Bit gold markets

The basic idea of bit gold is for "bit gold miners" to set their computers to solving computationally intensive mathematical puzzles, then to publish the solutions to these puzzles in secure public registries, giving them unique title to these provably scarce and securely timestamped bits. These titles to timestamped bits will be more secure and provably scarce than precious metals, collectibles, and any other objects that have ever been used as money. In a description of bit gold, which was mostly an overview of the technology, I wrote about how, because the algorithms and architectures for solving computationally intensive mathematical puzzles to create bit gold will often be dramatically improved, the bits (the puzzle solutions) from one period (anywhere from seconds to weeks, let's say a week) to the next are not fungible. But fungible units can be created from non-fungible ones:

bit gold will not be fungible based on a simple function of, for example, the length of the string. Instead, to create fungible units dealers will have to combine different-valued pieces of bit gold into larger units of approximately equal value. This is analogous to what many commodity dealers do today [pooling commodities with a wide variety of qualities into a handful of standard grades] to make commodity markets possible.

Bit strings (puzzle problem/solution pairs) are securely timestamped by their time of publication. More recent solutions that have been produced in greater quantities will be discounted by markets. To create fungible units dealers will bundle strings of different value into pools of a standard value (i.e. collect strings into a pool so that the sum of the market values of the strings in the pool add up to the standard value).

It's a bit indirect, but computers can easily handle these logistics. Leaving aside the gold metaphor for a minute, one can think of these bit strings as digital rare postage stamps. Each stamp might trade for a different price, but one can sort stamps into pools so that the prices of stamps in each pool add up to the same total price. Then divide each pool into tranches to create your standard currency denominations.

The rare stamp metaphor is, however, in other ways very misleading. Unlike stamps, but like gold, there are no ongoing changes in subjective valuations between bit strings to worry about, but instead the demand for bit gold is purely for its monetary functions, and thus purely based on how scarce the supply of puzzles solved during a given time period was and is. As a result, pooling and tranching will work far better for bit gold than it does for actual rare postage stamps.

This deserves more elaboration. It seems to be a common objection to bit gold that the mere difference in the price of a bit from one time period to the next produced by technology improvements introduce intractible subjective valuations, making the matter of comparing one week to the next subject to too much uncertainty and transaction costs, as occurs with many collectibles. Just as pooling and tranching rare postage stamps would be a somewhat risky affair as subjective valuations of the underlying stamps change, so too this is supposed for bit gold.

The problem that would occur if we tried to turn most collectibles into a standard currency by pooling and tranching is that, besides a subjective aesthetic component in the demand curve that doesn't come into play with computer bits, their scarcity is uncertain. Art can turn out to be forged, rare stamps thought to be lost or to have never existed might be found, and so on. The supply curve, in other words, can be highly uncertain and in danger of elasticity. Since the supply and demand curves of different pools can change differently over time, the relative values of pools would diverge from their initial values, so that trying to use tranches as standard denominations of a currency would create arbitrage opportunities.

By sharp contrast bit gold will be entirely public: no one gains secure title to any puzzle solutions until they are published. Thus, the exact amount and kind of puzzle solutions during a given period are well known, and perfectly define the supply curve relative to future weeks for all time thereafter.

There will be, in other words, a perfectly objective, measurable, and inelastic supply curve, completely derivable from the relative scarcity of bits (puzzle solutions) on the week (or the day, or the hour, or the minute, if necessary) of their publication. Arbitrage to set the different prices of different weeks (or minutes) can be computerized on this basis. The demand curve, the demand for puzzle solutions for the monetary functions they can perform as a store of value and medium of exchange, will be based on recognition of the superiority of bit gold as a form of money that is more secure and has a far less elastic supply curve than traditional commodities such as precious metals. Since there are no aesthetic differences, the demand curve will be the same function of scarcity for all weeks (or minutes), so it won't affect the simple scheme of automated arbitrage between epochs with different supply curves. The supply and demand curves of different pools will change in the same way over time, and the relative values of pools will not diverge from their initial relative values. Using tranches as standard denominations for a currency does not create arbitrage opportunities.

For most of history collectibles were used for as stores of value and media of exchange; aesthetics played an important role. But before we can separate out the roles of scarcity and aesthetics, we must ask why humans evolved such aesthetic values. The aesthetic instincts, for example the instinct to collect shiny things, evolved just because in the evolutionary environment they approximated an instinct to collect scarce things, and to distinguish hard-to-find from easy-to-find things, i.e. an instinct to recognize and collect objects that can best perform monetary functions, as I describe here, in the "Evolution..." section early in the paper, and the "Attributes of Collectibles" section late in the paper.

As a proximate matter, the contribution to the demand curve from demand for monetary functions (store of value or medium of exchange or both) and the contribution from aesthetic considerations are completely separable. One can demand a commodity for its aesthetic value, or for its value as money, or for both, or for neither. Thus a check for a million dollars might have a design that is utterly philistine, yet the check is still worth a million dollars.

