Skip to main content

Reward Sharing for Mixnets

Published onJun 13, 2022
Reward Sharing for Mixnets
·

Abstract

We present a reward sharing scheme for incentivized network privacy infrastructures such as the Nym mixnet. Given a bootstrapping reserve and a bandwidth pricing mechanism, our model enables a decentralized, economically sustainable mixnet that can scale, as increased usage translates into fees that allow the mixnet to grow to meet demand. Our scheme periodically selects mix nodes to mix packets proportionally to their reputation, which signals the confidence of stakeholders in the node’s reliability and performance. Selected mix nodes are then rewarded proportionally to their reputation and performance, and share their rewards with the stakeholders supporting them. We prove the properties of our scheme with a game-theoretic analysis, showing that the equilibria promote decentralization and mixnet performance. We further evaluate the scheme empirically via simulations that consider non-ideal conditions and show that the mixnet can be viable under realistic assumptions.

1. Introduction

The Nym network1 is currently deploying an incentivized mixnet to provide a generic message-based communication privacy infrastructure for applications [1]. This paper describes the economic model of the Nym network and the reward scheme used to incentivize mix nodes to reliably mix packets and effectively protect the metadata of users’ communications, including financial and other blockchain-enabled services but also applications such as instant messaging or email. To our knowledge, this is the first incentive system that fairly shares rewards the nodes in an anonymous overlay system like a mixnet for provisioning privacy for users.

The two key ingredients of privacy protection for communications’ metadata are: a large user base, because anonymity loves company [2]; and a technical design and implementation that leverages the user base and translates it into large anonymity sets [3] for all communications routed through the network. In terms of technical design the Nym mixnet is, like Tor [4], an overlay network where data packets from end users are routed via multiple intermediaries, each performing cryptographic transformations on the data before forwarding to the next hop, until the packet is sent to its final destination. The aggregation of packets from many users at each intermediary is crucial to assemble the large anonymity sets that provide effective privacy protection for all users [5][6]. Recent results add to the evidence that a key advantage of architectures that distinguish between ‘end user’ and ‘intermediary’ roles, compared to solutions where all participants are both simultaneously end users and intermediaries for others (e.g., like Dandelion [7] or Lightning Network [8]), is that in the latter, thin traffic per intermediary results in poor anonymity sets that do not leverage the scale of the network [9][10]. In contrast, in architectures where routing is the same for all traffic [11][4][1][12][13], users are aggregated in one anonymity set that scales with the user base. In addition, the Nym mixnet is designed to protect communication anonymity against global network adversaries with visibility over all internet communications, which is achieved by routing messages independently, introducing a randomized per-hop “mixing latency,” and adding cover traffic.

Adequately servicing a large user base requires computing resources to scale up operations and meet demand while reliably providing a high quality of service; as well as software usability, maintenance and ease of integration with a broad set of applications, which itself involves significant development effort. Furthermore, anonymity networks are decentralized solutions that need to be operated by non-colluding entities, meaning that a large number of independent node operators need to be signed up to run the network.

Tor2 has had a remarkable degree of success in engaging volunteers who contribute their own resources to operate the network as well as in obtaining public financing and donations to fund software development and community outreach. There are, however, limitations to volunteer-driven non-profit models. For example, the Tor network steadily grew to six thousand (6 000) nodes between its launch in 2004 and 2015, but its growth has stalled since and in the last seven years the number of nodes has remained between six and seven thousand,3 indicating that there is a limited pool of individuals and organizations willing and able to fund out of their own pocket such network operations [14]. A limited supply of well-meaning volunteer operators poses a problem not only for scalability, but also for security: Adversaries can populate the network by simply volunteering to run enough nodes, and thus compromise anonymity for many users (who need that some intermediaries are honest to achieve privacy). Dependency on public funding programs has also made the project resources for development vulnerable to changes in funding priorities.4

Nym has opted instead for an incentivized model where the operators of mix nodes are compensated for their resources and effort, and users can pay a fee for the obtained private bandwidth. The fee is determined via a dynamic posted-price mechanism that accounts for node costs and a rate of profit for the network. This enables a market for private bandwidth that allows the mixnet to arbitrarily scale to meet demand while covering operational costs. Participating as a mix node in an anonymous communication infrastructure involves costs in the form of computation (to perform cryptographic transformations on the traffic) and bandwidth (to relay the traffic). Without compensation for costs and labor, it is difficult to attract sufficiently many independent mix node operators who are appropriately resourced to deliver a high performing network that can arbitrarily scale up to meet demand.

The distribution of rewards to mix nodes further rewards good node performance and cost-effectiveness and motivates stakeholders to support nodes (culminating in a reputation score per node)—while penalizing under-performing nodes and nodes that for some reason fail to attract stakeholder support. By sampling mix nodes to be active in the mixnet based on their reputation, Nym makes it difficult for adversaries to populate the mixnet with malicious nodes. Adversaries not only need to run a set of mix node servers (just as they would for running Tor relays and populating the Tor network), but they also need to attract enough support from stakeholders (or acquire themselves vast amounts of NYM) for those nodes to have high reputation, and thus high chances of selection for routing packets in the mixnet—all while being in direct competition with other nodes for a finite amount of stakeholder support. A mix node that has poor performance or engages in malicious behavior is accountable to stakeholders, who may withdraw their support if they are not satisfied with the node operations, thereby diminishing the node’s opportunities for participation in providing the service and earning rewards for it. The system incentives are designed in such a way that stakeholders maximize their rewards when they support well-performing mix nodes that have high reputation, which in turn has the effect of populating the mixnet with nodes that are cost-effective and trusted by stakeholders to provide a reliable service to users.

Incentivized anonymity networks typically face a bootstrapping problem: both the privacy offered by the network and the capacity to fund its operations increase with the user base; while at the same time a usable and functional network needs to be already in place for the user base to be willing to pay for the privacy service. Nym addresses the problem of bootstrapping the mixnet with a reserve of funds called the “mixmining pool” that is initialized with a quarter of the total NYM token supply. The reserve slowly releases rewards over time, providing funds to sustain the network in the first years, until the mixnet has gained enough popularity for user fees to become the primary source of income.

Taking these two sources of income into account (user fees and rewards from the mixmining pool), we adopt reward-sharing concepts from cryptocurrencies [15] and apply them to the setting of provisioning privacy in order to distribute the available rewards among nodes participating in the Nym mixnet and the stakeholders supporting them. Our reward-sharing scheme is shown to possess equilibria that fairly and efficiently distribute the rewards in a manner that is Sybil resistant, thus creating the conditions for the community of stakeholders to recruit the nodes needed to provision privacy with high quality of service and at the scale of demand.

We complement the theoretical analysis with an empirical evaluation of the reward scheme in non-ideal conditions, which we conduct via simulations. We examine two hypothetical scenarios, one with low traffic and another with fast growing traffic that triggers network scaling, and study the rewards given to participants in both scenarios. We specify the assumptions and parameter values used in the evaluation and discuss the impact of different parameters on the results. The simulation results indicate that, under reasonable assumptions, our scheme can support an economically viable network, which can either serve rapidly scaling demand or initially grow slower. We note that the presented theoretical results cannot be interpreted as determining the amount of rewards that participants can expect in the real world, which may be higher or lower depending on the specific combination parameters of the scenario in question (e.g., rate of staking by stakeholders and overall distribution of node reputation). Rather, these empirical results serve to illustrate the functioning and dynamics of our scheme when the system is not in equilibrium as well as the effects of reputation on the viability of running mix nodes.

The paper is organized as follows: First, an overview of the relevant components of the Nym network is in Section 2. The incentives and reward-sharing scheme are described in Section 3, along with the equilibrium analysis. Section 4 introduces our simulation framework and Section 5 describes in detail the experimental setup we used to conduct experiments. Section 6 offers a number of simulations showing that the reward-sharing scheme leads to sustainable rates of return under various realistic conditions. We summarize relevant related work in Section 7 and conclude with a summary and directions for future work in Section 8.

2. System model

The Nym network [1] implements an anonymous communication service that relies on the NYM5 token to take usage fees and reward the operators provisioning privacy. The system model from the perspective of service functionality is shown in Figure 1. The core component of Nym is a mixnet (mix network) that provides multi-hop anonymous packet routing functionalities to end users. In addition, gateways act as interface between end users and the mixnet, while a set of validators maintain the Nyx blockchain,6 which broadcasts public Nym network parameters, executes the Nym smart contracts, and keeps the ledger of NYM transactions. Thus in addition to recording NYM transactions and ownership, validators of the Nyx blockchain serves a similar purpose as directory authorities in Tor. We describe in the rest of this section these different components from a service functionality perspective, as well as introduce the underlying economic model and the flows of NYM token between components.

Figure 1: Nym system model

2.1 The Nym mixnet

The Nym mixnet encodes data in a cryptographic packet format similar to Sphinx [16]. Packets are then routed through multiple mix nodes, each performing a decryption on the packets and reordering the flow of packets they route. The mixnet is composed of continuous-time mix nodes organized in a layered topology, such that messages traverse one mix per layer [11][1]. The number of nodes per layer, called the mixnet width (denoted by WW), is proportional to the throughput of the mixnet. Nym assigns an equal number WW of nodes to each of the LL mixnet layers, for a total of A=LWA=LW active nodes in the mixnet. When choosing a packet route, in each layer all WW mix nodes are selected with the same probability 1W\frac{1}{W}, i.e., there are WLW^L possible mixnet routes, each selected with probability WLW^{-L}. As result, the AA nodes that are simultaneously active in the mixnet perform an equal share of work routing packets. Note that this imposes minimum throughput requirements on mix nodes. Nodes with insufficient network or processing capacity may not be able to route their share of packets during peaks of traffic, resulting in poor node performance and diminished rewards. The growth in demand for mixnet bandwidth can be met by increasing the mixnet width WW, with the extra nodes linearly increasing overall mixnet throughput. In addition, the Nym network may increase (via software updates accepted by the majority of participants) the expected throughput of mix nodes, e.g., requiring additional bandwidth and processor cores per mix to handle more traffic.

The selection of A=LWA=LW nodes and their assignment to LL mixnet layers is refreshed periodically, at hourly epochs (hourly reconfiguration allows adjusting mixnet size to demand). Given a number NN of registered mix node candidates such that N>AN > A, and a periodic publicly verifiable random beacon [17], a smart contract can sample the set of A=LWA = LW nodes selected to be active in the mixnet for the next epoch. Nodes are selected proportionally to their reputation, defined as the aggregate amount of token pledged and delegated to the node (see Section 2.4.1 for the distinction between these operations), relative to the stake saturation point, which is a system-wide parameter; i.e., a node’s reputation takes values between zero and one, and the maximum reputation of one is reached when the token pledged and delegated to the node is equal (or superior) to the saturation point. High-reputation nodes have higher chances of selection for the mixnet than low-reputation nodes, as described in Section 3.2, and thus better opportunities for contributing to the service and earning rewards for their work.

Mixnet bandwidth demand may grow suddenly, requiring WW to be increased significantly from one epoch to the next. To incentivize the existence of additional mix nodes that can provide extra capacity on short notice, our scheme selects an additional set of BB nodes to be kept in reserve or standby for the epoch. These BB nodes are also rewarded, albeit at a lower rate, for a total of K=A+BK=A+B nodes being rewarded, while the NKN-K nodes that are not selected do not receive any rewards for that epoch. As shown in the next section, the reward scheme reaches equilibrium when there are N=KN=K mix node candidates with maximum reputation. In practice, we expect N>KN > K, meaning that there is an excess of mix node candidates, of which KK are sampled and rewarded per epoch.

2.2 Gateways

Gateways act as entry points to the mixnet, as first-layer mix nodes only accept traffic from gateways. To register with the Nym network, prospective gateway operators have to lock up a NYM token deposit and make their public keys available in a declaration added to the Nyx blockchain. A gateway declaration binds the deposit to its public key and allows all network participants to verify they are interacting with a legitimate gateway, preventing gateway impersonation.

Users acquire NYM in the open market and can deposit an amount of NYM to a smart contract in exchange for private bandwidth to be routed via the Nym mixnet. The amount of bandwidth (data) the users can buy for a certain amount of NYM (fee) is determined by a pricing mechanism as described in Section 3.3. When obtaining the bandwidth, users can tie it to a gateway of their choice (among all the registered gateways). Funding for gateways is allocated at this step as a fraction of the NYM fees deposited by the users for the bandwidth. The remaining fraction of NYM fees are held in the contract, to be distributed to mix nodes following our reward sharing scheme, introduced in Section 3.4. The user proves the payment to the chosen gateway and registers with it for the amount of purchased bandwidth. The bandwidth credential itself is a privacy-preserving anonymous credential [18] so the user does not reveal unnecessary information when using a gateway to access the mixnet [19].

