 Hello and welcome to our monthly meeting of the Central Banking and Digital Currency series. Before we start, I would like to advertise two upcoming events. First, next week on October 6th, there will be a webinar co-organized with the CDPR on digital money and finance. I will post the registration link in the chat box. And then at the end of the month on the 28th, we will host a job market candidate workshop featuring four job market candidate presentations. Hope you will join us and meet the junior researchers working on central banking and digital currencies. And for today, our moderator is Thomas Moser, who is an alternate member of the Governing Board of the Swiss National Bank. I will now turn things over to Thomas. Thank you very much, Jonathan. Thank you very much for the invitation to moderate this interesting panel. So let me first do some housekeeping, the way it works. The presenter has 25 minutes and then the discussion usually has 10 minutes. We may be doing 15 minutes for serial. He prepared a lot of comments. And then we will have a Q&A of 20 minutes. And panelists can unmute themselves and ask the questions. All others can use the Q&A box. And then I can select and read the questions that you have. And also note, please, that this session is being recorded and it will be posted on the website. Okay, then I think I can start, Jonathan. Is that okay? Yeah. Good. So the presenter, as you have seen, is Hannah Hallaburda. She is an associate professor of technology, operations and statistics at New York University Stern. She has before been an assistant professor at Harvard Business School. And from my perspective, important, she has been at the Bank of Canada. So a former fellow central banker. And I also have to say that that probably the first economic analysis of cryptocurrencies that I have ever read was Hannah's book that she published back in 2015. Beyond Bitcoin, the economics of digital currency. So great to see that she's still contributing to the field. And today she will present a paper that she called called an economic model of consensus on distributed ledgers. So Hannah, let me turn over to you. Thank you very much. Thank you for this nice introduction. Let me share my slides. So this is a, this is a counter to work with Giga and Justin Lee. And this work has been inspired by an observation that a lot of the newer blockchains blockchains post proof of work are using the so called business in full tolerant, tolerant protocols in their consensus mechanisms. So this is true about the Ethereum using proof of stake, a hyperager fabric for a while now, tend to mean rebranded by us ignite. So the new this new generation of blockchains is using this isn't in full tolerant, the concept of business in full tolerance and business in full tolerant consensus protocols. Why was this surprising worry in any way pushing us to ask question. This is because isn't in full tolerance is far older than blockchains. It goes back to the late 70s as a problem and early 80s as solutions. And this is a problem that originated in distributed databases. And by now very classic problem, it has many solutions, not just one but a whole couple of classes of solutions. And we wouldn't be able to function, we wouldn't be able to see this large companies on internet like Facebook, Google, Amazon, or even smaller ones. If we didn't have a good way to manage distributed databases and consensus on distributed databases. So, the problem of distributed of consensus on distributed databases is that in distributed systems, there is a peer to peer network that is communicating and sending messages. And this peer to peer network keeps their own ledgers, their own databases that need to be updated in a similar way. So as the messages are floating around in the peer to peer network, they may be a little bit out of order. The really important part for distributed databases is that every note in the distributed database is keeping the same copy of the database. And as each one of them is updating their individual local copies, they all updated in the same way. So this is a far from a trivial problem, but we have methods to solve it. And one of the oldest most reliable one is this Byzantine fault tolerant. Just a short brief version, a brief detour on the name, Byzantine fault tolerant comes from the name comes from a Byzantine general's problem. And Byzantine generals are trying to communicate and coordinate and attack, and they basically need to be sending those messages to each other's messages may be intercepted. So at which point they have each of those Byzantine generals have the belief that everybody else is going to attack at the same time, just relying on this local knowledge. So this is, this actually does the logic that's play an important role. So, like I say it's an old problem it had solutions. It was almost relegated to a dusty corner of computer science departments, but the interest in the problem is was reignited by the by the blockchains and the new generation of blockchains. Blockchains basically are distributed letters, I mean, they are distributed letters which means that they are basically distributed databases a special type of distributed databases. And what we have learned from Byzantine fault tolerant protocols give us guidance to this to design efficient and effective blockchain protocols to achieve consensus. Right. There is however crucial difference and this is why we were interested in this problem. There's a difference in advertiser. There's a difference in how adversaries and how adversaries behave in this in the two environments. So, in both environments, we may have situations where somebody wants to subvert the system somebody wants to hack the notes and make them do something else. But in traditional distributed databases, while we expected that some notes may be hacked and other notes may fail notes that work properly. They just follow the protocol as it is prescribed. And the crucial difference is that in blockchains notes who are not hacked and who did not fail. They are independent entities and they are individually pay off maximizing and therefore, therefore, every note decides whether it is worth for them to follow the protocol or to deviate from the protocol. You can download Ethereum client but then you can modify it you don't need to run exactly the default version of the of the software. So, we need to think about economic incentives in analysis of Byzantine fault tolerant consensus in the context of blockchains. So what type of protocols will be incentive compatible because now we need this incentive compatibility in order for the notes to actually want to follow the protocol and therefore reach the consensus. And this is why we developed the economic model of Byzantine fault tolerant consensus, where we characterize characterize our symmetric equilibria. And we show that not every design that achieve consensus achieves consensus in the, in the distributed database will achieve consensus in the presence of rational agents who are individually pay off maximizing to