The value of gold today is almost entirely based on its monetary value rather than mere aesthetic value. There are plenty of metals that are as shiny and smooth as gold, but people don't demand them as a store of value or medium of exchange because they are common. There are plenty of rocks that look as good as diamonds, but "diamonds are a girl's best friend" because they are hard to obtain and thus hold their value. Value comes to attach to the unique aesthetic features of gold or diamonds because these features signal scarcity. The value of precious metals or gems as stores of value, media of exchange, or even as cultural icons does not come from these aesthetic features, it is only signalled by them. It is their secure scarcity, not their aesthetic features, that allows them to be more securely used as a store of value and thus gives them a monetary value, and often a corresponding emotional and cultural value, far above the often trivial value they would have if they had the same aesthetics but were common.

There will be a problem defining futures contracts for yet-to-be produced bit gold: how much it might cost to solve a given puzzle a year later, or even a month, will be a very uncertain matter. But the pools that define currencies will be based on spot prices for already produced bit gold, not on futures.

[These comments edit and add to comments of mine under previous blog post(s)]

Bit gold

A long time ago I hit upon the idea of bit gold. The problem, in a nutshell, is that our money currently depends on trust in a third party for its value. As many inflationary and hyperinflationary episodes during the 20th century demonstrated, this is not an ideal state of affairs. Similarly, private bank note issue, while it had various advantages as well as disadvantages, similarly depended on a trusted third party.

Precious metals and collectibles have an unforgeable scarcity due to the costliness of their creation. This once provided money the value of which was largely independent of any trusted third party. Precious metals have problems, however. It's too costly to assay metals repeatedly for common transactions. Thus a trusted third party (usually associated with a tax collector who accepted the coins as payment) was invoked to stamp a standard amount of the metal into a coin. Transporting large values of metal can be a rather insecure affair, as the British found when transporting gold across a U-boat infested Atlantic to Canada during World War I to support their gold standard. What's worse, you can't pay online with metal.

Thus, it would be very nice if there were a protocol whereby unforgeably costly bits could be created online with minimal dependence on trusted third parties, and then securely stored, transferred, and assayed with similar minimal trust. Bit gold.

My proposal for bit gold is based on computing a string of bits from a string of challenge bits, using functions called variously "client puzzle function," "proof of work function," or "secure benchmark function.". The resulting string of bits is the proof of work. Where a one-way function is prohibitively difficult to compute backwards, a secure benchmark function ideally comes with a specific cost, measured in compute cycles, to compute backwards.

Here are the main steps of the bit gold system that I envision:

(1) A public string of bits, the "challenge string," is created (see step 5).

(2) Alice on her computer generates the proof of work string from the challenge bits using a benchmark function.

(3) The proof of work is securely timestamped. This should work in a distributed fashion, with several different timestamp services so that no particular timestamp service need be substantially relied on.

(4) Alice adds the challenge string and the timestamped proof of work string to a distributed property title registryfor bit gold. Here, too, no single server is substantially relied on to properly operate the registry.

(5) The last-created string of bit gold provides the challenge bits for the next-created string.

(6) To verify that Alice is the owner of a particular string of bit gold, Bob checks the unforgeable chain of title in the bit gold title registry.

(7) To assay the value of a string of bit gold, Bob checks and verifies the challenge bits, the proof of work string, and the timestamp.

Note that Alice's control over her bit gold does not depend on her sole possession of the bits, but rather on her lead position in the unforgeable chain of title (chain of digital signatures) in the title registry.

All of this can be automated by software. The main limits to the security of the scheme are how well trust can be distributed in steps (3) and (4), and the problem of machine architecture which will be discussed below.

Hal Finney has implemented a variant of bit gold called RPOW (Reusable Proofs of Work). This relies on publishing the computer code for the "mint," which runs on a remote tamper-evident computer. The purchaser of of bit gold can then use remote attestation, which Finney calls the transparent server technique, to verify that a particular number of cycles were actually performed.

The main problem with all these schemes is that proof of work schemes depend on computer architecture, not just an abstract mathematics based on an abstract "compute cycle." (I wrote about this obscurely several years ago.) Thus, it might be possible to be a very low cost producer (by several orders of magnitude) and swamp the market with bit gold. However, since bit gold is timestamped, the time created as well as the mathematical difficulty of the work can be automatically proven. From this, it can usually be inferred what the cost of producing during that time period was.

Unlike fungible atoms of gold, but as with collector's items, a large supply during a given time period will drive down the value of those particular items. In this respect "bit gold" acts more like collector's items than like gold. However, the match between this ex post market and the auction determining the initial value might create a very substantial profit for the "bit gold miner" who invents and deploys an optimized computer architecture.

Thus, bit gold will not be fungible based on a simple function of, for example, the length of the string. Instead, to create fungible units dealers will have to combine different-valued pieces of bit gold into larger units of approximately equal value. This is analogous to what many commodity dealers do today to make commodity markets possible. Trust is still distributed because the estimated values of such bundles can be independently verified by many other parties in a largely or entirely automated fashion.

In summary, all money mankind has ever used has been insecure in one way or another. This insecurity has been manifested in a wide variety of ways, from counterfeiting to theft, but the most pernicious of which has probably been inflation. Bit gold may provide us with a money of unprecedented security from these dangers. The potential for initially hidden supply gluts due to hidden innovations in machine architecture is a potential flaw in bit gold, or at least an imperfection which the initial auctions and ex post exchanges of bit gold will have to address.