[bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 7949 bytes --]

I start with a formalisation of loans as common in finance:

A zero bond is a contract between two parties Alice and Bob whereby Alice receives an amount less than P and has to pay back P at a later time point called maturity.
The difference between the amount received and P is the interest implied by the contract. E.g. receiving 1 Bitcoin (<P) and agree to pay back 1.1 (=P) in a year is the same as getting a loan with 10% p.a. interest.

The inherent risk in the contract is that Alice may not honor the agreement or be bankrupt by then.

If we could programmatically guarantee that Alice honors the contract then we would be able to create a riskless zero bond, the fundation of financial engineering.

A systemic problem with loans is that the lender might operate on fractional reserve, that is lending more than his capital.

Unchecked inflation of money supply through fractional reserve is creating a mess in the world we live in. Bitcoin could overcome this mess implementing this proposal!

I stop here with finance speak as the purpose of this mail is not to dive into finance, but to show how loans with full reserve check could be implemented in Bitcoin.

1. Receiving the loan is a payment from Bob to Alice, but we need a restriction how Alice can use the funds, so Bob can get them back unconditionally at maturity, so lending is riskless to him.
2. Bob wants to receive interest, since he gives up his control of the coins until maturity, he can not use them elsewhere until then. That interest could be paid in advance, this can be solved with Bitcoin as is.

How do we allow Alice to use the coins, that is: split/merge and transfer them to others, but still ensure Bob can claim them back at maturity?

We ensure that Alice can only send the coins to outputs that inherit a taproot path of validation (using http://bitcoin.sipa.be/miniscript/): 'and(time(100),pk(C))' where C is Bob’s key and 100 is maturity

This requires a generalization of the Bitcoin Covenants Idea[1] such that it nicely fits with taproot as follows:

1. A covenant in the form of '_ covenant C’ on output means that it can be spent to an output that maches the covenant pattern with placeholder _  and the output(s) will be assigned 'covenant C'.
2. A covenant that mandates an output script with alternate validation paths can also assign alternate covernants to be inherited by the output(s) depending on which path was used to spend the input eg. 'covenant or(c covenant C, d covernant D)’
3. The resulting covenant of outputs should be reduced following boolean algebra, e.g. or(b,or(b,a)) to or(b, a)
4. express transitivity with 'covenant transitive’ which means the output will have the same covenant as the input
5. allow to omit covenant on the output with 'covenant drop'

The covenant Bob would assign to the loan output sent to Alice is: 'covenant or(and(time(100),pk(Bob)) covenant drop, _ covenant transitive)' which means:
- Alice can send to an output script where she is free to chose the embedded script at the placeholder _ and that output will again have the same covenant as the input.
- After maturity Bob can claim any coin that is transitively rooted in the loan (more on this later) and the covenant will no longer be assigned to his new output(s).

Assuming Alice wants to send some of the borrowed coins to Charlie:

for shorter notation lets use b='and(time(100),pk(Bob)) covenant drop’ for the script that gives Bob control after maturity.

Alice can not send to pk(Charlie), but she can send to or(b, pk(Charlie) covenant transitive)
Sending to pk(Charlie) would be sending cash, sending to or(b, pk(Charlie) covenant transitive) is a promissory note issued by Alice to Charlie, here is why:

If Charlie accepts an or(b, pk(Charlie) covenant transitive) output then he trusts, that Alice will offer a regular payment in exchange for it before maturity, since that output is worthless to Charlie after maturity as Bob can just take it.

It seems at the first sight that there is no value in these outputs for Charlie, since he still has to ensure Alice replaces them before maturity.

The value of these outputs to Charlie is the proof that he has exclusive control of the coins until maturity.
Alice can not issue promissory notes in excess of own capital or capital that she was able to borrow. No coin inflation or fractional reserve here, which also reduces the credit risk Charlie takes.

Due to the transitive covenant Charlie could pass on the coins to an other temporary owner until maturity when Bob would re-collect them unconditionally.

Should Charlie no longer be comfortable with Alice’s promise or need final coins (cash) immediatelly, then he could turn to Dan and do a re-purchase (repo) agreement with him.

Charlie would receive final coins from Dan in exchange for the temporarily controled coins and Charlie's promise to replace them with final coins before maturity.
Dan would thereby charge high interest through a discount since as he has to bear the credit risk of Charlie. This is not a riskless but a plain zero bond.

Why would Dan want to take temporary control of the coins at all? Again, to ensure Charlie is not doing yet another repo with Frank on the same coins, the sum of Charlie's repo deals are not in excess of his claims against others.
This again avoids lending in excess of coin supply and reduces the credit risk Dan takes.

Here are the sketches for the transacions for above alternate actions:

lets use shortcut c for 'or(and(time(100),pk(Bob)) covenant drop, _ covenant transitive)’

the transactions offer a fee of 0.0001

Bob gives a riskless credit to Alice:

Input			Output
1 pk(Bob) 		1 or(b,pk(Alice) covenant c)
0.1 pk(Alice)		0.9999 pk(Bob)

Alice could send a 0.5 promissory note to Charlie:

Input					Output
1 or(pk(Alice) covenant c)		0.5 or(b,pk(Charlie) covenant c)
1 pk(Alice)				0.5 or(b,pk(Alice) covenant c)
					0.9999 pk(Alice)

Alice could make good of the note before maturity, pay some interest and get back temporary control of the coins with:
Input						Output
0.5 or(b,pk(Charlie) covenant c)		0.5 or(b,pk(Alice) covenant c)
0.5101 pk(Alice)				0.51 pk(Charlie)

alternatively Charlie borrows from Dan at high interest:

Input						Output
0.5 or(b,pk(Charlie) covenant c)		0.5 or(b,pk(Dan) covenant c)
0.3001 pk(Dan)				0.3 pk(Charlie)

and Charlie re-purchases the temporary coins before maturity, making good of the repo with Dan:

Input							Output
0.5 or(b,pk(Dan) covenant c)			0.5 or(b,pk(Charlie) covenant c)
0.5001 pk(Charlie)					0.5 pk(Dan)

We need to define further transaction level validations for transactions spending inputs with covenants as follows:

1. If there are inputs without covenant before the input with covenant than inputs without covenant must be spent exactly with outputs preceeding the outputs with covenants.
2. A transaction can have inputs with different covenants, their allocation to outputs should follow input order.
3. For output(s) that share input(s) with covenant, the sum of covenant outputs must exactly add up to the input(s). This allows merging and splitting them.

Bob would re-collect his coins at maturity unconditionally. Who followed through promises or defaulted down the transitive chain is irrelevant to him.
Remark: we might also need a covenant attribute defining the minimum size of output, so Bob is not forced to collect dust, which would be expensive or even impossible. I am not yet happy with this solution, looking for better.

I am very excited about the possibilities this proposal would unlock and ask you verify usefulness of this scheme and join working out the details and how covenants would be integrated with taproot.

Tamas Blummer

[1] Malte Moser, Ittay Eyal, and Emin Gun Sirer. Bitcoin Covenants. URL: http://fc16.ifca.ai/bitcoin/papers/MES16.pdf

[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

Hi Tamas,

There are a number of economic assumptions contained herein. While I understand you would like to focus on implementation, the worst bugs are requirements bugs. IMO these should be addressed first. I’ve addressed some possible issues inline.

> On Jun 28, 2019, at 01:27, Tamas Blummer via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:
> 
> I start with a formalisation of loans as common in finance:
> 
> A zero bond is a contract between two parties Alice and Bob whereby Alice receives an amount less than P and has to pay back P at a later time point called maturity.
> The difference between the amount received and P is the interest implied by the contract. E.g. receiving 1 Bitcoin (<P) and agree to pay back 1.1 (=P) in a year is the same as getting a loan with 10% p.a. interest.
> 
> The inherent risk in the contract is that Alice may not honor the agreement or be bankrupt by then.
> 
> If we could programmatically guarantee that Alice honors the contract then we would be able to create a riskless zero bond, the fundation of financial engineering.

I’m not aware of the basis of this statement. While people use the term “risk free rate of return” there has never actually been such a thing. It’s not clear to me how a unicorn has been the foundation of “financial engineering”, but I’m not also clear and what is intended by “engineering” in this sense. Generally engineering is the implementation of higher level concepts. It is those concepts that constitute requirements here.

At a minimum, interest cannot be guaranteed by this proposal, which implies that at best it guarantees, setting aside changes in purchasing power, a return of principle minus economic interest on that principle (ie opportunity cost). Given that purchasing power changes over time, risk increases with the term of the loan. As such this is not riskless - both volatility and opportunity cost remain as risks.

> A systemic problem with loans is that the lender might operate on fractional reserve, that is lending more than his capital.

This is not a systemic problem, this is the very nature of lending. Fractional reserve is simply a state banking term used to describe the fact that people invest (lend) a fraction of their savings and hoard the rest. It matters not that banks or individuals do this, credit expansion is inherent in economy. Without it there is no investment and therefore no production whatsoever.

> Unchecked inflation of money supply through fractional reserve is creating a mess in the world we live in. Bitcoin could overcome this mess implementing this proposal!

You seem to be conflating state banking with the effects of investing. Taxpayer support for bank investment creates both a moral hazard (and the resulting misallocation of capital to state-favored projects, creating the famed economic “business cycle”) and is a manifestation of persistent monetary inflation (ie seigniorage is a source taxation. Investment implies credit expansion, and the level of this expansion is controlled by time preference alone.

> I stop here with finance speak as the purpose of this mail is not to dive into finance, but to show how loans with full reserve check could be implemented in Bitcoin.
> 
> 1. Receiving the loan is a payment from Bob to Alice, but we need a restriction how Alice can use the funds, so Bob can get them back unconditionally at maturity, so lending is riskless to him.
> 2. Bob wants to receive interest, since he gives up his control of the coins until maturity, he can not use them elsewhere until then. That interest could be paid in advance, this can be solved with Bitcoin as is.

Interest cannot be paid in advance. This implies nothing more than a smaller amount of principle.

> How do we allow Alice to use the coins, that is: split/merge and transfer them to others, but still ensure Bob can claim them back at maturity?
> 
> We ensure that Alice can only send the coins to outputs that inherit a taproot path of validation (using http://bitcoin.sipa.be/miniscript/): 'and(time(100),pk(C))' where C is Bob’s key and 100 is maturity
> 
> This requires a generalization of the Bitcoin Covenants Idea[1] such that it nicely fits with taproot as follows:
> 
> 1. A covenant in the form of '_ covenant C’ on output means that it can be spent to an output that maches the covenant pattern with placeholder _  and the output(s) will be assigned 'covenant C'.
> 2. A covenant that mandates an output script with alternate validation paths can also assign alternate covernants to be inherited by the output(s) depending on which path was used to spend the input eg. 'covenant or(c covenant C, d covernant D)’
> 3. The resulting covenant of outputs should be reduced following boolean algebra, e.g. or(b,or(b,a)) to or(b, a)
> 4. express transitivity with 'covenant transitive’ which means the output will have the same covenant as the input
> 5. allow to omit covenant on the output with 'covenant drop'
> 
> The covenant Bob would assign to the loan output sent to Alice is: 'covenant or(and(time(100),pk(Bob)) covenant drop, _ covenant transitive)' which means:
> - Alice can send to an output script where she is free to chose the embedded script at the placeholder _ and that output will again have the same covenant as the input.
> - After maturity Bob can claim any coin that is transitively rooted in the loan (more on this later) and the covenant will no longer be assigned to his new output(s).
> 
> Assuming Alice wants to send some of the borrowed coins to Charlie:
> 
> for shorter notation lets use b='and(time(100),pk(Bob)) covenant drop’ for the script that gives Bob control after maturity.
> 
> Alice can not send to pk(Charlie), but she can send to or(b, pk(Charlie) covenant transitive)
> Sending to pk(Charlie) would be sending cash, sending to or(b, pk(Charlie) covenant transitive) is a promissory note issued by Alice to Charlie, here is why:
> 
> If Charlie accepts an or(b, pk(Charlie) covenant transitive) output then he trusts, that Alice will offer a regular payment in exchange for it before maturity, since that output is worthless to Charlie after maturity as Bob can just take it.
> 
> It seems at the first sight that there is no value in these outputs for Charlie, since he still has to ensure Alice replaces them before maturity.
> 
> The value of these outputs to Charlie is the proof that he has exclusive control of the coins until maturity.

At a minimum, money that predictably depreciates (to zero in this case) must be discounted accordingly. How much is money worth today that is worth zero tomorrow? This can be observed with both inflation and demurrage money. This also implies that each encumbered coin is not fungible with any other of a distinct discount schedule.

What is the economic consequence of lending discounted money? Lower interest rates. How much lower? The rate of depreciation. This can also be observed with inflation and demurrage, but observation isn’t required. This is a necessary outcome.

So when one lends 1 demurrage coin for a term one cannot earn interest on 1 coin, one is earning interest on a fraction of a coin. That fraction creates credit expansion and reduces return in direct proportion to the risk that has been offset. In other words, the risk cost has been converted to opportunity cost. The discounted fraction earns no interest.

So credit expansion and risk remain, in the same proportions as without such a system. However lack of fungibility introduces an additional overhead cost.

e

> Alice can not issue promissory notes in excess of own capital or capital that she was able to borrow. No coin inflation or fractional reserve here, which also reduces the credit risk Charlie takes.
> 
> Due to the transitive covenant Charlie could pass on the coins to an other temporary owner until maturity when Bob would re-collect them unconditionally.
> 
> Should Charlie no longer be comfortable with Alice’s promise or need final coins (cash) immediatelly, then he could turn to Dan and do a re-purchase (repo) agreement with him.
> 
> Charlie would receive final coins from Dan in exchange for the temporarily controled coins and Charlie's promise to replace them with final coins before maturity.
> Dan would thereby charge high interest through a discount since as he has to bear the credit risk of Charlie. This is not a riskless but a plain zero bond.
> 
> Why would Dan want to take temporary control of the coins at all? Again, to ensure Charlie is not doing yet another repo with Frank on the same coins, the sum of Charlie's repo deals are not in excess of his claims against others.
> This again avoids lending in excess of coin supply and reduces the credit risk Dan takes.
> 
> Here are the sketches for the transacions for above alternate actions:
> 
> lets use shortcut c for 'or(and(time(100),pk(Bob)) covenant drop, _ covenant transitive)’
> 
> the transactions offer a fee of 0.0001
> 
> Bob gives a riskless credit to Alice:
> 
> Input            Output
> 1 pk(Bob)        1 or(b,pk(Alice) covenant c)
> 0.1 pk(Alice)        0.9999 pk(Bob)
> 
> Alice could send a 0.5 promissory note to Charlie:
> 
> Input                    Output
> 1 or(pk(Alice) covenant c)        0.5 or(b,pk(Charlie) covenant c)
> 1 pk(Alice)                0.5 or(b,pk(Alice) covenant c)
>                    0.9999 pk(Alice)
> 
> Alice could make good of the note before maturity, pay some interest and get back temporary control of the coins with:
> Input                        Output
> 0.5 or(b,pk(Charlie) covenant c)        0.5 or(b,pk(Alice) covenant c)
> 0.5101 pk(Alice)                0.51 pk(Charlie)
> 
> alternatively Charlie borrows from Dan at high interest:
> 
> Input                        Output
> 0.5 or(b,pk(Charlie) covenant c)        0.5 or(b,pk(Dan) covenant c)
> 0.3001 pk(Dan)                0.3 pk(Charlie)
> 
> and Charlie re-purchases the temporary coins before maturity, making good of the repo with Dan:
> 
> Input                            Output
> 0.5 or(b,pk(Dan) covenant c)            0.5 or(b,pk(Charlie) covenant c)
> 0.5001 pk(Charlie)                    0.5 pk(Dan)
> 
> We need to define further transaction level validations for transactions spending inputs with covenants as follows:
> 
> 1. If there are inputs without covenant before the input with covenant than inputs without covenant must be spent exactly with outputs preceeding the outputs with covenants.
> 2. A transaction can have inputs with different covenants, their allocation to outputs should follow input order.
> 3. For output(s) that share input(s) with covenant, the sum of covenant outputs must exactly add up to the input(s). This allows merging and splitting them.
> 
> Bob would re-collect his coins at maturity unconditionally. Who followed through promises or defaulted down the transitive chain is irrelevant to him.
> Remark: we might also need a covenant attribute defining the minimum size of output, so Bob is not forced to collect dust, which would be expensive or even impossible. I am not yet happy with this solution, looking for better.
> 
> I am very excited about the possibilities this proposal would unlock and ask you verify usefulness of this scheme and join working out the details and how covenants would be integrated with taproot.
> 
> Tamas Blummer
> 
> [1] Malte Moser, Ittay Eyal, and Emin Gun Sirer. Bitcoin Covenants. URL: http://fc16.ifca.ai/bitcoin/papers/MES16.pdf
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1.1: Type: text/plain, Size: 15405 bytes --]

Hi Eric,

Thank you for your questions as they show what concepts need further explanation, so you understand the potential of this proposal and how it is helpful to the ecosystem.

Riskless zero bond is in fact the most basic concept of financial engineering. Yes, there are engineers of finance, those who create and price financial derivatives (e.g. options, swaps) and structure products such as e.g. ABS, CDO etc.
I used to be one of them.

A zero bond formalizes the observation that 1 unit of currency in the future has different value than 1 unit available now. It is called riskless if it is certain to receive the payment in the future.
If we put this difference of vaue in relation to the amount then we get the “risk freee rate of return”, that you heard of.

E.g if one is willing to exchange 1 BTC unconditionally available now for 1.1 BTC certainly available in a year but not earlier, then the implied “risk free rate of return” is apparently 10% pa. for Bitcoins.

The transaction I construct in the first example achives exactly this, because:

Bob forgoes his ability to use his unconditionally available coins by giving them to Alice with a covenant that ensures that Bob will receive them back later.
Bob does this because Alice pays for this in advance.

Alice can further transfer the coins encumbered by the covenant, but they will unconditionally return to Bob in the future.

The utility of these encumbered coins is that they prove that the loan is fully covered by reserves.

How valuable this utility is will be decided by the market and that value will be interest received by those who temporarily give up control. I am guess the value will be low but positive.

Lending does not mandate fractional or full reserves. These are choices the market or regulators enforce. Full reserve banking is not a fiction but is how things worked before introduction of gold receipts. A bank could only lend gold coins it possesed. Perils of fractional reserve were felt repeatedly by the Bitcoin ecnomy e.g. in the collaps of MtGox.

The idea to return to full reserve banking is not unique to gold bugs or Bitcoin but recently a popular vote was initiated in Switzerland to force Swiss banks to full reserves with respect to lending. This popular vote achived  24% support [1] which is quite remarkable if considered that the topic is not trivial as also our exchange shows.

I published today a writing in medium, that explains the concept of fractional vs. full reserve banking in conjunction with this proposal. Please read: https://medium.com/@tamas.blummer/full-reserve-banking-with-bitcoin-462b21ae9479 <https://medium.com/@tamas.blummer/full-reserve-banking-with-bitcoin-462b21ae9479>

I would welcome feedback on the generalized covenant construct or its implementation, as I think it can open up much more uses than the few examples I gave.

