The blockchain folk theorem∗

Bruno Biais† Christophe Bisière‡ Matthieu Bouvard§

Catherine Casamatta¶

November 21, 2017

Preliminary

Abstract
Blockchains are distributed ledgers, operated within peer-to-peer
networks. If reliable and stable, they could offer a new, cost effective,
way to record transactions and asset ownership, but are they? We
model the blockchain as a stochastic game and analyse the equilib-
rium strategies of rational, strategic miners. We show that mining the
longest chain is a Markov perfect equilibrium, without forking on the
equilibrium path, in line with the seminal vision of Nakamoto (2008).
We also clarify, however, that the blockchain game is a coordination
game, which opens the scope for multiple equilibria. We show there
exist equilibria with forks, leading to orphaned blocks and also possibly
to persistent divergence between different chains.

∗
We thank V. Glode, B. Gobillard, I. Goldstein, C. Harvey, J. Hörner, A. Kirilenko,
T. Mariotti, J. Tirole, S. Villeneuve, the members of the TSE Blockchain working group,
participants in the Inquire Conference in Liverpool, 2017, participants in the GSE Summer
Forum in Barcelona, 2017, the Africa Meeting of the Econometric Society in Algiers, 2017,
the RFS Fintech workshop, 2017, as well as an anonymous referee for helpful comments.
Financial support from the FBF-IDEI Chair on Investment banking and financial markets
value chain is gratefully acknowledged. This research also benefited from the support of
the Europlace Institute of Finance, and the Jean-Jacques Laffont Digital chair.
†
Toulouse School of Economics, CNRS (TSM-Research)
‡
Toulouse School of Economics, Université Toulouse Capitole (TSM-Research)
§
Desautels Faculty of Management, McGill University
¶
Toulouse School of Economics, Université Toulouse Capitole (TSM-Research)

1
1 Introduction
Blockchains are decentralised protocols for recording transactions and asset
ownership. In contrast with centralised protocols in which one authority
is in charge of recording or certifying transactions in a unique centralised
ledger, blockchain operates within a network, whose participants each possess
and update their own version of the ledger. The blockchain design was the
main innovation underlying the digital currency network Bitcoin (Nakamoto,
2008), but its potential benefits in terms of cost-efficiency, speed and secu-
rity, for a variety of assets and contracts, have attracted interest from a
broad range of institutions and businesses.1 Blockchain experiments, and
in some cases, deployments, have been conducted by the Australian Stock
Exchange, the Nasdaq, BHP Billiton and major banks around the globe. As
blockchains are being embedded into major transaction platforms, we pro-
pose to investigate the stability of the protocol: how efficient is a blockchain
at building a stable consensus among participants about the history of past
transactions? This question is particularly relevant in public blockchains
where participants are anonymous and no formal authority may coordinate
their behaviour in last resort.2 Our game-theoretic approach pins down the
tradeoffs faced by the key players in a blockchain’s decentralised certification
process, the “miners.”
We study the protocol known as “proof-of-work” that miners follow to
build consensus.3 This protocol, which we describe in more details in the
next section, can be sketched as follows. At each point in time, miners
try to validate a new block of transactions. This implies verifying that the
transactions in the block do not contradict each other or past transactions,
but also solving a purely numerical problem unrelated to the block’s content,
i.e., “mining.” The first miner to solve this problem obtains a proof-of-work,
which he attaches to the new block before diffusing it to the network. Hence,
the identity of the miner who validates a given block is the outcome of a
random draw in which each miner’s probability of winning is his share of
1
The blockchain is cost effective in that the administrative costs of running it are limited
compared to those incurred within older technologies and institutions, such as notaries,
banks or depositories.
2
Bitcoin and Ethereum are best-known examples of public blockchains. There also exist
private blockchains, which use the same technology, but whose participants are selected
and which can have specific coordination devices. Our paper focuses on public blockchains.
3
Major public blockchains such as Bitcoin or Ethereum run on proof-of-work protocols.

2
the total computing power in the network. This ensures that miners take
turns to validate blocks, and therefore no single miner has control over the
whole verification process. When a new block is diffused to the network, it
becomes part of the consensus if miners express acceptance by chaining to it
their next block. Each block includes a reward for the miner who solved it.
This process illustrated in Figure 1.

B1 B2 B3

time
0 t1 t2 t3

Figure 1: The Blockchain

At t = 0, there is an initial block B0 and a stock of transactions included in a
block B1 , chained to B0 . Miners work on a cryptographic problem until a miner
solves B1 at t1 . B1 is broadcast to all. Nodes check proof-of-work and transactions
validity, and express acceptance by chaining the next block to B1 .

Proof-of work generates a stable consensus, or in other words, a single

chain, if miners always accept a newly solved block as the parent for their
next block. Miners, however, may choose to discard certain blocks. Suppose,
e.g., that the last block solved is Bn , but miner m chains his next block to
the parent of Bn , i.e., Bn−1 . This starts a fork, as illustrated in Figure 2.
If some miners follow m, while others continue to attach their blocks to the
original chain, there are competing versions of the ledger. This reduces the
credibility and reliability of the blockchain, especially if the fork is persis-
tent. Even if, eventually, all miners agree to attach their blocks to the same
chain, the occurrence of the fork is not innocuous. The blocks in the chain
eventually abandoned are orphaned. They have been mined in vain, and the
corresponding computing power and energy have been wasted. Moreover,
the transactions recorded in the orphaned blocks may be called in question.
In the present paper, we first consider an environment in which miners’
payoffs are solely composed of rewards for solving blocks, and information
is instantaneously disseminated in the network. In this frictionless world,
it is commonly argued, in particular by the blockchain community, that
blockchains should give rise to a single and stable consensus, and thus offer a
reliable way to record transactions and ownership. We examine the validity
of that “folk theorem” in a stochastic game that captures the key features of

3
 Original chain

B1 Bn−1 Bn Bn+1
0
Bn

Fork

t
0 t1 tn−2 tn−1 tn

Figure 2: A fork

a blockchain and allows a formal analysis of the economic forces at play in

that environment. In particular, we are interested in mechanisms pushing to-
wards stability or instability of the distributed ledger. Our analysis uncovers
two important economic forces at play in the blockchain.
First, miners’ actions are strategic complements. Indeed, their rewards
are paid in the cryptocurrency associated with the chain on which they are
solving blocks. The value of that cryptocurrency depends on the credibility
of the corresponding chain, which is higher if more miners are active on it.
This generates complementarities: If more miners are expected to mine a
given chain going forward, the expected profit from mining blocks on that
chain increases. Hence, miners benefit from coordinating on a single chain,
which they can achieve by playing the longest chain rule (hereafter LCR),
as suggested by Nakamoto (2008). This sustains a Pareto-optimal equilib-
rium in which every new block becomes part of the consensus. However,
the same coordination motives sustain equilibria with forks (Proposition 2).
Intuitively, if at some time (a sunspot) a miner anticipates all other miners
to fork and create a new chain, his best response is to follow them. Indeed,
he rationally anticipates that any block solved out of the equilibrium path,
for instance on the original chain, will not be accepted by other miners and
the corresponding reward will be worthless.
Second, we identify a counterveiling force which we refer to as “vested
interest.” Because miners cannot immediately spend or convert the cryp-
tocurrency earned while mining, a miner who has accumulated rewards by

4
solving blocks on a given chain has a vested interest in this chain remaining
active. In particular, the value of these rewards would drop if he moved
to a different chain. Vested interests may counteract coordination motives
for a group of miners, inducing them to keep mining a minority chain, and
sustaining persistent forks in equilibrium (Proposition 3). Unlike temporary
forks that only rely on coordination motives and would arise with atomistic
miners, equilibria with persistent forks depend on miners internalising how
their actions affect the value of their rewards.
Overall, this analysis suggests that the blockchain design, by generating
complementarities and vested interest, is subject to instability. Next, we
investigate how frictions typically associated with dissensus and forks relate
to these economic forces. For instance, communication delays may generate
transient forks as some miners do not immediately realise that a new block
has been solved. Some miners may also derive extrinsic benefits from creat-
ing a fork: it can allow them to void previous transactions and recover the
corresponding cryptocurrencies (“double-spending”), or to push technical so-
lutions that give them a competitive edge (“upgrades”). We incorporate these
frictions in our model and show that while they may act as triggers (instead
of sunspots), the same fundamental interplay of coordination motives and
vested interests as in the frictionless case underlies equilibria with forks.
Finally, we endogenise the computing capacity that each miner installs.
Because the difficulty of the mining process is typically adjusted upwards
when the total computing capacity in the network increases, a miner’s invest-
ment in computing power exerts a negative externality on all other miners.
This gives rise to an arms race in which each miner ends up over-investing
(not unlike the over-investment in financial expertise noted by Glode, Green
and Lowery (2012)). This analysis points to another source of inefficiency in
the blockchain’s decentralised design.

Literature: Most existing literature on blockchains is in computer sci-

ence, with the notable exceptions of Harvey (2016), who discusses the pros
and cons of blockchains and Yermack (2017) who discusses their implications
for corporate governance.
Computer science papers offer insightful analyses of potential strategic
problems, but usually do not rely on the same type of formalism as in eco-
nomics. Bonneau et al. (2016) analyse how mining pools (i.e., groups of
miners) controlling a large fraction of the computing power could attack the

5
chain. Eyal and Sirer (2014) show how colluding miners can obtain a larger
revenue than their fair shares. Teusch, Jain and Saxena (2016) study how
a strategic miner can fork and attack the blockchain to double spend. The
paper to which our analysis is the closest is Kroll, Davey and Felten (2013).
They note that the interaction between miners should be analysed as a game.
They argue that the LCR is a Nash equilibrium. While their analysis offers
interesting economic intuition, it does not offer a formal analysis and proof
of equilibrium. Another difference between our analysis and theirs is our
analysis of forks on the equilibrium path.
Several papers (e.g., Evans, 2014) note that an additional problem with
the Bitcoin mining incentive scheme is that miners are paid with bitcoins,
which have a volatile value. In our analysis, the only source of variation
in the value of rewards to a given block is the extent to which the chain
including that block is actively mined. We analyse how these variations
affect incentives. Schrijvers et al. (2016) study a different type of incentive
problems than that we consider. They study the behaviour of miners in a
pool, assuming that the pool organiser does not observe when miners solve
blocks nor the computing power they dedicate to that task. They analyse
how to incentivise miners to reveal that they have solved a block as soon as
they have done so.
The remainder of the paper is organised as follows. The next section offers
an introduction to blockchain environments. Section 3 presents the model.
Section 4 develops our equilibrium analysis and contains our main results.
Extensions of the model are provided in Sections 5 and 6, and Section 7
concludes. All proofs are in the Appendix.

2 A primer on blockchains
In this section we first describe the blockchain protocol and then discuss some
problems that can arise in blockchains.

2.1 The blockchain protocol

Centralised vs decentralised ledgers: A ledger is a collection of
records, regarding ownership, transactions, identity, etc. For ledgers to facil-
itate interactions among economic agents, it is essential that the agents reach
a consensus about the state of the ledger and its authenticity. Historically,

6
a central authority, e.g., the state and its delegates, ensured this consensus
by managing and certifying the ledger. Such centralised ledgers, however,
cannot operate satisfactorily if the central authority behaves opportunisti-
cally, e.g., by excluding some participants or transactions, or by distorting
the ledger.
The distributed ledger technology (DLT) can overcome that obstacle.
Within a distributed ledger, there is a network of participants, and each
participant maintains its own ledger. When an economic transaction occurs,
the trading parties send this information to the network, so that it can be
validated by the network participants, each including it into his or her own
ledger. Ledgers should eventually be the same for all participants, giving rise
to consensus on a single, distributed, ledger.
Blockchain is the distributed ledger protocol invented by Nakamoto (2008)
when he created Bitcoin. The elegance and novelty of his solution relies in
particular on its endeavour to incorporate the incentives of the participants.4
This justifies our game theoretic approach that accounts for these incentives
to investigate the properties of this protocol.

Proof-of-work: Decentralisation of the ledger implies its validation

should not be controlled or manipulated by a single participant or a small
number of colluding participants. All participants should be equally able to
contribute to the validation process. One way to associate all participants to
the validation of transactions would be to rely on majority voting. However,
as noted by Nakamoto (2008), page 3:

“If the majority were based on one-IP-address-one-vote, it

could be subverted by anyone able to allocate IPs.”

The solution proposed by Nakamoto (2008) to this so-called “Sybil attack”

is called “proof-of-work.” 5 For convenience, participants do not validate each
transaction individually but group them in blocks. One participant is des-
ignated to send his block to the network to update the ledger. To obtain
this right, each participant works to solve a difficult cryptographic problem,
attached to his block. The term “work” in “proof-of-work” therefore refers
4
Section 6 of Nakamoto (2008) seminal paper is entitled “Incentive.”
5
Alternative protocols include proof-of-stake, currently used by NXT, BlackCoin and
Peercoin. However, and in spite of serious efforts, there is no satisfying alternative to
proof-of-work so far.

7
to using computers and electricity to perform this task. The problem to
solve has nothing to do with the economic transactions included in a block.
Rather, it allows each participant to use computing power to perform inde-
pendent trials (similar to draws under replacement) until one finds a solution
to an arbitrary numerical problem (a hash value lower than a given thresh-
old.) The larger the computing power the larger the number of draws per
unit of time, the shorter the expected time it takes to find the solution.
A property of cryptographic problems is that the solution is hard to find,
but easy to verify. Hence, when they receive a block for validation, par-
ticipants easily check whether the sender actually found the solution. If
participants accept this block, they take it as the parent of the new block
they start mining. Thus, as written by Nakamoto (2008), participants

“vote with their CPU power, expressing their acceptance of

valid blocks by working on extending them and rejecting invalid
block by refusing to work on them.”(page 8)

Proof-of-work is essentially a way to randomise across participants who

will propose the next change to the ledger. Otherwise stated, proof-of-work
is a way to randomise who will get to vote on the next state of the ledger.
This process gives rise to a chain of consecutively solved blocks, i.e., the
blockchain, as illustrated in Figure 1 and summarised by Nakamoto (2008)
on page 3:

“The steps to run the network are as follows:

1) New transactions are broadcast to all nodes.
2) Each node collects new transactions into a block.
3) Each node works on finding a difficult proof-of-work for its
block.
4) When a node finds a proof-of-work, it broadcasts the block
to all nodes.
5) Nodes accept the block only if all transactions in it are
valid and not already spent.
6) Nodes express their acceptance of the block by working
on creating the next block in the chain, using the hash of the
accepted block as the previous hash.” 6
6
This is a “hash pointer”, i.e., a value that identifies the block (note from the authors).

