The Right to Write a Line in the Ledger — What Mining and Staking Actually Buy

31.29 TWh of Electricity a Year

The Bitcoin network used 31.29 TWh of electricity throughout the year 2018. A TWh (terawatt-hour) is a large unit used when measuring the electricity a country consumes. There are even earlier records. One calculation from 2014 noted that the electricity being used for this task at the time was comparable to the electricity consumption of the entire country of Ireland (DOI: 10.1049/cp.2014.0699).

This electricity emitted 17.29 MtCO2-eq of greenhouse gases. This is a value measured in millions of tons by converting various greenhouse gases into the equivalent amount of carbon dioxide. This estimation was produced using a standard method that measures a product entirely from its creation to its disposal (in 2019), and the authors noted that this value sits at the lower end among the estimates published up to that point (DOI: 10.1021/acs.est.9b05687).

Two things had the largest influence in the same estimation. Where the machines running these calculations are located, and how efficient those machines are. How many years the machines are used, and the share taken up by making and discarding the machines, were small. This means most of the impact occurs while the machines are running. The authors predicted that while the calculation volume of the entire network would grow, the energy and environmental footprint per unit of calculation would decrease (DOI: 10.1021/acs.est.9b05687).

One question remains. What is this electricity buying? The answer is that it is time to write the next page in the notebook.

"What Is a Blockchain" dealt with a notebook whose copies are shared among many people. It is a notebook where each page has its preceding page sealed, making any tampering obvious and the cost of tampering expensive. The question that article left at the end is the question of this article. Who takes the turn to write the next page, and at what cost? And how does that cost connect to the security of this notebook? It does not deal with what the current price is, and it uses no formulas.

The Line Written Down Is the Money Itself

Let us look at your bank account balance first. There are no bundles of cash with your name tag attached sitting somewhere in a bank vault. The numbers written in the bank ledger are your money.

A coin is the very line written in that ledger stating whose share is how much. When a ledger records money, the blockchain that runs that ledger becomes the cryptocurrency (DOI: 10.1017/s1744137417000200). The difference from a bank account is who holds the ledger. A bank ledger is held by the bank, while this notebook has its copies divided among multiple witnesses.

For a written line to act as money, the same share must not be spent twice. If a share handed over to Person A could be handed to someone else again, that line would not become money. This act of spending the same share twice is the double-spending covered in "What Is A Blockchain". In a bank ledger, the bank prevents this. The economic significance of Bitcoin lies in solving this double-spending problem without a central authority like a bank. A 2022 survey summarized this significance as follows (DOI: 10.1146/annurev-financial-111620-011240).

This article reads most of the costs we will follow ahead as the costs of preventing the same share from being spent twice, without trusting an institution.

The Turn to Pay and Buy

The name "mining" comes from mines, but nothing is dug from the ground. Mining is the act of paying with computation to buy the right to write the next page in the ledger. The mining side must check all incoming transactions, and in return, they receive newly created coins as a reward (DOI: 10.1049/cp.2014.0699). The computation paid is proof-of-work, which we saw in "What Is a Blockchain", meaning the method of repeating calculations until the seal matches.

The turn is decided by a contest. The mining sides compete at guessing seals for the reward of attaching a new block. The main factors determining win or loss are two: the computing power they hold, and the time it takes for the guessed block to spread to other witnesses (DOI: 10.1109/lwc.2018.2820009, evolutionary game model). Even if you guess first, if you spread late, a block guessed by another side in the meantime may be accepted first. Usually, the block that is guessed first and spreads first gets attached to the chain. When two blocks come out almost together and the chain splits, as we saw in "What Is a Blockchain", witnesses follow the branch where more computation has piled up. The computation paid by the side that loses the contest does not remain on the chain.

What gets paid is electricity and equipment. That calculation in 2014 concluded that for this work to yield a reward exceeding the electricity cost, dedicated equipment is usually required (DOI: 10.1049/cp.2014.0699).

