 So then why is crypto-economics different from just regular old economics? Well, it's the environment. We live in a very different environment with the decentralization and trustlessness that makes economics a lot more difficult. We cannot rely on an outside law enforcement that makes people follow what we do. Instead, it's a very adversarial environment where we only assume that people are rational, meaning that people maximise their own payals and do what's best for them. This is also what makes it very exciting in my opinion. Where crypto-economics really started was with the game theory of the Bitcoin protocol. So game theory is the study of strategic behaviour or how you would respond to situations in which other people also make decisions about how they behave. Importantly for the Bitcoin protocol is that you have a decision in which chain to mine. You could either mine on the longest chain or on another fork. And this decision is something that every miner actually has to make. And you're incentivised to mine on the longest chain because you'll get some issuance rewards and fees. And if you mine on another chain and it's not included in the canonical chain, you only waste your energy spending on this, meaning that you're incentivised to do the right thing. Now in game theory, we usually put these kind of games into tables to make it easier for ourselves to see what's happening, what other players are doing, and how we can determine our own strategy. So as you can see here, assume that you're a Bitcoin miner doubting to mine on the longest chain, what you're supposed to do, or on another chain for the next block. And all of the other miners we've aggregated into one group as well, and they're simultaneously deciding on their strategy as well. So in this table, the first emoji corresponds to the utility or payoff of the person in the first column. So that's you as a miner. And the second emoji corresponds to what all of the other players are doing. And we can see that since all the other players are in this situation mining on the same chain, they'll always be happy as that chain will be the canonical chain. However, for you deciding on which chain to mine on, it's important to think about what are you doing on the longest chain or on the other chain. And then how you could determine your strategy is to see, given that other people are mining on the longest chain, what maximise my payoff? Well, in this case, mining on the longest chain as well. And given that other players are mining on another chain, what maximise my payoff? Well, mining on the other chain. So since every player in this situation has the same strategy, we actually end up in a point where there's a steady state. Everyone mines on the same chain, hopefully. And the steady state is what we call a Nash equilibrium, because no one has a straight sense of deviate from this situation. So if you're mining on the long chain, if you mine on another chain, it means that your payoff will be less, meaning that you don't have an incentive to deviate. So this is the game theory part of crypto economics, a small introduction. And now we'll introduce a bit more theory called mechanism design. So mechanism design is really the study of designing strategic situations with game theory in mind. So how can we make games so that the payoff or the outcome is how we want it to be? An example could be when we're designing an auction. We want people to have an easy way to bid. So for example, bid their true valuation of something. And we want that to be incentive compatible with the protocol. So incentive compatibility means that the designers have a goal in mind and the strategy that users are going to deploy reaches that goal. So in that case, we could use game theory to see what's the strategy and how can we design about this. And it's always very important to take into account what you're actually designing for. So there have been some famous mistakes. For example, some Olympic games where the pools weren't made correctly and some teams actually both tried to lose, which is a very weird setting. So then if you turn back to our example of the miners in Bitcoin, Bitcoin enforces that everyone mines on the longest chain, which is what the protocol wants them to do, by issuing rewards only for those mined on the longest chain. So this was a section about game theory and mechanism design and bit more theoretical setting. These will have more into applied settings. But if anyone has any suggestions, questions or anything, please just raise your hand. If not, we'll just continue to how the gas market works. So many of you have probably heard of Vitalik's speech this morning. He talked a bit about the gas markets. And I'll try to elaborate a bit on that. So the gas market is basically for any transaction that you send to Ethereum, you pay gas. And how this gas is constructed is dependent on the amount of operations and the type of operations that you do in a transaction. So each operation or opcode has a fixed amount of gas units that are associated with it. So, for example, multiplying two numbers to five units of gas and adding two numbers to three units of gas. And this ratio is relatively defined. So five, three ratio, and this doesn't change. But this may be weird because, as you may have noticed, the amount that you pay for your transactions isn't actually fixed. This is because the amount of ETH that you pay per gas unit, so these are two separate markets, is determined by supply and demand. It's important to have this distinction between the amount of gas units and the amount of ETH that you pay per gas unit. We have a gas limit to preserve