Cosmos Validator Economics — Bridging the Economic System of Old into the New Age of Blockchains

This blog post was co-authored by Felix Lutsch, Brian Crain and Meher Roy from Chorus One. It has been edited/updated as of July 2, 2019.

I. Cosmos Economic Design

Cosmos is an upcoming network of blockchains that could revolutionize the blockchain landscape by providing much-needed scalability and interoperability. The Cosmos Network will be secured jointly by the holders of atoms (the staking token of Cosmos) and validators, who will run consensus nodes to validate transactions and maintain network consensus.

Definitions:

We subsequently define key parts of the Cosmos system, as even people with a good understanding of Cosmos may not be aware of the current plans. We start by breaking down key components of the economic design.

Cosmos Hub

The Cosmos Hub is the first blockchain of the Cosmos Network. The hub will connect to many other blockchains, effectively functioning as a light client of those chains. This will allow token transfers across different chains to be routed via the hub.

Atoms

The atom is the native token of the Cosmos Hub. The core utility of atoms is to act as a staking mechanism to secure the Hub as deposits in the staking process. You can think of the atom as a virtualized ASIC of sorts, to loosely frame it in Proof-of-Work mining terms. The amount of atoms staked towards a validator defines the frequency by which the validator may propose a new block and its weight in votes to commit a block. For a deep dive into how weighted voting for validators works, read this blog post. In return for bonding (staking) atoms with their chosen validator, an atom holder, who has delegated (see below) becomes eligible for block rewards paid in atoms and photons, as well as transaction fees paid in any of the whitelisted tokens (see below).

Validators

Validators secure the Cosmos Hub by validating and relaying transactions, proposing, verifying and finalizing blocks. Validators can stake their own atoms or be delegated tokens from other atom holders. There will be a limited number of validators, initially 100, who will be individually required to operate highly reliable automated signing infrastructure. Validators must also keep their validation keys secure while connected to the P2P network to sign blocks. Validators will be able to charge delegators a commission in atoms for their work in securing the network.

Delegators

Delegators of the Cosmos Hub are holders of the staking token, atoms, who use some or all of their atoms to secure the Cosmos Hub. There is no minimum amount of atoms required in order to stake atoms. They do so by selecting one or more validators and delegating their voting power to them by putting up atoms as collateral. In the case of misbehavior by the validator (for example, signing two different blocks at the same block height), part of the collateral deposited by both the errant validator and delegator will get slashed. In return, delegators can earn a proportion of the transaction fees as well as block rewards.

Inflationary Atoms

New atoms are created every block and distributed to validators and delegators participating in the consensus process. This provides an incentive to atom holders to not just passively hold their tokens in wallets, but to put them at risk in order to secure the network. The number of new atoms created per block is variable and depends on the percentage of the atom supply that is staked in the network. The target rate of atoms put up as collateral to secure the network is at least ⅔ of the total atom supply. If less atoms are staked, atom supply via block rewards increases up to a ceiling of 20% annualized inflation of the total supply. If more than ⅔ are being staked, atom block rewards decrease gradually down to a floor of 7% annualized inflation.

Transactions Fees

Transactions on the Cosmos Network will be subject to transaction fees similar to other existing blockchains. Unlike current blockchains, the Cosmos Network plans to accept a multitude of tokens for the purpose of payment of transaction fees (see whitelisting tokens below for more information). Resulting transaction fees, minus a network tax that goes into a reserve pool, are split among validators and delegators based on their stake. Funds from the reserve pool are planned to be used to increase the security and value of the Cosmos Network and may also be distributed in accordance with decisions from the governance system.

Governance

The Cosmos Network employs on-chain governance by letting token holders vote on proposals that can adjust parameters of the system, implement upgrades or change the written constitution governing the Cosmos Hub. (No written constitution governing the Cosmos Hub has yet been implemented.) Each zone in the network can have its own constitution and governance mechanism. Delegators implicitly take part in the voting process by inheriting the vote of the validator they are delegating to. Delegators are given an option to override the vote of the validator they delegated atoms to for a vote on a specific issue.

