 Thank you for inviting me and thank you everybody for attending my talk. I want to start by saying I'm really sad that I can't join you in person in Toulouse, and this has been a very crazy year and I really hope to see you all in person maybe next year. Yeah, so my talk will be about looking at blockchain technology through the lens of game theory. This will be an open-ended talk. I will mainly focus on challenges and open questions. And some of the open questions I will mention, there has been a lot of work and progress in. So it's not my goal to critique or to insult current work. It's more about trying to focus on what are the big challenges and what are the interesting questions in my view. So the focus here really is about blockchain, but as you know there is a deep connection between blockchain and computer science. And my main background is from computer science and this is kind of my interest, the intersection of blockchain and computer science. But obviously there is a huge impact also on economics. I believe that this multidisciplinary view is very important. So seeing both the practical aspects of blockchain, both the view from computer science and extremely important view of economics. And really, you know, along this talk I want you to imagine an imaginary meeting between Satoshi Nakamoto and John Nash. And what we will go is through several types of challenges or things where there might be areas of intersection. And I will focus on four of them. So I will talk about modeling money endogenously. And then I will talk mainly about trust. This will be kind of the big, the main part of this talk. And then incentivizing fairness and incentivizing welfare. Each one of these are going to be separate parts. So, you know, if you lose focus, if you are bored and so on, you can kind of regain and restart in the next item. So don't worry about it. And so, you know, Satoshi, we don't know a lot about him or her or this group, but we do know that Nash is a famous mathematician. So we'll be focused really on some of the foundational mathematical questions in this space in particular in the game theoretic view of blockchain technology. So yeah, the first topic is about how to model money, because I think in some sense, if you look at at kind of the cryptocurrency world and really the breakthrough of Bitcoin, it is a new approach to to basically generate money in a digital manner. This is a real breakthrough in the world. And the question here is what are the tools, the game theoretic tools, the economic tools to model this type of technology. And so I highly encourage you to read this, this white paper it's it's very well written, and I will show some parts of it during during this talk. So here's I think maybe the first or second sentence in this. This is a white paper. What is needed is an electronic payment system based on cryptographic proof instead of trust, allowing any two parties to transact directly with each other without a need for a trusted third party. So if we see here, there are a few interesting aspects here one is this idea that there is an electronic payment system. So we need to focus on how to reduce the friction and allowing people to pay where all you need is just two willing parties. So there is no need. There is no other entities that needs to give you payment. And the second aspect here that I'd like to highlight is is the removal of a trusted third party. So in this sense, the goal was to provide something that has low friction in terms of payments, and also reduces kind of the need for a trusted third party. So if you look at the traditional way that money is is defined typically, it's defined kind of ex-dominously as as an external measure. So typically, if you look at economics, then you see things like you want money to be a medium of exchange. So money is a way where we can kind of transfer utility from one to another, or we can exchange value. Of course, we can always exchange sand. Sand is a good way to exchange things. The problem is that at least in some granularities, sand is not very scarce. So you need something that there is a very few of. And so scarcity is a very important property of money. The other problem is that maybe the allocation of sand is not completely equal. If I live in the mountains, maybe I have less sand available for me. And if I live near the sea, near the beach, then maybe I have more sand. So you want to have something that provides some somehow an equal scarcity to participants. And so, you know, you could imagine maybe taking an orange as a as a good type of money system and, you know, I can exchange oranges. Oranges are relatively scarce. There's a limited amount of orange oranges in the world. The problem maybe with oranges is that they might not be a very good store of value. And so the problem is that maybe over time, oranges lose their ability and they rot and they go away. And so one of the important parts of money is that you would actually like their value or their utility for you to remain over time. And so, you know, if it's if it's something physical like a metal like gold, then maybe it has a longevity. If it's something that depends on, let's say a sovereign state, then your value depends on the sovereignty of the states and for example if the state gets conquered or it gets eliminated then maybe you your money is at risk. So these are kind of challenges that typically are just defined away. And you know what Bitcoin does is really tries to create solutions for these things in particular, you know, gives electronic method of payment. It creates kind of a digital