decentralization, which of course is a tool of the protocol. And this is done because if we could make the trade-off for a higher gas limit, so more gas units per block, and this means lower fees, more transactions, but it means less decentralization because less people would be able to participate in a protocol, less people would be able to validate, meaning that we miss one of the goals of decentralization. And how blocks are in principle made is that a miner sees all of the transactions that come into the mempool, and they choose the transactions that are paid the highest fee per gas unit, and they basically just fill their block with the highest-paid transactions. Again, the rationality assumption that we talked about before. Important to note here as well is that this is the pre-ERP 1559 gas market. I'll talk a bit about this ERP later, but this is the simplest setting how it was before some time ago in Ethereum. Then this auction for block space, an auction in which we sell a scarce resource, which is block space, which is what the Ethereum protocol sells, is actually a first-priced auction. So players bid for the transaction to be included, and if they win the bid, when they auction, they just pay their bid, and they're included. However, this is not an ideal setting, because it's very difficult as users to know what to bid exactly. If you bid your true valuation, you get your transaction in, but you also pay everything in gas fee, so you're not really better off. So you're going to shade a bit and going to bid a bit lower, lower, lower, but you don't really know how much to bid. And it's also difficult for the protocol, because in some cases, people that actually have more valuable transactions that were willing to bid more are not included, while people that have lower value transactions are included, because it's difficult to determine your bidding strategy. How could we design an auction mechanism for Ethereum in which block space is sold in an incentive-capacitable manner, so that people can just bid their true valuation and don't have to worry about shading? We have second-price auctions. In principle, these are very simple. We are auctioning off the scarce resource again in block space, and if you win an auction, you pay the second-price bid. So, for example, if I bid 10-eath, you bid 14-eath, and two other people bid 5-1-eath, you win the auction with your 14-eath bid, but you only pay my bid of 10-eath, which is the second-price bid. And the nice thing about this property is that we can mathematically prove that, in this case, it's dominant strategy incentive compatible, and this means that every person has a strategy independent of what other players are doing to simply bid their true valuation. This maximizes their utility, maximizes their payoff, and because every user is going to do this, we end up in the national equilibrium we talked about before. And this is actually great because now we have a national equilibrium that we, as opposed to what we want. So, why wouldn't we just implement the second-price auction? This is an open question, so if anyone has a suggestion why we can't implement the second-price auction in Ethereum, so you mean that you know what everyone bids, so you can't implement the second-price auction, because then you can just bid yourself. Yeah, exactly. So, because of the adversarial setting, miners will maximize their payoff. So, let's say that you have a block in which there are four transactions, someone paying 10 fees, 8 fees, 7 fees, and 2 fees, and we'll assume here that the second-price version works in the case where you just bid the lowest transaction that's included in the block, then every user will have to pay 2 fees if the miner uses the real transactions. However, the miner can, in the adversarial setting, maximize their payoff by stuffing the block with a known transaction. So, they switch out the transaction paying 2 fees, insert one of six, and now three people pay six in fees instead of four people paying eight, meaning that they maximize their payoff. And this is something that can be easily done by a miner and it's very difficult to detect. Therefore, we can't implement these kind of mechanisms, which is unfortunate, because as we have seen, there are quite a few negative consequences of first-price auctions, for example, the priority gas auction, or PGA for short. This means that if there's a very valuable blotch base, you may want to have your transaction included before other players. So, for example, if there's an NFT minting and there's only one NFT, you want to be the first one to mint this NFT, but other players may also want to mint it. So, let's say this NFT is worth 100 ETH. You're willing to pay up to 100 ETH in gas fees, but of course, you want to shade your bid as much as possible and pay as little as possible. And that's what we see here. On the y-axis, we see gas bids in grey, and on the x-axis, we see time. And the orange triangles are bids by one bot who is searching through Ethereum, seeing if there are valuable transactions they want a bid for. And the blue is a similar bot, but just a different one. On the green star, we see where the bot is at one, and the red bot is the bot that lost. And you see that the bids are increasing over time, outbidding each other iteratively by small amounts to matchmise their payoff. And now, why this is exactly bad for the protocol is because it spams the mempool. It makes sure that even transactions that don't win, so transactions that aren't the green one, are also included in the block because they pay a lot of gas fees, so miners are incentivised to include them in the