Competitive equilibria between staking and on-chain lending

Proof of Stake (PoS) is a burgeoning Sybil resistance mechanism that aims to have a digital asset (“token”) serve as security collateral in crypto networks. However, PoS has so far eluded a comprehensive threat model that encompasses both Byzantine attacks from distributed systems and ﬁnancial attacks that arise from the dual usage of the token as a means of payment and a Sybil resistance mechanism. In particular, the existence of derivatives markets makes malicious coordination among validators easier to execute than in Proof of Work systems. We demonstrate that it is also possible for on-chain lending smart contracts to cannibalize network security in PoS systems. When the yield provided by these contracts is more attractive than the inﬂation rate provided from staking, stakers will tend to remove their staked tokens and lend them out, thus reducing network security. In this paper, we provide a simple stochastic model that describes how rational validators with varying risk preferences react to changes in staking and lending returns. For a particular conﬁguration of this model, we provide a formal proof of a phase transition between equilibria in which tokens are predominantly staked and those in which they are predominantly lent. We further validate this emergent adversarial behavior (e.g. reduced staked token supply) with agent-based simulations that sample transitions under more realistic conditions. Our results illustrate that rational, non-adversarial actors can dramatically reduce PoS network security if block rewards are not calibrated appropriately above the expected yields of on-chain lending.


INTRODUCTION
There is currently an intense effort to improve the scalability of blockchains and other decentralized value systems known as crypto networks.These networks use cryptographic proofs and game theoretic constructions to provide tamper-resistant updates to a global ledger.While there are a variety of research and engineering challenges in setting up these systems, one of the major bottlenecks to network throughput is the cost of Sybil resistance mechanisms within a decentralized consensus protocol.Proof of Work (PoW) networks achieve Sybil resistance by requiring consensus-participating nodes to provably burn energy to compute many iterations of a particular cryptographic hash function.PoW, while effective and permissionless, expends a large amount of natural resources and has resulted in concentrated ownership of the underlying digital assets (e.g.Bitcoin).Proof of Stake (PoS) was first introduced as an alternative in a 2012 BitcoinTalk post [QuantumMechanic 2011] that showed the equivalence between a PoW miner who could immediately reinvest her block rewards into hash power within the network and a PoS validator who can reinvest their validation earnings into network security.PoS works by instead allowing users to 'lock' a digital asset, known as a token, into a smart contract that provides them with token-denominated returns in exchange for validating transactions and providing network security.Using shared, verifiable randomness, all network participants can use a multi-party computation protocol to sample the distribution of asset ownership locked into the contract and choose participant(s) who receive the block reward emitted by the network.This is analogous to how PoW can be thought of as a protocol that samples the distribution of hash power to choose the next block producer [Pass et al. 2017].One of the main benefits of PoS is that one does not have to commit a costly natural resource to participate in the network.Instead, a purely digital asset is used as collateral for the network and the network can control its supply to provide the desired properties.For an introductory background on PoS protocols and their complex security models, please see [Kiayias et al. 2017;King and Nadal 2012;Saleh 2019;Daian et al. 2019;Neuder et al. 2019].In this paper, we show that these purported benefits do not come for free.As PoS algorithms inherently connect a decentralized network's security with the capital cost of a digital asset, PoS protocols tie their security to the cost of capital rather than to the cost of a natural resource.Volatility in the cost of capital, which is usually higher than that of natural resources [Poelhekke and van der Ploeg 2007], can have adverse effects on capital commitments to PoS networks.The main result we show is that alternative sources of yield can drive staking token capital allocators to collectively drain a network's security, akin to a bank run.In particular, we find that PoS in deflationary systems is unstable and unlikely to work and that for more reasonable inflation rates, the effectiveness of PoS Fig. 1: Staking and lending with Compound's smart contract parameters (left) and more aggressive parameters with yields of up to 75%.The y-axis in both figures is the percentage of the total outstanding token supply that is allocated to staking versus that which is allocated to lending.This simulation had 512 agents whose parameters were sampled as in equations ( 3) and (4).Note that the two figures have different time-scales to illustrate how the parameters of the model (see §3.2.1) affect the oscillations between staked and lent supply In particular, it is clear that there is a relationship between the price of capital availability and participant's willingness to stake, as stakers have to earn more than a risk-adjusted market rate on their staked capital.However, unlike Proof of Work, there are no physical limits that prevent validators in staking networks from rapidly moving their assets into higher yielding activities.Onchain lending, such as Compound, makes this particularly efficient, as validators simply have to post a single Ethereum transaction to unbond their tokens and begin earning yield within a single block time.High lending yields would likely lead to a reduction in network security (e.g. a financial attack) as these yields would encourage rational actors to unexpectedly coordinate and reduce network security by optimizing for financial gain.We answer these questions with a stochastic model that can be theoretically solved in certain situations and is easily simulated via Monte Carlo methods.Our aim is not to model realistic networks parameters perfectly, but rather to show that even in the most simplified model of agents optimizing portfolios composed of staked and lent tokens, on-chain lending can cause dramatic volatility in network security.In particular, we construct an agent-based model, where each network participant is represented via an agent with a utility and decision function.Agent-based modeling has been previously used for modeling censorship properties in sharded PoW chains [Chitra et al. 2019] and can serve as a conduit for comparing theoretical results to empirical data in a statistically rigorous manner.Our model for rational network agents involves having each participant view their total token wealth as a two component portfolio of tokens staked and lent.We assume that the agents Fig. 2: Plots of relative amount of staking to lending, with inflation increasing in a clockwise manner.When these plots are negative, there is, on average, more lending than staking and vice-versa, when positive.When we are deflationary (top two rows), we see that regardless of the lending rate parameters (the x-axis is β 0 and the y-axis is β 1 from equation ( 1)), tokens on average lent.This empirically demonstates that there is a phase transition from a lending-dominated regime (which is deflationary) to one that is staking-dominated and inflationary.This simulation also uses 512 agents and the titles state the inflation rate (which is deflationary if it is less than 1), block reward, half-life, and borrow threshold (see §5.3) and each sample involves an average over a hundred random seeds.
have different risk preferences and locally optimize their token portfolios using mean-variance optimization [Markowitz 1952], which allows for agents to adjust their portfolios based on observed returns and risk preferences.Figure 2 illustrates that there is a phase transition in inflation rate that leads to tokens going from being predominantly lent in deflationary regimes to predominantly staked in inflationary regimes.Moreover, figure 3 shows that the spread between borrowing and lending rates is significantly worse for deflationary PoS assets, further confirming the existence of a phase transition.We explicitly state our simplifying assumptions in §2 and note that agent-based modeling allows one to relax these assumptions and analyze how these results carry over to real PoS protocols, such as Cosmos [ Buchman 2019] and Tezos [Goodman 2014].In section §4, we prove properties of this model that match the observed phase transition from figures 2 and 5.A single sample path is depicted in Figure 1, which visually show that agents participating in on-chain lending and staking can cause a "flippening," where there are more assets lent out than staked.The observed volatility in the amount of assets staked is tantamount to dramatically reducing the cost of taking over a staking network, which implies that the security model of PoS networks needs to account for attacks on the network that stem from reduced cost of capital.The combination of theoretical and simulation-based results demonstrate that the threat model for PoS networks needs to be expanded to include financial attacks that result from yield competition with on-chain financial products.For provenance, note that the mathematical notation used in this paper is documented in Appendix A.
Fig. 3: Plots of the relative spread between borrowing and lending rates.If the value is higher, then borrowing costs more than lending.Note that in the deflationary regime, as the lending rates increase (e.g. as β 0 , β 1 from (1) increase), the spread also increases, whereas this effect is far more muted.The simulation parameters are the same as figure 2.