scarcity by defining the limit of 21 million bitcoins. And really the idea here is that there is no central bank or one person. They're trying to replace this third party by by this ledger technology. If you look at kind of the traditional game theoretic approach, then you know you have a utility function which is a preference over over outcomes, and you just model money as some external, you know, rational number positive rational number. And you know so it's just one of them. People typically want more money so if you have more money than your utility is is is greater all things being equal. So I think money is kind of a way to transfer utility. And I think you know this, this modeling is good in some cases but but in reality, what we're seeing is there are many different types of money system so I mentioned oranges, sand, gold, and monetary systems of sovereign states, and now we're seeing these new type of approaches, like, like in cryptocurrency and Bitcoin. So how can we measure and how can we compare between different types of money systems. And so really what I'm asking here is is kind of a micro economic theory that talks about the competition between money systems, in particular a type of system that manages to define money endogenously by assigning utility for money systems based on these beneficial properties. So in particular, you know you want a money system to have more utility. When it can reduce friction, right so if the cost of exchange is low, and then you would like to have a, you'd imagine that that would increase the utility of that money system versus let's say a different system where the friction is is higher. Similarly, you want to have some sort of fairness in the allocation of a scarce resource. So that would might also be a measure of how, how much value you get from a monetary system. And finally, you know you want to have these money systems be a good store of value. And so really the question is trying to come up with a way to measure these properties of friction fairness and trust. So it tries to solve it in one way. It uses electronic payments based on cryptography so this is kind of their approach of reducing friction. It creates a limited supply, and it uses Byzantine fault tolerance, and creating kind of a replicated state machine among all minors for trust and we'll talk more about Byzantine fault tolerance. The first open question I want to present is kind of coming up with a game theoretic endogenous theory for the utility of money systems in particular this type of theory should be able to capture the benefits or drawbacks of systems that have low friction, high fairness and high trust. Great, so I'm going to go to the second part and this is going to be the main part and I'm going to talk about this notion of trust. And there's going to be three separate parts here. And we will try to explain what does that mean that there is a trust in the system. And then we'll maybe talk about who is actually maintaining this trust. And thirdly, there's a typo here of course this should be trust and scalability. So the first thing really to ask ourselves is kind of you know what does it mean to not have a trusted third party and let's go back to Satoshi Nakamoto's white paper. And before he goes on and explains kind of the Bitcoin approach, they talk about kind of a common solution and so the common solution is just to have a trusted central authority. And you know in their point of view the problem with this solution is that the entire fate of the money system depends on the company running the mint and every transaction has to go them just like a bank. So obviously, you know the writers of this white paper did not like banks, but really you can see that's what they were afraid of is that when you give control to a monetary system to some other entity some central authority. Then what they were worried about is that this authority might actually cause your value to be reduced over time, and you know there are inflationary pressures and there are different types of risks. Satoshi Nakamoto just wanted to build a solution where there was no central authority or where at least this authority was distributed among many participants. And so how did they do this. So here is kind of a very famous email that Satoshi Nakamoto sent as a response about a month after the white paper and this is kind of for me as a computer scientist working on this problem of the Byzantine generals problem this is a very influential email and really it shows that that the writers of the white paper already knew in 2018 that the core new idea in in kind of bitcoins ledger this is a proof of the Byzantine work chain is that it solves the Byzantine generals problem. And basically the Byzantine generals problem is a way to instantiate a distributed authority that is replicated among multiple minors, so that there is no central note there is basically a consensus protocol running along multiple different notes. So really, you know, I would like to highlight the differences between the view of Byzantine fault tolerance and game theory, because if you think about them initially, it seems like these are completely different worlds so you know in distributed computing in the world where you look at this problem of Byzantine fault tolerance. Typically, you know you assume that there are good guys and bad guys and typically we say there's n nodes in total, and maybe f of them are bad so f measures are bad guys and and what is our goal our goal is to build a protocol protocol is just a strategy. And we wanted to be tolerant to an adversary controlling f