8
 Miners: The nodes conducting the above mentioned tasks are called
“miners”, as they “mine” to solve proof-of-work problems and get rewarded
for this in units of the cryptocurrency whose ownership is recorded in the
blockchain. This includes the creation of new units of the cryptocurrency
allocated to the miner (12.5 BTC per block on Bitcoin in 2017, and 3 ETH
on Ethereum since Oct. 2017) plus transaction fees which the originators of
economic transactions can choose to offer for the validation of these trans-
actions. Bitcoin imposes a 100-block delay before rewards earned through
mining can be spent.
In practice, miners gather in large pools. Figure 3 presents the distri-
bution of computing power of the pools operating on Bitcoin in November
2017. The figure illustrates that 13 mining pools represented about 95 %
of the total hash capacity. Pools allow miners to mutualise block discovery
risk. They also coordinate individual mining strategies. For example, on
https://www.bitcoinmining.com/bitcoin-mining-pools/, one can read:
“If you participate in a Bitcoin mining pool then you will want
to ensure that they are engaging in behavior that is in agreement
with your philosophy towards Bitcoin. [...] Therefore, it is your
duty to make sure that any Bitcoin mining power you direct to a
mining pool does not attempt to enforce network consensus rules
you disagree with.”

Difficulty: The time it takes a miner to solve a block depends on the

difficulty of the cryptographic problem and the miner’s computing power.
The difficulty is set by the blockchain protocol to keep the average duration
between two blocks close to a target (10 minutes on Bitcoin and between
9 and 17 seconds on Ethereum). If the total computing power increases
(e.g., due to the entry of new miners and new pools), the protocol ensures
that the difficulty is scaled up so that average duration between two blocks
remains equal to the desired level. Thus, on Bitcoin every 2,016 blocks, i.e.,
approximately every 2 weeks, the difficulty is rescaled to ensure that the
average time between blocks remains at 10 minutes.

2.2 Forks
Consensus on the decentralised ledger requires that there is only one chain of
blocks, observed by all and on which all agree. It is jeopardised if the chain

9
 Figure 3:
Hashrate distribution of Bitcoin mining pools on November 15, 2017.
Source: blockchain.info. AntPool servers are located in China. The other three
main pools have servers in China, Japan and the US.

splits into a fork, with two competing branches, each with its own version of
the ledger. In the present subsection we review some reasons why forks can
happen in blockchains, and describe forks which actually occurred.

Communication delays: In practice, the information that a block has

been solved is not transmitted instantaneously and simultaneously to all net-
work participants. For example, miners in Siberia might learn before miners
in Iceland that a block has been solved in China. Thus, it will routinely
happen that a block has just been solved but some participants are not yet
aware of that. If these participants solve their own block in the meantime,
this starts a fork with two competing blocks attached to the same parent.
Nakamoto (2008) identified that problem and suggested it would be solved if
miners always chained their blocks to the longest chain (following the Longest

10
Chain Rule, hereafter LCR):

“Nodes always consider the longest chain to be the correct one

and will keep working on extending it. If two nodes broadcast
different versions of the next block simultaneously, some nodes
may receive one or the other first. In that case, they work on
the first one they received, but save the other branch in case it
becomes longer. The tie will be broken when the next proof-of-
work is found and one branch becomes longer; the nodes that
were working on the other branch will then switch to the longer
one.”Nakamoto (2008), page 3.

Double spending: The blockchain protocol was also designed to pre-

vent “double spending.” Suppose a miner buys an object from a seller, paying
for it with bitcoins. The corresponding transaction is recorded in a block B.
When the latter is validated, the seller delivers the object and is entitled to
use the bitcoins. This could give an incentive for the buyer to start a fork:
he could try to solve a block that does not contain his transaction, and that
is chained to the parent of B, in the hope of attracting miners to his chain.
If he succeeded in doing so, no block would be chained to B (i.e. B would
be “orphaned”), which would void the transfer of his bitcoins to the seller.
Nakamoto (2008) argues that double spending is unlikely to be successful
because it would require solving blocks faster than the rest of the network.

Software upgrades: So far we used the term “fork” to refer to chain

splits. There is another possible use of the term: In the context of open source
software, forking means copying the source code of a computer program and
modifying it. In a blockchain, a “soft fork” is the introduction of an upgraded
version of the software which remains compatible with the previous version:
blocks mined with the new version are considered as valid by miners still
running the old version. In that case, a soft fork does not trigger a fork in
the blockchain, even if not all miners upgrade to the new version. In contrast,
a “hard fork” is not backward-compatible, as upgraded miners might create
blocks that will be rejected as invalid by non-upgraded miners. Therefore,
if not all miners upgrade, a hard fork can be a way to trigger a fork in the
blockchain. We describe below some actual unintended or intended forks
triggered by software upgrades.

11
 Unintended forks: An important chain split occurred on the Bitcoin
blockchain in March 2013, following what developers thought to be an innocu-
ous soft fork: On March 11, 2013, some miners upgraded to a new version
of the software, referred to as 0.8. There turned out to be a bug so that the
miners operating with the 0.7 version rejected as invalid one block solved by
the 0.8 miners and consequently the subsequent ones (Thus the 0.8 upgrade
turned out to be an unintended hard fork, which miners identified with a
delay). From that point on, the 0.8 miners worked on a chain stemming
from that block, while the 0.7 worked on a competing chain, stemming from
its parent. When they discovered the split, participants all wanted to revert
to a single chain, but they had to decide which branch to keep and which
to orphan. Achieving coordination turned out to be difficult, as illustrated
by the following discussion between Bitcoin software developers and miners
(reported by Narayanan (2015)):
“Gavin Andresen: the 0.8 fork is longer, yes? so majority
hashpower is 0.8 ... first rule of bitcoin: majority hashpower
wins
Luke Dashjr: if we go with 0.8 we are hard forking
BTC Guild: I can single handedly put 0.7 back to the majority
hashpower. I just need confirmation that that’s what should be
done.
Pieter Wuille: that is what should be done, but we should
have consensus first.”
Miners faced a dilemma. Should they follow the longest chain rule and
mine the 0.8 chain which had attracted the majority of the computing power?
Or should they revert to the 0.7 version? Miners wanted to abide to the
consensus, but they first needed to coordinate on what the consensus should
be.
Eventually, BTC Guild, which was one of the largest pools at the time,
chose to downgrade to the 0.7 version. This resulted in the 0.7 chain be-
coming the longest, and all miners coordinating back to it. It took 8 hours
before participants could solve the problem. Consequently more than 24
blocks, solved on the 0.8 chain, became orphaned, and their miners (in-
cluding BTC Guild) lost the corresponding rewards. Commenting on this
situation, Narayanan (2015) wrote:
“One way to look at this is that BTC Guild sacrificed rev-
enues for the good of the network. But these actions can also

12
 be justified from a revenue-maximising perspective. If the BTC
Guild operator believed that the 0.7 branch would win anyway
(perhaps the developers would be able to convince another large
pool operator), then moving first is relatively best, since delaying
would only take BTC Guild further down the doomed branch.”

This discussion underscores that miners’ coordination, or the lack thereof,

plays an important role in the emergence and resolution of forks. It also
underscores the importance of beliefs in this context: An individual miner
(such as, e.g., BTC Guild) decides to chain his blocks to the branch which
he believes the others will choose. Thus, beliefs about the actions of others
influence one’s action. This generates a form of beauty contest, in which
coordination effects are critical.

Intended forks: Ethereum underwent a hard fork in the summer of

2016. Following the hack of TheDAO, a large venture capital fund oper-
ating through smart contracts, members of the Ethereum community sug-
gested to roll back the blockchain in order to cancel the transactions that
diverted the fund’s money. They hoped all participants would coordinate
on that hard fork, leading to a single active chain. Other members, how-
ever, refused to alter the history of the ledger and rejected the hard fork.
Consequently, Ethereum split in two incompatible branches, Ethereum and
Ethereum Classic. These two branches still exist, each corresponding to a
different ledger and history of trades, and a different cryptocurrency. As
of may 2017, Ethereum Classic represented about 10% of the hash capacity
of Ethereum, and the price of ETC was about 10% of the ETH price. This
episode illustrates the difficulty to achieve coordination on a single chain, the
uncertainty about miners’ actions and the resulting occurrence of persistent
competition between alternative chains.
Bitcoin also underwent a hard fork, in the summer of 2017. The com-
munity had long been divided on how to relax the limitation of the network
throughput.7 Two main solutions, Segregated Witness (SegWit) and Bitcoin
Unlimited (BU), were supported by different participants, with the threat of
some to fork in order to impose their preferred solution. In the New York
Agreement signed on may 2017, most mining pool operators agreed to roll
7
The Bitcoin protocol sets the maximum size of a block of transactions to one megabyte.
This limit slows down the speed of transactions validation and hinders the development
of the network itself.

13
out a compromise solution (SegWit2x). Yet another way to increase through-
put, Bitcoin Cash, was eventually implemented, via a hard fork, on August
1st, 2017. Bitcoin then split in two branches, with two different cryptocur-
rencies, Bitcoin and Bitcoin Cash. On the former branch, following the New
York Agreement, a hark fork was planed for November 2017. There was
a lot of uncertainty, and discussion among miners, about who would adopt
SegWit2x, and whether there would be a new chain split. Many bloggers,
developers and mining pool operators announced that a chain split was very
likely. At odds with those forecasts, the SegWit2x hard fork was abandoned.
One could have thought this meant participants would coordinate on Bitcoin.
Quite to the contrary, a large fraction of miners reacted by shifting from Bit-
coin to Bitcoin Cash. While, early November, 12-hour average hashrates
were about 10 Exahashes (1018 hashes) per second on Bitcoin versus less
than 2 on Bitcoin Cash, on November 12, hashrates were similar on the two
branches. Again, this episode underscores that it is difficult for miners to
coordinate on a single chain, that chain splits are not uncommon, and that
the outcome is hard to predict, even for major participants.
In the next sections, we will show how these features of blockchain in the
real life also arise, in equilibrium, due to standard economic forces.

3 Model
In line with the above description of the blockchain technology, we consider
the following model.

Miners and pools: There are M ≥ 2 risk-neutral miners, indexed by

m ∈ M = {1, ...M }. While, in our model, we refer to each m as a miner, m
can also represent a mining pool, which coordinates the efforts of its miners
as regards which blocks they mine.

Mining technology: There is a continuous flow of transactions sent

for confirmation by end-users.8 For the moment, for simplicity, we assume
all miners perfectly and instantaneously observe this flow, which they include
in the blocks they mine.
8
For simplicity we take the flow of transactions to be exogenous, while in practice it can
actually be endogenous. In fact, we don’t model the transactions and model the blockchain
process directly at the level of the blocks.

14
 As explained in Nakamoto (2008), the time it takes miner m to solve a
block problem is exponential with parameter θm . For a given computational
power, the greater the difficulty, the lower the intensity θm . A key property
of the exponential distribution is that it is memoryless: at each point in
time, the distribution of the waiting time until the miner finds a solution
is independent from how long the miner has been working on the problem.9
This waiting time is also independent of which block m is mining, and also
from the blocks the other miners are mining. We denote by Nm the Poisson
process jumping each time miner m solves a block. Thus, the number of
blocks solved by miner m between time 0 and time t, is
Z t
Nm (t) = dNm (s).
s=0

For simplicity we assume (in line with what happens in practice) that
miners do not update the set of transactions defining the block they mine
until they have solved the hash problem (transactions that flow in mean-
while are stored in a buffer.) Relaxing that assumption would not alter the
economic mechanism we analyse below.
We assume that at time zm , exponentially distributed, with parameter
λm , miner m is hit by a liquidity shock. At time zm the miner must leave
the game and sell the cryptocurrencies he earned previously to a new miner
who also inherits his beliefs and preferences.10 Thus, exits are compensated
by entries and the environment is stationary.

Blockchain: At time 0, there is an initial state of the ledger, encoded

in B0 , and a set of transactions. Starting from B0 , miners start working on
the first block, B1 , which contains the initial set of transactions. Once B1
is solved, miners must choose to which parent block to chain the next block
(B2 ) they mine. If miners choose B1 as a parent block, they continue the
first chain. Alternatively, miners can choose to disregard B1 and attach B2
to B0 . In that case, miners start a fork and there are two competing chains,
one including B0 and B1 , the other B0 and B2 .
9
Another key property of the exponential distribution is that the minimum of two
exponentials, with parameters θ and θ0 , is also exponential, with parameter θ + θ0 . Thus,
when interpreting the M players in our game as M pools, we interpret the intensity of
pool m, θm , as the sum of the intensities of all the miners active in that pool.
10
We explain below the process through which miner m accumulates cryptocurrencies.

15
 As the game unfolds, a tree of blocks develops. At each vertex Bk , the
tree includes a label, identifying the miner who solved the corresponding
block, m(Bk ). The indices of the blocks give the order in which they have
been solved. That is, if k < n, then block Bk was solved before block Bn .
Thus, at any time t, one can observe a tree of solved blocks C t = {B t , E t , I t },
where B t = (B0 , ...Bn ) is the set of all blocks that have been solved by time
t, E t = {(B0 , B1 ), ...(Bk , Bk0 ), ...}, with 0 ≤ k < k 0 ≤ n, is the set of edges
chaining these blocks, and I t = (m(B1 ), ...m(Bn )) is the set of identities
of miners who solved blocks. Within a tree, a chain is a sequence of con-
nected blocks in which each block is connected to at most one subsequent
block. Thus, each fork starts a new chain. More formally, we define a fork
as follows:
Definition 1 Fork: There is a fork at time t if and only if there exists
(Bi , Bk , Bk0 ) included in B t such that (Bi , Bk ) and (Bi , Bk0 ) belong to E t .
It is also useful to define the original chain for a given tree C t , as follows:
Definition 2 Original Chain: Suppose E t contains (Bi , Bk ) and (Bi , Bk0 ).
A chain that includes (Bi , Bk ) preexists a chain that includes (Bi , Bk0 ) if and
only if k < k 0 . We call the original chain the chain that preexists all other
chains in C t .
Note that the original chain is well defined since the “preexist” relation
provides a complete ranking of all chains (as all chains have at least one
common block, B0 ).

Stopping times: We assume miners make decisions at different points

in time, corresponding to a sequence of stopping times. Whenever a block
is solved or a miner is hit by a liquidity shock, all miners make a decision.
Miners can also make a decision, after a time interval of length ∆, if no
block is solved and no liquidity shock has occurred during that interval. ∆
can be arbitrarily small to approximate a continuous time environment.11
Thus, the sequence of stopping times at which miners make decisions is
T ={0, ...τj , τj+1 , ...} where the next stopping time after τj , τj+1 , is equal
to τj+1 = min[τj + ∆, τ l (τj ), τ b (τj )], τ l (τj ) being the first time a liquidity
shock occurs after τj and τ b (τj ) the first time a block is solved after τj .
11
This discretisation enables us to avoid technical issues regarding the definition of
strategies in continuous time games.

16
 Action space: At any time τ ∈ T , miners observe the set B τ of all
the blocks that have been solved previously. A miner’s action is the choice
of which block in B τ to attach his current block to. All miners m ∈ M =
{1, ...M } face the same action space.

