Incentive design and the security budget

A permissionless ledger has no guards. What stops someone from rewriting it is that rewriting costs more than it pays. That sentence is the whole of the security model, and everything else, proof of work, proof of stake, slashing, finality gadgets, is engineering in service of it.

The quantity that makes the sentence operational is the security budget: the total value paid out per unit of time to the parties who produce and validate blocks. It is the network's annual defence spending. Where that money comes from, whether it is stable, and whether the amount is well matched to what is being protected are three separate questions, and the answers differ sharply between designs.

What the budget is, and who pays it

The security budget has exactly two funding sources: newly issued tokens and transaction fees.

Issuance is paid by holders, through dilution. Nobody writes a cheque, which is why it is politically easy and why it is often described as free. It is not free; the previous lesson set out the arithmetic of who loses what share.

Fees are paid by users, per transaction. This is politically harder, because the cost is visible at the moment of use, and it is economically more honest, because it charges the people consuming block space.

Every network is somewhere on the path from the first to the second. Bitcoin's design makes the migration explicit: the subsidy halves roughly every four years and reaches nothing around 2140, so fees must eventually carry the entire budget. Whether a fee market alone can support a budget large enough is the central open question about the design, and reasonable people disagree about it.

Sizing the budget: a worked example

Take a proof-of-work chain paying a subsidy of 3.125 coins per block with 144 blocks per day, so 450 coins per day. Suppose, purely as an illustration, a price of CHF 60,000 per coin. Daily miner revenue from the subsidy is 450 × 60,000 = CHF 27 million. Annualised, that is 27 million × 365 = CHF 9.855 billion.

Now suppose the network's aggregate market value is CHF 1.2 trillion. The annual security spend is 9.855 ÷ 1,200 = 0.82 per cent of the value secured.

Two readings of that number are both correct. It is a large absolute sum, larger than the security spend of most institutions on earth. It is also a thin ratio in a specific sense that Eric Budish made precise in his 2018 analysis of the economic limits of proof of work: the budget is a flow, paid per unit of time, while the value it protects is a stock. An attacker does not need to outspend the annual flow. They need to outspend the flow for the duration of the attack.

In this example, honest miners collectively earn 27 million ÷ 24 = CHF 1.125 million per hour. Acquiring hash power roughly equal to the whole network for six hours therefore costs on the order of 1.125 × 6 = CHF 6.75 million in direct operating terms, before the question of where that hardware comes from. Against CHF 1.2 trillion of secured value, the flow cost of a short attack is trivially small. Budish's conclusion is that proof-of-work security only holds if the value that can be extracted in one attack window is kept small relative to that flow, which is precisely why exchanges require more confirmations for larger deposits. The confirmation rule is not a technical convention. It is the mechanism that keeps the attackable stock in line with the defensive flow.

Proof of stake changes the collateral, not the logic

Under proof of stake, block production rights are allocated in proportion to tokens bonded to the protocol. The security argument shifts from "an attack costs electricity" to "an attack costs capital that the protocol can destroy".

The destruction is the important half. Slashing means that a validator caught signing two conflicting blocks loses part of its bonded stake, and designs typically add a correlation penalty: the more stake is slashed simultaneously, the larger each participant's loss, up to the entire bond. This converts an attack from a flow cost into a stock cost. The attacker does not rent the attack, they burn their principal.

Sizing it requires care. Suppose total supply is 100 million tokens, 30 million are staked, and the price is CHF 2.00, so CHF 60 million is bonded. Say an attack requires one third of the active stake. The naive calculation, one third of 30 million, gives 10 million tokens or CHF 20 million. That is wrong, because staking your own tokens increases the staked set. You need x such that x ÷ (30 + x) = 1/3, which gives x = 15 million tokens, or CHF 30 million at the quoted price.

And the quoted price is fiction at that size. Fifteen million tokens is 15 per cent of total supply and half the free float in most such networks. Buying it would move the price violently against the buyer, then the attack itself would destroy the value of the position being used to conduct it. The honest statement is that the cost of attacking a proof-of-stake chain is bounded below by the market-impact-adjusted cost of acquiring the stake, plus the slashing loss, and the first term is usually much larger than a spot calculation suggests.

The corresponding weakness is different in kind. Proof of stake ties security to the token's own market value, which is reflexive: a collapsing price cheapens an attack at exactly the moment confidence is weakest. Proof of work ties security to an external cost, electricity and hardware, which decouples the two but requires continuous expenditure forever.

The third revenue line: MEV

Issuance and fees are the visible budget. There is a third stream, and ignoring it produces wrong answers.

Whoever chooses the order of transactions in a block holds an option. They can place their own transaction ahead of a large trade they can see in the queue, they can sandwich it, they can capture a liquidation before anyone else. This value, generally called maximal extractable value, was named and measured in the 2019 paper Flash Boys 2.0 by Daian and co-authors. It is paid, ultimately, by users who receive a worse execution than they otherwise would.

