yanmaani I also wonder if the mechanism described with enable a dirt-cheap spam attack. Normally to raise the block median you need at least 50+% of blocks to pay a penalty. In this case, you could maintain a high block median with 51% blocks at the median, and 49% of blocks way below the median collecting scrip. Then, to raise the median you now make 49% of blocks using max blocks + collected scrip

(avoiding penalty) and 2% paying penalty.

UkoeHB_: Isn't the marginal penalty 0 for everything up to the limit?

My claim is that they will keep blocks at the limit, because it costs nothing to do so, but only push it if people pay for it. So the median block size is a floor on block size

Sure, but suppose you have 11 tx, 10 with fee=tiny, 1 with fee=big, and the block limit is 10 tx. Now, will the miner add all 11 tx to the block? No, he will only add 10, and leave out one tx with tiny fee, since it isn't enough to offset the marginal penalty.

sure

but if the block limit is 10 tx, and there is 1 with fee=tiny

then the miner will create 9 new txns, with fee = whatever

and pay himself

as for the spam attack: you'd need to pay money for the scrip

and you lose opportunity costs from all that

so, avoiding profitable txns to gather scrip equals buying scrip

and buying scrip to do a spam attack is the opposite of profitable

fundamentally, scrip will never allow you to bload the blockchain, since you can never take out more than you put in

you can't 'borrow' from a central bank, "I'll make this one very big but a future block small"

you have to first cut, then increase

Ok suppose we have a stepwise function in the tx volume: 20 tx/min, 10 tx/min, 20 tx/min. Originally the penalty free zone is 20 tx, and all tx have tiny fees to fill it up. Then honest volume falls to 10 tx/min, and fee revenue falls in half (still tiny fees). If the miner fills the gap, with 10 fake tx, he doesnt gain anything now. Then tx volume goes back to 20tx/min and fee revenue doubles again.

Consider the alternate case where he didnt add fake tx. The penalty free zone falls to 10tx/min, then tx volume rises to 20tx/min again. Suddenly tx authors must pay big fees to push into the penalty zone. Miner revenue will be higher since 20tx with high fee will be in sum higher than the marginal penaltyQ

It takes 4x the block reward to fill blocks with tx all the way to the max block size

in fees

But he doesn't get it, does he?

Why not?

TX authors pay big fees, but this goes to the block stuff

It goes to miners?

there's always multiple miners. And for the collective of miners, block penalties are a net drain

No, the block reward goes down, that's what the penalty does

else miners could just pay themselves and shit

Sure, and it is more than offset by fees

Yes. But they don't get it.

If you need to pay $100 of penalty to get a transaction in, and your TXN fee is $100, then that's $0 for the miner.

So miners have no incentive to keep penalties high, the contrary.

That's just the marginal penalty. All other tx in a block must also pay that same fee

so it's more like 400$ in fees, and miner gets 300$

above the original block reward of 100$

Wait, do all transactions in a block all pay the same fee?

They must at least all pay the marginal penalty, to get into the penalty zone

Assuming miners are not altruistic

All? Surely only some of them do, although they can't know which beforehand?

Miners as I see it have no incentive to have high penalty fees. That's just money going from users to deflation.

Why would a miner add a tx if its fee isnt enough to offset the marginal penalty from adding it? He can iterate through all potential tx to test it

If we define net txn fee as (gross txn fee - penalty required to include), then miners seek to optimize net txn fees

So if the penalty goes up, that is bad

and if penalty goes down, that is good

for them

it wouldn't, but penalties are still a drain for the miners. Miners don't have incentive to keep penalties high

since they don't get any of the money from them. You can see penalties as a "fee on the fees" if you will

Hm how to say this better lol

the net penalty will always be lower than the net fees, and the higher the penalty, even higher will be the net fees

since the marginal penalty is linear and not constant

wait what?

you can think of filling up a bucket, the heaviest tx fee will always fall to the bottom, and lowest fees sit on top

The gross penalty will always be lower than the gross fees you mean?

As in, the net fee will always be positive

As in, miners will not light their money on fire

if the lowest fee in a set of tx can't offset the marginal penalty, it wont be included in a block

right

but as the penalty gets higher, the lowest fee for a marginal tx gets bigger and bigger, so the sum of fees also grows with the marginal penalty

while the total penalty is the integral, and hence lower

this seems unintuitive. It's a straight optimization problem. Were the penalty lower, then miners could also fill the blocks better.

Like, you have an infinite supply of widgets, and people are willing to buy. How many do you sell?

The answer isn't 'all of them', because then the price goes to 0

the answer isn't 'none', because then the volume is zero

As a reductio ad absurdum: if what you're saying is true, then shouldn't miners wish to crank up penalties to infinity?