A research team in 2015 viewed that Bitcoin's reward structure has an unstated design goal: scattering influence over the network among multiple independent participants (DOI: 10.1145/2810103.2813621). Decentralization is a state where this power to write is scattered among multiple independent participants rather than concentrated in one or two places. Bitcoin's security claim relies on the premise that no single entity holds a sufficiently large share of the network's total computing power (DOI: 10.1145/2810103.2813621). This means that if computing power is concentrated in one place, the ground upon which that security claim stands is shaken.

Turns Earned by the Stake You Deposited

There is also a way to decide the turn using something other than electricity. The approach of reaching consensus through computation has been criticized for using a lot of energy, being slow, and being vulnerable to security threats. Consensus here is the process by which witnesses match the contents of the next page into a single agreement. Proof of stake emerged as a way to overcome those limitations (DOI: 10.1109/access.2019.2925010).

Proof of stake is a method of reaching consensus by proving one's own share in the ledger instead of computing. Staking is depositing that share into the ledger and using it as the basis to earn the right to write the next page. In this method, the deposited share determines the right to write instead of computation.

The larger the deposited share, the more frequently the turn to write the next page usually comes around. While deposited, that share cannot be freely withdrawn, and some ledgers even slash the deposits of those who break the rules. Therefore, in this method, the locked-up share acts as collateral instead of electricity, and in ledgers with slashing, the risk of losing that share is also factored in. The details vary by ledger, and the papers this article relies on do not cover those specifics. Where deposited shares actually aggregate is continued in the decentralization section of "Where to Look Next".

The first economic model to mathematically analyze whether this method truly reaches consensus came out in 2020 (DOI: 10.1093/rfs/hhaa075). Such models find an equilibrium. An equilibrium is a state where no participant has anything more to gain by changing their strategy alone, so everyone stays put. Under that model, if the reward is set sufficiently small, two things hold true. An equilibrium that reaches consensus as quickly as possible exists, and an equilibrium where the chain remains split is ruled out. The reason the latter result occurs is that, unlike the computational method, in this method the writer must be a holder of a stake in that ledger (DOI: 10.1093/rfs/hhaa075).

This model demonstrated an equilibrium that reaches consensus under the condition that the reward is set sufficiently small.

The Price Paid to Be Written In

Suppose you want to put your line onto the next page. The space available on a single page is fixed, and there are often more lines trying to get in than there is room.

A fee is the price attached to the side asking to have their single line put onto the next page. Some ledgers pay this price under the name of gas.

The side doing the writing has costs that the fees must cover. Once a line is written, it is never erased, and every witness keeps stacking up copies, so the longer the ledger grows, the higher the storage cost climbs. A 2020 model examined whether fees cover this cost through a two-stage game. In the first stage, the party creating a transaction sets the fee, and in the second stage, the party doing the writing chooses which transactions to put into the current page (DOI: 10.1109/icc40277.2020.9148934).

In the equilibrium of this game, the fees of current practice largely failed to cover the storage costs of the writer. The reasons are twofold: the storage burden that a line imposes on others is not factored into the line's price, and the method of pricing based on waiting time is unfair. Increasing the interval between pages raises the fees and thus eases this worry, but requires waiting that much longer. The authors suggest that this shortfall can, in the long run, reduce the participation of writers and endanger the safety of the ledger (DOI: 10.1109/icc40277.2020.9148934).

There are also records of fees skyrocketing. Ethereum is a blockchain ledger that can record not only money but also contracts written with conditions and run them, and automated trading programs for exchanges run on top of it. In 2020 on Ethereum, automated trading programs on those exchanges detected regular users' transactions in advance and bought and sold ahead of them to make a profit. To secure the front spot, the programs competitively bid up their fees. This is because the writers usually put the lines with higher attached fees in front. This competition was named the priority gas auction (DOI: 10.1109/sp40000.2020.00040).

Researchers who documented this showed that the high fees paid to secure the front spot pose a systematic risk to the safety of consensus. The mechanism commonly cited is this: when the value at stake on a page is large, writers may have an incentive to roll back an already written page and pocket that value for themselves. The authors noted that this fee is merely one form of a larger phenomenon—the value that block producers can extract by manipulating transaction order. And they demonstrated empirically that this phenomenon was a real-world threat to Ethereum at the time (DOI: 10.1109/sp40000.2020.00040).

