Decentralizing Money: Bitcoin Prices and Blockchain Security

Abstract

We address the determination of bitcoin prices and decentralized security. Users forecast the transactional and resale values of holdings, pricing the risk of systemic attacks. Miners contribute resources to protect against attackers and compete for block rewards. Bitcoin’s design leads to multiple equilibria: the same blockchain technology is consistent with sharply different price and security levels. Bitcoin’s monetary policy can lead to welfare losses and deviations from quantity theory. Price-security feedback amplifies fundamental shocks’ volatility impact and leads to boom and busts unconnected to fundamentals. We characterize how viability versus fiat currency depends on bitcoin’s relative acceptability and inflation protection.

The rapid growth of Bitcoin has sparked heated debates. The issue of bitcoin¹ price determination and volatility is particularly elusive. On the one hand, those in investment and entrepreneurial circles often argue that price reflects fundamental factors, such as the security of the underpinning blockchain technology. A prominent view in the academic and policy communities, on the other hand, is that bitcoins are just part of a cryptocurrency bubble that will eventually burst, and, therefore, prices are meaningless. Bitcoin’s persistently high price volatility is frequently offered as evidence of disconnection from fundamentals.² While both perspectives could yield elements of truth, reaching a consensus is challenged by the fact that traditional monetary and asset pricing models were not designed around a decentralized system, such as Bitcoin.

Two crucial differences are immediately recognizable in the system designed by Nakamoto (2008): the security model and its monetary policy. Security is paramount to any financial network, since transfers of ownership require verification, and it should be difficult for an attacker to manipulate historical records. In a centralized system, a specific trusted agent, such as a central bank, government, or a corporation, assumes such responsibility. In Bitcoin, however, verification and updates to the system ledger (blockchain) rely on self-selected noncooperating agents, the miners. The reward to successful miners includes a predetermined number of newly minted bitcoins, which is the sole source of supply increase. Monetary policy is, therefore, not only driven by a software protocol but also intrinsically connected to security. To understand equilibrium price determination, we must disentangle the interplay between these breakthrough features and bitcoins’ monetary function.

In this paper, we analyze an economy in which consumers hold intrinsically useless bitcoins for their transactional and/or speculative value. They internalize and price the risk of a system attack that could compromise the ability to transfer bitcoins. The system security reflects the probability of such an attack, driven by the balance of computing power—or hashrate—between an attacker and honest miners (just miners hereafter) within the proof-of-work (PoW) contest. The attacker has a given finite budget and a private interest in sabotaging Bitcoin. Miners are profit driven and invest according to the anticipated real value of block rewards. The critical structural mechanism at work is that bitcoins simultaneously serve an exchange role for users and an incentive role for miners. We refer to the general equilibrium of this economy as a decentralized monetary equilibrium (DME), with the defining property that the bitcoin price and its system security are jointly determined.

Our first main result is that the interaction between users and miners gives rise to multiple self-fulfilling equilibria, which can be ranked according to price-security levels. The reason is that, if agents anticipate the value of bitcoins will be low, miners have little incentive to invest in computational resources, and the security of the network is low. In that case, buyers do not wish to accumulate large real balances, and the resultant valuation for bitcoins is low. The opposite is true when agents anticipate the value of bitcoins will be high. A nonmonetary equilibrium, on the other hand, is always reached if the attacker’s pockets are too deep, that is, if miners fail to acquire 50% of the system’s computational power.

The important message is that the security of PoW systems should be seen as an economic outcome and not as an embedded property of its blockchain technology. Put simply, since the same fundamentals are consistent with outcomes displaying sharply different security levels, one should not regard the blockchain technology as a production function for secure databases; as often presented to businesspeople and regulators.³

In Section 2, we present this result within a stylized three-period setting that purposely abstracts from a granular description of bitcoin exchanges. This allows us to distill the pivotal role of user-miner complementarities and highlights that the conclusions therein are robust to alternative representations of the demand for a means of exchange.⁴ Next, to establish welfare and monetary policy analyses, Section 3 informs agents with more structure to make bitcoin-holding decisions, in the spirit of Lagos and Wright (2005) and Rocheteau and Wright (2005). Our focus is on the properties of stationary DMEs; under certain conditions, we find an even number of them, which can be ranked not only according to price and security but also by welfare.

Our second contribution is to assess the optimality of monetary policy in a PoW-based system. We do so in regard to three plausible design goals: maximizing the token price, the system’s security, and social welfare. A series of related results demonstrate the impossibility of simultaneously achieving these goals. To understand the trade-offs, take the valuation goal. A surprising finding is that Bitcoin’s monetary policy can lead to violations of the quantity theory. Unlike with central banking, changes in supply growth, |$\rho$|⁠, activate two opposing channels. A scarcity channel operates as usual, with less debasing leading to higher token prices. However, there is a new security channel: a higher mining reward incentivizes miners to invest, making the attacker’s efforts less dangerous. For some equilibria, a value-optimal level for |$\rho$| exists; thus, a reduction in miners’ nominal reward—such as quadrennial halvings—could leave the price unchanged or even decrease it.

The price-maximizing value is not necessarily optimal for aggregate welfare.⁵ This is because bitcoin buyers, unlike a benevolent planner, do not internalize mining costs. Instead, the marginal buyer weighs the expected trade benefit of holdings against the inflation tax embedded in mining rewards—a transfer from users to miners here, with null aggregate effect. Therefore, price and welfare are generally not jointly maximized. We establish conditions that rank these policies according to fundamentals. We show that the |$\rho$| value that maximizes security is the highest and leads to both socially excessive mining and a relatively low token price.

Our third contribution is to show how Bitcoin’s security model embeds price volatility amplification. We identify two separate mechanisms responsible for this conclusion, neither of which is the direct observation that supplies rigidity makes it impossible to accommodate demand fluctuations. The first mechanism concerns the amplification of fundamental shocks due to price-security feedback, which we illustrate considering the repercussions of a decrease in the number of bitcoin buyers. We show that this structural mechanism implies that a demand shock induces a more pronounced price movement for bitcoin than for other currencies.⁶

The second mechanism concerns the emergence of stochastic equilibria in which expectations about future prices depend on sentiment, driven by the realization of a sunspot process. Any such equilibrium is defined by a set of optimistic and pessimistic states and a transition probability distribution. When optimistic states are observed, users and miners rationally expect high prices in the future, leading to high bitcoin prices in the present moment, and vice versa. We show that the multiplicity of stationary DMEs—stemming from Bitcoin’s security model—is a necessary condition for the emergence of one such class of equilibria. Therefore, we argue that bitcoins are also more prone to exhibit seemingly irrational price jumps than other currencies.⁷

Finally, we develop an extension in which consumers choose between bitcoins and a fiat currency. While both are intrinsically worthless, we do not follow Kareken and Wallace (1981) in assuming perfect substitutability.⁸ Indeed, consumers anticipate retailers might not accept all forms of payment, and they do not regard bitcoins and fiat currency as equally risky. We highlight three emerging insights. First, a sufficient condition for bitcoins to command a positive price is for bitcoins to be essential in some transactions.⁹ Second, when bitcoins are valued, one also finds multiple equilibria with distinct price-security levels. This clarifies that multiplicity is inherent to Bitcoin’s design, and not a consequence of a lack of payment alternatives. Third, the degree of bitcoin acceptability imposes further restrictions on their value. For example, take the case in which all retailers accept fiat currency, but some also accept bitcoins. We characterize a lower bound for the fiat currency inflation—strictly higher than Bitcoin’s—that must be met for bitcoins to command a positive price.

This paper contributes to the small but growing literature on the economics of Bitcoin, blockchains, and decentralized currencies.¹⁰ In these environments, the multiplicity of equilibria manifests in various forms. Among them, Biais et al. (2019) formalize the coordination among miners regarding which blocks to append to the blockchain and establish conditions for stable consensus. Cong, He, and Wang (2018, 2019) have developed a token valuation framework that generates feedback between adoption and price. Li and Mann (2020) show the role that initial coin offerings can play in facilitating coordination in peer-to-peers platforms. Sockin and Xiong (2018) study decentralized platforms where tokens serve as membership certificates that facilitate transactions, featuring complementarity in membership demand. Our work complements these papers because we focus on a different, but not mutually exclusive, mechanism that embeds equilibria with price-security feedback. To distill our contribution, however, we intentionally abstract from additional multiplicity sources; absent security concerns, our model always features a unique equilibrium.

Multiplicity can also arise in traditional monetary models because of well-known channels, such as entry externalities or storage costs (see, e.g., Lagos, Rocheteau, and Wright, 2017, and the references therein), which are not featured here.¹¹ Also related are models of currency attacks against a central bank, where multiplicity is often a consequence of strategic complementarities among speculators.¹² Here, there is no monetary authority, but we do feature strategic complementarities: users’ valuations positively incentivize miners’ investment, which, in turn, reduces users’ risk exposure to a malicious attack, raising valuations. Such a distinct complementarity manifests here to increase the payment system’s defenses against sabotage, rather than induce an exchange-rate regime change. It also brings attention to the interaction between agents’ beliefs and new economic fundamentals: the primitives of mining and the security function (covered in Sections 2.2 and 2.3).

