pith. sign in

arxiv: 2606.06700 · v1 · pith:QYC5HWIJnew · submitted 2026-06-04 · 💻 cs.GT · cs.CR· econ.TH

The Economics of Proof-of-Useful-Work

Rafael Pass This is my paper

Pith reviewed 2026-06-27 22:50 UTC · model grok-4.3

classification 💻 cs.GT cs.CRecon.TH
keywords proof of useful workblockchain economicscompetitive equilibriummachine learning inferencecryptocurrency securityduplex computationtoken adoption
0
0 comments X

The pith

In equilibrium, proof-of-useful-work keeps the economic cost of a majority attack equal to the block reward.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper builds a competitive equilibrium model in which compute can be split among pure mining, pure machine-learning inference, or duplex modes that deliver both with some overhead. Equilibrium allocations and prices are pinned down by the size of duplex overheads and one ratio that measures how large the token market is relative to the inference market. This setup produces three regimes: one that reduces to ordinary proof-of-work, one in which duplex work displaces mining and raises security while useful output stays fixed, and one in which token rewards act as rebates that lower inference prices and pull in extra useful computation. The model shows that market prices adjust so that the cost of attacking the ledger remains tied to the block reward even when the work produces external value. In the rebate regime the extra inference generated grows steadily with token adoption and with improvements in duplex efficiency.

Core claim

Once equilibrium prices are taken into account, the economic cost of a majority attack remains tied to the block reward; in the regime where token rewards subsidize inference, block rewards generate additional socially useful computation that would not otherwise occur, and the size of this expansion rises monotonically with token adoption and technological efficiency.

What carries the argument

Competitive-equilibrium model of compute allocation across pure mining, pure inference, and duplex modes, with allocations and prices fully determined by duplex overheads and the exogenous token-inference ratio, producing the regimes Bitconia, Fortessia, and Duplexia.

If this is right

  • The economic cost of a majority attack equals the block reward in every regime.
  • Duplex modes can replace pure mining while leaving or raising the cost of attack.
  • Token rewards function as rebates that expand the supply of inference beyond the level the inference market would produce alone.
  • The added inference volume grows steadily as token adoption rises or duplex overheads fall.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the model holds, PoUW systems could be designed so that larger token markets automatically increase the amount of inference hardware deployed.
  • Empirical tests could compare inference prices before and after a PoUW chain launches to check whether the predicted rebate effect appears.
  • The same equilibrium logic might apply to other subsidy mechanisms that mix ledger security with external productive work.

Load-bearing premise

A competitive equilibrium exists in the market for compute and fully determines allocations and prices from duplex overheads and the token-inference ratio.

What would settle it

Measure, in an operating PoUW system that has reached the rebate regime, whether the observed drop in inference prices and the resulting increase in inference quantity scale exactly with the block reward divided by the token-inference ratio.

Figures

Figures reproduced from arXiv: 2606.06700 by Rafael Pass.

Figure 1
Figure 1. Figure 1: Total spend in USD at duplex overhead (γ = 1.3), and its composition in terms of different activities. The labeled regions correspond to Bitconia, Fortessia, and Duplexia as described in Theorem 1. Note how in Duplexia, total amount spent on inference is lower than the value of this inference; this is due to the rebate on inference prices illustrated in [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Block-reward value and inference subsidy across regimes. The subsidy emerges in Du [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Duplex output space. A duplex operation producing (1 [PITH_FULL_IMAGE:figures/full_fig_p023_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Compute composition and security at duplex overhead ( [PITH_FULL_IMAGE:figures/full_fig_p046_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Varying T/I rate θ at fixed α = 1.3: each panel isolates one economic quantity and compares it a Bitcoin-style baseline. 44 [PITH_FULL_IMAGE:figures/full_fig_p047_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Sensitivity of the USD spend composition to demand elasticity. Higher elasticity strength [PITH_FULL_IMAGE:figures/full_fig_p049_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Welfare decomposition of Corollary 6 for ( [PITH_FULL_IMAGE:figures/full_fig_p052_7.png] view at source ↗
read the original abstract