In addition to forwarding packets from the user to the mixnet, the gateway keeps packets received for the user if needed, e.g., when the user device is offline, and it may bundle additional services (which may or may not be charged additionally), such as data storage or censorship circumvention functionalities. Gateways have incentives to attract and retain as many users as possible in order to receive more rewards, since they are purely rewarded based on work: a gateway that fails to attract users receives no rewards; while a popular gateway that attracts many users will receive substantial rewards. Users who run their own gateway get in practice a discount on their Nym network use (they are refunded the gateway share of the fee), at the cost of maintaining their own gateway server. In this paper we account for gateways when considering the income from fees, from which gateways take a cut, but otherwise leave out of scope an in-depth analysis of gateway incentives.

To prevent free riding from gateways, mix nodes locally keep count of the aggregate amount of traffic received from each registered gateway, which is compared to the paid bandwidth fees associated to the gateway in the smart contract managing the NYM bandwidth transactions. Mix nodes blacklist gateways that they detect engaging in free riding, i.e., that forward more traffic to the mixnet than the declared total that has been paid for. Once a gateway is blacklisted by a critical mass of mix nodes, its registration may be revoked and its deposit confiscated, to compensate for the costs caused by their free riding. Note that gateway registration deposits are not treated as staking: delegation is not possible and gateways are not rewarded proportionally to the deposited amount, which acts simply as locked collateral to disincentivize misbehaviour and compensate for any costs caused in case of abuse.

2.3 Validators

The validators are the nodes that maintain the Nyx blockchain, which records the ledger of NYM transactions and executes the smart contracts for distributing NYM rewards. The blockchain also acts as broadcast channel for the Nym network. It makes available to all participants the global network parameters, the publicly verifiable random beacon, the list of registered gateways and the public declarations of mix nodes, which include their public keys and contact information, necessary for users to prepare mixnet packets to send through the network.

Validators are funded by transaction fees that are necessary to interact with the Nyx blockchain. These fees are needed both to reward validators for their service and to protect the blockchain from spam. Transaction fees are paid by all Nym participants: end users converting token to bandwidth, mix nodes and gateways registering their node declarations, NYM stakeholders making token transfers, operator pledges or token delegation operations. The transaction fees are payable in NYM and in any other token that is accepted by the Nyx blockchain validators, who may also receive transaction fees from running smart contracts for others besides Nym. For the purposes of our analysis we factor transaction fees as part of the mix node operational costs, while leaving a detailed analysis of validator economics out of the scope of this paper, as the paper is focused on mixnet incentives.

2.4 NYM token flows

Nym distributes rewards in NYM token that act as financial incentive to operate the service. As already mentioned, gateways receive a percentage of the fees paid by their users in exchange for mixnet bandwidth, while validators are funded by transaction fees paid by anyone writing to the blockchain. Mix nodes are rewarded from user fees as well as from a mixmining reserve, as we explain below. In addition to enabling fees and rewards, the NYM token is instrumental to determining node reputation, which is proportional to the aggregate amount of NYM token pledged and delegated to a mix node. The node reputation is expressed as fraction relative to the stake saturation point, which defines the maximum desirable amount of token accumulated on a single node. A node’s reputation in turn determines its likelihood of selection for participation in the mixnet as well as the amount of rewards it receives for its work.

Figure 2: Token flows

Figure 2 depicts the main flows of NYM token between components. In a nutshell, the budget of rewards periodically available for distribution to mix nodes is the aggregation of income from two sources: (1) a mixmining pool reserve that periodically emits rewards; and (2) a fraction of the fees collected from network usage. Using our scheme, this budget of rewards is distributed among individual mix nodes, and further divided between each node’s operator and its stakeholders, who are rewarded proportionally to the amount of token they have delegated to the node. Per-node rewards are dependent on the node’s pledge, reputation and performance, and nodes may not realize their full reward potential if they under-perform or have low reputation, meaning that not all of the available reward budget is allocated. Any unclaimed rewards are returned to the mixmining pool for future distribution.

2.4.1 Stakeholders.

Any holder of NYM token is a stakeholder. NYM stakeholders can deposit their token in exchange for an allowance of mixnet bandwidth. These deposits constitute fees that fund the mix nodes and gateways routing that bandwidth. All NYM stakeholders also pay transaction fees to validators for publishing information in the blockchain.

Additionally, stakeholders can pledge NYM token to become mix node operators. Pledging involves locking an amount of NYM in a smart contract, together with the registration of the node’s public keys, address and parameters. This registers the node as a valid mix node candidate that can be chosen to route packets in the mixnet. It also enables all other stakeholders to delegate token to the node, to increase its reputation, participation in the mixnet and potential earnings. If the node performs adequately and rewards materialize, delegates receive a share of the node’s rewards.

The NYM token is thus required both by the end users (to pay for their private traffic as a utility token) and by the mix node operators that provision privacy to those users (as a reputation token needed for eligibility to be part of the network and thus receive rewards in exchange for work). All NYM stakeholders collectively determine node reputation by ‘voting’ with their token which node to support. This raises the cost of deploying Sybil attacks [20]: In order to get their nodes to be part of the Nym mixnet, adversaries need to either buy large amounts of NYM or somehow persuade enough NYM stakeholders to delegate their token to adversarial nodes.

2.4.2 Mixmining pool.

The mixmining pool is a token reserve used to bootstrap the network by providing rewards to mix nodes during the initial years of operation. The pool is implemented as a smart contract initialized with an amount of NYM token that is locked and slowly released as rewards. The emitted rewards function in practice as inflation, in the sense that they increase the circulating supply of NYM. Note however that there is a finite supply of NYM, and thus the supply increase is bounded.

Every monthly interval, a fraction of the pool funds are emitted as rewards; i.e., the emission follows an exponential decay function. The emitted rewards become available for distribution to the mix nodes that contributed to the mixnet in any of the epochs over the interval (considering 720720 hourly epochs per monthly interval). Note in any actual deployment the interval and epoch lengths may change. Some of the rewards available in an interval may remain unclaimed, e.g., due to poor performance or to low levels of node reputation. In such cases, those funds are returned to the pool and distributed in subsequent intervals. These bootstrapping reserve rewards are necessary as nodes need to cover operational costs even if the user traffic is initially insufficient to bring in enough fees to sustain the network. Once usage increases, fees can replace the pool as main source of income for the network.

3. Reward sharing scheme

This section describes our rewards mechanism and offers a theoretical analysis of its equilibrium properties. The reward sharing scheme aims to incentivize the set of NYM stakeholders to coalesce around a target number of well-performing, cost-effective operational mix nodes, relying on the “wisdom of the market" to assign reputation in terms of pledging and delegating NYM tokens to mix nodes.

We have two main objectives for our mechanism: (i) there exists an equilibrium where rational, utility-maximizing actions by the stakeholders lead them to propose and operate a sufficient number of well-functioning nodes that can be used to populate the mixnet; and (ii) a financial impediment should be imposed to any stakeholder who attempts to control multiple nodes at the same time as in a Sybil attack [20].

We design and analyze a mechanism for the above objectives under two fundamental assumptions: (i) there is a diverse distribution of stake across a fairly large set of stakeholders; in particular, the number of stakeholders exceeds the number of nodes required by the mixnet; and (ii) the rewards offered by the system in NYM token are sufficient to fund the operational costs of the mixnet; i.e., operators rewarded in NYM can use the token to offset their costs. We return to these assumptions validating them experimentally in Section 6.

The parameters and notations we use to describe the mechanism are the following:

  • LL, the number of layers in the mixnet.

  • WW, the width of the mixnet (i.e., number of mix nodes per layer).

  • A=LWA = LW, the number of active nodes in the mixnet.

  • BB, the total number of idling nodes that are kept ‘on reserve’.

  • K=A+BK = A + B, the total number of mix nodes that receive rewards for their contributions in a certain epoch.

  • NN, total number of mix node registrations.

  • RR, the total amount of rewards in NYM available for the mixnet in an epoch.

  • nn, the total number of stakeholders.

  • sis_i, the stake of the ii-th stakeholder expressed as a fraction of the total circulating supply.

  • MM, a random variable expressing the number of packets routed by the mixnet per epoch.

  • MiM_i, a random variable expressing the number of packets processed by the ii-th mix node per epoch.

  • Costi(x)Cost_i(x), the cost declared by the ii-th node to route xx packets.

  • μi\mu_i, the profit margin declared by node ii.

  • ρi\rho_i, the performance factor associated with node ii, defined as percentage of correctly routed packets, which we assume to be publicly available.

  • β\beta, the saturation level for nodes (set by default to 1K\frac{1}{K}).

We note that it is beyond the scope of the current exposition to detail how ρi\rho_i is estimated. One straightforward option is to delegate this task to dedicated entities trusted to correctly report measurements, e.g., a bandwidth scanner7 such as those used to measure performance in Tor [4]. More decentralized solutions are also possible; e.g., having a larger number of entities send measurement messages and issue verifiable statistical data “on-chain” that can then be averaged publicly to compute an estimated ρi\rho_i per node [1]. We leave the detailed specification of such a decentralized mechanism as the subject of follow-up work, while considering here that accurate ρi\rho_i are available for all nodes.

We divide the description of the mechanism in the following five subsections: Section 3.1 describes how stakeholders propose nodes and become operators; Section 3.2 explains how mix nodes are selected and assigned to the mixnet; the bandwidth pricing mechanism is explained in Section 3.3; the algorithm for distributing rewards among individual mix nodes and stakeholders is described in Section 3.4; and, finally, Section 3.5 provides the equilibrium analysis.

3.1 Registering a mix node

A prospective operator who wishes to run a mix node must pledge some of their NYM tokens as initial stake to register the node. These pledges will be specially treated by the reward function to ensure that operators are rewarded for having “skin in the game." Pledges can be arbitrary amounts of token as long as they exceed a minimum threshold, which helps prevent spam consisting of bogus registrations. As we will show later, there is a soft cap (saturation point) for the upper limit on how much to pledge to a node.

In more detail, operators who wish to run a mix node submit a declaration to the Nyx blockchain that includes their pledge, their cost function C(x)C(x) and a desired profit margin μ\mu to be applied on the node revenue. For mix nodes, CC maps the number xx of routed packets to the amount of NYM that the node operator spends to cover its costs. For some operators the cost function can be approximated by a constant value that represents monthly costs in a flat-rate setup with unlimited bandwidth allowance. Other operators may have more sophisticated cost functions C(x)C(x), e.g., where the price increases linearly per packet or “jumps" after a certain amount of bandwidth is used. Large stakeholders who posses stake exceeding the saturation point have the option of declaring multiple nodes that are operated by the same entity.

Once a mix node is registered, any stakeholder can delegate NYM to that node and support it by increasing its reputation (until the saturation point), which leads to increased selection probability and increased rewards, which are in turn shared with the node’s delegates.

3.2 Assignment of nodes to the Nym mixnet

At each epoch, KK mix nodes are elected to be rewarded, with KK being a parameter of the reward mechanism, and under the assumption that there are at least NKN \geq K candidate mix nodes registered in the system at any time. The KK selected nodes are divided in two groups, the first A=LWA=LW nodes to be sampled are assigned to be active mix nodes that route traffic in the mixnet, while the next B=KAB=K-A are selected for rewards but kept idling. The selection of active and idling nodes is performed by sampling without replacement [21], with each node weighted according to its reputation (a value between zero and one that represents the amount of NYM pledged and delegated to the node, relative to the stake saturation point β\beta). For sampling purposes, we use the following water-filling principle when nodes exceed the saturation level: any excess stake over the saturation level does not increase the sampling weight of a node, and is instead ‘added’ to the sampling weight of the following candidate nodes, allocated in order of decreasing reputation, always capping the sampling weight at saturation. The AA nodes active in an epoch are assigned to a position in the LLxWW mixnet uniformly at random (using a public random seed) with the restriction that nodes operated by the same entity are always placed in the same layer. This prevents adversaries with prior knowledge of the stake and registered nodes to strategically position compromised nodes in the mixnet. We remark that the parameter KK, as well as the mixnet parameter WW, are periodically adjusted (though in larger intervals consisting of multiple epochs) so that the available mixnet capacity exceeds in a suitable way the running average of demand in the last few epochs. Having an excess in capacity at any given moment is necessary to service peaks in demand that may invariably occur during mixnet operation.