Several contemporaneous papers emphasize one or more aspects of the intricate Bitcoin mining ecosystem. While we focus on seigniorage-financed rewards, Easley, O’Hara, and Basu (2019) and Huberman, Leshno, and Moallemi (2019) analyze the determination of fees with heterogeneous transaction urgency. Cong, He, and Li (2018) analyze risk sharing in mining pools, while Alsabah and Capponi (2019) analyze miners’ R&D decisions. Budish (2018) analyzes the extent to which miners can defend Bitcoin against for-profit and sabotage attacks. Lehar and Parlour (2019) analyze the possibility of miner collusion. While their focuses differ, these papers take the value of bitcoin as a given. We contribute by developing a framework where mining outcomes, bitcoin demand, and prices are jointly determined.¹³

Chiu and Koeppl (2019) and Kang (2020) analyze related monetary economies but focus on the conditions under which double-spend attacks can be prevented as a function of the block confirmations required by retailers. Instead, we focus on the risk of sabotage attacks, which yield new equilibria with different positive implications. From a protocol design perspective, Chiu and Koeppl argue that it is optimal to finance the entire security budget with seigniorage, as in our setting, rather than with fees. Therefore, our characterization of the socially optimal inflationary reward complements their findings. A different and interesting angle on welfare is provided by Choi and Rocheteau (2019), whose model treats mining as an occupational choice against other productive uses, providing insights on output and social costs.

Also related is the literature on private monies pioneered by Hayek (1976) and recently fostered by Bitcoin. Among others, Fernandez-Villaverde and Sanches (2016) use a search-based model to study competition among private currency issuers; Schilling and Uhlig (2019) study a Bewley-like model with a publicly and a privately issued currency. Although these papers introduce valuable features, they consider alternative payment systems to be perfect substitutes. We contribute in this regard by introducing heterogeneity in acceptance and explicitly incorporating Bitcoin’s security shortcomings. This allows us to refine the conditions under which bitcoins can be positively priced.

1. Background

This section provides a description of how the Bitcoin security model, monetary policy, and attack risk interrelate and clarifies some of our modeling choices. For brevity, we relegate supplemental figures and technical details to Section A of the Internet Appendix.

1.1 Security model

Bitcoin’s history of transfers is periodically updated in a sequence of blocks. Which particular miner adds a block is the result of a competitive process to solve a mathematical problem based on a cryptographic algorithm.¹⁴ The winning miner is only compensated provided that the miner respected a set of consensus rules that prevents fraud; otherwise, the investment in computer power is entirely lost.¹⁵ The winning miner’s compensation, which we will call the system’s security budget, consists of the block reward plus any fees paid by users. Thus far, the block reward is the dominant component of the security budget. For the period from July 2010 to January 2020, on a daily basis, the block reward accounts for a median (mean) proportion of 99.21% (97.57%).¹⁶

Because the block reward is paid in bitcoins, which have no intrinsic value, miners must input the token price into their decisions. Such a connection finds strong empirical support in the price-hashrate time series displayed in Figure 1. Intuitively, the higher the price, the greater the incentive to respect the consensus rules, and the greater the cost to manipulate the ledger’s history. Thus, the token price, |$p$|⁠, and the security of the system, indexed by |$S$|⁠, are linked. We refer to such a link as an intrinsic security model.

 

We note that the intrinsic link between the token price and security is no longer exclusive to Bitcoin; rather, it is present in blockchain-based networks, such as Ethereum, Monero, and Litecoin. In contrast, Ripple is a digital currency system in which approved network members verify transactions. Although transfers of the network token, XRP, are subject to fees to avoid spamming, verifiers (e.g., a trusted bank) are not compensated for their services with XRP. Thus, we label Ripple’s security model as extrinsic. The same can be said of similar permissioned blockchains, such as Libra, Facebook’s proposed digital currency.¹⁷

Extrinsic security could stem from the ability to exclude certain participants, reverse transactions, access regulators or the legal system, and so on. Identifying case-by-case sources is not our present focus. What is essential for our purposes is that pricing tokens with intrinsic security requires one to simultaneously account for their monetary and security functions, as in Figure 2.

1.2 Monetary policy

Bitcoin’s protocol-driven monetary policy is rigid: no authority can regulate the nominal supply. The only source of bitcoin creation is the block reward that miners receive. Because of its preprogrammed issuance scheme, future bitcoin supply can be approximated quite precisely, as illustrated in Section A.3 in the Internet Appendix. The initial inflationary reward was set to 50 bitcoins by Nakamoto and is programmed to decline by 50% every 210,000 blocks, or approximately 4 years.¹⁸ We can view each period between halving as an inflation era for Bitcoin. Within an era, nominal supply growth decreases slightly, since total supply increases but the reward stays constant.

1.3 Risk of network attacks

If there were no concerns about malicious players, the security task that miners perform would be trivial. Numerous types of mining-based attacks have been described in the computer science literature (see Conti et al., 2018; Kaiser, Jurado, and Ledger, 2018; Liu et al., 2019, and the references therein). From an economic perspective, Budish (2018) considers two broad groups: double-spend and sabotage attacks. Put succinctly, in a double-spending attack, the attacker seeks to purchase a good through a bitcoin transfer and, upon delivery, to broadcast an alternative chain history that includes a transfer of the same coins the attacker’s own wallet, rendering the original payment invalid.

The goal of a sabotage attack, on the other hand, is not to transfer the same bitcoins multiple times, but to hurt the network. Rosenfeld (2014) argues that such an effort can be motivated by external profit sources, such as protecting the profits of an incumbent—for example, the banking system or payment processing corporations—or profiting from a short position.¹⁹ The motivation could also originate in the success of a competing cryptocurrency, especially when the same mining equipment is used. Arguably stronger in scale is the possibility of not-for-profit actions by a governmental agency. Economic superpowers, such as the United States and China, and multilateral agencies, such as the G20, have repeatedly expressed concerns about the national security, environmental, and financial stability hazards of cryptocurrencies.²⁰

Like Budish, we argue for the importance of considering explicit sabotage attacks. A double-spend attacker is interested in preserving the value of the recovered bitcoins and that of any specialized mining equipment. This fact creates a natural limit to the attack scale, to avoid a sharp price drop once the attack is identified. Moreover, being a for-profit effort, double-spend attacks might not be as much of a concern for Bitcoin relative to small blockchains, given its immense mining investment: they embed huge risky bets. Also, critical is the fact that retailers can protect their wealth by requiring multiple-block payment confirmations before transferring goods. A saboteur is not dissuaded by the lack of within-network profits.²¹

Equally important, from the perspective of equilibrium pricing, is the fact that a sabotage attack is more akin to an aggregate source of risk, since it affects all participants, not just one or a few retailers. Therefore, we embed within a general equilibrium economy a stylized saboteur who could create disruptive blockchain histories (forks) designed to undermine confidence and destroy Bitcoin.

2. Prices, Mining, and Security in a Three-Period Economy

In this section we show how user-miner complementarities in Bitcoin lead to equilibrium multiplicity, using a simple finite horizon setting. The characterizations of the mining game and attack risks serve as building blocks in the remainder of the paper.

2.1 Environment and Bitcoin users

Consider two dates, |$t$| and |$t+1$|⁠. At |$t$|⁠, a continuum of |$n$| homogeneous agents can produce and consume a perishable good whose price acts as the numeraire. The marginal utility of consumption and disutility of production is unitary. There is also an intrinsically useless and transferrable token, bitcoin, in supply |$B$|⁠. Agent |$i$| can purchase any nonnegative amount |$B_{it}$| at a price |$p_{t}$| that is taken as given, thereby becoming a Bitcoin user. Agents acquire bitcoins because, if its transfer system is operational at an interim subperiod |$t'$|⁠, they expect to find uniquely beneficial exchange opportunities with probability |$f$|⁠. We assume here that any holder |$i$| of a real balance |$b_{it}=p_{t}B_{it}$| values those opportunities according to |$V(\cdot)$|⁠, a continuous, strictly increasing and concave function that is twice differentiable and satisfies |$V(0)=0$|⁠, |$V'(0)=+\infty$|⁠, and |$V(\tilde{b})=\tilde{b}$| for some |$\tilde{b}>0$|⁠.

The presence of a malicious agent, a saboteur, exposes all Bitcoin users to the risk of a systemwide attack between |$t$| and |$t'$|⁠. The attack outcome is captured by the realization of a binary random variable |$\tilde{x_{t}}$|⁠: |$x_{t}=1$| indicates that the network survives the attack and a new block of transactions will be added to the predetermined ledger, an event with probability |$S$|⁠; |$x_{t}=0$| indicates a successful attack, an event with probability |$1-S_{t}$|⁠. Following an attack, the network is unusable and bitcoins become worthless. We refer to |$S$|⁠, a key endogenous object, as the security function.