decide whether they want to follow the protocol or not. Because now we need to think about the incentives of the notes, the national notes, they need to be given some reward for achieving consensus and some punishment for not achieving consensus, the payoffs need to be there. And since the notes need to be paid to be incentivized to reach consensus, it adds to the cost of running the system. So, the cost of running a system was always there, you know, even in this with the databases that the servers take, take up energy and so on and when to lay the cables. But really now we have the cost of incentives that are part of the architecture of the of the protocol, which has not been considered before. So incentives adds to the cost of the system. So our equilibrium analysis show offers explanation on how to design a protocol, and how the design of the protocol affects the cost of the system, and which type of protocols will be cheaper will achieve consensus cheaper than others. So to give a kind of one example why it matters and why why it's different. When we think about incentives is a traditional Byzantine fault tolerant protocols recommend that notes always send them forward messages as frequently as they can or you know with the highest probability that they can sometimes however messages get lost. So traditional prescription is traditional protocols prescription is, even if you think that with some probability the message will get lost, you still send it every time you can, every time you get it. We showed it in the presence of message loss when there's some probability of message loss. And when to incentivize the notes, it may be actually prohibitively, prohibitively costly to achieve reliable consensus, if we ask the notes to always send the message so send a message even if it gets there with probability 99%. It matters out not to be as effective as asking the notes to send the message only with probability one house. So sometimes you send sometimes you don't according to prescribed probability. Okay, so this is an example of how economic analysis may change the prescription of the of the protocol. So, like I said, the Byzantine fault tolerant protocols are a classic problem in computer science so the first kind of reliable solution goes back to the 80s. And it is important to, you know, to think about the structure of the classic Byzantine fault tolerant protocol which will modify slightly. Another important part is that we have this distributed network of computer nodes, it's a peer to peer network, and they communicate with each other. There isn't one authoritative copy of a database that they can all refer to the same way that we don't have the blockchain, we tend to talk about the blockchain but there isn't the blockchain they're just local copies of it and the magic comes from the fact that they are all the same. But only in equilibrium when it works. So each of those computer nodes, they need to reach consensus based only on the local information, they don't know exactly what the other nodes are seeing what messages, they are seeing, but they need to infer, and without this global knowledge, the local information needs to lead to consensus. And they need to do it in the presence of Byzantine nodes and Byzantine nodes are the ones that may behave arbitrary they may coordinate and try to attack together, they may have some other objectives, or they may be attacking independently. So we don't really know what they are doing but even though they are there we should be able to reach our consensus. So the Byzantine fault tolerant protocols stipulate honest strategies so called honest strategies for non Byzantine nodes so just following the protocol will be modifying that. And as I said they are very popularly used by all tech companies to maintain their databases. So, in this paper, we acknowledge that blockchains live in trustless environments and they are run by those independent entities that are individually pay of pay of optimizing. And therefore, on non Byzantine nodes in our model are rational, rather than honest, and they will follow the protocol only if they will find it worthwhile. And also they need to form beliefs about what what what will be the behavior of Byzantine notes. And here we are going to utilize the ambiguity aversion about Byzantine Byzantine strategies. So because we don't know what Byzantine notes objectives are and we don't know what they are going to be doing, we're going to assume that they will be doing whatever we think is the worst case scenario as a rational note. Because in the context of this, this worst case scenario we still need to reach equilibrium, and we still need to reach consensus in equilibrium. So, we are going to the basis of our analysis is a simple consensus game a simplified consensus game, where we have a continuum, a continuum of computer notes of measure and, and those notes will be communicating. First, nature randomly selects one note as a leader, and all the other notes then our code called backups. And then the leader decides whether to send a message, and it could be a new batch of transaction the message we're going to attack it's 3am, and so on, whether to send this new message to other backup backup nodes. The backup notes who received a message from the leader will forward or decide whether to forward the message to other backup notes. And for at the end of this communication stage, each note note looks at the messages that they have received, and then decide based on the number of messages that they have received and from whom they received those messages. They decide whether to commit a message or to their local ledger or not so whether to add the batch of the new batch of transactions to their local ledger or not. Of course they worry about whether other, other notes are adding the same batch of transactions or not. So we reach consensus when everybody adds the same number, the same batch of transactions. The problem is that we, we have a measure of Byzantine notes we take arbitrary actions. And the bigger problem is that we never know who, which of the, which of the computers are Byzantine notes if we knew who are the Byzantine notes, we just exclude them and we will ignore them, but we can't ignore them. So we know we are going to have those messages from Byzantine notes floating around. So, for the, for the measure and minus f of rational notes, they are going to maximize the, their payoff, and their, and to maximize the pay of it is important what are the payoffs. So if a rational note commits and commits message to the, to the ledger and the consensus succeeds, then the note receives a reward R, which is positive. But if a rational note commits message to the ledger and the consensus fails, it means that now we are getting the fork, and there is a penalty for those who committed to this message of minus of minus C. If you do not commit the message you get the benchmark zero there is the blockchain is stolen. And we are going to say that the consensus succeeds, if the measure and minus f so almost all rational notes