bad guys. And so what does it mean that it's a tolerance it can tolerate this adversary. Well, what it formally means, I mean, formally sorry it means that no matter which set of f players, the adversary controls. So if these are running the honest protocol. Then these good properties of the protocol hold so in particular if we want to hold things like no double spend then this property is being held. And this this simple definition is a key notion of Byzantine fault tolerance and distributed computing and cryptography. And when you look at game theory. It's extremely different because in game theory there are no good guys and bad guys. We just assume there and players, and they're all rational. So on the, you know, in the first layer when you look at things it looks like these are completely two different worlds that have no connection. But once you go a little bit deeper into the definitions, you realize that there is a very deep connection. And in a sense, these things are much similar than than what people believe. So in game theory, what does it mean that a protocol or strategy is robust to a coalition of size F or a coalition robust equilibrium. Well it means that no matter who the coalition of F parties are, if all the other players are playing the prescribed strategy. And the coalition plays their best response to these other players. So if you look at these of the protocol hold in particular the properties where no double spend and this is kind of the properties that we will have. And this is a key notion of coalition resistant equilibrium in game theory. And so if you look at these two definitions, you realize that really the only thing that's different here is kind of this, this one, a line that requires that the, that the coalition actually plays a best response. It is what is the difference between imagining that the players have arbitrary utility and so we basically say no matter what they do, versus a rational adversary where we can assume best response, but really you can model this best also in the distributed computing space, and you can view the, the notion of Byzantine fault tolerance and consensus as a game theoretic notion where you want to seek a coalition resistant equilibrium. And you know this this idea obviously appears in in many papers, but actually when I read the, the Bitcoin white paper. I see that the, the writers there also had very good intuition about game theory and had a very similar view. You know one piece of text, if a greedy attacker and you can imagine a greedy attacker is just a rational player is able to assemble more CPU than all the honest player players. He would have to choose, and here he has to choose a best response, right this is what a rational player does between using it to defraud people, or using it to generate new coins. And what the author of the white paper says that he ought to find it's more profitable to play by the rules. And as you know, whenever you prove that the thing that's most profitable is to play by the rules this is essentially that you are proving a equilibrium strategy again a coalition resistant equilibrium strategy. In a way, you know, even the Bitcoin white paper is already trying to implicitly prove that there is a coalition resistant equilibrium that is causing people to reach consensus and not to deviate and double spend. And so I guess the high level open question here is kind of formalizing this more and providing a game theoretic theory of consensus and a game theoretic analog to Byzantine fault tolerance. And again, there has been a lot of work in this topic and even today and in the next few days you will see more work on it. So I really think what we're missing is kind of, you know, a better understanding there are still areas where we maybe need a more clear notion and clear theory around this topic. But you know, anytime you have a Byzantine fault tolerance system the question really is, who are those players or parties that are decentralizing the trust and running this consensus protocol. And so really, the people who are running this consensus protocol are the people who are allowed to vote because in a sense that consensus or a Byzantine fault tolerance system in a system where people are allowed to vote. And so, this is kind of the next thing which which I'll talk about which is, you know, who is actually maintaining this this this ledger. The next question of who is allowed to vote is an important question in the world in general and you know, let's say taking in France this idea that all adult males are allowed to vote is quite radical it's, it's very new it's only maybe a few hundred years. And the idea that adult women are allowed to vote is, you know, is less than 100 years old. So, really, the distribution of power is a very important aspect and similarly, you know, in the US. The idea that adult women are allowed to vote is maybe just 100 years old. And, and the point here is that by choosing who is allowed to vote. That is basically saying how we distribute power. And no matter what consensus protocol we run. We are running it on the people that we provide power to run its for. And so, by deciding who is allowed to, allowing to vote we are making a very important decision about our system. And so in coming on computer science the way we model this is by having an adversary, and we restrict the adversary voting power. So in particular in Bitcoin, you know, we assume that the adversary controls less than 51% of the mining. And you know, here is kind of a quote from the Bitcoin white paper. The system is secure as long as the honest nodes