At |$t+1$|⁠, if the attack failed, users sell any remaining bitcoin holdings in a liquidation market displaying perfectly elastic demand at an uncertain price |$p_{t+1}$|⁠. Users’ expectation of future prices is given by |$\mathbb{E}_{t}p_{t+1}=S_{t}\mathbb{E}_{t}^{1}p_{t+1}+\left(1-S_{t}\right)\times0$|⁠, where |$\mathbb{E}_{t}^{1}$| denotes the expectation operator conditional on |$x_{t}=1$| and any available information at |$t$|⁠. We require beliefs to satisfy |$R:=\mathbb{E}_{t}^{1}\frac{p_{t+1}}{p_{t}}<\frac{1}{\delta S}$|⁠; otherwise, agents’ expected utility would be increasing in bitcoins and demand would be unbounded.

Given beliefs and time preference |$\delta\in(0,1)$|⁠, agents maximize expected utility at |$t$|⁠, |$c_{it}-l_{it}+\mathbb{E}_{t}\left(V\left(B_{it}p_{t}\right)+\delta c_{it+1}\right)$|⁠, over goods consumption |$c$|⁠, disutility of production |$l$|⁠, and bitcoin holdings, subject to the budget constraints |$B_{it}p_{t}+c_{t}\le l_{t}$| and |$c_{t+1}\le B_{it}p_{t+1}$|⁠. Expanding the expectation and incorporating the constraints, agent |$i$|’s program becomes: |$\max_{b_{it}\ge0}S_{t}\left(fV\left(b_{it}\right)+\left(1-f\right)\delta b_{it}R\right)-b_{it}$|⁠.

It is helpful to consider a benchmark where security |$\overline{S}\in(0,1]$| stems from a trusted institution rather than miners’ actions. There can be at most one equilibrium price in that case. Provided |$V'(0)$| is sufficiently large, a solution must exist, and we can associate any such security level |$\overline{S}$| with a corresponding equilibrium price |$\overline{p}_{t}>0$|⁠. To understand how the interrelation between users and miners can affect this conclusion, we turn to mining activities.

2.2 Miner competition

At the beginning of |$t$|⁠, |$m\ge2$| identical risk-neutral miners invest in computing power to win a block verification reward within a noncooperative PoW game. Miners are subject to a one-period reward lock. If a miner wins a block reward within |$t$|⁠, the miner receives the reward at |$t+1$|⁠, sells it at the prevailing price and consumes the proceeds.²² We assume that the block size is large enough to include all contemporaneous transactions and that miners cannot commit to excluding transactions based on user fees. Hence, we concentrate on equilibria in which fees are negligibly small.²³

Because the random nature of the PoW race, the proportion of blocks verified by miner |$j$| is proportional to its computer power contribution. If a block confirmation occurs, |$j$| wins with probability |$\mathbb{P}(h_{j},h_{-j})=\frac{h_{j}}{H}$|⁠, |$H=h_{j}+h_{-j}$|⁠. We assume that the PoW difficulty level adjusts to ensure that each block is verified within the corresponding period.²⁴

Miners act as price takers and form expectations about next period’s bitcoin prices. Conditional on winning, a miner expects revenues equal to |$\psi\mathbb{E}_{t}^{1}p_{t+1}$|⁠, where |$\psi$| represents the block reward in units of bitcoins. We simplify things by considering a single program for all miners given by |$\max_{h_{j}\ge0}\mathbb{P}(h_{j},h_{-j})\times\delta\psi\mathbb{E}_{t}^{1}p_{t+1}-C(h_{j})$|⁠, where |$C:h_{j}\rightarrow\mathbb{R_{+}}$| is the cost of mining function, an increasing, twice-differentiable function that satisfies |$C''(h)\ge0$| and |$C(0)=0$|⁠.²⁵ We search for a symmetric Nash equilibrium, which yields the following characterization of miners’ investment.

 

Part (ii) of Lemma 1 reflects the intuition that, ceteris paribus, a higher nominal reward or a higher expected bitcoin price induces miners to invest in more computing resources. The fact that miners are homogeneous yields a monotonically positive relation between the number of miners and the system hashrate. Point (iv) highlights that the cost of mining does not affect the allocation of the reward across miners, but is directly related to the total computing power in the system.

Hereafter, we focus on the case of linear mining costs |$\kappa\times h$|⁠, where |$\kappa>0$| captures the costs of inputs, electricity, and any leasing hardware per unit of computational power.²⁶ Such a case best represents mining firms that are small enough to act as price takers in input markets.²⁷

2.3 Security function

We consider a source of aggregate risk in the form of a sabotage attack. Because such an attack on Bitcoin has not yet been observed, the specifics are not readily available. For concreteness, we consider the realization of a disruptive fork with |$k>1$| blocks, by which we mean the emergence of one (or multiple) alternative block history that creates a confidence crisis among users. As an example, the saboteur could mine numerous empty blocks, denying service to other users and/or inducing merchants to stop accepting bitcoins. The attacker could also employ hash power to generate multiple persistent forks in the blockchain, thereby undermining consensus and persuading honest miners to leave. We interpret parameter |$k$| as the minimum block length for such a disruptive fork to lead to a collapse in bitcoin demand.

What is the likelihood of such an event? The answer must depend on the balance of computing resources between honest and malicious agents. To avoid excessive complexity, we regard the saboteur as a single agency endowed with a constant use-it-or-lose-it budget across periods that affords a hashrate |$A>0$|⁠.²⁸ To assign probabilities to outcomes, imagine that once |$H$| has been determined on date |$t$|⁠, a subgame arises in which the saboteur and miners play a race that ends when the former generates a |$k$|-block fork. At each step of the subgame, a PoW-like gamble takes place where miners and the saboteur have computing power given by |$H_{t}$| and |$A$|⁠. The deficit of |$k$| blocks decreases by one with probability |$\alpha:=\frac{A}{A+H_{t}}$|⁠, and increases by one with probability |$1-\alpha=\frac{H_{t}}{A+H_{t}}$|⁠, as in a binomial random walk. If this race continued forever within the subgame, the probability of eliminating the deficit of |$k$| blocks would be |$\left(\frac{\alpha}{1-\alpha}\right)^{k}=\left(\frac{A}{H_{t}}\right)^{k}$|⁠, provided |$\alpha<\frac{1}{2}$|⁠, and one otherwise.²⁹

Function (2) allows for a tractable pricing analysis and, as Nakamoto first highlighted, it captures the notion that Bitcoin is not viable when honest miners control less than 50% of the hash power. Moreover, (2) satisfies the following intuitive properties: |$\lim_{H\rightarrow+\infty}S=\lim_{A\downarrow0}S=1$|⁠, |$\lim_{H\downarrow A}S=0$|⁠, and, if |$H_{t}>A$|⁠, |$S_{A}<0$| and |$S_{H}>0$|⁠. We informally refer to increases in |$A$| as increases in the saboteurs’ budget. In what follows, we take |$k$| and |$A$| as a given and use (2) to endogenize the security level in the general equilibrium.

2.4 Indeterminacy of price and security in PoW blockchains

Unlike for the extrinsic security benchmark, it is only by studying the relations between demand fundamentals, mining incentives, and the depth of the saboteur’s pockets that we can assess whether a general equilibrium allocation exists, one in which the bitcoin price and security are jointly determined. To begin, we note that a situation in which the value of bitcoins stays at zero always represents an equilibrium. Absent external subsidies, if the price is zero, miners do not contribute security resources; in turn, users do not exchange any amount of goods for unsecured tokens.

We will show that, if it does exist, an equilibrium with a positive bitcoin price is no longer unique.

 

Proposition 1 highlights that the multiplicity of equilibria originates in the strategic complementarities between users and miners. The intuition is that, if the value of bitcoins is perceived to be low, honest miners have little incentive to invest in computational resources, and the security of the network is low. In that case, agents do not wish to accumulate large real balances, and the resultant valuation for bitcoins is low. The opposite is true when the value of bitcoins is perceived to be high, making a high-value, high-security equilibrium self-fulfilling.

Figure 3 illustrates the equilibrium determination. Note that, for any given |$A$|⁠, first, if the bitcoin price is sufficiently low, that is, |$p\le p_{m}:=H^{-1}\left(A\right)$|⁠, the miners’ economic incentive is not strong enough to amass 50% of the hashrate. In that case, the saboteur always succeeds, and the viability of bitcoins as a means of exchange vanishes. A general equilibrium is found when |$\Delta(p_{t})=1$|⁠, where |$\Delta$| represents the left-hand side of (3). Two such equilibria exist in the displayed economy, which can be ranked according to price and security levels: |$p_{H}>p_{L}$| and |$S_{H}>S_{L}$|⁠.

Second, a general equilibrium can be found, provided the number of interested buyers is high enough. Intuitively, if competition for bitcoins is strong enough, the anticipated value of the nominal block reward is sufficient to induce an investment |$H>A$|⁠. Conversely, one can establish that, for a fixed |$n$|⁠, the existence and properties of an equilibrium depend on how resourceful the attacker is. At one extreme, when |$A\rightarrow0$|⁠, the bitcoin economy converges to that with |$\overline{S}\rightarrow1$|⁠, a full-security economy with a unique equilibrium. At the other extreme, one can identify the maximum value that |$A$| can take to be compatible with an equilibrium. The dashed curve in Figure 3 represents an economy in which |$A$| is too high for an equilibrium with a positive price and security to exist.