Photons

The current planned proposal for the Cosmos Network is to introduce a secondary token with the intent to be used to pay for fees in addition to the native staking token, atom. The idea is that by introducing a secondary fee token, currently called “photon”, the security of the network will be strengthened because it reduces the liquidity of atoms. The reasoning is that reducing the liquidity of atoms makes it harder for an attacker to obtain a large enough stake in the network to start an attack. The usage of atoms for staking purposes is further encouraged by dynamically inflating the atom supply based on the total amount of staked atoms as described above. Atoms minted in this way are distributed to validators and delegators that stake their atoms, effectively lowering the value of non-staked atoms in the process. The photon as a secondary token is planned to be highly liquid and features an inflation rate that asymptotically reaches 0. Newly created photons will be distributed to validators and delegators to reward their contribution. Validators will be able to charge commission on these rewards. As of this writing, whether the Cosmos Network will introduce photons will be resolved by governance on the Cosmos Hub.

Hard Spoon

The photon is likely to be distributed to bonded-atom, ether, and bitcoin holders through a hard spoon, which is comparable to an airdrop, using a snapshot of the state of their respective blockchains at a given block height (another parameter which will be determined through governance). This is achieved by creating a zone in the Cosmos Network specifically for the purpose of claiming photons. This zone mirrors the account balances of ether holders, which may then be transferred to other zones (e.g. Ethermint zones) to pay transaction fees in those zones. The process of this hard spoon is explained in some detail in the official introductory blog post. The hard spoon aims to incentivize ether users to migrate to the Cosmos Network to benefit from the higher performance of the network. Parameters of the hard spoon are planned to be subject to a governance vote, where modalities of the hard spoon, e.g. the distribution between ether and atom holders and the inflation rate of photons, will be decided. Core questions around how the hard spoon will be executed and what the economic parameters around photons will be addressed after mainnet launch.

Commission Rates

To incentivize running a validator instead of only delegating atoms to a validator, validators will be able to charge commissions for the service they provide. Validators could set a commission rate of their choice, for example 15%, which by default is applied uniformly across all fees and block rewards (i.e. atoms and photons). Then, 85% of the revenues generated would go to the delegators and 15% would be retained by the validator for providing its service. Validators could compete on features, security, and commission rate, etc. Meanwhile, delegators could select those validators whose offer, services, and safety threshold most suited for them.

Validators can charge some variable commission rate on block rewards paid in atoms, photons and on transactions fees from whitelisted tokens. As of now, the default mode is a single commission rate for atom and photon block rewards, as well as transaction fees. However, if the community chooses to change this setting later for variable commission rates per fee token, the community can do so through governance.

Whitelisting Tokens

In addition to the two Cosmos tokens, atom and photon, there are plans to whitelist other cryptocurrencies (e.g. bitcoin or ether) for paying transaction fees on the network, once those tokens become available on the Cosmos Hub. Which tokens will be accepted will be decided through governance votes. The token model paper expands on these possibilities. Whitelisted tokens can be accepted as payment for fees with validators deciding upon how they value each of these tokens.

II. Weighing the Costs & Benefits for Atom Holders

The economic viability of operating a validator is dependent on the prices of both atoms and photons, which could be entirely decoupled. The following paragraphs hopefully shed color onto the economic viability for atom holders to either set up a validator or simply delegate.

Tradeoffs in the Cosmos Network

The target of the Cosmos Network is to launch an Internet of Blockchains connected through a central hub. No single party should be able to control or censor the system in any way. This can be achieved by striking a balance between enabling enough independent validators to profitably run a secure validator, while at the same time ensuring that validators do not accumulate too much wealth and power (in the form of atoms) for providing their service. The ideal system would maximize the distribution of power without jeopardizing the overall security and performance of the network.

Cosmos uses a Proof-of-Stake BFT-based consensus system to achieve performance while maintaining decentralization, with delegators effectively voting for validators by means of delegating their atoms towards the validator they feel aligns best with their, and the overall networks’, interests. Several mechanisms designed to punish undesirable validator behavior (slashing) are also put in place.

The ‘Rich Get Richer’ Myth

A pervasive myth that critics of decentralized systems secured by Proof-of-Stake argue is that validators can rapidly accumulate staking tokens and eventually gain network control.

The following example uses realistic assumptions, tied back to the Cosmos Network, to show that accumulating a larger stake in the network through commision on atom block rewards will take an inordinately long time and does not lead to over-concentration of atom holdings.