Tamas Blummer

[1] Vollgeld Initiative: https://www.bfs.admin.ch/bfs/de/home/statistiken/politik/abstimmungen/jahr-2018/2018-06-10/vollgeld-initiative.html <https://www.bfs.admin.ch/bfs/de/home/statistiken/politik/abstimmungen/jahr-2018/2018-06-10/vollgeld-initiative.html>
> On Jun 28, 2019, at 19:25, Eric Voskuil <eric@voskuil.org> wrote:
> 
> Hi Tamas,
> 
> There are a number of economic assumptions contained herein. While I understand you would like to focus on implementation, the worst bugs are requirements bugs. IMO these should be addressed first. I’ve addressed some possible issues inline.
> 
>> On Jun 28, 2019, at 01:27, Tamas Blummer via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org <mailto:bitcoin-dev@lists.linuxfoundation.org>> wrote:
>> 
>> I start with a formalisation of loans as common in finance:
>> 
>> A zero bond is a contract between two parties Alice and Bob whereby Alice receives an amount less than P and has to pay back P at a later time point called maturity.
>> The difference between the amount received and P is the interest implied by the contract. E.g. receiving 1 Bitcoin (<P) and agree to pay back 1.1 (=P) in a year is the same as getting a loan with 10% p.a. interest.
>> 
>> The inherent risk in the contract is that Alice may not honor the agreement or be bankrupt by then.
>> 
>> If we could programmatically guarantee that Alice honors the contract then we would be able to create a riskless zero bond, the fundation of financial engineering.
> 
> I’m not aware of the basis of this statement. While people use the term “risk free rate of return” there has never actually been such a thing. It’s not clear to me how a unicorn has been the foundation of “financial engineering”, but I’m not also clear and what is intended by “engineering” in this sense. Generally engineering is the implementation of higher level concepts. It is those concepts that constitute requirements here.
> 
> At a minimum, interest cannot be guaranteed by this proposal, which implies that at best it guarantees, setting aside changes in purchasing power, a return of principle minus economic interest on that principle (ie opportunity cost). Given that purchasing power changes over time, risk increases with the term of the loan. As such this is not riskless - both volatility and opportunity cost remain as risks.
> 
>> A systemic problem with loans is that the lender might operate on fractional reserve, that is lending more than his capital.
> 
> This is not a systemic problem, this is the very nature of lending. Fractional reserve is simply a state banking term used to describe the fact that people invest (lend) a fraction of their savings and hoard the rest. It matters not that banks or individuals do this, credit expansion is inherent in economy. Without it there is no investment and therefore no production whatsoever.
> 
>> Unchecked inflation of money supply through fractional reserve is creating a mess in the world we live in. Bitcoin could overcome this mess implementing this proposal!
> 
> You seem to be conflating state banking with the effects of investing. Taxpayer support for bank investment creates both a moral hazard (and the resulting misallocation of capital to state-favored projects, creating the famed economic “business cycle”) and is a manifestation of persistent monetary inflation (ie seigniorage is a source taxation. Investment implies credit expansion, and the level of this expansion is controlled by time preference alone.
> 
>> I stop here with finance speak as the purpose of this mail is not to dive into finance, but to show how loans with full reserve check could be implemented in Bitcoin.
>> 
>> 1. Receiving the loan is a payment from Bob to Alice, but we need a restriction how Alice can use the funds, so Bob can get them back unconditionally at maturity, so lending is riskless to him.
>> 2. Bob wants to receive interest, since he gives up his control of the coins until maturity, he can not use them elsewhere until then. That interest could be paid in advance, this can be solved with Bitcoin as is.
> 
> Interest cannot be paid in advance. This implies nothing more than a smaller amount of principle.
> 
>> How do we allow Alice to use the coins, that is: split/merge and transfer them to others, but still ensure Bob can claim them back at maturity?
>> 
>> We ensure that Alice can only send the coins to outputs that inherit a taproot path of validation (using http://bitcoin.sipa.be/miniscript/): 'and(time(100),pk(C))' where C is Bob’s key and 100 is maturity
>> 
>> This requires a generalization of the Bitcoin Covenants Idea[1] such that it nicely fits with taproot as follows:
>> 
>> 1. A covenant in the form of '_ covenant C’ on output means that it can be spent to an output that maches the covenant pattern with placeholder _  and the output(s) will be assigned 'covenant C'.
>> 2. A covenant that mandates an output script with alternate validation paths can also assign alternate covernants to be inherited by the output(s) depending on which path was used to spend the input eg. 'covenant or(c covenant C, d covernant D)’
>> 3. The resulting covenant of outputs should be reduced following boolean algebra, e.g. or(b,or(b,a)) to or(b, a)
>> 4. express transitivity with 'covenant transitive’ which means the output will have the same covenant as the input
>> 5. allow to omit covenant on the output with 'covenant drop'
>> 
>> The covenant Bob would assign to the loan output sent to Alice is: 'covenant or(and(time(100),pk(Bob)) covenant drop, _ covenant transitive)' which means:
>> - Alice can send to an output script where she is free to chose the embedded script at the placeholder _ and that output will again have the same covenant as the input.
>> - After maturity Bob can claim any coin that is transitively rooted in the loan (more on this later) and the covenant will no longer be assigned to his new output(s).
>> 
>> Assuming Alice wants to send some of the borrowed coins to Charlie:
>> 
>> for shorter notation lets use b='and(time(100),pk(Bob)) covenant drop’ for the script that gives Bob control after maturity.
>> 
>> Alice can not send to pk(Charlie), but she can send to or(b, pk(Charlie) covenant transitive)
>> Sending to pk(Charlie) would be sending cash, sending to or(b, pk(Charlie) covenant transitive) is a promissory note issued by Alice to Charlie, here is why:
>> 
>> If Charlie accepts an or(b, pk(Charlie) covenant transitive) output then he trusts, that Alice will offer a regular payment in exchange for it before maturity, since that output is worthless to Charlie after maturity as Bob can just take it.
>> 
>> It seems at the first sight that there is no value in these outputs for Charlie, since he still has to ensure Alice replaces them before maturity.
>> 
>> The value of these outputs to Charlie is the proof that he has exclusive control of the coins until maturity.
> 
> At a minimum, money that predictably depreciates (to zero in this case) must be discounted accordingly. How much is money worth today that is worth zero tomorrow? This can be observed with both inflation and demurrage money. This also implies that each encumbered coin is not fungible with any other of a distinct discount schedule.
> 
> What is the economic consequence of lending discounted money? Lower interest rates. How much lower? The rate of depreciation. This can also be observed with inflation and demurrage, but observation isn’t required. This is a necessary outcome.
> 
> So when one lends 1 demurrage coin for a term one cannot earn interest on 1 coin, one is earning interest on a fraction of a coin. That fraction creates credit expansion and reduces return in direct proportion to the risk that has been offset. In other words, the risk cost has been converted to opportunity cost. The discounted fraction earns no interest.
> 
> So credit expansion and risk remain, in the same proportions as without such a system. However lack of fungibility introduces an additional overhead cost.
> 
> e
> 
>> Alice can not issue promissory notes in excess of own capital or capital that she was able to borrow. No coin inflation or fractional reserve here, which also reduces the credit risk Charlie takes.
>> 
>> Due to the transitive covenant Charlie could pass on the coins to an other temporary owner until maturity when Bob would re-collect them unconditionally.
>> 
>> Should Charlie no longer be comfortable with Alice’s promise or need final coins (cash) immediatelly, then he could turn to Dan and do a re-purchase (repo) agreement with him.
>> 
>> Charlie would receive final coins from Dan in exchange for the temporarily controled coins and Charlie's promise to replace them with final coins before maturity.
>> Dan would thereby charge high interest through a discount since as he has to bear the credit risk of Charlie. This is not a riskless but a plain zero bond.
>> 
>> Why would Dan want to take temporary control of the coins at all? Again, to ensure Charlie is not doing yet another repo with Frank on the same coins, the sum of Charlie's repo deals are not in excess of his claims against others.
>> This again avoids lending in excess of coin supply and reduces the credit risk Dan takes.
>> 
>> Here are the sketches for the transacions for above alternate actions:
>> 
>> lets use shortcut c for 'or(and(time(100),pk(Bob)) covenant drop, _ covenant transitive)’
>> 
>> the transactions offer a fee of 0.0001
>> 
>> Bob gives a riskless credit to Alice:
>> 
>> Input            Output
>> 1 pk(Bob)        1 or(b,pk(Alice) covenant c)
>> 0.1 pk(Alice)        0.9999 pk(Bob)
>> 
>> Alice could send a 0.5 promissory note to Charlie:
>> 
>> Input                    Output
>> 1 or(pk(Alice) covenant c)        0.5 or(b,pk(Charlie) covenant c)
>> 1 pk(Alice)                0.5 or(b,pk(Alice) covenant c)
>>                   0.9999 pk(Alice)
>> 
>> Alice could make good of the note before maturity, pay some interest and get back temporary control of the coins with:
>> Input                        Output
>> 0.5 or(b,pk(Charlie) covenant c)        0.5 or(b,pk(Alice) covenant c)
>> 0.5101 pk(Alice)                0.51 pk(Charlie)
>> 
>> alternatively Charlie borrows from Dan at high interest:
>> 
>> Input                        Output
>> 0.5 or(b,pk(Charlie) covenant c)        0.5 or(b,pk(Dan) covenant c)
>> 0.3001 pk(Dan)                0.3 pk(Charlie)
>> 
>> and Charlie re-purchases the temporary coins before maturity, making good of the repo with Dan:
>> 
>> Input                            Output
>> 0.5 or(b,pk(Dan) covenant c)            0.5 or(b,pk(Charlie) covenant c)
>> 0.5001 pk(Charlie)                    0.5 pk(Dan)
>> 
>> We need to define further transaction level validations for transactions spending inputs with covenants as follows:
>> 
>> 1. If there are inputs without covenant before the input with covenant than inputs without covenant must be spent exactly with outputs preceeding the outputs with covenants.
>> 2. A transaction can have inputs with different covenants, their allocation to outputs should follow input order.
>> 3. For output(s) that share input(s) with covenant, the sum of covenant outputs must exactly add up to the input(s). This allows merging and splitting them.
>> 
>> Bob would re-collect his coins at maturity unconditionally. Who followed through promises or defaulted down the transitive chain is irrelevant to him.
>> Remark: we might also need a covenant attribute defining the minimum size of output, so Bob is not forced to collect dust, which would be expensive or even impossible. I am not yet happy with this solution, looking for better.
>> 
>> I am very excited about the possibilities this proposal would unlock and ask you verify usefulness of this scheme and join working out the details and how covenants would be integrated with taproot.
>> 
>> Tamas Blummer
>> 
>> [1] Malte Moser, Ittay Eyal, and Emin Gun Sirer. Bitcoin Covenants. URL: http://fc16.ifca.ai/bitcoin/papers/MES16.pdf
>> _______________________________________________
>> bitcoin-dev mailing list
>> bitcoin-dev@lists.linuxfoundation.org <mailto:bitcoin-dev@lists.linuxfoundation.org>
>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>

[-- Attachment #1.2: Type: text/html, Size: 33365 bytes --]

[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

[-- Attachment #1: Type: text/plain, Size: 19175 bytes --]


> On Jun 28, 2019, at 12:21, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> Hi Eric,
> 
> Thank you for your questions as they show what concepts need further explanation, so you understand the potential of this proposal and how it is helpful to the ecosystem.
> 
> Riskless zero bond is in fact the most basic concept of financial engineering. Yes, there are engineers of finance, those who create and price financial derivatives (e.g. options, swaps) and structure products such as e.g. ABS, CDO etc.
> I used to be one of them.
> 
> A zero bond formalizes the observation that 1 unit of currency in the future has different value than 1 unit available now. It is called riskless if it is certain to receive the payment in the future.
> If we put this difference of vaue in relation to the amount then we get the “risk freee rate of return”, that you heard of.
> 
> E.g if one is willing to exchange 1 BTC unconditionally available now for 1.1 BTC certainly available in a year but not earlier, then the implied “risk free rate of return” is apparently 10% pa. for Bitcoins.

As I implied, I am well aware of the concept of risk free rate of return, which is a hypothetical.

> The transaction I construct in the first example achives exactly this, because:

Which implies you have created an actual instance of this heretofore purely hypothetical concept.

> Bob forgoes his ability to use his unconditionally available coins by giving them to Alice with a covenant that ensures that Bob will receive them back later.
> Bob does this because Alice pays for this in advance. 
> 
> Alice can further transfer the coins encumbered by the covenant, but they will unconditionally return to Bob in the future. 

Why would Alice pay for this at all?

> The utility of these encumbered coins is that they prove that the loan is fully covered by reserves.

What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.

Bitcoin is a money, not consumable in any way. Its utility arises strictly from the possibility of eventually being traded for something else. The only reason to accept it in trade is that expectation. Removing that possibility, even transitively and over time, removes all utility immediately. In my previous comments I described a necessary discount to NPV, but it’s safe to say that must be 100%.

> How valuable this utility is will be decided by the market

Value is of course subjective, and is determined by individual preferences. Yet what is the value one might place on something of no use? Economically speaking it must be zero, since value is a subjective evaluation of utility (i.e. service to a person).

Consider the case of the 1000 and 500 rupee demonetization. Long lines of people formed at banks to convert to notes to others of equivalent denomination.

https://en.m.wikipedia.org/wiki/2016_Indian_banknote_demonetisation

Of course, upon announcement of the demonetization, existing 1000/500 rupee notes were discounted for the cost/risk of accomplishing this conversion (several people are reported to have died in the effort). If there was no such conversion possible, making the notes worthless at the future date, the *immediate* effect would necessarily have been 100% discount.

This of course sets aside any consumable value of the “paper” notes, such as burning for heat or trading as novelties (e.g. demonetized Zimbabwean 100T notes currently trading), as Bitcoin is not capable of being consumed. It also sets aside the possibility that some people were unaware of the demonetization.

Who would accept such a note today that was known to be worthless at a future date? If they did, who would would accept it from them? It’s literally an on-chain scamcoin, where the first sucker must find another, and he another, an so on, as soon as possible, before it expires, leaving the last sucker holding the bag. Given an efficient market (i.e perfect knowledge of the scam), zero initial value is implied.

> and that value will be interest received by those who temporarily give up control. I am guess the value will be low but positive.

Giving up control of money for a period does not imply the money is useful to someone else. Bob might as well lock his coins in a time capsule, for which he has the only key, and ask Alice to pay him for it.

> Lending does not mandate fractional or full reserves.

I didn’t say that it does. Lending implies no “mandate”. But the nature of fractional reservation is inherent in every loan/investment. 

> These are choices the market or regulators enforce.

Fractional reservation is not a consequence of statutory or market controls. The level of hoarding vs. lending is a consequence of individual time preference.

> Full reserve banking is not a fiction but is how things worked before introduction of gold receipts. A bank could only lend gold coins it possesed. Perils of fractional reserve were felt repeatedly by the Bitcoin ecnomy e.g. in the collaps of MtGox.

I don’t believe I called full reserve a fiction. With full reserve there is no possible investment, production or products. Unlikely, and disastrous for humanity, but not provably impossible.

A hazard of viewing economic concepts through a financial lens is that those higher order concepts become obscured by a morass of economically-irrelevant regulation and implementation details.

At this point we are going to end up in a discussion on what fractional reserve actually is. I’d be happy to have a discussion on the topic, but this list is clearly not a good forum for that.

Furthermore the question of whether or not this proposal is relevant to fractional reserve is moot unless it can be shown that the assumed utility actually exists. So I suggest we take this interesting but secondary question on fractional reserve somewhere else.

> The idea to return to full reserve banking is not unique to gold bugs or Bitcoin but recently a popular vote was initiated in Switzerland to force Swiss banks to full reserves with respect to lending. This popular vote achived  24% support [1] which is quite remarkable if considered that the topic is not trivial as also our exchange shows.

It shows the breadth of economic ignorance which is not surprising given its counterintuitive nature.

Best,
Eric

> I published today a writing in medium, that explains the concept of fractional vs. full reserve banking in conjunction with this proposal. Please read: https://medium.com/@tamas.blummer/full-reserve-banking-with-bitcoin-462b21ae9479
> 
> I would welcome feedback on the generalized covenant construct or its implementation, as I think it can open up much more uses than the few examples I gave.
> 
> Tamas Blummer
> 
> [1] Vollgeld Initiative: https://www.bfs.admin.ch/bfs/de/home/statistiken/politik/abstimmungen/jahr-2018/2018-06-10/vollgeld-initiative.html
> 
>> On Jun 28, 2019, at 19:25, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>> Hi Tamas,
>> 
>> There are a number of economic assumptions contained herein. While I understand you would like to focus on implementation, the worst bugs are requirements bugs. IMO these should be addressed first. I’ve addressed some possible issues inline.
>> 
>>> On Jun 28, 2019, at 01:27, Tamas Blummer via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:
>>> 
>>> I start with a formalisation of loans as common in finance:
>>> 
>>> A zero bond is a contract between two parties Alice and Bob whereby Alice receives an amount less than P and has to pay back P at a later time point called maturity.
>>> The difference between the amount received and P is the interest implied by the contract. E.g. receiving 1 Bitcoin (<P) and agree to pay back 1.1 (=P) in a year is the same as getting a loan with 10% p.a. interest.
>>> 
>>> The inherent risk in the contract is that Alice may not honor the agreement or be bankrupt by then.
>>> 
>>> If we could programmatically guarantee that Alice honors the contract then we would be able to create a riskless zero bond, the fundation of financial engineering.
>> 
>> I’m not aware of the basis of this statement. While people use the term “risk free rate of return” there has never actually been such a thing. It’s not clear to me how a unicorn has been the foundation of “financial engineering”, but I’m not also clear and what is intended by “engineering” in this sense. Generally engineering is the implementation of higher level concepts. It is those concepts that constitute requirements here.
>> 
>> At a minimum, interest cannot be guaranteed by this proposal, which implies that at best it guarantees, setting aside changes in purchasing power, a return of principle minus economic interest on that principle (ie opportunity cost). Given that purchasing power changes over time, risk increases with the term of the loan. As such this is not riskless - both volatility and opportunity cost remain as risks.
>> 
>>> A systemic problem with loans is that the lender might operate on fractional reserve, that is lending more than his capital.
>> 
>> This is not a systemic problem, this is the very nature of lending. Fractional reserve is simply a state banking term used to describe the fact that people invest (lend) a fraction of their savings and hoard the rest. It matters not that banks or individuals do this, credit expansion is inherent in economy. Without it there is no investment and therefore no production whatsoever.
>> 
>>> Unchecked inflation of money supply through fractional reserve is creating a mess in the world we live in. Bitcoin could overcome this mess implementing this proposal!
>> 
>> You seem to be conflating state banking with the effects of investing. Taxpayer support for bank investment creates both a moral hazard (and the resulting misallocation of capital to state-favored projects, creating the famed economic “business cycle”) and is a manifestation of persistent monetary inflation (ie seigniorage is a source taxation. Investment implies credit expansion, and the level of this expansion is controlled by time preference alone.
>> 
>>> I stop here with finance speak as the purpose of this mail is not to dive into finance, but to show how loans with full reserve check could be implemented in Bitcoin.
>>> 
>>> 1. Receiving the loan is a payment from Bob to Alice, but we need a restriction how Alice can use the funds, so Bob can get them back unconditionally at maturity, so lending is riskless to him.
>>> 2. Bob wants to receive interest, since he gives up his control of the coins until maturity, he can not use them elsewhere until then. That interest could be paid in advance, this can be solved with Bitcoin as is.
>> 
>> Interest cannot be paid in advance. This implies nothing more than a smaller amount of principle.
>> 
>>> How do we allow Alice to use the coins, that is: split/merge and transfer them to others, but still ensure Bob can claim them back at maturity?
>>> 
>>> We ensure that Alice can only send the coins to outputs that inherit a taproot path of validation (using http://bitcoin.sipa.be/miniscript/): 'and(time(100),pk(C))' where C is Bob’s key and 100 is maturity
>>> 
>>> This requires a generalization of the Bitcoin Covenants Idea[1] such that it nicely fits with taproot as follows:
>>> 
>>> 1. A covenant in the form of '_ covenant C’ on output means that it can be spent to an output that maches the covenant pattern with placeholder _  and the output(s) will be assigned 'covenant C'.
>>> 2. A covenant that mandates an output script with alternate validation paths can also assign alternate covernants to be inherited by the output(s) depending on which path was used to spend the input eg. 'covenant or(c covenant C, d covernant D)’
>>> 3. The resulting covenant of outputs should be reduced following boolean algebra, e.g. or(b,or(b,a)) to or(b, a)
>>> 4. express transitivity with 'covenant transitive’ which means the output will have the same covenant as the input
>>> 5. allow to omit covenant on the output with 'covenant drop'
>>> 
>>> The covenant Bob would assign to the loan output sent to Alice is: 'covenant or(and(time(100),pk(Bob)) covenant drop, _ covenant transitive)' which means:
>>> - Alice can send to an output script where she is free to chose the embedded script at the placeholder _ and that output will again have the same covenant as the input.
>>> - After maturity Bob can claim any coin that is transitively rooted in the loan (more on this later) and the covenant will no longer be assigned to his new output(s).
>>> 
>>> Assuming Alice wants to send some of the borrowed coins to Charlie:
>>> 
>>> for shorter notation lets use b='and(time(100),pk(Bob)) covenant drop’ for the script that gives Bob control after maturity.
>>> 
>>> Alice can not send to pk(Charlie), but she can send to or(b, pk(Charlie) covenant transitive)
>>> Sending to pk(Charlie) would be sending cash, sending to or(b, pk(Charlie) covenant transitive) is a promissory note issued by Alice to Charlie, here is why:
>>> 
>>> If Charlie accepts an or(b, pk(Charlie) covenant transitive) output then he trusts, that Alice will offer a regular payment in exchange for it before maturity, since that output is worthless to Charlie after maturity as Bob can just take it.
>>> 
>>> It seems at the first sight that there is no value in these outputs for Charlie, since he still has to ensure Alice replaces them before maturity.
>>> 
>>> The value of these outputs to Charlie is the proof that he has exclusive control of the coins until maturity.
>> 
>> At a minimum, money that predictably depreciates (to zero in this case) must be discounted accordingly. How much is money worth today that is worth zero tomorrow? This can be observed with both inflation and demurrage money. This also implies that each encumbered coin is not fungible with any other of a distinct discount schedule.
>> 
>> What is the economic consequence of lending discounted money? Lower interest rates. How much lower? The rate of depreciation. This can also be observed with inflation and demurrage, but observation isn’t required. This is a necessary outcome.
>> 
>> So when one lends 1 demurrage coin for a term one cannot earn interest on 1 coin, one is earning interest on a fraction of a coin. That fraction creates credit expansion and reduces return in direct proportion to the risk that has been offset. In other words, the risk cost has been converted to opportunity cost. The discounted fraction earns no interest.
>> 
>> So credit expansion and risk remain, in the same proportions as without such a system. However lack of fungibility introduces an additional overhead cost.
>> 
>> e
>> 
>>> Alice can not issue promissory notes in excess of own capital or capital that she was able to borrow. No coin inflation or fractional reserve here, which also reduces the credit risk Charlie takes.
>>> 
>>> Due to the transitive covenant Charlie could pass on the coins to an other temporary owner until maturity when Bob would re-collect them unconditionally.
>>> 
>>> Should Charlie no longer be comfortable with Alice’s promise or need final coins (cash) immediatelly, then he could turn to Dan and do a re-purchase (repo) agreement with him.
>>> 
>>> Charlie would receive final coins from Dan in exchange for the temporarily controled coins and Charlie's promise to replace them with final coins before maturity.
>>> Dan would thereby charge high interest through a discount since as he has to bear the credit risk of Charlie. This is not a riskless but a plain zero bond.
>>> 
>>> Why would Dan want to take temporary control of the coins at all? Again, to ensure Charlie is not doing yet another repo with Frank on the same coins, the sum of Charlie's repo deals are not in excess of his claims against others.
>>> This again avoids lending in excess of coin supply and reduces the credit risk Dan takes.
>>> 
>>> Here are the sketches for the transacions for above alternate actions:
>>> 
>>> lets use shortcut c for 'or(and(time(100),pk(Bob)) covenant drop, _ covenant transitive)’
>>> 
>>> the transactions offer a fee of 0.0001
>>> 
>>> Bob gives a riskless credit to Alice:
>>> 
>>> Input            Output
>>> 1 pk(Bob)        1 or(b,pk(Alice) covenant c)
>>> 0.1 pk(Alice)        0.9999 pk(Bob)
>>> 
>>> Alice could send a 0.5 promissory note to Charlie:
>>> 
>>> Input                    Output
>>> 1 or(pk(Alice) covenant c)        0.5 or(b,pk(Charlie) covenant c)
>>> 1 pk(Alice)                0.5 or(b,pk(Alice) covenant c)
>>>                   0.9999 pk(Alice)
>>> 
>>> Alice could make good of the note before maturity, pay some interest and get back temporary control of the coins with:
>>> Input                        Output
>>> 0.5 or(b,pk(Charlie) covenant c)        0.5 or(b,pk(Alice) covenant c)
>>> 0.5101 pk(Alice)                0.51 pk(Charlie)
>>> 
>>> alternatively Charlie borrows from Dan at high interest:
>>> 
>>> Input                        Output
>>> 0.5 or(b,pk(Charlie) covenant c)        0.5 or(b,pk(Dan) covenant c)
>>> 0.3001 pk(Dan)                0.3 pk(Charlie)
>>> 
>>> and Charlie re-purchases the temporary coins before maturity, making good of the repo with Dan:
>>> 
>>> Input                            Output
>>> 0.5 or(b,pk(Dan) covenant c)            0.5 or(b,pk(Charlie) covenant c)
>>> 0.5001 pk(Charlie)                    0.5 pk(Dan)
>>> 
>>> We need to define further transaction level validations for transactions spending inputs with covenants as follows:
>>> 
>>> 1. If there are inputs without covenant before the input with covenant than inputs without covenant must be spent exactly with outputs preceeding the outputs with covenants.
>>> 2. A transaction can have inputs with different covenants, their allocation to outputs should follow input order.
>>> 3. For output(s) that share input(s) with covenant, the sum of covenant outputs must exactly add up to the input(s). This allows merging and splitting them.
>>> 
>>> Bob would re-collect his coins at maturity unconditionally. Who followed through promises or defaulted down the transitive chain is irrelevant to him.
>>> Remark: we might also need a covenant attribute defining the minimum size of output, so Bob is not forced to collect dust, which would be expensive or even impossible. I am not yet happy with this solution, looking for better.
>>> 
>>> I am very excited about the possibilities this proposal would unlock and ask you verify usefulness of this scheme and join working out the details and how covenants would be integrated with taproot.
>>> 
>>> Tamas Blummer
>>> 
>>> [1] Malte Moser, Ittay Eyal, and Emin Gun Sirer. Bitcoin Covenants. URL: http://fc16.ifca.ai/bitcoin/papers/MES16.pdf
>>> _______________________________________________
>>> bitcoin-dev mailing list
>>> bitcoin-dev@lists.linuxfoundation.org
>>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
> 