PROTOCOL ASSUMPTIONS
In order to simplify our model, we will make some simplifying assumptions.These assumptions hold for all models analyzed in this paper and they focus on properties of the underlying distributed ledger rather than properties about the economic behavior of participants, which is described in the proceeding section.

Assumption 1 (Cryptographic). All sampling processes use true randomness and not pseudorandomness
This differs from many standard cryptographic threat models that assume pseudorandomness and provide an ε-approximation to true random sampling [Koblitz and Menezes 2015].In the Appendix, we use this property to ensure that our PoS algorithm is non-anticipating (e.g.adapted to a suitably chosen filtration), allowing for conditional probabilities to be computed without having to aggregate the ε error terms.One can remove this assumption, in a similar manner to [Chan et al. 2018], with a significant increase in proof complexity.
Assumption 2 (Distributed Systems).All communication between participants is synchronous.
This can be relaxed to partial synchrony, with an increase in complexity in the proofs and simulations described in the following section.
Assumption 3 (Identity).All pseudonymous identities are known by all participants and the number of participants (measured by unique addresses), n, is fixed.
Assumption 4 (Time).The entire system will update at discrete time intervals, with each tick to be thought of as a block update.
While participants will likely execute strategies in continuous time, assuming discrete time evolution ensures that participants only respond to event updates that are received on-chain.One can also remove this assumption at the cost of increased variance using 'Poissonization' techniques [Kane 2016] and 'sleepy consensus' assumptions [Pass and Shi 2017].
Assumption 5 (No External Markets).Only on-chain lending, borrowing, and staking will be considered.
We are ignoring off-chain lending (e.g.OTC desks or lending businesses, such as Galaxy and Tagomi) and are assuming that there always exists block space for any participant's action to succeed.We are omitting this to reduce the complexity of our model, as off-chain lending has varied pricing models and term structures.
Assumption 6 (Money Supply is Deterministic).The block reward at time t, R t and the money supply at time t, S t = ∑ t s=0 R t are deterministic and known to all participants.In particular, we avoid assuming that there exist governance mechanisms for changing the block reward, which have been proposed for protocols such as Algorand [Gilad et al. 2017] and Celo [Kamvar et al. 2019].Assumption 7 (No Transaction Fee Revenue).The only revenue that validators receive from staking comes from the block reward.This is a model assumption that removes the complexity of modeling crypto network fee markets, which currently have unstable dynamics and are poorly understood.
Assumption 8 (PoS).The following properties hold for our idealized PoS algorithm: -No compounding: PoS mechanism uses epoch-based sampling and does not immediately reinvest block rewards.This is to avoid the concentration behavior described in [Fanti et al. 2019].One can relax our model to handle Pólya urn processes, at the cost of significantly worse variance.-Single validator per block: To simplify the model, we avoid using committees [Gilad et al. 2017;Rocket et al. 2019;Kamvar et al. 2019;Goodman 2014;Buchman 2019;Chitra and Chitra 2019;Pass and Shi 2018;Neuder et al. 2019] and verifiers [Bagaria et al. 2018;Baudet et al. 2018] as they add more variance and make both formal and simulation methods more difficult.-Constant slashing probability: We assume that each validator has a fixed probability p slash of being slashed on a block that they produce.This is simplistic as it assumes that all validators have the same chance of being slashed, regardless of stake and validation history.However, in practice, we have seen very few live slashes and this model encourages simpler formal and simulation analysis.-Sharded state is synchronously traversed Any sharded state in our PoS blockchain is read synchronously and we assume linearizability in our blockchain.This can be relaxed to nonlinearizable protocols like Avalanche [Rocket et al. 2019], but will depend on the scoring function used for each branch.-No unbonding period We do not assume that the PoS protocol has an unbonding period like that of Cosmos [Buchman 2019] or Tezos [Goodman 2014].