block, meaning that the block is filled up with transactions that revert, they do nothing, and they basically only waste block space. And since block space is now more scarce, gas fees go up, which is bad for everyone, of course. So an elegant solution that was thought of for this is ERP1559, as I spoke about before. And basically what this does is it transforms the fee market into something that resembles more of a second price auction. So now, up until ERP1559, you just pay the gas fees and those go to the block builder, and they can put all of their profits in the pockets. But now, there's a base fee that's determined by the protocol and amount that you give to the block builder, and this base fee is burnt, so there's no incentive for people to try and make off-chain agreements, giving you parts of the base fee. And this makes the bidding for block space very different, because now blocks in general aren't full, so miners are just incentivised to include whichever transaction pays them enough tip to be included. So bidding has become a lot easier. You basically just pay the base fee and you add a very small amount of grey that's constant over time, and this means that your strategy of bidding is basically incentive compatible with how the protocol wants you to do, so it resembles kind of a second price auction, and you can just bid their true value. And also, it's a common misconception that ERP1559 decreases total fees or gas fees that users pay, and this is not the case because it's only a mechanism of how users bid for their transactions to be included. The block space in the long run is not increased, meaning that gas fees don't decrease, because the supply and demand are still the same. So that was the part about gas fees. If anyone has a question, ERP1559 is quite interesting, so I'd be happy to take anything, but otherwise we'll just continue with maximum attractable value, which is also a very interesting subject. It's a subject which has a lot of applications and there are many papers written about this, so it's definitely worth checking out, but we'll give a brief introduction to it. So maximum attractable value means that you attract as much value as you can from the Ethereum network. So how this is done is we'll start by looking at how transactions come into the block, as we talked about before, users submit their transactions and they're included in the mempool at first, so all block builders, searchers, searcher people who extract MIV can look and they try to maximize their own payoff. So for example, if you submit a transaction to the mempool, trading token A for token B, and it's a very large trade, the price of this pair is going to switch. So as someone searching through the mempool, you could think that this is going to happen, so in that case, I'll bid, place a transaction just before this in the block so that I can buy token B before it increases in price, meaning that I have an arbitrage, a risk-free profit, and this is what happens a lot. And why this is possible is because the ordering in the block is not fixed. It's not the case that if you submit your transaction, it's included in the block on a time basis. Anyone can shift the order, or actually builders can shift the order, or if someone is willing to pay for it, they can shift the order as well, meaning that they could extract any value from users in the Ethereum network. So interestingly about this, this is very similar in some sense to high-frequency trading in traditional finance. In the blockchain, the difference is that you can actually execute these strategies atomically, meaning that if you have one transaction in the mempool that you would like to do some MEV on, you can include your transactions only if they're profitable. So in this case, there's really no way to lose money. So this all sounds very bad. Users are being value-attracted, it makes execution worse for users. Why wouldn't we just forbid MEV? Well, it's not as simple. MEV is quite powerful for us, so we'll have a look at why some people think MEV is good and why some people think MEV is bad. So on the one hand, people argue that MEV is bad, because searchers find almost all transactions in the mempool that they can do MEV on, and they make sure that your execution is as bad as possible, which is of course not something that you like. Also interestingly, MEV incentivizes centralization. Again, if we look back to the comparison with high-frequency trading in traditional finance, these are usually the corporations with multiple billion-dollar budgets. They have very big infrastructure operations, and some similar arguments can be made for MEV. You need to stand the mempool. There are multiple strategies that require high investments, meaning that there are economies to scale, which is a centralizing force, which is of course not something that you want. And it's actually been towards it as one of the threats to the Ethereum. Search is waste blood space. This is what we saw before in the priority gas auctions, where transactions that are reverted or do nothing are included, pushing up gas prices. And MEV searches are generally very smart, so they could put their time and efforts into building other great projects that contribute to the ecosystem. But some people argue that this is very bad. On the other hand, there's an argument to be made that MEV is good or maybe this is a bit un-nuanced. MEV might not be extremely good, but it's worth extracting or the way to deal with MEV is not to just ignore it. There's an argument that some searches provide very valuable services to the network. For example, if there are two liquidity pools and then the