[-- Attachment #2: Type: text/html, Size: 38983 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 1728 bytes --]

Hi Eric,

> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
> 
> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
> 

Coins encumbered with the described covenant represent temporary control of a scarce resource.

Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.

An example where final control is not available are areas and jurisdictions where land can not be bought only long time rents are offered.
People pay high prices there to step in place of the renter in an existing long term rent contract and they figured out the contracts that work under these restrictions.

Bitcoin’s predominant use is already store of value. Many assume not only wealth preservation but that it would allow to purchase of more goods in the future than now.
This leads to unwillingnes to give up final control, which can resolve in two ways:

- Increasing fiat prices for final control. We see this, and is actually further reinforcing unwillingnes to give up final control.
- dealing with temporary control. We do not yet have the technical means of even representing this. Developing them is my goal.

I think you do not show the neccesary respect of the market.

Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.

I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.

Tamas Blummer



[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jun 30, 2019, at 03:56, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> Hi Eric,
> 
>> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
>> 
> 
> Coins encumbered with the described covenant represent temporary control of a scarce resource.
> 
> Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.

For something to become property (and therefore have marketable value) requires that it be both scarce and useful. Bitcoin is useful only to the extent that it can be traded for something else that is useful. Above you are only dealing with scarcity, ignoring utility.

> An example where final control is not available are areas and jurisdictions where land can not be bought only long time rents are offered.
> People pay high prices there to step in place of the renter in an existing long term rent contract and they figured out the contracts that work under these restrictions.

I was careful to point out that bitcoin is not in any way consumable. Occupying scarce land is a service to people. Units of bitcoin encumbered such that they cannot be traded for something of service to a person do not constitute property. You cannot even polish them, stack them on the floor, and roll around on them.

> Bitcoin’s predominant use is already store of value. Many assume not only wealth preservation but that it would allow to purchase of more goods in the future than now.

Yet it has been established that these encumbered coins cannot purchase anything of value except to the extent that an imperfect market is unaware of the scam.

> This leads to unwillingnes to give up final control, which can resolve in two ways:
> 
> - Increasing fiat prices for final control. We see this, and is actually further reinforcing unwillingnes to give up final control.
> - dealing with temporary control. We do not yet have the technical means of even representing this. Developing them is my goal.

Your goal is clear and not at issue.

> I think you do not show the neccesary respect of the market.

I’m not sure what is meant here by respect, or how much of it is necessary. I am merely explaining the market.

> Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.

It seems to me you have reversed the meaning of temporary and final. Bitcoin is useful because of the presumption that there is no finality of control. One presumes an ability to trade control of it for something else. This is temporary control. Final control would be the case in which, at some point, it can no longer be traded, making it worthless at that point. If this is known to be the case it implies that it it worthless at all prior points as well.

These are distinct scenarios. The fact that temporary (in my usage) control implies the possibility of value does not imply that finality of control does as well. The fact that (renowned or otherwise) people have made errors does not imply that I am making an error. These are both non-sequiturs.

> I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.

The analogy to rental of a consumable good does not apply to the case of a non-consumable good. If it cannot be traded and cannot be consumed it cannot obtain marketable value. To this point it matters not whether it exists.

Best,
Eric

> Tamas Blummer
> 
> 

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 3834 bytes --]


> On Jun 30, 2019, at 19:41, Eric Voskuil <eric@voskuil.org> wrote:
> 
> 
>> On Jun 30, 2019, at 03:56, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>> 
>> Hi Eric,
>> 
>>> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
>>> 
>>> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
>>> 
>> 
>> Coins encumbered with the described covenant represent temporary control of a scarce resource.
>> 
>> Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.
> 
> For something to become property (and therefore have marketable value) requires that it be both scarce and useful. Bitcoin is useful only to the extent that it can be traded for something else that is useful. Above you are only dealing with scarcity, ignoring utility.

There is a deeper utility of Bitcoin than it can be traded for something else. That utility is to use its unforgeable register.
We have only one kind of units in this register and by having covenants we would create other kinds that are while encumbered not fungible with the common ones.

Units are certainly less desirable if encumbered with a debt covenant. You say no one would assign them any value.

I am not that sure as they still offer the utility of using the unforgeable register, in this case a register of debt covered by reserves.
You also doubt forcing debt to be covered by reserves is a good idea, I got that, but suppose we do not discuss this here.
If there are people who think it is a good idea, then they would find having an unforgeable register of it useful and therefore units needed to maintain that register valuable to some extent.

> 
>> I think you do not show the neccesary respect of the market.
> 
> I’m not sure what is meant here by respect, or how much of it is necessary. I am merely explaining the market.
> 

You are not explaining an existing market but claim that market that is not yet there will follow your arguments.

>> Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.
> 
> It seems to me you have reversed the meaning of temporary and final. Bitcoin is useful because of the presumption that there is no finality of control. One presumes an ability to trade control of it for something else. This is temporary control. Final control would be the case in which, at some point, it can no longer be traded, making it worthless at that point. If this is known to be the case it implies that it it worthless at all prior points as well.
> 
> These are distinct scenarios. The fact that temporary (in my usage) control implies the possibility of value does not imply that finality of control does as well. The fact that (renowned or otherwise) people have made errors does not imply that I am making an error. These are both non-sequiturs.
> 
>> I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.
> 
> The analogy to rental of a consumable good does not apply to the case of a non-consumable good. If it cannot be traded and cannot be consumed it cannot obtain marketable value. To this point it matters not whether it exists.
> 

I meant with control the control of entries in the register which I think is the deeper utility of Bitcoin. Final control is meant to be the opposite of temporary which is the time limited control with some expiry.

Thank you for your thoughts as they help to sharpen my arguments.

Best,

Tamas Blummer

> Best,
> Eric
> 
>> Tamas Blummer
>> 
>> 


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

Could you please explain the meaning and utility of “unforgeable register” as it pertains to such encumbered coins?

The meaning in terms of Bitcoin is clear - the “owner” of outputs that represent value (i.e. in the ability to trade them for something else) is recorded publicly and, given Bitcoin security assumptions, cannot be faked. What is not clear is the utility of a record of outputs that cannot be traded for something else. You seem to imply that a record is valuable simply because it’s a record.

e

> On Jun 30, 2019, at 11:35, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> 
>> On Jun 30, 2019, at 19:41, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>> 
>>> On Jun 30, 2019, at 03:56, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>> 
>>> Hi Eric,
>>> 
>>>> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
>>>> 
>>>> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
>>>> 
>>> 
>>> Coins encumbered with the described covenant represent temporary control of a scarce resource.
>>> 
>>> Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.
>> 
>> For something to become property (and therefore have marketable value) requires that it be both scarce and useful. Bitcoin is useful only to the extent that it can be traded for something else that is useful. Above you are only dealing with scarcity, ignoring utility.
> 
> There is a deeper utility of Bitcoin than it can be traded for something else. That utility is to use its unforgeable register.
> We have only one kind of units in this register and by having covenants we would create other kinds that are while encumbered not fungible with the common ones.
> 
> Units are certainly less desirable if encumbered with a debt covenant. You say no one would assign them any value.
> 
> I am not that sure as they still offer the utility of using the unforgeable register, in this case a register of debt covered by reserves.
> You also doubt forcing debt to be covered by reserves is a good idea, I got that, but suppose we do not discuss this here.
> If there are people who think it is a good idea, then they would find having an unforgeable register of it useful and therefore units needed to maintain that register valuable to some extent.
> 
>> 
>>> I think you do not show the neccesary respect of the market.
>> 
>> I’m not sure what is meant here by respect, or how much of it is necessary. I am merely explaining the market.
>> 
> 
> You are not explaining an existing market but claim that market that is not yet there will follow your arguments.
> 
>>> Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.
>> 
>> It seems to me you have reversed the meaning of temporary and final. Bitcoin is useful because of the presumption that there is no finality of control. One presumes an ability to trade control of it for something else. This is temporary control. Final control would be the case in which, at some point, it can no longer be traded, making it worthless at that point. If this is known to be the case it implies that it it worthless at all prior points as well.
>> 
>> These are distinct scenarios. The fact that temporary (in my usage) control implies the possibility of value does not imply that finality of control does as well. The fact that (renowned or otherwise) people have made errors does not imply that I am making an error. These are both non-sequiturs.
>> 
>>> I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.
>> 
>> The analogy to rental of a consumable good does not apply to the case of a non-consumable good. If it cannot be traded and cannot be consumed it cannot obtain marketable value. To this point it matters not whether it exists.
>> 
> 
> I meant with control the control of entries in the register which I think is the deeper utility of Bitcoin. Final control is meant to be the opposite of temporary which is the time limited control with some expiry.
> 
> Thank you for your thoughts as they help to sharpen my arguments.
> 
> Best,
> 
> Tamas Blummer
> 
>> Best,
>> Eric
>> 
>>> Tamas Blummer
>>> 
>>> 
> 

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 5779 bytes --]


> On Jun 30, 2019, at 20:54, Eric Voskuil <eric@voskuil.org> wrote:
> 
> Could you please explain the meaning and utility of “unforgeable register” as it pertains to such encumbered coins?

I guess we agree that some way of keeping track of ownership is prerequisite for something to aquire value.
We likely also agree that the security of that ownership register has great influence to the value.

The question remains if a register as utility in itself gives value to the thing needed to use that register.
I think it does, if people are interested in what it keeps track of, for whatever reason, even for reasons you find bogus.

It was not intentional, but I think I just explained why Ethereum aquired higher market value by being register of ICO tokens.

Now back to the coins encumbered with the debt covenant:
Transactions moving them constitute a register of covered debt and you need them to update that register.
Should some people find such a register useful then those coins needed to update this register will aquire value.
Does not matter if you think the concept of covered debt is just as bogus as ICOs.

Here some good news: If they aquire value then they offer a way to generate income for hodler by temporarily giving up control.

Tamas Blummer

> 
> The meaning in terms of Bitcoin is clear - the “owner” of outputs that represent value (i.e. in the ability to trade them for something else) is recorded publicly and, given Bitcoin security assumptions, cannot be faked. What is not clear is the utility of a record of outputs that cannot be traded for something else. You seem to imply that a record is valuable simply because it’s a record.
> 
> e
> 
>> On Jun 30, 2019, at 11:35, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>> 
>> 
>>> On Jun 30, 2019, at 19:41, Eric Voskuil <eric@voskuil.org> wrote:
>>> 
>>> 
>>>> On Jun 30, 2019, at 03:56, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>> 
>>>> Hi Eric,
>>>> 
>>>>> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
>>>>> 
>>>>> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
>>>>> 
>>>> 
>>>> Coins encumbered with the described covenant represent temporary control of a scarce resource.
>>>> 
>>>> Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.
>>> 
>>> For something to become property (and therefore have marketable value) requires that it be both scarce and useful. Bitcoin is useful only to the extent that it can be traded for something else that is useful. Above you are only dealing with scarcity, ignoring utility.
>> 
>> There is a deeper utility of Bitcoin than it can be traded for something else. That utility is to use its unforgeable register.
>> We have only one kind of units in this register and by having covenants we would create other kinds that are while encumbered not fungible with the common ones.
>> 
>> Units are certainly less desirable if encumbered with a debt covenant. You say no one would assign them any value.
>> 
>> I am not that sure as they still offer the utility of using the unforgeable register, in this case a register of debt covered by reserves.
>> You also doubt forcing debt to be covered by reserves is a good idea, I got that, but suppose we do not discuss this here.
>> If there are people who think it is a good idea, then they would find having an unforgeable register of it useful and therefore units needed to maintain that register valuable to some extent.
>> 
>>> 
>>>> I think you do not show the neccesary respect of the market.
>>> 
>>> I’m not sure what is meant here by respect, or how much of it is necessary. I am merely explaining the market.
>>> 
>> 
>> You are not explaining an existing market but claim that market that is not yet there will follow your arguments.
>> 
>>>> Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.
>>> 
>>> It seems to me you have reversed the meaning of temporary and final. Bitcoin is useful because of the presumption that there is no finality of control. One presumes an ability to trade control of it for something else. This is temporary control. Final control would be the case in which, at some point, it can no longer be traded, making it worthless at that point. If this is known to be the case it implies that it it worthless at all prior points as well.
>>> 
>>> These are distinct scenarios. The fact that temporary (in my usage) control implies the possibility of value does not imply that finality of control does as well. The fact that (renowned or otherwise) people have made errors does not imply that I am making an error. These are both non-sequiturs.
>>> 
>>>> I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.
>>> 
>>> The analogy to rental of a consumable good does not apply to the case of a non-consumable good. If it cannot be traded and cannot be consumed it cannot obtain marketable value. To this point it matters not whether it exists.
>>> 
>> 
>> I meant with control the control of entries in the register which I think is the deeper utility of Bitcoin. Final control is meant to be the opposite of temporary which is the time limited control with some expiry.
>> 
>> Thank you for your thoughts as they help to sharpen my arguments.
>> 
>> Best,
>> 
>> Tamas Blummer
>> 
>>> Best,
>>> Eric
>>> 
>>>> Tamas Blummer
>>>> 
>>>> 
>> 


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

ICO tokens can be traded (indefinitely) for other things of value, so the comparison isn’t valid. I think we’ve both made our points clearly, so I’ll leave it at that.