collectively control more CPU than any cooperating group of attacking nodes. So again, you can see that the Bitcoin white paper already understands this notion of providing voting power by CPU. And, and making sure that there is an adversary that controls less than one half. But you can really ask yourself, you know, is this the right way to to spread voting. And we're seeing a lot of other approaches. So you know there is kind of this traditional approach of proof of membership, where every member has one vote. So there's obviously this idea of proof of work. And this is what Bitcoin is using. We are seeing now a lot of systems move to this idea of proof of stake, where basically, there is some coin and the more coins you have the more voting power you have. So you know if you have more dollars you get more voting powers or if you have more Ethereum than you have more voting powers. So there's kind of new technology talking about proof of space and proof of replication and interesting at variants of that. And you know this this idea of proof of work, and is this the right way to distribute voting power is an open question and you know I will cite here work from 2018 which talks about kind of decentralization Bitcoin and Ethereum, showing that actually there are relatively few mining pools. There's actually very few ASIC providers so there is kind of a monopoly on the production of a voting machine of voting power. And so what we're seeing is that there is risks that proof of work is causing centralization proof of work prefers central certain geographic regions, in particular areas that have a lot of access electricity. So proof of work prefers places that have a preferred taxation for these types of activities. And you know another worry is that proof of work is is wastefully it uses a lot of energy, even though you know their argument saying that some of it is basically access energy that that can't be sold in the marketplace. So micro economic thesis here is that potentially buying a proof of work system is essentially just using your money to buying voting. And so the question here really is how can we avoid a system where the number of votes you have just depends on the number of money that you have. And so this kind of big open question is you know how to avoid monopolies how to avoid centralization and how to avoid bribery basically making somebody that has a lot of money. Pay you in order to cause you to vote for for its its needs. Yeah, so the third part of this incentivizing trust will be about trust and scalability. So in the first part we talked about kind of a game theoretic model for consensus. In the second part we talked about kind of a theory around who is allowed to vote and what is the right way to allocate votes. And the third one I would like to go to a vignette that talks about how to scale blockchains because as you know this is kind of one of the big challenges that the people are handling in the this year and I guess in the last two or three years in particular. And really this is kind of a you know technical challenges is not just a game theoretic challenge but I will highlight kind of the economic and game theoretical aspects here. So if you think about a blockchain system, there are many things that you can try to improve in order to scale and have more transactions per second. So one is you know you want to have a better consensus protocol and this is what I do for for living. I could talk for hours about consensus protocols but I'm not going to do it today. The second is basically data availability. So really, you know, no matter how much you do consensus at the end of the day if you need to record data, then you have a cost of putting that data on some sort of immutable ledger. So that will be a scalability bottleneck, and there are ways of sharding, which basically allow you to splits your data and not write it everywhere, or a different approach would be to write it everywhere, but not to execute it everywhere. And what we're seeing is that this third part is actually the most challenging one. So in particular, after you actually reach consensus on what the content of the block is. And after you have the block, the data of the block reaches everybody so you have data availability, the real bottleneck in terms of scalability is to execute the transactions. And in particular in a replicated state machine like like Bitcoin or Ethereum or all these blockchain systems, you, you, you are probably executing it after somebody already executed it. So in particular you are validating somebody else's execution. And so if there are hundreds or thousands of validators, then hundreds or thousands of people have to re execute and re validate all the transactions. And by far this execution and validation is the scalability bottleneck in the sense that consensus and data availability can run much faster. And what we're seeing is that in many workloads execution is kind of the hardest bottleneck. And so today, as I mentioned, you know, every minor every validator must execute all transactions. And there's kind of this very promising solution that gained prominence in the last year but but actually appears in kind of computer science literature for for over over 10 years. And the idea here is that instead of all of us executing, we will just have a few agents that will execute. And these agents will have some steak, some bond. So they have to deposit some bond. And once they execute, they have to report what is the aggregate with result of their execution. And then if they cheat, then there is a way for other people to post a