Payoffs: When miner m solves a block in a given chain, he receives a

reward, included in the block he mined, and expressed in the cryptocurrency
corresponding to that chain.12 We assume that miner m consumes the re-
wards he earned throughout the game at time zm . That is, we assume that,
until time zm , the miner keeps the units of cryptocurrency he earned.13
At time zm , the payoff from each solved block depends on the credibility
of the chain that contains the block. Consider two polar cases: In the first
case, a block solved by a miner becomes orphaned, i.e., no further blocks are
attached to it, so that no miner expresses acceptance of that block and the
transfer of cryptocurrency it encodes. In the second case there is a single
chain to which all blocks belong, reflecting consensus on the blocks in that
chain. The value of a reward in the first case, is likely to be zero, and is
bound to be smaller than in the second case. Next, consider an intermediate
case, in which the block is included in a chain competing with another one.
As long as a significant fraction of the miners are working on each of the
chains, the value of rewards included in the blocks of the two chains, while
uncertain, can remain positive. B miner solving B miner payoff
More formally, the payoff for miner m from solving B is an increasing
function, G(.), of the number of miners active at time zm in the chain includ-
ing B. For example, suppose there are two active chains at time zm . If there
are K miners active in the chain including B, and M − K in the other, the
payoffs from solving blocks are the following: The miner who solved block
B, which we denote by m(B), earns G(K) for block B. A miner who solved
a block in the other chain earns G(M − K) for that block. If a miner solved
a block that belongs to both chains, he earns G(M − K) + G(K).14 We set
12
For simplicity, we neglect transaction fees offered by final traders, since we do not
model explicitly transactions.
13
On Bitcoin, miners have to wait for at least 100 blocks before using their rewards.
In most digital currencies, a so called “k-blocks rule” prevents miners from using rewards
before sufficiently many blocks have been chained to their rewarding block. Our model
takes the simplified view that the vesting period lasts until zm .
14
We also assume that, if zm occurs just after a fork starts, the not yet realised fork
does not reduce the credibility of the current chain. That is, m(Bn ) earns G(M ) for Bn

17
G(0) = G(1) = 0 since, when there is only one or no miner on a chain, the
associated cryptocurrency has no value. Finally, we assume that when sev-
eral chains compete, the total value of a unit of cryptocurrency that belongs
to the competing chains is weakly lower than if it belonged to a single chain
that was the consensus of all miners: G(M − K) + G(K) ≤ G(M ), ∀K.
Our assumption that the value of the virtual currency is reduced by forks
is illustrated by Figure 4, which plots the decline in bitcoin value during the
March 2013 fork. The first vertical line indicates the time (around 22:00) at
which miners started working on two different chains. Chats between miners
realising there was a fork, started around 23:30.15 At 1:30 am, a message
posted on Bitcointalk asked miners to stop mining one the two branches of
the chain (the 0.8 branch). The second vertical line (approximately at 6:20)
indicates the time at which the 0.7 branch caught up the 0.8 branch. By 7:30,
miners had stopped mining the 0.8 branch, which became orphaned, so that
the fork was no longer active. The figure illustrates that, when the market
realised that miners worked on different branches this triggered a 25% drop
in the value of the virtual currency (from around $48 at 1:00 am to around
$36 at 3:00).

States: At time τ ∈ T , a state ωτ includes three elements:

• First, ωτ includes the tree of solved blocks C τ = {B τ , E τ , I τ }. The

entire set of previously solved blocks, B τ , is relevant for the miners,
since they can chain a new block to any of these previously solved
blocks. For each miner, the set of blocks he solved, measurable with
respect to I τ , determines his payoff, and therefore influences his actions.

• Second, ωτ includes the number of miners active on branches stemming

from each of the previously solved blocks:16 Aτ = (Aτ (B1 ), ..Aτ (Bk ), ...Aτ (Bn )),
where Aτ (Bk ) is the number of miners mining at time τ a block directly
in that case. Alternative hypotheses could be that the attempt to fork reduces mining
rewards. Our proofs are robust to the assumption that the reward is reduced to some
arbitrary g < G(M ) or to G(K) if K miners are active on the chain.
15
Source: http://web.archive.org/web/20130421062600/http://bitcoinstats.com:80/irc/bitcoin-
dev/logs/2013/03/12.
16
In practice, miners cannot directly observe the current distribution of the computing
power across the different branches of the chain, but estimate it based on the observed
frequency of block resolutions. In our analysis, equilibrium strategies only depend on Aτ
via miners’ payoffs at zm .

18
 Figure 4:
BTC/USD trade prices on Bitstamp exchange, around the March 2013 Bit-
coin fork.
The graph plots individual transaction prices obtained from a major bitcoin ex-
change platform, Bitstamp, during the March 11-12, 2013 fork. The first dotted
vertical line represents the time at which the fork started, and the second dotted
vertical line represents the time at which the original chain caught up the fork.
Data source: Kaiko

chained to Bk , determines the value of each miner’s reward if he’s hit

by a liquidity shock. reward

• Finally, as in Duggan (2012) or Cole and Kehoe (2000), to enable play-

ers to coordinate their actions using a public randomisation device, we
assume that at each time τ ∈ T , the realisation of a sunspot random
variable rτ is observed by all, and we include it in the state. rτ is
uniformly distributed on [0, 1] and i.i.d. over time.
Thus, we define ωτ = ( C τ , Aτ , rτ ) and denote by Ω the set of states of

19
the world.

Strategies: Miner m chooses his strategy to maximise his expected

payoff at time zm . At each time τ ∈ T , miners observe the whole history of
the game, that is, the state ωτ , as well as, e.g., the exact timing of blocks
resolution and the previous mining choices. In line with Markov perfection,
we only consider strategies that are measurable with respect to ωτ .17 A pure
τ
strategy for miner m is a function σm mapping each possible state of the
blockchain ωτ ∈ Ω, into an element of the action space B τ . We denote the
strategy of miner m throughout the entire history of the game by σm and the
profile of strategies for the M miners by σ = {σm }m∈M . σ, combined with the
random variables {z}m∈M and {Nm }m∈M , yield the transition probabilities
from one state of the blockchain to the next.

Equilibrium: The above elements define our stochastic game. Our

equilibrium concept is Markov Perfect Equilibrium, i.e., Subgame Perfect
Equilibrium with strategies restricted to depend only on the current state
ωτ .

4 Equilibrium analysis
To analyse equilibrium strategies, it is useful to first note that an upper
bound on the lifetime payoff miner m can earn is
Z s=zm 
max
Gm = dNm (s) G(M ),
s=0

minus the price he paid for the cryptocurrency if he was not there at time
0. This sunk cost does not affect his strategies and we neglect it hereafter.
max
Gm R zm bound because i) the total number of blocks solved by m
is an upper
before zm is s=zm − dNm (t), whatever his mining strategy, and ii) m cannot

earn more than G(M ) each time he solves a block. At time t, the expectation
17
Indeed, the timing of previous block resolutions, as well as previous mining choices,
are payoff irrelevant.

20
 max
of Gm , conditional on zm ≥ t, is
Z t Z zm 
Et dNm (s) + dNm (s)|zm ≥ t G(M )
s=0 s=t
 Z zm   
θm
= Nm (t) + E dNm (s)|zm ≥ t G(M ) = Nm (t) + G(M ).
s=t λm

Does there exist a natural strategy enabling miners to achieve this max-
max
imum expected payoff? The definition of Gm implies that, to obtain the
maximum expected payoff, all miners should be on the same chain, when any
of them is hit by the liquidity shock. This is the case if all miners stick to the
original chain at any time τ ∈ T . If they do so the longest chain rule (LCR)
trivially holds. Our first proposition states that there exists an equilibrium
in which miners follow this strategy.

Proposition 1 There exists a Markov Perfect Equilibrium such that on the

equilibrium path there is a single chain and all miners follow the LCR, thus
max
obtaining their maximum expected payoff, E[Gm ].

The intuition for Proposition 1 is the following. When all miners up to τ

attach their blocks to the original chain, thus following the LCR, there is a
single chain at τ . If the others abide to this strategy, then m can obtain his
max
maximum possible expected payoff, E[Gm |ωτ ], by also abiding to it. Hence
there is no profitable one shot deviation from the strategy which consists
in extending the original (and thereby longest) chain. Precisely, each miner
rationally anticipates that if he deviates and solves a block, the other miners
would not follow him, and the block solved out of the equilibrium path would
have no value.
In the context of the strategic interaction characterised in Proposition 1,
miners are not really competing to solve their block before the others. That
another miner solves his block before m does not, in itself, reduce m’s gains.
The only thing that matters for miners to obtain the maximum payoff they
get in Proposition 1 is that they coordinate well and all work on the same
chain.
It is also noteworthy that the result in Proposition 1 does not depend on
the number of miners M . The economic mechanism involved in Proposition
1 does not hinge on strategic behaviour. It is purely driven by coordination
effects, which would also be at play in a competitive environment.

21
 Proposition 1 emphasises that attaching blocks to the original chain is a
simple way for miners to coordinate their actions, and results in a single chain
with no fork. There might, however, be other ways for miners to coordinate
in our stochastic game. In particular they could rely on the sunspot variable
rτ . We now exhibit an equilibrium in which conditioning actions on rτ leads
to equilibria with forks.
Intuitively, suppose miners follow the original chain until the realisation
of the sunspot variable is such that miners anticipate a fork. As shown below,
because of coordination effects, this anticipation is self fulfilling.
More precisely, let τ f be the first time at which the sunspot variable is
above 1 − ε (where ε can be arbitrarily small), and let n(τ ) denote the index
of the last block solved by time τ . We now state our next proposition:

Proposition 2 Consider an arbitrary integer f . There exists a Markov Per-

fect Equilibrium such that the following occurs on the equilibrium path: As
long as rτ ≤ 1 − ε, or f ≥ n(τ ), there is a single chain and all miners chain
their current block to Bn(τ ) . At the first time τ such that rτ > 1 − ε and
f < n(τ ), each miner chains his current block to Bn(τ )−f . Afterwards, min-
ers chain their current block to the last solved block on the chain including
the edge (Bn(τ )−f , Bn(τ )+1 ).

In the statement of the proposition we focus on what happens on the

equilibrium path. In the proof in the appendix, we characterise the equi-
librium strategy profile for any state. The intuition of Proposition 2 is the
following: If I expect all to fork to Bn(τ )−f , and if I choose to deviate and
not fork, any block I solve will not be followed by the other miners, and I
will earn no reward for this block. Rationally anticipating this, the rewards I
obtain on the new chain become more valuable, therefore I choose to do like
the others and fork.
Miners’ behaviour in Proposition 2 is reminiscent of actual participants’
behavior during the 2013 Bitcoin fork reported in Subsection 2.2. Just like
BTC Guild lost the rewards from blocks mined on the 0.8 branch, miners
in Proposition 2 lose rewards from blocks Bn(τ )−f +1 to Bn(τ ) , since the fork
stemming from Bn(τ )−f becomes the only active chain.18 They fork neverthe-
less because they anticipate that the others do. Consequently, these miners
max max
earn less than Gm , while the other miners do not earn more than Gm .
18
This might also eliminate some of the underlying transactions included in blocks
Bn(τ f )−f +1 to Bn(τ f ) .

22
Thus the forking equilibrium in Proposition 2 is Pareto dominated by the
single chain equilibrium in Proposition 1.
Observe that, like Proposition 1, Proposition 2 does not depend on the
number of miners M . Both propositions hinge on coordination effects, which
also arise in a competitive environment.
While in the previous proposition, in spite of forking, there was eventually
a single chain, we now show that forking can lead to the persistent coexistence
of different branches, as in the examples of the Ethereum 2016 and Bitcoin
2017 forks.
As in Proposition 2, we consider the possibility that, at any time τ f , the
realisation of the sunspot can suggest that some miners fork to a new chain.
This can, for instance, give rise to two coexisting chains at time τ > τ f , the
original chain, including the blocks linked by the sequence of edges
(B0 , B1 ), ...(Bn(τ f )−f , Bn(τ f )−f +1 ), ...
and a new chain, including the blocks linked by
(B0 , B1 ), ...(Bn(τ f )−f , Bk+1 ), ...
with k ≥ n(τ f ).
The number of blocks solved by m after Bn(τ f )−f on any of these two
chains defines the vested interest of m on that chain. We denote the vested
o
interests of miner m at time τ on the original and the new chain by vm (τ ) and
n
vm (τ ) respectively. For example, suppose miner m keeps mining the original
chain. The vested interest of that miner on the original chain at time τ is
o
equal to vm (τ ) = Nm (τ )−Nm (τ (Bn(τ f )−f )) (where τ (Bn(τ f )−f ) is the stopping
time at which Bn(τ f )−f is solved), while his vested interest on the new chain
n
is vm (τ ) = 0. Alternatively, consider miner m0 who mines the new chain from
time τ f on. The vested interest of that miner on the original chain at time
o f
τ is vm 0 (, τ ) = Nm0 (τ ) − Nm0 (τ (Bn(τ f )−f )), while his vested interest on the
n f
new chain is vm 0 (τ ) = Nm0 (τ ) − Nm0 (τ ). For miners switching between the

original chain and the new one, vested interests are a bit more intricate, but
follow the same logic.
In our model miners hold their rewards until zm . Our next result illus-
trates the consequences of these vested interests. To state that result, rank
the miners by their vested interest in the original chain at time τ f as follows
Pr(zm = τ 0 ) o f Pr(zm+1 = τ 0 )
v (τ ) ≤ v o (τ f ),
Pr(Nm (τ 0 ) − Nm (τ f ) = 1) m Pr(Nm+1 (τ 0 ) − Nm+1 (τ f ) = 1) m+1

23
where Pr(zm = τ 0 ) is the probability that at the next stopping time τ 0 , miner
m is hit by a liquidity shock, and Pr(Nm (τ 0 ) − Nm (τ f ) = 1) is the probability
that he solves his block at τ 0 .
Consider the following condition.

Condition 1 For any M and any K < M , G(K)+G(M −K) = G(M ), and
ωτ is such that there is a single chain and there exists K ∈ {Int( M2 )+2, ...M }
(where Int denotes the integer part) such that

G(M − K − 1) + G(M − K + 1)
G(M − K) ≤ (1)
2
and for m > K

Pr(Nm (τ 0 ) − Nm (τ ) = 1) o
(G(K)−G(M −K)) < vm (τ )(G(M −K)−G(M −K−1))
Pr(zm = τ 0 )
(2)
while for m ≤ K

Pr(Nm (τ 0 ) − Nm (τ ) = 1) o
(G(K)−G(M −K)) > vm (τ )(G(M −K+1)−G(M −K))
Pr(zm = τ 0 )
(3)

The assumption that for any M and any K < M , G(K) + G(M − K) =
G(M ), simplifies the presentation of Condition 1. However, Proposition 3
below also holds in the more general case where G(K)+G(M −K) ≤ G(M ).19
Consider an arbitrary integer f . Let τ f be the first time at which rτ >
1 − ε, f < n(τ ) and Condition 1 holds.

Proposition 3 For ε sufficiently small, there exists a Markov Perfect Equi-

librium in which, on the equilibrium path, the following occurs: As long as
τ < τ f there is a single chain and all miners chain their current block to
Bn(τ ) . At τ f , all miners m ≤ K (defined in Condition 1) chain their current
block to Bn(τ f )−f and follow that chain afterwards, while the other miners
chain their current block to Bn(τ f ) and follow that chain afterwards.
19
In addition to notational changes, it would require imposing an (arbitrarily large)
upper bound on miners’ vested interests.