The total amount of token staked (both pledged and delegated) to a node is a measure of the node’s reputation. We expect most nodes to be operated by stakeholders with limited resources to pledge, who obtain most of their stake from the support of delegates (who, by virtue of delegating their NYM, implicitly signal trust in the node to deliver rewards). On the other hand, operators with large resources to pledge have the strongest incentives to run well-performing nodes, as they have significant ‘skin in the game’ dependent on their node’s performance. Therefore, weighing by total stake the selection of mix nodes results in a mixnet mostly populated by nodes that have high reputation and strong incentives for offering a high quality of service. If a mix node has a large amount of delegated stake, this suggests that the community stands behind the reputation of the node, as the node regularly provides rewards to its delegates by being reliably online and keeping a good performance factor. As we will see in the next sections, this node selection process also optimizes the cost for users, favoring the selection of nodes that are not only reliable but also economically efficient. A mix node that declares a C(x)C(x) function that is too expensive will distribute lower rewards to delegates, since the lower C(x)C(x) is, the higher the remaining rewards available for the node’s delegates.

To summarize, in order to attract delegation, mix node candidates must offer attractive parameters, such as more competitive (lower) costs C(x)C(x) and profit margin μ\mu, which leaves more share of rewards for delegates. It is also possible though to introduce other attractive externalities, such as giving some proceeds to a good cause such as “sponsored access" to Nym for human rights activists, which may resonate with some delegates and appear as free usage of the Nym mixnet to these end users. Some nodes may also capitalize on reputation in other mediums (e.g., nodes run by a well-recognized organization or personality). As we show in the next sections, underperforming and inefficient nodes receive diminished or no rewards, incentivizing delegates to move away from backing them, and creating opportunities for new mix nodes to attract delegates.

3.3 Bandwidth pricing and budget balance

In this section we describe the mechanism that prices the mixnet bandwidth to its prospective users. The problem we want to solve is to price bandwidth in a way that is proportional to the mixing effort required to route user traffic, so that the whole system, at minimum, can deliver anonymous routing as a service, generating enough revenue to cover its expenses and allowing the operators to make some profit. The mechanism follows a “dynamic” posted price approach continuously adjusting the price as users place requests for bandwidth that are serialized by a smart contract. Each request is assigned an appropriate amount of bandwidth, claimed by the user in the form of a bandwidth credential.

As a warm up towards the full pricing mechanism, consider the abstraction of a single trusted node with pricing declaration C()C(\cdot) that handles by itself the total traffic requested to be routed. Suppose that the total demand in an epoch follows some probability distribution. We denote by MM the random variable drawn from that distribution. We define the price of the xx-th packet (unit of bandwidth) sold in an epoch as:

C(x)C(x1)+C(0)1E[M]C(x) - C(x-1) + C(0)\cdot \frac{1}{\mathbb{E}[M]}

Under the above pricing scheme, the expected revenue of the node is E[C(M)]\mathbb{E}[C(M)].

Proof. Summing across all units of bandwidth sold, it holds that the revenue is equal to:

MC(0)E[M]+x=1M(C(x)C(x1))=MC(0)E[M]+C(M)C(0)M \cdot \frac{C(0)}{\mathbb{E}[M]} + \sum_{x=1}^{M} (C(x) - C(x-1)) =M \cdot \frac{C(0)}{\mathbb{E}[M]} + C(M) - C(0)

By linearity of expectation, we conclude the correctness of the statement. ◻

Given the above one can use properties of the distribution of MM and to argue that the system generates sufficient revenue, i.e., that it is “budget balanced” as a mechanism with high probability. Of course, this only refers to the case of a single hypothetical node that wants to break even, while in our setting we have a large set of profit seeking nodes who do not necessarily agree on their pricing functions Ci()C_i(\cdot) and they are organized in a stratified mixnet of LL layers.

To address our more general setting, we proceed in two steps. First we consider a combined pricing function C()C^*(\cdot) that is synthesized in some way based on all the individual Ci()C_i(\cdot) functions contributed by the node registrations of those nodes that will populate the mixnet in an epoch. Second, we determine a price per packet function F(x)F(x) that takes into account the fact that the mixnet has LL layers (hence the work is multiplied by LL) while the load is uniformly distributed within each layer among WW nodes. The following defines the fee for the xx-th packet and is parameterized by L,W,ML, W, M a “surplus” parameter τ\tau and an “average cost” function C()C^*(\cdot).

F(x):=L(C(xW)C(xW1)+WC(0)1E[M])+τF(x) := L \cdot \Big( C^*(\lceil \frac{x}{W}\rceil) - C^*(\lceil \frac{x}{W} \rceil -1) + W \cdot C^*(0)\cdot \frac{1}{\mathbb{E}[M]} \Big) + \tau(1)

Note that τ\tau is the parameter of the system controlling the surplus that we wish the fees to produce. We next argue that there is a suitable choice of C()C^*(\cdot) that combines all operators’ individual functions and enables the system to be budget balanced and leave a surplus that is controlled by the parameter τ\tau. For simplicity, in the analysis we assume that MM is a multiple of WW (note that in any case MWM\gg W with overwhelming probability).

Theorem 1: Let Mix\mathsf{Mix} be the set of nodes selected for the mixnet and Idl\mathsf{Idl} the set of nodes selected to be idle. Consider the average cost function defined as follows:

C(x)=1LW(iMixCi(x)+iIdlCi(0))C^*(x) = \frac{1}{LW}\cdot \Big( \sum_{i\in \mathsf{Mix}}C_i(x) + \sum_{i\in \mathsf{Idl}} C_i(0) \Big)

The total fees collected cover the costs in expectation leaving a surplus of τE[M]\tau \cdot \mathbb{E}[M], assuming Ci()C_i(\cdot) are linear functions.

PROOF: We denote by MiM_{i} the packets routed by node ii. Without loss of generality we assume i=1,,LWi=1,\ldots,LW are selected to participate in the mixnet, while nodes Ki>LW+1K\geq i>LW+1 are on reserve.

It holds that E[Mi]=E[M]/W\mathbb{E}[M_{i}]=\mathbb{E}[M]/W for iLWi\leq LW and Mi=0M_i=0 otherwise. Given this, the expected costs are equal to:

E[i=1LWCi(Mi)+i=LW+1KC(0)]=i=1LWCi(E[M]/W)+i=LW+1KCi(0)\mathbb{E}[ \sum^{LW}_{i=1} C_i(M_i) + \sum^K_{i=LW+1} C(0) ] = \sum^{LW}_{i=1} C_i(\mathbb{E}[M]/W) + \sum^K_{i=LW+1} C_i(0)

by applying linearity of expectation.

We next compare this to the proceeds from selling the private bandwidth. Let =M/W\ell = M/W.

x=1MF(x)=LW(C()C(0))+LW2C(0)1E[M]+Mτ\sum^M_{x=1} F(x) = L \cdot W \cdot (C^*(\ell) - C^*(0) ) + L \cdot \ell \cdot W^2 \cdot C^*(0) \cdot \frac{1}{\mathbb{E}[M]} + M \cdot \tau

It follows that the expectation of the above expression is equal to LWE[C(M/W)]+τE[M]L\cdot W \cdot \mathbb{E}[ C^*(M/W) ] + \tau \cdot \mathbb{E}[M]. Observe now the following based on linearity of expectation:

LWE[C(M/W)]=i=1LWCi(E[M]/W)+i=LW+1KCi(0)L\cdot W\cdot \mathbb{E}[C^*(M/W)] = \sum^{LW}_{i=1}C_i(\mathbb{E}[M]/W) + \sum^K_{i=LW+1} C_i(0)

Based on this we conclude the proof. ◻

Remark 1: In light of Theorem 1, in the remaining of the section we will use the assumption that the Ci(x)C_i(x) functions are linear in xx.

Remark 2: The parameter τ0\tau\geq 0 which controls the surplus is set to some system-wide value which can be updated over time to ensure that there are sufficient funds for participants to cover costs and engage in meaningful delegation. See Section 5.3 for further discussion.

Remark 3: The above dynamic posted-price mechanism does not attempt to perform price discovery. Auction mechanisms are also possible, e.g., running a multi-unit auction such as Vickrey, or uniform price [22]. Such mechanisms come with the downside that users will have to engage in more complex bidding processes and wait for the auction to complete in order to obtain their bandwidth allowance (this is in contrast to the posted-price mechanism described above, which processes bandwidth requests as they come).

Remark 4: It is worth noting that the Ci()C_i(\cdot) functions are denominated in NYM, nevertheless they reflect real world costs which may be best denominated in fiat currencies (e.g., USD). To accommodate volatility in the exchange rate of NYM, it should be possible for operators to adjust their cost function periodically or, perhaps preferably, incorporate an on-chain oracle that provides the exchange rate and facilitates the cost adjustment automatically.

3.4 Reward allocation mechanism

We denote by RR the share of rewards that are available for distribution to the mixnet in an epoch. We recall that RR is composed of rewards emitted from the mixmining pool and of (a fraction of) the income from fees. The reward allocation mechanism determines the fraction of RR given to each individual mix node, and its subsequent division among the stakeholders (operators and delegates) supporting the node with their NYM token. Recall that one important objective of the mechanism is to compensate the nodes that populate the mixnet for their operational costs. When the ii-th node transmits MiM_i packets in an epoch, Ci(Mi)C_i(M_i) will be refunded to the operator, while the operator of an idling node ii is still refunded an amount equal to Ci(0)C_i(0). The rewards (aggregation of cost refunds plus applicable profits) are transferred automatically to the operators’ accounts and to stakeholder accounts (as the operator should not have to be trusted to forward funds to its delegates). In addition to the above, the mechanism is capped so that no node receives more than βR\beta \cdot R of the rewards, where β\beta is the saturation level parameter.

With foresight, the goal of the mechanism is to incentivize an equilibrium with the following ideal properties:

  • There are at all times N=KN=K operational nodes, all of which have an equal amount of reputation (delegated stake plus pledge), where KK is a public parameter.

  • Delegates who select properly operating nodes receive the same rewards (in expectation) per delegated NYM token.

  • More competitive nodes (e.g., those with lower costs and/or higher pledges) are able to translate their competitiveness to higher profit by claiming a larger profit margin.

  • Operators who attempt to register multiple nodes either publicly or covertly (in what amounts to a Sybil attack [20]) have to pledge sufficient stake per node to maintain their competitiveness against other nodes. This effect is controlled by a parameter of the scheme denoted by α\alpha; the higher the α\alpha parameter, the larger the loss of competitiveness experienced by the Sybil attacker when partitioning stake into multiple pledges.

To achieve the above, the mechanism constrains node rewards in a certain manner, taking into account the stake pledged and delegated to the node. The constraint creates a “soft-cap” on how much stake it is rational to pledge or delegate to a node, nudging stakeholders to an equitable organization behind the target number KK of mix nodes and preventing centralization of stake (where just a handful of nodes emerges that are insufficient to populate a mixnet of the desired dimensions) as well as fragmentation (where too many weak nodes are proposed and quality of service is severely degraded).

The mechanism is a generalization of the mechanism of Cardano stakepools [15] to a ‘proof of work’ setting where different amounts of ‘work’ might be performed by the mix nodes in each epoch and cost functions are functions of system load per unit of time, as opposed to constant. A node’s work relates to the amount of mixnet packets it routes, and recall that the ii-th node routes MiM_i packets incurring a cost Ci(Mi)C_i(M_i); in contrast, in the modeling of Cardano the costs are independent of actual work invested [15]. Furthermore, given a total amount of traffic routed by the entire mixnet in an epoch, the share of work performed by each node depends on whether it has been selected to be active in the mixnet, selected to be in reserve and is idling, or not selected at all in that epoch. As described earlier, the parameter KK sets the number of nodes that the stakeholders are incentivized to create. The exact choice of KK and of the number of active nodes AA and in reserve BB, K=A+BK=A+B, depends on the expected demand as estimated by the system. For example, if we want a throughput of 1212 Gbps in a mixnet with three layers, with each node offering 100100 Mbps, we can choose K=720K=720, which accommodates A=360A=360 operational nodes in a 33x120120 mixnet and B=360B=360 idling nodes on reserve. Having B=360B=360 allows the mixnet to double its capacity for the next epoch if demand increases. In any real world deployment, the number of active nodes and reserve will be different and could be based on projected demand and the ability to handle ‘bursty’ spikes of usage.