commit. So, with that we are ending up with this dynamic game of imperfect, imperfect information that has flavors of both coordination because I want to commit if and only if everybody else commits and cheap talk of the communication stage. Which we solve for perfect Bayesian equilibrium with with multipliers over Byzantine strategies and the multi prior priors over Byzantine strategies come from this ambiguity aversion assumption that that we are making. And the basic, the basic logic behind it is that we don't know what Byzantine Byzantine notes are doing so let's assume that whatever they are doing is going to be worse for us so we are going always going to think about the strategy of Byzantine notes, which is going to be worse for our pay off, depending on what we are doing. We give them this ability to always see what I were doing and respond on the worst possible way for us. So in this environment, in order to characterize all symmetric equilibrium, we start with with considering a candidate symmetric equilibrium so symmetric equilibrium will mean that we are going to assume that everybody. Every note sends a rational leader sends message to each backup with the same probability p and rational backup, if they got a message they will forward this message with probability q to everybody else because in principle those probabilities could be differential depending on the recipient. We're going to look at the symmetric equilibrium. Okay, so we have this p and q. And then based on the p on this p and q, the backup collects the messages, and is going to commit only if receiving certain number of messages, given the interval that we are going to characterize. So you made this possible that the backup note will want to commit based on, based on different number of messages if they also got the message from the leader, then the number of messages that they are getting if they didn't get one from the leader. And sometimes it will matter and sometimes it will not. So the first thing that we are showing is that so called gridlock equilibrium always exists. So this is a null equilibrium in coordination games that we are very familiar with. It is always possible for consensus to fail. Nobody ever commits no matter how many messages they are getting. This is an equilibrium. And it's kind of surprising that we are not seeing more of those stalled blockchains but it is always possible. Instead, of course, we are interested in the successful consensus equilibria where the messages are sent with some probability and there is some commitment decisions. So I'm going to focus on those consensus opposite consensus equilibria. So every user, every, every note, rational note who receives some K number of messages can make certain inferences based on the number of messages that they receive. So they know what probability with which probability rational leader is going to send the message they know with what probability the backup notes are going to be forwarding the messages so knowing P and Q. The K messages that they receive, they can infer number of things. Number one is they can infer whether the leader is rational or Byzantine. And this is because a rational leader in equilibrium P and Q, if the leader is rational, the number of messages that the rational backup note is going to get will be restricted by this behavior consistent with P and Q. So at least they are going to get n minus F P times Q messages. So this is if all the Byzantine notes decided not to forward the message. And at most they are going to get n minus F P Q plus F P messages and this is when rational notes behave as they are prescribed. But the all the Byzantine notes are sending the forwarding messages 41 and not probability Q. So getting messages anywhere outside of this interval indicates naturally that the leader is Byzantine. Getting messages within that interval means that the leader may be either Byzantine or rational. There's already some inference. In addition, in addition, a rational note can make inferences about what number of messages other rational notes received given I that I received K. So I know that all the other rational notes can get at least my number of messages minus F or at most my number of messages plus F so that kind of limits not everything is possible. So this is what they get if the leader is Byzantine and if the leader is rational and I know that they are going to get messages within the same the same interval blue interval that is consistent with rational. So based on those inferences, we can specify possible intervals and possible possible protocols that are going to lead to consensus. So number one thing is that if we have a consensus consensus equilibrium, then I am going to commit only if I'm getting messages within the interval consistent with rational rational leader. And this is because if I know that the leader is Byzantine, I will not want to commit ever because I know that I will be getting minus C from committing in this worst case scenario world that I have that I have assumed. So, except for one, you know one point that I'm not going to dwell on in the short presentation but but we we we talk about it extensively in the paper. So the way I mean the reason why we never want to commit when the leader is the leader is Byzantine is because no matter what we think we could have a number that we can coordinate on like let's say everybody if they get three messages they are going to commit. Then the leader can always kind of always gung up against us Byzantine leader, and make sure that we are getting that number of messages and everybody else is getting a different number of messages. So by the strategy of iterated deletion of dominated strategies, we are showing I'm going to kind of short short cut it here because I don't think I have that much time to go carefully over a proof. But basically can show that if we know that the leader is Byzantine, then we never really want to commit to commit to a message because other, other rational notes are going to get a different number of messages. So, we know we are never going to get to commit to messages outside of this interval but are we going to commit to message within the interval that is consistent with rational leader. So it turns out that we may or may not, but what is important that if we are going to commit to some part of this interval, we are going to commit in the, in the whole in the whole interval so it cannot be, we cannot have holes, because again, again the Byzantine backup notes can gung up against us, even if they are, even if the leader is rational. In the end, we find that that either we are going to commit in this interval or not commit in this whole interval. And like I said, we are showing that we always get this gridlock equilibria where we never want to commit. But the question is when are we going to get a good equilibrium where we actually do want to commit if we get messages in this interval. And it turns out that it crucially depends on the reward and reward and penalty scheme. And that's why this incentivization of blockchains with