Proof-of-work (PoW) blockchains rely on computational expenditure to secure a ledger supporting a native cryptocurrency. In existing systems such as Bitcoin, this expenditure is intentionally useless: the computation secures consensus but produces no external economic output. An emerging alternative -- proof of useful work (PoUW) -- enables the same computation to simultaneously secure the blockchain and generate economically valuable output. However, PoUW is often criticized on economic grounds: if the work is useful, attackers might be "paid to attack," potentially weakening security. We develop a competitive-equilibrium model of a PoUW blockchain in which compute can be allocated across pure mining, pure useful work -- instantiated as machine-learning inference -- or "duplex" work that produces both with computational overheads. We provide a complete closed-form characterization of equilibrium allocations and prices as a function of the duplex overheads and a single economic parameter -- the token-inference ratio -- measuring token adoption relative to the inference market. This characterization reveals three regimes: "Bitconia," in which the economy reduces to classical PoW; "Fortessia," in which duplex replaces mining, increasing security while useful output remains unchanged; and "Duplexia," in which token rewards subsidize inference, lowering prices and expanding inference supply. Contrary to the common strawman argument, PoUW does not make attacks economically cheap: once equilibrium prices are taken into account, the economic cost of a majority attack remains tied to the block reward. Moreover, in Duplexia, block rewards act as rebates on inference prices, generating additional socially useful computation that would not arise without the blockchain -- an expansion monotonically increasing in token adoption and technological efficiency.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The manuscript develops a competitive-equilibrium model of a PoUW blockchain in which compute is allocated across pure mining, pure ML inference, or duplex modes that combine both with overheads. It supplies a closed-form characterization of equilibrium allocations and prices as functions of duplex overheads and the single exogenous parameter (token-inference ratio), partitions the parameter space into three regimes (Bitconia, Fortessia, Duplexia), and concludes that equilibrium prices keep majority-attack costs tied to the block reward while Duplexia generates additional socially useful inference that expands monotonically with token adoption and efficiency.

Significance. If the closed-form equilibria are robust, the paper supplies a precise economic framework for assessing PoUW security and externalities, directly countering the 'paid to attack' critique and identifying conditions under which blockchain incentives expand useful computation beyond what would occur in a standalone inference market.

major comments (2)
  1. [Model setup and §4 (Duplexia regime)] The token-inference ratio is introduced and maintained as an exogenous parameter in the equilibrium derivation (see the model setup and the three-regime partition). The central Duplexia claim—that block rewards generate additional socially useful computation monotonically increasing in token adoption—requires that this ratio can be varied independently of inference-market size. If token adoption endogenously enlarges inference demand, the monotonicity result and regime boundaries would require re-derivation under a joint equilibrium; the current setup provides no such feedback loop.
  2. [Security analysis (attack-cost derivation)] The claim that 'the economic cost of a majority attack remains tied to the block reward' once equilibrium prices are taken into account is load-bearing for the security conclusion. The derivation should explicitly display the attack-cost expression (presumably in the security analysis section) and show the algebraic reduction that eliminates dependence on the useful-work component and the token-inference ratio.
minor comments (2)
  1. [Model section] Notation for the duplex overhead parameter and the token-inference ratio should be introduced with explicit symbols and units in the model section to improve readability of the closed-form expressions.
  2. [Abstract and §3] The abstract states that results are 'parameter-free' except for the token-inference ratio; the main text should clarify whether any other fitted or calibrated values enter the regime boundaries.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments, which help clarify the model's assumptions and strengthen the security analysis. We address each major point below, agreeing to revisions where they improve exposition while defending the current exogenous-parameter approach as appropriate for the paper's scope.

read point-by-point responses

  1. Referee: [Model setup and §4 (Duplexia regime)] The token-inference ratio is introduced and maintained as an exogenous parameter in the equilibrium derivation (see the model setup and the three-regime partition). The central Duplexia claim—that block rewards generate additional socially useful computation monotonically increasing in token adoption—requires that this ratio can be varied independently of inference-market size. If token adoption endogenously enlarges inference demand, the monotonicity result and regime boundaries would require re-derivation under a joint equilibrium; the current setup provides no such feedback loop.

