is a rational minus? The rational minus is neither altruistic nor malicious and acts in her enlightened self-interest. She's also dealing with rational users who wish to pay the lowest fee to get their transactions mined. This is the basic dynamic of a fee market in Monero. You have the Maya, you have the users, and you have the penalty. And essentially, the users are competing against the penalty in order to get their transactions mined. So the problem, you're a rational miner, the problem is given a finite number of these transactions and transaction pool. I have a distribution of weights and fees. What is the optimal set of transactions in a block in order to maximize the return to the miner? And this is not, this is essentially what's called a discrete optimization problem. You can actually solve it exactly, but there's also a relatively simple approximation that is pretty close to where you want to be, but not 100%, which I'm going to go over, kind of explains it a lot more efficiently. So you make an approximation. And the approximation that we make is that the transactions are small compared to the block size. So you order the transactions and fee per byte. Okay? You add them to the block starting with the highest transaction first. The idea there is you take the highest paying transactions and you give them priority, the most profitable one. Then you test that age transaction for profit. And then you test when you got into the penalty, then you look at it. Okay, I add an extra transaction. Do I get, I get a fee? Does it attract more penalty than that fee? If the answer is yes, then you stop. If the answer is no, then you keep adding transactions. And of course, if you run out of transactions with or without penalty, then that's fine also. So the rational miner does is take the best highest paying transactions, gives them priority, and then works away right up until they get a point where there's no longer profitable to add more transactions. So basically, the penalty level is determined by the lowest paying fee transaction. And this is a critical point. All the transactions are up below, actually paying a higher fee per byte, because the miner is already giving priority. So this effectively creates every time the penalty is triggered a profit for the miner. The miner makes a profit on the transactions because they need to get ahead of the penalty. So they have to pay this so that the miner will include them. But the miner gives priority to the highest paying transaction. So the rational user is basically going to figure out where in the penalty do I want to be. And then ask the question, okay, this is how much I'm willing to pay. And this is how much I'm willing to push the penalty to get my transaction might. That's the decision the rational user does. And then it offers that penalty as a fee. Okay, now, here's a key element of all of this. The total fees that are collected are proportional to the block reward, because what's driving it is the penalty, which is a portion of the block reward. That is what's constraining the size and growth of the block size. So here's the interesting fun part. What happens when the block reward goes to zero? And the answer is really quite simple. So do the fees, because the penalty is zero. So now, if you drive the block reward to zero, you get no fees. And how do you incentivize the miner? Okay, we may have a problem here. Essentially, there are two scenarios. One of them is that the miners try to form a cartel to protect themselves. And they go ahead and they try to protect fees. Cartels are historically being fined to fail because people cheat. And so that is not a particularly stable. The more likely the overall scenario is simply the whole thing collapses. The base goes to zero. The total fees goes to zero. You have a tragedy of the comments because of competition among miners. And here's a really interesting part. You have no incentive to secure the network. And that's scary because you have no security, none. Okay, so how does Monero deal with this? Well, what Monero actually does is it sidesteps the whole thing. It simply says, we're not going to allow the block reward to go to zero. And then that makes it actually the point that it's talking about a particularly interesting coin because actually Monero solved the problem by simply sidestepping it. And this is why it's so critical to have this minimum telemission or block reward. Because without it, you will not have the scaling in Monero. And in fact, as I will discuss later, we have serious problems with some of the other scaling ideas that have been put in place. So I'm going to deal with it first with one coin, which is a bit interesting in the history of Monero. And that's Bitcoin. People might have known Bitcoin as a heavily pre-mined scam because over 83% was either a pre-mined or an instant mine. It was launched just about the same time, just before Monero. And actually, Monero was forked from Bitcoin. And there was a script on all reference. One of the key differences that Bitcoin did that Monero didn't have is that Bitcoin doesn't have a tail emission. It followed the Bitcoin model of allowing it to smoothly go to zero. And because it tried to set up this pre-mined, linear-mined thing and make it look like a linear-mined over two years, so it was 2012 to 2014, and it went at 83%. So they had to decry the total block reward by 83% in two years. You have this really, really fast falling reward curve, which makes it the perfect canary in the gold mine to look at this problem fee. And so you look at it and you say, okay, we have the block reward went to about 808 BCN. Now if you actually look at the code, there's a 10,000 factor between bytecode and Monero, which is sort of rough, comparable to .08 XMOP of block. So that's roughly the comparison. And this then is about 12% of Monero's tail emission. They still have a falling block reward, because there's a really fast block reward. They panicked, they had to do something, otherwise they're going to become insecure. So they said, okay, fine, let's have the minus boat on the median, effectively trying to set up where it's going to look like a minor cartel. A little more interesting history of bytecoin is there was a bunch of ASICs on mining Monero, there were four of the network, and these last year actually, and these ASICs ended up in bytecoin under primarily the control of bitme. So essentially what we have is a minor cartel in bytecoin. And then what we're likely going to have is, sooner or later the ASICs are going to run out, the block reward is still going down fast to zero, there's hardly any transactions, and nobody's going to bother building new ones, and the thing might just go into tragedy of the commons. So now we're going to talk about the Bitcoins. Now Bitcoin originally introduced the one megabyte block size in 2010, and this is one criticism that I do have of the Satoshi paper. It says, incentive can also be funded with transaction fees. Yeah, fine. If the original value of a transaction is less than the input value, the difference is a transaction fee that is added to the incentive of the block containing the transaction. Once a predetermined number of coins is in the