Whether they fall short or skyrocket, fees touch the safety of the ledger. If they fall short, the modeling results indicate that writers may leave in the long run; if they skyrocket through battles for the front spot, they pose a risk to the safety of consensus, as was seen on Ethereum in 2020.

Since Your Turn Rarely Comes Alone, We Pool Together

For someone calculating alone, turns come rarely and erratically. The probability of guessing the seal by oneself is very low, resulting in a pattern where one receives nothing for a long time and then occasionally receives a large reward all at once.

A pool is a gathering where people for whom turns rarely come alone pool their shares together to chase the right collectively, dividing what they receive in proportion to their contribution. Because solo calculations have high volatility, the number of people joining well-known large pools has increased. When people gather together, the likelihood that the gathering creates the next block increases and volatility decreases (DOI: 10.1109/snpd.2015.7176229). Because guessing seals is so difficult, individual participants tend to enter pools to secure stable income (DOI: 10.1109/lwc.2018.2820009, evolutionary game model). This means people gather to obtain evenly arriving income.

Pools also form in ledgers where participants obtain turns by depositing stakes. When calculations are pooled, it is a mining pool; when stakes are pooled, it is a staking pool. How the reward given for a single block is set relative to the entire network's stake greatly influences the degree of decentralization, according to the analysis and simulation results of a 2019 survey (DOI: 10.1109/access.2019.2925010). This means that the design choice of how rewards are determined alters how many places stakes concentrate.

The two pools do the same thing, differing only in what they pool. They replace an individual's share with multiple people's shares, and change where and how much writing power resides after gathering. Superimposing the two pools as a single phenomenon is the synthesis of this article. The reasons why people gather rely only on calculation-side evidence, while deposit-side evidence extends up to a survey's analysis and simulation.

Whether bought through calculation or obtained by depositing a stake, the right to write can be gathered into a pool, and the distribution after gathering alters the ledger's degree of decentralization.

What changes when people gather is found in the calculation-side records. Most participants enter pools rather than acting alone, and within the pool, a central manager largely directs activities. That much power concentrates in the manager. Around 2015, a single largest pool once exceeded half of the entire network's calculation capacity (DOI: 10.1145/2810103.2813621).

Those researchers found the reason why pools are so common in the proof-of-work problem itself. That problem provides an effective means to enforce cooperation within the gathering. Even if a participant guesses the seal, the reward goes to an address set by the manager, so the participant cannot pocket it alone. The researchers proposed several forms of "unoutsourcable" calculation problems that block this enforcement and suppress gatherings. These are problems that make it difficult for a gathering where calculation is outsourced to others to persist, by allowing the person who guessed to take the reward as their own share. They also demonstrated practicality through implementation and performance measurement (DOI: 10.1145/2810103.2813621).

The concentration of power into a few places is called centralization. By analyzing all blocks created from 2009 to 2014, an index was produced to measure how much the network centralized each year. The authors wrote that centralization is a phenomenon that occurs naturally in organized systems, and in Bitcoin, it can run counter to the initial decentralization character and raise concerns (DOI: 10.1109/snpd.2015.7176229).

There is also evidence in the opposite direction. An economic model from 2020 views that a centralized pool intended to share risk does not necessarily undermine decentralization just because it grows. Participants spread their bets across multiple pools, and pool operators set fees themselves. Consequently, the larger the pool, the more it shoulders its impact on the entire network and the higher the fees it charges. It attracts fewer participants relative to its size and grows more slowly. Instead, pools intensify an arms race among participants seeking to secure more computational power than others, substantially increasing the energy consumption of the proof-of-work ledger. The authors write that real-world data from Bitcoin mining supports this model's prediction, and view that this insight can be applied to other consensus methods as well (DOI: 10.1093/rfs/hhaa040).