    Authors: The token-inference ratio is deliberately maintained as an exogenous parameter to enable closed-form characterization of equilibria and clean comparative statics across adoption levels. This setup directly supports the monotonicity result in Duplexia as the ratio increases, holding the inference market fixed. An endogenous joint equilibrium linking token adoption to demand would constitute a distinct model and is outside the paper's current scope; we view the exogenous treatment as a standard and transparent modeling choice for isolating the blockchain's incentive effects. We will add a brief discussion in the conclusion acknowledging this limitation and identifying endogenous demand as a direction for future work. revision: partial

  2. Referee: [Security analysis (attack-cost derivation)] The claim that 'the economic cost of a majority attack remains tied to the block reward' once equilibrium prices are taken into account is load-bearing for the security conclusion. The derivation should explicitly display the attack-cost expression (presumably in the security analysis section) and show the algebraic reduction that eliminates dependence on the useful-work component and the token-inference ratio.

    Authors: We agree that the security claim benefits from explicit algebra. In the revised manuscript we will insert the full attack-cost expression in the security section and display the step-by-step reduction demonstrating that, after substituting equilibrium prices, the cost depends only on the block reward and is independent of both the useful-work overhead parameters and the token-inference ratio. revision: yes

Circularity Check

0 steps flagged

No circularity; equilibria derived from exogenous parameter with independent content

full rationale

The paper introduces the token-inference ratio explicitly as an exogenous parameter and derives a closed-form characterization of allocations, prices, and three regimes (Bitconia, Fortessia, Duplexia) as functions of this parameter plus duplex overheads. The monotonic expansion claim in Duplexia follows from the model's equilibrium equations without any reduction of outputs to fitted inputs, self-definitions, or self-citation chains. No load-bearing step renames a known result or imports uniqueness from prior author work. This is a standard theoretical model whose central claims remain falsifiable against external market data.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 0 invented entities

The analysis introduces the token-inference ratio as a free parameter and relies on the domain assumption of competitive equilibrium to obtain closed-form results; no independent evidence or machine-checked support is mentioned.

free parameters (1)
  • token-inference ratio
    Single economic parameter measuring token adoption relative to the inference market; determines regime and equilibrium allocations and prices.
axioms (1)
  • domain assumption Competitive equilibrium exists and determines unique allocations and prices for compute across mining, inference, and duplex modes
    Invoked to derive the complete closed-form characterization of equilibria as a function of duplex overheads and the token-inference ratio.

pith-pipeline@v0.9.1-grok · 5822 in / 1448 out tokens · 39901 ms · 2026-06-27T22:50:04.144340+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

38 extracted references

  1. [1]

    Bitcoin pricing, adoption, and usage: Theory and evidence

    Susan Athey, Ivo Parashkevov, Vishnu Sarukkai, and Jing Xia. Bitcoin pricing, adoption, and usage: Theory and evidence. Technical report, Stanford Graduate School of Business, 2016

    2016

  2. [2]

    Proofs of useful work

    Marshall Ball, Alon Rosen, Manuel Sabin, and Prashant Nalini Vasudevan. Proofs of useful work. InAdvances in Cryptology – CRYPTO 2017, volume 10402 ofLecture Notes in Computer Science, pages 283–312. Springer, 2017

    2017

  3. [3]

    Proof of work with external utilities, 2025

    Yogev Bar-On, Ilan Komargodski, and Omri Weinstein. Proof of work with external utilities, 2025. 54

    2025

  4. [4]

    Review of Cournot’sRecherches sur les Principes Math´ ematiques de la Th´ eorie des Richesses.Journal des Savants, pages 499–508, 1883

    Joseph Bertrand. Review of Cournot’sRecherches sur les Principes Math´ ematiques de la Th´ eorie des Richesses.Journal des Savants, pages 499–508, 1883

  5. [5]

    George Bissias, Rainer B¨ ohme, David Thibodeau, and Brian N. Levine. Pricing security in proof-of-work systems, 2020

    2020

  6. [6]

    Levine, and David Thibodeau

    George Bissias, Brian N. Levine, and David Thibodeau. Greedy but cautious: Conditions for miner convergence to resource allocation equilibrium, 2019

    2019

  7. [7]

    The economic limits of bitcoin and the blockchain.NBER Working Paper, (24717), 2018