Best,
Eric

> On Jun 30, 2019, at 12:55, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> 
>> On Jun 30, 2019, at 20:54, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>> Could you please explain the meaning and utility of “unforgeable register” as it pertains to such encumbered coins?
> 
> I guess we agree that some way of keeping track of ownership is prerequisite for something to aquire value.
> We likely also agree that the security of that ownership register has great influence to the value.
> 
> The question remains if a register as utility in itself gives value to the thing needed to use that register.
> I think it does, if people are interested in what it keeps track of, for whatever reason, even for reasons you find bogus.
> 
> It was not intentional, but I think I just explained why Ethereum aquired higher market value by being register of ICO tokens.
> 
> Now back to the coins encumbered with the debt covenant:
> Transactions moving them constitute a register of covered debt and you need them to update that register.
> Should some people find such a register useful then those coins needed to update this register will aquire value.
> Does not matter if you think the concept of covered debt is just as bogus as ICOs.
> 
> Here some good news: If they aquire value then they offer a way to generate income for hodler by temporarily giving up control.
> 
> Tamas Blummer
> 
>> 
>> The meaning in terms of Bitcoin is clear - the “owner” of outputs that represent value (i.e. in the ability to trade them for something else) is recorded publicly and, given Bitcoin security assumptions, cannot be faked. What is not clear is the utility of a record of outputs that cannot be traded for something else. You seem to imply that a record is valuable simply because it’s a record.
>> 
>> e
>> 
>>> On Jun 30, 2019, at 11:35, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>> 
>>> 
>>>> On Jun 30, 2019, at 19:41, Eric Voskuil <eric@voskuil.org> wrote:
>>>> 
>>>> 
>>>>> On Jun 30, 2019, at 03:56, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>>> 
>>>>> Hi Eric,
>>>>> 
>>>>>> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
>>>>>> 
>>>>>> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
>>>>>> 
>>>>> 
>>>>> Coins encumbered with the described covenant represent temporary control of a scarce resource.
>>>>> 
>>>>> Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.
>>>> 
>>>> For something to become property (and therefore have marketable value) requires that it be both scarce and useful. Bitcoin is useful only to the extent that it can be traded for something else that is useful. Above you are only dealing with scarcity, ignoring utility.
>>> 
>>> There is a deeper utility of Bitcoin than it can be traded for something else. That utility is to use its unforgeable register.
>>> We have only one kind of units in this register and by having covenants we would create other kinds that are while encumbered not fungible with the common ones.
>>> 
>>> Units are certainly less desirable if encumbered with a debt covenant. You say no one would assign them any value.
>>> 
>>> I am not that sure as they still offer the utility of using the unforgeable register, in this case a register of debt covered by reserves.
>>> You also doubt forcing debt to be covered by reserves is a good idea, I got that, but suppose we do not discuss this here.
>>> If there are people who think it is a good idea, then they would find having an unforgeable register of it useful and therefore units needed to maintain that register valuable to some extent.
>>> 
>>>> 
>>>>> I think you do not show the neccesary respect of the market.
>>>> 
>>>> I’m not sure what is meant here by respect, or how much of it is necessary. I am merely explaining the market.
>>>> 
>>> 
>>> You are not explaining an existing market but claim that market that is not yet there will follow your arguments.
>>> 
>>>>> Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.
>>>> 
>>>> It seems to me you have reversed the meaning of temporary and final. Bitcoin is useful because of the presumption that there is no finality of control. One presumes an ability to trade control of it for something else. This is temporary control. Final control would be the case in which, at some point, it can no longer be traded, making it worthless at that point. If this is known to be the case it implies that it it worthless at all prior points as well.
>>>> 
>>>> These are distinct scenarios. The fact that temporary (in my usage) control implies the possibility of value does not imply that finality of control does as well. The fact that (renowned or otherwise) people have made errors does not imply that I am making an error. These are both non-sequiturs.
>>>> 
>>>>> I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.
>>>> 
>>>> The analogy to rental of a consumable good does not apply to the case of a non-consumable good. If it cannot be traded and cannot be consumed it cannot obtain marketable value. To this point it matters not whether it exists.
>>>> 
>>> 
>>> I meant with control the control of entries in the register which I think is the deeper utility of Bitcoin. Final control is meant to be the opposite of temporary which is the time limited control with some expiry.
>>> 
>>> Thank you for your thoughts as they help to sharpen my arguments.
>>> 
>>> Best,
>>> 
>>> Tamas Blummer
>>> 
>>>> Best,
>>>> Eric
>>>> 
>>>>> Tamas Blummer
>>>>> 
>>>>> 
>>> 
> 

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 6560 bytes --]

My argument does not need the comparison with ICOs.

They were just an example that people pay for the utility of register even though others think the tokens they keep track of are worthless.

Tamas Blummer


> On Jun 30, 2019, at 22:13, Eric Voskuil <eric@voskuil.org> wrote:
> 
> ICO tokens can be traded (indefinitely) for other things of value, so the comparison isn’t valid. I think we’ve both made our points clearly, so I’ll leave it at that.
> 
> Best,
> Eric
> 
>> On Jun 30, 2019, at 12:55, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>> 
>> 
>>> On Jun 30, 2019, at 20:54, Eric Voskuil <eric@voskuil.org> wrote:
>>> 
>>> Could you please explain the meaning and utility of “unforgeable register” as it pertains to such encumbered coins?
>> 
>> I guess we agree that some way of keeping track of ownership is prerequisite for something to aquire value.
>> We likely also agree that the security of that ownership register has great influence to the value.
>> 
>> The question remains if a register as utility in itself gives value to the thing needed to use that register.
>> I think it does, if people are interested in what it keeps track of, for whatever reason, even for reasons you find bogus.
>> 
>> It was not intentional, but I think I just explained why Ethereum aquired higher market value by being register of ICO tokens.
>> 
>> Now back to the coins encumbered with the debt covenant:
>> Transactions moving them constitute a register of covered debt and you need them to update that register.
>> Should some people find such a register useful then those coins needed to update this register will aquire value.
>> Does not matter if you think the concept of covered debt is just as bogus as ICOs.
>> 
>> Here some good news: If they aquire value then they offer a way to generate income for hodler by temporarily giving up control.
>> 
>> Tamas Blummer
>> 
>>> 
>>> The meaning in terms of Bitcoin is clear - the “owner” of outputs that represent value (i.e. in the ability to trade them for something else) is recorded publicly and, given Bitcoin security assumptions, cannot be faked. What is not clear is the utility of a record of outputs that cannot be traded for something else. You seem to imply that a record is valuable simply because it’s a record.
>>> 
>>> e
>>> 
>>>> On Jun 30, 2019, at 11:35, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>> 
>>>> 
>>>>> On Jun 30, 2019, at 19:41, Eric Voskuil <eric@voskuil.org> wrote:
>>>>> 
>>>>> 
>>>>>> On Jun 30, 2019, at 03:56, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>>>> 
>>>>>> Hi Eric,
>>>>>> 
>>>>>>> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
>>>>>>> 
>>>>>>> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
>>>>>>> 
>>>>>> 
>>>>>> Coins encumbered with the described covenant represent temporary control of a scarce resource.
>>>>>> 
>>>>>> Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.
>>>>> 
>>>>> For something to become property (and therefore have marketable value) requires that it be both scarce and useful. Bitcoin is useful only to the extent that it can be traded for something else that is useful. Above you are only dealing with scarcity, ignoring utility.
>>>> 
>>>> There is a deeper utility of Bitcoin than it can be traded for something else. That utility is to use its unforgeable register.
>>>> We have only one kind of units in this register and by having covenants we would create other kinds that are while encumbered not fungible with the common ones.
>>>> 
>>>> Units are certainly less desirable if encumbered with a debt covenant. You say no one would assign them any value.
>>>> 
>>>> I am not that sure as they still offer the utility of using the unforgeable register, in this case a register of debt covered by reserves.
>>>> You also doubt forcing debt to be covered by reserves is a good idea, I got that, but suppose we do not discuss this here.
>>>> If there are people who think it is a good idea, then they would find having an unforgeable register of it useful and therefore units needed to maintain that register valuable to some extent.
>>>> 
>>>>> 
>>>>>> I think you do not show the neccesary respect of the market.
>>>>> 
>>>>> I’m not sure what is meant here by respect, or how much of it is necessary. I am merely explaining the market.
>>>>> 
>>>> 
>>>> You are not explaining an existing market but claim that market that is not yet there will follow your arguments.
>>>> 
>>>>>> Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.
>>>>> 
>>>>> It seems to me you have reversed the meaning of temporary and final. Bitcoin is useful because of the presumption that there is no finality of control. One presumes an ability to trade control of it for something else. This is temporary control. Final control would be the case in which, at some point, it can no longer be traded, making it worthless at that point. If this is known to be the case it implies that it it worthless at all prior points as well.
>>>>> 
>>>>> These are distinct scenarios. The fact that temporary (in my usage) control implies the possibility of value does not imply that finality of control does as well. The fact that (renowned or otherwise) people have made errors does not imply that I am making an error. These are both non-sequiturs.
>>>>> 
>>>>>> I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.
>>>>> 
>>>>> The analogy to rental of a consumable good does not apply to the case of a non-consumable good. If it cannot be traded and cannot be consumed it cannot obtain marketable value. To this point it matters not whether it exists.
>>>>> 
>>>> 
>>>> I meant with control the control of entries in the register which I think is the deeper utility of Bitcoin. Final control is meant to be the opposite of temporary which is the time limited control with some expiry.
>>>> 
>>>> Thank you for your thoughts as they help to sharpen my arguments.
>>>> 
>>>> Best,
>>>> 
>>>> Tamas Blummer
>>>> 
>>>>> Best,
>>>>> Eric
>>>>> 
>>>>>> Tamas Blummer
>>>>>> 
>>>>>> 
>>>> 
>> 


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

It’s an exceedingly poor example. First, value is subjective. It matters not what other people may consider, only those who act. Given that people trade them (ICO tokens), they have value to those people. Second, the scenario would not function given that the value, as with money, is based on the ability to trade perpetually.

I said that I would make no further comment given the belief that no new ideas were surfacing. However, after giving it some more thought on my own, I believe I have found the one case in which a person could value such encumbered coins.

In the case of tracking an asset that becomes worthless at a specific time, one could value a record of ownership, and the ability to trade ownership of the asset during the period. Consider colored coin type tracking of a theater ticket for a specific show, where the ticket is worthless by the end of the show.

Now consider the value attributable to renting coin (e.g. to the tick issuer) in order to track the ticket. First, there is no net value in renting coin to pay confirmation (mining) fees on transfers. The cost of a fee is driven by competition and remains the same whether the coin used for payment is encumbered or not. In other words, even with value in tracking there is no *cost advantage* to renting of such coins for use as money.

But tracking an asset in this manner has required not only a fee for each trade, but also the burning of coin. By allowing the lender to recover the coin when the asset expires, this part of the cost of on-chain tracking can be time-shared (rented), and without depreciation of the coin.

In this case the lender is achieving both a time-locked hoard/speculation and a pre-paid rental return. The return to the lender would be the rental price minus the opportunity cost of not investing (ie, in production) this coin otherwise during that period. This is of course based on the economic principle that both hoarding and speculation are expected to produce no predictable return. As such the cost of the rental would be driven (by competition) toward the cost of capital (e.g. annualized 10% of the coin price) for the same period. 

Depending on the term, rental will be cheaper than the outright cost of burning the same minimum amount of coin (i.e. dust+1, assuming policy compliance) as required for tracking. As soon as the rental cost exceeds the minimum tracking burn, rental becomes more expensive than just purchasing the coin. So, for example, at 10% market return on capital (rental cost), purchasing the coin is cheaper than rental at any tracking term beyond 7.2 years.

As discussed previously, there can be no monetary value of such encumbered coins. And as shown above, the non-monetary (tracking) scenario is limited to fixed-term tracking. This use of Bitcoin would of course reduce the average cost of non-monetary blockchain storage. I’m not sure that is a use people want to facilitate with a protocol change, but that’s for the community to decide.

Best,
Eric

> On Jun 30, 2019, at 13:26, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> My argument does not need the comparison with ICOs.
> 
> They were just an example that people pay for the utility of register even though others think the tokens they keep track of are worthless.
> 
> Tamas Blummer
> 
> 
>> On Jun 30, 2019, at 22:13, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>> ICO tokens can be traded (indefinitely) for other things of value, so the comparison isn’t valid. I think we’ve both made our points clearly, so I’ll leave it at that.
>> 
>> Best,
>> Eric
>> 
>>> On Jun 30, 2019, at 12:55, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>> 
>>> 
>>>> On Jun 30, 2019, at 20:54, Eric Voskuil <eric@voskuil.org> wrote:
>>>> 
>>>> Could you please explain the meaning and utility of “unforgeable register” as it pertains to such encumbered coins?
>>> 
>>> I guess we agree that some way of keeping track of ownership is prerequisite for something to aquire value.
>>> We likely also agree that the security of that ownership register has great influence to the value.
>>> 
>>> The question remains if a register as utility in itself gives value to the thing needed to use that register.
>>> I think it does, if people are interested in what it keeps track of, for whatever reason, even for reasons you find bogus.
>>> 
>>> It was not intentional, but I think I just explained why Ethereum aquired higher market value by being register of ICO tokens.
>>> 
>>> Now back to the coins encumbered with the debt covenant:
>>> Transactions moving them constitute a register of covered debt and you need them to update that register.
>>> Should some people find such a register useful then those coins needed to update this register will aquire value.
>>> Does not matter if you think the concept of covered debt is just as bogus as ICOs.
>>> 
>>> Here some good news: If they aquire value then they offer a way to generate income for hodler by temporarily giving up control.
>>> 
>>> Tamas Blummer
>>> 
>>>> 
>>>> The meaning in terms of Bitcoin is clear - the “owner” of outputs that represent value (i.e. in the ability to trade them for something else) is recorded publicly and, given Bitcoin security assumptions, cannot be faked. What is not clear is the utility of a record of outputs that cannot be traded for something else. You seem to imply that a record is valuable simply because it’s a record.
>>>> 
>>>> e
>>>> 
>>>>> On Jun 30, 2019, at 11:35, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>>> 
>>>>> 
>>>>>> On Jun 30, 2019, at 19:41, Eric Voskuil <eric@voskuil.org> wrote:
>>>>>> 
>>>>>> 
>>>>>>> On Jun 30, 2019, at 03:56, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>>>>> 
>>>>>>> Hi Eric,
>>>>>>> 
>>>>>>>> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
>>>>>>>> 
>>>>>>>> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
>>>>>>> 
>>>>>>> Coins encumbered with the described covenant represent temporary control of a scarce resource.
>>>>>>> 
>>>>>>> Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.
>>>>>> 
>>>>>> For something to become property (and therefore have marketable value) requires that it be both scarce and useful. Bitcoin is useful only to the extent that it can be traded for something else that is useful. Above you are only dealing with scarcity, ignoring utility.
>>>>> 
>>>>> There is a deeper utility of Bitcoin than it can be traded for something else. That utility is to use its unforgeable register.
>>>>> We have only one kind of units in this register and by having covenants we would create other kinds that are while encumbered not fungible with the common ones.
>>>>> 
>>>>> Units are certainly less desirable if encumbered with a debt covenant. You say no one would assign them any value.
>>>>> 
>>>>> I am not that sure as they still offer the utility of using the unforgeable register, in this case a register of debt covered by reserves.
>>>>> You also doubt forcing debt to be covered by reserves is a good idea, I got that, but suppose we do not discuss this here.
>>>>> If there are people who think it is a good idea, then they would find having an unforgeable register of it useful and therefore units needed to maintain that register valuable to some extent.
>>>>> 
>>>>>> 
>>>>>>> I think you do not show the neccesary respect of the market.
>>>>>> 
>>>>>> I’m not sure what is meant here by respect, or how much of it is necessary. I am merely explaining the market.
>>>>> 
>>>>> You are not explaining an existing market but claim that market that is not yet there will follow your arguments.
>>>>> 
>>>>>>> Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.
>>>>>> 
>>>>>> It seems to me you have reversed the meaning of temporary and final. Bitcoin is useful because of the presumption that there is no finality of control. One presumes an ability to trade control of it for something else. This is temporary control. Final control would be the case in which, at some point, it can no longer be traded, making it worthless at that point. If this is known to be the case it implies that it it worthless at all prior points as well.
>>>>>> 
>>>>>> These are distinct scenarios. The fact that temporary (in my usage) control implies the possibility of value does not imply that finality of control does as well. The fact that (renowned or otherwise) people have made errors does not imply that I am making an error. These are both non-sequiturs.
>>>>>> 
>>>>>>> I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.
>>>>>> 
>>>>>> The analogy to rental of a consumable good does not apply to the case of a non-consumable good. If it cannot be traded and cannot be consumed it cannot obtain marketable value. To this point it matters not whether it exists.
>>>>> 
>>>>> I meant with control the control of entries in the register which I think is the deeper utility of Bitcoin. Final control is meant to be the opposite of temporary which is the time limited control with some expiry.
>>>>> 
>>>>> Thank you for your thoughts as they help to sharpen my arguments.
>>>>> 
>>>>> Best,
>>>>> 
>>>>> Tamas Blummer
>>>>> 
>>>>>> Best,
>>>>>> Eric
>>>>>> 
>>>>>>> Tamas Blummer
> 

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[ZmnSCPxj]

Good morning Eric, and Tamas,

> In the case of tracking an asset that becomes worthless at a specific time, one could value a record of ownership, and the ability to trade ownership of the asset during the period. Consider colored coin type tracking of a theater ticket for a specific show, where the ticket is worthless by the end of the show.

As it happens, I was playing around with another idea I am developing.
And it involves something very much similar, but distinct.

In particular, currencies are worthless unless exchanged for things of value to existent beings.
And the discovery of things of value is enabled by advertising.
The idea I am developing, is that of a "Bitcoin Classified Ads Network", wherein ordinary P2PKH UTXOs (or P2WPKH equivalents) embed a commitment to an advertisement.
A secondary network of nodes (separate from the Bitcoin network) transmits the actual advertisements, as well as the UTXOs being used to commit to them.
This secondary network would then reject/purge advertisements once the UTXO is spent on the Bitcoin blockchain.
This makes advertising costly (for the opportunity cost of locking some money in a UTXO until one has acquired actual paying custom) while reducing impact on Bitcoin blockchain space (commitment to the advertisment is in the same space as the ownership of the coin).
Changing the advertisement one makes is possible, at the cost of paying for a transaction in the Bitcoin blockchain to spend the old UTXO and publish a new UTXO now committing to the new advertisement.

Of note is that I also derived that it would be beneficial, for some HODLers to offer their funds for the purpose of making these advertisements.
Some service or product provider would agree with an advertiser to lock some coins of the advertiser for a limited amount of time, in exchange for payment upfront, with the coin address committing to the indicate advertisement of the service or product provider.
This can be done by paying to a 2p-ECDSA (or with Schnorr, MuSig) public key, with the service/product provider embedding a commitment to its advertisement to its own key, and a pre-signed `nLockTime` transaction that lets the advertiser recover the money.

This is in fact a similar use to the "theater ticket" case you mentioned, yet distinct.
In the case of the Bitcoin Classified Ads Network, it is the intermediate addresses used before reclamation by the advertiser that is valuable, as they also serve as commitments to advertisements, attesting to the (probable) validity of the advertisement and making spam have a cost.
Given that nodes of the Bitcoin Classified Ads Network will have memory limits, advertisements whose "lockup-rate" (i.e. the amount of value of the backing UTXO, divided by the size of the advertisement) are low could be evicted from memory before advertisements with high lockup-rate, and thus be less likely to propagate across the network.
Thus service/product providers would want to increase their "marketing budget" to be less likely to be evicted from nodes of the Bitcoin Classified Ads Network, which is beneficial as it increases the minimum practical lockup-rate needed to spam the network, thus making spam costly.

My current plan is that the provider can contact the advertiser in order to effect changes to their advertisement.
Then the provider and the advertiser sign a new timelocked reclamation transaction, then sign a transaction moving from the old advertisement to the new advertisement (presumably there is some protocol for ensuring the advertiser gets paid for this, such as an HTLC that can be triggered by an onchain payment or by an LN payment; I have the details in my processing space but require some time to serialize to human-readabe format).

Arguably, this example seems to show that generalized covenants are not needed in fact, if transfers of coin require paying to the issuer/lender of the coin.
Generalized covenants allows the provider (or ticket-holder in your example) to effect transfers from one advertisement to another (or one ticket-holder to another in your example) without cooperation with the advertiser (or ticket-issuer in your example).
This would be otherwise needed if we lock using a 2-of-2 address that has a timelocked transaction to reclaim the funds.

Regards,
ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 7686 bytes --]

Good morning Eric and ZmnSCPxj,

> On Jul 2, 2019, at 05:45, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
> 
> Good morning Eric, and Tamas,
> 
>> In the case of tracking an asset that becomes worthless at a specific time, one could value a record of ownership, and the ability to trade ownership of the asset during the period. Consider colored coin type tracking of a theater ticket for a specific show, where the ticket is worthless by the end of the show.
> 
> As it happens, I was playing around with another idea I am developing.
> And it involves something very much similar, but distinct.
> 
> In particular, currencies are worthless unless exchanged for things of value to existent beings.
> And the discovery of things of value is enabled by advertising.
> The idea I am developing, is that of a "Bitcoin Classified Ads Network", wherein ordinary P2PKH UTXOs (or P2WPKH equivalents) embed a commitment to an advertisement.
> A secondary network of nodes (separate from the Bitcoin network) transmits the actual advertisements, as well as the UTXOs being used to commit to them.
> This secondary network would then reject/purge advertisements once the UTXO is spent on the Bitcoin blockchain.
> This makes advertising costly (for the opportunity cost of locking some money in a UTXO until one has acquired actual paying custom) while reducing impact on Bitcoin blockchain space (commitment to the advertisment is in the same space as the ownership of the coin).
> Changing the advertisement one makes is possible, at the cost of paying for a transaction in the Bitcoin blockchain to spend the old UTXO and publish a new UTXO now committing to the new advertisement.
> 
> Of note is that I also derived that it would be beneficial, for some HODLers to offer their funds for the purpose of making these advertisements.

All above aligns with my intuition that: on one side giving up temporary control of UTXOs represent opportunity cost and on the receiver side having temporary control can unlock utility they would pay for.
If the techical setup is trustless and return of control to those who gave it up temporarilty is certain, then this in combination means that HODLer are able to earn riskless interest by giving up control of their UTXOs temporarily.