When Half Gathers in One Hand

A 51% attack is when a single hand grabs more than half of the voting rights to rewind and rewrite an already written ledger. That single hand could be a single participant or a group like a mining pool. Witnesses follow the branch where more computation has piled up, so the side holding over half of the computing power can push out the already recorded history with a branch it built separately.

This attack has been considered theoretically possible but difficult in practice. The assumption was that if there are enough participants, it is very difficult to gather that much computing power into one hand. A study in 2021 reported that this assumption had never been thoroughly examined and dissected the participants of Bitcoin and Ethereum. In recent years, computing power has been concentrated among a very small number of participants, and the authors view this as a real risk (DOI: 10.1109/access.2021.3119291). In the same analysis, the mining activities of major participants showed consistent patterns, making it possible to recognize behavior that differs from the norm. This means that pattern could become a clue to detecting attacks in advance.

According to an analysis from 2019 covered in "What Is a Blockchain", attacks by those holding a majority were actually frequent across multiple cryptocurrencies around that time. Cryptocurrencies with low computing power are always vulnerable to this attack because the required computing power is easily obtainable (DOI: 10.3390/app9091788). That article noted that regarding this notebook, it was only made expensive to modify, not proven impossible to modify. Translated into the terms of this article, the cost of modification is the cost of gathering a majority of the voting rights.

That cost depends on how easily the majority computing power can be gathered. If computing power can be amply secured by borrowing spare computing power, the cost of mounting a 51% attack is surprisingly cheap. This poses a major threat to many proof-of-work ledgers (DOI: 10.1109/blockchain.2019.00041). A technique proposed in 2019 as a way to stop this assigns weights to the records of blocks created by participants up to that point and includes them in the criteria for choosing branches. According to the authors' analysis, this raises the attack cost of the existing method by a factor of one hundred (DOI: 10.1109/blockchain.2019.00041). This is an analysis at the proposal stage. On the other hand, the earlier 2019 analysis reviewed the top five leading protection techniques and concluded that in most cases, they do not provide practical protection. This is because the vulnerabilities are inherited from the consensus protocol itself (DOI: 10.3390/app9091788).

Problems also exist for the side that does not exceed half. The conventional wisdom was that Bitcoin's mining rules are tailored to incentives—meaning that following the rules is most profitable for everyone—which prevents a colluding minority. A study published in 2018 showed that this is not the case (DOI: 10.1145/3212998). In the attack presented by the authors, the colluding group does not immediately reveal the blocks they solved, but hides them. Then, when the other side reveals a block, they reveal their hidden blocks, rendering the computations performed by other participants useless. By doing so, the colluding participants gain profits greater than their fair share.

The authors wrote that as a consequence, rational participants may try to join that side, the colluding group can grow until it becomes the majority, and at that point, the system ceases to be a decentralized currency. Unless specific assumptions are made, this attack can occur regardless of the size of the collusion. The modification proposed by the authors only stops collusion holding less than a quarter of the total resources. The authors noted that while this threshold is lower than the incorrectly assumed one-half, it is better than the current reality where collusion of any size can undermine the system (DOI: 10.1145/3212998).

The side that stakes shares to take turns also has attacks that can start without half. This attack targets proof-of-stake ledgers in general, which do not separately maintain a trustworthy intermediate checkpoint. An intermediate checkpoint is a mark that nails down a point in an already written ledger, declaring, "Up to this point, there is no going back." Without a checkpoint, a branch that split off from a very old point can be accepted later. The attacker copies honest transactions from their original context onto a separately continued branch and pockets the fees. And by using the usual rule of following the longest chain, they eventually completely take over the ledger (DOI: 10.1109/cvcbt.2018.00015).

This attack can start with any fixed percentage of stake. As honest transactions pile up and the opponent holds a larger stake, the power of the attack grows. The authors wrote that under the statistical conditions of ledgers around 2018, once a few years' worth of operating records accumulate, it falls within the executable range. What the authors singled out as most important is that this attack shows how closely fees and rewards are intertwined with the security of proof of stake. They wrote that future designs attempting to proceed without intermediate checkpoints must reflect and prevent this attack, and presented two ways to stop it: examining the context in which a transaction was created, and looking at density statistics that measure how densely blocks are written in the chain (DOI: 10.1109/cvcbt.2018.00015).