a stake rewarding or with, or with other type of rewards or in permission blockchains with the penalty, when we, when the, when the, when something goes wrong with the, with the consensus is really crucial, crucial design element to achieve consensus, and we are characterizing exactly the conditions on the reward and the penalty that we need. I know this is a busy slide, but I just want to kind of highlight certain things. I wanted to make sure that we have all equilibria in one slide for reference so this is why it became so busy. So, we show that aside of the gridlock equilibrium, we have two types of good consensus equilibria. Consensus one type of consensus equilibrium arises, we call it single tone is your equilibria. This arises when the leader rational leader sense the message with probability one. So leader always sends messages to the backup notes. And that allows the backup notes to always infer from the number of messages that they got from the, from the leader, whether the leader is visiting or, or not. So, especially visiting. So if they never got the message from the leader, they know for sure that the leader is visiting. And three minutes left. Okay, I think this will be. This will be almost almost right. Almost enough. Another type of consensus equilibria, the interval zero equilibria is when the leader sense a message to each backup with some probability that is less than one, and this is within certain interval. And now, if the backup does not get a message from the leader, it is still possible that leader is rational. And that kind of changes the inference. And if it changes the inference, it changes the conditions on the payoffs that we need to offer to the, to the, to the notes. So, it turns out and this is what I want to highlight here is that the requirement on our on the reward is much lower if we are going for the for the equilibrium with with P one. And the requirement on the reward if we want to go for the other equilibrium where the leader sense the message for probability, less than one. Now I'm not going to go into the, the, the, the, okay. I'm not going to go into the detail why this is the case, but I'm going to think about the consequences. So, when we have a protocol that prescribes certain behaviors, then, and given given certain punishments and rewards, then we only are going to reach consensus. If this protocol is incentive compatible. So if the conditions are met, so we can calculate the cost of incentives. And this is where we find that it is going to be cheaper to get the singleton is your equilibrium, then, then get the, then the interval interval is your equilibrium. And for interval, however, if we are forced to get interval is your equilibrium, the P that is farther from one half requires higher reward. And now, why would we care about it because if this is the case we should always go for this great cheap equilibrium that is that is prescribing the leader to send a message with probability one. The problem is that I'm going to skip that slide the problem is that messages sometimes get lost. The moment we have a loss of messages, our good cheap equilibrium with singleton is zero is disappearing and we are only left with the more expensive equilibria that require positive interval for for the for the for the positive is zero. So this is positive interval of messages that that's under which the backup nodes are going to commit even if they did not get a message from the leader. And then we need to prescribe the leader to send the messages with lower probability than one so that they will get to the backup notes with lower probability than let's say 0.99 in order to more incentivize those backup notes to actually commit the messages, because otherwise they will worry worry that they will. They don't have the irrational leader and they will not commit messages and will not get consensus. This is this is my last slide so I may be almost on time. So why does it all matter right I took you on this trip of you know quite theoretical theoretical model of consensus mechanism, bringing elements from CS and elements from from economics. This is because operational success of any blockchain depends on its design and it is true for proof of stake for permission permission less blockchains and you know of course for proof of work as well. But if you want to use Byzantine fault tolerant consensus protocols, which we actually are doing in many of the permissioned and proof of stake permission less blockchains, then we should account for incentives of Byzantine fault tolerant for tolerance. Then we need to remember that all designs will be subject to multiple equilibria concerns and who may get the we should worry about the grid gridlock equilibrium and even small probability of message loss will significantly affect equilibria. So our model provides a guidelines guidance on cost of incentives needed to achieve consensus, depending on the on the design. And we are showing that it is less costly when protocol may ask for sending messages with probability one half, then asking to send messages with with with one probability one. Different recommendation from traditional Byzantine fault tolerance prescriptions. So, in the end, we need to think more carefully about incentives because they are going to really affect the cost of running those new systems as we're building them more and more. Thank you very much. Thank you very much, Hannah. The discussion for the paper is serial money. He's a professor of economics at the University of burn. He also has a formal life as a central banker. He was at the Federal Reserve Philadelphia, Minneapolis at the ECB, and he also was an advisor to the Swiss National Bank. So serial, the floor is yours. Thanks. Thanks a lot, Thomas. So let me jump right in because I don't have much time. So, another question that the, the authors want to answer is essentially how to reach consensus in distributed ledgers, but not in any distributed ledgers. It's when agents are utility maximizing, because the, the agents that have to reach consensus, they, they are honest, some of them, but they also want to maximize their utility. And this is the main difference from the usual consensus literature that you find in computer science. And computer scientists don't care about utility maximization. Or some of them don't. And, you know, the issue there is that others agents that will want to jeopardize the system. So they are going to be the Byzantines here, and they will sort of seek to pretend to be honest but you know at the end, they won't be. So, you know, the question then is given these bad guys. How do you reach consensus. So what is consensus here. So consensus has a following definition. So consensus is achieved when all honest agents, they commit to a block. Okay, so when a block is submitted on the blockchain. The honest guys have to commit to it. And if all honest agents commit, then we say that we reach consensus. So the, the authors, the, the, and Anna presented the model. So it's pretty simple model. I mean, the model is essentially on this