PoS Model
Let S t be the total outstanding token supply of a PoS protocol at time t and let S t = ζ t + t , where ζ t is the number of staked tokens and t is the number of lent tokens.We use a simple model of a PoS system that samples a single block producer from a discrete time-series of stake distributions, denoted by π stake (t) ∈ ζ t ∆ n , where ∆ n is the n-dimensional probability simplex (see Appendix A).
The main input parameters are: π stake (0): Initial asset distribution -R t : Staking block reward at block height t -S(i, π stake ): Slash that validator i receives if the staking distribution is π stake The formal specification of the algorithm can be found in Algorithm 1 in Appendix B. The algorithm state includes the current stake distribution, the current epoch's reward set, the current epoch's slash set, and the current block time.At a high-level, for each block, we select a validator who should receive a block reward and decide if they are to be slashed by flipping a coin with probability p slash .If they are slashed, we add their id and the amount that they are to be slashed to the current epoch's slash set.Otherwise, we add them to the block reward set.The algorithm updates the stake distribution on a per epoch basis.

Lending Model
We will study two models for lending, one involving an explicit model for borrowing demand and one that is implicit.The implicit model, which is simpler, provides a prototype for constant borrowing demand and is amenable to theoretical results.On the other hand, the model involving an explicit description of borrowing demand is more realistic and amenable to being fit by historical data.
3.2.1.Two-State Lending Model.In the two-state lending model, we track the time evolution of two token distributions, π stake (t), π lend (t) ∈ S t ∆ n , which respectively represent the distribution of staked tokens and those locked in a lending contract.The ith component of the stake distribution, π stake (t) i , corresponds to the amount of tokens that the ith agent has staked.Each agent has a wealth W i (t) at time t that is equal to the sum of their portfolio of staked and lent tokens, i.e.W i (t) = π stake (t) i + π lend (t) i .By definition, the total lending supply is equal to the sum of all lent portfolios, i.e. t = π lend (t) 1 , and the total money supply is equal to the sum of all portfolios, i.e. S t = π stake (t) 1 + π lend (t) 1 .At each time step, agents update their portfolios based on returns accrued from the previous time step and after portfolios are updated, the lending rate, γ t , is updated based on the total amount lent.This means that we are making two implicit assumptions: (1) Constant relative borrowing demand: We are assuming that ratio of borrowing demand (represented via a quantity of tokens) to the total token supply stays constant, as the rate only depends on the lending and staking supplies.Formally, this means that the demand at time t is equal to kS t (2) Flows are the only determining factor: Participants who move tokens from staking to lending or vice versa are the only causes for changes to the lending rate We draw inspiration from Compound [Leshner and Hayes 2019], which provides a simple formula for the borrow lending rate, β t , and the lending rate, γ t .The Compound model computes a utilization rate U t at block height t, which is the ratio of the borrowing demand to the token supply locked in the contract, and uses that to update formulas for β t , γ t .Mathematically, they define the utilization rate as U t = kS t t + kS t We compute the borrow and lend rates using the following formulas, where β 0 , β 1 ∈ (0, 1) are interest-rate parameters and γ 0 ∈ (0, 1) is a measure of the spread between lending and borrowing (i.e. 1 − γ 0 is the relative spread). (1) For reference, the Compound V2 contract uses the values β 0 = 5% and β 1 = 45%.As depicted in Figure 1, there can be an enormous amount of volatility in the fraction of the token supply that is lent, t S t .In §4, we prove tail bounds on the inflows and outflows of lent tokens over a time step, e.g.
that explicitly depend on the block reward, R t and the interest rate parameters.These bounds suggest that even for the overly simplistic setting of the two-state model, PoS protocols need to carefully choose their block rewards if they desire to have a large fraction of the outstanding token supply staked at all times.23.2.2.Three-State Model.Instead of assuming that there is constant relative borrowing demand, we can relax this by specifying an additional distribution, π borrow (t), such that π token = π stake + π lend + π borrow and S t = ζ t + t + ξ t , where ξ t = π borrow (t) 1 is the total amount borrowed at time t.In this world, the utilization ratio is now defined as: t + ξ t Formally analyzing this model has a variety of difficulties that stem from that fact that we have to explicitly model the borrow demand distribution and disentangle how it couples to each participant's local model of risk, which is defined in the next section.In §5, we simulate this model with a variety of different borrowing demand distributions, but all formal proofs that follow only analyze the twostate lending model.Since the pool of borrowers (e.g.arbitrageurs) is often disjoint from the pool of stakers and lenders, we will make the following assumption: Assumption 9 (Borrowing demand is independent of staking and lending).The borrowing demand distribution π borrow is probabilistically independent of the lending and staking distributions.