A parameter ωi\omega_i is defined to specify the share of total network ‘work’ undertaken by the ii-th node, such that i=1Kωi=1\sum^K_{i=1}\omega_i = 1. In a mixnet with equal number WW of nodes and uniform routing through LL layers, ωi\omega_i is the same for all A=LWA=LW active nodes. The B=KAB=K-A reserve nodes do not route user traffic in the epoch, but they need to spend resources being online, as their uptime and quality of service is tested throughout the epoch to help determine their performance over time. We establish that the work performed by an active mix is a 1010x factor larger that the work of being in reserve (any other factor than 1010x may be used if desired — see Section 6 for experimental validation of our choice). For the AA active nodes we compute ωi\omega_i as:

ωi=1010A+B1iA\omega_i = \frac{10}{10A+B} \hspace{0.5cm} 1 \leq i \leq A(2)

For each of the BB reserve nodes, the work ωi\omega_i is computed as:

ωi=110A+BA+1iA+B\omega_i = \frac{1}{10A+B} \hspace{0.5cm} A+1 \leq i \leq A+B(3)

The performance factor ρi\rho_i represents the estimated fraction of packets correctly routed by each node, with ρi=1\rho_i = 1 indicating that the node followed the routing protocol for all the packets it received. ρi\rho_i decreases when the node is down due to a failure, congested due to low throughput and thus dropping some packets, or dropping packets for a malicious purpose. ρi\rho_i can be estimated by sampling via special-purpose measurement authorities, as is the case in Tor [4] or via a decentralized protocol as sketched in Nym [1]. The specific method to establish node performance is out of the scope of this paper, where we assume that ρi\rho_i is available on chain. The performance factor affects nodes’ rewards proportionally. When a node frequently has a performance ρi<1\rho_i<1, delegates are incentivized to move their delegated stake to nodes with better performance in order to maximize their rewards.

Given the above, we now define the reward scheme.

1. The amount of rewards apportioned for the ii-th node and its delegates is equal to

Ri=Rρiσiβ(ωi+αλi)11+α,%\label{eq:noderewardshare} R_i = R \cdot \rho_i \cdot \frac{\sigma_i'}{\beta} \cdot (\omega_i + \alpha \cdot \lambda_i') \cdot \frac{1}{1+\alpha},(4)

where λi\lambda_i is the stake that the operator of the ii-th node has pledged to their node as a fraction of circulating supply, σi\sigma_i is the total stake pledged and delegated also as a fraction of the total circulating supply, and λi=min{λi,β}\lambda_i' = \min \{\lambda_i, \beta \} and σi=min{σi,β}\sigma_i' = \min \{ \sigma_i, \beta \} are capped versions of λi\lambda_i and σi\sigma_i. We observe the following budget balance property holds:

i=1KRiR.\sum^K_{i=1} R_i \leq R.

This follows immediately as i=1Kωi=1\sum^K_{i=1} \omega_i =1, i=1Kλi1\sum^K_{i=1} \lambda_i' \leq 1 and σiK1\sigma_i' \cdot K \leq 1 for i=1,,Ki=1,\ldots,K.

Note that the above is necessary to ensure there are no incentives to delegate more than β\beta of the circulating supply to any one node and thus stakeholders are incentivized to create KK distinct nodes; see the next section where we delve deeper into the equilibrium analysis.

2. Given RiR_i rewards assigned to the ii-th node, its operator is credited with the following amount:

min{C(Mi),Ri}+[(μi+(1μi)λiσi)(RiC(Mi))]+,%\label{eq:rewardsoperator} \min\{C(M_i),R_i\} + [(\mu_i + (1-\mu_i) \cdot \frac{\lambda_i}{\sigma_i} ) \cdot (R_i - C(M_i)) ]^+,(5)

where []+=max{0,}[\cdot]^+ = \max\{0, \cdot\}, and μi\mu_i is the declared profit margin of the ii-th operator.

A node delegate with delegated stake ss, receives:

[(1μi)sσi(RiC(Mi))]+%\label{eq:rewardsdelegate} [ (1-\mu_i) \cdot \frac{s}{\sigma_i} \cdot (R_i - C(M_i)) ]^+(6)

3. The above allocation process may result in leftover funds. Observe that in typical conditions where λi<1\sum \lambda_i <1, a certain portion of rewards remain unclaimed and are returned to the reserve. Nodes fail to realize their full reward potential when they are less than “saturated” (i.e., they are supported by a fraction of stake σi\sigma_i that is less than β\beta of the available NYM supply) or if their performance ρi\rho_i is below par. The unallocated funds are returned to the reserve, to be distributed in the future. The fact that the mixmining reserve is long lived also helps stabilize rewards in the event of temporary drops of demand (and consequently drops in income from fees), as nodes can remain operational, covering running costs with mixmining pool rewards.

Remark 5: Even though we describe the above mechanism in a “per epoch” fashion, in a real world deployment it is also possible to aggregate rewards for a number of epochs, (e.g., epochs last an hour but rewards are computed in monthly reward intervals, i.e., every 720720 epochs). In such case, one can average values across longer intervals for the node performance ρi\rho_i.

3.5 Equilibrium analysis

3.5.1 Family of admissible strategies.

We focus our analysis on scenarios where each stakeholder strategically decides to either set up a node or delegate its stake to one or more node operators. More complex strategies can be expressed as coalitions of parties in this mutually exclusive scenario. We assume that the utility of the stakeholders is not affected by any external factors and that the rewards available are always sufficient for at least KK stakeholders to become operators. Moreover, delegation incurs no cost, thus all players are either delegators or operators (we revisit this assumption in Remark 7).

The expected potential profit associated with the node operated by the ii-th stakeholder is equal to:

πi=E[R(ωi+αsi)11+αCi(Mi)]\pi_i = \mathbb{E}[R \cdot (\omega_i + \alpha \cdot s_i)\cdot \frac{1}{1+\alpha} -C_i(M_i)](7)

Note that the above expression sets σi\sigma_i to be β=1K\beta=\frac{1}{K} (we call such a node “saturated”) and, by slightly abusing notation, considers ωi\omega_i to be the random variable corresponding to the node’s work ratio at a point of “full saturation,” i.e., when KK nodes have reached stake β\beta. Also recall that MiM_i is the random variable corresponding to the traffic routed by the node. To simplify the analysis we make the following assumption about the players’ parameters: the stake of all stakeholders satisfies siβs_i\leq \beta; for larger players (a.k.a. “whales”) whose stake exceeds the bound, one can think of them as being a coalition of a number of smaller players each one with stake obeying the bound.

To reason about the strategic options of delegation, we define desirability of a node as a quantity equal to (1μi)πi(1-\mu_i)\cdot \pi_i where μi\mu_i is the profit margin declared by the operator. It expresses the portion of the node’s potential profit that the operator distributes to the delegates. In our family of admissible strategies, delegators always delegate to the operators that run nodes with the highest desirability; in other words, a strategy is admissible if all delegated stake is assigned to the most desirable operator; if two or more operators have equal desirability, then delegates are indifferent in their choice between them, unless one of them is saturated while the other is not, in which case the unsaturated node would be preferred. This stems from the fact that once a node is saturated the rewards stop increasing. Finally, in an admissible strategy, any stakeholder who can be competitive as an operator (in terms of being able to select a profit margin that makes her competitive compared to other stakeholders) runs a node (i.e., we assume that all stakeholders are capable of running nodes) and we have always at least KK nodes proposed by stakeholders.

3.5.2 Family of perfect strategies.

We next introduce a set of strategies, called “perfect” strategies that we demonstrate are a Nash equilibrium. We assume without loss of generality that players are sorted in a descending order according to expected potential profit. In a perfect strategy, the ii-th player operates a node only in case its potential profit is competitive against the (K+1)(K+1)-th stakeholder. The profit margin selected by the player in this case is set to be equal to 1πK+1πi1- \frac{\pi_{K+1}}{\pi_{i}}. In case of ties for the KK-th position, multiple perfect strategies exist. We observe that in a perfect strategy the node operator iKi\leq K, derives expected utility equal to:

(μi+(1μi)siβ)πi=(πiπK+1)+πK+1siβ(\mu_i + (1-\mu_i) \cdot \frac{s_i}{\beta} ) \pi_i = (\pi_i-\pi_{K+1}) + \pi_{K+1} \cdot \frac{s_i}{\beta}

while delegators investing stake ss receive πK+1sβ\pi_{K+1} \cdot \frac{s}{\beta}. In other words, node operators receive πiπK+1\pi_i-\pi_{K+1} in its entirety and subsequently all involved stakeholders in the node, share according to their contributed stake a portion of πK+1\pi_{K+1}. Observe also that in a perfect strategy the desirability of the first KK stakeholders who become operators is exactly πK+1\pi_{K+1}.

The main characteristics of perfect strategies are as follows:

  • All stake is either pledged or delegated.

  • There are KK nodes with exactly β=1K\beta = \frac{1}{K} stake staked to them (including pledge and delegation).

  • If α=0\alpha=0, for any two players, the one with the lower cost for the work allocated will be necessarily running a node, assuming the other one does. For higher values of α\alpha, players backing their nodes with higher pledges gradually become more competitive as α\alpha increases.

  • Assuming no sub-par performance anywhere in the system, all delegators receive the same rewards equal to πK+1sβ\pi_{K+1} \cdot \frac{s}{\beta}, where ss is their stake relative to the total supply, independently of their choice, where πK+1\pi_{K+1} is the potential profit of the (K+1)(K+1)-th operator.

  • The jj-th operator receives an additional reward of πjπK+1\pi_j-\pi_{K+1} (on top of its rewards as a delegator to its own node). This is the benefit it receives for being competitive.

Theorum 2: Every perfect strategy is an equilibrium.

PROOF: Since we are on a perfect strategy, N=KN=K, the delegated stake on the node jKj\leq K is β=1/K\beta = 1/K, the margin μj=1πK+1πj\mu_j = 1- \frac{\pi_{K+1}}{\pi_{j}} and the desirability of the KK operators is the same and equal to πK+1\pi_{K+1}. To prove the theorem, we consider the following cases.

Case I. The stakeholder jj is an operator who decreases its margin μj\mu_j to a smaller value μj\mu_j^*. The desirability of the operator remains among the best KK and given we are in an admissible strategy the only question is whether the delegated stake makes a difference due to influx of delegates from all the other operators (since we are moving to another admissible strategy where the jj-th operator is the most desirable). Note that due to the cap of the reward scheme, the rewards awarded to the jj-th operator in total remain the same, however the operator, by decreasing its margin, makes the jj-th node more desirable to delegates. The utility of the operator becomes (μj+(1μj)(sj/β))(Rjcj)( \mu_j^* + (1-\mu_j^*)( s_j/\beta) ) (R^*_j - c^*_j), where cjc^*_j is the expected cost after the switch, while the node rewards are equal to Rj=R(ωj+αsj)/(1+α)=πj+cjR_j^* =R \cdot ( \omega^*_j + \alpha \cdot s_j ) / (1+\alpha) = \pi_j + c_j, where ωj\omega_j^* is the expected weight of the operator after the margin adjustment and cjc_j the expected cost prior to it; the equality between the two expressions stems from the fact E[ωj]=ωj\mathbb{E}[\omega_j] = \omega_j^*, which is implied by the fact that the probability of selecting jj as an active mixnet node does not change due to the water-filling sampling approach when a node’s stake exceeds the saturation level. It follows that the utility of the node is equal to the following expression.

(μj+(1μj)(sj/β))(πj+cjcj)( \mu_j^* + (1-\mu_j^*)( s_j/\beta) ) (\pi_j + c_j - c^*_j)

Now observe that it holds cjcjc^*_j\geq c_j, since the operator’s profile and work allocated is maintained; based on this, it follows the utility of the jj-th operator cannot increase.

Case II. The stakeholder jj is an operator who increases its margin μj\mu_j. This drops its desirability below πk+1\pi_{k+1} and thus the operator runs a node without any delegated stake. This is due to the fact that other stakeholders following the admissible strategy choose to delegate to the original K1K-1 operators while the (K+1)(K+1)-th stakeholder now runs a node as well (by choosing a profit margin of 00 she is as competitive as the K1K-1 original operators who are fully saturated). Running a node without delegates for the jj-th stakeholder results in utility R(sj/β)(ωj+αsj)/(1+α)cjR \cdot (s_j / \beta) \cdot (\omega_j^* +\alpha s_j)/(1+\alpha) - c^*_j where cjc^*_j is the operational cost in this circumstance and ωj\omega_j^* the expected weight of the node after increasing the margin. Given that ωjωj\omega^*_j \leq \omega_j in expectation, this expression is less or equal to (sj/β)(πj+cj)cj=(sj/β)πj+(sj/β)cjcj(s_j / \beta) \cdot (\pi_j + c_j) - c^*_j = (s_j / \beta) \cdot \pi_j + (s_j / \beta) \cdot c_j -c^*_j, where cj=E[Cj(Mj)]c_j = \mathbb{E}[C_j(M_j)]. Recall the utility of the operator prior to the margin increase is πjπk+1+(sj/β)πk+1\pi_j - \pi_{k+1} + (s_j/\beta)\cdot \pi_{k+1}. Subtracting this from the utility after the profit margin increase, we obtain

(1sj/β)(πk+1πj)+(sj/β)cjcj0(1- s_j/\beta) \cdot (\pi_{k+1} - \pi_j) + (s_j/\beta) \cdot c_j - c^*_j \leq 0

which follows from the facts (i) πk+1πj\pi_{k+1}\leq \pi_j, i.e., the jj-th operator was competitive prior to the increase, and (ii) (sj/β)cjcj0(s_j / \beta) \cdot c_j -c^*_j\leq 0 which we argue next.