> Some service or product provider would agree with an advertiser to lock some coins of the advertiser for a limited amount of time, in exchange for payment upfront, with the coin address committing to the indicate advertisement of the service or product provider.
> This can be done by paying to a 2p-ECDSA (or with Schnorr, MuSig) public key, with the service/product provider embedding a commitment to its advertisement to its own key, and a pre-signed `nLockTime` transaction that lets the advertiser recover the money.
> 
> This is in fact a similar use to the "theater ticket" case you mentioned, yet distinct.
> In the case of the Bitcoin Classified Ads Network, it is the intermediate addresses used before reclamation by the advertiser that is valuable, as they also serve as commitments to advertisements, attesting to the (probable) validity of the advertisement and making spam have a cost.
> Given that nodes of the Bitcoin Classified Ads Network will have memory limits, advertisements whose "lockup-rate" (i.e. the amount of value of the backing UTXO, divided by the size of the advertisement) are low could be evicted from memory before advertisements with high lockup-rate, and thus be less likely to propagate across the network.
> Thus service/product providers would want to increase their "marketing budget" to be less likely to be evicted from nodes of the Bitcoin Classified Ads Network, which is beneficial as it increases the minimum practical lockup-rate needed to spam the network, thus making spam costly.
> 
> My current plan is that the provider can contact the advertiser in order to effect changes to their advertisement.
> Then the provider and the advertiser sign a new timelocked reclamation transaction, then sign a transaction moving from the old advertisement to the new advertisement (presumably there is some protocol for ensuring the advertiser gets paid for this, such as an HTLC that can be triggered by an onchain payment or by an LN payment; I have the details in my processing space but require some time to serialize to human-readabe format).
> 
> Arguably, this example seems to show that generalized covenants are not needed in fact, if transfers of coin require paying to the issuer/lender of the coin.
> Generalized covenants allows the provider (or ticket-holder in your example) to effect transfers from one advertisement to another (or one ticket-holder to another in your example) without cooperation with the advertiser (or ticket-issuer in your example).
> This would be otherwise needed if we lock using a 2-of-2 address that has a timelocked transaction to reclaim the funds.

Yes, your example does not need the covenant as the one who gave up temporary control is still involved in any motion of the UTXO, therefore able to enforce own interest that reclaiming the UTXOs remains possible.

A covenant is needed only if it is against the interest of all parties involved in transfers of the UTXO, in which case consensus must enforce that it is carried forward.
The added strength of the covenant is that the one who gives up temporary control does not have to be involved in using the UTXO until it is given back.

Note that the advertizing service provider would need temporary access to UTXOs of signficant value, so opportunity cost and thereby cost of advertizing becomes significant.
Covenants would allow the separation of the advertizing service from HODLer funding it with significant UTXOs.
HODLer could give temporary control to the service and the service could broker those to others, but the original HODLer was sure to receive the UTXOs back and the HODLer would not be bothered with the operation of the service.

The covenant I proposed would add an alternate taproot validation path stacked onto previously existing ones.
This means that one could give others temporary access for a shorter time period than one’s own temporary access.
One could however not override the delayed access secured for the HODLer.

Does this remind you of something? Yes, the service provider would act like a bank, matching depositor, the HODLer, with those who need temporary control of UTXO for advertizing purposes.
This shows why temporary control with covenant can be understood as loan in a full reserve banking, which started my exploration of this topic.

Current technical means do not allow trustless and hands-off coordination of provider of UTXOs (that is capital) with provider of arbitary services that monetize the use of Bitcoin’s unforgable registry.
In other words we need covenants to enable Bitcoin applications to trustlessly and flexibly deal with foreign capital.

One other thing the consensus would have to ensure is that inputs with covenants are merged only into outputs with same covenant.
Which makes UTXOs with a particular covenants obey rules earlier known for colored coins and transactions moving it form a distinct embedded chain.
Adding same covenant establishes fungible coinbases of same embedded chain and dropping the covenant makes them again fungible with common UTXOs.

I could not be more excited of what boost this could give to the Bitcoin economy, unlocking the use of its unforgeable registry to track any asset with the same security guarantees it offers for its own cash token.

Best to you,

Tamas Blummer


> 
> Regards,
> ZmnSCPxj


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[ZmnSCPxj]

Good morning Tamas,

> Note that the advertizing service provider would need temporary access to UTXOs of signficant value, so opportunity cost and thereby cost of advertizing becomes significant.
> Covenants would allow the separation of the advertizing service from HODLer funding it with significant UTXOs.
> HODLer could give temporary control to the service and the service could broker those to others, but the original HODLer was sure to receive the UTXOs back and the HODLer would not be bothered with the operation of the service.

Thank you for this thought.
It has challenged me to consider how to bring this capability out of the Bitcoin blockchain.

As a counterargument, I observe that committing to the advertisement on the UTXO is similar to committing to a SCRIPT on a UTXO.
And I observe the Graftroot idea, wherein we commit to a public key on the UTXO, and admit a SCRIPT that is signed by the public key as a SCRIPT that unlocks the UTXO for spending.

By analogy, in my "advertising" scheme, instead of committing the advertisement on the UTXO, I can instead commit a public key (for example, the hash of the "advertiser pubkey" is used to tweak the onchain public key).
Then we use this advertiser pubkey to admit advertisements on the advertising network.

This advertiser pubkey is used to sign an "advertisement chain", which is a merklized singly-linked list whose contents are the actual advertisements, each node being signed using the advertiser pubkey.
To ensure that the advertiser does not sign multiple versions of this chain, we can have the signing nonce be derived from the height of the advertchain, such that signing the same height multiple times leads to private key revelation.
Each header of the advertchain also includes a `CLTV`-like construct, which is the Bitcoin blockheight that must be reached first before another advertchain header can be added, containing a new advertisement that replaces the previous one.

This lets an advertising broker pay for some onchain UTXO to a HODLer, providing a `nLockTime`d onchain transaction returning the funds to the HODLer, with the UTXO paying to a 2-of-2 with a commitment to the advertiser pubkey.
Then the advertising broker can rent out the UTXO to providers who wish to advertise, though I have to figure out how to make this atomic (i.e. paying the advertiser onchain or on Lightning, would be enough for the provider to derive the advertchain header and its signature, for its own advertisement --- perhaps some minimal SCRIPT-like language on the advertchain can be done).

This lets the advertising broker case to work even without generalized covenants on the Bitcoin blockchain, while providing the same benefit of not bothering the HODLer who ultimately owns the funds each time advertisements need to be changed.
This gives the advantage that changes to the advertisement that is attested by a UTXO do not have any activity on the Bitcoin blockchain itself, only on the advertchain; at the cost that the advertising network now takes on the added bandwidth of handling several tiny blockchains of limited lifetime, instead of keeping the data on "which advertisement is valid" on the Bitcoin blockchain.

Regards,
ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 1422 bytes --]

Hello ZmnSCPxj,

> On Jul 2, 2019, at 10:12, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
> 
> As a counterargument, I observe that committing to the advertisement on the UTXO is similar to committing to a SCRIPT on a UTXO.
> And I observe the Graftroot idea, wherein we commit to a public key on the UTXO, and admit a SCRIPT that is signed by the public key as a SCRIPT that unlocks the UTXO for spending.
> 
> By analogy, in my "advertising" scheme, instead of committing the advertisement on the UTXO, I can instead commit a public key (for example, the hash of the "advertiser pubkey" is used to tweak the onchain public key).
> Then we use this advertiser pubkey to admit advertisements on the advertising network.
> 
> This advertiser pubkey is used to sign an "advertisement chain", which is a merklized singly-linked list whose contents are the actual advertisements, each node being signed using the advertiser pubkey.
> To ensure that the advertiser does not sign multiple versions of this chain, we can have the signing nonce be derived from the height of the advertchain, such that signing the same height multiple times leads to private key revelation.

The advertiser would thereby put the funds of the HODLer on risk of his misbehavior, which means the HODLer would have to trust the advertizing service.
This is not the trustless separation the covenant achives.

Regards,

Tamas Blummer


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 2007 bytes --]

Hello ZmnSCPxj,

I share your goal to move everything possible off-chain.

The discussion of covenant is not an on/off-chain discussion, but if covenant is needed to solve problems we currently can not and which unlock significant innovation.

Consensus support of the covenant is only needed if an unchained setup using it is closed uncooperatively, otherwise there is not even a reason to disclose on-chain that a covenant was used.

Regards,

Tamas Blummer

> On Jul 2, 2019, at 11:30, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> Hello ZmnSCPxj,
> 
>> On Jul 2, 2019, at 10:12, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>> 
>> As a counterargument, I observe that committing to the advertisement on the UTXO is similar to committing to a SCRIPT on a UTXO.
>> And I observe the Graftroot idea, wherein we commit to a public key on the UTXO, and admit a SCRIPT that is signed by the public key as a SCRIPT that unlocks the UTXO for spending.
>> 
>> By analogy, in my "advertising" scheme, instead of committing the advertisement on the UTXO, I can instead commit a public key (for example, the hash of the "advertiser pubkey" is used to tweak the onchain public key).
>> Then we use this advertiser pubkey to admit advertisements on the advertising network.
>> 
>> This advertiser pubkey is used to sign an "advertisement chain", which is a merklized singly-linked list whose contents are the actual advertisements, each node being signed using the advertiser pubkey.
>> To ensure that the advertiser does not sign multiple versions of this chain, we can have the signing nonce be derived from the height of the advertchain, such that signing the same height multiple times leads to private key revelation.
> 
> The advertiser would thereby put the funds of the HODLer on risk of his misbehavior, which means the HODLer would have to trust the advertizing service.
> This is not the trustless separation the covenant achives.
> 
> Regards,
> 
> Tamas Blummer
> 


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 2157 bytes --]

Hello ZmnSCPxj,

To be more precise, the value of the UTXO is severaly damaged that it is governed by rules of a de-facto side chain with different rules.
Therefore its value to those renting it from the advertizer is just that of the advertizement, which is not neccesarily following the opportunity cost.

The covenant supported temporary access is transitive, therefore anyone who is in temporary control of an UTXO can recover its cost by sub-renting.
The opportunity (riskless) interest provides a baseline of value on top of which you may have utility that is the advertizement.

Regards,

Tamas Blummer

> On Jul 2, 2019, at 11:30, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> Hello ZmnSCPxj,
> 
>> On Jul 2, 2019, at 10:12, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>> 
>> As a counterargument, I observe that committing to the advertisement on the UTXO is similar to committing to a SCRIPT on a UTXO.
>> And I observe the Graftroot idea, wherein we commit to a public key on the UTXO, and admit a SCRIPT that is signed by the public key as a SCRIPT that unlocks the UTXO for spending.
>> 
>> By analogy, in my "advertising" scheme, instead of committing the advertisement on the UTXO, I can instead commit a public key (for example, the hash of the "advertiser pubkey" is used to tweak the onchain public key).
>> Then we use this advertiser pubkey to admit advertisements on the advertising network.
>> 
>> This advertiser pubkey is used to sign an "advertisement chain", which is a merklized singly-linked list whose contents are the actual advertisements, each node being signed using the advertiser pubkey.
>> To ensure that the advertiser does not sign multiple versions of this chain, we can have the signing nonce be derived from the height of the advertchain, such that signing the same height multiple times leads to private key revelation.
> 
> The advertiser would thereby put the funds of the HODLer on risk of his misbehavior, which means the HODLer would have to trust the advertizing service.
> This is not the trustless separation the covenant achives.
> 
> Regards,
> 
> Tamas Blummer
> 


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[ZmnSCPxj]

Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday, July 2, 2019 5:30 PM, Tamas Blummer <tamas.blummer@gmail.com> wrote:

> Hello ZmnSCPxj,
>
> > On Jul 2, 2019, at 10:12, ZmnSCPxj ZmnSCPxj@protonmail.com wrote:
> > As a counterargument, I observe that committing to the advertisement on the UTXO is similar to committing to a SCRIPT on a UTXO.
> > And I observe the Graftroot idea, wherein we commit to a public key on the UTXO, and admit a SCRIPT that is signed by the public key as a SCRIPT that unlocks the UTXO for spending.
> > By analogy, in my "advertising" scheme, instead of committing the advertisement on the UTXO, I can instead commit a public key (for example, the hash of the "advertiser pubkey" is used to tweak the onchain public key).
> > Then we use this advertiser pubkey to admit advertisements on the advertising network.
> > This advertiser pubkey is used to sign an "advertisement chain", which is a merklized singly-linked list whose contents are the actual advertisements, each node being signed using the advertiser pubkey.
> > To ensure that the advertiser does not sign multiple versions of this chain, we can have the signing nonce be derived from the height of the advertchain, such that signing the same height multiple times leads to private key revelation.
>
> The advertiser would thereby put the funds of the HODLer on risk of his misbehavior, which means the HODLer would have to trust the advertizing service.

No it would not :)

Onchain, the locked UTXO would be a 2-of-2 MuSig / 2p-ECDSA of the HODLer and the advertising broker.
The HODLer and advertising broker perform a (mostly-offchain) ritual that ensures that the HODLer gets a `nLockTime` transaction spending from this UTXO and paying it back to the HODLer, and that the advertising broker pays for rent of this UTXO, prior to the UTXO actually appearing onchain.

The UTXO requires both cooperation of HODLer and advertising broker in order to spend, and the HODLer only cares that it gets an `nLockTime` transaction and will no longer cooperate / will permanently delete its share of the key after getting this.

The MuSig / 2p-ECDSA pubkey used will then be tweaked (by addition in MuSig, by multiplication in 2p-ECDSA; the HOLDer need not even learn it, the advertising broker can tweak its pubkey in the Bitcoin-level transaction beforehand) to commit to a hash of the "Advertising pubkey".
Thus I say the UTXO "commits to the advertising pubkey", not "pays to the advertising pubkey".
Indeed, the pubkey of the advertising broker used on the Bitcoin blockchain can be very different from the advertising pubkey used on the advertchain.

This "Advertising pubkey" is the pubkey used in the advertchain.

The actual money on Bitcoin cannot be spent by the broker unilaterally.

However, what advertisement it will commit to on the advertchain, can be controlled unilaterally by the advertising broker.
That is the entire point: the HODLer rents out the UTXO to the advertising broker, relinquishes control over the advertchain, but retaining (eventual) control over the actual Bitcoins.
The advertising broker then has sole control of the advertchain, and can rent it out for smaller timeframes to actual service/product providers.


Regards,
ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1.1: Type: text/plain, Size: 2345 bytes --]


Hello ZmnSCPxj,

> On Jul 2, 2019, at 12:33, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
> 
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Tuesday, July 2, 2019 5:30 PM, Tamas Blummer <tamas.blummer@gmail.com <mailto:tamas.blummer@gmail.com>> wrote:
> 
>> The advertiser would thereby put the funds of the HODLer on risk of his misbehavior, which means the HODLer would have to trust the advertizing service.
> 
> No it would not :)


You are right. I noticed after sending my reply and then I sent two other. I apologize for being noisy.

Let me consolidate my thinking, here.

If there is a use for UTXOs with temporary control, then those who want that use will pay for it.

A user of a service that requires temporary control UTXOs would need to cover:

1. fees required by the service
2. the opportunity cost of temporary ownership paid to the original holder who gave up control.

If the service is operated by an entity billing user then it can use UTXOs of minimal value for its operation and practically ignore opportunity interest.
This is the case with theater tickets just and other simple colored coin like use of Bitcoin. Also in case of the unchained advertizement, if the service bills its user
for its internal re-allocation of an UTXO, then why would it need to use significant value temorary control UTXOs? Actually why not use plain UTXOs, to start with?

If however the service is a common good, a network without owner and therefore not billing on behalf of someone, but wants to protect itself from spam, then it is could require temporary access to significant value UTXOs and thereby induce opportunity cost to user. Alternatively it could require burning ordinary UTXOs. Burning indirectly benefits all HODLer, temporary control benefits those who consciously gave up control. I dislike burning as it is unsustainable.

If the implementation of temporary use is enforced by consenus such that it is transitive, then temporary use could be re-rented or sold to recover opportunity cost for no longer needed temporary access, making it useable for an other service.

Temporary access UTXOs with covenants allows us to build spam limited public services that are not owned by an operator and financially benefit HODLer offering them riskless interest.

Tamas Blummer

[-- Attachment #1.2: Type: text/html, Size: 6848 bytes --]

[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 7981 bytes --]


> On Jul 1, 2019, at 20:52, Eric Voskuil <eric@voskuil.org> wrote:
> 
> I said that I would make no further comment given the belief that no new ideas were surfacing. However, after giving it some more thought on my own, I believe I have found the one case in which a person could value such encumbered coins.
> 
> In the case of tracking an asset that becomes worthless at a specific time, one could value a record of ownership, and the ability to trade ownership of the asset during the period. Consider colored coin type tracking of a theater ticket for a specific show, where the ticket is worthless by the end of the show.
> 


In other words you now see the utility of a register offered by UTXOs that are only temporary availability to current owner. If there is a utility there is also a value in it for them.
I am glad we are on the same side on this utility and thanks to you and ZmnSCPxj we now have two additional uses cases for UTXOs that are only temporarily accessible to their current owner.

Since ZmnSCPxj also raised the question if covenants are needed at all, let me continue my thoughts on this in reply to his mail.

Tamas Blummer

> 
> 
>> On Jun 30, 2019, at 13:26, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>> 
>> My argument does not need the comparison with ICOs.
>> 
>> They were just an example that people pay for the utility of register even though others think the tokens they keep track of are worthless.
>> 
>> Tamas Blummer
>> 
>> 
>>> On Jun 30, 2019, at 22:13, Eric Voskuil <eric@voskuil.org> wrote:
>>> 
>>> ICO tokens can be traded (indefinitely) for other things of value, so the comparison isn’t valid. I think we’ve both made our points clearly, so I’ll leave it at that.
>>> 
>>> Best,
>>> Eric
>>> 
>>>> On Jun 30, 2019, at 12:55, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>> 
>>>> 
>>>>> On Jun 30, 2019, at 20:54, Eric Voskuil <eric@voskuil.org> wrote:
>>>>> 
>>>>> Could you please explain the meaning and utility of “unforgeable register” as it pertains to such encumbered coins?
>>>> 
>>>> I guess we agree that some way of keeping track of ownership is prerequisite for something to aquire value.
>>>> We likely also agree that the security of that ownership register has great influence to the value.
>>>> 
>>>> The question remains if a register as utility in itself gives value to the thing needed to use that register.
>>>> I think it does, if people are interested in what it keeps track of, for whatever reason, even for reasons you find bogus.
>>>> 
>>>> It was not intentional, but I think I just explained why Ethereum aquired higher market value by being register of ICO tokens.
>>>> 
>>>> Now back to the coins encumbered with the debt covenant:
>>>> Transactions moving them constitute a register of covered debt and you need them to update that register.
>>>> Should some people find such a register useful then those coins needed to update this register will aquire value.
>>>> Does not matter if you think the concept of covered debt is just as bogus as ICOs.
>>>> 
>>>> Here some good news: If they aquire value then they offer a way to generate income for hodler by temporarily giving up control.
>>>> 
>>>> Tamas Blummer
>>>> 
>>>>> 
>>>>> The meaning in terms of Bitcoin is clear - the “owner” of outputs that represent value (i.e. in the ability to trade them for something else) is recorded publicly and, given Bitcoin security assumptions, cannot be faked. What is not clear is the utility of a record of outputs that cannot be traded for something else. You seem to imply that a record is valuable simply because it’s a record.
>>>>> 
>>>>> e
>>>>> 
>>>>>> On Jun 30, 2019, at 11:35, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>>>> 
>>>>>> 
>>>>>>> On Jun 30, 2019, at 19:41, Eric Voskuil <eric@voskuil.org> wrote:
>>>>>>> 
>>>>>>> 
>>>>>>>> On Jun 30, 2019, at 03:56, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>>>>>> 
>>>>>>>> Hi Eric,
>>>>>>>> 
>>>>>>>>> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
>>>>>>>>> 
>>>>>>>>> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
>>>>>>>> 
>>>>>>>> Coins encumbered with the described covenant represent temporary control of a scarce resource.
>>>>>>>> 
>>>>>>>> Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.
>>>>>>> 
>>>>>>> For something to become property (and therefore have marketable value) requires that it be both scarce and useful. Bitcoin is useful only to the extent that it can be traded for something else that is useful. Above you are only dealing with scarcity, ignoring utility.
>>>>>> 
>>>>>> There is a deeper utility of Bitcoin than it can be traded for something else. That utility is to use its unforgeable register.
>>>>>> We have only one kind of units in this register and by having covenants we would create other kinds that are while encumbered not fungible with the common ones.
>>>>>> 
>>>>>> Units are certainly less desirable if encumbered with a debt covenant. You say no one would assign them any value.
>>>>>> 
>>>>>> I am not that sure as they still offer the utility of using the unforgeable register, in this case a register of debt covered by reserves.
>>>>>> You also doubt forcing debt to be covered by reserves is a good idea, I got that, but suppose we do not discuss this here.
>>>>>> If there are people who think it is a good idea, then they would find having an unforgeable register of it useful and therefore units needed to maintain that register valuable to some extent.
>>>>>> 
>>>>>>> 
>>>>>>>> I think you do not show the neccesary respect of the market.
>>>>>>> 
>>>>>>> I’m not sure what is meant here by respect, or how much of it is necessary. I am merely explaining the market.
>>>>>> 
>>>>>> You are not explaining an existing market but claim that market that is not yet there will follow your arguments.
>>>>>> 
>>>>>>>> Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.
>>>>>>> 
>>>>>>> It seems to me you have reversed the meaning of temporary and final. Bitcoin is useful because of the presumption that there is no finality of control. One presumes an ability to trade control of it for something else. This is temporary control. Final control would be the case in which, at some point, it can no longer be traded, making it worthless at that point. If this is known to be the case it implies that it it worthless at all prior points as well.
>>>>>>> 
>>>>>>> These are distinct scenarios. The fact that temporary (in my usage) control implies the possibility of value does not imply that finality of control does as well. The fact that (renowned or otherwise) people have made errors does not imply that I am making an error. These are both non-sequiturs.
>>>>>>> 
>>>>>>>> I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.
>>>>>>> 
>>>>>>> The analogy to rental of a consumable good does not apply to the case of a non-consumable good. If it cannot be traded and cannot be consumed it cannot obtain marketable value. To this point it matters not whether it exists.
>>>>>> 
>>>>>> I meant with control the control of entries in the register which I think is the deeper utility of Bitcoin. Final control is meant to be the opposite of temporary which is the time limited control with some expiry.
>>>>>> 
>>>>>> Thank you for your thoughts as they help to sharpen my arguments.
>>>>>> 
>>>>>> Best,
>>>>>> 
>>>>>> Tamas Blummer
>>>>>> 
>>>>>>> Best,
>>>>>>> Eric
>>>>>>> 
>>>>>>>> Tamas Blummer
>> 


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jul 2, 2019, at 00:08, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> 
>> On Jul 1, 2019, at 20:52, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>> I said that I would make no further comment given the belief that no new ideas were surfacing. However, after giving it some more thought on my own, I believe I have found the one case in which a person could value such encumbered coins.
>> 
>> In the case of tracking an asset that becomes worthless at a specific time, one could value a record of ownership, and the ability to trade ownership of the asset during the period. Consider colored coin type tracking of a theater ticket for a specific show, where the ticket is worthless by the end of the show.
> 
> 
> In other words you now see the utility of a register offered by UTXOs that are only temporary availability to current owner. If there is a utility there is also a value in it for them.