State Transition
The final task needed to completely specify this model is to define the state transition rule that sends π lend (t), π borrow (t), π token (t) to π lend (t + 1), π borrow (t + 1), π token (t + 1).As per Assumption 9, the evolution of π borrow (t) is independent of staking and lending, and will be specified separately in §5.We therefore need to specify state transition rules on a per agent basis, where each agent's state is their token portfolio (π stake (t) i , π lend (t) i ).Traditionally, the strategy space of rational actors is described via an expected utility function that an agent aims to maximize by taking various allowable actions.Before specifying the strategy space that we will sample, let's consider a few examples to motivate the need for agents who have varying risk preferences.If at time t, staking is returning more than lending and every agent moves their entire portfolio from lending to staking, then we will observe a correlated spike in lending rates t will go to zero and U t = 1.Moreover, the relative staking reward to any agent will decrease as S t will increase by the amount of tokens that flow from lending to staking as the expected return on an epoch for an agent is their staked tokens divided by the token supply, π stake (t) i S t − t .Thus the greedy strategy of moving all of one's assets to the higher yielding activity and causes drastic swings in the relative yields of staking and lending is unstable and doesn't accurately represent reality, where token holders have differing risk preferences and will not immediately move their entire portfolio from staking to lending (or vice-versa).Furthermore, cryptocurrency holders are often looking for returns that are multiples of their initial investment and have a long time-preference [Weber 2016].In our evolution of each agent's portfolio, we also assume that an agent making a decision at time t can only use the information about all portfolios up to time t, {π i (t) : i ∈ [n]}, and the implied rate γ t .Since we are dealing with on-chain lending only, this assumption says that players cannot use strategies that look into the future and that all agent portfolios are public.In order to capture strategies that are independent of front-running and latency arbitrage, we will make the following assumption: Assumption 10 (Martingale Ordering).There exists an [n]-valued martingale Z t that chooses the ordering in which participants are allowed to update their portfolios at time t to those at time t + 1.Under this assumption, agents receive no advantage in expected returns by trying to predict when their strategy is executed (e.g. is agent 1's strategy executed before agent 2's strategy because agent 1 has more staked than agent 2?).This assumption is reasonable as our goal is to figure out if rational, but non-Byzantine, agents will cause PoS network security to decrease when on-chain lending activity is sizeable.
3.3.1.Optimal Portfolio Construction.Mean-variance methods, pioneered by Markowitz's Nobel Prize winning work on portfolio theory [Markowitz 1952], provide a way for rational traders of risky assets to construct portfolios that trade-off individual preferences for maximizing returns with those of risk minimization.These methods, which are the backbone of the majority of trillions of dollars of passive portfolios and statistical arbitrage strategies, provide a simple, easy-to-solve model that involves two parameters for constructing portfolios of n assets: an expected return vector µ ∈ R n and a positive-definite covariance matrix Σ ∈ S n×n + .Given these parameters, one solves a strongly convex program that aims to compute the fraction of an agent's wealth that should be allocated to each asset while ensuring that the sum of the allocations is one and each entry is positive.In particular, the seminal work of Markowitz aimed to optimize the quadratic form f : where λ is a parameter that controls the riskiness of the output portfolio and w is the portfolio allocation.As λ is varied, the efficient frontier of admissible portfolios is defined as the surface S(µ, Σ) = {w ∈ R n : ∃λ such that w ∈ arg min f (w, µ, Σ, λ)}.The original work of Markowitz [Markowitz 1952] focused on the single period allocation problem, where an investor aims to find the optimal portfolio over a single time-period, which corresponds to assuming that µ and Σ do not change over time.Further work on multiple period [Li and Ng 2000] and continuous-time methods [Zhou and Yin 2003] for mean-variance optimization allow for µ and Σ to vary as functions of time, with the continuous-time methodology drawing µ from an Îto process, such as a solution to the Black-Scholes equation for options pricing.As blockchain systems have incremental updates with independent games per update (e.g.transaction fee markets can differ wildly from block to block), we will necessarily have to consider the multiple period model and define how each agent's mean vector and risk-preferences evolve over time.Finally, we note that our methodology is directly comparable to that of multistrategy backtesting in quantitative trading [Boyd et al. 2017].We will assume that each agent treats their token wealth, (π lend (t) i , π stake (t) i ) as a Markowitz portfolio and updates, on receiving tokens from staking and lending, an estimate for a time-dependent return vector µ i (t) ∈ R 2 .We also assume that each agent has a different, time-independent covariance matrix Σ i that is drawn from a random matrix ensemble3 .In other words, the expected return vector adjusts with time (it depends on the staked and lent quantities), while the covariance stays fixed in time.As long as there is some variance in the chosen random matrix ensemble (e.g.∃i, j ∈ [n] such that Pr[Σ i = Σ j ] > 0), then the dynamics will not deadlock into a state where all participants end up with the same portfolio (e.g.all outstanding tokens are 100% allocated to staking or lending).If agents simply move all of their assets from one pool to another, as opposed to some risk-adjusted proportion, then the system can deadlock quickly when borrowing demand is constant.Using the notation of the prequel, we define µ i (t) = µ i (π stake (t), π lend (t)) as: Let us motivate this choice of expected return vector.Recall that the return vector is supposed to represent the relative rate of return (usually referred to as an alpha in the quantitative finance literature) over a riskless asset.In this situation, the riskless asset is holding our tokens (as bearer instruments) and we expect to earn yields 4 of R t S t − t and γ t for staking and lending, respectively.However, note that the former yield can be greater than 1 (when S t − t < R t ), whereas the latter yield cannot as per equation (1).In order for Markowitz optimization to be well-defined, we need to choose yields that are directly comparable (e.g. have the same range).Moreover, we note that the naïvely calculated staking yield loses the dependence on the ith party's current wealth.Since our system allows for slashing and each validator incurs a variance in reward proportional to the inverse square root of the epoch length, it is preferable to find a yield that depends on the ith parties wealth to reflect this variance.The simplest estimator for a staking validator's yield that is in [0, 1] (comparable to lending yield) and has a component of the variance is the probability of winning the block reward, π stake (t) i S t − t , which is exactly what (3) describes.In order to describe the covariance matrix, we will first state an assumption that aims to connect the variances in the system with the expected staked and lent times: Assumption 11.The ith agent's covariance matrix Σ i will be static (e.g.does not vary with block height), diagonal, and will have variances connected to the expected stake time τ stake and expected lent time τ lend Formally we use the following model for the covariance matrix: One can interpret τ stake as the expected epoch length (see Algorithm 1), while τ lend represents the withdrawal window under which a lender can remove their tokens from the lent pool. 5By connecting the covariance matrix to these quantities, we encode the connection between a validator's expected risk preference and the time that capital is locked into either staking or lending.Equation (4) represents the fact that risk and time preferences are, to first-order, inversely correlated (e.g.you are willing to lock up capital for the longest duration in the least risky assets) [De Santis and Gerard 1997].To explain these choices of random variables, first recall that the Markowitz objective function is of the form f (µ, Σ, w, λ) = w T Σw − λµ, where λ parametrizes the agent's preference for return maximization over risk minimization.If we divide this objective function by λ, provided that λ > 0, we get an equivalent optimization problem for λ −1 f .Note that λ can be thought of as encoding 'collective' risk-preferences for all agents (e.g. a 'bull market' when λ is large, a 'bear market' when λ is small).As such we need a methodology for choosing λ that depends on the network size and/or number of agents.We make λ ∼ χ 2 (n) in order to capture the fact that as the number of participants increases, so should the expected number that are risk seeking.Once we do this, we can directly interpret the variables α i , β i as encoding both this risk preference and the inherent duration difference between lending risk and staking risk.The static nature of the covariance matrix in Assumption 11 implies that each agent has an 'equilibrium' risk-preference.Moreover, this implies that the distribution of risk-preferences amongst changes is not changing -which one can expect in 4 For staking, the relative yield is defined as future expected staked wealth divided by current stake wealth minus 1, which is This is the standard form of how yields are specified in traditional Markowitz portfolio theory [Markowitz 1952]. 5This is implemented in a manner analogous to how hedge funds only let you recall your invested capital in small chunks over a window of time the limit as the number of agents goes to infinity. 6Making this assumption allows for significantly faster simulation (e.g. less compute needed to reduce the variance of the estimator below an error threshold ε) To summarize, we evolve the system by having each agent update their Markowitz estimate at each time step, which changes the lending and staking distributions for the next time step.In simulation, agents will only be able to migrate their staking tokens at times kτ stake , k ∈ N. Explicitly, we evolve the system via the following loop: -Initialize distributions {π stake (0 -Observe empirical distributions πstake (t) i , πlend (t) i (generated via actual staking / lending rewards accrued in the epoch)