Let pjp_j be the probability that the jj-th operator is selected. The expected cost is (1pj)Cj(0)+pjCj(E[M]/W)(1-p_j) \cdot C_j(0) + p_j C_j(\mathbb{E}[M]/W) due to the linearity of Cj()C_j(\cdot). In the case of cjc_j, it holds that pj=1p_j=1 as there are exactly KK nodes with non-zero weight and hence cj=Cj(E[M]/W)c_j = C_j(\mathbb{E}[M]/W). In the case of cjc^*_j, where the jj-th node is running “solo”, we have a configuration where the jj-th node is by itself, K1K-1 nodes have total stake 1/K1/K and a single node has 1/Ksj1/K-s_j. It holds that

pj=11KsjK(1+t=1K1i=t+1K(1KsjKi+1+Ksj)).p_j = 1 - \frac{1-Ks_j}{K} \cdot \Big( 1+ \sum^{K-1}_{t=1} \prod^K_{i=t+1} (1 - \frac{K\cdot s_j}{K-i+1+Ks_j}) \Big).

It is easy to observe that pjKsj=sj/βp_j\geq K s_j = s_j/\beta. Putting everything together we have that cj=(1pj)Cj(0)+pjcjc^*_j = (1-p_j)C_j(0) + p_j c_j and as a result (sj/β)cjcj=(sj/βpj)cj(1pj)Cj(0)0(s_j/\beta) \cdot c_j - c^*_j = (s_j/\beta - p_j) c_j - (1-p_j) C_j(0) \leq 0.

Case III. The stakeholder jj stops being an operator and becomes a delegator. In this case its utility equals to πk+1(sj/β)\pi_{k+1} \cdot (s_j /\beta) which is no better than the operator utility that includes the additional additive term πjπk+1\pi_j-\pi_{k+1}.

Case IV. Consider now a stakeholder jj that is a delegator. By definition of the profit margins in the perfect strategy the delegator has to choose profit margin zero. It follows easily that the utility of the player cannot increase in this case.

The above four cases cover all possible deviations within our family of admissible strategies and hence the theorem’s statement follows. ◻

Next we consider the truthfulness of the mechanism, i.e., whether, in a perfect strategy, it makes sense for players to deviate from declaring their true cost. In a nutshell, the following theorem establishes that in a perfect strategy it does not make sense to deviate from being truthful.

Theorum 3: In a perfect strategy, untruthful cost declarations are not advantageous.

PROOF: Consider the jj-th operator making a cost declaration Cj^\hat{C_j} that is different from its true cost CjC_j. In this case, the expected potential profit of the operator would be calculated with the declared cost, as π^j=E[R(ωj+αsj)/(1+α)Cj^(Mj)]\hat{\pi}_j = \mathbb{E} [R(\omega_j + \alpha s_j)/(1+\alpha)- \hat{C_j}(M_j) ]. We consider two cases depending on the relation of π^j\hat{\pi}_j and πK+1\pi_{K+1}.

Case π^j<πK+1\hat{\pi}_j<\pi_{K+1}. In this case, the jj-th operator declaration makes the operator non-competitive and thus it will not be selected by other delegators who follow the perfect strategy. It follows that the expected utility of the operator in this case is derived by its own stake and is equal to

E[Rsj/β(ω^j+αsj)/(1+α)]cj(π^j+c^j)(sj/β)cj\mathbb{E} [R \cdot s_j/\beta \cdot ( \hat{\omega}_j + \alpha s_j)/(1+\alpha)] - c_j \leq (\hat{\pi}_j + \hat{c}_j) \cdot (s_j/\beta) - c_j

where cj=E[Cj(Mj)]c_j= \mathbb{E}[C_j(M_j)], c^j=E[Cj^(Mj)]\hat c_j= \mathbb{E}[\hat{C_j}(M_j)], and ω^j\hat{\omega}_j is the modified expected weight for the jj-th node due to the potential change in its total stake, for which we have ω^jE[ωj]\hat\omega_j\leq \mathbb{E}[\omega_j].

Now recall that πj=E[R(ωj+αj)/(1+α)]cj\pi_j = \mathbb{E}[R (\omega_j + \alpha_j)/(1+\alpha)] - c_j and as a result πj+cj=π^j+c^j\pi_j + c_j = \hat{\pi}_j + \hat{c}_j. From this we derive that the expected utility is less or equal to (πj+cj)(sj/β)cjπj(sj/β)πjπK+1+(sj/β)πK+1(\pi_j + c_j)\cdot (s_j/\beta) - c_j \leq \pi_j \cdot (s_j/\beta) \leq \pi_j - \pi_{K+1} + (s_j/\beta) \cdot \pi_{K+1}, which follows from the fact that πjπK+1\pi_j\geq \pi_{K+1}. It follows that the utility is no better than the case of a truthful declaration.

Case π^jπK+1\hat{\pi}_j\geq \pi_{K+1}. In this case, the jj-th operator retains its competitiveness. Recall that its expected utility as a truthful operator is equal to πjπK+1+πK+1(sj/β)\pi_j - \pi_{K+1} + \pi_{K+1} (s_j/\beta), while the actual expected utility of the operator now would be equal to (π^jπK+1)+πK+1(sj/β)cj+c^j(\hat{\pi}_j - \pi_{K+1}) + \pi_{K+1}(s_j/\beta) - c_j +\hat c_j. It is easy to see that the difference between the two is πjcj(π^jc^j)=0\pi_j - c_j - (\hat{\pi}_j - \hat{c}_j) = 0, and hence there is no advantage in this case either (to understand the intuitive reason why, consider that in a perfect strategy, the jj-th operator will have to either use (i) a higher margin, when the cost declaration is lower than the true one to cover the costs, or (ii) use a lower margin, when the cost declaration is higher than the true one to remain competitive; in either case, the benefit of lying about the cost is negated by the adjustment in the margin). ◻

Finally, we discuss the Sybil resilience offered by the mechanism. Specifically we ask how many nodes a large stakeholder, say holding stake χ\chi, can control at the perfect strategy equilibrium. In this case, the stakeholder splits her stake into χ1,,χt\chi_1,\ldots,\chi_t portions and operates as tt individual stakeholders who create nodes by declaring costs that for the assigned work have expectations equal to c~1,,c~t\tilde c_1,\ldots,\tilde c_t, splitting the total cost of the Sybil player c~=j=1tc~j\tilde c = \sum^t_{j=1} \tilde c_j. Suppose that all tt nodes are included in the perfect strategy equilibrium and have potential profit π~1,,π~t\tilde\pi_1,\ldots,\tilde \pi_t respectively. This suggests that π~jπ\tilde \pi_j \geq \pi^*, for some other party’s potential profit π\pi^*, i.e., E[R(ω~j+αχj)/(1+α)]c~jE[R(ω+αs)/(1+α)]c\mathbb{E}[R(\tilde \omega_j + \alpha \chi_j)/(1+\alpha)]- \tilde c_j \geq \mathbb{E}[R(\omega^* + \alpha s^*)/(1+\alpha)]-c^*, where s,cs^*,c^* are the stake and expected cost respectively of the best non-competitive player who is outside the KK equilibrium nodes. By summing for all j=1,,tj=1,\ldots,t, we obtain E[R(ω~+αχ)/(1+α)]c~t(E[R(ω+αs)/(1+α)]c)\mathbb{E}[R(\tilde \omega + \alpha \chi)/(1+\alpha)]- \tilde c \geq t\cdot (\mathbb{E}[R(\omega^* + \alpha s^*)/(1+\alpha)]-c^*), where ω~=i=1tω~j\tilde\omega = \sum^t_{i=1} \tilde \omega_j, from which we have:

χt(sE[ω~]/tE[ω]αcc~/tR(1+1α))\chi \geq t \Big(s^* - \frac{ \mathbb{E}[\tilde \omega]/t - \mathbb{E}[\omega^*]}{\alpha} - \frac{c^* - \tilde c/t}{R}(1 + \frac{1}{\alpha}) \Big)

Based on the above, we observe that when α\alpha\rightarrow \infty we have χtsc/R,\chi \geq t \cdot s^* - c^*/R, i.e., the mechanism imposes a lower bound on the Sybil attacker’s total stake which has to be approximately tt times as large as the stake of the first non-competitive stakeholder assuming RcR\gg c^*.

Remark 6: We note that in practice the system configuration will approximate but may not reach a perfect strategy due to (i) externalities (e.g., an exchange stakeholder who may avoid pledging because it requires high liquidity) (ii) friction and action inertia (e.g., stakeholders who perform a delegation action and subsequently do not engage with the system despite the fact that their delegation choice has in the meantime become sub-optimal).

Remark 7: In a real world deployment, it can be the case that some stakeholders cannot engage in stake delegation. For instance, keys corresponding to wallets might be lost, or tokens might be locked in smart contracts that prohibit their participation in the delegation game. As a result, if at a certain time there is a fraction of stake ζ<1\zeta<1 that is available for engaging with the mixnet game, then the saturation level β\beta should be set to ζ/K\zeta/K to accommodate for the loss in participation.

4. Economic model simulator

In the previous section we have proven that the reward scheme reaches an equilibrium when participants are perfectly rational and always make choices that maximize their financial returns. This ideal behavior may however not be fully met in practice where, e.g., we can expect a larger number NN of registered nodes than the equilibrium value (equal to KK rewarded nodes set by the scheme); and that some significant fraction of the token in circulation may not be pledged or delegated, meaning that some stakeholders are taking an opportunity cost compared to the equilibrium, which also results in increased rates of unclaimed rewards that are returned to the mixmining reserve.

To study the economic viability of the network in practical scenarios, we have implemented in a simulator8 that models the Nym network and distributes rewards to nodes over time, according to the proposed reward scheme. This simulator allows us to evaluate rewards in non-ideal conditions and compare returns for node operators and delegates in different scenarios. The simulator takes as inputs the system configuration parameters and parameters on the behavior of participants. It runs the reward distribution scheme with those parameters and participant behaviors for a configurable number of intervals (where each interval corresponds to a month), evolving the state on a per-interval basis to account for token flows (e.g., updates to the mixmining pool size considering past emissions and returned unclaimed rewards) and system updates (e.g., increased number KK of mix nodes required to serve a growing demand).

To capture a wider set of possible configurations we do not assume that the system has converged to the perfect strategy equilibrium (cfSection 3.5), and instead consider nodes with varying pledge sizes, amounts of delegation and resulting reputation scores. Moreover, in line with Remark 7 only a fraction of the available token supply is staked in the network. The simulator computes the per-interval distribution of rewards to each participant as well as a variety of parameters of interest, such as the share of work performed per node in the interval. We use this simulator to study the economic viability of the mix network in different conditions and deployment scenarios.

To be clear, this is an academic paper and not an investment prospectus or financial advise. We use the term ‘return on stake’ in a loose generic sense, and are relying on hypothetical scenarios using experimental technology. Actual results using the technology will vary widely. It’s quite possible that this venture could result in loss of monetary funds for anyone who uses the software. Any participant in an actual network is expected to do their own research rather than relying on these simulation-based experiments.

5. Experimental setup

Using the simulator, we study the reward allocation to participants over a five-year period, considering the configurations described in this section and the parameter values summarized in Table 1. It should be emphasized that our simulations consider hypothetical scenarios to obtain indicative results useful to fine-tune the scheme’s parameters; they however provide no guarantee on the reward amounts that may be obtained by nodes or the return rates that delegates can expect in the actual world, where parameter values will vary and not reproduce the exact same configurations considered in these simulations.

Table 1: Parameters of the experimental setup

5.1 Reference mix node

In our experiments we consider that all the available nodes are identical in terms of operational cost, packet processing capacity, performance and declared profit margin. Fixing Ci()C_i(\cdot), ρi\rho_i and μi\mu_i, allows us to focus on the effects of pledge and reputation on the node’s rewards, λi\lambda_i' and σi\sigma_i', which we vary per node. We represent these values as fractions over the stake saturation point of nodes, considering saturation β=1K\beta = \frac{1}{K}, i.e., the reputation level of node ii is given by σiK\sigma_i' \cdot K and its pledge saturation level by λiK\lambda_i' \cdot K.