If voting rights exceeding half gather in one hand, that hand can rewrite the ledger, and where incentives are misaligned, problems can begin even with a share smaller than half.

Until My Single Line Enters the Ledger

Let us pull out again the line we wrote in "What Is a Blockchain". "Transfer 10 of my share to Ga." This time, we trace who pays what until this line is recorded.

I sign this line, attach a fee, and send it to the witnesses. This line waits together with other lines trying to enter the next page. As in the two-stage game we saw earlier, it is the writer who chooses which lines to put into this page (DOI: 10.1109/icc40277.2020.9148934).

If this notebook is a ledger that determines turns through computation, the party that writes the next page is the one that wins the seal-guessing contest. Let us say the winner is a pool. Around 2015 in Bitcoin, most participants joined pools rather than acting alone (DOI: 10.1145/2810103.2813621). When the pool wins, newly minted coins and the fee I attached come in as a reward, and the pool distributes them according to contribution.

If this notebook is a ledger that determines turns by depositing shares, deposited shares rather than computation determine the qualification to write. There, too, pools that aggregate shares can form (DOI: 10.1109/access.2019.2925010).

This scene also incorporates the conditions set by the preceding sections. There is a modeling result that the fees of current practice generally fail to cover the storage costs of the writer (DOI: 10.1109/icc40277.2020.9148934). The winning pool is a collective where a manager generally directs the operations (DOI: 10.1145/2810103.2813621).

The remaining question for Ga is whether this line will be rolled back. In "What Is a Blockchain", the answer was a probability traded off against waiting time. That probability stood upon the condition that computational power of more than half had not gathered in one hand. The previous section added two exceptions to that condition. There is an analysis that in Bitcoin, a colluding minority can initiate problems with even less than half the share (DOI: 10.1145/3212998). In proof-of-stake ledgers without a trusted intermediary checkpoint, there are attacks that can be initiated with any fixed proportion of the stake (DOI: 10.1109/cvcbt.2018.00015).

The circumstances supporting the conditions do not tilt only to one side. On one hand, there is a 2021 analysis that in recent years computational power has concentrated in a very small number of participants and that this is a real risk (DOI: 10.1109/access.2021.3119291), and there is a record from around 2015 where a single largest pool exceeded half (DOI: 10.1145/2810103.2813621). On the other hand, there is a 2020 economic model showing that larger pools grow more slowly, and the authors wrote that actual Bitcoin data supports that prediction. However, the same model also sees that pools intensify an arms race, significantly increasing energy consumption (DOI: 10.1093/rfs/hhaa040).

Into the solidifying of this single line went the fee I attached, the electricity someone paid or the share they deposited, and the time Ga waited. That solidifying is a probability, and that probability leans simultaneously on the condition that the right to write has not concentrated over half in one hand and the condition that incentives do not misalign. There was no bank in this scene to take charge of the ledger. There were positions like pool managers that concentrated the power to write.

Writing Down Conditions in Advance

The entries in a ledger can record anything besides money, such as property rights, identities, and certificates, and contracts are one of them (DOI: 10.1017/s1744137417000200). You can write down conditions and what to do in a single line, like "If Ga sends 10, transfer 5 deposited in this line to Ga."

A smart contract is one where conditions and what to do at that time are written in advance in the ledger, and when someone calls that line, the conditions are checked and executed as-is without human judgment. Because human judgment is not involved in execution, the written condition becomes the rule, and a condition written wrongly also becomes a rule. Things outside the ledger, such as whether an item was received, must be brought inside the ledger by someone, and that problem is covered in "A Smart Contract Cannot See the Outside World — The Moment You Have to Trust Whoever Tells It the Price".