24
 The intuition for this result is the following. First note that for some
miners to fork, we must have that the left-hand-side of (3) be non negative,
which implies that K ≥ M2 + 1. That is, in Proposition 3, persistent forks
can occur only if a majority of miners choose to fork and this is expected by
all.
Now, suppose all miners expect that a majority will fork and this will
result in two coexisting chains and consider the choice of miner m between
forking and remaining on the original chain. For m, the benefit from forking
is that the blocks he will mine on the new chain will be worth G(K), which is
larger than the value of blocks mined on the original chain, G(M − K). This
benefit is large if the probability that m solves a block in any given period,
Pr(Nm (τ 0 ) − Nm (τ ) = 1), is large relative to the probability that m leaves
the game because of a liquidity shock, Pr(zm = τ 0 ). Note that the ratio of
these probabilities increases with the ratio of the mining intensity θm to the
liquidity shock intensity, λm . This benefit is captured in the left-hand-side
of equations (2) and (3) in Condition 1.
On the other hand, the cost of mining the new chain is that it reduces
the value of the blocks already mined on the original chain. For instance,
if miner m > K deviates from the equilibrium strategy and mines the new
chain, he reduces the value of all the blocks he solved on the original chain
from G(M − K) to G(M − K − 1). This cost is large if m has large vested
o
interests in the original chain, that is, if vm (τ ) is large. This cost is captured
in the right-hand-side of equations (2) and (3) in Condition 1.
Overall, Proposition 3 shows that the endogenous sorting between miners
who prefer to stick to the original chain and those who fork is driven by two
forces: the number of blocks that a miner expects to solve in the future, λθm m
,
o
and his vested interest in the original chain, v (m, τ ). A miner is more likely
to fork when the former is higher, and the latter is lower.
Last, inequality (1) ensures that the set of miners who choose to stick to
the original chain has no intersection with the set of miners who prefer to
fork. Figure 5 represents the competing chains sustained at the equilibrium
of Proposition 3.
Unlike Proposition 1 and Proposition 2, the conditions in Proposition
3 depend on the number of miners. More precisely, the tradeoffs faced by
the miners involve the effect of their mining strategy on the value of their
rewards. If miners were competitive and their choice had no impact on the
value of their rewards, this strategic effect would not arise.
Finally note that the equilibrium outcome in Proposition 3 is Pareto

25
 Original chain with M − K miners

Bn(τ f )−f Bn(τ f )−f +1 Bn(τ f )+i

Bn(τ f )+1 Bn(τ f )+j

New chain with K miners

t
τf

Figure 5: Equilibrium of Proposition 3

dominated by that in Proposition 1. Again, forking reduces the total gains

of the miners, and yet it can arise in equilibrium.

5 Frictions
So far we have considered the frictionless case, in which, relying on abstract
sunspots, we have shown that coordination effects can lead to forks and mul-
tiplicity of equilibria. We now introduce frictions by allowing for information
delays, double spending attempts, and hard fork upgrades, and show that
they can play a similar role as sunspots in triggering forks. This underlines
that the fundamental problem is not the frictions per se, but the coordina-
tion effects that necessarily arise when seeking consensus in a decentralised
protocol.

5.1 Information transmission delays

One way to introduce frictions is to consider delays in the dissemination
of information through the network. Such delays could induce short term
forks. As mentioned above, Nakamoto (2008) considered that possibility and
conjectured that miners would follow the LCR and that this would resolve
short term forks. We explore below how delays can give rise to forks and
multiplicity of equilibria.

26
 To model information transmission, we introduce the following modifica-
tion of our framework: To keep things as simple as possible, we assume that
a delay in information transmission can happen only once. Thus, as long as
all miners have observed when all previous blocks were solved, each time a
new block Bn is solved there is a probability η that one (and only one) of the
miners does not observe that event. In that case each of the M − 1 miners
has an equal chance of not observing the block solved by the other miner.
(when this happens all miners don’t have the same stopping times.) As soon
as the next block (Bn+1 ) is solved, the miner who did not observe that Bn
was solved learns that information.

Proposition 4 When miners can observe solved blocks with a delay, there
exists a Markov Perfect Equilibrium such that on the equilibrium path miners
always mine the chain which they perceive to be the longest. If there are two
chains of the same length, each miner keeps mining the chain he was mining
just before.

At the equilibrium presented in Proposition 4, because of information

transmission delays, two chains of the same length can appear. At this
point, there is a fork. In that case, miners continue mining the chain on
which they were active before the fork. When one chain becomes strictly
longer, miners apply the LCR and the shortest branch of the fork becomes
orphaned. This is in line with the conjecture of Nakamoto (2008). The
equilibrium described in Proposition 4 therefore illustrates the robustness of
the LCR equilibrium of Proposition 1 in the presence of observation delays.
Yet, reflecting coordination issues, other equilibria can be sustained in which
miners deviate from the Nakamoto (2008) rule. This is illustrated in the
following proposition.
Proposition 5 When miners can observe solved blocks with a delay, there
exists a Markov Perfect Equilibrium such that on the equilibrium path miners
always mine the chain that they perceive as the longest. If there are two
chains of the same length, miners always chain to the forking branch, and
the original chain becomes orphaned.
In Proposition 5, miners follow the LCR on the equilibrium path, but, when
the information delay causes a fork, they abandon the chain on which they
were active and follow the fork. While similar in spirit to the sunspot anal-
ysed in Section 4, Proposition 5 offers a concrete example of an event that

27
can trigger a fork. In the proposition, the fork is only one-block-long because
the delay can only affect the observation of one block. By extension, longer
forks could be sustained if delays affected more blocks. Note that delays are
not necessarily due to network latency. In the case of the Bitcoin March
2013 Fork, a delay in the observation of several blocks occurred, because one
block was mistakenly rejected by computers using one version of the mining
software.

5.2 Double spending

Another important potential issue outlined in Nakamoto (2008) is double
spending. We study below whether it can arise at equilibrium. In the spirit
of the modelling of delays above, assume that after each block is solved, there
is a probability η 0 that one miner can divert the payment S from a transaction
included in the last block solved on the original chain. To earn S, the miner
needs to create a fork from the parent of that block, that becomes the only
active chain. Assume that this opportunity to double spend occurs only once
and denote Pr(m = m(B)) the probability that at any time τ , m solves the
next block.

Proposition 6 Assume each miner can receive an opportunity to double

spend and that for any miner

G(M )(2 − Pr(m = m(B)))

S> . (4)
Pr(m = m(B))

There exists a Markov Perfect Equilibrium such that on the equilibrium path
miners always mine the longest chain, except the miner who has the opportu-
nity to double spend. The latter tries to create a fork longer than the original
chain. If he succeeds, all miners chain to his fork and the original chain is
orphaned.

When a miner spots a double spending opportunity, he endeavours to

solve two blocks in a row before the other miners solve any new block on the
original chain. If he succeeds, a fork occurs which enables the miner to recover
S and therefore double spend it. The equilibrium described in Proposition 6
relies on a similar coordination effect as that of Proposition 4: miners have
an interest in following the longest chain when they anticipate that all other
miners (except possibly a miner who spotted a double-spending opportunity)

28
do the same. This in turn can induce a miner to create a fork that will be
followed by all miners if it becomes the longest. But in contrast with the case
of delays, the fork does not start accidentally, it is intentionally triggered by
the miner who tries to double spend. This miner finds it profitable to do so if
(4) holds. Condition (4) is explained as follows. When trying to create a fork
after spotting S, a miner has a high probability that his fork does not become
the longest chain. Hence, he bears the risk of mining blocks on the fork in
vain, and obtaining no reward. The higher the double spending S, the more
it compensates for these losses. Similarly, the higher Pr(m = m(B)), the
higher the probability that the fork succeeds. In Proposition 6, (4) holds for
all miners, so that all miners can start a fork. Alternatively, one can construct
an equilibrium such that only the miners with the largest computing power
can double spend. The condition under which double spending can occur
would then be less demanding than (4).
The theoretical possibility of double spending is only relevant in practice if
condition (4) is likely to hold. A back-of-the-enveloppe computation suggests
that if λ is small and there are 15 identical miners, (4) can be approximated
as S > 30G(M ). For Bitcoin, G(M ) = 12.5 bitcoins in 2017, hence for (4)
to hold, S must be larger than 375 bitcoins, which is a sizeable amount.

5.3 Upgrades
Blockchain participants may want to change the rules governing their mining
process by introducing upgraded versions of the mining software. To study
the impact of these upgrades, we assume it is common knowledge that just
after the nth block on the original chain has been solved, a new technology
is introduced. Then, miners must choose between staying with the existing
technology, C = 0, or adopting the new technology C = 1. From this point
on, miners choose between C = 0 and C = 1 for each block they mine.
To capture the notion of hard fork, we assume that miners can only chain
their block to a block solved with the same technology. We also assume that
each miner m derives a private benefit from using technology C. Private
benefits can reflect a cost advantage of using one technology over another.
For instance, it is argued that the mining pools controlled by Bitmain, an
ASIC manufacturer, favoured the Bitcoin Cash solution because they have

29
access to a patented mining-enhancing device20 that cannot be used with the
SegWit solution adopted on Bitcoin in august 2017. Alternatively, private
benefits can reflect ideological preferences: the attempt at increasing the size
of blocks on Bitcoin with the SegWit2X hard fork was supported by a group
of large mining pools. It was eventually defeated in november 2017 by the
Bitcoin core developers who opposed the principle of a hard fork (and the
idea of letting the SegWit2X proponents impose their solution).
To model private benefits, we assume that when solving a block with
technology C, miner m obtains a reward (1 + bm (C))G(K) where K is the
number of miners active on the chain containing this block and bm (C) > −1
for all m. Without loss of generality, we normalise bm (1) to 0.

Proposition 7 There exists a Markov Perfect Equilibrium in which, on the

equilibrium path, all miners follow the LCR and choose technology C = 0,
and another equilibrium in which, on the equilibrium path, all miners follow
the LCR and choose technology C = 1.

If miners anticipate that all other miners will choose one technology, say,
C = 0, then it is a best response to choose C = 0 as well, whatever the level
of private benefit associated with each technology. This is because each miner
anticipates that the others will follow the longest chain rule with the same
equilibrium technology, so there is no gain in mining a block with a different
technology. The equilibria described in Proposition 7 therefore hinge on the
same coordination effects as in Propositions 1 and 2.
When miners coordinate on the same technology and on following the
LCR, the level and distribution of private benefits does not affect which
equilibrium will prevail. In particular, it can be that C = 1 is chosen at
equilibrium even if all miners have a preference for C = 0 (i.e., even if
bm (0) > 0 ∀m). We explore below how a persistent fork can also be sustained
at equilibrium in the presence of private benefits. To do so, assume miners
m ∈ {1, 2, ...K} have bm (0) = 0, and miners m ∈ {K + 1, ...M } have bm (0) =
b > 0. Denote τ f the time at which the new technology is introduced.
G(K)
Proposition 8 If b ≥ G(M −K)
−1 and K ≥ M2 , there exists a Markov Perfect
Equilibrium in which, on the equilibrium path, for τ < τ f all miners follow
the LCR and for τ ≥ τ f , miners m ≤ K choose C = 1 and follow the LCR
20
This is the ASICBOOST technology that can increase the efficiency of the SHA-256
hash function.

30
on the chain of blocks mined with C = 1, and miners m > K choose C = 0
and follow the LCR on the chain of blocks mined with C = 0.

When some miners have sufficiently large private benefits, the introduc-
tion of a new technology can give rise to a disagreement on the technology
choice, which triggers a persistent fork on the blockchain. For a fork to
happen, it must be that a majority of miners have no private benefit (i.e.,
K ≥ M2 ): indeed, if a miner has no private benefit attached to a technology,
he chooses to mine blocks on the branch that yields the highest reward per
block solved, that is, the branch with the majority of miners. If K ≥ M2 ,
a majority of miners have no private benefit associated to C = 0, and can
coordinate on choosing C = 1 (even though they do not have any private
benefit associated to C = 1 either). When K miners choose C = 1, it is
costly for other miners not to adopt the same technology. They are never-
theless willing to stick to C = 0 if their level of private benefit b is sufficiently
large to compensate the loss in reward when mining blocks on a chain with
only M − K ≤ K active miners.
This result is reminiscent of the persistent fork equilibrium described in
Proposition 3 in which a minority of miners agree to split from the majority
because they have vested interests attached to one branch. One difference
with Proposition 3 is that here private benefits are exogenous, while vested
interests arose endogenously from the distribution of past solved blocks. An-
other difference is that here the fork can happen with probability one, simply
because some miners have different interests.
The introduction of upgrades in the blockchain bears similarities with
patterns observed in open source programs, in which coordination effects
and conflicting interests can lead to the splintering of programs into several
variants (see Lerner and Tirole (2002)).

6 Computing capacity
We now endogenise computing power in the network to investigate the re-
lation between equilibrium hash capacity and the socially optimal one. The
determination of equilibrium capacity is similar to that in Dimitri (2017).
Our contribution relative to Dimitri (2017) is to identify an externality in
the computing power acquisition game, which drives a wedge between equi-
librium and social optimality.

31
 For each miner m, the instantaneous probability of solving a block, θm ,
is determined by his individual computing power, or hash power, and by the
difficulty of the mining task set by the network protocol, D:21
hm
θm = . (5)
D
The difficulty is set so that the expected time between two blocks is equal
to a constant, X (on Bitcoin X = 10 minutes), that is
1
X=P . (6)
i∈M θi

Substituting (5) into (6), we get

X
D=X hi . (7)
i∈M

D must be larger than or equal to 1. Moreover,

By construction, the difficulty P
if the total computing power i∈M hi was lower than 1/X it would not be
feasible to have one block solved every X units of time. Consequently we
impose the technical constraint that
X
hi ≥ 1/X. (8)
i∈M

Therefore
1 h
θm = P m . (9)
X i∈M hi
We now analyse the individually optimal choice of hm by miner m. To
make this choice the miner needs to anticipate how his computing power
will affect his continuation game payoff. To do so, the miner needs to form
a conjecture on the equilibrium that will prevail in the mining game. For
simplicity, we assume that all miners rationally anticipate that the single
chain equilibrium described in Proposition 1 will prevail.
The program of miner m is
θm cm (hm )
max G(M ) − ,
hm λm λm
21
Indeed, when miners try to solve the hash problem, at each trial they have a probability
1
D to solve the problem. The hash power hm is the number of trials per unit of time.