Based on estimated commercial costs for computation and bandwidth we consider that a mix node with up to 1616 CPU cores and unlimited network data can be operated for a flat monthly cost of $200200.9 The mix node cost function is thus simply modeled as C(x)=200C(x)= 200 for all nodes (cfSection 3.1). We assume that these monthly operational costs remain constant over the five-year period. Since computation and networking costs are likely to decline over time, this is a conservative assumption.

In terms of mix node capacity, based on current implementation benchmarks10, we assume a CPU core11 can process 3 125 mixnet packets per second, while the size of the packet payload has little impact on processing time. We consider mix nodes that parallelize packet processing over up to 16 CPU cores and thus can process up to 5050k mixnet packets per second. We consider a moderate increase in processing power per CPU core of 1%1\% monthly (12.7%12.7\% annually), which after five years takes the peak capacity per core slightly above 5 600 packets per second.

In our simulations we consider that nodes have perfect performance ρi=1\rho_i = 1, while noting that any decrease in performance would proportionally scale down a node’s rewards in line with Equation 4).

We also consider that nodes declare a profit margin of 10%10\%,12 i.e., μi=0.1\mu_i=0.1. In practice (given comparable systems such as Cosmos and Cardano), profit margins are likely to vary widely and the parameter is a point of competition between nodes to attract delegates as seen in the perfect strategy described in Section 3.5. Recall that the profit margin only affects the split of a node’s rewards between its operator and delegates, but has no impact on the total rewards RiR_i received by the node. In addition, note that the effect of μi\mu_i is mainly relevant for nodes with low pledge and high delegation (σiλi\sigma_i' \gg \lambda_i'); for nodes with small amounts of delegation (σiλi\sigma_i' \approx \lambda_i'), variations in μi\mu_i will not make much difference to the raw profit of the operator, which is in such cases mainly determined by the operator’s pledge (λi\lambda_i').

5.2 Mixnet parameters

The mixnet has three layers (L=3L=3) and a variable width WW that is dependent on the traffic demand MM. Given an expected M^\hat{M} packets in the next epoch, the mixnet width WW is chosen so that mixes are on average at 20%20\% of their peak capacity (of 5050k p/s), and can thus absorb sudden increases in demand of a factor 55x over the average load. Thus, mix nodes route on average 1010k p/s, and a total of Me=36M_{e} = 36 million packets per one-hour epoch. Given an expected M^\hat{M}, WW is computed as W=M^MeW=\lceil \frac{\hat{M}}{M_{e}}\rceil.

As explained in Section 3.4, the network also keeps a reserve of BB idling nodes that can be used to grow the network in the next epoch. We consider that the number of reserve nodes is chosen as B=A=LWB=A=LW, meaning that the total number of nodes is K=A+B=6WK=A+B=6W and the network can be doubled in size if needed. Thus, for an expected traffic load M^\hat{M}, the network is dimensioned so that the available nodes can route up to 10M^10\cdot \hat{M} when all are active and used at peak capacity.

In order to bootstrap a network that provides sufficient usage capacity (more than a million mixnet packets per second) from the start and that sustains a sizeable community of operators, we set a minimum value for the mixnet width of W=120W=120 nodes (even if in the beginning there is very little or no traffic), which results in K=720K=720 nodes, of which A=360A=360 are active across 33 layers and the other B=360B=360 are in reserve. We note that Nym uses cover traffic that makes up for low user traffic, so that W=120W=120 does not result in poor anonymity due to thin traffic per node, and also that mix nodes may run on fewer than 1616 CPU cores until the network is functioning at capacity for W=120W=120.

Finally, we assume that at all times there is an excess of mix node candidates to sample from, i.e., N>KN>K. In our experiments we consider N=2KN=2K total registered nodes, meaning that in each epoch half the nodes are selected for rewards. We discuss the effects of this parameter choice in Section 5.5.

5.3 NYM exchange rate and service pricing

Token exchange rates are notoriously volatile and hard to predict, often due to speculation. To factor out exchange rate effects (which are extraneous to the reward scheme and would obscure rather than enlighten the dynamics of the scheme itself) and simplify our study, we consider that the exchange rate of NYM and USD is constant at parity, i.e., 1 NYM = US $1. In terms of the overall effects of variations in the exchange rate, we can say that a highly valued token makes the mixmining reward pool emissions be worth more and thus increases the desirability of participation (both for operators and stakeholders) regardless of fee income, while a low token price would diminish the value of pool emissions (the ‘subsidy’ would be worth very little) and make the system wholly dependent on user fees, which are expected to remain stable in fiat (converted to NYM) because they depend on node operational costs and user willingness to pay, both of which are tied to fiat.

In terms of pricing, we consider that users are willing to pay US $1 per million anonymous mixnet packets. With the current deployed size of 2 KB per packet, this corresponds to up to 2 GB of anonymized user data for US $1 (which, depending on the underlying application, can be significant throughput, e.g., for Ethereum transactions assuming an average size of 500 bytes, this would translate to 4M transactions). Note that the ideal packet size is dependent on the applications used over Nym, and thus if applications accessible through Nym require exchanging large volumes of data, larger packet sizes may be introduced to lower the cost per byte for users. For example, large mixnet packets of 1 MB would enable users to send up to 1 TB for US $1. This would be effective because the mixnet performance bottleneck is the processing power required for public key operations per packet header, while being mostly insensitive to packet payload size. If the applications that use Nym involve short exchanges of data, e.g., sending blockchain transactions or text messages, then packet sizes of just a few KB utilize bandwidth more effectively. In our simulations we consider just the number of packets. We assume for simplicity that the price of US $1 per million packets remains constant over time, i.e., that the system adjusts the parameter τ\tau (Equation 1) if needed to keep user prices constant at that level.13 Of course, these assumptions in terms of user fees and payment are vast simplifications and need in-depth investigation in future research.

In terms of the interaction between the NYM exchange rate and Nym service pricing, we expect service prices (as well as operational costs) to remain stable in fiat, while adjusting for the exchange rate of NYM if it fluctuates. Beyond accounting for exchange rate adjustments however, we note that an appreciation in value of the NYM token allows for setting a lower τ\tau (even τ=0\tau=0), as the mixmining rewards alone provide strong incentives for participation in the system, while a low exchange rate for the NYM token may require raising τ\tau to ensure mix nodes receive enough rewards after covering costs to be willing to continue to provision the service.

5.4 Available mixnet rewards

The budget of rewards R(t)R(t) available to the mixnet per monthly interval tt is the aggregation of two sources of income: the emissions of the mixmining pool, which per interval amount to 2% of the funds in the pool P(t)P(t), and 60% of the total income from mixnet usage fees F(t)F(t). Setting monthly pool emissions at 2% makes the reserve deplete slowly, lasting multiple years, while at the same time it provides enough rewards from the start to sustain a large enough set of operators: with 250250m NYM allocated to the pool, the emissions in the first month amount to 55m NYM, and after one year the pool still emits about 44m NYM per month, i.e., 80%80\% of the initial value. When considering K=720K=720 nodes, 55m NYM results in almost 77k NYM per node per month in the equilibrium, and about 0.7%0.7\% monthly (8%8\% annualized) returns for NYM stakeholders supporting the node. In terms of bandwidth fees, we note that packets typically travel five hops, with the first and last hop being a gateway and the three middle hops corresponding to nodes in each of the three mixnet layers. Therefore allocating 40%40\% of the income to gateways and 60%60\% to the mixnet is a fair split that reflects each party’s contribution to the service provisioning. Thus, the budget of rewards available for distribution to the mixnet in interval tt is:

R(t)=0.02P(t)+0.6F(t)R(t) = 0.02 \cdot P(t) + 0.6 \cdot F(t)(8)

This budget R(t)R(t) is distributed among individual mix nodes, each receiving a share Ri(t)R_i(t) depending on their parameters, according to Equation 4).

5.4.1 Mixmining pool.

The mixmining pool is initialized with P(0)=250P(0)=250 million NYM, and updated per interval as:

P(t+1)=P(t)0.02P(t)+U(t),P(t+1) = P(t) - 0.02 \cdot P(t) + U(t),(9)

where 0.02P(t)0.02\cdot P(t) is the inflation emitted by the pool and U(t)U(t) are the rewards available for distribution to the mixnet that remain unclaimed and are returned to the pool, computed as:

U(t)=R(t)iRi(t)U(t) = R(t) - \sum_i R_i(t)(10)

R(t)R(t), Ri(t)R_i(t) and U(t)U(t) are computed by the simulator based on the system and node parameters that determine the rewards distribution. The interval rewards Ri(t)R_i(t) per node are the aggregate of the rewards allocated by our scheme to the node per epoch (cf. Equation 4), considering 720720 epochs (hours) per interval (month), and sampling (proportionally to reputation), on a per-epoch basis, AA nodes to be active and BB nodes to be in reserve, for a total of K=A+BK=A+B sampled nodes that are rewarded. These KK nodes are sampled from a larger set of N>KN>K registered node candidates. Updates to WW (and consequently updates of AA, BB, KK, and NN) happen in the change of interval, whenever needed to serve increased demand. Accordingly, we show results at monthly (or yearly) granularity rather than per epoch. When computing rewards for an interval with 720720 epochs, the scheme accounts for the number of epochs in the interval that a node was selected as active (the node was one of the first AA sampled nodes, and is rewarded at the ‘active’ work rate), selected as reserve (the node was one of the last BB sampled nodes, and is rewarded at the ‘reserve’ work rate), or not selected for rewards (the node receives zero rewards for those epochs).

5.4.1 Income from fees.

For the income from fees F(t)F(t) we consider two extreme scenarios to explore a wide range of possible reward outcomes for participants:

  1. Scenario S0S_0: “low demand” is a scenario with low income from fees which, without loss of generality, we will assume to be the worst possible case, namely F0(t)=0F_0(t) = 0. Scenario S0S_0 provides the horizon of viability of a mixnet that relies on the mixmining pool alone. We consider the scheme rewards K=720K=720 nodes, of which half are active in the mixnet at any time, and another half are kept in reserve (A=B=360A=B=360 and W=120W=120), while N=1440N=1440 candidate nodes are available to sample from at any time.

  2. Scenario S1S_1: “growing demand” is a scenario with 6%6\% growth of demand per monthly interval, i.e., F1(t+1)=1.06F1(t)F_1(t+1) = 1.06 \cdot F_1(t), which about doubles demand every year. F1(0)F_1(0) is the income corresponding to an initial average load of 200200k packets per second, which amount to 0.510120.5 \cdot 10^{12} packets in the first month, as shown in Figure 3. With fees priced at 11 NYM per million packets, F1(0)=0.5F_1(0) = 0.5 million NYM, of which 200200k NYM are taken by gateways leaving 300300k NYM to the mixnet (note that P(0)=5P(0)=5 million NYM, and thus initially usage fees provide just 6%6\% of the mixnet budget). After 55 years, in this scenario the network routes 16101216 \cdot 10^{12} packets per month, amounting to almost ten million NYM in fees for the mixnet. Compared to less than four million NYM of monthly pool emissions, in S1S_1 fees provide more than 70%70\% of the mixnet income by the end of year five, with the mixmining pool providing the remaining 30%30\%. As shown in Figure 4, the exponentially increasing demand triggers a scaling up of the mixnet in the beginning of the fourth year (month 3838), from the configured initial size of K=720K=720 rewarded nodes up to more than two thousand, allowing us to study network growth funded by fees. Note that we consider NN to be double the number KK set by the reward scheme as optimal for the equilibrium, and thus the number NN of node candidates shown in the figure is double of KK.