The order in which entries are written also changes the outcome. The automated trading program we saw earlier is an example. If you place your own transaction one step ahead of a regular user's transaction, the value the user receives changes even for the same trade. Blockchains, and smart contracts in particular, have promised a fair and transparent trading ecosystem, and the researchers from 2020 that we saw earlier showed that this promise was not kept. The researchers emphasized two things: the large and complex risks created by the property that the outcome changes depending on which transaction is written first, and the way exploitation methods used in traditional financial markets are seeping into the blockchain economy (DOI: 10.1109/sp40000.2020.00040).

When conditions are written down, human judgment is removed from execution, and to that extent, the written conditions and the order in which they are written determine the outcome.

The Price to Pay for This Position

Let us place the costs mentioned in this article in one place. There was electricity, specialized equipment, the staked share, and the fee attached to each line. Because a single person rarely gets a turn, people gather, and after gathering, there was a flow where the writing power concentrated in a few places. There were reports by authors showing that a model saying a large pool does not necessarily harm decentralization is backed by actual data, and the same model also saw that pools significantly increase energy consumption.

This article bundles these costs together and reads them as the price paid to keep the same share from being spent twice without a trusted institution. That nature is what a 2022 survey summarized as the economic significance of Bitcoin (DOI: 10.1146/annurev-financial-111620-011240). There is no paper that bundles the costs in this exact way, and this bundle is the synthesis of this article. If a trusted institution like a bank already guards that position, the factors to consider change.

If a trustworthy institution is already in that position and there is a way to verify that trust, it is better not to use it than to pay this price and use it anyway.

In a place where there is no trusted institution or no way to verify that trust, these costs buy something, and designs to reduce those costs have also emerged. The 2010s—wait, the 2020 proof-of-stake model is titled "Blockchain Without Waste", and it showed an equilibrium reaching consensus under the condition that rewards are set sufficiently small (DOI: 10.1093/rfs/hhaa075). A 2019 lifecycle estimate projected that while the total computation of the network would increase, the energy and footprint per unit of computation would decrease (DOI: 10.1021/acs.est.9b05687). A computational problem aimed at suppressing the force of centralization toward pools has been presented as a proposal whose implementation and performance were tested by researchers (DOI: 10.1145/2810103.2813621).

There is also a perspective that views this ledger more broadly than money technology. A 2018 institutional economics paper goes beyond viewing blockchain as a new general-purpose technology widely used across various industries, arguing that we should see it as a technology for creating institutions, which are rules people follow together. After examining cases of economic coordination and governance on the blockchain, the authors view blockchain as an example of how institutions evolve (DOI: 10.1017/s1744137417000200).

Therefore, the questions are posed as follows. Is there already a trustworthy institution in this position? If not, who is currently paying the price to run it without one? And right now, in how many places is the right to write concentrated?

Where to Look Next

Who holds the keys to move the coins written in this ledger is picked up by the next installment in this series, Where Are My Coins? — Wallets, Exchanges, and Who Holds the Key (/articles/wallet-custody-primer), and smart contracts, defined only briefly in this article, are covered in the final installment, What Is a Smart Contract? — A Promise Everyone Runs the Same Way, Exactly as Written (/articles/smart-contract-primer).

If you want to follow further down the path where power gathers, head to Is Blockchain Really Decentralization — From Mining Pools to MEV, Where Power Reassembles (/articles/blockchain-decentralization-debate). Starting from the pools in this article, that piece traces all the way to where value is extracted from the authority that decides transaction order.

How witnesses arrive at a single answer even when liars are mixed in is handled by Consensus Without Trust — How Mutually Distrusting Participants Agree on One Ledger (/articles/consensus-without-trust-basics).

Places where code containing written conditions actually went wrong are split across several pieces. The Code Did Exactly What It Promised — What Algorithmic Stablecoins Guaranteed, and What They Could Not (/articles/algorithmic-stablecoin-collapse) looks at cases where conditions written to defend their own value collapsed, while A Rug Pull Is Not a Hack — It Is a Permission (/articles/rug-pull-anatomy) looks at cases where permissions left behind in the code were the problem in the first place.