• Total atom supply at launch: 230,000,000
• Average annual inflation: 10%
• Assumed average commission on atom rewards: 10%
• Annual commission income for all validators (in atoms): 2,300,000
• Profit margins: 50%
• Annual profits across all validators (in atoms) 1,150,000 (0.5% of supply)

Let’s assume that over 10 years (an eternity in blockchain time), validators can maintain high profit margins and commission rates of 50% and 10% respectively. In addition, over 10 years, validators keep all of their profits in atoms. They pay no dividends, return no money to investors, do not hedge their balance sheets by converting atoms to fiat currencies, do not invest atom rewards into growing their business or sell atoms to fund validation efforts in other PoS networks. Then (and only then!) they end up earning 5% of the total token supply from commissions after 10 years. Therefore the claim that validators will rapidly accumulate atoms is incorrect.

Let’s also look at the decision that a large atom holder, a Cosmos whale, faces with a few assumptions:

• Annual inflation: 10%
• Cosmos whale’s atom holdings: 1,000,000
• Cost of operating a validator: US$300,000 annually

Assume that validators are charging commission in atoms and the average commission rate were 20%. If the whale delegated to another validator and she were to pay 1,000,000 atoms*10%(inflation)*20%(commission) = 20,000 atoms annually for the service. So if she expects the atom price to exceed US$15, it would be rational for her to operate a validator instead of delegating.

With the ‘rich get richer’ myth out of the way, let us focus on principles of blockchain security and and how economic specifications incentivize a network of diverse validators to ensure a decentralised network.

Blockchain Security

The security of a blockchain network is determined by how expensive it is to attack it. To a significant extent, the cost to attack a network is positively correlated with the amount of money invested in the infrastructure to secure the network.

Let us illustrate this principle using Bitcoin. The current market capitalization of the Bitcoin network is ~$150bn. Current block rewards translate to roughly 6% inflation a year, so miners earn around $9bn annually in addition to transaction fees. The dynamic at play here is that miner revenues rise in conjunction with the appreciation of the total network value. Rising prices also means mining gets more profitable resulting in more money being spent on mining infrastructure, which in turn increases the security of the network and tends to drive profitability down again.

This is a great dynamic since a higher bitcoin price also means that more value is being secured by the network. And more value being secured by the network means that the profitability of a successful attack increases. So a properly designed system would see the cost of attacking the Bitcoin network rise by incentivising greater expenditure on mining. And that is exactly the way Bitcoin is designed.

What about Proof-of-Stake? One attack would be to buy up a lot of staking tokens and sign different blocks at the same height, forking the chain. Fortunately, PoS has very good game theoretic security making such an attack extremely expensive. If an attacker starts purchasing atoms, he drives up the price of the token driving up the price of the attack. Buying up ⅔ of the tokens could easily induce slippage, drive up the market cap by 10x, and cause such an attack to become extremely costly. In addition, if an attack were executed, a hard fork could be done that would slash the attackers tokens wiping out the entire capital deployed in its execution. This dynamic is extremely powerful and it means that we are unlikely to witness that kind of attack. This is even more true for Cosmos, because inflation incentivizes the staking of atoms, which will reduce the liquid supply and further drive up the cost of an attack.

But this does not mean that no attacks can be executed! Validators in Cosmos will need to constantly produce and sign new blocks. This means that their validation private key needs to be accessible from an always network-connected server. It cannot just sit in a bunker somewhere. If an attacker can gain control over the infrastructure and setup of validators, they can attack the network. In that case, a slashing of coins may still occur, but that is not an issue for that attacker since it is not their stake that gets destroyed, but that of the compromised validator and their delegators.

Thus, a far more likely way to attack a system like Cosmos than buying up a majority of staking tokens would be to try to bypass the operational security of the validators. The security of Cosmos will be driven to a large extent by how good of an infrastructure validators build. This infrastructure will include things like using HSMs, having physical security in data centers, provisioning backup validating servers in geographically diverse data centers, having a resilient sentry node setup, employing more information security personnel, securely generating keys, getting security audits done, installing host-based intrusion detection systems on validating nodes, etc. The collective knowledge of the Validator Working Group’s practical experience building such a system indicates that a validator setup could range from anywhere between $10,000 and $2,000,000 depending on the amount of security and resiliency sought after.

As a network, it is desirable that as the value secured by each validator increases, validators have the resources to upgrade their security setup. One example might be that in the beginning a validator may be fine with trusting 1–2 key people in the company who could theoretically attack their own system. At a later point in time, for example, when the validator secures more than $100,000,000, this would most likely be an unacceptable risk. Companies like Xapo, Coinbase or cryptocurrency exchanges all build complex systems that make them resilient to threats both from inside and outside. Validators as they grow also need to build such systems. Implementing such measures will increase the complexity and cost of running a validator as the network grows in value. And that is a good thing because it will mean that the cost of attacking the network increases with the value being secured.