In other words I discovered a potentially-valid use case for you. The concern I expressed was that you had not presented one.

> I am glad we are on the same side on this utility

My goal is never to discourage, but understanding of provable behavior and utility. Our space is replete with unsupportable conjecture and hyperbole. There are no sides, just discovery of truth.

> and thanks to you and ZmnSCPxj we now have two additional uses cases for UTXOs that are only temporarily accessible to their current owner.

Actually you have a single potentially-valid use case, the one I have presented. The others I have shown to be invalid (apart from scamming) and no additional information to demonstrate errors in my conclusions have been offered.

I’ve noticed that in subsequent posts you continue to imply that there is economic value in such tracking of any asset, and of course here imply the validity of your other use case, monetary lending. This, as I have shown, is not the case. Tracking of an asset of value beyond the net compound interest cost of dust is more cheaply accomplished by burning than by renting, and as I have shown, it is not accurate to claim that the encumbered coin can be used as money (or to track any asset of perpetual value). When the coin expires the money/asset holder becomes a bag holder, invalidating any initial value apart from scamming.

In the valid use case that I have demonstrated (tracking of expiring assets), the marketable value of the rented coin is not the market price of that coin, but the price paid for it. So for example, 1 coin rented at 10% APR for one year is worth .1 coin. And when a renter resells this tracking coin it is worth the fraction of this amount for the time remaining. The coin itself (i.e. its face value) cannot be used by the renter to purchase anything.

As such this is truly not a loan in the financial or economic sense. Given an actual loan the borrower can use the full value of the amount borrowed to purchase goods that can be used in production. Subsequent generation of products and thereby revenue is the source of yield on a loan (economically equivalent to dividend on an equity contract). This allows the borrower to repay the loan with interest. Without *any* usable capital over the term of the rental, there is no investment possible and the time value of the rented coin cannot be realized by the renter.

So the one potentially-valid scenario, a fixed-term tracking rental, is entirely an *expense*, not a loan. A financial loan incurs an interest expense, but also implies the value of the amount loaned is fully usable (i.e., consumed or traded) during the term (the reason to pay interest). That is money over time, yielding the time value of money. In this case the value of the loan at any time to the renter is simply the amortized interest remaining. This implies that no income can be generated from the rental “principle” by the renter. A price is paid for the rental and that value of the rental is fully exhausted by the end of the term, with no other benefit than the tracking that was purchased.

The person renting the fixed-term tracking coin (i.e. “owner”) can earn income by selling dust+1 outputs at the cost of capital, limited to a maximum term dictated by the cost of capital and the dust limit (as shown previously). Economically speaking, all business returns gravitate toward the cost of capital, including lending, and this is no different. But it cannot be said that the owner is a financial lender. The owner is simply selling non-depreciating (from his perspective) fixed-term tracking space.

The owner can of course trade rights to the controlling output. The rental contract has been prepaid (by your design, in order to shift counterparty risk). As such the traded contract has no yield and therefore contracting for its sale is a currency future, not an interest rate future as would be implied by a debt market. Yet FX speculation already exists for Bitcoin, requiring no covenant or rental market. This would seem to undermine any secondary market for these more complex and limited currency futures.

Finally, valuation is based on the assumption of a non-zero dust+1, which BTC enforces as a 0 satoshi dust limit (i.e. 0 sats is considered dust and is not valid). Anything above this is policy-enforced only. As such a miner can undercut the cost of tracking an individual asset down to 1 sat. Given that there is no financial incentive to a higher dust limit for a miner, but a positive financial incentive to undercut the rental price for the same return, this is economically rational and therefore must be assumed.

One might argue that a lower dust policy would hurt BTC and therefore its miners collectively, creating an offsetting negative financial pressure. However given that the apparent cost is socialized in relation to individual benefit, this is not an economically rational conclusion. Furthermore, as the tracking outputs become unspendable due to the nature of the covenant, there is no actual dust accumulation (implementation dependent).

As such the return on any fixed-term tracking output, given a 10% APR, would become as low as .1 sat per year, assuming such a market could continue to function at that level. But it is also the case that a 1 sat output can be burned directly by the tracker and used indefinitely. This would presumably undermine any robust market for fixed-term tracking rental.

Best,
Eric

> Since ZmnSCPxj also raised the question if covenants are needed at all, let me continue my thoughts on this in reply to his mail.

> Tamas Blummer
> 
>> 
>> 
>>> On Jun 30, 2019, at 13:26, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>> 
>>> My argument does not need the comparison with ICOs.
>>> 
>>> They were just an example that people pay for the utility of register even though others think the tokens they keep track of are worthless.
>>> 
>>> Tamas Blummer
>>> 
>>> 
>>>> On Jun 30, 2019, at 22:13, Eric Voskuil <eric@voskuil.org> wrote:
>>>> 
>>>> ICO tokens can be traded (indefinitely) for other things of value, so the comparison isn’t valid. I think we’ve both made our points clearly, so I’ll leave it at that.
>>>> 
>>>> Best,
>>>> Eric
>>>> 
>>>>> On Jun 30, 2019, at 12:55, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>>> 
>>>>> 
>>>>>> On Jun 30, 2019, at 20:54, Eric Voskuil <eric@voskuil.org> wrote:
>>>>>> 
>>>>>> Could you please explain the meaning and utility of “unforgeable register” as it pertains to such encumbered coins?
>>>>> 
>>>>> I guess we agree that some way of keeping track of ownership is prerequisite for something to aquire value.
>>>>> We likely also agree that the security of that ownership register has great influence to the value.
>>>>> 
>>>>> The question remains if a register as utility in itself gives value to the thing needed to use that register.
>>>>> I think it does, if people are interested in what it keeps track of, for whatever reason, even for reasons you find bogus.
>>>>> 
>>>>> It was not intentional, but I think I just explained why Ethereum aquired higher market value by being register of ICO tokens.
>>>>> 
>>>>> Now back to the coins encumbered with the debt covenant:
>>>>> Transactions moving them constitute a register of covered debt and you need them to update that register.
>>>>> Should some people find such a register useful then those coins needed to update this register will aquire value.
>>>>> Does not matter if you think the concept of covered debt is just as bogus as ICOs.
>>>>> 
>>>>> Here some good news: If they aquire value then they offer a way to generate income for hodler by temporarily giving up control.
>>>>> 
>>>>> Tamas Blummer
>>>>> 
>>>>>> 
>>>>>> The meaning in terms of Bitcoin is clear - the “owner” of outputs that represent value (i.e. in the ability to trade them for something else) is recorded publicly and, given Bitcoin security assumptions, cannot be faked. What is not clear is the utility of a record of outputs that cannot be traded for something else. You seem to imply that a record is valuable simply because it’s a record.
>>>>>> 
>>>>>> e
>>>>>> 
>>>>>>> On Jun 30, 2019, at 11:35, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>>>>> 
>>>>>>> 
>>>>>>>> On Jun 30, 2019, at 19:41, Eric Voskuil <eric@voskuil.org> wrote:
>>>>>>>> 
>>>>>>>> 
>>>>>>>>> On Jun 30, 2019, at 03:56, Tamas Blummer <tamas.blummer@gmail.com> wrote:
>>>>>>>>> 
>>>>>>>>> Hi Eric,
>>>>>>>>> 
>>>>>>>>>> On Jun 29, 2019, at 23:21, Eric Voskuil <eric@voskuil.org> wrote:
>>>>>>>>>> 
>>>>>>>>>> What loan? Alice has paid Bob for something of no possible utility to her, or anyone else.
>>>>>>>>> 
>>>>>>>>> Coins encumbered with the described covenant represent temporary control of a scarce resource.
>>>>>>>>> 
>>>>>>>>> Can this obtain value? That depends on the availability of final control and ability to deal with temporary control.
>>>>>>>> 
>>>>>>>> For something to become property (and therefore have marketable value) requires that it be both scarce and useful. Bitcoin is useful only to the extent that it can be traded for something else that is useful. Above you are only dealing with scarcity, ignoring utility.
>>>>>>> 
>>>>>>> There is a deeper utility of Bitcoin than it can be traded for something else. That utility is to use its unforgeable register.
>>>>>>> We have only one kind of units in this register and by having covenants we would create other kinds that are while encumbered not fungible with the common ones.
>>>>>>> 
>>>>>>> Units are certainly less desirable if encumbered with a debt covenant. You say no one would assign them any value.
>>>>>>> 
>>>>>>> I am not that sure as they still offer the utility of using the unforgeable register, in this case a register of debt covered by reserves.
>>>>>>> You also doubt forcing debt to be covered by reserves is a good idea, I got that, but suppose we do not discuss this here.
>>>>>>> If there are people who think it is a good idea, then they would find having an unforgeable register of it useful and therefore units needed to maintain that register valuable to some extent.
>>>>>>> 
>>>>>>>> 
>>>>>>>>> I think you do not show the neccesary respect of the market.
>>>>>>>> 
>>>>>>>> I’m not sure what is meant here by respect, or how much of it is necessary. I am merely explaining the market.
>>>>>>> 
>>>>>>> You are not explaining an existing market but claim that market that is not yet there will follow your arguments.
>>>>>>> 
>>>>>>>>> Your rant reminds me of renowed economists who still argue final control Bitcoin can not have value, you do the same proclaiming that temporary control of Bitcoin can not have value.
>>>>>>>> 
>>>>>>>> It seems to me you have reversed the meaning of temporary and final. Bitcoin is useful because of the presumption that there is no finality of control. One presumes an ability to trade control of it for something else. This is temporary control. Final control would be the case in which, at some point, it can no longer be traded, making it worthless at that point. If this is known to be the case it implies that it it worthless at all prior points as well.
>>>>>>>> 
>>>>>>>> These are distinct scenarios. The fact that temporary (in my usage) control implies the possibility of value does not imply that finality of control does as well. The fact that (renowned or otherwise) people have made errors does not imply that I am making an error. These are both non-sequiturs.
>>>>>>>> 
>>>>>>>>> I say, that temporary control does not have value until means dealing with it are offered, and that is I work on. Thereafter might obtain value if final control is deemed too expensive or not attainable, we shall see.
>>>>>>>> 
>>>>>>>> The analogy to rental of a consumable good does not apply to the case of a non-consumable good. If it cannot be traded and cannot be consumed it cannot obtain marketable value. To this point it matters not whether it exists.
>>>>>>> 
>>>>>>> I meant with control the control of entries in the register which I think is the deeper utility of Bitcoin. Final control is meant to be the opposite of temporary which is the time limited control with some expiry.
>>>>>>> 
>>>>>>> Thank you for your thoughts as they help to sharpen my arguments.
>>>>>>> 
>>>>>>> Best,
>>>>>>> 
>>>>>>> Tamas Blummer
>>>>>>> 
>>>>>>>> Best,
>>>>>>>> Eric
>>>>>>>> 
>>>>>>>>> Tamas Blummer
> 

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[ZmnSCPxj]

Good morning Eric,


> > and thanks to you and ZmnSCPxj we now have two additional uses cases for UTXOs that are only temporarily accessible to their current owner.
>
> Actually you have a single potentially-valid use case, the one I have presented. The others I have shown to be invalid (apart from scamming) and no additional information to demonstrate errors in my conclusions have been offered.

I presented another use case, that of the "Bitcoin Classified Ads Network".
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-July/017083.html

Advertisements are "backed" by an unspent TXO.
In order to limit their local resource consumption, nodes of this network will preferentially keep advertisements that are backed by higher UTXO values divided by advertisement size, and drop those with too low UTXO value divided by advertisement size.

Thus, spammers will either need to rent larger UTXO values for their spam, paying for the higher rent involved, or fall back to pre-Bitcoin spamming methods.
Thus I think I have presented a use-case that is viable for this and does not simply devolve to "just burn a 1-satoshi output".

I still do not quite support generalized covenants as the use-case is already possible on current Bitcoin (and given that with just a little more transaction introspection this enables Turing-completeness), but the basic concept of "renting a UTXO of substantial value" appears sound to me.


Regards,
ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

Hi ZmnSCPxj,

Generalizing a bit this appears to be the same with one exception. The amount of encumbered coin is relevant to an external observer. Of course the effective dust limit is the maximum necessary encumbrance otherwise.

In the case of simple tracking, the market value of the coin is not relevant, all that is required is a valid output. Hence the devolution to 1 sat tracking. In your scenario the objective is to establish a meaningful cost for the output.

A community of people using this as a sort of hashcash spam protection can raise the amount of encumbered coin (i.e. advertising threshold price) required in that context. The cost of this encumberance includes not only at least one tx fee but market cost of the coin rental.

At a 1 year advertisement term, 10% APR capital cost, and threshold of 1 encumbered coin, the same is achieved by burning .1 coin. In other words the renter (advertiser) has actually paid to the coin owner .1 coin to rent 1 coin for one year.

As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?

e

> On Jul 3, 2019, at 23:57, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
> 
> Good morning Eric,
> 
> 
>>> and thanks to you and ZmnSCPxj we now have two additional uses cases for UTXOs that are only temporarily accessible to their current owner.
>> 
>> Actually you have a single potentially-valid use case, the one I have presented. The others I have shown to be invalid (apart from scamming) and no additional information to demonstrate errors in my conclusions have been offered.
> 
> I presented another use case, that of the "Bitcoin Classified Ads Network".
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-July/017083.html
> 
> Advertisements are "backed" by an unspent TXO.
> In order to limit their local resource consumption, nodes of this network will preferentially keep advertisements that are backed by higher UTXO values divided by advertisement size, and drop those with too low UTXO value divided by advertisement size.
> 
> Thus, spammers will either need to rent larger UTXO values for their spam, paying for the higher rent involved, or fall back to pre-Bitcoin spamming methods.
> Thus I think I have presented a use-case that is viable for this and does not simply devolve to "just burn a 1-satoshi output".
> 
> I still do not quite support generalized covenants as the use-case is already possible on current Bitcoin (and given that with just a little more transaction introspection this enables Turing-completeness), but the basic concept of "renting a UTXO of substantial value" appears sound to me.
> 
> 
> Regards,
> ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 4285 bytes --]

Hi Eric,

there are some other ways to impose cost on use without direct billing, e.g.:

- Burn Bitcoins to use the service, as you mentioned. This could work and would benefit remaining Bitcoin owner, but is unsustainable.

- Pay high fees in self dealing transactions. This could work and would benefit miner.

- Time lock own Bitcoins. This is forgoing control of an UTXO for a time period, which implies opportunity cost. This could be done with CLTV (OP_HODL). It damages the current owner but benefits no one. The problem is one might not have substantial UTXO to  imply high enough opportunity cost.

- Pay someone else to time lock. This is paying someone to lock an UTXO for a time span. Payment and time lock could be combined in the same transaction.

- Transferable borrowed Bitcoin.  This needs the covenant. This benefits those who consciously give up control for a time span. Its advantage is that since transferable it can be sold if no longer needed, thereby shortening the term of the original arrangement. It coul be re-rented for a shorter time period.

Tamas Blummer


> On Jul 4, 2019, at 18:43, Eric Voskuil <eric@voskuil.org> wrote:
> 
> Hi ZmnSCPxj,
> 
> Generalizing a bit this appears to be the same with one exception. The amount of encumbered coin is relevant to an external observer. Of course the effective dust limit is the maximum necessary encumbrance otherwise.
> 
> In the case of simple tracking, the market value of the coin is not relevant, all that is required is a valid output. Hence the devolution to 1 sat tracking. In your scenario the objective is to establish a meaningful cost for the output.
> 
> A community of people using this as a sort of hashcash spam protection can raise the amount of encumbered coin (i.e. advertising threshold price) required in that context. The cost of this encumberance includes not only at least one tx fee but market cost of the coin rental.
> 
> At a 1 year advertisement term, 10% APR capital cost, and threshold of 1 encumbered coin, the same is achieved by burning .1 coin. In other words the renter (advertiser) has actually paid to the coin owner .1 coin to rent 1 coin for one year.
> 
> As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?
> 
> e
> 
>> On Jul 3, 2019, at 23:57, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>> 
>> Good morning Eric,
>> 
>> 
>>>> and thanks to you and ZmnSCPxj we now have two additional uses cases for UTXOs that are only temporarily accessible to their current owner.
>>> 
>>> Actually you have a single potentially-valid use case, the one I have presented. The others I have shown to be invalid (apart from scamming) and no additional information to demonstrate errors in my conclusions have been offered.
>> 
>> I presented another use case, that of the "Bitcoin Classified Ads Network".
>> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-July/017083.html
>> 
>> Advertisements are "backed" by an unspent TXO.
>> In order to limit their local resource consumption, nodes of this network will preferentially keep advertisements that are backed by higher UTXO values divided by advertisement size, and drop those with too low UTXO value divided by advertisement size.
>> 
>> Thus, spammers will either need to rent larger UTXO values for their spam, paying for the higher rent involved, or fall back to pre-Bitcoin spamming methods.
>> Thus I think I have presented a use-case that is viable for this and does not simply devolve to "just burn a 1-satoshi output".
>> 
>> I still do not quite support generalized covenants as the use-case is already possible on current Bitcoin (and given that with just a little more transaction introspection this enables Turing-completeness), but the basic concept of "renting a UTXO of substantial value" appears sound to me.
>> 
>> 
>> Regards,
>> ZmnSCPxj


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jul 4, 2019, at 12:10, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> Hi Eric,
> 
> there are some other ways to impose cost on use without direct billing, e.g.:
> 
> - Burn Bitcoins to use the service, as you mentioned. This could work and would benefit remaining Bitcoin owner, but is unsustainable.

Burning is not an economic concern and cannot be prevented. As there are fewer coins, all things being equal, the cost of each increases, and thus fewer must be burned to achieve the same cost. So assuming sufficient divisibility (an existing Bitcoin assumption) it is sustainable. But as I demonstrated, it’s not necessary.

> - Pay high fees in self dealing transactions. This could work and would benefit miner.

This is essentially what I suggested, though presumably you mean Bitcoin fees not secondary network.