The problem of bringing values from outside the ledger into the ledger is found in A Smart Contract Cannot See the Outside World — The Moment You Have to Trust Whoever Tells It the Price (/articles/defi-oracle-manipulation). The liquidity pools appearing in that piece are pools holding two types of tokens, and they share only the name with the pools in this article that gather the right to write.

What happens when properties that held within a single ledger move between ledgers is looked at by A Bridge Does Not Inherit the Chain's Guarantees — Why Cross-Chain Bridges Keep Getting Drained (/articles/cross-chain-bridge-hacks).

Buying votes in an organization where you can change the rules as much as you hold votes is covered by The Power to Change the Rules Is Also for Sale — When Governance Itself Becomes the Attack Surface (/articles/dao-governance-attacks).

A share written in the ledger is also broadly called a token. The tokens appearing in How Guessing the Next Word Becomes a Conversation are the name for the tiny pieces language models use when looking at text, and the two tokens only sound the same.

Source Papers

• "Life Cycle Assessment of Bitcoin Mining" (2019) — DOI: 10.1021/acs.est.9b05687 — A life-cycle assessment estimated the 2018 Bitcoin network at 31.29 TWh and 17.29 MtCO2-eq, sitting at the lower end of previous estimates. The primary drivers are the geographical distribution of miners and equipment efficiency, while equipment manufacturing and disposal play a minor role. The hash rate is projected to continue growing while energy and footprint per unit decrease.
• "Bitcoin Mining and its Energy Footprint" (2014) — DOI: 10.1049/cp.2014.0699 — Mining is necessary to confirm every transaction, creating coins as compensation in return. Breaking even generally requires specialized hardware, and the electricity used for mining at the time was comparable to Ireland's electricity consumption.
• "Blockchains and the economic institutions of capitalism" (2018) — DOI: 10.1017/s1744137417000200 — When a ledger records money, that blockchain is a cryptocurrency, and ledger entries can record any data structure, such as property rights, identities, certificates, and contracts. The argument is that blockchains are an institutional technology and an example of institutional evolution.
• "Bitcoin and Beyond" (2022, survey) — DOI: 10.1146/annurev-financial-111620-011240 — Formalizes the economic significance of Bitcoin as solving the double-spending problem without a centralized authority. Surveys the literature on economic interactions among participants, the economics of proof of stake, fees, forks, and volatility.
• "Evolutionary Game for Mining Pool Selection in Blockchain Networks" (2018) — DOI: 10.1109/lwc.2018.2820009 — Miners compete in puzzle-solving for the reward of issuing new blocks, with the hash rate and block propagation delay being the two factors that determine the outcome. Due to puzzle difficulty, individual miners join pools for stable revenue. Models and simulates pool selection dynamics as an evolutionary game.
• "Nonoutsourceable Scratch-Off Puzzles to Discourage Bitcoin Mining Coalitions" (2015) — DOI: 10.1145/2810103.2813621 — The implicit goal of reward structures is the decentralization of influence, and security claims rely on no single entity holding a large share of computing power. Most miners join pools managed by administrators, concentrating power, and the largest pool has exceeded half. Suggesting that the cause lies in proof-of-work puzzles providing a means to enforce cooperation, the paper proposes, implements, and measures non-outsourceable puzzles.
• "Proof-of-Stake Consensus Mechanisms for Future Blockchain Networks" (2019, survey) — DOI: 10.1109/access.2019.2925010 — Surveys proof of stake, which achieves consensus through proof of stake ownership to overcome the energy inefficiency, delay, and security vulnerabilities of proof of work. Analyzes and simulates stake pool formation and stake distribution, noting that the ratio of block rewards to total stake significantly impacts decentralization.
• "Blockchain without Waste: Proof-of-Stake" (2020) — DOI: 10.1093/rfs/hhaa075 — The first formal economic model of proof of stake. With a sufficiently modest reward schedule, an equilibrium exists where consensus is reached as quickly as possible, and persistent fork equilibria are also ruled out. The latter result holds because, unlike in proof of work, validators must be token holders.