FORMAL PROPERTIES
We will describe a few formal properties (proved in the appendix) of the two-state model, as it is feasible to analytically analyze this model.Our goal in this section is to bound the amount of turnover in the stake distribution that is caused by on-chain lending becoming more attractive than staking rewards to rational stakers.A secondary goal is to understand what properties of the stochastic processes that represent the evolution of the lending and staking distributions are necessary and/or sufficient for ensuring that we do not have a lot of volatility in agent token portfolios.This is important as volatility in these portfolios implies that PoS networks have volatile security, which is a distinct defect when compared to PoW.We will make a few additional assumptions that are necessary to provide analytical results: Assumption 12 (Bounded Size).There is a minimum fraction δ > 0 of the money supply that needs to be staked, e.g. S t − t > δS t If no one is staking then the on-chain lending contract has no value (as it doesn't have any security), so this is a realistic assumption that matches the practical parameters chosen in live networks such as Tezos [Goodman 2014] and Cosmos [ Buchman 2019].Note that one can directly interpret δ as the fraction of altruistic validators who will never reallocate or rebalance their assets.
Assumption 13 (Number of Agents).The number of agents n is larger than a constant multiple of the product of the exponential parameters, e.g.n = Ω(τ stake τ lend ).
This assumption is required for purely technical reasons that are explained in the proofs in the appendix. 7If we solve the unconstrained problem8 for the Markowitz objective function, f (µ, Σ, w, λ) = w T Σw − λµ, then w needs to satisfy the first-order condition, ∇ w f (µ, Σ, w, λ) = 0.This yields, Given that we are in the multi-period Markowitz setting, this means that we can estimate the ith participant's portfolio weights via w i (t) = λΣ −1 i µ i (t).As a measure of volatility in the security of the underlying staking mechanism, we will first look at how w i (t) changes in time.Intuitively, this change corresponds to how large rebalancing events (e.g.moving tokens from staking to lending, or vice-versa) are between subsequent blocks.If this rebalancing is large, then the network could dramatically reduce it's security as holders move their assets from staking to lending.On the other hand, if this rebalancing is small and decreases over time, then we know that the staked token supply is stable.Using the Markowitz update rule (7), we have the following bound.
where A 1→1 = max v∈R n , v 1 =1 Av 1 is the L 1 operator norm.This simple inequality implies that the volatility in portfolio weights, represented by the single block difference in weights, is controlled by the difference in the mean vector, as Therefore, we focus on trying to bound the difference in expected returns as a function of the block reward at time t, R t , the total token supply S t , the lent supply t , and the Compound lending curve parameters β 0 , β 1 .Let π stake (t + 1) i − π stake (t) i = ∆ stake i (t) and t+1 − t = ∆ lend (t).Since the PoS algorithm is adapted to a filtration F t on S t ∆ n and the covariance matrices are constant as time evolves, 9 π stake (t), π lend (t) are also F t -adapted random variables.Note that by definition, ∆ stake i (t) ≤ S t and ∆ lend (t) ≤ S t , since we cannot change the amount staked or lent by more than the outstanding money supply.We will first bound the difference in expected returns as a function of ∆ stake i (t), ∆ lend (t), and S t : Note that these constants are allowed to depend on δ from Assumption 12.If we have an compounding and inflationary rewards schedule, e.g. S t = e λt , then this claim implies the following: Claim 2. If there exists λ > τ stake such that S t = Ω(e λt ) and min i W i (t) > 0, then as t → ∞, the maximum change in stake is bounded above by the lending volatility, ∆ 2 lend (t), w.h.p.This claim implies that if there is not much variance in the lending rate, either due to choosing small parameters β 0 , β 1 or because borrowing demand is minimal, then we should not expect portfolios to rebalance regularly and rational stakers will tend to keep their tokens locked in a staking contract.Another natural quantity to look at is the variance of the lent assets.We show that the money supply and time-preference for lending, τ lend , control the variance of lent assets.
Claim 3. Let F t be the filtration such that the lending process t is adapted.Then we have: Moreover, we have the following bounds: Note that if k is the constant representing the ratio of borrowing demand to S t (c.f.§3.2.1), there exists a constant 10 ℵ that depends on k such that γ t ≥ ℵ.As such, Claim 3 implies that as long as S t = Ω n 1 4 , we have reallocation from staking to lending.Thus, any monetary policy that grows sufficiently quickly with the number of users of the network will always have assets moving into 9 In particular, they are random at time t = 0 and defined in F 0 , but are constant throughout.This is a measure theoretic way of defining quenched disorder [Talagrand 2010] 10 Since U t = kSt t +kSt and Assumption 12 implies that t < (1 − δ)S t , we have U t > k k+1−δ and and out of lending.If we place constraints on the demand k, we can strengthen this result into a bound on how much ∆ 2 lend oscillates: √ n and α t = t τ lend S t η t If for all t, k ≥ α t 1−α t , where and the hypotheses of claim 2 hold, then ∆ 2 lend (t) is a submartingale and we have and subsequently, In words, this claim says that as long as we have inflation and there is enough borrowing demand, then we can be sure that the worst-case rebalancing is bounded by the variance of lending volatility.
If we add another constraint on the behavior of the increments ∆ 2 lend (t), then we can strengthen this claim to get a phase transition that resembles the Galton-Watson phase transition [Asmussen and Hering 1983].
The intuition for this is as follows: -When there is either too little or too much borrowing demand (e.g.γ t < r − or γ t > r + ), then the expected lent supply either increases (on average) to one or decreases to zero.This is analogous to a gambler's wealth after playing a game with probability p < 1/2 for n rounds -the wealth concentrates into either the house (staked supply) or the gambler (lent supply).-When there is a moderate amount of borrowing demand, γ t ∈ [r − , r + ], then we have stable, potentially oscillatory behavior.Doob's Supermartingale Convergence Theorem [Billingsley 2008] intimates that the distribution is stationary as t → ∞.This corresponds to a gambler playing a game in which their chance of winning is p > 1/2.
These results for the simpler two-level model suggest that our simulated phase transition results convey the existence of a deeper phase transition.
Agent-level Behavior.In order to get a stronger understanding of what is going on at the agent level and for different monetary policies, one needs an understanding of the probability that a single agent has a large rebalancing event that affects the staked portion of their portfolio.This involves studying how the staking components of µ i (t) changes over time.Let µ stake (t) i be the different in the staking component of µ i (t) between times t and t + 1.We can bound the probability that an agent rebalances their portfolio by an ε fraction via the following claim: Then for all t > 0, we have Bounds like (10) are of the form Pr[X t < ε] = Y t , which imply that the extrema of Y t provide a guaranteed bound of how large X t can be when Y t is minimized.This means that we can try to bound the first hitting time t * for the maxima of |µ stake (t) i | by analyzing the minima of the righthand side of (10).Note that the function 1 − (kx) n e −k kx has a minima at x = nk n−2 k , which means that we can estimate when, as a function of S t , γ t , ε, we have maximal deviations in stake.In the following section, we examine this claim for different monetary policies S t .