To sum up, the noncooperative interaction between users and miners can bootstrap an equilibrium with a positive bitcoin price and some protection against malicious attackers. However, there is no one-to-one mapping between technological primitives and the security level: the same fundamentals are compatible with a strongly or a weakly secured payment system. Put simply, one can only assess the security properties of a particular equilibrium allocation in a system such as Bitcoin, but not that of its blockchain technology.

3. Decentralized Monetary Framework and Welfare

The previous section elicited a fundamental mechanism in the Bitcoin system that generates a multiplicity of price-security ranked equilibria. In the remainder of the paper, we seek to understand its implications for welfare, the design of monetary policy, and price fluctuations. In this section, we therefore consider a more granular microfoundation for the use of bitcoins as a means of exchange, with an endless horizon, since we rule out token holdings providing enjoyment or dividend flows.³⁰

3.1 Bitcoin demand

An endless sequence of dates is divided into two stages where different markets for perishable goods operate, both with Walrasian pricing. The first-stage market is frictionless, while the second-stage market is subject to meeting frictions, similar to the competitive equilibrium of Rocheteau and Wright (2005). Following convention, we refer to the first and second stages as the centralized market (CM) and the decentralized market (DM). All agents can produce and consume the CM good, which acts as the numeraire. Agents are divided into two types according to their roles in the DM: sellers can produce, but do not wish to consume; buyers wish to consume, but cannot produce. Such heterogeneity generates demand for bitcoins as a means of exchange; for buyers to consume the good in the DM—the bitcoin good. A buyer meets a seller with probability |$f$| and trades at a price |$z$|⁠. All agents are anonymous, so credit arrangements are not possible.

Instead of assuming a liquidation market, the intertemporal consistency of users’ holding decisions depends on an explicit demographic process. Each period |$t$|⁠, a continuum of |$n$| buyers who live for three subperiods is born. Buyers born at time |$t$| have a lifetime utility given by |$c_{t}-l_{t}+u\left(q_{t}\right)+\delta c_{t+1}$|⁠, where |$c$| and |$q$| represent the consumption of the numeraire and bitcoin goods. Old buyers sell their bitcoin holdings, enjoy consuming the CM good with the proceeds, and then die.³¹ Unless otherwise stated, |$u$| is assumed to be have the same properties as |$V$| in Section 2.1. A fundamental difference is that |$u$| is now defined over the consumption of goods. Sellers born at |$t$| do not need to accumulate bitcoins in that period’s CM. Those who meet a buyer in the period’s DM can produce any amount at a unitary marginal disutility of production. At the first stage of period |$t+1$|⁠, sellers can exchange any bitcoin holdings for the CM good, from which they derive linear utility. Therefore, their lifetime utility is |$-q_{t}+\delta c_{t+1}$|⁠.

Figure 4 summarizes the sequence of events in each period of this dynamic setting. On the supply side, miners compete for block verifications in each stage, as in Section 2.2, and receive rewards at the beginning of the subsequent CM. They do not consume the bitcoin good nor store bitcoins; the winning miner sells the reward immediately after receiving it to consume.³² The resolution of the sabotage attack happens between the CM and the DM, before buyers and sellers meet. The fundamentals of security are as described by (2).

It is apparent from (5) that, provided sellers break even, which requires |$\delta\mathbb{E}_{t}^{1}\frac{p_{t+1}}{p_{t}}=\frac{1}{z_{t}}$|⁠, they are indifferent between any two positive production levels. We construct equilibria with this property; otherwise, the solution to the sellers’ problem would require either null or unbounded production.

Next, we characterize the demand for bitcoin holdings in a partial equilibrium, that is, taking |$\left\{ S_{t}\right\} _{t\ge0}$| as a given sequence.

 

This lemma bounds the risk-adjusted expected holding returns that are compatible with a monetary equilibrium. When |$\frac{\delta S_{t}\mathbb{E}_{t}^{1}p_{t+1}-p_{t}}{p_{t}}<0$|⁠, carrying a balance is costly; buyers will try to avoid doing so and will demand quantities of the bitcoin good below the efficient level |$q^{*}$|⁠. The optimality condition in the lemma implies a positive relation between the security of the system and the demand for bitcoins. It also expresses that |$p_{t}$| equals the present value of the risk-adjusted expected price, plus a term reflecting bitcoins’ usefulness as a liquidity instrument. Such a term is driven by the probability of finding trading opportunities, |$f$|⁠, and by the Lagrangian multiplier associated with relaxing the constraint |$zq\le b$| on the trade surplus, |$(u'\left(q\right)-1)^{+}$|⁠. We follow convention in referring to the latter as the liquidity premium, which is positive if |$q<q^{*}$| and equals zero otherwise.

3.2 DME: Multiplicity and welfare

We define a DME as a sequence |$\left\{ B_{it},q_{t}^{d},q_{t}^{s},h_{t},z_{t},p_{t}\right\} _{t=0}^{\tau}$| of consumption, production, and saving decisions by buyers and sellers, hashrate decisions by miners, and positive prices, such that, for all |$t$|⁠, buyers’ and sellers’ decisions satisfy (4) and (5); miners maximizes expected profits; security is given by (2); and all markets clear. Because equilibria depend on beliefs about the future value of bitcoins, the conceivable set is large. Instead of characterizing every possible equilibrium, we focus on whether there is a stationary DME with constant real quantities, and, if so, whether it is unique.

Bitcoins’ supply growth is roughly constant within a 4-year inflation era³³ and is expected to halve at a quadrennial frequency until 2140. Unless one introduces a form of block congestion, there is no stationary DME with a vanishing nominal growth |$\rho_{t}\rightarrow1$|⁠; a perennially shrinking block reward leads to a security level that is inconsistent with a positive bitcoin price. Characterizing a functioning system that approaches the last halving event requires fees that somehow offset the loss of seigniorage, as argued by Nakamoto (2008). Accordingly, we pursue a two-part strategy. In the remainder of this section, we search for stationary DMEs with a positive and constant |$\rho>1$|⁠, constant real balances, and bitcoin prices that users and miners (conditionally) expect to decrease at the same rate, |$\mathbb{E}_{t}^{1}\frac{p_{t+1}}{p_{t}}=\rho^{-1}$| for all |$t$|⁠. We consider that to be a helpful approximation within an inflation era.³⁴ Subsequently, we study the effect of supply growth changes in Section 4.

The condition in (8) expresses that |$b_{ss}$| makes the marginal usefulness of bitcoins equal to their marginal carrying cost. To see this, note that the left-hand side depends on the probability of finding trading opportunities and on the liquidity premium, expressing the payoff from a marginal unit of wealth that is liquid; that is, it can be used to acquire more of the bitcoin good. The right-hand side measures how costly it is for buyers to carry bitcoins and can be interpreted as a risk-adjusted analogue of the nominal interest rate, |$i_{B}\left(b\right):=\frac{\rho}{S\left(b,A\right)\delta}-1$|⁠.³⁵ Such a cost is positively related to the tax from inflationary rewards, and it is negatively related to the system’s security.

An analysis of miners’ and users’ optimality in (6) and (8) allow us to characterize existence and uniqueness of a DME. Three main features are shared with the finite horizon setting in the previous section: a monetary equilibrium is not viable for |$b\le b_{m}=p_{m}B$|⁠; if the number of users is sufficiently large, the system can support an equilibrium with a strictly positive bitcoin price and security; such an equilibrium is not unique. Figure 5 illustrates the determination of equilibria in the |$\left(b_{t+1},b_{t}\right)$| space. Two stationary DMEs exist in the displayed economy, |$b_{L}$| and |$b_{H}$|⁠, which we refer to as the low and the high equilibria, respectively. The figure also displays the extrinsic security benchmark, |$\overline{D}$|⁠. Where its unique equilibrium |$\overline{b}$| is relative to |$b_{L}$| and |$b_{H}$| depends on the value of |$\overline{S}$|⁠.³⁶

Using (9), we establish two welfare properties. First, consider the case in which buyers formed bitcoin demand decisions in the same environment, but sought to (altruistically) maximize (9) instead of (4). Such a case resembles the problem of a constrained planner who cannot affect the system design but internalizes mining costs. Perhaps surprisingly, the demand for bitcoins would then be higher. The reason is that balances’ carrying cost associated with (4), which input the inflationary reward, can be shown to be above mining costs.³⁸

Second, we can rank welfare outcomes across DMEs: the high equilibrium leads both to a higher trade volume |$q$| and to greater social welfare. Indeed, the equilibrium condition (8) implies that an increase in the exchange quantity from |$q_{L}$| to |$\tilde{q}$|⁠, provided |$\tilde{q}<q^{*}$|⁠, leads to an enhancement in the expected trade surplus that is greater than the corresponding increase in mining costs.

We summarize the main results in this section in the following proposition.

 

4. Implications for the Design of Monetary Policy under PoW

Nakamoto’s protocol prevents any agent, user or miner, from influencing bitcoins’ supply. Therefore, analyzing monetary policy in the traditional sense of regulating the money supply is not possible. Instead, this section adopts a protocol design perspective. The main results establish the optimal monetary policy associated with three goals, namely, maximizing bitcoin’s market value, the system’s security, and social welfare, and characterizes the relations between all three.