32
where cm (hm ) is the cost of using hm per unit of time and therefore can be
thought of as the rental cost of the equipment plus the cost of electricity.
Miner m bears this cost until he is hit by a liquidity shock.22
Substituting (9) this is

P hm
i∈M hi cm (hm )
max G(M ) − .
hm λm X λm
It is reasonable to assume that the cost function is linear, that is cm (hm ) =
cm hm , which yields the following first order condition:
P

i∈M hi − hm G(M )

2 = cm . (10)
X
P
hi i∈M

A Nash equilibrium of the computing power acquisition game is a vector

{h∗m }m=1,...M
such that h∗m is the optimal choice of miner m when he antic-
ipates the others will choose h∗−m . The following proposition presents the
equilibrium computing capacity of the network.
P
i∈M i c
Proposition 9 Assume that cm ≤ M −1
≤ G(M ), ∀m. When miners
anticipate that no fork will occur on the network, their equilibrium computing
capacity is defined by
 
∗ G(M ) M − 1 M −1
hm = P 1 − cm P . (11)
X i∈M ci i∈M ci

The total computing capacity installed on the network is

X G(M ) M − 1
h∗i = P . (12)
i∈M
X i∈M ci

P
i∈M ci
Condition
P
cm ≤ ensures that the solution to (11) is positive for all
M −1
i∈M ci
≤ G(M ) ensures that i∈M h∗i ≥ X1 as requested by (8).
P
miners and M −1
Equilibrium individual computing power is increasing in the mining reward
(G(M )), decreasing in the average duration between blocks (X) and P in the
unit cost cm . Consequently, total network capacity decreases with i∈M ci .
22
For simplicity, when miner m is hit by a shock, his successor inherits the computing
capacity hm .

33
 We now compare the equilibrium network capacity to what miners would
choose if they could coordinate their choice and maximise their joint profit.
To do so in the simplest way, we consider the special case in which all miners
have the same cost c and the same λ.
The corresponding maximisation problem is
1 h c
max M ( P G(M ) − h).
h λX m h λ
This is decreasing in h. So miners coordinate on P the smallest possible value
of h, corresponding to D = 1. PWe then have i∈M hi = X1 . Comparing
i∈M ci
this to (12), and recalling that M −1
≤ G(M ), there is overinvestment in
computing power: if miners could cooperatively decide on their individual
computing capacity, each would invest M1X . But if all miners invest M1X ,
then any miner m has an incentive to increase his own h in order to increase
his probability to solve blocks, leading to an arms race in computing capac-
ity. This uncovers an additional cost of decentralised ledgers compared to
centralised ones.

7 Conclusion
Our analysis suggests that miners’ incentives are key to the production of
a robust consensus in a blockchain. While miners benefit from coordinating
on a single chain, thereby maintaining consensus, coordination motives may
also lead them to abandon portions of the blockchain. This jeopardises the
blockchain’s key function, i.e., producing a stable and immutable history of
transactions. In addition, vested interests, by counteracting coordination
motives, may lead to the persistence of multiple active chains.
Our approach could be taken in different directions going forward. First,
the current design could be enriched by providing miners with additional
tools to avoid coordination failures. In particular, communication among
miners could play a role in this context, and provide a rationale for informa-
tion channels such as IRC networks and forums, or flags attached to blocks
to signify support for an upgrade. Second, one could study how modifying
the current design would affect stability. A natural candidate is miners’ pay-
ment scheme which could, for instance, reward some orphaned blocks, as is
already the case on Ethereum. Another component of miners’ profits are the
rewards attached to transactions to provide incentives for faster validation.

34
On Bitcoin, these payments are bound to become more significant relative
to rewards for solving blocks and could affect the nature of the interaction
between miners. Finally, alternative protocols, such as proof-of-stake, have
been put forward, if not fully implemented, and their properties could be
compared to the design we study here. Overall, we hope that the current
model can be a first step towards a better understanding of decentralised
transaction systems.

35
Appendix
Notation
We summarize below notation we use throughout the proofs:

- τ (Bn ) is the stopping time at which block Bn is solved,

- n(τ ) is the index of the last block solved by time τ ,

- Nm (τ ) is the total number of blocks solved by miner m by time τ ,

C
- Nm (τ ) is the number of blocks solved by miner m on chain C by time
o
τ . In particular, Nm (τ ) is the number of blocks solved by m on the
original chain,

- p(Bn ) is the index of the block to which Bn is chained (his parent).

∗
The following Lemma implies that a candidate strategy profile {σm }m∈M
forms a Markov Perfect Equilibrium (MPE) if and only if no miner has a
profitable one-shot deviation after any possible history of the game ωτ .

Lemma 10 Our blockchain game is continuous at infinity.

Proof of Lemma 10
Denote by J(σm ) the expected payoff of miner m if he follows strategy σm .
0
Consider an alternative strategy, σm , that prescribes the same actions as σm
until time T and differs afterwards. The difference between the two expected
payoffs can be written as
0 0
J(σm ) − J(σm ) = Pr(zm ≤ T )E[J(σm ) − J(σm )|zm ≤ T ]
0
+ Pr(zm > T )E[J(σm ) − J(σm )|zm > T ].

Now, by definition,
0
E[J(σm ) − J(σm )|zm ≤ T ] = 0.

Moreover
lim Pr(zm > T ) = 0,
T →∞

36
 0 max
and J(σm ) − J(σm ) is bounded, since Gm is finite. Hence,
0
lim J(σm ) − J(σm ) = 0,
T →∞

which ensures that our game is continuous at infinity.

QED

Proof of Proposition 1
The candidate equilibrium strategy specifies that miners always chain their
block to the last block on the original chain. We let Bn denote that block,
and check that no miner has a profitable one-shot deviation.
Consider the strategy of miner m at time τ after history ωτ . We break
the analysis into three cases, the probabilities of which are independent of
the miners’ actions (they reflect the distributions of independent Poisson
processes with exogenous intensities).

i) Suppose the next event is zm . The equilibrium strategy prescribes that

all miners mine the original chain. Therefore if m follows the equilibrium
strategy and chains his block to the last block on the original chain,
Bn , he earns G(M ) for each block he solved on the original chain and
G(0) = 0 for any other block.
Suppose m deviates and does not chain his block to Bn . By definition,
he cannot earn more than G(M ) for each block he solved on the original
chain. In addition, he cannot earn more than G(1) = 0 for each block
he solved on forks since all other miners mine the original chain. Hence
deviating is not strictly profitable in this case.

ii) Suppose the next event is that a block is solved by another miner than m
at time τ 0 .23 Then the state of the blockchain at τ 0 , ωτ 0 , does not depend
on m’s action at τ . By definition, ωτ 0 captures all the payoff-relevant
information, hence m’s action at τ does not affect his payoff.

iii) Suppose the next event is that m solves block Bn(τ )+1 at time τ 0 . Since all
other miners play the equilibrium strategy going forward and m himself
23
The next event can also be that nothing happens, or that another miner is hit by a
liquidity shock. Which block m chose as a parent block is also irrelevant in those cases.
For brevity, we ignore these cases in the remainder of the proofs.

37
 reverts to mining the original chain after τ 0 (one-shot deviation), which
block m chose as a parent block at τ does not affect the payoff m expects
from previously mined blocks or from future blocks. Consequently, m’s
payoff in any one shot deviation differs from his equilibrium payoff only
in the reward he obtains for Bn . This reward is G(M ) if m played the
equilibrium strategy and chained Bn(τ )+1 to Bn , and G(0) if he chained
Bn(τ )+1 to any other block as in that case, no miner will ever chain a
block to Bn(τ )+1 . Hence deviating is strictly dominated in this case.

Overall, there is no state ωτ in which a one-shot deviation gives m a

strictly higher expected payoff than the candidate equilibrium strategy, which
therefore forms a MPE.
QED

Proof of Proposition 2
Let τ f be the first time the sunspot variable is above 1 − ε and f is strictly
lower than the number of blocks n(τ ). We call “new chain” the chain created
by the fork. Formally, for every τ > τ f , the new chain, if it exists, is
the chain containing (Bn(τ )−f , Bk ) that preexists all other chains containing
(Bn(τ )−f , Bk ), where k ≡ min{k̂ > n(τ f ), (Bn(τ )−f , Bk̂ ) ∈ ωτ }.
Our candidate equilibrium strategy specifies the following:

a) Before the fork: If τ < τ f , miners chain their block to the last block on
the original chain.

b) At the fork inception and after the fork: If τ ≥ τ f , miners chain their
block to the last block on the new chain, or to Bn(τ )−f if the new chain
does not exists.

We now show that miner m does not have a profitable one-shot deviation
from this strategy at time τ .

a) Before the fork. Since m’s actions do not affect the occurrence of the
sunspot, for τ < τ f the proof operates along the same lines as the proof
of Proposition 1.

38
b) At the fork inception and after the fork. Suppose τ ≥ τ f . As in the proof
of Proposition 1, we can restrict attention to the case where m solves
the next block, Bn(τ )+1 , at time τ 0 . In that case, m0 s equilibrium payoff
differs from his payoff in a one-shot deviation only in the reward for block
Bn(τ )+1 . Since m expects all miners, including himself, to attach their
block to the last block on the new chain after τ 0 , m’s reward for block
Bn(τ )+1 is G(M ) if he played the equilibrium strategy and chained his
block to the last block on the new chain (or to Bn(τ )−f ), and G(0) = 0 if
he chained Bn(τ )+1 to any other block.

QED

Proof of Proposition 3
Preliminary steps
n
We define the new chain as in the proof for Proposition 2, and let vm (τ ) =
n n f
Nm (τ ) − Nm (τ ) be miner m’s vested interests on that chain, that is, the
number of blocks he solved on the new chain after τ f .
To define our equilibrium strategies, we use the following condition, which
we will derive explicitly in the proof:

Condition 2 For τ ≥ τ f , ωτ is such that for m > K

o n
vm (τ )(G(M − K) − G(M − K − 1)) − vm (τ )(G(K + 1) − G(K)) ≥
0
Pr(Nm (τ ) − Nm (τ ) = 1)
(G(K) − G(M − K)), (13)
Pr(zm = τ 0 )

while for m ≤ K
o n
vm (τ )(G(M − K + 1) − G(M − K)) − vm (τ )(G(K) − G(K − 1)) ≤
0
Pr(Nm (τ ) − Nm (τ ) = 1)
(G(K) − G(M − K)). (14)
Pr(zm = τ 0 )

Our candidate equilibrium strategy profile specifies the following:

a) Before the fork: If τ < τ f , miners chain their block to the last block
on the original chain.

39
 b) At the fork inception and after the fork: If τ ≥ τ f and Condition 2
holds, miners m ≤ K chain their block to Bn(τ f )−f if the new chain
does not exist, and to the last block on the new chain otherwise, while
miners m > K chain their block to the last block on the original chain.
c) After the fork off-path: Suppose τ > τ f and Condition 2 does not hold.
f
Let ∆ω ≡ ω τ \ω τ (i.e., ∆ω contains the history of the game between τ f
and τ ). Then for every τ 0 ≥ τ , all miners play the strategy prescribed
0
after history ω τ \∆ω that is defined in b). In playing strategies defined
in b), miners consider that the original and the new chain are defined
0
with respect to history ω τ \ ∆ω. 24

As will become explicit below, the specification of the equilibrium strategy

in states described in c) is useful to rule out certain types of deviations.
To show that a miner does not have a profitable one shot deviation, we
consider each of the cases above in turn.

Proof of part a): Before the fork.

Miner m’s one-shot deviation from equilibrium at time τ < τ f has two
effects on his expected payoff. First, it can affect the distribution of vested
interests on the original chain at future times τ such that rτ > 1 − ε. Second,
as in the proof for Proposition 2, it can impact the value of the block m
chooses to mine. As in the previous proofs, these effects are affected by m’s
action at τ only if he solves the next block, Bn(τ )+1 .
Consider the first effect. The occurrence of a fork may reduce the payoff
participants receive from the blocks they will mine after τ f , as well as some
of the blocks they have mined before τ f , namely, the f blocks between the
last block solved before the sunspot, Bn(τ f ) and the first block that does not
belong to the new chain, Bn(τ f )−f +1 . For each of these blocks, as well as
for the blocks solved after τ f , the maximal loss for miner m is G(M ). In
addition m’s deviation has an impact on the materialisation of this loss only
if the sunspot occurs before m’s liquidity shock when m plays the equilibrium
strategy. Hence, an upper bound on this loss, or equivalently, on the gain
from reducing the likelihood of a fork via a deviation is
θm
Pr(τ f < zm |ωτ )[f + ]G(M ).
λm
24
In words, miners play as if the blocks solved between τ f and τ do not exist.

40
Now,
Z ∞
f
Pr(τ < zm |ωτ ) = Pr(τ f < zm |ωτ , zm )λm e−λm zm dzm .
zm =τ

Observe that

Pr(τ f < zm |ωτ , zm ) < Pr(∃τ < zm , rτ > 1−ε|ωτ , zm ) = 1−Pr(∀τ < zm , rτ ≤ 1−ε|ωτ , zm ).

Moreover,

Pr(∀τ < zm , rτ ≤ 1 − ε|ωτ , zm ) = E[(1 − ε)ν(τ,zm ) |ωτ , zm ],

where ν(τ, zm ) is the number of stopping times between τ and zm . Now, for
small ε, a Taylor expansion yields

(1 − ε)ν(τ,zm ) ≈ 1 − ν(τ, zm )ε.

Hence, for small ε,

Pr(∀τ < zm , rτ ≤ 1 − ε|ωτ , zm ) ≈ 1 − E[ν(τ, zm )]ε.

Hence, if ε is close enough to 0, Pr(τ f < zm |ωτ , zm ), and therefore the gain
from reducing the likelihood of a fork via a deviation, can be arbitrarily
small.
Next consider the second effect. If miner m solves Bn(τ )+1 but this block
is not on the original chain, no further block will be chained to it, since
all miners henceforth play the equilibrium strategy. Hence the expected
payoff for this block is G(0) = 0. If instead m was following the equilibrium
strategy when he solved Bn(τ )+1 , the expected payoff from this block is strictly
positive.
Overall, the first effect, which reflects the maximum gain from a one-shot
deviation can be set arbitrarily close to 0, while the second effect, which
reflects the cost of a one shot deviation, is bounded away from 0. Hence,
there is no profitable one-shot deviation.

Proof of part b): At or after the fork:

i) Consider first a deviation by a miner m > K.

Any deviation other than chaining to the last block on the new chain
is ruled out by similar arguments as in Proposition 1. Hence we just

41
 check that m prefers to chain his block to the last block on the original
chain, rather than to the last block on the new chain. As in the proof
of Proposition 1, a one-shot deviation affects m’s payoff only if the next
stopping time τ 0 corresponds to two possible events: either m is hit by
a liquidity shock or m solves a block.

- Suppose miner m solves a block at τ 0 , i.e., Nm (τ 0 ) − Nm (τ ) = 1.