slide. So this means that, you know, it's always a good model in the sense that it's very simple when you can present a model on a single slide. And this is what, you know, we should aim for a theorist. So I think that, you know, sums up for that. So the setup is the following. So you have a continuum of honest agents. So n minus F you have a continuum F of Byzantine agents. And one of these agents is going to be selected as a leader. And the leader here is going to suggest a block to the other agents. So agents who received the block can also send that block, you know, to other agents. Okay, so there's going to be a round of communication. And then people or agents are going to count the amount of messages that they received. So given the number of messages received, the question is going to be, as an honest guy, should I accept or should I commit the block in my local blockchain or not. Now, what's my payoff. So if I commit and all other honest agents do, then I'm going to get R. If I commit, but some other honest agents do not, then I'm going to be punished and I'm going to get minus C. If I don't commit, you know, whatever irrespective of what other people do I get zero. Okay, so here, I mean it's pretty easy to see that I'd better commit if I sing that everybody else can't otherwise I'm going to get this minus C. Okay, so that's the simpler, the simple setup here and I'm going to go through a simpler setup, but I don't know if it's simpler, but it was simpler to me. So, and it's going to be to replace the continuum of agents by a finite number of agents. Okay, so now you should think of it as there's a finite number of honest agent and a finite number of Byzantine agents. It's simpler because then we don't enter into this measure theoretic issues. I'm going to also make it simpler because I'm only going to first consider when this this problem when there is only one round of message. Okay, so essentially a leader is selected and this leader has to send messages and then people have to say, should I commit or not? Okay, and that's it. So there's no second round of communication. So here is the how it plays out. So here you have some honest guys. So these are the black the black figures here and then you have some Byzantine agents. These are the red figures here. Okay, so suppose that here you have one honest leader that is selected and the guy is going to communicate to these agents a block. So to reach consensus, you know, it has to be that this leader sends the block to everybody. The leader, this honest agent here doesn't care if agents who receive that blocks are Byzantine or honest, you know, but this leader wants the honest guy to receive this message. So the honest leader will have to send the same message to all these agents. That's what the honest leader will do. Knowing that the leader is honest, the honest agents, they expect that everybody else received this message. And therefore, then there's going to be two equilibrium, one where they commit to the block and then they receive a Bay of R and one when they don't. Okay, and then they get zero. Okay, so why wouldn't they commit? Well, because they expect at least one other agent not to commit and therefore it's optimal for them not to commit. So you always have this gridlock equilibrium, which the computing literature, they don't have because they always, they always assume that agents behave because they don't have this incentive issues. But here we will always have this gridlock equilibrium. Okay, so this is when you know that the leader is honest. Now suppose that the leader is Byzantine. Okay, so if the leader is Byzantine. So suppose is that the Byzantine leader will seek to impose damage. So to speak on the on the system. So the maximum damage here is going to be imposed when the Byzantine leader sends a block to all but one honest agent. Okay, why because this honest agent here, he doesn't know what the block is so he cannot agree on the block and he cannot add it on the blockchain on his local blockchain. So the definition of consensus, which was that all honest agent have to commit. You know, even if all the honest agent who received the information commit, you won't have consensus because of this loan guy here. Okay, so now the problem is, you know, these, these honest agent who received the information, of course, they don't know if if the leader is honest or not. The future is actually going to to select the leader randomly. Okay, so the probability that the leader is honest is going to be the fraction of honest agents in this economy. The probability that the leader is Byzantine is going to be the fraction of Byzantine agents in this economy. So in terms of expected payoff, you know, you know that if the leader is honest, you will reach consensus and you will get R, you know that if the leader is Byzantine, you won't and you will get punished by minus C. So at the end of the day, you commit if your expected payoff is positive. Okay, so this was the condition that Anna was showing in the E0 equilibrium, I think, or I forgot. Anyway, so this is also their expected payoff from actually committing. Okay, so here you can see that agents will commit only if the reward they get from committing is high enough. Okay, now the question is, can we do better? Okay. So that's that's pretty good, we can reach consensus, but some of the time the consensus is not going to be good because actually we don't reach consensus. Some of the time, and the issue is by adding a layer of communication, can we do better than that in terms of expected payoff. So this is what this slide is about. So here suppose that so we already know that if the leader is honest, you know you achieve consensus. Now suppose that the leader is Byzantine. Okay, so you have this lone guy here, the blue guy who didn't get any information. Now you need to reach these guys. So how do you do it? Well by adding another layer of communication, you can ask all the agents to again send the block that they received from the leader. So if all send, so the honest leader here, it's as if they become a leader in the second stage. They each become a leader. And so their optimal strategy is just to send that block to everybody else, because then the blue guy becomes informed. So if the blue guy becomes informed about the block, you know, all the honest guys, the black guys here, they will expect that everybody got the information about the block. And then it's an optimal strategy for them. I mean, you always have the gridlock equilibrium, but it's also an equilibrium to commit. Okay. So, given this, you know, what is the best strategy for the Byzantine leader, the best that wants to minimize the payoff of the honest agents. Here's the best strategy is not to submit any block. Okay, so if the leader is Byzantine, the Byzantine leader knows that by sending a block, everybody will become informed about that block. And so the bit the leader, the Byzantine leader is going to say, well, you know, if I want to minimize the payoff of these agents, I'd better send nothing. But if the