4.1 Value-optimal monetary policy

We begin by considering the optimal policy regarding market value. Recall that a central implication of the quantity theory is that increases in the growth of nominal balances have a negative effect on the price of money. This implication holds in our benchmark with extrinsic security. Increasing supply growth |$\rho$| through direct transfers to agents, or a nominal dividend, has the effect of reducing the equilibrium token price as it becomes less scarce.

Bitcoin is different, since we can distinguish two distinct channels by which changes in |$\rho$| affect the bitcoin price. While the scarcity channel operates as above, there is a security channel that is new to the Bitcoin economy. Since there are no dividends for bitcoin users, all new issuances are restricted to miner rewards. Increasing the latter incentivizes miners’ investment, strengthening resistance against a malicious player, thus generating upward price pressure.

The relative strength of each channel depends on the fundamentals. Intuitively, when |$\rho$| is low, the security channel should be relatively stronger, and increases in |$\rho$| should have a positive price effect; when |$\rho$| is high, the negative scarcity effect should dominate. We are interested in whether there is a |$\rho$| value that finds the optimal balance in the sense of maximizing the market value of Bitcoins. The following proposition shows that we can characterize such value for a high DME.³⁹

 

Equation (10) expresses that |$\rho_{V}$| renders the marginal value of security gains equal to the marginal impact on buyers’ and sellers’ carrying costs. As an illustration, consider the special case with |$f=1$| and a constant |$\sigma\in(0,1)$|⁠. The right-hand side of (10) becomes |$1-\sigma$|⁠. Since |$\epsilon_{S,\rho}(\rho_{V})=\frac{k(1-S)}{S\left(\rho_{V}-1\right)}$|⁠, |$\rho_{V}=1+\frac{k(1-S)}{(1-\sigma)S}$|⁠. From this we infer that an increase in |$k$| causing |$S\rightarrow1$| leads to |$\rho_{V}\rightarrow1$|⁠: as security needs progressively diminish, the value-optimal amount of mintage approaches zero.

Proposition 3 implies that the behavior of the supply side of Bitcoin is fundamentally different from that of traditional monetary economies, since the graph |$\left(\rho,p_{H}\left(\rho\right)\right)$| is concave. The top panel of Figure 6 illustrates this property. For values |$\rho>\rho_{V}$|⁠, the negative impact of the scarcity channel is stronger than that of the security channel, and the price declines. A direct implication is that, unless |$\rho=\rho_{V}$|⁠, the same |$p_{H}$| is consistent with two different regimes, with low or high supply growth.

Besides protocol design concerns, Proposition 3 has practical implications for understanding changes in bitcoin prices over time. Commentators often argue that a block reward halving causes the bitcoin price to increase; in contrast, we find that the price effect of a change in |$\rho$| is nonmonotonic: the price can increase or decrease.⁴⁰

In sum, the general equilibrium relation between supply growth and price depends on the environment, as in (10), and should thus be considered with more scrutiny than a simple application of Fisher’s equation of exchange would suggest. Such careful consideration is particularly important for Bitcoin, since its design prevents any issuances directed to holders; if one introduced these, a violation of the quantity theory would become less likely.

4.2 Security-optimal monetary policy

We now ask what is the supply growth rate that maximizes the system’s security? The answer links to miner incentives. Naturally, miners’ investment is not based solely on the bitcoin price, but, rather, the product between that price and the block reward. Provided such product increases, one could observe that prices and miners’ hashrate move in opposite directions, as graphically illustrated on the left panel of Figure 6 as one move to the right of |$\rho_{V}$|⁠. Accordingly, we seek to determine what is the growth rate that maximizes miners’ expected income, which, in a steady state can be expressed as |$\frac{\rho-1}{2}\frac{\delta}{\rho}b_{ss}\left(\rho\right)$|⁠.⁴¹ It is clear that income is highest in the high DME, and its maximizing value |$\rho_{S}$| is as follows.

 

The proof is immediately evident, as follows. Since |$\rho>1$| in any DME, for (11) to hold, one must have |$\frac{db_{H}\left(\rho_{S}\right)}{d\rho}<0$|⁠. From Proposition 3, real balances in the high DME decrease for values higher than |$\rho_{V}$|⁠, implying |$\rho_{S}>\rho_{V}$|⁠. Intuitively, bitcoin buyers are concerned with both the inflation tax and security risks. Minimizing the latter exclusively leads to a relatively weak user demand and, thus, a lower token valuation.

4.3 Socially optimal monetary policy

We are interested in this section in the optimal monetary policy from the perspective of a benevolent planner, denoted as |$\rho_{W}$|⁠. We begin by considering the benchmark economy without mining investment and a given security level |$\overline{S}$|⁠. In that case, the first-best DM surplus can be achieved by |$\overline{\rho}_{W}=\overline{S}\delta<1$|⁠.⁴² The intuition is that the net nominal growth must be negative so that the token price appreciation is sufficient to compensate for attack risks and impatience, inducing buyers to carry enough balances to achieve an efficient exchange.⁴³ This is a version of the Friedman rule, which is the optimal monetary policy in many monetary environments (Rocheteau 2017, chap. 6). The adjustment by |$\overline{S}$| simply reflects the lack of a risk-free saving technology.

For Bitcoin, negative nominal growth is arguably unfeasible due to taxation challenges. More importantly, |$\rho_{W}\le1$| would be undesirable with seigniorage-financed security, since a null exchange surplus would be achieved with null security. In this regard, a Friedman rule cannot be optimal.

Instead, the socially optimal policy is implicitly given by |$\frac{d\mathcal{W}}{d\rho}\left(\rho_{W},b\left(\rho_{W}\right)\right)=0$| from (9), subject to the satisfaction of users’ and miners’ optimality in (6) and (8). We note that the social and private benefits associated a change in |$\rho$| on the trade surplus coincide; buyers capture the entire surplus. The social and private costs, however, are different. Buyers are concerned with balances’ carrying costs regarding issuances received by the miners and attacks’ risk. All else equal, the planner is involved with the amount invested in mining, not with buyers’ inflation tax; a mere transfer from users to miners. Hence, the monetary policy that most benefits buyers and that which is socially optimal could differ. The planner finds that mining investment increases with |$\rho$| up to |$\rho_{S}$|⁠; the effect on private carrying costs is ambiguous, since an increase in |$S$| could decrease the ratio |$\frac{\rho}{\delta S}$|⁠.

The following proposition establishes the relation between the socially optimal monetary policy and the considered alternatives.

 

The intuition for (ii) is that a planner would not select |$\rho_{W}>\rho_{S}$| because such a policy would result in greater distortions on |$q$| and, by the definition of |$\rho_{S}$|⁠, in lower security as well. The case |$\rho_{W}=\rho_{S}$| could only hold in the counterfactual scenario in which |$q$| were unaffected by |$\rho$|⁠.

We note that the inequality in (iii) expresses the relation between the marginal impacts of a change in |$\rho$| near |$\rho_{V}$| on the trade surplus (left-hand side) and mining costs (right-hand side). The net effect on the trade surplus depends on the positive effects on security, measured by the elasticity term |$\epsilon_{S,\rho}$|⁠, and the negative effect on |$q$| due to inflation; captured by |$i_{B}$| in an equilibrium. Regarding costs, a marginal increase in |$\rho$| has only a quantity effect on miners’ reward, since |$\frac{db(\rho_{V})}{d\rho}=0$|⁠. The planner is concerned with the fraction |$\frac{m-1}{m}$| of that reward spent in mining, not with miners’ profits.

Depending on the primitives, there could be socially excessive mining at |$\rho_{V}$|⁠. We illustrate this point with an example in Figure 6, using a generalized CRRA function |$u(q)=\frac{1}{1-\sigma}((q+\xi)^{1-\sigma}-\xi^{1-\sigma}),$||$\xi\approx0,\sigma>0$|⁠. The bottom panels are otherwise identical but feature a low and a high |$\sigma$| value.⁴⁴ In the bottom-left panel, at |$\rho=\rho_{V}$|⁠, the marginal impact of a change in |$\rho$| on carrying costs is lower than that on mining costs; again, due to the beneficial increase in |$S$| in regards to |$i_{B}$|⁠. Accordingly, the planner would find it optimal to reduce the bitcoin issuance rate to economize on mining costs. The opposite holds in the economy displayed on the bottom-right panel: the marginal impact of a change in |$\rho$| at |$\rho_{V}$| is lower on mining costs. Relative to |${\rho_{V}}$|⁠, the planner seeks to marginally increase |$\rho$| to provide miners with better incentives and increase the trade surplus’ expected value.

5. Implications for Bitcoin Price Volatility

What does Bitcoin’s security model imply for price volatility? We identify two mechanisms with the potential to amplify price fluctuations, each associated with a distinct source of uncertainty. The first mechanism is the amplification of a fundamental shock in bitcoins’ demand, and the second is volatility induced by sentiment shifts that are unrelated to fundamentals.