If Condition 2 is still true at τ 0 , since every miner, including m,
reverts to the equilibrium strategy from τ 0 on, the only impact
of the deviation is that m earns G(K) for block Bn(τ 0 ) instead of
G(M −K) under the equilibrium strategy. If Condition 2 is not true
at τ 0 , then from c), the impact of the deviation is that m earns 0 for
block Bn(τ 0 ) instead of G(M − K) under the equilibrium strategy,
and loses all rewards for blocks solved between τ f and τ 0 .
- Suppose miner m is hit by a liquidity shock at τ 0 , i.e., zm = τ 0 .
Then his payoff under the deviation is
o n o
vm (τ )G(M − K − 1) + vm (τ )G(K + 1) + Nm (τ (Bn(τ f )−f ))G(M )
instead of
o n o
vm (τ )G(M − K) + vm (τ )G(K) + Nm (τ (Bn(τ f )−f ))G(M )
under the equilibrium strategy.25

It follows that there is no profitable deviation if

Pr(Nm (τ 0 ) − Nm (τ ) = 1)[G(K) − G(M − K)] ≤
Pr(zm = τ 0 )[vm
o n
(τ )(G(M − K) − G(M − K − 1)) − vm (τ )(G(K + 1) − G(K))],
which is exactly inequality (13) in Condition 2.
ii) Consider next a deviation by a miner m ≤ K. A symmetric reasoning
yields that there is no profitable deviation if
Pr(Nm (τ 0 ) − Nm (τ ) = 1)[G(K) − G(M − K)] ≥
Pr(zm = τ 0 )[vm
o n
(τ )(G(M − K + 1) − G(M − K)) − vm (τ )(G(K) − G(K − 1))],
which is exactly (14) in Condition 2.
25
Note that we used the assumption that ∀K, G(M ) = G(M − K) + G(K) to write
down miner m’s payoff from blocks solved before τ (Bn(τ f )−f ).

42
 Next, see that at τ = τ f , vm
n
(τ f ) = 0 for all miners. Inequality (13) is
then written:
Pr(Nm (τ 0 ) − Nm (τ f ) = 1) o
[G(K)−G(M −K)] < vm (τ f )[G(M −K)−G(M −K−1)],
Pr(zm = τ 0 )
which is exactly inequality (2) in Condition 1. Similarly, inequality (14) is
then written:
Pr(Nm (τ 0 ) − Nm (τ ) = 1) o
[G(K)−G(M −K)] > vm (τ )[G(M −K+1)−G(M −K)]
Pr(zm = τ 0 )
which is exactly inequality (3) in Condition 1.
Furthermore, if miners adhere to the equilibrium strategy, then miners
m ≤ K always mine the new chain so that inequality (3) in Condition 1
implies that inequality (14) in Condition 2 is true at any τ ≥ τ f . Symmet-
rically, given that miners m > K stick to the original chain, Condition 2 is
always verified after τ f . Hence, given that Condition 1 holds at τ f , then for
τ > τ f , Condition 2 holds on the equilibrium path.
Last, see that inequality (1) in Condition 1 guarantees that (2) and (3)
cannot be satisfied jointly for the same miner m.

Proof of part c): After the fork off-path

Suppose ωτ is as described in c). Then given that all other players play
the equilibrium, m’s payoff from adhering to the equilibrium strategy is as
in b) above. Following the same logic as in the proof of b), other deviations
can be ruled out.
QED

Proof of Proposition 4
Our candidate equilibrium strategy specifies the following:
a) If a miner solved a block outside the original chain thereby creating a
one-block-long fork as long as the original chain, that miner chains his
next block to the block he just solved.

b) Otherwise, each miner chains his current block to the last block solved
on the original chain, except if there is a fork starting with two blocks
consecutively solved by the same miner, longer than the original chain. In

43
 that case, each miner chains his block to the longest chain, which miners
consider to be the original chain from that point on.26
We further assume that G(M − 1) + G(1) = G(M ). Indeed, there can
be a transient fork created by one miner who did not observe in time the
actual state of the original chain. If another miner is hit by a liquidity shock
precisely when the fork is being formed, the blocks previously solved by that
other miner, which with certainty will not become orphaned, are worth at
the time of the fork G(M − 1) + G(1). Given equilibrium strategies, the same
blocks will be worth G(M ) just after the fork is resolved. Our assumption
means that these blocks have the same value at and after the fork. This
assumption also mirrors the assumption that G(1) = G(0): if only one miner
is not on the same chain as the others, the reward for solving blocks is not
affected. We specify below when this assumption is used.27

Proof of part a)
Let Bn be the last block solved on the original chain. Suppose that at
time τ , miner m has just created a one-block-long fork as long as the original
chain by solving Bn(τ ) that is chained to Bn ’s parent, p(Bn ).28
As earlier, the relevant choice for m is between chaining his next block
to Bn(τ ) (the equilibrium strategy) and chaining it to Bn (the only relevant
deviation). As in the proof of Proposition 1, a one-shot deviation affects
m’s payoff only if the next stopping time corresponds to two possible events:
either m is hit by a liquidity shock or m solves a block.

i) Suppose the next event is zm . If m deviated and chained his block to

Bn his payoff is
o
G(0) + Nm (τ (Bn ))G(M ).
Indeed, all miners, including m, chain to Bn . Hence, m earns G(0) for
solving block Bn(τ ) and G(M ) for every block he solved on the original
chain up to τ (Bn ).
26
This is to define equilibrium strategies if a second fork occurs off the equilibrium path.
27
This assumption simplifies the proofs but is not necessary to establish the results.
If we instead assume that G(M − 1) + G(1) < G(M ), the proposition would still hold
provided that the probability of a liquidity shock is sufficiently small.
28
Since the equilibrium strategies are defined for all states, including those which are
not on the equilibrium path, we cannot exclude that out of equilibrium, some blocks are
solved outside the original chain before or after Bn is solved: p(Bn ) is not necessarily
Bn−1 , and Bn(τ ) is not necessarily Bn+1 .

44
 If, instead, m followed the equilibrium strategy and chained his block to
Bn(τ ) his payoff is
o
G(1) + Nm (τp(Bn ) )[G(M − 1) + G(1)] + 1{m=m(Bn )} G(M − 1).
Since m is the only miner chaining to Bn(τ ) , he earns G(1) for block
Bn(τ ) . In addition, m earns G(M − 1) + G(1) for each block he solved on
the original chain up to p(Bn ), reflecting the occurence of a fork where
m chains to Bn(τ ) and the M − 1 other miners chain to Bn . Finally, m
earns G(M − 1) for Bn if he solved it.
Since by assumption G(M − 1) + G(1) = G(M ) and G(1) = 0, the
deviation is not strictly profitable in that case
ii) Suppose the next event is that m solves block Bn(τ )+1 .

- If m deviated and chained his block to Bn , the original chain be-

comes the only active chain and Bn(τ ) is orphaned. m’s expected
gain is
o
Nm (τ (Bn ))G(M ) + G(M )
Z zm
+ E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )] − L(τ (Bn(τ )+1 )).
τ (Bn(τ )+1 )

Indeed, m earns G(M ) for each block he solved on the original

chain up to Bn and for Bn(τ )+1 . The conditional expectation is
his expected reward for the blocks solved after τ (Bn(τ )+1 ) if none
becomes orphaned.29 L(τ (Bn(τ )+1 ) is the expected loss due to one
m’s blocks solved after τ (Bn(τ )+1 ) becoming orphaned. On the
equilibrium path, orphaned blocks occur iff a miner observes a block
with delay and creates a successful fork.
- If instead m played the equilibrium strategy and chained his block
to Bn(τ ) , the chain including Bn(τ ) and Bn(τ )+1 becomes the longest,
hence the only active one. m’s expected gain is
o
Nm (τ (p(Bn )))G(M ) + 2G(M )
Z zm
+ E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )] − L(τ (Bn(τ )+1 )),
τ (Bn(τ )+1 )

29
As before, if zm occurs when a fork starts, these previously solved blocks are worth
G(M − 1) + G(1) which is equal to G(M ) by assumption in that case.

45
 where the second term capture rewards for Bn(τ ) and Bn(τ )+1 .

It follows that a deviation is strictly dominated in this case.

Proof of part b)
As earlier, Bn is the last block solved on the original chain.
1) Suppose that at time τ , there is no fork of two consecutive blocks solved
by the same miner and longer than the original chain.
For any miner m (who has not started a fork), the two relevant choices
are to follow the equilibrium strategy and chain his block to Bn , or to create
a fork by chaining his block to p(Bn ) and try solving two blocks in a row
(other deviations are ruled out by the same reasoning as in Proposition 1).
As in the proof of Proposition 1, a one-shot deviation affects m’s payoff
only if the next stopping time corresponds to two possible events: either m
is hit by a liquidity shock or m solves a block. If the next event is zm , m’s
o o
payoff is Nm (zm )G(M ) (if there is no fork), or Nm (zm )(G(M − 1) + G(1)) =
o
Nm (zm )G(M ) (if a fork was started by another miner) whether he follows
the equilibrium strategy or deviates. If the next event is that m solves
block Bn(τ )+1 , there are two possible continuations: Either another miner
does not observe that m solved Bn(τ )+1 or all miners observe that m solved
Bn(τ )+1 . The probabilities of these two events are independent of m’s action,
we consider them in turn.

i) If all miners observe that m solved Bn(τ )+1 , m’s expected gain if he
followed the equilibrium strategy and chained Bn(τ )+1 to Bn is
Z zm
o
(Nm (τBn ) + 1)G(M ) + E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )]
τ (Bn(τ )+1 )

− L(τ (Bn(τ )+1 )).

The first term is the reward for blocks solved up to τ (Bn ) plus the reward
for mining Bn(τ )+1 when the latter remains on the original chain. The
conditional expectation is m’s expected reward for solving blocks after
τ (Bn(τ )+1 ). The last term, L(τ (Bn(τ )+1 )) is the expected loss due to one
of m’s blocks solved after τ (Bn(τ )+1 ) becoming orphaned.

46
 m’s expected gain if he deviated and chained Bn(τ )+1 to p(Bn ) is30

Nm (τ (p(Bn )) + 1{m=m(Bn )} Pr(Bn = p(Bn(τ )+2 )) + Pr(m = m(Bn(τ )+2 )) G(M )

 o 
Z zm
+ E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )] − L(τ (Bn(τ )+1 )).
τ (Bn(τ )+1 )

Indeed, m earns G(M ) on all blocks solved on the original chain up to

τ (p(Bn ), on Bn if he solved it and it remains on the active chain (if
Bn(τ )+2 is attached to Bn ), and on Bn(τ )+1 if it is included in the active
chain (if m solves Bn(τ )+2 ).31
The second term is the continuation payoff for all blocks solved after
Bn(τ )+1 if they are not orphaned afterwards. The third term is the
expected loss due to one of m’s blocks solved after τ (Bn(τ )+1 ) becoming
orphaned. Neither term depends on which block m chains Bn(τ )+1 to.
Since Nm o o
(τ (Bn )) ≥ Nm (τ (p(Bn )) + 1{m=m(Bn )} Pr(Bn = p(Bn(τ )+1 )), if
all miners observe that m solved Bk+1 , m’s expected payoff is larger if
he followed the equilibrium strategy than if he deviated.

ii) If one miner (m0 ) did not observe that m solved Bn(τ )+1 , m’s expected
gain if he followed the equilibrium strategy is

[Nmo
(τ (Bn )) + 1 − Pr(m0 = m(Bn(τ )+2 ) = m(Bn(τ )+3 ))]G(M )
Z zm
+ E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )].
τ (Bn(τ )+1 )

The first term is m’s expected reward for solving blocks up to Bn(τ )+1 ,
reflecting the risk that Bn(τ )+1 become orphaned if m0 solves Bn(τ )+2 and
Bn(τ )+3 . The second term is m’s continuation payoff, reflecting that m
will be mining on the single active chain (be it the original one or a fork
that becomes the consensus).
30
Clearly, this is the only relevant deviation since m cannot obtain more if he chained
Bn(τ )+1 to Bn(τ ) if Bn(τ ) started a fork: Bn(τ )+1 will never be on the active chain given
the equilibrium strategies, even if m solves Bn(τ )+2 . A fortiori, m cannot obtain more if
he decides to chain Bn(τ )+1 to any block Bi with i < n(τ ) outside the original chain.
31
A fork can happen if one miner does not observe Bn(τ )+1 , but even in that case,
Bn(τ ) , as well as all previously solved blocks, will be on the active chain and yield G(M )
or G(M + 1) + G(1) = G(M ) depending on when zm occurs.

47
 If m deviated by chaining Bn(τ )+1 to p(Bn ),32 to earn his reward on
Bn(τ )+1 , m needs to solve Bn(τ )+2 so his expected gain is

Nm (τ (p(Bn )) + 1{m=m(Bn )} Pr(Bn = p(Bn(τ )+2 )) + Pr(m = m(Bn(τ )+2 )) G(M )

 o 
Z zm
+ E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )].
τ (Bn(τ )+1 )

As above
o
Nm o
(τ (Bn )) ≥ Nm (τ (p(Bn ))) + 1{m=m(Bn )} Pr(Bn = p(Bn(τ )+2 )).

Consequently, there is no profitable deviation if

1 − Pr(m0 = m(Bn(τ )+2 ) = m(Bn(τ )+3 )) ≥ Pr(m = m(Bn(τ )+2 )).

That is

1 ≥ Pr(m = m(Bn(τ )+2 )) + Pr(m0 = m(Bn(τ )+2 ) = m(Bn(τ )+3 )),

which holds because

1 ≥ Pr(m = m(Bn(τ )+2 )) + Pr(m0 = m(Bn(τ )+2 )) ≥

Pr(m = m(Bn(τ )+2 )) + Pr(m0 = m(Bn(τ )+2 ) = m(Bn(τ )+3 )).

This completes the first part of the proof of the optimality of the strategy
stated in b).

2) Suppose there is a fork starting with two blocks consecutively solved by

the same miner and longer than the original chain. The equilibrium strategy
then prescribes that miners chain their block to the longest chain.
If one miner observed a block with delay, we are in the same situation as
in Proposition 1, and there is no profitable deviation from mining the longest
chain. Off the equilibrium path, however, that fork could have occurred for
other reasons, and a new fork could still occur because of a delay in the
future. In that case there is no profitable deviation (in particular, trying to
create a fork by solving two blocks in a row is dominated by the equilibrium
strategy), as shown in the first part of b).
QED
32
As above, this is the only relevant deviation.