Deflationary Monetary Policy
In this case, R t = kr −t , r < 1 and , where C ∞ is the final money supply (e.g.21 million, for Bitcoin).Letting ε = δS t+1 and plugging this into the right hand side of (10) and optimizing for t using the chain rule gives the condition t * = − log C − nδ γ t τ stake τ lend .Requiring that t * > 0 gives the condition C − √ nδγ t τ stake τ lend ∈ (0, 1) or δ > (C ∞ − 1)γ t τ stake τ lend n The above condition implies that at the time with the highest expected amount of removed stake, we expect that quantity to at be on the order of C ∞ n .If there are fewer terminal coins than participants, C ∞ n, then we should expect large rebalances for every staker.This formalizes the intuition that totally deflationary currencies are vulnerable to large rebalances that depend strongly on the number of coins in the system.It also confirms the intuition that if there are fewer coins than participants, then borrowing demand will be high and we should again expect large rebalances.

Inflationary Monetary Policy
Next, we consider what Claim 6 implies about inflationary monetary policies.We will consider two types of inflationary policies: Polynomial (S t = Ω(t k )) and Exponential (S t = Ω(e λt )).
4.2.1.Polynomial Inflation.For polynomial inflation, we have R t = ct k−1 and S t = Ω(t k ).Optimizing (10) with this form of S t gives t * = nδ γ t τ stake τ lend 1/k .Plugging this into the right-hand side of (10) gives a lower bound of 1 − δ 2 n γ t τ stake τ lend e −τ stake τ lend δ 2 n/γ t which means that if δ = O(n −1/2 ), individual agents will not have rebalances of size δS t with high probability.These guarantees do not depend on the polynomial degree k, which means that even simple linear policies (k = 1) are sufficient to get low stake turnover.
4.2.2.Exponential Inflation.In the case of exponential inflation, S t = C 0 e λt for some λ > 0 and initial token distribution C 0 .Following the logic of the §4.1 section, we arrive at a conclusion of, δ > C 0 γ t τ stake τ lend n This states that the worst-case rebalancing is bounded by the initial token distribution as opposed to the final token distribution.Given that most networks assume that there will be more users than the initial distribution, C 0 , this implies that large rebalancing events should become rarer once the network achieves a scale of n C 0 .

Conclusions
The results of this section show that the model of §3.3 has a volatility that is mainly dependent on lending volatility.This volatility, if demand is sufficiently shallow, is small enough to help bound the worst-case portfolio rebalancing for any validator in the system.However, the turnover in staked quantity, measured by how each agent's expected reward changes over each epoch period, is sensitive to the precise nature of the monetary policy, S t .In particular, deflationary policies cannot support on-chain lending, as the worst-case rebalancing rate depends on the terminal money supply, whereas the rebalancing rate for exponentially inflationary monetary policies only depends on the initial money supply (e.g.Ethereum's pre-mine).Finally, we note that polynomial inflation provides particularly good rebalancing guarantees that are independent of the rate of growth of the money supply.Many of these results rely on asymptotic behavior of agents in this system and all of these results depend on simple models for borrowing demand.The remainder of the paper will focus on using simulation to provide a more realistic picture of §3.3.