5.1 Bitcoin’s security and price amplification of fundamental shocks

Consider a fundamental change in money demand due to a change in the number of bitcoin buyers. We contrast the steady-state equilibrium response for tokens with intrinsic and extrinsic security. To establish a meaningful contrast, we concentrate on the high DME, since the low DME is unique to bitcoins. Bitcoin security is |$S\left(b_{H},A\right)$| and an otherwise identical token has security |$\overline{S}$|⁠. From (8), if |$\overline{S}=S\left(b_{H},A\right)$|⁠, the stationary value of real balances must coincide: |$b_{H}=\overline{b}$|⁠.

How is the value of each token affected by a change in |$n$|? In the extrinsic case, we know from Lemma 2 that an increase in |$n$| raises the marginal value of liquidity in the DM; thus, the new steady-state price must be higher, and vice versa. The following proposition shows that, for bitcoins, an identical change in |$n$| causes greater equilibrium price movements.

 

Figure 7 illustrates the equilibrium price change. A decrease from a high to a low value of |$n$| causes the demand for real balances to weaken. The direct impact of this change in demand on |$\overline{b}$|⁠, with security held constant, is given by |$\left|\overline{b}'-\overline{b}\right|$|⁠. For Bitcoin, however, miners’ incentives are also affected, generating a negative system hashrate response and, thus, a decrease in security that feeds back the downward pressure on the price. The price impact of the endogenous security response can be traced graphically as |$\left|b'_{H}-\overline{b}'\right|$|⁠. Conversely, a positive increase in demand would generate a positive mining response, and a greater equilibrium price increase for bitcoins. Therefore, failing to consider the structural connection between price and security could lead to systematic mispricing and underestimating the price volatility for bitcoins and similar PoW blockchains.

We comment further on the interpretation of this result. First, if one naively ignored the equilibrium price-security connection, one should not expect pricing errors to be symmetric. Provided that mining investment has a decreasing marginal impact on security, mispricing is likely to be more pronounced for negative shocks.⁴⁵ Second, we should not expect this type of amplification to be a transient effect, but a structural feature. Since the system’s security is tied to an internal budget, the probability distribution over security outcomes depends on the bitcoin price. Third, because meaningful price changes are more likely to trigger security reassessments, this mechanism connects more naturally to long-term price movements⁴⁶ (quarterly, yearly) rather than high-frequency ones.

5.2 Nonfundamental uncertainty, price booms, and crashes

We observe more frequent booms and busts in the bitcoin’s price than that for most currencies. What makes them particularly puzzling is that they often occur without any apparent link to fundamentals (e.g., Bhambhwani, Delikouras, and Korniotis 2019). In this section, we analyze the potential role of nonfundamental uncertainty (Azariadis 1981; Cass and Shell 1983) by constructing equilibria in which the price of bitcoin can jump based on agents’ sentiments, which are driven by sunspots. We show how the scope for such unpredictable jumps is broader for bitcoins than for traditional currency.

For a given |$b_{1}$| and |$b_{2}$|⁠, we are interested in whether probabilities |$\phi_{\omega}\in\left(0,1\right)$| that satisfy (12) can be found to support sunspot equilibria. This is possible under two types of conditions:

• Type I: |$D(b_{2})>b_{2}>b_{1}>D(b_{1})$|⁠,

• Type II: |$D(b_{1})>b_{2}>b_{1}>D(b_{2})$|⁠.

Type I requires function |$D$| to cross the 45-degree line from below between |$b_{1}$| and |$b_{2}$|⁠, as in the left panel of Figure 8. One finds therein a continuum of such equilibria for |$b_{1}\in(b_{m},b_{L})$| and |$b_{2}\in\left(b_{L},b_{H}\right)$|⁠, as shown by the red and green segments. Type II requires |$D$| to cross the line from above, as in the right panel. In this case, |$b_{1}$| and |$b_{2}$| belong to the area of overlap between |$D(b)$| and |$D^{-1}(b)$| in the proximity of |$b_{H}$|⁠.

The existence of Type II equilibria relies on the specifics of the preferences and parameters. For example, regarding the figure’s parametrization, a large value of the utility parameter |$\sigma$| is needed. Therefore, regardless of the security model, Type II equilibria may or may not exist. It is important to stress that Type I equilibria can exist only when the security function and the token price interrelate—yielding multiple DMEs—as we state in the following proposition.

 

Since both types are viable for Bitcoin, we can say that, relative to other currencies, bitcoins are more prone to exhibiting seemingly irrational and unpredictable price jumps.⁴⁷ Indeed, for some primitives, conventional currencies on a stationary equilibrium path would never feature price booms and crashes, while bitcoins can, as in the left panel of Figure 8.

6. Bitcoin in a Bimonetary Economy

In this section, we consider an extension with two payment systems, Bitcoin and a fiat currency. Although we do not attempt to model every conceivable difference between these systems, we emphasize that they are not perfect substitutes. Our differentiating focus is on security risks and their liquidity function regarding one’s ability to conduct certain transactions. Allowing for such heterogeneity helps in clarifying the conditions under which bitcoins are valued. It also illustrates the model’s application to more complex settings.

The determination of Bitcoin’s security is as in Section 3. Fiat currency can be purchased in the CM at a price |$\phi$| and is not subject to sabotage attacks. The growth rate of fiat supply, |$M$|⁠, is constant and denoted |$\gamma=M_{t+1}/M_{t}$|⁠. We focus on steady-state equilibria in which real quantities, including real monetary balances |$b_{t}=p_{t}B_{t}$| and |$\mu_{t}=\phi_{t}M_{t}$|⁠, are constant over time; accordingly, agents expect |$\frac{\phi_{t+1}}{\phi_{t}}=\gamma^{-1}$| and |$\frac{p_{t+1}}{p_{t}}=\rho^{-1}$|⁠.

On the transaction side, we consider the possibility that not all sellers accept each form of money in the DM.⁴⁸ More specifically, buyers anticipate three types of meetings |$\tau\in\left\{ B,M,MB\right\} $|⁠, reflecting whether sellers accept bitcoins only, fiat currency only, or both. We denote as |$f_{\tau}$| the probability that the buyer meets a seller of type |$\tau$| and |$f=\sum_{\tau}f_{\tau}$|⁠. The competitive prices for the goods traded in the DM are |$z_{B}$| if bitcoins are used and |$z_{M}$| if the fiat currency is used.

The sellers’ break-even condition resembles that in previous sections; for sellers to be indifferent between any two production levels, one needs |$z_{B}$| and |$z_{M}$| to compensate for their balances’ carrying cost. Thus, |$z_{B}=\frac{\rho}{\delta}$| and |$z_{M}=\frac{\gamma}{\delta}$|⁠. An |$MB$|-type seller is willing to exchange a given production level |$q_{MB}$| with buyer |$i$| for any combination of |$b_{i}$| and |$\mu_{i}$| as long as |$q_{MB}=\left(\frac{b_{i}}{z_{B}}+\frac{\mu_{i}}{z_{M}}\right)$|⁠.

The buyers’ program is a generalization of (4) that yields an optimal choice of bitcoin and fiat holdings. Besides the corresponding budget constraints, buyers face a liquid wealth constraint in the DM that now depends on the type of seller in a given meeting. When both monies are valued in a given equilibrium, buyers’ choices must satisfy the conditions listed in the following lemma.

 

The system (13)–(14) is a generalization of (8); similarly, |$i_{B}$| and |$i_{M}$| express buyers’ marginal carrying costs of bitcoin and fiat currency balances. Given that both bitcoins and fiat currency are intrinsically useless, this system indicates that the equilibrium value of real balances in each case must equalize their marginal carrying costs to the marginal value of their liquidity service.⁴⁹

In the remainder of this section, we focus on particular cases. First, we consider the case in which no seller accepts both fiat currency and bitcoins, |$f_{MB}=0$|⁠. For example, regular internet sellers like Amazon, who accept only fiat card payments, and dark web sellers like Silk Road, who accept only bitcoins. From Lemma 3, it is immediately clear that we can derive the value of bitcoins using (2), (6), and (13) alone. Therefore, the value of bitcoins is equivalent to that obtained in (8). A first conclusion then is that, from a pricing perspective, Proposition 2 best represents bitcoin’s value when either form of money is essential for a given transaction.

Now consider the case in which all sellers accept fiat currency, but some also accept bitcoins (⁠|$f_{B}=0$|⁠). Combining (13) and (14), we obtain |$i_{M}-Si_{B}(b)=\left(f_{M}+\left(1-S\right)f_{MB}\right)\lambda_{M}\left(\mu\right)$|⁠; for this equation to hold, we need |$i_{M}>Si_{B}(b)$|⁠. Therefore, we can establish a lower bound for the fiat currency inflation rate |$\gamma$|⁠, which becomes a necessary condition for bitcoins to be valued. A second conclusion is then that, if bitcoins are inessential for commerce, we only expect consumers to demand bitcoins in economies where the fiat inflation tax is high. If the central bank followed a deflationary or constant-supply policy, bitcoin demand would be naught.