48
Proof of Proposition 5
Our candidate equilibrium strategy specifies the following:
a) If a miner solved a block outside the original chain thereby creating a
one-block-long fork as long as the original chain, all miners chain their
next block to the fork, which miners consider to be the original chain from
that point on.
b) Otherwise, each miner chains his current block to the last block solved on
the original chain.
Proof of part a)
Let Bn be the last block solved on the original chain, suppose Bk+1 , with
k ≥ n, is chained to p(Bn ). As above, the relevant choice for m at time
τ is between chaining his next block to Bk+1 (the equilibrium strategy) and
chaining it to Bn (the only relevant deviation). As in the proof of Proposition
1, a one-shot deviation affects m’s payoff only if the next stopping time
corresponds to two possible events: either m is hit by a liquidity shock or m
solves a block.
i) Supppose the next event is zm . If m deviated and chained his block to
Bn his payoff is
1{m=m(Bk+1 )} G(M − 1) + 1{m=m(Bn )} G(1) + Nmo (τ (p(Bn )))G(M ),
where G(M − 1) is his reward if he solved block Bk+1 , and G(1) his
reward if he solved Bn . If, instead, m followed the equilibrium strategy
and chained his block to Bk+1 his payoff is
1{m=m(Bk+1 )} G(M ) + 1{m=m(Bn )} G(0) + Nmo (τ (p(Bn )))G(M ).
Since by assumption G(M − 1) ≤ G(M ) and G(1) = G(0), the deviation
is not strictly profitable.
ii) Suppose the next event is that m solves block Bn(τ )+1 .
If m chained his block to Bn , Bn(τ )+1 becomes orphaned since all miners,
including m mine the fork after τ (Bn(τ )+1 ). m’s expected gain is
o
Nm (τ (p(Bn )))G(M ) + 1{m=m(Bk+1 )} G(M ) + 1{m=m(Bn )} G(0) + G(0)
Z zm
+ E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )] − L(τ (Bn(τ )+1 )),
τ (Bn(τ )+1 )

49
 since blocks Bn and Bn(τ )+1 are orphaned and earn G(0). As before,
L(τ (Bn(τ )+1 )) is the expected loss due to one of the blocks solved by m
after τ (Bn(τ )+1 ) becoming orphaned.
If instead m had chained his block to Bk+1 , m’s expected gain is
o
Nm (τ (p(Bn )))G(M ) + 1{m=m(Bk+1 )} G(M ) + 1{m=m(Bn )} G(0) + G(M )
Z zm
+ E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )] − L(τ (Bn(τ )+1 )),
τ (Bn(τ )+1 )

since now m earns G(M ) for solving Bk+2 .

It follows that the deviation is strictly dominated.

Proof of part b)
As before, Bn is the last block solved on the original chain. Assume there
is no one-block-long fork of the same length as the original chain at time τ .
The only relevant deviation for miner m is to try and start a fork by chaining
his current block to p(Bn ). If zm occurs, or if another miner solves the next
block, m’s payoff is not affected by which block he currently mines.
Consider the case where the next event is that m solves block Bn(τ )+1 . If
m deviated and chained Bn(τ )+1 to p(Bn ), his payoff is:
o
Nm (τ (p(Bn )))G(M ) + G(M )
Z zm
+ E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )] − L(τ (Bn(τ )+1 )).
τ (Bn(τ )+1 )

Indeed, all miners chain their future blocks to the chain that contains Bn(τ )+1 ,
therefore m earns G(M ) for Bn(τ )+1 . If m played the equilibrium strategy
and chained Bn(τ )+1 to Bn , he obtains the same payoff, since he earns G(M )
for Bn(τ )+1 as well. Therefore there is no profitable deviation.
QED

Proof of Proposition 6
Our candidate equilibrium strategy specifies the following

a) If a miner has the opportunity to double spend, he mines a block chained

to the parent of the last block solved on the original chain.

50
b) If a miner solves a block that creates a one-block-long fork as long as
the original chain, that miner chains his next block to the block he just
solved, except if he spots an opportunity to double-spend, in which case
he plays according to a).
c) Otherwise, each miner chains his current block to the last block solved
on the original chain, except if there is a fork starting with two blocks
consecutively solved by the same miner, longer than the original chain. In
that case, each miner chains his block to the longest chain, which miners
consider to be the original chain from that point on.
The general structure of the proof is similar to that of Proposition 4. As in
this previous proof, we assume that G(M −1)+G(1) = G(M ) to simplify the
exposition. We also clarify that the miner who earns the reward S is the one
who completes a double-spending fork before being hit by his liquidity shock
zm . In particular, a miner who initiates a double-spending fork but is hit by
a liquidity shock before the fork is resolved does not earn S. By contrast,
a miner who successfully completes a double-spending fork initiated by the
miner he replaced does earn S.

Proof of part a)
Let Bn be the last block solved on the original chain. Consider the strat-
egy of miner m who spots the opportunity to double spend at time τ .
Following the same reasoning as above, the relevant choice for m is be-
tween chaining his next block to p(Bn ) (the equilibrium strategy), chaining it
to Bn , or chaining it to Bn(τ ) if Bn(τ ) is chained to p(Bn ) and m = m(Bn(τ ) ).
(This can happen off path if m started a fork from p(Bn ) and spots the
double-spending opportunity right after. By assumption, S can only be
earned if m creates a new fork from p(Bn ).) As in the proof for Proposi-
tion 1, we can restrict attention to the cases where the next event is that m
either is hit by a liquidity shock, or solves a block.
Suppose first that the next event is zm . If m deviated and chained his
o
block to Bn his payoff is Nm (τBn )G(M ). If, instead, m followed the equilib-
rium strategy and chained his block to p(Bn ) his payoff is
o
Nm (τ (p(Bn )))[G(M − 1) + G(1)] + 1{m=m(Bn )} G(M − 1).

Last, suppose m = m(Bn(τ ) ) and Bn(τ ) is chained to p(Bn ). If m deviated and

chained his block to Bn(τ ) , his payoff is the same as when chaining his block to

51
p(Bn ), plus G(1) for solving Bn(τ ) .33 Since by assumption G(M −1)+G(1) =
G(M ) and G(1) = 0, the deviations are not strictly profitable.
Alternatively, suppose next event is that m solves Bn(τ )+1 .
To analyse this case, we condition m’s payoffs on the event that m =
m(Bn(τ )+2 ), that is m solves Bn(τ )+2 before being hit by a liquidity shock.
This event’s probability is independent from m’s strategy, and if m follows
the equilibrium strategy, then m earns S if and only if this event is true.

i) Suppose m solves Bn(τ )+2 .

If m deviated and chained his block to Bn , his payoff is
Z zm
o
Nm (τ (Bn ))G(M )+2G(M )+E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+2 )].
τ (Bn(τ )+2 )

m earns G(M ) for all the blocks solved on the original chain up to τ (Bn ).
m earns G(M ) for solving Bn(τ )+1 and Bn(τ )+2 which belong to the orig-
inal chain, and for all the future blocks solved after τ (Bn(τ )+2 ), since m
knows that no other double spending opportunity will be spotted.
If m = m(Bn(τ ) ) and Bn(τ ) is chained to p(Bn ), if m deviated and chained
Bn(τ )+1 to Bn(τ ) , his payoff is
Z zm
o
Nm (τp(Bn ) )G(M )+3G(M )+E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+2 )].
τ (Bn(τ )+2 )

m’s fork has succeeded and he earns G(M ) on all blocks solved up to
p(Bn ) on the original chain, plus on Bn(τ ) , Bn(τ )+1 and Bn(τ )+2 .
If m played the equilibrium strategy and chained Bn(τ )+1 to p(Bn ), his
payoff is
Z zm
o
Nm (τp(Bn ) )G(M )+2G(M )+E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+2 )]+S.
τ (Bn(τ )+2 )

m earns G(M ) for all the blocks he solved before the fork (up to p(Bn )),
G(M ) for Bn(τ )+1 and for Bn(τ )+2 , and for all the future blocks solved
after τBn(τ )+2 , since on the equilibrium path all miners mine on the chain
including Bn(τ )+2 . In addition, m earns S from double-spending.
33
In that case a fork has started so the reward for solving Bn is G(M − 1) which is lower
than G(M ). This makes the deviation even less profitable.

52
 Hence, the net benefit of following the equilibrium strategy rather than
deviating is S − max{1{m=m(Bn )} ; 1{[m=m(Bn(τ ) )] T[p(Bn(τ ) )=p(Bn )]} }G(M ).

ii) Suppose that either zm occurs before τ (Bn(τ )+2 ) or zm occurs after τ (Bn(τ )+2 )
but m does not solve Bn(τ )+2 . To write m’s payoff, we will distinguish
the two events when needed.
If m deviated and chained Bn(τ +1) to Bn , his payoff is
o
Nm (τ (Bn ))G(M ) + G(M )
Z zm
+ Pr(zm > τ (Bn(τ )+2 ))E[ dNm (t)G(M )dt|zm > τ (Bn(τ )+2 )].
τBn(τ )+2

(15)

m earns G(M ) for all the blocks solved up to τ (Bn ), for Bn(τ )+1 (since
it is on the original chain), and for blocks solved after τ (Bn(τ )+2 ) if
zm > τ (Bn(τ )+2 ).
If m = m(Bn(τ ) ) and Bn(τ ) is chained to p(Bn ), if m deviated and chained
Bn(τ )+1 to Bn(τ ) , his payoff is
o
Nm (τ (p(Bn )))G(M ) + 2G(M )
Z zm
+ Pr(zm > τ (Bn(τ )+2 ))E[ dNm (t)G(M )dt|zm > τ (Bn(τ )+2 )].
τBn(τ )+2

(16)

m’s fork has succeeded and he earns G(M ) on all blocks solved up to
p(Bn ) on the original chain, plus on Bn(τ ) and Bn(τ )+1 .
If m played the equilibrium strategy and chained Bn(τ )+1 to p(Bn ), his
payoff is

- if zm occurs first,
o
Nm (τ (p(Bn )))(G(M − 1) + G(1)) + 1{m=m(Bn )} G(M − 1) + G(1).

In that case, m has created a one-block-long fork as long as the

original chain when he is hit by his liquidity shock. Therefore, he
earns G(M − 1) + G(1) for all the blocks he solved on the original
chain up to τ (p(Bn )). He also earns G(M − 1) for Bn if he solved
it and G(1) for Bn(τ )+1 .

53
 - if Bn(τ )+2 is solved by another miner before zm ,
Z zm
o
Nm (τBn )G(M )+G(0)+E[ dNm (t)G(M )dt|zm > τ (Bn(τ )+2 )].
τBn(τ )+2

m’s fork fails, therefore he earns G(M ) for all the blocks he solved
on the original chain up to τ (Bn ) and for the blocs solved after
τ (Bn(τ )+2 ).

Since G(M − 1) = G(M ),34 gains earned by m on all blocks solved up

to τ (Bn ) are the same in the two events above. Hence m’s payoff if he
played the equilibrium strategy when he does not solve Bn(τ )+2 is:
Z zm
o
Nm (τBn )G(M )+Pr(zm > τ (Bn(τ )+2 ))E[ dNm (t)G(M )dt|zm > τ (Bn(τ )+2 )].
τBn(τ )+2
(17)
Hence, the net benefit of following the equilibrium strategy rather than
deviating when m does not solve Bk+2 is the difference between (17) and
the max of (15) and (16), that is,
n o
− G(M ) + (1{[m=m(Bn(τ ) )]∩[p(Bn (τ ))=p(Bn )]} − 1{m=m(Bn )} )G(M ) .

Overall, m always follows the equilibrium strategy (including when he

solved Bn ) iff

Pr[m = m(Bn(τ )+2 )|m = m(Bn(τ )+1 )][S − G(M )]

> (1 − Pr[m = m(Bn(τ )+2 )|m = m(Bn(τ )+1 )])2G(M )

G(M )(2 − Pr[m = m(Bn(τ )+2 )|m = m(Bn(τ )+1 )])

⇔ S> .
Pr[m = m(Bn(τ )+2 )|m = m(Bn(τ )+1 )]

Remark that Pr(m = m(Bn(τ )+2 )|m = m(Bn(τ )+1 )) is just the probability
that at any time m solves the next block.

Proof of part b)
34
Again, allowing for G(M − 1) < G(M ) only makes the condition under which the
equilibrium exists more intricate.

54
 As earlier, Bn is the last block solved on the original chain. Suppose that
at time τ , miner m has just created a one-block-long fork as long as the
original chain by solving Bn(τ ) that is chained to Bn ’s parent, p(Bn ). The
relevant choice for m at τ is between chaining his next block to Bn(τ ) (the
equilibrium strategy) and chaining it to Bn (the only relevant deviation).
The reasoning is analogous to the proof of Proposition 4 part a), hence we
only sketch it here.

i) Suppose that the next event is zm .

If m deviated and chained his block to Bn , the original chain remains
the only active chain and m’s payoff is
o
G(0) + Nm (τ (Bn ))G(M ),

where the first term is the reward for Bn(τ ) .

If, instead, m followed the equilibrium strategy and chained his block to
Bk+1 his payoff is
o
G(1) + Nm (τ (p(Bn )))[G(M − 1) + G(1)] + 1{m=m(Bn )} G(M − 1),

where the first term is the reward for Bn(τ ) . Since G(M − 1) + G(1) =
G(M ) and G(1) = 0, this deviation is not strictly profitable.

ii) Suppose the next event is that m solves Bn(τ )+1 .

If m deviated and chained his block to Bn , the original chain remains the
only active chain and Bk+1 becomes orphaned. Therefore, m’s expected
payoff is
Z zm
o
Nm (τ (Bn ))G(M ) + G(M ) + E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )]
τ (Bn(τ )+1 )

+ S(τ (Bn(τ )+1 )) − L(τ (Bn(τ )+1 )),

where the second term is the reward for Bn(τ )+1 . As earlier, L(τ (Bn(τ )+1 )),
is the expected loss due to one of m’s blocks solved after τ (Bn(τ )+1 ) be-
coming orphaned. S(τ (Bn(τ )+1 )) is the expected benefit from m spot-
ting a double-spending opportunity after τ (Bn(τ )+1 ). Note that both
L(τ (Bn(τ )+1 )) and S(τ (Bn(τ )+1 )) are conditional on m’s information at
τ . For instance, if m already had a double-spending opportunity, then
L(τ (Bn(τ )+1 )) = S(τ (Bn(τ )+1 )) = 0.

55
 If instead m played the equilibrium strategy and chained Bn(τ )+1 to Bn(τ ) ,
the chain including Bn(τ ) and Bn(τ )+1 becomes the longest one, and all
miners hereafter chain their blocks to it. Thus m expected payoff is at
least equal to
Z zm
o
Nm (τp(Bn ) )G(M ) + 2G(M ) + E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+2 )]
τ (Bn(τ )+1 )

+ S(τ (Bn(τ )+2 )) − L(τ (Bn(τ )+2 )),

where the second term is the reward for Bn(τ )+1 and Bn(τ )+2 . This payoff
is higher by S if m has the double-spending opportunity (the only case
on the equilibrium path).

Since 1{m=m(Bn )} ≤ 1, m prefers to follow the equilibrium strategy.

Proof of part c)
The reasoning is analogous to the proof of Proposition 4 part b), we only
sketch it here. Bn is the last block on the original chain
1. First consider the case in which there is no fork of two consecutive
blocks solved by the same miner and longer than the original chain. For
any miner m who does not have the double-spending opportunity, the
only two relevant choices are to chain his block to Bn (the equilibrium
strategy) and to create a fork and try solving two blocks in a row (the
only relevant deviation). As in the proof for Proposition 1, we can
restrict attention to the cases where the next event is that m either is
hit by a liquidity shock, or solves a block.
- Suppose the next event is zm . If m followed the equilibrium strat-
o o
egy, his payoff is Nm (zm )G(M ) (if there is no fork), or Nm (zm )(G(M −
o
1) + G(1)) = Nm (zm )G(M ) (if a fork has started). If m deviated,
o
his payoff is at most equal to Nm (zm )G(M ).
- Suppose the next event is that m solves block Bn(τ )+1 .
If m followed the equilibrium strategy and chained Bn(τ )+1 to Bn ,
his expected payoff is
Z zm
o
(Nm (τBn ) + 1)G(M ) + E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )]
τ (Bn(τ )+1 )

+ S(τ (Bn(τ )+1 )) − L(τ (Bn(τ )+1 )).