AGENT-BASED SIMULATIONS
In order to test the three-state model in a quantitatively rigorous and realistic fashion, we turn to agent-based simulations.One of the main reasons to use agent-based simulation over formal methods is that it hard to formally prove what block reward growth rate is ideal for mitigating volatility in portfolio allocation.For instance, it is difficult to evaluate whether R t = Ω(t 2 ) or R t = Ω(t) provide ideal mitigation for on-chain lending with parameters β 0 , β 1 .Moreover, we can test various realistic demand distributions, including ones that are atomic and do not have a probability density.Prior work on agent-based simulations of blockchain systems [Chitra et al. 2019] has focused on analyzing consensus protocols via event-based simulation.We follow a similar event-based framework for simulating staking and lending, albeit ignoring the details of peer-to-peer networking and consensus.Our goal is to sample as many trajectories X t |F t = (π stake (t), π lend (t), γ t ) as possible for different combinations of parameters β 0 , β 1 , and block reward schedules R t .

Initialization
In order to generate sample paths X t , we need to specify the following variables: -Initial distributions: π stake (0), π lend (0) -Initial interest rate: γ 0 ∈ (0, 1) -Interest rate parameters: β 0 , β 1 ∈ (0, 1) -Demand-generating distribution parameters (vary depending on the demand generating distributions chosen): P ξ -Staking and lending time scale: τ stake , τ lend -Slashing probability: p slash -PRNG seed: s ∈ Z 2 64 We chose to model π stake (0) i ∼ Exp(λ stake ) and π lend (0) i ∼ Exp(λ lend ), as these distributions exemplify the extreme concentration of wealth that accompanies most token distributions.Exponential distributions are also useful in that the order statistics are also exponential11 , which represents the idea that the kth entrant to a network should have a decaying fraction (in this case 1 k ) of the total token supply.We note that we do not use power law distributions as there are conflicting reports of the wealth distribution in Bitcoin actually following a power law [Kondor et al. 2014;Alvarez-Ramirez et al. 2018].Given the statistical difficulty of discerning if one has a power law versus an exponential decay [Shalizi 2007;Stumpf and Porter 2012] and the extra parameter in a power law (e.g.p(x = t) ∝ x min t −a ), we decided to use exponential initial distributions.In our simulations, we kept the initial interest rate at 10%, as we saw very little sensitivity to the initial choice.In particular, agents quickly rebalance their portfolio into lending, if the rate is high enough and this appeared to equilibrate within a small number of time steps.We swept the other parameters, β 0 , β 1 , τ stake , τ lend , p slash , over realistic ranges and for each choice of parameter, we sampled trajectories for a variety of seeds s to get an ensemble average.Fig. 4: Borrowing demand sample paths, ξ t , juxtaposed with the money supply S t .The sample paths in the upper left (linear, R t = c), upper right (deflationary, R t = kr t , r < 1), and lower left (inflationary, R t = kr t , r > 1) use simple random walks, whereas the figure in the lower right samples a geometric Brownian motion path with reflecting boundary conditions at (1 − η 0 )S t , (1 + η 1 )S t .

Simulation Loop
The main simulation loop follows that as described at the end of §3.3.We exactly evaluate the Markowitz update rule, with constraints, via the exact solution for optimal portfolios [Boyd et al. 2017].Given that we are solving n independent, two-dimensional Markowitz problems, we evaluated the constraints analytically (as opposed to using a convex solver like Gurobi or CVX).The main event loop has the following causal ordering: (1) If t = kτ stake for some k ∈ N, allow agents to update their Markowitz portfolios 12(2) Sample the borrowing demand distribution (3) Update γ t as a function of the new borrowing demand (4) Run Algorithm 1 to determine who wins the reward R t and/or if they get slashed

Borrowing Demand Distributions
We sampled a variety of borrowing demand distributions for deflationary and inflationary block rewards, as illustrated via the sample paths in Figure 4.These stochastic borrowing demand paths each have four parameters: mean, variance, maximum, and minimum demand.We define the maximum and minimum demand parameters as multipliers of the token supply, so that the minimum is (1 − η 0 )S t and the maximum is (1 + η 1 )S t (illustrated via the lower and upper bounds in figure 4, respectively).