Figure 9 illustrates the equilibrium determination of |$b$| and |$\mu$| in an economy with |$f_{MB},f_{M}>0$|⁠, |$f_{B}=0$|⁠, and |$\gamma>\rho$|⁠. The functions |$\mu=g_{B}(b)$| and |$\mu=g_{M}(b)$| are implicitly defined by (13) and (14), respectively. Importantly, as in previous sections, the complementarities between bitcoin users and miners yield a multiplicity of price-security ranked equilibria.⁵⁰ A third conclusion is then that Bitcoin’s security model can generate multiplicity regardless of whether bitcoins are essential in transactions. This fact highlights that the main conclusion of Propositions 1 and 2 is not a result of assuming that only bitcoins are available as a means of payment.

We group the conclusions derived above in the following proposition.

 

7. Discussion

We present a succinct discussion of our results and establish connections with empirical findings.

7.1 Price formation and hashrate

An essential empirical implication of our model is that bitcoin prices and the system’s hashrate are positively related in the general equilibrium. The long-term evolution of these key quantities, as displayed in Figure 1, provides strong support. To further assess this implication, we document in Section A.4 of the Internet Appendix the joint evolution of prices and the hashrate for Ethereum, the second-largest PoW blockchain by market capitalization, and Litecoin, one of Bitcoin’s clones with the longest history. For these, we also find a robust positive relation. Bhambhwani, Delikouras, and Korniotis (2019) provide further empirical support. The authors find that the aggregate hashrate has a long-term (cointegration) relation with the bitcoin price, and the same holds for a set of cryptocurrencies that rely on Bitcoin’s security model.⁵¹

7.2 Security budget and network attacks

As of yet, no successful hashrate attack against Bitcoin have been recorded.⁵² Our results highlight that such robustness must be seen as an equilibrium economic outcome—one with a high-security budget—and not as a byproduct of its blockchain technology. This vital distinction is best illustrated by the successful attack history of blockchains that, despite sharing Bitcoin’s features and security model, have failed to achieve one such reliable budget. We document several related episodes in Table A2 in the Internet Appendix.

7.3 Monetary policy in PoW blockchains

Although maximizing the token’s value, the system’s security, and social welfare can all be plausible design goals, we have shown that no monetary policy achieves these objectives at once. We note that the once-and-for-all implementation of Bitcoin’s monetary policy does not seem the solution to any formal design goal.⁵³ In particular, given that no mechanism renders |$\rho$| close to |$\rho_{W}$|⁠, miner security investment can be expected to be socially inefficient.⁵⁴ While a monetary policy reformulation in Bitcoin is unlikely, our results can help to clarify its private and social costs and offer guidance in the design of new systems.

7.4 Nonfundamental volatility

We find that bitcoins’ prices can fluctuate stochastically as nonfundamental sentiment changes, and the scope for such unpredictable jumps is greater than for traditional currencies. This result corresponds well to several empirical findings. For example, Bhambhwani, Delikouras, and Korniotis (2019) find that bitcoin prices deviate from fundamentals in response to a sentiment factor based on momentum.⁵⁵ Our result also suggests that the unprecedented volatility that Bitcoin has exhibited thus far cannot be entirely attributable to behavioral biases and/or limited use in commerce, although these factors can also play a role. Indeed, we do not feature irrational agents or upper bounds for the acceptability of bitcoins.

7.5 Bitcoin usage

Our model features the use of bitcoin as a means of exchange for some transactions. Some of the earliest related evidence is provided by Athey et al. (2016). Biais et al. (2020) develop an empirical test relating the market value of bitcoins with transactional benefits, which are proxied by retailer acceptance. Besides legal status uncertainty and taxation, a frequent argument is that large price volatility prevents more widespread use (Yermack 2015). Our results on the structural amplification of volatility suggest that such a challenge is likely to be enduring.

The bimonetary analysis highlights Bitcoin’s potential in two specific circumstances. The first one is when private agents suffer from incomplete connectivity due to governmental restrictions on using currency or the banking system. In that regard, Bitcoin can function as a stateless system offering a high degree of censorship resistance. Formally, we can associate the latter with |$f_{B}>0$|⁠; if |$B$|-type sellers are the government’s economic or political targets of a service-denial attack. The greater the number of restrictions, the greater the scope for Bitcoin to complete the network of economic relations domestically, or abroad, under international sanctions. Therefore, the expectation of a relatively high |$f_{B}$| and bitcoin price values with repressive authorities seems reasonable.⁵⁶

The second circumstance is when bitcoins can offer protection against fiat currency inflation, regardless of whether bitcoins are essential for specific trades.⁵⁷ This model implication corresponds well to industry reports that rank unstable high-inflation countries, such as Venezuela, among those with the highest Bitcoin usage per capita,⁵⁸ and to the evidence by Yu and Zhang (2020).

8. Concluding Remarks

We have presented a tractable decentralized monetary economy in which users’ and miners’ decisions affect each other, and the evolutions of bitcoin prices and security are jointly determined. The model outcomes demonstrate how ignorance of these general equilibrium connections—as in the benchmark considered—can lead one to mischaracterize the equilibrium set, underprice/overprice the token depending on assumptions about security, underestimate price volatility, and wrongly conclude that Bitcoin’s declining supply growth mechanically increases its value. We believe that our results can help understand other markets for network assets that rely on PoW consensus.

We conclude by discussing limitations and opportunities for future work. We focused on equilibria that do not display congestion. Intuitively, in our setting, it is sufficient for the block size to exceed the data storage needs with |$n$| transfers. If the block size were smaller, not all buyers would be able to acquire bitcoins. An equilibrium would then require buyers to be indifferent about buying bitcoins. This could be achieved with mixed strategies if those who buy bitcoins pay transaction fees of a value matching their trade surplus, thus redistributing resources from users to miners. This observation is decisively not to suggest that abstraction from fees is without loss of generality. If we observed heterogeneity in the level of impatience across agents, user-initiated fees could play an allocative role, as demonstrated by Easley, O’Hara, and Basu (2019) and Huberman, Leshno, and Moallemi (2019). The integration of a rich fee bidding game into a general equilibrium monetary framework is an exciting avenue of work.

Our focus on seigniorage-financed security also highlights challenges inherent in Bitcoin’s monetary policy, which eliminates issuances in the long term. If bitcoin usage continues to grow over the coming decades, one can, like Nakamoto, hope that user fees compensate for some or all of the loss of miner revenue. However, there is no built-in mechanism that ensures such a shift in revenue source. Second-layer networks, such as Lightning, can help mitigate scaling limitations, but their net impact of on-chain fees is still uncertain. Whether security can remain at high levels beyond 2140 is, therefore, an important open question.

A. Appendix: Proofs of Propositions

This appendix contains the proofs of proposition in the main body of the paper. Proofs of lemmas are found in Section E of the Internet Appendix. Subsequently, we sometimes avoid displaying the dependency of |$S$| and its derivatives on |$\left(H(b),A\right)$| and |$H(b)$| on |$b$| for compactness of notation.

A.1 Proof of Proposition 1

The necessary and sufficient condition for the existence of equilibrium under extrinsic security follows immediately from (3). Since |$V'$| is strictly decreasing, there can be at most one equilibrium.

Consider the case of intrinsic security and let |$\pi=\{p>0:\Delta\left(p\right)=1\}$| be the set of positive values satisfying (3), where |$\Delta(p)$| represents the left-hand side of (3). Let |$p_{m}$| be defined by |$p_{m}=H^{-1}\left(A\right)$| according to (1). Clearly, |$\tilde{p}\in[0,p_{m}]$| cannot be in |$\pi$| since |$H(\tilde{p})\in[0,A]$|⁠; given (2), |$S\left(H(\tilde{p}),A\right)=0$|⁠. For |$p>p_{m}(A)$|⁠, instead, we must have |$S\left(H(p),A\right)>0$|⁠. Since |$V'$| is decreasing and |$V'\left(0\right)=+\infty$|⁠, by continuity, there must be a sufficiently large |$\hat{n}(A)$| such that |$\Delta(p;\hat{n}(A))\ge1$|⁠. Therefore, when the population of buyers is large enough, |$\pi$| must contain at least one element.

For the smallest element in |$\pi$|⁠, |$p_{L}$|⁠, |$\Delta(p)$| must cross |$1$| from below, so |$\Delta'(p_{L})>1$|⁠. Next, note that from (2), |$S_{H}=\left(\frac{A}{H}\right)^{k}\frac{k}{H}$|⁠; from (1), |$H_{p}=\frac{m-1}{m}\left(\frac{\delta\psi R}{\kappa}\right)$|⁠. Combining these expressions, |$S_{H}H_{p}=\left(\frac{A}{H}\right)^{k}\frac{k}{p}$|⁠. Thus, for sufficiently large |$p$| values, |$S(H(p),A)\approx1$|⁠, |$S_{H}H_{p}\approx0$|⁠, and |$\Delta'\left(p\right)\rightarrow\frac{\overline{B}}{n}fV''\left(\frac{\overline{B}}{n}p\right)<0$|⁠. We conclude that, if there exists a stationary value |$p_{L}>0$| with |$\Delta'\left(p_{L}\right)>1$|⁠, there must be another solution |$p_{H}>p_{L}$| with |$\Delta'\left(p_{H}\right)<0$| so that |$\Delta$| crosses 1 from above. Since this conclusion holds regardless of |$V$|’s specific functional form, the number of elements in |$\pi$| must be even. An exception is the special case of a tangency value |$\hat{p}$| such that |$\Delta(\hat{p})=1$| and |$\Delta'(\hat{p})=0$|⁠. |$\square$|

A.2 Proof of Proposition 2

The existence and multiplicity part of the proof follows similar steps to those in Proposition 1. Still, we must account for the optimality conditions in the DM exchange and supply growth. Let |$\beta=\{b_{ss}:b_{ss}=D(b_{ss}),b_{ss}>0\}$| be the set of positive values satisfying (8). Let |$b_{m}$| be defined by |$b_{m}=H^{-1}\left(A\right)$| according to (6). For |$b\le b_{m}(A)$|⁠, we must have |$S\left(H(b),A\right)=0$|⁠; for |$b>b_{m}(A)$|⁠, |$S\left(H(b),A\right)>0$|⁠. Since |$u'$| is a decreasing function, and |$u'\left(0\right)=+\infty$|⁠, by continuity, for values |$b>b_{m}(A)$| there must be a sufficiently large |$\hat{n}(A)$| such that |$D(b;\hat{n}(A))\ge b$|⁠. Therefore, when the population of buyers is large enough, |$\beta$| must contain at least one element.