56
 If m deviated and chained Bn(τ )+1 to p(Bn ), his expected payoff is

Nm (τ (p(Bn )) + 1{m=m(Bn )} Pr(Bn = p(Bn(τ )+2 )) + Pr(m = m(Bn(τ )+2 )) G(M )

 o 
Z zm
+ E[ dNm (t)G(M )dt|zm ≥ τ (Bn(τ )+1 )] + S(τ (Bn(τ )+1 )) − L(τ (Bn(τ )+1 )).
τ (Bn(τ )+1 )

Since
o
Nm o
(τBn ) ≥ Nm (τp(Bn ) ) + 1{m=m(Bn )} Pr(Bn = p(Bn(τ )+2 )),

m’s expected payoff is larger if he followed the equilibrium strategy

than if he deviated.

2. Consider the case in which there is a fork starting with two blocks
consecutively solved by the same miner and longer than the original
chain. If that fork occurred because one miner exploited a double-
spending opportunity, we are in the same situation as in Proposition
1, and there is no profitable deviation from mining the longest chain.
If that fork occurred for other reasons (off the equilibrium path), a
new fork could still occur because of a double-spending opportunity in
the future. In that case there is no profitable deviation (in particular,
trying to create a fork by solving two blocks in a row is dominated by
the equilibrium strategy), as shown in the first part of c).

QED

Proof of Proposition 7
Let τ f be the time at which the nth block is solved on the original chain.
Hence, Bn(τ f ) is the nth block on the original chain. We say that a chain
“conforms” to technology C if every block on that chain solved after τ f was
mined with technology C. We call “C-chain” the chain that contains Bn(τ f ) ,
conforms to C, and preexists all other chains containing Bn(τ f ) and conform-
C
ing to C. Nm (τ ) is the number of blocks solved by m up to τ on the C-chain.
Our candidate equilibrium strategy specifies the following:

a) For every τ < τ f , miners chain their block to the last block on the original
chain,

57
b) For every τ ≥ τ f , miners choose C = 0 and chain their block to the last
block on the chain that contains Bn(τ f ) , conforms to C = 0, and preexists
all other chains containing Bn(τ f ) and conforming to C = 0. If such a
chain does not exist, miners choose C = 0 and chain their block to Bn(τ f ) .

We consider each case in turn.

a) Suppose τ < τ f . Then using the same reasoning as in Proposition 1, a

deviation is not profitable.

b) Suppose τ ≥ τ f . As in the proof of Proposition 1, it is sufficient to

compare payoffs when m solves the next block, Bn(τ )+1 .
If miner m played the equilibrium strategy, that is, chose C = 0 and
chained his block to the last block on the 0-chain, or to Bn(τ f ) , his payoff
is
0
Nm (τ )(1 + bm (0))G(M ) + (1 + bm (0))G(M )
Z zm
+ E[ dNm (t)(1 + bm (0))G(M )dt|zm ≥ τ (Bn(τ )+1 )]
τ (Bn(τ )+1 )

The first term is m’s rewards from blocks he solved on the 0-chain up to
τ . The second term is the reward from solving Bn(τ )+1 , and the last term
is the expected value of solving future blocks on the 0-chain.
If instead, miner m deviated and chained his block to another block than
the last one on the 0-chain, using any technology C, his payoff is
0
Nm (τ )(1 + bm (0))G(M ) + (1 + bm (C))G(1)
Z zm
+ E[ dNm (t)(1 + bm (0))G(M )dt|zm ≥ τ (Bn(τ )+1 )]
τ (Bn(τ )+1 )

Hence, the only difference between m’s payoff if he deviates and his equi-
librium payoff is the reward from solving block Bn(τ )+1 . This reward is
(1 + bm (C))G(1) = 0 if he deviates and (1 + bm (0))G(M ) > 0 if he plays
the equilibrium strategy. It follows that a deviation is not profitable.

A symmetric argument sustains the equilibrium in which all miners choose

C = 1.
QED

58
Proof of Proposition 8
We use the same notation as in the proof of Proposition 7 for the C-chain.
To define our equilibrium strategies, we need to introduce the following
condition, which we will derive explicitly in the proof:

Condition 3 For τ ≥ τ f , ωτ is such that for m > K

Pr(Nm (τ 0 ) − Nm (τ ) = 1)(G(K) − (1 + b)G(M − K)) ≤

( )
0 0 f
(Nm (τ ) − Nm (τ ))(1 + b)(G(M − K) − G(M − K − 1))
Pr(zm = τ 0 ) 1 1
,
−(Nm (τ ) − Nm (τ f ))(G(K + 1) − G(K)))
(18)

and for m ≤ K

Pr(Nm (τ 0 ) − Nm (τ ) = 1)(G(K) − G(M − K)) ≥

( )
0 0 f
(Nm (τ ) − Nm (τ ))(G(M − K + 1) − G(M − K))
Pr(zm = τ 0 ) 1 1
. (19)
−(Nm (τ ) − Nm (τ f ))(G(K) − G(K − 1)))

Our candidate equilibrium strategy specifies the following

a) Before the hardfork: If τ < τ f , miners chain their block to the last block
on the original chain.

b) At the hardfork or after: If τ = τ f , or if τ > τ f , and Condition 3 holds,

miners m ≤ K choose C = 1 and chain their block to Bn(τ f ) if the 1-chain
does not exist, and chain their block to the last block solved on the 1-
chain otherwise, while miners m > K choose C = 0 and chain their block
to Bn(τ f ) if the 0-chain does not exist, and chain their block to the last
block on the 0-chain otherwise.

c) After the hardfork off-path: Suppose τ > τ f and Condition 3 does not
f
hold. Let ∆ω ≡ ω τ \ ω τ (i.e., ∆ω contains the history of the game
between τ f and τ ). Then for every τ 0 ≥ τ , all miners play the strategy
0
prescribed after history ω τ \∆ω that is defined in b). In playing strategies
defined in b), miners consider that the 0-chain and the 1-chain are defined
0
with respect to history ω τ \ ∆ω.

59
 We need to prove that a miner does not have a profitable one shot devi-
ation from σ ∗ . We hereafter consider each of the cases above in turn.

Proof of part a): Before the fork

Following the reasoning of the proof of Proposition 1, there is no profitable
deviation. In particular, it is not profitable for any miner m ≤ K to choose
C = 1 before τ f since any block solved with C = 1 will, by definition, not
belong to the 1-chain and yield a reward of 0. Also, note that unlike in the
proof of Proposition 3, miners’ actions before τ f cannot after the condition
under which the hardfork occurs.

Proof of part b): at or after the fork

i) Consider first a deviation by a miner m > K.

Any deviation other than chaining to the last block on the 1-chain is
ruled out by similar arguments as in Proposition 1. Hence check that
m prefers to mine blocks on the 0-chain, rather than on the 1-chain.
As earlier, this one-shot deviation affects m’s payoff only if the next
stopping time τ 0 , corresponds to two possible events: either m solves his
block, or zm occurs.

- Suppose miner m solves a block at τ 0 , i.e., Nm (τ 0 ) − Nm (τ ) = 1.

If Condition 3 is still true at τ 0 , since every miner, including m,
reverts to the equilibrium strategy from τ 0 on, the only impact
of the deviation is that m earns G(K) for block Bn(τ 0 ) instead of
(1 + b)G(M − K) under the equilibrium strategy. If Condition 3 is
not true at τ 0 , given c), the impact of the deviation is that m earns
0 for block Bn(τ 0 ) instead of (1 + b)G(M − K) under the equilibrium
strategy and loses all rewards for blocks solved between τ f and τ 0 .
- Suppose miner m is hit by a liquidity shock at τ 0 , i.e., zm = τ 0 .
Then his payoff under the deviation is
0 0
(Nm (τ ) − Nm (τ f ))(1 + b)G(M − K − 1) + (Nm
1 1
(τ ) − Nm (τ f ))G(K + 1)
0
+ Nm (τ f )(1 + b)G(M )
instead of
0 0
(Nm (τ ) − Nm (τ f ))(1 + b)G(M − K) + (Nm
1 1
(τ ) − Nm (τ f ))G(K)
0
+ Nm (τ f )(1 + b)G(M )

60
 under the equilibrium strategy.35 It follows that there is no profitable
deviation if
Pr(Nm (τ 0 ) − Nm (τ ) = 1)(G(K) − (1 + b)G(M − K)) ≤
( )
0 0 f
(Nm (τ ) − Nm (τ ))(1 + b)(G(M − K) − G(M − K − 1))
Pr(zm = τ 0 ) 1 1
,
−(Nm (τ ) − Nm (τ f ))(G(K + 1) − G(K)))
which is exactly inequality (18) in Condition 3.

ii) Consider next a deviation by a miner m ≤ K. A symmetric reasoning

yields that there is no profitable deviation if
Pr(Nm (τ 0 ) − Nm (τ ) = 1)(G(K) − G(M − K)) ≥
( )
0 0 f
(Nm (τ ) − Nm (τ ))(G(M − K + 1) − G(M − K))
Pr(zm = τ 0 ) 1 1
,
−(Nm (τ ) − Nm (τ f ))(G(K) − G(K − 1)))
which is exactly (19) in Condition 3.
Next, see that at τ = τ f , Nm
C C
(τ ) = Nm (τ f ) for all miners. Inequality (18) is
then written:
G(K)
(1 + b)G(M − K) ≥ G(K) ⇔ b ≥ − 1.
G(M − K)
Similarly, inequality (19) is then written:
M
G(K) ≥ G(M − K) ⇔ K ≥ .
2
Furthermore, if miners adhere to the equilibrium strategy, then miners
m ≤ K always mine the 1-chain so that if K ≥ M2 , inequality (19) in Condi-
tion 3 is true at any τ ≥ τ f . Given that miners m > K stick to the 0-chain,
G(K)
if b ≥ G(M −K)
− 1, inequality (18) is always verified after τ f . Hence, for
τ ≥ τ f , Condition 3 holds on the equilibrium path.
Proof of part c): After the fork off-path
Suppose ωτ is as described in c). Then given that all other players play
the equilibrium, m’s payoff from adhering to the equilibrium strategy is as
in b) above. Following the same logic as in the proof of b), other deviations
can be ruled out.
QED
35
Note that we used the assumption that ∀K, G(M ) = G(M − K) + G(K) to write
down miner m’s payoff from blocks solved before τ f .

61
Proof of Proposition 9
See first that miner m’s participation constraint is
X G(M )
hi ≤ . (20)
i∈M
cm X

Evaluated at equilibrium, (10) yields

! !2
X X X
h∗i − h∗m = cm h∗i
i∈M
G(M ) i∈M

! !2
X X X
h∗i − cm h∗i = h∗m . (21)
i∈M
G(M ) i∈M

Summing over miners

! ! !2 !
X
∗
X X X X
M hi − ci h∗i = h∗i∈
i∈M i∈M
G(M ) i∈M i∈M
! ! !2
X X X X
(M − 1) h∗i = ci h∗i
i∈M i∈M
G(M ) i∈M

(M − 1) G(M ) X
P = h∗m
i∈M c i X i∈M
X G(M ) M − 1
h∗i = P ,
i∈M
X i∈M ci

which is exactly (12) in P

Proposition 9. Into participation constraint (20),
this yields (M − 1)cm ≤ i∈M ci . Next, substituting (12) into (21)
   2
∗ G(M ) M − 1 X G(M ) M − 1
hm = P − cm P .
X i∈M ci G(M ) X i∈M ci
  
∗ G(M ) M − 1 X G(M ) M − 1
hm = P 1 − cm P
X i∈M ci G(M ) X i∈M ci
 
G(M ) M − 1 M −1
h∗m = P 1 − cm P ,
X i∈M ci i∈M ci

62
which is exactly (11) in Proposition 9. Last, replacing h∗m into miner m’s
objective function, one obtains that his equilibrium profit is
 2
G(M ) (M − 1)cm
1− P .
λm X i∈M ci

63
References
Biais, B., T. Foucault and S. Moinas, 2016, “Equilibrium Fast-Trading,” Jour-
nal of Financial Economics, 116(2), 292–313.

Bonneau, J., E. W. Felten, S. Goldfeder, J. A. Kroll, and A. Narayanan, 2016,

“Why buy when you can rent? Bribery attacks on Bitcoin consensus,”
Princeton University working paper.

Cass, D. and K. Shell, 1983, “Do sunspots matter?,” Journal of Political

Economy, 91(2), 193–227.

Cole, H. L. and T. Kehoe, 2000, “Self-Fulfilling Debt Crises", The Review of

Economic Studies, 67(1), 91-116.

Dimitri, N, 2017, “Bitcoin Mining as a Contest", Ledger, 2,

doi:https://doi.org/10.5195/ledger.2017.96.

Duggan, J., 2012, “Noisy Stochastic Games", Econometrica, 80(5), 2017–

2045.

Evans, D.S., 2014, “Economic aspects of Bitcoin and other decentralized

public-ledger currency platforms,” Coase-Sandor Working Paper Series in
Law and Economics, University of Chicago Law School.

Eyal, I., and E. G. Sirer, 2016, “Majority is not enough: Bitcoin mining is
vulnerable,” in International Conference on Financial Cryptography and
Data Security, Springer, 436–454.

Glode, V., R. Green, and R. Lowery, 2012, “Financial Expertise as an Arms

Race,” Journal of Finance, 67, 1723–1759.

Harvey, C. R., 2016, “Cryptofinance,” working paper.

Kroll, J. A., I. C Davey, and E. W. Felten, 2013, “The economics of Bitcoin

mining, or Bitcoin in the presence of adversaries,” in Proceedings of WEIS,
2013.

Lerner, J, and J. Tirole, 2002, “Some simple economics of open source,” The
Journal of Industrial Economics, 2, 197-234.

Nakamoto, S., 2008, “Bitcoin: A peer-to-peer electronic cash system.”

64
Narayanan, A., july 28, 2015, “Analyzing the 2013 Bitcoin fork:
centralized decision-making saved the day,” http://freedom-to-
tinker.com/2015/07/28/analyzing-the-2013-bitcoin-fork-centralized-
decision-making-saved-the-day.

Pease, M., R. Shostak, and L. Lamport, 1980, “Reaching Agreement in the

Presence of Faults,” J. ACM, 27(2), 228-234.

Schrijvers, O., J. Bonneau, D. Boneh, and T. Roughgarden, 2016, “Incentive

compatibility of Bitcoin mining pool reward functions,” Financial Cryp-
tography and Data Security.

Teutsch, J., S. Jain, and P. Saxena, 2016, “When cryptocurrencies mine their
own business,” Financial Cryptography and Data Security (FC 2016).

Yermack, D., 2017, “Corporate governance and blockchains,” Review of Fi-

nance, forthcoming.

65