• "Economics of Blockchain Storage" (2020) — DOI: 10.1109/icc40277.2020.9148934 — A two-stage game where users set fees in the first stage and miners select transactions in the second stage. In equilibrium, fees generally fail to cover storage costs (negative externality and delay-based pricing). This risks reduced participation and security concerns in the long run. Increasing block intervals raises fees but increases delays.
• "Flash Boys 2.0" (2020) — DOI: 10.1109/sp40000.2020.00040 — Shows that the fair and transparent trading promised by smart contracts was not upheld. Formalizes priority gas auctions where bots competitively bid fees to secure execution order, and demonstrates that these high fees pose a systematic risk to consensus-layer security. Those fees are a form of a general phenomenon called MEV, presenting a real threat to Ethereum at the time. Emphasizes the risks of transaction-order dependence and the influx of financial exploitation methods.
• "Trend of centralization in Bitcoin's distributed network" (2015) — DOI: 10.1109/snpd.2015.7176229 — Due to the high variance of solo mining, joining large pools increases, as clustering raises the probability of producing the next block while reducing variance. Proposes centralization metrics through an analysis of all blocks from 2009 to 2014, concluding that centralization naturally occurs in organized systems, which raises concerns as it conflicts with Bitcoin's initial decentralized nature.
• "Decentralized Mining in Centralized Pools" (2020) — DOI: 10.1093/rfs/hhaa040 — The rise of centralized pools for risk sharing does not necessarily undermine decentralization (cross-variance and endogenous fee setting mean larger pools internalize externalities, charge higher fees, have fewer inflows, and grow slower). Instead, pools intensify miners' arms races, significantly increasing energy consumption. Empirical Bitcoin data supports the model's predictions, with implications for other consensus methods.
• "The 51% Attack on Blockchains: A Mining Behavior Study" (2021) — DOI: 10.1109/access.2021.3119291 — If miners or a coalition control more than half of the computing power, they can rewrite the ledger. The assumption that this is difficult in practice has not been thoroughly examined, and an analysis of Bitcoin and Ethereum shows that hash power has concentrated in very few hands in recent years, making it a real threat. Anomalous behavior can be identified through the patterns of major miners.
• "Assessing Blockchain Consensus and Security Mechanisms against the 51% Attack" (2019) — DOI: 10.3390/app9091788 — Having more than half of the computing power splits the chain to enable double spending. Long considered prohibitively expensive and rare, such attacks have occurred frequently in recent times, causing millions of dollars in losses across multiple cryptocurrencies. Coins with low computing power remain perpetually vulnerable. Five previous protection mechanisms fail to provide substantial protection because they inherit weaknesses from the consensus protocol.
• "Effective Scheme against 51% Attack on Proof-of-Work Blockchain with History Weighted Information" (2019) — DOI: 10.1109/blockchain.2019.00041 — When hash power is readily available, the cost of a 51% attack is surprisingly low and poses a major threat to many proof-of-work blockchains. Proposes a miner history-weighting scheme, analyzing that it increases existing attack costs by two orders of magnitude.
• "Majority is not enough" (2018) — DOI: 10.1145/3212998 — Refutes the common notion that mining protocols are incentive-compatible. A colluding minority earns a larger share of revenue than its fair share, rational miners join to make the coalition a majority, and at that point, the network may cease to be a decentralized currency. Without specific assumptions, this can happen for any size of collusion. The proposed modification prevents collusion below 1/4 — lower than the mistakenly assumed 1/2, but better than the reality where any size can break it.
• "Stake-Bleeding Attacks on Proof-of-Stake Blockchains" (2018) — DOI: 10.1109/cvcbt.2018.00015 — An attack targeting checkpointless proof-of-stake ledgers as a whole to completely take over the ledger. It can be initiated with any fixed stake ratio, grows stronger with honest transactions and a larger attacker stake, and statistics at the time showed it would become executable after several years of operation. Above all, it demonstrates how closely fees and rewards are coupled with security properties, which future designs must account for, suggesting context sensitivity of transactions and chain density statistics as defenses.