    Eric Budish. The economic limits of bitcoin and the blockchain.NBER Working Paper, (24717), 2018

    2018

  8. [8]

    Trust at scale: The economic limits of cryptocurrencies and blockchains.The Quarterly Journal of Economics, 140(1):1–62, 2025

    Eric Budish. Trust at scale: The economic limits of cryptocurrencies and blockchains.The Quarterly Journal of Economics, 140(1):1–62, 2025

    2025

  9. [9]

    Optimization-based proof of useful work: Framework, modeling, and security analysis, 2024

    Weihang Cao, Xintong Ling, Jiaheng Wang, Xiqi Gao, and Zhi Ding. Optimization-based proof of useful work: Framework, modeling, and security analysis, 2024

    2024

  10. [10]

    ScaloWork: Useful proof- of-work with distributed pool mining, 2025

    Diptendu Chatterjee, Avishek Majumder, and Subhra Mazumdar. ScaloWork: Useful proof- of-work with distributed pool mining, 2025

    2025

  11. [11]

    Bitcoin Hashrate Chart.https://www.coinwarz.com/mining/bitcoin/ hashrate-chart, May 2026

    CoinWarz. Bitcoin Hashrate Chart.https://www.coinwarz.com/mining/bitcoin/ hashrate-chart, May 2026. Reports Bitcoin network hashrate of 1.020 ZH/s as of May 31, 2026

    2026

  12. [12]

    Tokenomics: Dynamic adoption and valuation

    Lin William Cong, Ye Li, and Neng Wang. Tokenomics: Dynamic adoption and valuation. Review of Financial Studies, 34(3):1105–1155, 2021

    2021

  13. [13]

    Hachette, Paris, 1838

    Antoine Augustin Cournot.Recherches sur les Principes Math´ ematiques de la Th´ eorie des Richesses. Hachette, Paris, 1838. English translation:Researches into the Mathematical Principles of the Theory of Wealth, Macmillan, 1897

  14. [14]

    Energy equilibria in proof-of-work mining

    Amos Fiat, Anna Karlin, Elias Koutsoupias, and Christos Papadimitriou. Energy equilibria in proof-of-work mining. InProceedings of the 2019 ACM Conference on Economics and Computation, pages 489–502, 2019

    2019

  15. [15]

    Macmillan, 1911

    Irving Fisher.The Purchasing Power of Money: Its Determination and Relation to Credit, Interest and Crises. Macmillan, 1911

    1911

  16. [16]

    The quantity theory of money—a restatement

    Milton Friedman. The quantity theory of money—a restatement. In Milton Friedman, editor, Studies in the Quantity Theory of Money, pages 3–21. University of Chicago Press, 1956

    1956

  17. [17]

    Zero-Cost

    Joshua S. Gans and Hanna Halaburda. “Zero-Cost” majority attacks on permissionless blockchains.Management Science, 70(6):3381–3396, 2024

    2024

  18. [18]

    The bitcoin backbone protocol: Analysis and applications

    Juan Garay, Aggelos Kiayias, and Nikos Leonardos. The bitcoin backbone protocol: Analysis and applications. InAnnual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT). Springer, 2015

    2015

  19. [19]

    Harberger

    Arnold C. Harberger. The measurement of waste.American Economic Review, 54(3):58–76, 1964. 55

    1964

  20. [20]

    Macmillan, London, 1865

    William Stanley Jevons.The Coal Question: An Inquiry Concerning the Progress of the Nation and the Probable Exhaustion of Our Coal Mines. Macmillan, London, 1865

  21. [21]

    Primecoin: Cryptocurrency with prime number proof-of-work.https:// primecoin.io/primecoin-paper.pdf, 2013

    Sunny King. Primecoin: Cryptocurrency with prime number proof-of-work.https:// primecoin.io/primecoin-paper.pdf, 2013. Whitepaper

    2013

  22. [22]

    Proofs of useful work from arbitrary matrix multipli- cation.CoRR, abs/2504.09971, 2025

    Ilan Komargodski and Omri Weinstein. Proofs of useful work from arbitrary matrix multipli- cation.CoRR, abs/2504.09971, 2025

    arXiv 2025

  23. [23]