Byzantine leader doesn't send anything, then, you know, these agents, they get zero as a payoff. So the expected payoff in this economy for these honest agents, then it's just the probability that the leader is honest, and then they get the reward of consent of researching consensus. And when the leader is Byzantine, then they get zero. But as you can see, now the payoff is higher than before when you had only one round of communication. So here communication is helping quite a lot. And it's helping because it forces the Byzantine leader to stay quiet. Okay. And not to sort of screw up the system. You have three minutes left. Yeah, thank you. So this was on 10 minutes or 15 minutes. Oh my God. So, you know, if you have multiple messages, that actually doesn't affect the result. The reason, and I'm going to skip that slide, I can come back to it if you want later on. Now, what affects the result if the failure to deliver messages? Okay, so Anna talked about message fails. And so it's essentially that when a leader communicates a block, it only reaches a node with priority Pi. Okay, so here, since there is n minus F honest leaders, the probability that they all become informed is going to be given by Pi to the power and minus F. Okay. Now, with a Byzantine leader here, you know, the Byzantine leader might want to inflict maximum damage on the on the system. And you know, I'm going to assume that here the honestly, the Byzantine leader sends up to only one honest guy. I mean, now the honest guy is going to send the message to everybody else. And again, the probability that it reaches everybody else is going to be n minus F minus one. So at the end of the day, what you get is that agents commit whenever the probability. I mean, whenever there's a sufficiently high probability that they can reach consensus. So again, this is a probability of reaching consensus that the message gets to everybody. And this is the probability that it doesn't get to anybody. And this actually is interesting. What's interesting here is that this effect that the message doesn't reach anybody also appears when the leader is honest. Okay, so you always get that here. Now, as you can see here, as the number of honest agents increase, you know, you need to increase the reward. So that agents commit like, you know, more than proportionately. So actually are the reward is becoming a convex function of the number of honest agent. So this means that as, you know, the distributed ledger is acquired or updated by more and more agents in the economy, the higher and the higher the reward has to become. Okay, so what are the key takeaways from all this. And actually, you know, this is Anna's paper. So from Anna's paper. So the one thing is that there always exists a gridlock equilibrium. And that's new layers. So more layers of communication help consensus. And I think that's that's quite important. And more distribution, which means a higher number of agents implies that there should be more communication. And that actually makes it even more difficult to achieve consensus when there is message fails. And, you know, so you should have higher rewards as falls become increasingly likely. And I think that's that's interesting. So basically, the fact that, you know, the reward function is convex also is quite interesting because it means that as more and more people participate, the higher the reward has to become. And this is convex it's not linear. Final remark so you know, the, I didn't do, you know, I didn't do credit to, you know, the paper in the sense that take, I mean the technicality in the paper they are really nice. And I love the paper for characterizing all symmetric equilibria that's really nice. There's really nice proof using iterated deletion of the mediated strategies. I really recommend reading it. Now I'm wondering if this could be simplified by determining the objective of the honest leader. In particular, the honest leader as a first move advantage. And so it should be possible to actually, you know, by by really specifying what the objective of this guy is, you know, to determine what he's going to do. In particular, it seems to me that, you know, the best, and you know, this is sort of what Anna was was referring to the best strategy of these guys always to communicate the block to everybody. Okay, so to choose peak or one. Okay, then let me skip this one. So one, I think important remark is that here, consensus is on anything. Okay, so it's like, that's what I call an anything goes consensus. In the sense that you want to reach consensus on whatever information is sent by the leader. But it seems to me that, you know, you want them the content of the message to be correct. In particular, you don't want, for instance, a block to have like a double spend transaction. Consensus on the wrong information might jeopardize the whole system. So what I, you know, the way I read the paper is really as a benchmark paper where, you know, we want to reach consensus on information. The next step should be reaching consensus, but on the right information. And, you know, we know that, I mean, or I know that it's hard to do. We have a recent paper with Rod Garrett where we actually show that reaching truth telling in a decentralized setting is we call it impossible. So, you know, it's hard to reach consensus on the truth. So it's sort of, I'm going to wave my hand is sort of easy to reach consensus. Anna's paper show it's not easy at all. Okay. But the next step is to reach consensus on the truth. Last slide. I was wondering if adding communication rounds would help. Okay, because here you only have one communication. You have two communication rounds. And I'm wondering if, you know, adding one more helps in any way. I mean, given you have a continuum, a continuum of agents, I'm wondering if that's really helping with a discrete finite number of agents. It might help. And it might actually help to go sequential. Anyway, so I'm wondering about that. Now, the other question is your, the notion of consensus you use is very strong, right is that every honest agents have to agree. And I'm just wondering, you know, if you have 99% of an agent agreeing, would that be enough for the system to be viable. You know, in the long run, maybe it's not and then it would be a very interesting result to have. The final word on the last slide is that, you know, to me, this is a must read paper and consensus on distributed ledger. It provides a really interesting benchmark for future studies. So if you're interested in that you should definitely read it and thanks for giving me more time. Thank you very much. See, Hannah, would you like to respond to, to serious comments. So our first of all, thank you very much for, for fantastic comments. It's a, it may be a very illustrative example for us to use even in the paper to use this discrete, discrete number of number of users to kind of show what what's going on. And, and I would say that, you know, the things that you are wondering about the one in the last slide, we're also wondering about so will the