one pool token A and B are trading for, well, you can get five tokens at B for one token A, and then the other pool, you can get 10 token B for one token A. This is, of course, a mismatch. And searchers, they can do an arbitrage transaction here, making the prices again equal, so that users in general have better execution if they trade in one of these pools randomly. Also, liquidations for lending platforms, if there's bad debt, searchers liquidate and the people that lend out the money are protected. And these are generally recognized as quite good parts of MEV. MEV can be redistributed, so it's an interesting line of research where the idea is that you extract all of the MEV, but then the MEV is redistributed to users. For example, as a user, if you submit a large transaction that's going to shift prices, you could make an agreement with someone that's going to extract from you. Let's say they make one e-profit by extracting from you, you could get an agreement saying that, okay, you have to pay me back at least 90% or something of this extraction, and then it's fine. So in this case, MEV wouldn't be as toxic as it would be normally. And another big argument is that MEV needs to be attracted to ensure political safety. There are quite some proposals to ensure political safety by other means, but the extraction and redistribution seems like an argument which is very holistic, meaning that users don't fall through the tracks. And there are no incentives to be very quick or not. So it's very difficult to say whether MEV is actually very good or if it's particularly bad. It's easy to say that MEV cannot be ignored. Why it's not really settled is because there are lots of nuances as well. For example, some back runs that we talked about before that make sure that prices in liquidity pools are equal, are seen as bad. For example, if you have a lot of transactions trading E for Bitcoin and Bitcoin for ETH and the other way around, you can first align all of the transactions trading E for Bitcoin and then back run by basically first having all the users pay up the price and then taking free arbitrage profits, which would be seen as a bad back run. So not all MEV can be detected and not all MEV can be easily classified into good or bad, meaning that it's not as easy to say that we should do particular things with it. However, there are things to be done. So some responsibility lies with DAP developers. You could design your DAPs with, for example, mechanism design and game theory in mind such that your users aren't extracted from too much. This is something that's very important and is an increasing line of research. And we can't say that's all of the responsibility lies with DAP developers because some MEV cannot be mitigated by only one DAP. It's a contribution of multiple factors, multiple transactions that may be unrelated, meaning that there is also a role for the protocol to make sure that users aren't extracted too much from. And now we'll be going a bit into ongoing research that we do at the EF, at the robust incentives group. So I would also like to invite Barne Bay for this. And if you have any questions, do let us know. We'll be happy to talk about what we do. We do basically crypto economic research on the foundation of the assumptions that we talked about earlier. So are there any questions about what we talked about up to now? I think MEV is also irrespective of sharding in some sense. So there are, for example, cross-domain MEV opportunities that don't simply disappear because of sharding. So no, I don't think it would disappear. We mitigated somehow if most of the user transactions moved to like rollups, and rollups are the ones who use the data sharding facilities that we're now building at protocol level. In that case, most of the MEV maybe accumulates at the rollup level, and you might not see so much of it at the base layer of Ethereum. But yeah, as Julian said, because rollups don't just live in their single world, for instance, you have designs for pooled liquidity where different rollups could use the same liquidity that resides at the base layer or at some settlement layer. You could see that some of the MEV sort of percolates down to where the liquidity is. So many people I think are trying to build models, including us. So rollup economics is something that we're trying to think about to see how the value flows from the users to the protocols, to protocols which are on top of Ethereum, and MEV is a part of it. So maybe I'll explain what the sandwich attack is in general. So if there's a transaction moving prices, you can put your transaction in front and the transaction at the back, so back running, and profiting at both sides. And in this case, you have a transaction in between two of your transactions which makes a sandwich, which is seen in general, I think, as a toxic form of MEV. Yeah, also in traditional finance, it's a difficult argument, I think. It's not as nuanced that when market making isn't... Yeah, it's not as atomic arbitrage as it's here. Like, you have 100% chance of making money, and if it's not profitable, you simply let your transaction not execute. But there are quite some parallels we made between MEV and high-frequency trading in traditional finance. Traditional finance, when you see high-frequency trading, a lot of value goes to, I don't know, putting your computer next to the New York Stock Exchange, or billions of dollars to shave off nanoseconds to your strategies. This is economic value that just leaves the market and goes towards people who build all this infrastructure. Maybe one of the opportunities that we have with the protocol with respect