challenge or a proof that they cheated, they did not execute correctly. And they get a reward, if they are correct, if they are correct improving a fraud and the executor that cheated the bond that they posted gets a slash or gets a they get some sort of punishment. Again, this is something that if you're in the micro economic world, you should know this is a classical problem of a principal agent with deep ties obviously to computer science. But really the idea here is that there is a principle that wants transactions to be aggregated. This is kind of the society that wants to have high degree of scalability. These agents, these agents are validators. And the naive thing to do is basically that every minor just executes all transactions. And so this is kind of one way you just have all the agents rerun everything so every agent is verifying every other agent. But you want to say, are there game theoretic mechanisms that could allow you to incentivize people to behave honestly, and to punish them if they are lazy or malicious. And so this is kind of the third question around trust and scalability, which is kind of a game theoretic framework for scalable validation. Good, so I will move to the third part. And in this third part I will talk about fairness and incentivizing fairness. I will go back to the Bitcoin white paper. And let's see, it's very clear and very simple approach of how to incentivize nodes to support the network. And so the idea is very simple. The idea is that in a block, the first transaction is a special transaction that awards new coins to the creator of the block. And so this is a way to incentivize nodes to support the network. But also, crucially, this is a way to distribute coins into circulation. So, you know, there is this question of how do you add coins to circulation so for example one way is to say well I have a francs and now I will move from francs to euros so there will be some conversion rate and everybody who has francs they can replace them to euros and this way I can create new circulation of euros by matching them to some different coin. Or I can basically start new coins from scratch from zero. And this is the approach that Bitcoin took. And basically every coin that is created is created from a transaction inside the block. And this, this both gives you incentive and also adds more money into circulation. And again, this was because they did not want any central authority to issue these coins, but they basically said that whoever mines a new block gets a new coin. So this is a very elegant idea. However, you know what we're seeing is that there are some challenges with this idea. And in particular, you know we're getting kind of this effect that large coalitions might try to to gain and have more advantage relative to smaller groups that have less, less to gain. And this kind of again causes this centralization problem where larger groups have an advantage relative to smaller groups. And here's this nice quote by by Percy Blythe Shelley. Yeah, so you know you want a money system to be fair and actually defining fairness is is a little bit challenging. But you know one way that you can define a type of fairness is this notion of chain quality. And roughly speaking, chain quality means that the amount of reward that that you receive is proportional to the fraction of your voting power. And he said that these consensus protocols have some voting power. So you know if I have 10% of the voting power, roughly speaking, a fair solution would give me 10% of the rewards. This is one way to define fairness. And you know, this is really a big question how do you initially allocate money I don't think they are easy answers to this, but we can see how Bitcoin does it. It's new coins to the minor of a block. But there is kind of a technical aspect here that you actually only receive this money. If this block becomes part of the longest chain right so in Bitcoin there's this longest chain. But if your block is not part of the longest chain, even though you mind the block, you do not get paid. And this is kind of implicit inside the protocol. So, you know, this small technical aspect actually opens up an attack surface where if you are an orphan, if you basically are connected to the chain but nobody extends you people extend some other longest chain, then you get no reward. And this kind of gives us this notion of selfish mining and this is kind of in a famous attack. In a sense, one way to think about selfish mining is that this is a strategy that can increase the probability of people that are outside of your coalition to become orphans. And by increasing the probability of other people to become orphans, you basically decrease their fair share. And when you decrease their fair share, you are implicitly increasing your share unfairly. And so you are getting a larger chain quality. And so this is kind of a challenge with with selfish mining, which is that there is a way to attack that increases your share relative to everybody else. The problem with this attack is it actually requires a large coalition to succeed. And moreover, the advantage you have from this attack increases. As you have long larger coalitions. And so a small coalition might not benefit at all, but a larger coalition might have a major benefit in doing selfish mining attacks. And so really this is kind of this problem where these types of attack incentivize being centralized or joining kind of a cartel. This really kind of highlights this problem of rich get richer. So at a very high level here's kind of the selfish mining attack. So you know you