more and more rounds of communication would it help. And it may not necessarily as you're pointing out with continuum of agents, but you pointed out that, you know, what if we have only 99% consensus. So we were following computer scientific literature, which we're saying like we only care if everybody everybody agrees and if you think about, you know, potential use of blockchain for inter banking system. We don't really want you know 99% you know 1% chance that we are getting forks and one bank has a different ledger than everybody else right we don't want to run into this problem and we're only going to think about systems that are going to give us this 100% guarantee. What happens is that if we combine this, what if we get 99% consensus in one round but now we have multiple rounds of communication, we can iron it out so we can we can actually combine those two, even with continuum of users. So, so this is the, this is, we are thinking and wondering exactly along the same, the same ways. I wanted to kind of comment also on this truth in blockchain. So, right from the beginning when we're thinking about a proof of work blockchains. There wasn't really a notion of true the reason why we have longest chain attacks is because as long as majority of the of the network agrees on something this becomes true. And this is why you can override the history as long as we, you know, majority of us agrees to overrun it. And the same thing may happen in proof of stake and in other situations as well so this, you know, I will, I will very much reach your paper with with road. And the idea of having blockchain being also the source source of true is actually going back to a very philosophical problem of how do we know that a given sentence is true. We need to have external Oracle to do that and we know, even in blockchain world that once we start dealing with Oracle we enter in, you know, a whole new realm of problems. And that's the case, the case here. So like you said, we are just focusing on even reaching consensus on just any message that is, that is problematic. So overall, thank you very much for the for both the, you know, the comments the clarification the example and, you know, thinking along the same lines about the future questions. So let's see if there are questions or comments from the audience, and we have a number of panelists who can unmute and speak. All the others can use the Q&A area to post questions or comments. So, I guess, yeah. I have a question which is related I think to Cyril's idea of truth but if you're thinking of a Byzantine leader who's trying to do maximum damage. You assume that maximum damage means not reaching consensus, but I think Cyril implicitly we're saying maximum damage could be reaching consensus on the wrong thing. So that's not exactly how he phrased his comment but I was wondering if you thought about this, and how that would complicate your analysis. I imagine you haven't considered because it would just complicate things a lot but but I would be interested in any thoughts you have. Well, I mean, I haven't thought we haven't thought about it, you know, to put it in the paper but definitely we have thoughts about it in the in general context. So, you know, one thing is, what would be this damage on the wrong consensus on the wrong message. So Cyril said, Well, how about double spent this we can actually mechanically exclude because double spent transactions will raise red flags and those are not considered to be committable messages to the existing to existing existing blockchain so this would not work. So basically, let's say we have two conflicting to conflicting transactions, I'm sending money to Cyril and I'm sending money to Russ, and you know one of them gets into the blockchain and the other one is deemed invalid automatically. So, if I am this Byzantine agent, I am sending money to Cyril and then I'm in cahoots with Russ so I'm actually trying to get the first transaction that the transaction is more favorable to me on the blockchain first. Right. So, is this the, you know, is this the maximum damage. If this is a maximum damage that we already have rules of blockchains that are preventing that. So only if Cyril sees that the transaction on the blockchain then he gives me a bicycle that I was buying and not before. And because he sees it on the blockchain it means that the transaction you know where I'm sending the same money to us did not go in because it would be conflicting. So there is the question is how much damage can be done by putting in the wrong message. I think there may be more of this damage done in more permissioned settings where we don't have enough safeguards already against this. Any other questions? Then let me ask something Hannah in the, as you mentioned this is a very old classic problem in computer science and the solution back then to the Byzantine general problem was exactly about the proportion that you had between all Byzantine notes and honest notes. So how does that work in your in your model, you know that the proportion that what would happen if you would exclude all Byzantine notes and kind of do a Satoshi thing and say everyone is rational. Okay, so we say our rational notes have ambiguity, our ambiguity averse to the strategies of Byzantine notes. The way to interpret it is that, well, everybody may be rational. It just for notes that we call rational they are maximizing their payoffs within the system. And Byzantine notes maximize their payoffs that may come from wherever it may be, you know, I may be a hacker who wants to bring down the system, or I may be a, you know, an aspiring hacker who wants to show ability to get into a group of hackers to do something else. Right, we don't know what their objectives are. And therefore we are not looking at the strategies that are that are maximizing their payoffs. But yes, we can clearly say that they are, they are maximizing maximizing payoffs and they are rational it just not everybody is only not everybody's objective is solely included in the in the in the protocol right so this is now the when the question of the number of Byzantine notes so notes who would have objectives that may be outside of the protocol. We have in our formulas so all our formulas are affected by this number F, both N and F and the difference. And that means that given the the number of the expectations of the of the of how many Byzantine notes we have the range of where do we commit for where do we commit the new batch of transactions to the ledger is going to change. Thank you. I saw dear had his hands up. Yeah, do we still have a second or so I was wondering, I'm not sure what I fully understood that the pie factor so the probability that the message is sort of corrupted. So, could it help in that context that you sort of partition the set of the recipients and let them individually each of the individual groups coordinate on what signal they thought they have received and then later on, re aggregate sort of the signal rather than having everybody receive the signal and go into the second round