> - Time lock own Bitcoins. This is forgoing control of an UTXO for a time period, which implies opportunity cost. This could be done with CLTV (OP_HODL). It damages the current owner but benefits no one. The problem is one might not have substantial UTXO to  imply high enough opportunity cost.

Another reason why simply spending or burning them is preferential.

> - Pay someone else to time lock. This is paying someone to lock an UTXO for a time span. Payment and time lock could be combined in the same transaction.

This implies additional complexity with no benefit to anyone required by the scenario, which was my implication.

> - Transferable borrowed Bitcoin.  This needs the covenant. This benefits those who consciously give up control for a time span. Its advantage is that since transferable it can be sold if no longer needed, thereby shortening the term of the original arrangement. It coul be re-rented for a shorter time period.

The terms lend/borrow are misleading here, as I have previously shown. The coin is neither spendable nor consumable. This is why I have used the terms owner/renter. Yes, the renter can sell the remaining rental expense to another.

Yes, the potential incremental value over the other scenarios is transferability of the output, but this accrues to both to the advertiser/renter and the owner (trade always benefits both parties trading). This transfer incurs a fee if on chain, and in the tracking scenario may easily overwhelm the effective benefit (fraction of the rental, no higher than dust, not yet expired), making it economically non-transferrable.

In the advertising scenario this transfer can be achieved independent of Bitcoin, by simply changing the advertisement (e.g. publish a provably-superseding ad for the same output), avoiding the material on-chain fee. Recall that the value of the coin cannot be captured by the advertiser through transfer, just the tracking cost.

e

> Tamas Blummer
> 
> 
>> On Jul 4, 2019, at 18:43, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>> Hi ZmnSCPxj,
>> 
>> Generalizing a bit this appears to be the same with one exception. The amount of encumbered coin is relevant to an external observer. Of course the effective dust limit is the maximum necessary encumbrance otherwise.
>> 
>> In the case of simple tracking, the market value of the coin is not relevant, all that is required is a valid output. Hence the devolution to 1 sat tracking. In your scenario the objective is to establish a meaningful cost for the output.
>> 
>> A community of people using this as a sort of hashcash spam protection can raise the amount of encumbered coin (i.e. advertising threshold price) required in that context. The cost of this encumberance includes not only at least one tx fee but market cost of the coin rental.
>> 
>> At a 1 year advertisement term, 10% APR capital cost, and threshold of 1 encumbered coin, the same is achieved by burning .1 coin. In other words the renter (advertiser) has actually paid to the coin owner .1 coin to rent 1 coin for one year.
>> 
>> As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?
>> 
>> e
>> 
>>> On Jul 3, 2019, at 23:57, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>>> 
>>> Good morning Eric,
>>> 
>>> 
>>>>> and thanks to you and ZmnSCPxj we now have two additional uses cases for UTXOs that are only temporarily accessible to their current owner.
>>>> 
>>>> Actually you have a single potentially-valid use case, the one I have presented. The others I have shown to be invalid (apart from scamming) and no additional information to demonstrate errors in my conclusions have been offered.
>>> 
>>> I presented another use case, that of the "Bitcoin Classified Ads Network".
>>> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-July/017083.html
>>> 
>>> Advertisements are "backed" by an unspent TXO.
>>> In order to limit their local resource consumption, nodes of this network will preferentially keep advertisements that are backed by higher UTXO values divided by advertisement size, and drop those with too low UTXO value divided by advertisement size.
>>> 
>>> Thus, spammers will either need to rent larger UTXO values for their spam, paying for the higher rent involved, or fall back to pre-Bitcoin spamming methods.
>>> Thus I think I have presented a use-case that is viable for this and does not simply devolve to "just burn a 1-satoshi output".
>>> 
>>> I still do not quite support generalized covenants as the use-case is already possible on current Bitcoin (and given that with just a little more transaction introspection this enables Turing-completeness), but the basic concept of "renting a UTXO of substantial value" appears sound to me.
>>> 
>>> 
>>> Regards,
>>> ZmnSCPxj
> 

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jul 4, 2019, at 12:10, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> Hi Eric,
> 
> there are some other ways to impose cost on use without direct billing, e.g.:
> 
> - Burn Bitcoins to use the service, as you mentioned. This could work and would benefit remaining Bitcoin owner, but is unsustainable.
> 
> - Pay high fees in self dealing transactions. This could work and would benefit miner.
> 
> - Time lock own Bitcoins. This is forgoing control of an UTXO for a time period, which implies opportunity cost. This could be done with CLTV (OP_HODL). It damages the current owner but benefits no one.

I meant to point out that a voluntarily trade cannot represent “damage” to the person making it. The person chooses the action because it is preferred over alternatives (i.e. it is beneficial). Such choices are the only objective expression of preference, a fundamental principle of praxeology.

> The problem is one might not have substantial UTXO to  imply high enough opportunity cost.
> 
> - Pay someone else to time lock. This is paying someone to lock an UTXO for a time span. Payment and time lock could be combined in the same transaction.
> 
> - Transferable borrowed Bitcoin.  This needs the covenant. This benefits those who consciously give up control for a time span. Its advantage is that since transferable it can be sold if no longer needed, thereby shortening the term of the original arrangement. It coul be re-rented for a shorter time period.
> 
> Tamas Blummer
> 
> 
>> On Jul 4, 2019, at 18:43, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>> Hi ZmnSCPxj,
>> 
>> Generalizing a bit this appears to be the same with one exception. The amount of encumbered coin is relevant to an external observer. Of course the effective dust limit is the maximum necessary encumbrance otherwise.
>> 
>> In the case of simple tracking, the market value of the coin is not relevant, all that is required is a valid output. Hence the devolution to 1 sat tracking. In your scenario the objective is to establish a meaningful cost for the output.
>> 
>> A community of people using this as a sort of hashcash spam protection can raise the amount of encumbered coin (i.e. advertising threshold price) required in that context. The cost of this encumberance includes not only at least one tx fee but market cost of the coin rental.
>> 
>> At a 1 year advertisement term, 10% APR capital cost, and threshold of 1 encumbered coin, the same is achieved by burning .1 coin. In other words the renter (advertiser) has actually paid to the coin owner .1 coin to rent 1 coin for one year.
>> 
>> As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?
>> 
>> e
>> 
>>> On Jul 3, 2019, at 23:57, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>>> 
>>> Good morning Eric,
>>> 
>>> 
>>>>> and thanks to you and ZmnSCPxj we now have two additional uses cases for UTXOs that are only temporarily accessible to their current owner.
>>>> 
>>>> Actually you have a single potentially-valid use case, the one I have presented. The others I have shown to be invalid (apart from scamming) and no additional information to demonstrate errors in my conclusions have been offered.
>>> 
>>> I presented another use case, that of the "Bitcoin Classified Ads Network".
>>> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-July/017083.html
>>> 
>>> Advertisements are "backed" by an unspent TXO.
>>> In order to limit their local resource consumption, nodes of this network will preferentially keep advertisements that are backed by higher UTXO values divided by advertisement size, and drop those with too low UTXO value divided by advertisement size.
>>> 
>>> Thus, spammers will either need to rent larger UTXO values for their spam, paying for the higher rent involved, or fall back to pre-Bitcoin spamming methods.
>>> Thus I think I have presented a use-case that is viable for this and does not simply devolve to "just burn a 1-satoshi output".
>>> 
>>> I still do not quite support generalized covenants as the use-case is already possible on current Bitcoin (and given that with just a little more transaction introspection this enables Turing-completeness), but the basic concept of "renting a UTXO of substantial value" appears sound to me.
>>> 
>>> 
>>> Regards,
>>> ZmnSCPxj
> 

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[ZmnSCPxj]

Good morning Eric,

> As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?

Using the unspentness-time of a UTXO allows for someone advertising a service or producer to "close up shop" by simply spending the advertising UTXO.
For instance, if the advertisement is for sale of a limited stock of goods, once the stock has been sold, the merchant (assuming the merchant used own funds) can simply recover the locked funds, with the potential to reinvest them elsewhere.
This allows some time-based hedging for the merchant (they may be willing to wait indefinitely for the stock to be sold, but once the stock is sold, they can immediately reap the rewards of not having their funds locked anymore).

Similarly, an entity renting out a UTXO for an advertisement might allow for early reclamation of the UTXO in exchange for partial refund of fee; as the value in the UTXO is now freed to be spent elsewhere, the lessor can lease it to another advertiser.

Burnt funds cannot be "un-burnt" to easily signal the end of a term for an advertisement.
Similarly for miner fees.
The best that can be done would be to have the nodes of the classified ads network automatically decay the spent value of older advertisements to let them be dropped from their advertisements pool.

Less importantly, burning currently has bad resource usage for practical applications.
Practical burning requires spending to a provably-unspendable P2PKH or P2SH or similar output.
This adds UTXO entries to the UTXO database that will never be removed.
This will of course be remedied by compact UTXO representations later, but not today.
Similarly, it would be very nice to have non-0-amount `OP_RETURN` outputs, as `OP_RETURN` outputs are never stored in the UTXO database.
However, this will require a change in node relay policy, which again will take time to make possible, and would not be practical today.

Thus I think use of UTXO is better than burning or mining-fee-spending.


Also, mostly trivia:
The use of UTXOs to advertise services is not original to me --- I found the LN channel gossip to be the inspiration for this.
Publicly-announced channels indicate the backing UTXO that funds the channel.
The purpose of publicly announcing the channels is to be able to provide the service, of forwarding across the Lightning Network; thus the public announcement serves as an advertisement for the service.
Channel closure immediately spends the UTXO, and also doubles to "revoke" the existing "advertisement".
I found this ability to "revoke" the advertisement appealing, and thereby designed the Bitcoin Classified Ads Network around the UTXO spentness mechanism.

Regards,
ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jul 4, 2019, at 21:05, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
> 
> Good morning Eric,
> 
>> As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?

Good morning ZmnSCPxj,

> Using the unspentness-time of a UTXO allows for someone advertising a service or producer to "close up shop" by simply spending the advertising UTXO.
> For instance, if the advertisement is for sale of a limited stock of goods, once the stock has been sold, the merchant (assuming the merchant used own funds) can simply recover the locked funds, with the potential to reinvest them elsewhere.
> This allows some time-based hedging for the merchant (they may be willing to wait indefinitely for the stock to be sold, but once the stock is sold, they can immediately reap the rewards of not having their funds locked anymore).

This is a materially different concept than proposed by Tamas.

“...he gives up his control of the coins until maturity, he can not use them elsewhere until then.”

> Similarly, an entity renting out a UTXO for an advertisement might allow for early reclamation of the UTXO in exchange for partial refund of fee; as the value in the UTXO is now freed to be spent elsewhere, the lessor can lease it to another advertiser.

You appear to be proposing a design whereby either the owner or the renter (not entirely clear to me which) can spend the “locked up” coin at any time (no maturity constraint), by dropping the covenant.

If the renter can do this he can simply steal the coin from the owner.

If the owner can do this there is no value to the renter (or as a proof of cost), as the owner retains full control of the coin.

If you mean that the age of the encumbrance is the proof of cost, this requires no covenant. I don’t believe this is what you intended, just covering all bases.

> Burnt funds cannot be "un-burnt" to easily signal the end of a term for an advertisement.

And as I have shown above, nor can a “locked-up” coin be unlocked to do the same.

> Similarly for miner fees.

Well that’s the point, money spent is no longer under one’s control. The provable cost of this surrender was your stated objective. Renting at a fractional cost of coin face value is a non-recoverable spend by the renter to the owner. Burning or spending the same amount in a way that is provably not to one’s self achieves the exact same result.

> The best that can be done would be to have the nodes of the classified ads network automatically decay the spent value of older advertisements to let them be dropped from their advertisements pool.

The advertiser can presumably trade control of as space on the ad network. It’s not clear to me why this is not simply an independent chain of limited ad space ownership. It might as well be namecoin.

> Less importantly, burning currently has bad resource usage for practical applications.
> Practical burning requires spending to a provably-unspendable P2PKH or P2SH or similar output.
> This adds UTXO entries to the UTXO database that will never be removed.

If an output is provably unspendable (burned) it is not a UTXO.

It is worth noting that not all full node implementations require a store of UTXOs, this is an implementation detail. For example, libbitcoin uses a flag on each output to indicate its spentness on the strong branch. As such the store size is linear by height.

> This will of course be remedied by compact UTXO representations later, but not today.
> Similarly, it would be very nice to have non-0-amount `OP_RETURN` outputs, as `OP_RETURN` outputs are never stored in the UTXO database.
> However, this will require a change in node relay policy, which again will take time to make possible, and would not be practical today.
> 
> Thus I think use of UTXO is better than burning or mining-fee-spending.

I don’t believe you have shown this.

Best,
Eric

> Also, mostly trivia:
> The use of UTXOs to advertise services is not original to me --- I found the LN channel gossip to be the inspiration for this.
> Publicly-announced channels indicate the backing UTXO that funds the channel.
> The purpose of publicly announcing the channels is to be able to provide the service, of forwarding across the Lightning Network; thus the public announcement serves as an advertisement for the service.
> Channel closure immediately spends the UTXO, and also doubles to "revoke" the existing "advertisement".
> I found this ability to "revoke" the advertisement appealing, and thereby designed the Bitcoin Classified Ads Network around the UTXO spentness mechanism.
> 
> Regards,
> ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[ZmnSCPxj]

Good morning Eric,


Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Saturday, July 6, 2019 3:27 AM, Eric Voskuil <eric@voskuil.org> wrote:

> > On Jul 4, 2019, at 21:05, ZmnSCPxj ZmnSCPxj@protonmail.com wrote:
> > Good morning Eric,
> >
> > > As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?
>
> Good morning ZmnSCPxj,
>
> > Using the unspentness-time of a UTXO allows for someone advertising a service or producer to "close up shop" by simply spending the advertising UTXO.
> > For instance, if the advertisement is for sale of a limited stock of goods, once the stock has been sold, the merchant (assuming the merchant used own funds) can simply recover the locked funds, with the potential to reinvest them elsewhere.
> > This allows some time-based hedging for the merchant (they may be willing to wait indefinitely for the stock to be sold, but once the stock is sold, they can immediately reap the rewards of not having their funds locked anymore).
>
> This is a materially different concept than proposed by Tamas.
>
> “...he gives up his control of the coins until maturity, he can not use them elsewhere until then.”

Possibly.
In a way, this is giving up control of the coin, until he no longer needs the advertisement, i.e. dynamically select the maturity age needed.

> > Similarly, an entity renting out a UTXO for an advertisement might allow for early reclamation of the UTXO in exchange for partial refund of fee; as the value in the UTXO is now freed to be spent elsewhere, the lessor can lease it to another advertiser.
>
> You appear to be proposing a design whereby either the owner or the renter (not entirely clear to me which) can spend the “locked up” coin at any time (no maturity constraint), by dropping the covenant.
>
> If the renter can do this he can simply steal the coin from the owner.
>
> If the owner can do this there is no value to the renter (or as a proof of cost), as the owner retains full control of the coin.
>

Obviously this will require a 2-of-2 multisig, with an timelocked transaction that lets the owner recover at a futuredate, so that it is the agreement of *both* that is needed to perform any actions before the timelock.
I already described this in the link I provided.


> If you mean that the age of the encumbrance is the proof of cost, this requires no covenant. I don’t believe this is what you intended, just covering all bases.

Not age of encumbrance, quite.
Instead, it is the simple fact that the UTXO is a UTXO (and not yet spent), that validates the advertisement.

No, it does not *require* a covenant.
However, covenants do make it easier to use, in the sense that the renter can repurpose the UTXO (e.g. change details of advertisement) without having to contact the owner.



>
> > Burnt funds cannot be "un-burnt" to easily signal the end of a term for an advertisement.
>
> And as I have shown above, nor can a “locked-up” coin be unlocked to do the same.

You have shown no such thing, merely shown that you have not understood the proposal.

Regards,
ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jul 5, 2019, at 16:16, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
> 
> Good morning Eric,
> 
> 
> Sent with ProtonMail Secure Email.
> 
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Saturday, July 6, 2019 3:27 AM, Eric Voskuil <eric@voskuil.org> wrote:
> 
>>> On Jul 4, 2019, at 21:05, ZmnSCPxj ZmnSCPxj@protonmail.com wrote:
>>> Good morning Eric,
>>> 
>>>> As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?
>> 
>> Good morning ZmnSCPxj,
>> 
>>> Using the unspentness-time of a UTXO allows for someone advertising a service or producer to "close up shop" by simply spending the advertising UTXO.
>>> For instance, if the advertisement is for sale of a limited stock of goods, once the stock has been sold, the merchant (assuming the merchant used own funds) can simply recover the locked funds, with the potential to reinvest them elsewhere.
>>> This allows some time-based hedging for the merchant (they may be willing to wait indefinitely for the stock to be sold, but once the stock is sold, they can immediately reap the rewards of not having their funds locked anymore).
>> 
>> This is a materially different concept than proposed by Tamas.
>> 
>> “...he gives up his control of the coins until maturity, he can not use them elsewhere until then.”
> 
> Possibly.
> In a way, this is giving up control of the coin, until he no longer needs the advertisement, i.e. dynamically select the maturity age needed.
> 
>>> Similarly, an entity renting out a UTXO for an advertisement might allow for early reclamation of the UTXO in exchange for partial refund of fee; as the value in the UTXO is now freed to be spent elsewhere, the lessor can lease it to another advertiser.
>> 
>> You appear to be proposing a design whereby either the owner or the renter (not entirely clear to me which) can spend the “locked up” coin at any time (no maturity constraint), by dropping the covenant.
>> 
>> If the renter can do this he can simply steal the coin from the owner.
>> 
>> If the owner can do this there is no value to the renter (or as a proof of cost), as the owner retains full control of the coin.
>> 
> 
> Obviously this will require a 2-of-2 multisig, with an timelocked transaction that lets the owner recover at a futuredate, so that it is the agreement of *both* that is needed to perform any actions before the timelock.
> I already described this in the link I provided.
> 
> 
>> If you mean that the age of the encumbrance is the proof of cost, this requires no covenant. I don’t believe this is what you intended, just covering all bases.
> 
> Not age of encumbrance, quite.
> Instead, it is the simple fact that the UTXO is a UTXO (and not yet spent), that validates the advertisement.

Not any UTXO then, one that with sufficient time-locked coin.

> No, it does not *require* a covenant.
> However, covenants do make it easier to use, in the sense that the renter can repurpose the UTXO (e.g. change details of advertisement) without having to contact the owner.

So how does one get the owner to sign off on the multisig release? Presumably the renter cares because he wants to recover the remaining value of rental. So he not only needs to contact the owner, he also needs to negotiate with the owner for a pro-rated refund. In other words, he must sell the remaining portion of the rental return - essentially how I described it previously. He might as well just sell the marketable ad space that he controls through the remainder of the term (the same value).

Certainly the owner could given him a partially-signed transaction, returning the coin, allowing the renter to exit at any time, but the renter has no reason to sign it without a refund, which must be pro-rated in some way, implying later contact/negotiation with the owner.

But it’s worth noting that early recovery of the UTXO entirely eliminates the value of the time lock cost to the ad market. The most obvious example is one encumbering the coin to himself, then releasing it with his own two signatures whenever he wants. In other words, there is no encumbrance at all, just a bunch of pointless obscurantion.

>>> Burnt funds cannot be "un-burnt" to easily signal the end of a term for an advertisement.
>> 
>> And as I have shown above, nor can a “locked-up” coin be unlocked to do the same.
> 
> You have shown no such thing, merely shown that you have not understood the proposal.

I think I understand the implications of it clearly. Feel free to point out what I’m missing. But I don’t spend any time in implementation details until I can justify those implications.

A multisig doesn’t fix the central economic issue, which it is not clear that you understand. If so it hasn’t been demonstrated. A cost created by making coin unusable for a term is not an actual cost if that lock can be released at any time before maturity of that term. Furthermore, cost is most easily demonstrated by simply spending. 

By analogy, proof of work is simply proof of a spend (incurred cost). Imagine if one demonstrated that cost by “locking up” coin for a year, and then after the block was accepted, he unlocked that coin after just one day.

Best,
Eric

> Regards,
> ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[ZmnSCPxj]

Good morning Eric,

> But it’s worth noting that early recovery of the UTXO entirely eliminates the value of the time lock cost to the ad market. The most obvious example is one encumbering the coin to himself, then releasing it with his own two signatures whenever he wants. In other words, there is no encumbrance at all, just a bunch of pointless obscurantion.

You still do not understand.
I strongly suggest actually reading the post instead of skimming it.

