Abstract. The purpose of a consensus protocol is to keep a distributed network of nodes “in sync,” even in the presence of an unpredictable communication network and adversarial behavior by some of the participating nodes. In the permissionless setting relevant to modern blockchain protocols, these nodes may be operated by a large number of unknown players, with each player free to use multiple identifiers and to start or stop running the protocol at any time. Establishing that a permissionless consensus protocol is “secure” thus requires both a distributed computing argument (that the protocol guarantees consistency and liveness unless the fraction of adversarial participation is sufficiently large) and an economic argument (that carrying out an attack would be prohibitively expensive for a potential attacker). There is a mature toolbox for assembling arguments of the former type; the goal of this paper is to lay the foundations for arguments of the latter type. For example, the Ethereum protocol is oft-claimed to be “more economically secure” after “the merge,” meaning in its current proof-of-stake incarnation relative to the (proof-of-work) original. What, formally, does this assertion mean? Is it true? Could there be alternative protocols that are “still more economically secure” than Ethereum? How do the answers depend on the assumptions imposed on, for example, the reliability of message delivery or the active participation of non-malicious players? An ideal permissionless consensus protocol would, in addition to satisfying standard consistency and liveness guarantees, render consistency violations prohibitively expensive for the attacker without collateral damage to honest participants—for example, by programatically confiscating an attacker’s resources without reducing the value of honest participants’ resources, as is the intention for slashing in a proof-of-stake protocol. We make this idea precise with our notion of the EAAC (expensive to attack in the absence of collapse) property and prove the following results: (1) In the synchronous and dynamically available setting (in which the communication network is reliable but nonmalicious players may be periodically inactive), with an adversary that controls at least one-half of the overall resources, no protocol can be EAAC. In particular, this result rules out EAAC for all typical longest-chain protocols (be they proof-of-work or proof-of-stake). (2) In the partially synchronous and quasi-permissionless setting (in which resource-controlling non-malicious players are always active but the communication network may suffer periods of unreliability), with an adversary that controls at least one-third of the overall resources, no protocol can be EAAC. In particular, slashing in a proof-of-stake protocol cannot achieve its intended purpose if message delays cannot be bounded a priori. (3) In the synchronous and quasi-permissionless setting, there is a proof-of-stake protocol with slashing that, provided the adversary controls less than two-thirds of the overall stake, satisfies the EAAC property. Thus, while only “classical security” is possible in the dynamically available or partially synchronous settings, proof-of-stake protocols with slashing can obtain additional “economic security” in the quasi-permissionless and synchronous settings. All three results are optimal with respect to the size of the adversary. With respect to Ethereum, our work formalizes the potential security benefits of proof-of-stake sybil-resistance coupled with slashing and the common belief that the merge has increased Ethereum’s economic security. Our work also provides mathematical justifications for several key design decisions behind the post-merge Ethereum protocol, ranging from long cooldown periods for unstaking to economic penalties for inactivity.

An ideal permissionless consensus protocol would, in addition to satisfying standard consistency and liveness guarantees, render consistency violations prohibitively expensive for the attacker without collateral damage to honest participants---for example, by programatically confiscating an attacker's resources without reducing the value of honest participants' resources, as is the intention for slashing in a proof-of-stake protocol. We make this idea precise with our notion of the EAAC (expensive to attack in the absence of collapse) property, and prove the following results:

Approximate Competitive Equilibrium from Equal Incomes (A-CEEI) is an equilibrium-based solution concept for fair division of discrete items to agents with combinatorial demands. In theory, it is known that in asymptotically large markets:

We propose an economic framework for determining the optimal allocation of a scarce supply of vaccines that become gradually available during a public health crisis, such as the Covid-19 pandemic. Agents differ in observable and unobservable characteristics, and the designer maximizes a social welfare function over all feasible mechanisms---accounting for agents' characteristics, as well as their endogenous behavior in the face of the pandemic. The framework emphasizes the role of externalities and incorporates equity as well as efficiency concerns. Our results provide an economic justification for providing vaccines immediately and for free to some groups of agents, while at the same time showing that a carefully constructed pricing mechanism can improve outcomes by screening for individuals with the highest private and social benefits of receiving the vaccine. The solution casts light on the classic question of whether prices or priorities should be used to allocate scarce public resources under externalities and equity concerns.

The first part of this talk will cover the argument in Budish, Cramton and Shim [1] that the predominant market design used by financial exchanges around the world, called the continuous limit order book, is flawed. The flaw - essentially, a glitch introduced in the transition from human-based financial exchanges to electronic ones - is to treat time as a continuous variable, and process requests to trade serially. This combination of continuous time and serial processing creates mechanical arbitrage opportunities based on symmetric public information --- a violation of efficient markets theory, built right into the market design! --- which in turn harms liquidity provision and induces a never-ending, socially wasteful, arms race for speed. That is, much of high-frequency trading is a symptom of flawed market design. We propose an alternative market design, called frequent batch auctions, in which time is discrete and orders are batch processed using auctions, and show that this directly fixes the problem with the continuous market. The second part of this talk will ask whether the "market will fix the market?" that is, whether market forces will lead to the adoption of discrete-time trading instead of continuous-time trading, or whether a regulatory intervention would be needed. This requires a model of how modern stock exchanges compete and earn profits, the subject of new work-in-progress with Lee and Shim [2]. The model shows that competition among stock exchanges is fierce on the dimension of traditional trading fees, but that exchanges have market power in the sale of exchange-specific speed technology - i.e., arms for the arms race. We then use the model to study the private and social returns to market design innovation. We find that even though the social returns to adopting discrete-time trading would be large and positive, the private returns can be negative, due to the loss of rents from speed technology. We discuss some modest policy interventions that could tip the balance of incentives and encourage the "market to fix the market". Last, I will discuss some open questions about financial market design that lie at the intersection of economics and computer science. [1]Budish, E, P. Cramton and J. Shim. 2015. The High-Frequency Trading Arms Race: Frequent Batch Auctions as a Market Design Response. Quarterly Journal of Economics, pg. 1547-1621. [2]Budish, E, R. Lee and J. Shim. 2018. Will the Market Fix the Market? A Theory of Stock Exchange Competition and Innovation. Manuscript in Preparation.

Economists have long been puzzled by event-ticket underpricing: underpricing reduces revenue for the performer, and encourages socially wasteful rent-seeking by ticket brokers. Why not use an auction to set price correctly? This paper studies the recent introduction of auctions into the event-ticket market by Ticketmaster. By combining primary-market data from Ticketmaster with secondary-market resale value data from eBay, we show that Ticketmaster's auctions work: the auctions substantially improve price discovery, roughly double performer revenues, and, on average, nearly eliminate the arbitrage profits associated with underpriced tickets. The data thus suggest that auctions can eliminate the speculator rent-seeking that has been associated with this market since the 19th century, and that seems to have exploded in volume in the 21st century.

No abstract available.