is that a way to sort of deal with this convexity that you can sort of structure the set of the recipients and they're re communicating in a different way than doing it linearly across everybody. I'm not sure what I'm clear and trying to phrase what I have in mind. There is a question more to Cyril, then, then, then, but I guess so and so the idea is that it disappeared to pure network, and you are forwarding messages to other users, you're signing the messages. So, so in a way everybody with some probabilities going to get message from you, you could potentially say, oh, I got a message from you that you got this message and I didn't get it from, you know, from the other note so let us communicate and figure out potentially, yes, I'm not sure whether this is actually going to be a site of the fight is going to increase the number of messages and latency of making any decision. It's not clear whether it actually is going to make a difference because in the end when you are going to aggregate it it's going the aggregation will depend on the relative weights of this of the system of the of the two groups. So, if I understand your comments, the, the message of losses is idiosyncratic. So, in proportion, there's always some people get in the message some people do not and then in the second round you just mix it again so in some sense that I think it's addressing your question. I think you go there in example that Cyril provided which was in discrete world there was always possibility that some fraction is not getting message at all and this is what gave the complexity. Oh, I see in your model that's not there. And in the in the continuum model, it's not happening because in continuum model, when we have continuum all large number of nodes or large number of rounds, the probability that that somebody did not get any messages just due to the compounded loss is going to zero. I see. Okay, thank you. We still have time for one or two questions given that we gave more time to the discussant. Next there's time I'll ask a question. So, the, the assumption of the ambiguity aversion seems kind of strong. You know, for example, I thinking about Cyril's first example. If I got a message, you know, I'm thinking either it's an honest leader and we all got the message, or it's a Byzantine leader and I was selected into you know I was the one who was chosen to receive the message. I think about how likely those are and you know sort of if I started as a Bayesian and there are a large number of people. I'm going to think it's very likely the honest leader, but if I'm ambiguity first and I act as if it's the Byzantine leader. So in that sense it feels strong and I'm just wondering is it possible and move away from that and sort of be more Bayesian and are there ways to do that and would it change things. Yes. So yes, and possibly depending on which of the questions I know of your questions I'm answering so yes it is possible to move away from it. So let me start with justification why we started with that assumption. This assumption that is taken directly from CS literature and the assumption that is that this use in CS that we always take the worst case scenario for the for the Byzantine leader for the Byzantine nodes because it may be one attacker that hacked all the nodes. Potentially, but we actually don't know what they would be doing. So this is why this worst case scenario assumption. We have worst case scenario assumption. And, and it is, you know, because it's strong it kind of gives us the strongest possible conditions on the equilibrium. If those are satisfied and we are in a good shape. Now, is it possible to step away. It is possible to step away but the model, in fact, becomes much more complicated, because much more complicated because now and a little bit more shaky in a way because now we need to make assumptions about what the enemy leader wants. And, and guessing what the attacker wants. It's, it's just, you know, it's always shaky and uncertain that they want to really be, you know, destabilize the system and and destroy it. Do they want to just destabilize the system to show their power and therefore extract some rent. Do they want to and so on. Now, even if we assume are just one particular objective. So we are getting into multiple, multiple strategies that may, that may, that may work just as well for the Byzantine note we are getting into mixed strategy equilibria and then we are getting into a much larger set of potential potential equilibrium characterizations. I see. Thanks. But in a way we are all working on it. So this is why I, you know, I can give you this answer with a little bit more detail. I have a couple of questions. We have one in the Q&A box that goes way beyond your paper. And basically it asks about the use cases for for DLT, including I don't know whether you want to take, whether you want to take a stab at it or leave that up to your fellow central bankers. So I'm, what are the, what will be the future business uses use cases in order to add value. So, well, let me, let me say that, you know, we were asking this question we know far more about technology and about potential ways in trying to implement it. Then we know about the potential benefits of implementing it, which I think is pretty bizarre and the questions why why would we still need it are popping up all over the place even though we are actively implementing and designing those systems. And, you know, the idea of having a shared ledger that is allowing for, you know, immediate settlement not immediate settlement but the thing is like that it is removing the need to coordinate individual ledgers, having a system that kind of by design coordinates those individual ledgers by a protocol is very enticing, right. So this is why we keep thinking of interbank settlement layer or any supply chain layer any anywhere where we're constantly sending our sending messages in order to reconcile individual ledgers. This is exactly what the consensus mechanism is doing is setting up everyone on a joint system so that we automatically are reconciling our individual ledgers right this is where we get consensus when we all have the same ledger. So, so I think that there are a lot of, you know, it kind of is going to distributed ledger systems are going to get and become this middle layer. In the use in the use cases where the end users will not care anymore the same way that we don't care anymore about internet because internet is everywhere, and it makes communication easier, but it definitely has a lot of a lot of impact. But this kind of I think that the ease of reconciling individual ledgers will have a lot of uses. Thank you very much. Thanks, Hannah. Thanks, Siri. Let me hand back to you, Jonathan. Thank you again to Thomas, Hannah and Siri for the very informative and for provoking discussion and to all of you for participating today. And we hope you will join us again next week for the CPR webinar and next month for the job market candidate workshop. Until then I hope you have a pleasant day and a nice weekend. Thank you.