(no, since they'd price out otherwise perfectly good txns)

for a set of tx to 'buy' additional space in a tx, all its component tx must have higher fee than the marginal penalty of that space. tx_set_total_fee = num_tx*largest_marginal_penalty, while total_penalty = sum[marginal_penalties], where those marginal penalties are all smaller than the bought space. So the next largest marginal penalty grows the tx set another delta(marginal_penalties)*tx_set_size

it reduces to a collective bargaining problem which is just generally messy - a selfish miner would want to cash out as much as it can as fast as possible, a cooperating miner would want to keep the block reward high enough to collect many fees, but low enough to cause congesion.

Right. So why don't miners want for the penalty algorithm to be 2^(2^(excess size))?

big penalties = big profits, no?

Well I doubt anyone has thought this far into it lol

But it's not that easy to manipulate penalties in the first place

yeah but if they could

are you saying the greatest profit would be in just raising them to infinity?

Greatest profit is raising penalty to the block reward, in which case total fees are at minimum about 3-4x the block reward

how do you know this?

Excel

doesn't this assume demand inelasticity?

If there's an infinite number of people who want to pay fees, and the penalties are zero, the profits would be infinity.

Well yes

at minimum I said

If the penalties are anything higher than zero, the profits would not be infinity

so it seems as if you can create some scenarios in which it is not beneficial. And it depends on the shape of the demand curve.

You'd have to convince a lot of miners to forego fees for many blocks (at least 51% usually)

No, in a hypothetical scenario when they can just make it up

So the dynamic effect does not kick in, quite hard to coordinate

then it would be best for them, in that scenario, to have 0 penalty

So what you have is a collective bargaining problem, price optimization, all that stuff

classical economics basically

Seems that way

Basically you'd be forcing static block rewards lol

block size*

Which can be independent of the penalty itself. Why not just force the static size to be the penalty free zone? Then you get block reward AND fees, just like bitcoin.

Actually no, still better to fill as many blocks as possible. Although the price point on fees would be different if available block size fell by 1/3, which may actually increase total income.

Maybe the most interesting dynamic is a miner cabal that enforces a fixed block size will raise profits for new blocks, inviting new miners in who will reduce the cabal's share of blocks and reduce the profitability of their hash power. In the end, profits will always stabilize at the standard profit rate, making the cabal's effort mostly useless (especially given how rapidly hash rate can respond to

changes in profit margins)!

When it comes to miner incentives, miners already have a strong incentive to keep locks small because they profit from the penalty

I covered this in my talk at the CDC in 36c3 frab.riat.at/en/36C3/public/events/125.html

Basically it comes down to the interaction between rational miners and users

So I do not see the need for additional miner incentives to keep blocks small

Monero is very different from Bitcoin in this

In Bitcoin it can e very profitable for miners to spam the network in order to force fees higher and this does occur

This type of spam attack does not work in Monero

It seems a large cabal of miners could artificially and temporarily force fixed block rewards, driving up fees.

fixed block sizes*

How does this incentive work?

Since fees can go quite high without dynamic changes to size

Although new miners would break the cabal, I wonder about a cyclic enforcement of fixed sizes. Although loss of profits on the downswing could counteract profit gains on the upswing

The long-term consequences on purchasing power might be dramatic though, if the network is suspected to be malicious

A large cabal of miners this sounds like a 51% attack

Yeah a new kind of 51% attack

and for starters 1) They have to pay the penalty upfront in order to create the large blocks 2) They loose the profit on the penalty on natural growth 3) There is a large incentive to break ranks and simply profit from the fees and penalty payments

and yes they loose also on the downside

An interesting thought experiment anyway

Some _very_ early work on a C++ test implementation of Triptych: SarangNoether/monero d806357

Please don't use it for anything even remotely important

brb launching a new coin

Goal is to do a practical verification complexity comparison with CLSAG and MLSAG

But this commit lacks a lot of optimizations, as well as a bunch of basic checks and tests

kind of cool that it's only like 600 loc

sarang: make sure to add a license header :)

Yep, haven't added that either !

selsta: done

sarang in your timelock construction, is the difference between the locktime of the input and output recorded in a similar fashion to the current transaction fee?

do you mean the hidden timelock construction?

yes

hm I think a tx records for its outputs: pedersen commitment to timelock, encoded timelock (similar to encoded amount); for its inputs' timelocks it records for each: pseudo timelock commitment, and a new reference timelock t' in cleartext which is >= the original timelock

the scheme might update timelock to be on a per-output basis, instead of per-tx basis, in which case the timelock commitment and encoded timelock would be one per output

ah, there would only be one reference timelock for the entire tx

What do you mean with "reference timelock"?