MEV matters to incentive design for three reasons. It supplements the security budget without appearing in issuance or fee statistics. It is unevenly distributed, which pushes block production toward specialised firms and therefore toward centralisation. And beyond some size it threatens consensus itself: if the value inside a past block exceeds the reward for extending the chain, the rational move is to reorganise the chain to capture it rather than build on it. That is why designs separate the roles of block builder and block proposer, so that the party with the ordering power is not the party with the consensus vote.

Designing incentives that survive contact with users

A few principles generalise beyond any particular chain.

Pay for the behaviour you need, not the behaviour that is easy to measure. Rewarding raw participation attracts participants; rewarding correct and timely attestation attracts validators. The gap between the two is where most incentive failures live.

Make the penalty asymmetric to the profit. If honest operation earns a few per cent per year and a successful attack pays a multiple of the bond, no rational actor is deterred by a marginal penalty. Slashing works because it is not marginal.

Beware of budgets that are procyclical. A security budget denominated in the network's own token is largest when the token is expensive and smallest when it is cheap. That is the opposite of an insurance policy, which should pay out when things go wrong.

Distinguish the cost of attacking from the cost of profiting. An attacker must not only rewrite history, they must convert the rewrite into value, which usually means moving funds through a venue that has its own controls, withdrawal delays and monitoring. Practical security is the product of both, which is why the exchanges and custodians discussed later in this course are part of the security perimeter whether or not they wish to be.

Where a Swiss participant meets these mechanics

Two features of the Swiss framework bear directly on staking, and neither is about the protocol.

The first is tax. For a Swiss-resident private investor, staking and mining rewards are treated by the Federal Tax Administration's guidance as taxable income at the moment of receipt, valued at the price then, and the resulting tokens then enter the wealth-tax base at their 31 December value. The practical consequence is a timing mismatch: income tax crystallises on rewards received during a rising year, while the position that must fund the bill is marked at year end. A validator that reinvests everything can owe cash tax on tokens it never sold, at a value it no longer has.

The second is custody. Switzerland's ledger-based-securities legislation added a segregation rule to the Banking Act for crypto-assets held in custody: client assets that are held ready for delivery at all times or individually allocated to the client are separated from the bankruptcy estate rather than ranking as unsecured claims. Staking sits awkwardly against that requirement, because bonded stake is subject to an exit queue and cannot be delivered on demand. Anyone using a Swiss custodian's staking service should be reading the contract for how that condition is satisfied, not assuming it is.

Finally, a note on where this money cannot come from. Swiss occupational pension assets are constrained by the BVV2 investment ordinance, and the later lesson on institutional adoption works through the category limits that apply. The short version is that the room available is small and already contested by other alternative exposures, so the security budget of a public chain is not, in Switzerland, going to be underwritten by pillar-2 capital.

What to take away

• The security budget is a flow paid per unit of time, while the value it protects is a stock, and it is the ratio between the two over an attack window, not the annual total, that determines whether an attack is affordable.
• Confirmation requirements are the mechanism that keeps the attackable amount within the reach of the security flow, which is why they scale with transaction size rather than being a fixed convention.
• Computing the stake needed for a proof-of-stake attack against the existing staked set understates it: reaching one third of the post-entry set from a 30 million base requires 15 million tokens, not 10 million.
• MEV is a real revenue line for block producers and a real cost to users, and when it grows large relative to the block reward it turns from a distributional problem into a consensus problem.
• Swiss staking rewards are taxed as income when received, which creates a cash-tax liability on tokens that were never sold and are marked for wealth tax at a different date.

Sources

• Eric Budish, The Economic Limits of Bitcoin and the Blockchain (NBER Working Paper 24717, 2018).
• Philip Daian, Steven Goldfeder, Tyler Kell, Yunqi Li, Xueyuan Zhao, Iddo Bentov, Lorenz Breidenbach and Ari Juels, Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges (2019).
• Vitalik Buterin and Virgil Griffith, Casper the Friendly Finality Gadget (2017), on slashing conditions and finality.
• Raphael Auer, Beyond the doomsday economics of "proof-of-work" in cryptocurrencies (BIS Working Papers No. 765, 2019).
• Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008), sections on incentive and on the probability of an attacker catching up.
• Swiss Federal Tax Administration, working paper on cryptocurrencies and initial coin offerings, on the income treatment of staking and mining rewards.
• Swiss Federal Act on Banks and Savings Banks, provisions on the segregation of crypto-based assets held in custody, as amended by the DLT framework.
• Ordinance on Occupational Retirement, Survivors' and Disability Pension Plans (BVV2), investment provisions.