Figure 3: Exponential growth in demand and mixnet size over five years (60 months); Bandwidth demand in S1 (packets per month)


Figure 4: Exponential growth in demand and mixnet size over five years (60 months); Number N of registered mix node candidates over time in S1, considering N = 2K and an initial K = 720


Figure 5: Evolution over 60 months in S0 and S1 of: pool emissions 0.02 · P (t), mixnet income fees 0.6 · F (t), available rewards R(t), distributed rewards iRi(t)\sum_i R_i(t) and unclaimed rewards U(t); Rewards budget in scenario S0


Figure 6: Evolution over 60 months in S0 and S1 of: pool emissions 0.02 · P (t), mixnet income fees 0.6 · F (t), available rewards R(t), distributed rewards iRi(t)\sum_i R_i(t) and unclaimed rewards U(t); Rewards budget in scenario S1

Figure 5 and Figure 6 shows for both scenarios S0S_0 and S1S_1 the evolution of the mixmining pool emissions (0.02P(t)0.02\cdot P(t)), the mixnet income fees (0.6F(t)0.6\cdot F(t)), and their aggregation as available rewards R(t)R(t), of which iRi(t)\sum_i R_i(t) are distributed to mix nodes and U(t)U(t) remain unclaimed. As shown in Figure 5, in S0S_0 all the network income is due to pool emissions, which slowly diminish over time (the green line representing fee income is at zero and not visible, while the blue and orange lines overlap). After five years, the monthly emissions have declined in this scenario to about half the initial monthly amount of 55 million. With the considered distribution of pledges and delegation (described in detail in the next section), slightly more than half the available rewards are distributed to nodes in this scenario while the rest is returned to the pool as unclaimed. Figure 6 shows the total budget of rewards in S1S_1 increasing over time due to the growing income from fees, which overtake pool emissions as the main source of income after three years (month 4242). In the last year of the simulation (from month 4545), the amount of unclaimed rewards is larger than the pool emissions, meaning that the pool is replenished for a few intervals. This replenishment would stop once fee income stabilizes at some level or stakeholder engagement increases (which would reduce the proportion of unclaimed rewards), leading again to shrinking of the mixmining reserve. The reserve thus acts as a buffer that depletes when needed to subsidize network operations, and replenishes if the network income grows steeply without stakeholders being fully engaged in contributing to node reputation.

5.5 Staking distribution and parameters.

The NYM total supply is constant at one billion token, all of which are created at genesis. Initially, 250 million token are locked in the mixmining pool and thus unavailable for staking. The remaining 750 million token can be considered as entirely or partially available for staking. In the presented simulation scenarios we consider for simplicity that the entire 750 million are available as part of the staking supply. Taking into account that a large part of NYM tokens are locked in vesting contracts, this implies that all unvested tokens can be staked from the start. Alternatively, the staking supply may be restricted to liquid tokens, or also allow a limited amount of unvested tokens to be staked, e.g, up to a maximum amount per vesting account or as a fraction of the locked amount per account.14 The main impact of restricting the staking supply is higher rewards per staked token, since the amount of distributed rewards remains constant while the amount of tokens staked to receive those rewards is smaller. Note that any such effects are limited in time to the vesting period (in this case two years), and that once all tokens can be staked the results are the same in all scenarios.

Once the available staking supply is set, the per-node stake saturation point is computed as the available stake uniformly distributed over KK nodes, i.e., 7501061K750 \cdot 10^6 \cdot \frac{1}{K} when considering all 750 million tokens can be staked. For the initial K=720K=720 nodes this amounts to a saturation point of 1.041.04 million NYM per node. As the mixmining reserve funds are released, the total NYM supply available for pledging and delegation increases accordingly, and so does the saturation point. Conversely, when the number KK of rewarded nodes increases, the saturation point decreases.

The equilibrium analysis presented in Section 3.5 shows that in an ideal frictionless world, the system has an equilibrium state with all available stake evenly distributed among exactly KK nodes, all of which are at saturation point (maximum reputation of one) and operated by the stakeholders with the largest stake to pledge. In real-world settings however, we can expect deviations from the ideal world. For example, we can expect a larger number NN of registered nodes than the equilibrium value KK, as is currently the case in comparable deployed systems such as Cardano, where most candidate nodes are unsaturated and there is a long tail of nodes that have minimal pledging and no delegation. Furthermore, not all stakeholders stake all their token, leaving a fraction unallocated (cf. Remark 7), and for a variety of reasons some large stakeholders may prefer to delegate their stake rather than pledge it to operate themselves a node. Finally, due to all sorts of externalities (e.g., popularity, community dynamics), stakeholders in practice pursue strategies that deviate from purely maximizing returns to prioritize support of nodes they like; and due to action inertia they may fail to act in a timely fashion as the system re-configures, leaving their stake sub-optimally allocated. We attempt to capture these aspects in our simulations in order to evaluate the reward scheme in realistic conditions.

Of the available NYM token (initially 750750 million), we consider that stakeholders dedicate 15%15\% of their total combined stake to pledging and 60%60\% to delegation, with the remaining 25%25\% of available stake being unallocated.15 These pledged and delegated NYM are spread over NN node candidates, each with an aggregate amount between the minimum pledge and the saturation point. We consider distributions of pledging and delegation that are in line with what can be observed in existing staking systems such as Cardano.16 We take into account that pledges are constrained by how stake is distributed among stakeholders, with a small number of large stakeholders (e.g., investors and other ‘whales’ that have acquired large amounts of NYM) who can saturate their pledges to maximize rewards, and a large number of stakeholders with a limited budget to pledge. We aim to study the reward outcomes for participants with a wide range of budgets (pledge) and reputation (aggregate of pledge and delegation). For this, and in line with other research in the space [15], we consider a very skewed Pareto distribution of pledges with a few saturated nodes (pledges of 11m NYM) and a long tail with the minimum pledge of 10001000 NYM, as shown in Figure 7.

Figure 7 (Distribution of pledges and reputation (snapshot for an epoch)): Distribution of node pledges in a network with K = 720, N = 1440, and 15% of available token supply dedicated to pledging. Ordered by pledge.


Figure 8 (Distribution of pledges and reputation (snapshot for an epoch)): Distribution of reputation (pledge+delegation) in a network with K = 720, N = 1440, 15% of available token supply dedicated to pledging and 60% delegated. Ordered by reputation (pledge+delegation).

We further consider that 60%60\% of the NYM supply is delegated to registered nodes. We allocate delegated token to nodes in a randomized manner (uniform amount of delegation between zero and the saturation point minus the pledge), choosing first the nodes whose pledge is larger than the minimum until the delegation budget is exhausted. As shown in Figure 8, this results in part – but not all – of the nodes with minimum pledge receiving delegation, some even up to the saturation point, allowing us to study a broad range of pledge-delegation combinations. Once all the delegated stake has been allocated, there remains a tail of nodes with minimal pledge and no delegation. Given that the minimal pledge is much smaller than the saturation point, this amounts to negligible reputation. Considering N=2K,N=2K, three quarters of registered nodes have non-negligible reputation while the last quarter has negligible reputation. Increasing NN to account for more nodes with negligible reputation does not change the reward dynamics, since nodes with negligible reputation are (almost) never selected, and even when they are, they receive a small amount of rewards and thus have no impact on the rewards of nodes with non-negligible reputation. In other words, nodes with negligible reputation are practically irrelevant, and the existence of a smaller or larger set does not make a difference for nodes with non-negligible reputation. The value of N=2KN=2K should however be taken into account when interpreting results that show boxplot distributions over the set of nodes: the bottom quarter (third quartile) of nodes have negligible reputation (and consequently negative profits due to low rates of selection and rewards), while the median corresponds to the KK-th highest reputation node. Larger values of NN, e.g., N=10KN=10K, would result in the vast majority of nodes having negligible reputation and, when depicting distributions, only the outliers would show meaningful results for the high-reputation nodes that are actually players in the network.

We recall that the per-epoch selection of nodes is proportional to their reputation expressed as stake saturation level, i.e., the fraction of pledge and delegated token of nodes relative to the stake saturation point. For example, if the stake saturation point is reached at 11 million NYM, a node that aggregates 200200k NYM between pledge and delegation has a reputation or saturation level of 0.20.2, or 20%20\%. Considering N=2KN=2K, only half the nodes are selected for rewards in each epoch, and given that more than half have non-negligible reputation (marked with the vertical dotted line in Figure 8), not all nodes with non-negligible reputation are selected in every epoch for rewards.

Figure 9: Scenario S0 boxplot with the distribution of node reputation (pledge+delegated token) over the set of N node candidates and its evolution on a monthly basis for 5 years (60 months). 15% of available token supply is dedicated to pledging and 60% is delegated.


Figure 10: Scenario S1 boxplot with the distribution of node reputation (pledge+delegated token) over the set of N node candidates and its evolution on a monthly basis for 5 years (60 months). 15% of available token supply is dedicated to pledging and 60% is delegated.

In Figure 9 and Figure 10 we show how the distribution of node reputation evolves over time in scenarios S0S_0 and S1S_1. We represent each interval’s distribution of aggregate pledge and delegation as a boxplot17 where the top values mark the per-node saturation point in that interval (initially at 1.041.04m NYM). Note that each individual boxplot can be represented as Figure 8, where the median is marked by a vertical dotted line and the maximum values are on the left of the xx axis. In S0S_0 the network size is constant and thus the distribution remains stable, with a slight increase in values over time due to the increased circulating supply (caused by the emissions of the mixmining reserve). In S1S_1 we can observe that the amount of token staked per node decreases from the fourth year (month 3838), as from that moment the mixnet size grows every month and the token supply is redistributed among a larger number of nodes to account for network scaling, which lowers the per-node saturation point.

6. Experimental results

We run our simulator in the described experimental setup and study participant rewards. In all the figures we show on the left results for the S0S_0 (low demand) scenario, and on the right for S1S_1 (growing demand). We recall that these results are illustrative of the functioning of the scheme but provide no guarantees or even likelihood on the rewards that stakeholders can expect in any deployment in the real world.

6.1 Distribution of node rewards

First we examine the distribution of rewards over nodes per interval. Figure 11 and Figure 12 show boxplots with the distribution of monthly rewards to nodes over a 55-year period. The top whisker per box corresponds to the rewards of the most rewarded node in the interval; the top of the box marks the first quartile of the distribution; the median is marked with an orange line; and the bottom whisker corresponds to the rewards of the least rewarded node, which is usually zero considering there is a tail of nodes with minimal reputation, unlikely to be selected for rewards.

Figure 11: Monthly rewards received by nodes in S0 over five years. Distribution of monthly rewards to nodes over five years (60 months), considering K = 720 minimum rewarded nodes per epoch and N = 2K total node candidates.


Figure 12: Monthly rewards received by nodes in S1 over five years. Distribution of monthly rewards to nodes over five years (60 months), considering K = 720 minimum rewarded nodes per epoch and N = 2K total node candidates.

We can see that in both scenarios the node median rewards are stable at around 11k NYM per month, though slightly lower in S0S_0, particularly after some time. As we are considering N=2KN=2K total node candidates, the median (orange line) corresponds to the KK-th most rewarded node, which in a situation of equilibrium would be the last existing node, while the first quartile (top of the box) represents the K2\frac{K}{2}-th node, which would be the median node in a situation without excess candidates. In S0S_0, the most rewarded nodes (those with maximum reputation) initially receive 88k NYM per month, slowly declining to about 4.54.5k NYM per month after five years. In S1S_1, as result of the exponential growth in demand (and corresponding income from fees), the rewards per node do not diminish even as there are more nodes to reward. The peak at month 3838 corresponds to the network taking fees at capacity for K=720K=720, when bandwidth demand has grown to fully utilize the initial capacity, but right before additional demand makes the mixnet increase over the initial size (thus increasing the number of nodes over which to spread rewards). Once the network starts scaling, the per node rewards stabilize around 3.53.5k NYM for the first quartile and 88k NYM for the top rewarded nodes, with the median remaining at 11k NYM per month. Thus, as long as the NYM exchange rate does not diminish to the point of making the mixmining rewards worthless, these results indicate that under this model, the network can operate and remain viable for a few years, even with low income from usage. This provides the system with ample time to integrate applications and grow the user base – keeping in mind that long-term sustainability is only possible with eventual income from fees.

Figure 13: Annualized node rewards relative to node reputation (stake saturation level of the node) in S0 (first year)


Figure 14: Annualized node rewards relative to node reputation (stake saturation level of the node) in S1 (first year)


Figure 15: Annualized node rewards relative to node reputation (stake saturation level of the node) in S0 (fifth year).


Figure 16: Annualized node rewards relative to node reputation (stake saturation level of the node) in S1 (fifth year).

To better understand the relationship between node reputation and received rewards, i.e., which nodes are at the top of the boxplot and which at the bottom, we take snapshots of the network in the first and fifth years of simulation, for both S0S_0 and S1S_1. The results are in Figure 13 - Figure 16, where we show a scatterplot of the annualized rewards received by nodes relative to their reputation level; i.e., each dot with coordinates (x,y)(x,y) is a sample from a node in the simulation, the xx coordinate is the node reputation and the yy coordinate the annualized rewards received by the node. As we can see in Figure 13 and Figure 14, the results are similar for both scenarios in the first year of operation.