circulation, the incentive can transition entirely to transaction fees and be completely inflation free. This is a straight quote from Satoshi. My opinion on this is very simple. The fact that you include a statement in what is otherwise a work of genius does not make the statement true. There is no justification whatsoever for this statement, no theory, no references. What is the game theory? How is this supposed to work? None. What happened is about 20 months later, 2010, the one megabyte block size was introduced in a hard fork in Bitcoin. That's what actually happened, and it was actually introduced by Satoshi. Then the birth of the block size debate in Bitcoin started. Very interesting. So what has happened? Well, you have this maximum number of this limitation, and one of the interesting results is that from Monera is, well, okay, so if we're going to have the Satoshi fee market, whatever penalty we're going to have, whatever price to increase the block size, it better be stiffer than what Monera has, because we've already shown that Monera was zero, so without a block reward. So we need something as harder. We need something as stiffer. And what better than just a fixed block size, which is essentially what Bitcoin has done. But this, of course, creates a problem that you can't scale the coin. And Bitcoin essentially failed as a transaction currency, mostly failed. I mean, you can still use it for large amounts. It's still cost-effective to do that. In fact, I've done it, and I do it regularly on a very regular basis. But it is not particularly effective for small transactions, because the fees are right. And so it's been transitioned as a store of value, which has been a major, I mean, I consider it a major success of the Bitcoin community, because they managed to save the value of Bitcoin. But so there's great response in that regard. But basically, because of this security issue, the only prudent response from Bitcoin Coach is basically to leave the one megabyte thing in place, at least until you can show that you can actually generate this Satoshi Fimo. Having said that, there are still potential attacks. And one of them that I consider is what Amazon Christmas Day. Well, on Christmas Day, you have all this high shopping, and all of a sudden, nobody's shopping, nobody's transacting, nothing's happening in the network. So if you have a fee-based solution, if you want to attack the coin, then that is what I want to do it. So I looked at if you're going to attack a coin that's just based on fees, the day to do it is Christmas Day. So you get to play Scrooge. So I call it a Scrooge Attack. So that's interesting in Bitcoin. Now, if you look at Bitcoin, you see they just took off the limits entirely. So there, what they did is they have an effectively infinite site. But wait a minute, you have an infinite block size. How are we restricting this? Nothing. And then they're going to say, well, okay, there's no limit on the size. Well, he has to question how this fee market is going to develop. I did a rough estimate and it'd be roughly about 8.8% of the block reward in 2043, which is basically the 200th anniversary of Charles Dick and Christmas Cow. It was published in 1843. And then we're not talking 2143. So we're talking something within our lifetime. And they're already very, very low. So that begs the question, how? And what I end up getting is there's a lot of questions and very few answers. And some people might say minimum fees, and I should backtrack on that in our previous slides. Minimum fees do not prevent the miners from giving out-of-bound rebates. So that's not a solution. Because a miner can basically say, okay, I'm going to rebate your back if you submit the transaction directly to my site. So that's not really the answer. So what you end up with is lots of questions and very few answers. So my conclusion, the Monero emission, tail emission, is absolutely vital. It actually makes Monero work. And it may be very close to optimal because of the amount versus the fact that it's less than the inflation rate of gold, which is considered a hard money. So you have the hard money argument sort of handled. The Satoshi fee market is totally unproven. I may not even work at all. We don't know. I mean, the best chance is in Bitcoin, if they managed by keeping the block size small, that they may be able to make it work. We don't know the answer. There's no evidence for this. There's a lot of evidence for cryptocurrency working with a block rule. We have 10 years of evidence in Bitcoin for that. But we don't have evidence for this Satoshi fee market. And basically, what you get if you have a maximum number of coins on all block rewards, you've got more questions than real answers. So at this point in time, I'm ready to take some questions. If anybody has questions, no discussion. Any questions? Yes. Well, I mean, the price that you pay is that you have a linear inflation, which is less than the historic inflation rate of gold. And that's the argument, that's the hard money argument. I mean, that is what scares people because a lot of people love the idea of the finding number of coins. It's very saleable. But what you end up with is you're still harder than gold. And if you're going to go for the gold standard of hard money or Austrian money, which is essentially what we're trying to say here, the implication is, well, if you can beat gold, you're okay. The other thing is because it's linear and it's not exponential, you actually might get a situation where you get a stable stability between the total number of coins, lost coins, and the inflation rate. So what you end up actually very likely is some kind of equilibrium between price, lost coins, and the inflation rate. So you'll actually end up with exactly a flat amount of coins. But you still have that bound by the inflation rate of gold. So as long as you're ahead of gold, you're harder money than gold, then you're okay. But it's just kind of the argument that that one can make. Any more questions? Well, unless you have a penalty or a cost of increasing the block size that is stiffer than Monero, because if you show in Monero that this is what happened, you need a stiffer penalty, a stiffer cost of increasing the block size for the fees to go to zero. So for example, Bitcoin Core is done, it says, well, we're going to keep the block size at 1 megabyte. Well, that is definitely an infinite penalty. So it could work there. But then you get someone like, say, Bitcoin Satoshi Vision, we're going to let this thing grow to infinity. They just mined a 210 megabyte block. Well, that is way weaker than what Monero has. So you have a bound. You have a bound saying if it's stronger, the penalty is weaker than what's in Monero, then the fees are going to go to zero. That's essentially the the thesis. There is nothing to restrain that block size. There is nothing to create scarcity. So either you go back to the Bitcoin scenario, either you have a mining cartel, or you're going to try to do the comments, all could probably happen. You first get a mining cartel and then you're going to try to do your comments. Any more questions? Any more questions? Don't talk about two minutes left. Okay. Well, thank you.