We conclude that if there exists a stationary solution |$b_{L}>0$| with |$D'\left(b_{L}\right)>1$|⁠, there must another solution |$b_{H}>b_{L}$| with |$D'\left(b_{H}\right)<1$| so that |$D$| crosses the 45-degree line from above. Because (A.1) holds regardless of the functional form of |$u$|⁠, the number of elements in |$\beta$| must be even. An exception with no crossings is the particular case where |$D$| is tangent to the 45-degree line at a point |$b_{ss}$| such that |$D'(b_{ss})=1$|⁠.

Expression I in (A.3) reflects a security enhancement; it must be positive given (2) and Lemma 1. Expression II reflects the marginal change in the value of the trade surplus; it must be positive since |$q_{L}<q^{*}$| by Lemma 2. Expression III reflects the positive marginal increase in mining costs. Social welfare increases with |$q$| only if the constant term III is small relative to I and II between |$q_{L}$| and |$q_{H}$|⁠. To assess the latter, note that, from (8), it must hold that |$f\left(u'\left(q_{L}\right)-1\right)=\frac{\rho}{\delta S(q_{L},A)}-1$|⁠. Therefore, II equals |$\frac{\rho}{\delta}-S\left(q_{L},A\right)$|⁠. Since |$S<1$| for |$q>0$|⁠, |$\frac{\rho}{\delta}>1$|⁠, and |$\frac{m-1}{m}<1$|⁠, we must have II|$>$|III. Thus, an increase in |$q$| over |$q_{L}$| raises social welfare. Since |$q_{H}>q_{L}$|⁠, we conclude that |$\mathcal{W}_{H}>\mathcal{W}_{L}$|⁠. |$\square$|

A.3 Proof of Proposition 3

A.4 Proof of Proposition 5

Substituting |$i_{B}=f\left(u'(q)-1\right)$| from (8) in (A.9), we obtain the inequality in (iii). If (A.9) holds, social welfare is enhanced by setting |$\rho_{W}$| below |$\rho_{V}$|⁠. If the inequality in (A.9) is reversed, |$MSB>MSC$|⁠; thus, it is socially optimal to set |$\rho_{W}>\rho_{V}$|⁠. |$\square$|

A.5 Proof of Proposition 6

The first bracketed term on the left-hand size of (A.12) is positive at a DME, while the second is negative. From Lemma E1 in the Internet Appendix, we know that the sum must be negative: |$y_{b}(b_{H})=\left(\frac{D'\left(b_{H}\right)-1}{b_{H}}\right)<0$|⁠. Therefore, |$\left|y_{b}\left(b_{H}\right)\right|<\left|\overline{y}_{b}(\overline{b})\right|$|⁠, implying that |$\left|db_{H}\right|>\left|d\overline{b}\right|$|⁠. |$\square$|

A.6 Proof of Proposition 7

Sunspot equilibria can exist under two types of conditions. For Type I, the denominator in (A.13) is positive. The full set of conditions for Type I is as follows: |$\phi_{1}>0$| requires |$\frac{D(b_{2})}{S(b_{2})}>\frac{b_{1}}{S_{1}}$|⁠; |$\phi_{1}<1$| requires |$\frac{b_{1}}{S_{1}}>{{\frac{D(b_{1})}{S(b_{1})}}}$|⁠; |$\phi_{2}>0$| requires |$\frac{b_{2}}{S_{2}}>\frac{D\left(b_{1}\right)}{S\left(b_{1}\right)}$|⁠, and |$\phi_{2}<1$| requires |$\frac{D(b_{2})}{S(b_{2})}>\frac{b_{2}}{S_{2}}$|⁠. Therefore, the joint satisfaction of these conditions requires |$b_{1}$| and |$b_{2}$| to satisfy |$\frac{D(b_{1})}{S(b_{1})}<\frac{b_{1}}{S_{1}}<\frac{D(b_{2})}{S(b_{2})}$| and |$\frac{D(b_{1})}{S(b_{1})}<\frac{b_{2}}{S_{2}}<\frac{D(b_{2})}{S(b_{2})}$|⁠. Since |$S_{1}>S\left(b_{1}\right)$|⁠, for |$\frac{D(b_{1})}{S(b_{1})}<\frac{b_{1}}{S_{1}}$| to hold, it is necessary that |$D(b_{1})<b_{1}$|⁠. Similarly, since |$S_{2}<S\left(b_{2}\right)$|⁠, for |$\frac{b_{2}}{S_{2}}<\frac{D(b_{2})}{S(b_{2})}$| to hold, it is necessary that |$D(b_{2})>b_{2}$|⁠. Therefore, |$D$| must cross the 45-degree line from below between |$b_{1}$| and |$b_{2}$|⁠, |$D(b_{1})<b_{1}<b_{2}<D(b_{2})$|⁠, which only holds in the intrinsic security case.

For Type II, the denominator in (A.13) is negative. Existence require that |$b_{1}$| and |$b_{2}$| satisfy |$\frac{D(b_{1})}{S(b_{1})}>\frac{b_{1}}{S_{1}}>\frac{D(b_{2})}{S(b_{2})}$| and |$\frac{D\left(b_{1}\right)}{S\left(b_{1}\right)}>\frac{b_{2}}{S_{2}}>\frac{D(b_{2})}{S(b_{2})}$|⁠. In this case, |$D$| crosses the 45-degree line from above between |$b_{1}$| and |$b_{2}$|⁠, and these values are in the area of overlap between |$D(b)$| and |$D^{-1}(b)$| around |$b_{H}$|⁠. If |$S(b_{1})\approx S(b_{2})$| for this range of values, a sufficient condition is that |$D'(b)<-1$| around |$b_{H}$|⁠. |$\square$|

A.7 Proof of Proposition 8

The proof of the existence of multiple equilibria is similar to that for Propositions 1 and 2 and is therefore omitted. Part (ii) follows directly from Lemma 3. Finally, note that, if |$f_{B}=0$|⁠, a necessary condition for the system (13) and (14) to hold is that |$i_{M}>S(b_{ss},A)i_{B}$|⁠. Using the definitions of |$i_{M}$| and |$i_{B}$| one obtains the lower bound for |$\gamma$| in (iii). |$\square$|

Acknowledgement

For helpful, detailed, and insightful comments, I am grateful to Itay Goldstein (the editor) and two anonymous referees. For helpful comments as conference discussants, I thank Matthew Bouvard, Jonathan Chiu, Maryam Farboodi, Nicola Pavanini, Jiasun Li, Michael Sockin, Konstantin Sokolov, and Peter Zimmerman. I also benefitted from conversations with Franklin Allen, Andreas Antonopolous, Andrea Buraschi, Ivan Canay, Will Cong, Marcin Kacperczyk, Andrei Kirilenko, Hanno Lustig, Alex Michaelides, David Miles, Andreas Park, Guillaume Rocheteau, Jose Scheinkman, Nick Szabo, Harald Uhlig, Stijn Van Nieurburgh, and Randall Wright; conference participants at the 2018 Finance Theory Group London, the 2018 Bloomberg Crypto Summit, the 2019 American Economic Association Meetings, the 2019 American Financial Association Meetings, the 2019 European Financial Association, the 2019 Central Bank Research Association Conference, the Second Toronto Fintech Conference, the 2019 Financial Intermediation Research Society Conference, the 2019 Cambridge Centre for Alternative Investment Conference, the 2019 Bank of Canada Money and Banking Workshop, the 2020 American Economic Association Meetings, the 2020 Western Finance Association Meetings, the Crypto and Blockchain Economics Research Forum, the 2020 Nova SBE Fintech Conference; and seminar participants at the Einaudi Institute for Economics and Finance, Imperial College London, the Swiss Finance Institute at EPFL, Central European University, Durham Business School, Cass Business School, NUS Business School, CUHK Business School, HKU Business School, University of Luxembourg, and Singapore Management University. Supplementary data can be found on The Review of Financial Studies web site.

Footnotes

References