have, let's say, three blocks. And now what the attacker does is it creates a hidden block. So instead of exposing this block, it creates an a block but does not report it to the system. So if some victim block comes in and since the your red attacker did not expose this block, then this victim block just connects to the previous block. And at that point, this hidden attacker can publish a second public block. And now you can see that there is a there are two chains one chain is of length four, and this other chain is of length five. This actually encourages you to to continue the longest chain, then the remaining next blocks will continue the red blocks of the attacker. And so this light blue block becomes an orphan block, basically a block that does not get reward. So you know many different types of approaches to to defend against this this kind of idea of an uncle reward, where you can add links to these orphan blocks and that can give you some payment. And you know this has still been shown to be susceptible to selfish mining. There are kind of academic work. Fruit chain is one that I will mention that allows you to do selfish mining. And they basically show that there is kind of a strategy, which is an epsilon best response. And so you know deviating from the strategy is always profitable but if nobody is deviating, then you get kind of a good equilibrium. You know another challenge with this solution is that it kind of differs from the standard longest fork, longest chain wins it kind of requires two different types of blocks. And there's recent work that that is to be published soon with my colleagues Danny Dole, Vital and Joe Halperin, that kind of tries to improve on fruit chain by basically showing an epsilon best response where deviating is almost always not profitable. And in addition it kind of tries to use a very similar approach like Ethereum that you basically just have to add links to orphans. So, I'd like to kind of conclude with the fourth part, which is about welfare. And so again let's go back to Satoshi Nakamoto and you know we've talked until now just about the miners but actually this is a market where there are minors but there's also clients that want to be served by the system. And these clients want to send transactions the value that they receive is kind of value from the system providing them a way to store their money and execute contracts on it. And so here's what Nakamoto authors say the incentive can also be funded with a transaction fees. The value of a transaction is less than the input value the difference is a transaction fee that is added to the incentive value of the block containing the transaction. So this is a very simple mechanism where basically clients can can provide additional payment tips to the creators of a block. And you can imagine this as kind of a game theoretic notion, where in a sense clients, the reason they are paying is that they are getting some value out of the system they are paying for trust for security. And the miners have costs they have to maintain the blockchain this is an expensive endeavor. And so really you want to have some sort of solution where buyers will pay sellers and compensate them for their work. And you know, this is essentially a mechanism design choice and if you think about like Bitcoin or Ethereum today essentially this is the first price auction with a limited block size. So you know the highest bidders pay they pay their bidder price and whatever is entered inside the block is what is being paid. Obviously, you know the size of this block is kind of a big debate in the Bitcoin community and I will not go into it today but this is another interesting mechanism mechanism design question. And really you can ask yourself well you know what's wrong with other types of solutions like second price auctions and why haven't people used second price auctions and indeed kind of this is because second prices type auctions are not robust to collusion between buyers or between buyers and sellers. And so you know another approach would be to use kind of a fixed price mechanism and I guess fixed price mechanism has have other problems of how do you actually decide what is this fixed price. And you know I would like to highlight kind of you know one of the most interesting advances in the last few months. This is this Ethereum improvement process 1559 that has become very famous. I guess part of the idea here is that the, the, the payments that the, that the clients provides some of it is a fixed price this fixed price depends on the recent congestion, and that fixed price actually gets burned. And anything beyond this fixed price is actually an optional tip that allows you to kind of handle congestion from the minor side. So one of the interesting aspects here is that's actually burning this price is a sort of a taxation policy, and this is kind of an interesting aspect of viewing blockchains as a public good. And basically by burning money, we are reducing the amount of money in circulation, and that basically increases the value of everybody that's holding this type of cryptocurrency. And so again this I think is kind of an interesting approach. And so yeah with this I will, I will conclude here is kind of a summary of the open questions that that I discussed we talked about four different things about modeling money endogenously about incentivizing trust, and about incentivizing fairness and welfare. So thank you very much. And if I don't know if we have time for questions but I'll be happy to take some if not then we can do it. You know doing the using the chat.