    Abba P. Lerner. The concept of monopoly and the measurement of monopoly power.Review of Economic Studies, 1(3):157–175, 1934

    1934

  24. [24]

    J. D. Leshno, Elaine Shi, and Rafael Pass. On the viability of open-source financial rails: Economic security of permissionless consensus.arXiv preprint, 2024

    2024

  25. [25]

    Whinston, and Jerry R

    Andreu Mas-Colell, Michael D. Whinston, and Jerry R. Green.Microeconomic Theory. Oxford University Press, New York, 1995

    1995

  26. [26]

    Bitcoin: A peer-to-peer electronic cash system

    Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system. 2008. White paper

    2008

  27. [27]

    Zk-SNARK market- place with proof of useful work, 2025

    Samuel Oleksak, Richard Gazdik, Martin Peresini, and Ivan Homoliak. Zk-SNARK market- place with proof of useful work, 2025

    2025

  28. [28]

    the economics of proofs of useful work

    Rafael Pass. Computational companion notebook for “the economics of proofs of useful work”. https://colab.research.google.com/drive/1mUryko3WD-Q1bQ-Z9ItrJbluFoXxx6IR,

  29. [29]

    Interactive simulation notebook

  30. [30]

    Analysis of the blockchain protocol in asynchronous networks

    Rafael Pass, Lior Seeman, and Abhi Shelat. Analysis of the blockchain protocol in asynchronous networks. InAnnual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT). Springer, 2017

    2017

  31. [31]

    The pearl network.https://pearlresearch.ai, 2026

    Pearl Research Labs. The pearl network.https://pearlresearch.ai, 2026. Accessed: 2026

    2026

  32. [32]

    Saunders

    Harry D. Saunders. The khazzoom–brookes postulate and neoclassical growth.The Energy Journal, 13(4):131–148, 1992

    1992

  33. [33]

    Reexamination of the perfectness concept for equilibrium points in extensive games.International Journal of Game Theory, 4(1):25–55, 1975

    Reinhard Selten. Reexamination of the perfectness concept for equilibrium points in extensive games.International Journal of Game Theory, 4(1):25–55, 1975

    1975

  34. [34]

    VanEck Mid-March 2026 Bitcoin ChainCheck.https://www.vaneck.com/us/ en/blogs/digital-assets/matthew-sigel-vaneck-mid-march-2026-bitcoin-chaincheck/, March 2026

    Matthew Sigel. VanEck Mid-March 2026 Bitcoin ChainCheck.https://www.vaneck.com/us/ en/blogs/digital-assets/matthew-sigel-vaneck-mid-march-2026-bitcoin-chaincheck/, March 2026. Data from Glassnode as of March 13, 2026

    2026

  35. [35]

    The Real Cost of Bitcoin Mining in 2026.https://www.simplemining.io/ insights/post/bitcoin-mining-cost-2026, May 2026

    Simple Mining. The Real Cost of Bitcoin Mining in 2026.https://www.simplemining.io/ insights/post/bitcoin-mining-cost-2026, May 2026. Reports modern S21-class miners at$4,000–12,000 per unit with efficiency of 13.5–17.5 W/TH

    2026

  36. [36]

    Jevons’ paradox revisited: The evidence for backfire from improved energy efficiency.Energy Policy, 37(4):1456–1469, 2009

    Steve Sorrell. Jevons’ paradox revisited: The evidence for backfire from improved energy efficiency.Energy Policy, 37(4):1456–1469, 2009

    2009

  37. [37]

    equation of exchange

    Gordon Tullock. Efficient rent seeking. In James M. Buchanan, Robert D. Tollison, and Gordon Tullock, editors,Toward a Theory of the Rent-Seeking Society, pages 97–112. Texas A&M University Press, 1980. 56 A A Simple Monetary Interpretation of the T/I Ratio This appendix shows that the token/inference ratioθ= P R pQ admits a simple monetary interpretation...

    1980

  38. [38]

    constant per-period

    used in monetary models (transactional expenditure equals price times velocity times circulating balances) and in crypto-asset pricing analyses such as [1]. 2.Float inflow from issuance.A fractionν∈(0,1] of newly issued tokens enters the settle- ment float each block, capturing the idea that miners sell a portion of rewards into transac- tional circulatio...