to MEV is if it can be captured efficiently, that this value could serve to strengthen protocol security rather than hamper it. So, of course, it doesn't mean that, yeah, let's get user sandwiched because that gives us more value for protocol safety. I think, of course, we should design dapps such that these bad outcomes don't happen. So, for sandwiches specifically, there's many different proposals that I would say realize different trade-offs that users might have. So, just mentioning some of the top of my head. One is encryption, so your transaction could go encrypted, be committed to, and then executed, so people can't send you to because you don't know what happens. The trade-off here, of course, is that the execution latency is a bit higher, but maybe as a user, you're fine with this. Another idea is receive time ordering consensus. So, there's this idea that if transaction A is seen by most of the network before transaction B, then transaction A should be included in the block before transaction B. It's, in theory, I think a property that is really nice, but again, because we're in a decentralized system, there's no one that reports, oh, I've seen A before B, so A must be before B. And again, you can have these games of co-location. Again, trade-offs here as well. Another thing that I would say is a relatively new idea is the idea of offering your order flow, so getting paid for your transaction, saying, well, if my transaction is so valuable to you, you should pay for it. That's what Julien also introduced earlier. I hope that we'll see more protocols in that direction because these are the ones, in my opinion, that make the users whole and also allow the protocol to capture some of that MEV. I don't want to comment on flashbots specifically because I'm not working for flashbots, but I would say flashbots of other people in this ecosystem are trying to understand MEV from first principle where it comes from. The view, of course, is to use it as a force for good, so trying to ensure that it doesn't destabilize the protocol, that it doesn't hurt the users. Yeah, so part of that comes from mitigating it if it's bad. Part of it comes from containing it and maybe capturing it if it's good. Yeah, I would say these are broad strokes of the ecosystem. Yeah, sure. So multidimensional gas fees is very different from MEV. It's not related. It means that now we pay gas for any kind of operation that you do. Whether you store something on the blockchain or whether you do just simple operations like multiplying. We all tram this cost of computation and cost of storage into one unit, which we call gas, but we could split this up into multiple units so that you pay more directly for what you use. So if you're trying to store things, you pay for that you store and you don't congest the blockchain with... So in this case, the gas limit is set so that people aren't... their computers aren't overwhelmed, but for example, if you have lots of transactions only using one particular thing like if there are only transactions using storage, there's lots of operations that could still be executed by people. And so in this case, multidimensional gas would mean that these computers are used more efficiently basically and more transactions could be executed. Yeah, adding to this, if you've heard about rollups, so the idea of rollups is there are chains that exist outside of the Ethereum base layer. There are chains to secure themselves with Ethereum. They have to post data to the Ethereum base layer. Basically, the kind of summary of what happened on the chain. So this data is not executed. So it doesn't add execution or execution cost to the base layer, but it needs to be made available and stored. For instance, these are two separate types of resources. Probably, if you've heard of EIP 4844, the idea of providing a much greater data capacity at the Ethereum base layer is separating the market between the Ethereum execution and the market for data that rollups are posting. In that case, you would have something like two base fees, or you would have the way to differentiate between two markets. So what we are personally working on is, for example, MEV, multidimensional gas, proposability separation, as David talked about, and I've worked basically on block space derivatives and hedge against gas fees rising in the future. Yeah, if you'd like to talk about that, please find us. Yeah, and I would say CryptoEconomics is relatively new as a field. There's a lot of people who don't have traditional economics background or even computer science background who get interested in it. So, yeah, the barrier to entry feels a little lower, mostly because there's a lot of resources now that are available. If you go into the DevCon video archive, there's lots of talks on CryptoEconomics that are interesting. And, yeah, if you think it's fun, I think both Julian and me would be also happy to answer questions offline. Talking about resources, we compile the list. So in the table, there are some collectives or groups that publish research on CryptoEconomics. And in the bottom, there are some links to some personal blots from people at Leaning for an Abay about some CryptoEconomic research. The slide should also be made available later. Yeah. So that was it. We ended a bit early. So if anyone has any questions, please feel free. But thank you very much for attending. And you can always also ask your questions later if you'd like. I want to give special thanks to Julian because he didn't know he was going to do this talk three days ago. And I think he did a really wonderful job. So if you can upload him again. Thank you very much.