What does this look like if commissions in atoms can be charged? Let’s use an example validator VCorp to illustrate this.

• Amount of atoms staked: 5,000,000
• Commission charged: 15%
• Atom inflation: 10%
• Atom price: US$5

VCorp is responsible for securing US$25,000,000 in value and its revenues are 5,000,000*10%*15% = 75,000 atoms or US$375,000. If the atom price suddenly increases to $50, VCorp is now responsible for securing US$250,000,000. This is a massive increase in responsibility, but its revenues have also increased to US$3,750,000. Thus, the company can invest in upgrading its security along with the value secured.

Therefore, we expect that as the value of the atom rises, competitive validators reputable for high-fidelity setups will reinvest into their operational security.

If the cost of securing a validator does not scale linearly with the value being secured, we should expect that competition between validators will result in lower commission rates over time.

Validator Incentives in the Cosmos Network

We will now look more rigorously at what determines the economics of operating a Cosmos validator. At launch of the Cosmos Network, the plan is to have a maximum of 100 validators. This number will expand to 300 over the course of ten years. Economically speaking, the incentives should be set in a such way that 100 validators are able to profit from running a validator. This means that there should be a positive payoff for validators after subtracting operating costs and profits to be gained by simply delegating atoms to another validator. Any setup outside of this equilibrium will either result in centralization of validator power, e.g. only the best/most popular validators are able to profitably run a validator, or in suboptimal validators, e.g. validators deploying insufficient security measures in an attempt to lower operating costs. When talking about operating costs in the following, we refer to the assumed minimal operating costs of running a secure validator. These should, as shown above, be positively correlated with the value a particular validator secures in the network.

The assumption for this equilibrium is that the ideal validators will be those that run the service professionally. Simply owning a lot of atoms does not qualify someone to be able to run a secure and reliable validator. The Cosmos Network has the potential to significantly impact the cryptocurrency ecosystem and the underlying incentives of the protocol are intended to enable the highest possible security guarantees, especially because Cosmos will be one of the first large-scale Proof-of-Stake networks.

The differences in profits between validating and delegating stems from the commission charged by validators for providing the validation service for delegators. As such, in the equilibrium, the least profitable validator should just about break-even with respect to his profits from commissions minus his operating costs.

In the current setup, this equilibrium written as an equation for the least profitable validator V with commission rate CRV and his stake-weighted share from delegation SDV, as well as overall photon (PP) and atom provisions (AP), aka block rewards in photons or atoms, translates to:

Transaction Fees

Transaction fees are enforced by validators by adding transactions to the blocks they are proposing. Because the Tendermint consensus protocol is very performant and the time between blocks is low, the Cosmos Hub will have a high transaction capacity. It is likely that for a long time, the Cosmos Hub will not have full blocks and users won’t have to outcompete each other by paying higher fees (above the spam limit) to get block space. The marginal cost of including a transaction for a block proposer is close to zero.

As we have seen with other blockchain networks, substantial revenues from transaction fees only occur when networks run at capacity and come with massive negative implications for usability. Following the equilibrium described above, assuming negligible transaction fees, validators can expect the commission on transaction fees they’ll receive to be close to zero (while the network is running under capacity).

A big caveat regarding the photon as a secondary fee token is that, over time, the value proposition of the photon to pay fees on the Cosmos Hub will inevitably become diluted, since many different zones will become connected to the Cosmos Hub and their respective tokens may potentially get whitelisted. If a user wants to move ETH from the Ethereum chain to a decentralized exchange chain via the Hub, they would prefer to pay the transaction fee on the hub in ETH instead of acquiring a separate token for that payment. Therefore, as the Cosmos Hub will become more connected, the utility of photons can decrease. But that doesn’t mean the photon does not have its use during the initial bootstrapping of the Cosmos Network.

*All observations up to this point are based on a medium term time horizon where the hard spoon already took place and photons have already been distributed among atom and ether holders and are being openly traded in the market.

III. In Closing

Given the complexities of the Cosmos Network, we are attempting to correctly align the incentives in order to enable the highest degree of security possible. We believe that competition between validators and an informed community of delegators will be able to help us enable massive, decentralized coordination on a scale previously achieved only by the likes of large transnational institutions.