The difference between the two scenarios becomes visible by the fifth year of operation, shown in Figure 15 and Figure 16, for S0S_0 and S1S_1, respectively. In S0S_0 rewards have diminished and, for the same level of reputation, nodes are receiving about half the amount of rewards compared to the first year of operation. In S1S_1 on the other hand, for a level of reputation nodes still receive the same amount of rewards as they did in the first year. Note that due to growing demand in S1S_1 the network has become larger after five years (higher WW, KK and NN), which lowers the per-node stake saturation point, and results in more nodes having high reputation levels. This is visible in Figure 16 with a higher density of samples in the higher saturation values, meaning that not only nodes keep receiving the same level of rewards for a saturation level, but also that more nodes are being rewarded at high levels.

Figure 17: Annualized received node rewards (fifth year) relative to the level of pledge saturation in S0


Figure 18: Annualized received node rewards (fifth year) relative to the level of pledge saturation in S1

In all depicted cases there is an obvious strong positive correlation between node reputation and received rewards. Nodes with a reputation level below 10%10\% barely receive any rewards. On the other extreme, we can observe some variance within the set of nodes with maximum reputation of 100%100\%, with two groups being distinguishable in Figure 14. This difference relates to the size of the nodes’ pledge, weighed by the parameter α\alpha in our reward scheme (Equation 4). The nodes receiving higher rewards are those with large pledges that significantly contribute to the reputation of the node. Those operators are compensated for the opportunity cost of locking up a large amount of token and for having more ‘skin in the game’. The set of nodes receiving lower rewards are those with small pledges, which reach saturation primarily with delegated stake. This is illustrated even more clearly in Figure 17 and Figure 18, where we show node rewards relative to the level of pledge saturation (ignoring delegation), and we clearly see the cluster of highest rewards corresponding to nodes whose pledge fully saturates the node. For low pledges, the variance in node rewards is very significant as it depends on the reputation of the node. As we can see in Figure 18, a node with minimal pledge (saturation barely above zero) may receive up to 8080k NYM per year if it becomes fully saturated and reaches maximum reputation, and as little as zero if it receives no delegation from other stakeholders; while a node with 60%60\% of pledge saturation receives a minimum of 4040k NYM when it receives no additional delegation, and up to 8585k NYM when it becomes fully saturated thanks to delegation. Nodes with fully saturated pledges are the best rewarded with between 8080k and 100100k NYM per year.

6.2 Distribution of node operator profits

From the amount of rewards allocated to a node (shown in the previous figures), our scheme first subtracts and refunds the node’s operational costs (C()=200C(\cdot)=200 in the considered case). The remainder represents the node’s profit, and it is split between the operator and the delegates according to Equation 5 and Equation 6.

The net amount of rewards given to the operator after refunding costs are the operator profits (a node’s profit is negative when the operational costs of running the node for a month are higher than the monthly rewards it has received). We show these profits for our studied scenarios in Figure 19 and Figure 20, again as boxplots with the distribution of per-node monthly profit for the set of NN candidate nodes. In both S0S_0 and S1S_1 the outliers at the top represent nodes run by ‘whales’ who can afford to fully saturate nodes with their pledge alone, and thus receive all the node’s rewards (note that those outliers match the top values in Figure 11 and Figure 12). The profit of these participants in both scenarios starts at around 88k NYM per month and after five years is at 44k8-8k NYM, depending on the demand scenario. The first quartile node, which is the K2\frac{K}{2}-th node in terms of operator profit, makes around 400400 NYM net per month in both scenarios, with operator profits slowly decreasing in S0S_0 over time, down to 200200 NYM per month after costs. The median node, which is the KK-th node in terms of operator profit, makes a modest but positive net profit in both S0S_0 and S1S_1, even at the end of the five year period. Even though the majority of nodes make a profit in both S0S_0 and S1S_1, we can see that some nodes take a loss, as the lower part of the boxplots (between the median and the third quartile) are below the red line marking zero, indicating loss (down to a loss of US $200\$200). This is the case for nodes that have very low reputation and thus are rarely sampled as part of the KK rewarded nodes — and even when they are, they receive small rewards, which at the end of the month are insufficient to compensate for the operational costs of running a node, estimated at US $200\$ 200 per month.

Figure 19: Distribution of monthly operator profits to node operators over five years (60 months) in S0, considering at least K = 720 rewarded nodes per epoch and N = 2K total node candidates


Figure 20: Distribution of monthly operator profits to node operators over five years (60 months) in S1, considering at least K = 720 rewarded nodes per epoch and N = 2K total node candidates

Similarly to before, we study the relationship between node operator rewards and node pledge, where the pledge is represented by its corresponding saturation level, i.e., if the per-node saturation point is 11 million NYM, then a pledge of 250250k NYM corresponds to a pledge saturation level of 0.250.25 (25%25\%). Our results for the first and fifth years of simulation, for both S0S_0 and S1S_1, are shown in Figure 21Figure 24. As expected, in all scenarios node operator rewards are proportional to the node’s pledge, with rewards per saturation level being sustained over time if the network receives income from fees (S1S_1) – but decaying to about half the amount after five years if the network fails to attract fees and is entirely reliant on the mixmining reserve for rewarding nodes (S0S_0). Compared to Figure 17 and Figure 18, we can see that operators obtain the lower band of the rewards minus the costs, while the excess rewards (if any), which are proportional to delegation to the node, are distributed among the delegates.

Figure 21: Annualized operator rewards relative to the level of pledge saturation in S0 (first year)


Figure 22: Annualized operator rewards relative to the level of pledge saturation in S1 (first year)


Figure 23: Annualized operator rewards relative to the level of pledge saturation in S0 (fifth year)


Figure 24: Annualized operator rewards relative to the level of pledge saturation in S1 (fifth year)

We also observe in all four cases that some nodes with low pledge have a negative profit (dots below the red line), meaning that their rewards are insufficient to cover operational costs. In the worst case a node’s yearly net profit may be US $2400\$2400 negative, when the node receives zero rewards and pays operational costs of US $200\$200 every month. This lack of profitability only affects nodes with both pledge saturation below 0.20.2 and low rates of delegation resulting in low reputation. Note that the median (KK-th) node considered in our setting has a reputation level of 0.40.4 (40%40\%), as shown by the dotted line in Figure 8.

6.3 Distribution of returns to node delegates

We now turn our attention to the returns received by stakeholders that delegate their stake rather than operate a node themselves. Our scenarios consider that all NN candidate nodes have identical operational cost, profit margin, and performance; while differing in their pledge and reputation, as before, to isolate the impact of pledging and delegation on rewards.

The distributions of yearly returns for delegates are shown as boxplots in Figure 25 and Figure 26, with each sample corresponding to the rewards received by a node in the simulation. We compute the annualized ROS (Return On Stake) without taking into account compounding effects, i.e., simply multiplying monthly ROS by 1212. The monthly ROS samples include all nodes with a non-zero amount of delegation, with the ROS value computed by dividing the rewards given to a node’s delegates by the total amount delegated to the node. For example, if a node has 500500k NYM in delegated token, and it distributes 22k NYM in a month to its delegates, the ROS value for that node in that month is 2103500103=0.4%\frac{2\cdot 10^3}{500 \cdot 10^3} = 0.4\%, which corresponds to 4.8%4.8\% annualized ROS.18

Figure 25: Distribution of ROS (Return On Stake) to node delegates over five years—annualized ROS for delegates in S0

Figure 26: Distribution of ROS (Return On Stake) to node delegates over five years—annualized ROS for delegates in S1

Figure 25 shows that in S0S_0 the annualized ROS for delegates starts with a median of 3.5%3.5\% and a maximum for the best performing nodes of 7.5%7.5\%, which is comparable to the ROS that would be attained in the equilibrium. Without any fee income, the ROS declines over time to a median of 2%2\% and a maximum of 4%4\% per year, after five years. As depicted in Figure 26, in S1S_1 returns start at a level just slightly above S0S_0 but, over time, they increase with user demand to a median of 8%8\% and a maximum of 20%20\% per year. The reason for this increase is that the amount of token available to pledge and delegate to nodes remains relatively constant, while the rewards allocated to the set of stakeholders are significantly multiplied due to the fees taken by the network, leading to higher rewards (returns) per unit of stake.

In both S0S_0 and S1S_1 scenarios there is a wide spread of ROS between the highest value (corresponding to the delegates of the node that provided the best ROS) and the lowest, which is zero for the fraction of nodes that use all received rewards to cover costs and do not distribute anything to their delegates. We show in Figure 27Figure 30 the relationship between the ROS offered by a node to its delegates, and the node’s reputation level, for both scenarios S0S_0 and S1S_1 in the first and fifth years of operation. As we can see in all figures, the returns are highly correlated with the node reputation. Nodes with reputation levels below 20%20\% give zero returns to delegates. Above this threshold, the returns increase up to the maximum return rate, achieved at reputation 100%100\%, which corresponds to the stake saturation point. This illustrates the strong incentives of the scheme towards clustering delegate support on nodes that already have a significant reputation, in other words, collectively reaching consensus on a set of reputable nodes. The ROS for delegates is comparable in the first year for both scenarios (slightly higher for S1S_1 as there is additional income), as shown in Figure 27 and Figure 28, where delegates of fully saturated nodes obtain a yearly ROS in the range 5%5\%-7%7\%. In the fifth year however, the returns are vastly different for S0S_0 and S1S_1, as illustrated in Figure 29 and Figure 30. In S0S_0 the returns decline to half their initial value, while in S1S_1 they increase very significantly up to a maximum of nearly 20%20\% annual ROS for the best performing nodes, and up to 10%10\% for nodes with medium levels of reputation.

Figure 27: Scatterplot of delegate ROS (Return On Stake) vs node saturation in S0 (first year)


Figure 28: Scatterplot of delegate ROS (Return On Stake) vs node saturation in S1 (first year)


Figure 29: Scatterplot of delegate ROS (Return On Stake) vs node saturation in S0 (fifth year)


Figure 30: Scatterplot of delegate ROS (Return On Stake) vs node saturation in S1 (fifth year)

Taking these results into account together with those of the previous section, we can see that in low-demand scenarios (S0S_0) the mixmining subsidies can sustain the network for some years while demand slowly takes off — as long as the subsidies remain valuable, which are tied to the value of the NYM token. During this time, a sufficient number of node operators are refunded for costs and additionally receive a net profit of several hundred NYM, while delegates make modest returns on their investment. With high demand (S1S_1), a growing number of operators can be adequately funded by the network as it scales, while delegate return rates increase significantly with the network’s turnover, strengthening the incentives for stakeholders to engage with the network by pledging or delegating their token.

6.4 Return On Stake (ROS) for pledging vs delegation

Finally, we consider stakeholders deciding whether to pledge or delegate their NYM stake, and study the rewards they would receive in the simulated scenarios for pledging versus delegating 11k, 1010k, and 100100k NYM to nodes with varying levels of reputation. For brevity we only show results for the first year of scenario S0S_0 (which are almost identical to the results for the first year of scenario S1S_1) and the fifth year of scenario S1S_1. The results for the fifth year of S0S_0 differ in expected ways, consistent with the results shown in previous sections: rewards become half the amount they were in the first year of S0S_0.

We show in Figure 31 and Figure 32 the simulated returns for pledging and delegating 11k NYM in the considered scenarios. Each dot at coordinates (x,y)(x,y) is a sample taken from a node in the simulation, with the xx being the node’s reputation, and the yy being the rewards obtained from pledging (green dots) or delegating (orange dots) 11k NYM to that node. In the case of pledging (green dots), we only sample nodes with a comparable pledge, defined as within 20%20\% of the considered amount, i.e., for 10001000 NYM, we only sample operator ROS (node operator profit divided by the node pledge) for nodes whose pledges are between 800800 NYM and 12001200 NYM, and multiply their operator ROS by 10001000 to obtain the returns for the considered 11k NYM pledge. In the case of delegation (orange dots), we sample the delegates’ ROS (total delegate rewards divided by total delegated stake) of all nodes with an amount of delegation equal or superior to the considered amount (i.e., for 11k NYM we consider nodes that have at least 11k NYM delegated to them) and multiply their delegate ROS by 10001000 NYM to obtain the rewards corresponding to the delegation of 11k NYM to that node.

Figure 31: Simulated annual rewards/returns for pledging and delegating 1k NYM in S0 (first year)


Figure 32: Simulated annual rewards/returns for pledging and delegating1k NYM in S1 (fifth year)

As we can see in Figure 31 and Figure 32, for a given level of node saturation a pledge of 11k NYM leads to rather similar rewards in both cases, even though the considered underlying scenarios are vastly different. Pledging 11k NYM to a node that becomes fully saturated with delegated stake results in returns of 66k-88k NYM per year for the node operator in the considered scenario. On the other hand, if the node saturation level is below 0.20.2 (20%20\%), rewards will not be sufficient to offset operational costs, resulting in a negative net balance for the operator. If the st