Results
In order to evaluate a variety of realistic conditions, we swept through many parameters illustrated above.The most interesting results come from looking at individual trajectories, such as Fig. 5: Heat maps of f (β 0 , β 1 ) = E t S t − t S t + t β 0 , β 1 for different deflation schedules at a half-life equal to 0.25% of the total simulation time (400 Bitcoin-style halvenings occur).Each pixel is the average of 100 random initializations with the other parameters fixed.On the left, we have a very high deflationary rate and we can see that the values are negative, implying that t > S t , whereas on the far right picture, which is non-deflationary, we see that S t > t 1, and heatmaps of how certain scalar functions behave as we vary the lending rate parameters β 0 , β 1 .We generated heatmaps for number of random seeds and took averages over these random instantiations to generate Figures 6 and 7.The two main measurements that we looked at were f (β 0 , β 1 ) = E t S t − t S t + t β 0 , β 1 , τ and g(β 0 , β 1 ) = E t [γ t − β t |β 0 , β 1 , τ], where given a nonanticipating stochastic process X t and a function stopped at time τ, E t [ f (X t )|τ] = τ 0 f (X t )dX t , for the stochastic measure dX t .We ran all trajectories for τ =250,000 blocks and approximate where ξ i is sampled from dX t+∆ − dX t .The first quantity, f (β 0 , β 1 ), is the normalized difference between the staked supply and the lent supply and when it is greater than zero, there is more quantity staked, on average.It is normalized relative to the total money supply S t + t so that ∀t, S t − t S t + t ∈ (0, 1) and thus we can compare the relative staking to lending proportions at different times.The second quantity, g(β 0 , β 1 ) measures the linear spread between borrowing and lending rates, which varies over time even though 1 − γ 0 = β t −γ t β t is constant.If the market for borrowing is efficient and there is less churn, we should expect that this rate should be quite low.Note that in all simulations used, we set the relative spread, 1 − γ 0 , to be 0.5%.In Figure 5, we see plots of f (β 0 , β 1 ) for different inflation rates r ∈ {0.25, 0.5, 1.0}.Note that when r = 1.0, then we have a linear polynomial inflation rate.This figure demonstrates that even though the dependence on β 0 , β 1 appears to be random, it is clear that the deflationary figures tend to have significantly more lending than staking.On the other hand, the linearly inflating component enjoys a significant advantage with regards to staked supply.Note that the dependence on β 0 , β 1 appears mostly random because of the use of a common scale to plot them.The usage of a common scale dampens the correct scale to plot the figures at (which should be on the order of Var( f (β 0 , β 1 )), which varies dramatically as a function of the other parameters that we sample, such as the block Fig. 6: Plots of g(β 0 , β 1 ) = E[γ t − β t |β 0 , β 1 ].As you go from left to right, we increase the inflation rate r (recall that when r < 1, we are deflationary) and as we go from top to bottom, the borrow threshold increased.Recall that the borrow threshold is the lower bound line from figure 4. We see that when the system has linearly increasing block rewards, we receive very tight spreads and a smooth, almost linear g(β 0 , β 1 ).On the other hand, as we have increasing deflationary policies, we see that we cause the expected spread to become more random and larger.reward.In some of the other plots that we will look at, we use independent color scales for each plot to emphasize the variation as a function of β 0 and β 1 .On the other hand, in figure 6, we see an array of plots that show how the borrowing spread, g(β 0 , β 1 changes as a function of inflation rate and borrowing threshold.The third column, which is the linearly increasing block rewards regime, demonstrates very tight spreads, suggesting that even changing the borrowing demand threshold causes little variation in spreads.On the other hand, the Fig. 7: Plots of f (β 0 , β 1 ) for differing inflation rates and borrowing thresholds.Note that the color bars vary for each figure.We see that when the policy is deflationary, f (β 0 , β 1 ) < 0.Moreover, when the borrowing threshold is high, we cause the plots to become less random and have a more clear dependence on β 0 , β 1 .deflationary regime is much more sensitive to shocks in borrowing demand, as illustrated by the plots in the upper left hand corner of figure 6.These empirical results validate Claims 2 and 3, as we directly see that lending volatility has a much more muted effect on inflationary systems.Finally, in figure 7, we see heatmaps of f (β 0 , β 1 ) for different borrowing thresholds and inflation rates.Note that these plots have different scales, unlike 5, and that the deflationary figures are all mainly negative.From the first two columns, it becomes clear that as borrowing demand increases, g(β 0 , β 1 ) becomes increasingly monotonically decreasing in β 0 , β 1 .This means that as borrowing demand increases, the system's loss of security to lending increases in a more predictable manner.
On the other hand, the linearly inflating regime does not have this issue and continues to have relatively random and non-monotonic dependence on β 0 , β 0 as we adjust the borrowing threshold.

CONCLUSIONS AND FUTURE WORK
This paper has explored how on-chain lending affects network security in PoS networks by studying how rational multiple period Markowitz optimizing agents optimize their token portfolios.In particular, we find that 'bank runs' can occur when many agents collectively move their tokens from staking contracts to lending contracts even when agents have indpendently drawn risk preferences.These attacks, which are coordinated only by rational optimization, show that the strictly Byzantine threat model is insufficient to describe security in PoS networks.Our theoretical and empirical findings show that deflationary PoS tokens are susceptible to attack by non-Byzantine, but rational participants who constantly turnover and rebalance their staking and lending portfolios to chase yield.Moreover, these findings show that one needs to choose a block reward schedule that increases relative to the yield that these on-chain contracts provide.Our theoretical results give explicit probabilities for the constant relative borrowing demand regime and show that there is a clear and strong dependence on the lending rate γ t in these probabilities.We buffet these results with agent-based simulations to confirm that these properties hold in more realistic borrowing scenarios.In the future, we aim to look at how unbonding times and transaction fees (e.g.gas costs) affect these protocols and how different lending curves will affect staking security.We also aim to provide more precise theoretical results by relaxing a number of the assumptions that are utilized in this paper.
In particular, since t < S t , we can use this bound at s = t S t to get This implies that Note that the condition S t − t > δS t also implies that t S t < 1 − δ, so that we can right this as: On the other hand, since S t > S t − t , we also have µ stake (t) i > π stake (t+1) i S t . Thus we have Let f (δ) be a constant such that which exists as per the last statement.Given these equation, we can now bound the single time step rebalance as follows: where the last step holds since α i is an exponential random variable with parameter τ stake .

E. PROOF OF CLAIM 3
Recall that β i was defined in equation 4 and is different than the lending rate β t .Note the following, which uses β i ∼ iid Exp(τ lend ): where ( 35) comes from splitting equation (34) into two terms by conditioning on A = α i W i (t) S t+1 − 1 < 0 and A c and throwing away the term dependent on A c and the third inequality (36) comes from W i (t) < S t+1 and majorizing the sum ∑ i β i W i (t).Note that (36) is the CDF for the product of an exponentially distributed random variable α and an Erlang distributed random variable, ∑ n i=1 β i .Let A ∼ Exp(τ stake ) and B ∼ Erlang(n, τ lend ).Then the product CDF 14 is: The integrand in (37) is maximized around the saddle point of the large deviation function Λ(x) = τ stake x − τ lend y x − (n − 1) log x.Let x * = arg max Λ(x).Using the first-order condition ∇Λ(x) = 0 and the quadratic formula, we get: x * = n − 1 2τ lend 1 + 4τ stake τ lend y (n − 1) 2 − 1 From Assumption 13, we know that 4τ stake τ lend < (n − 1) 2 , so x * ≈ 2τ stake y.Applying the method of steepest descent [Fedoryuk 1987] to (37) implies that there exists C > 0 such that ∞ 0 e −τ stake x−τ lend y x −(n−1) log x dx < Ce −Λ(x * ) so that we have: Combining ( 36) with (38) gives the result.