The advertisement is broadcast to new nodes on the ad network if and only if its backing UTXO remains unspent.
Once the UTXO is spent, then the advertisement is considered no longer valid and will be outright deleted by existing nodes, and new nodes will not learn of them (and would consider it spam if it is forced to them when the UTXO is already spent, possibly banning the node that pushes the advertisement at them).

Thus the locked-ness of the UTXO is the lifetime of the advertisement.
Once you disencumber the coins (whether your own, or rented) then your advertisement is gone; forever.
Your advertisement exists only as long as the UTXO is unspent.


Regards.
ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jul 5, 2019, at 17:17, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
> 
> Good morning Eric,
> 
>> But it’s worth noting that early recovery of the UTXO entirely eliminates the value of the time lock cost to the ad market. The most obvious example is one encumbering the coin to himself, then releasing it with his own two signatures whenever he wants. In other words, there is no encumbrance at all, just a bunch of pointless obscurantion.
> 
> You still do not understand.
> I strongly suggest actually reading the post instead of skimming it.

I am responding to the cryptoeconomic principles, not the implementation details. Based on your comments here I am not misrepresenting those principles.

For example, I have shown that the multisig unlock implementation reduces the presumably-encumbered UTXO to simply a UTXO. You have not disputed that. In fact below you have accepted it (more below).

> The advertisement is broadcast to new nodes on the ad network if and only if its backing UTXO remains unspent.
> Once the UTXO is spent, then the advertisement is considered no longer valid and will be outright deleted by existing nodes, and new nodes will not learn of them (and would consider it spam if it is forced to them when the UTXO is already spent, possibly banning the node that pushes the advertisement at them).
> 
> Thus the locked-ness of the UTXO is the lifetime of the advertisement.

The term “locked” here is misused. A unspent output that can be spent at any time is just an unspent output. The fact that you can “unencumber” your own coins should make this exceedingly obvious:

> Once you disencumber the coins (whether your own, or rented) then your advertisement is gone; forever.

As I have shown, there is no *actual* encumbrance.

> Your advertisement exists only as long as the UTXO is unspent.

Exactly, which implies *any* UTXO is sufficient. All that the ad network requires is proof of ownership of any UTXO.

Unspentness is not actually a necessary cost (expense). All coin is always represented as UTXOs. If one has a hoard of coin there is no necessary incremental cost of identifying those coins to “back” ads.This isn’t altered by the proposed design.

The only cost would be to have a hoard that one does not otherwise desire, representing an opportunity cost. Yet, as I have also pointed out, the amount of that opportunity cost can simply be spent (or burned) by the advertiser, representing the same cost. So covering the case where one cannot raise the capital to “back” one’s ad does not require rental, as the cost of the otherwise rental can just be spent outright.

Presumably it would be ideal to transfer the value of those spends to people who provably present the ads for effective viewing (i.e., the AdWords business model). It is of course this market-driven cost of presenting an ad that provides the spam protection/definition for AdWords.

Best,
Eric

> Regards.
> ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jul 5, 2019, at 18:28, Eric Voskuil <eric@voskuil.org> wrote:
> 
> 
> 
>> On Jul 5, 2019, at 17:17, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>> 
>> Good morning Eric,
>> 
>>> But it’s worth noting that early recovery of the UTXO entirely eliminates the value of the time lock cost to the ad market. The most obvious example is one encumbering the coin to himself, then releasing it with his own two signatures whenever he wants. In other words, there is no encumbrance at all, just a bunch of pointless obscurantion.
>> 
>> You still do not understand.
>> I strongly suggest actually reading the post instead of skimming it.
> 
> I am responding to the cryptoeconomic principles, not the implementation details. Based on your comments here I am not misrepresenting those principles.
> 
> For example, I have shown that the multisig unlock implementation reduces the presumably-encumbered UTXO to simply a UTXO. You have not disputed that. In fact below you have accepted it (more below).
> 
>> The advertisement is broadcast to new nodes on the ad network if and only if its backing UTXO remains unspent.
>> Once the UTXO is spent, then the advertisement is considered no longer valid and will be outright deleted by existing nodes, and new nodes will not learn of them (and would consider it spam if it is forced to them when the UTXO is already spent, possibly banning the node that pushes the advertisement at them).
>> 
>> Thus the locked-ness of the UTXO is the lifetime of the advertisement.
> 
> The term “locked” here is misused. A unspent output that can be spent at any time is just an unspent output. The fact that you can “unencumber” your own coins should make this exceedingly obvious:
> 
>> Once you disencumber the coins (whether your own, or rented) then your advertisement is gone; forever.
> 
> As I have shown, there is no *actual* encumbrance.
> 
>> Your advertisement exists only as long as the UTXO is unspent.
> 
> Exactly, which implies *any* UTXO is sufficient. All that the ad network requires is proof of ownership of any UTXO.
> 
> Unspentness is not actually a necessary cost (expense). All coin is always represented as UTXOs. If one has a hoard of coin there is no necessary incremental cost of identifying those coins to “back” ads.This isn’t altered by the proposed design.
> 
> The only cost would be to have a hoard that one does not otherwise desire, representing an opportunity cost. Yet, as I have also pointed out, the amount of that opportunity cost can simply be spent (or burned) by the advertiser, representing the same cost. So covering the case where one cannot raise the capital to “back” one’s ad does not require rental, as the cost of the otherwise rental can just be spent outright.
> 
> Presumably it would be ideal to transfer the value of those spends to people who provably present the ads for effective viewing (i.e., the AdWords business model). It is of course this market-driven cost of presenting an ad that provides the spam protection/definition for AdWords.

It’s worth pointing out at this point that this implies Google, etc. would achieve the same result by simply accepting Bitcoin for ad placement. In your model the advertiser is paying only for access to people who wish to avoid spam, not for targeted and actual placement. In other words your ad system would be directly competing with others that provide material additional value for the advertiser beyond anti-spam. If nothing else this implies the return on coin “lock-up” would be exceeded by its opportunity cost.

> Best,
> Eric
> 
>> Regards.
>> ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 2537 bytes --]

Hi Eric,

> On Jul 6, 2019, at 03:28, Eric Voskuil <eric@voskuil.org> wrote:
> 
> 
> 
>> On Jul 5, 2019, at 17:17, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>> 
>> Good morning Eric,
>> 
>>> But it’s worth noting that early recovery of the UTXO entirely eliminates the value of the time lock cost to the ad market. The most obvious example is one encumbering the coin to himself, then releasing it with his own two signatures whenever he wants. In other words, there is no encumbrance at all, just a bunch of pointless obscurantion.
>> 
>> You still do not understand.
>> I strongly suggest actually reading the post instead of skimming it.
> 
> I am responding to the cryptoeconomic principles, not the implementation details. Based on your comments here I am not misrepresenting those principles.
> 
> For example, I have shown that the multisig unlock implementation reduces the presumably-encumbered UTXO to simply a UTXO. You have not disputed that. In fact below you have accepted it (more below).
> 
>> The advertisement is broadcast to new nodes on the ad network if and only if its backing UTXO remains unspent.
>> Once the UTXO is spent, then the advertisement is considered no longer valid and will be outright deleted by existing nodes, and new nodes will not learn of them (and would consider it spam if it is forced to them when the UTXO is already spent, possibly banning the node that pushes the advertisement at them).
>> 
>> Thus the locked-ness of the UTXO is the lifetime of the advertisement.
> 
> The term “locked” here is misused. A unspent output that can be spent at any time is just an unspent output. The fact that you can “unencumber” your own coins should make this exceedingly obvious:
> 
>> Once you disencumber the coins (whether your own, or rented) then your advertisement is gone; forever.
> 
> As I have shown, there is no *actual* encumbrance.
> 

If you have to forgo using your money while using a service that encumbers you. You incur opportunity cost proportional to time you use the service and the amount you waived to use elsewhere.
No crypto is needed to understand this.


>> Your advertisement exists only as long as the UTXO is unspent.
> 
> Exactly, which implies *any* UTXO is sufficient. All that the ad network requires is proof of ownership of any UTXO.
> 

Not any, but one with significant value, so a service with limited bandwith can prioritize by that.

> Best,
> Eric
> 
>> Regards.
>> ZmnSCPxj

Best,

Tamas Blummer

[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jul 6, 2019, at 06:34, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> Hi Eric,
> 
>> On Jul 6, 2019, at 03:28, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>> 
>> 
>>> On Jul 5, 2019, at 17:17, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>>> 
>>> Good morning Eric,
>>> 
>>>> But it’s worth noting that early recovery of the UTXO entirely eliminates the value of the time lock cost to the ad market. The most obvious example is one encumbering the coin to himself, then releasing it with his own two signatures whenever he wants. In other words, there is no encumbrance at all, just a bunch of pointless obscurantion.
>>> 
>>> You still do not understand.
>>> I strongly suggest actually reading the post instead of skimming it.
>> 
>> I am responding to the cryptoeconomic principles, not the implementation details. Based on your comments here I am not misrepresenting those principles.
>> 
>> For example, I have shown that the multisig unlock implementation reduces the presumably-encumbered UTXO to simply a UTXO. You have not disputed that. In fact below you have accepted it (more below).
>> 
>>> The advertisement is broadcast to new nodes on the ad network if and only if its backing UTXO remains unspent.
>>> Once the UTXO is spent, then the advertisement is considered no longer valid and will be outright deleted by existing nodes, and new nodes will not learn of them (and would consider it spam if it is forced to them when the UTXO is already spent, possibly banning the node that pushes the advertisement at them).
>>> 
>>> Thus the locked-ness of the UTXO is the lifetime of the advertisement.
>> 
>> The term “locked” here is misused. A unspent output that can be spent at any time is just an unspent output. The fact that you can “unencumber” your own coins should make this exceedingly obvious:
>> 
>>> Once you disencumber the coins (whether your own, or rented) then your advertisement is gone; forever.
>> 
>> As I have shown, there is no *actual* encumbrance.
>> 
> If you have to forgo using your money while using a service that encumbers you. You incur opportunity cost proportional to time you use the service and the amount you waived to use elsewhere.
> No crypto is needed to understand this.

My use of “encumbrance” in this thread has been consistently a reference to a covenant. When the covenant can be released at any time it serves no purpose whatsoever, being an encumbrance in name only.

I gave a detailed explanation of opportunity cost, and gave you a scenario where that opportunity cost could actually be used - to purchase a tracking output (i.e., a fixed term asset tracked for that term). And I have discussed at length the use of opportunity cost in the hash-cash-like anti-spam ad scenario.

So it’s not clear to me why you continue to imply that the nature of either covenants or opportunity cost is the point at issue, and by implying I don’t understand them.

**The central issue in your proposal is that constrained coins can neither be used as borrowed money nor the tracking of perpetual assets.** This conclusion is not based on a failure to understand the nature of covenants or the concept of opportunity cost. It is the necessary consequence of attempting to trade something today that will provably disappear tomorrow. The sole possible value of such an instrument is to scam the eventual bag-holders.

A secondary issue, in the valid fixed-term asset tracking scenario, is that the cost of tracking is dust (and at least one transfer fee). The cost of such tracking is a function only of the market price of a satoshi. The financial value of renting one dust output is also limited in time by economic  interest (i.e., at 10% it is cheaper to buy than rent if the fixed term exceeds 7.2 years). So while valid, is not likely to be demanded until one satoshi becomes worth the overhead of renting it.

The opportunity of interest represents opportunity cost when forgone. This can be used to show proof-of-cost (ad scenario), and that level can float as a price on the anti-spam market. This is a perfectly valid scenario, as I have said.

The issue with that specific proposal is that it uses covenants in an irrational manner. The ability to release the covenant at any time eliminates the cost it would otherwise represent. One could either simply burn or spend coin outright, or use an actual encumbrance (as you propose) to “burn” (provably destroy) the opportunity, but a non-encumbrance adds nothing except complexity.

>>> Your advertisement exists only as long as the UTXO is unspent.
>> 
>> Exactly, which implies *any* UTXO is sufficient. All that the ad network requires is proof of ownership of any UTXO.
>> 
> Not any, but one with significant value, so a service with limited bandwith can prioritize by that.

Not significant, which is arbitrary, but sufficient - a result of supply and demand. Clearly my intent here is that no covenant on the UTXO is required in the scenario. As the preceding discussions conclude, without disagreement, all that is required is that the (sufficient) output remains unspent, not that it be encumbered.

>> Best,
>> Eric
>> 
>>> Regards.
>>> ZmnSCPxj
> 
> Best,
> 
> Tamas Blummer

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

[-- Attachment #1: Type: text/plain, Size: 199 bytes --]

I have published a summary here:

https://github.com/libbitcoin/libbitcoin-system/wiki/Risk-Free-Return-Fallacy

Barring any new consequential inputs I’ll refrain from further comment.

e


[-- Attachment #2: Type: text/html, Size: 597 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1.1: Type: text/plain, Size: 2363 bytes --]

Hi Eric,

Your cryproeconomic theories may describe correctly Bitcoin as money, but fall short of describing a Bitcoin that would also offer reliable memory for other uses.

In consequence you miss, that:

1. If the reliable memory that enables money would have more uses then even temporary use of the memory would have utility, therefore value. Bitcoin as is, does not have consensus rules to enable reliable alternate uses.

2. Finite supply of coins implies a finite memory capacity of Bitcoin. Alternate use of the memory requires that units at least temporarily become un-fungible, enforced by consensus. Alternate uses would then have to compete for units of memory, which would give rise to a price paid to those enabling alternate use, even if temoprarily.

3. If giving up control temorarily has a positive price (through 2) and return of control is certain (enforced by consenus) then the price paid is riskless interest for those giving up temporary control.

4. If a use requires more units of memory then it imposes higher cost to use and it since memory units are finite it imposes more severe scarcity.

Further certainly subjective remarks:

Although burning and loss is unavoidable and therefore Bitcoin (as is) is unsustainable we should design systems that they sustain it as long as possible (as is). Therefore a requirement to burn for any of unlimited number of uses should be avoided.

We currently perceive borrowed money just as good as (fungible with) any other money. This is a consequence that money actually comes into existence through someone borrowing it. Money on your account is a loan you gave the bank and even paper cash is a loan you gave the central bank.

Bitcoin is different as it just is, it is not borrowed into existence. Therefore it is not fungible with borrowed version of itself. This however does not imply that its borrowed version is worthless as it might be worth something if there is a use for it.

Tamas Blummer

> On Jul 7, 2019, at 03:30, Eric Voskuil <eric@voskuil.org> wrote:
> 
> I have published a summary here:
> 
> https://github.com/libbitcoin/libbitcoin-system/wiki/Risk-Free-Return-Fallacy <https://github.com/libbitcoin/libbitcoin-system/wiki/Risk-Free-Return-Fallacy>
> 
> Barring any new consequential inputs I’ll refrain from further comment.
> 
> e
> 


[-- Attachment #1.2: Type: text/html, Size: 3788 bytes --]

[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[ZmnSCPxj]

Good morning all,

I will attempt to restart my thinking from initial principles regarding my proposed "Bitcoin Classified Ads Network".

Nodes behave this way:

* Nodes in this network gossip advertisements.
* These advertisements refer to a UTXO that must be unspent at the chain tip considered by each node, else they would be rejected.
* The referred UTXO must contain a commitment to the text of the advertisement, else the advertisement is rejected.
* Nodes have a maximum limit on the total size of all advertisements they retain and propagate to new nodes, or gossip to their peers.
  This is a deliberate design decision.
* If nodes exceed the above limit, they will sort advertisements according to a value-rate, the value of the UTXO divided by the storage size of the advertisement, and prune advertisements with low value-rate until they are within the limit again.
* Once the backing UTXO is spent, the advertisement is removed by nodes that follow that chaintip.
* As the name ***Classified Ads*** suggests, each advertisement also indicates a "class" in which they belong to.

Then, from the above, we derive how a seller might behave.

* Sellers will attempt to put the minimum possible value into a UTXO committing to an advertisement, to reduce the opportunity cost of using the value elsewhere.
* Thus the rent of the advertisement in this case is paid to joinmarket makers and LN forwarding nodes, as the value used in a UTXO backing an advertisement is not useable in joinmarket/LN.
* Sellers remain in full control of their advertising UTXO, and can spend it at any time.
* Sellers may spend part of the UTXO and put the remaining funds into a change address that is a new advertising UTXO, and re-transmit the advertisement, this time pointing to the new change UTXO.
* However, if the remaining change becomes too low, then its value-rate may drop below the lowest value-rate that BCAN nodes will retain in their (deliberately limited) storage, thus also deleting their advertisement from the BCAN.
* Presumably, the reason for advertising at all, is that the seller considers the cost of advertising to be less than the expected gain of actually selling their product.
* Thus, even if the seller has the ability to spend the UTXO at any time, they run the risk of spending too much and thus removing their advertisement from the BCAN, and losing the expected gain of having the advertisement exist on the BCAN.
* A utility-maximizing seller would therefore not spend a minimal-value UTXO backing the advertisement until it has gained the advantage of actually selling the product, even if it has the option to do so: it is a forced move.
* The cost of keeping the minimal-value UTXO unspent is the opportunity cost in that the value may have been used in joinmarket or LN instead.
* The minimum value will largely be dependent on how much the BCAN is used; more sellers advertising over BCAN will increase the minimum value.
* If the minimum value that is viable to keep its advertisement alive goes higher, then the opportunity cost of the seller using the same value elsewhere might exceed the expected gain from selling the product.
  However, this is expected of *any* advertising scheme: if the gains from selling is too small to justify the advertisement price, advertising does not happen; this is expected utility-maximizing behavior.
* If competitors of the seller exist and the BCAN node storage is already filled, competitors can increase the minimum value of a UTXO that can keep an advertisement alive on BCAN by simply adding more of their advertisements to BCAN.
* Thus we expect that, once the BCAN node storage is at or near the maximum value, the minimum value of a UTXO that can back an advertisement will approach the expected gain from selling the product.

Thus the system of simply committing UTXOs to particular advertisement texts seems sufficient to extract value from a seller wishing to advertise.
The purpose of this extraction of value is to ensure that spam does not overload the BCAN.

Let us now consider some kind of specialization, where a HODLer specializes in owning UTXOs, while an advertiser specializes in trading products that need advertising of some kind.

* We assume that the specialization means that the HODLer cannot feasibly make and sell products on its own, while the advertiser cannot own and control UTXOs of the minimum value needed to keep their advertisement alive on the BCAN.
* We assume that the specialization means that the advertiser can make and sell products for cheaper than the HODLer can, while the HODLer can own and control (and secure) UTXOs of the minimum value needed for advertisements to be kept alive, for cheaper than the advertiser can.

Then:

* A HODLer may offer to provide a UTXO locked by a 2-of-2 with a commitment to an advertisement of the advertiser's choosing, in exchange for rent of the value, plus an unbreakable promise to return the rented UTXO value back to the HODLer (represented by a `nLockTime` pre-signed transaction that returns the 2-of-2 back to the HODLer control).
* The HODLer is effectively lending the UTXO out to the advertiser, for the time frame agreed upon by the advertiser.
* The rent at which the HODLer lends out the UTXO must be between the opportunity cost of instead securely utilizing the UTXO in LN or joinmarket, and the expected gain the advertiser expects from having its product advertised.
  * The HODLer is assumed to have the ability to secure the UTXO and retain all data it needs to recover the UTXO; this is part of the assumption that the HODLer specializes in such.
  * The advertiser is assumed to have positive gains from creating, advertising, and selling its product; this is part of the assumption that the advertiser specializes in such.
* The HODLer and advertiser can agree to refund part of the rent, if the advertiser signs a transaction that immediately returns control of the value to the HODLer, before the agreed `nLockTime`.
* The above constructions can be done in current Bitcoin.
* However, the same constructions could be done with a covenant as proposed by Tamas, possibly with reduced communication/coordination costs between the advertiser and HODLer.

Now, there remains the question as to whether users will actually patronize the BCAN instead of existing advertising systems.

* We assume that privacy is valuable to users.
* We assume that users of BCAN will run BCAN nodes.
  This leaks them as users of BCAN, a small loss of privacy.

Then:

* Users can look for advertisements of specific classes by simply querying their own BCAN node.
  This does not leak privacy ata all as long as the communication channel of the user with their own BCAN node is private.
  * Compare this to alternatives, which involve some entity observing the behavior of users and thus invading their privacy.
* Advertisers that misclassify their advertisements will be unable to reach their target audience.
* Utility-maximizing advertisers will correctly indicate the class of their advertisements, as otherwise they would be paying the advertising cost without gaining the benefit of the advertisement.


Regards,
ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1: Type: text/plain, Size: 9736 bytes --]

Good morning ZmnSCPxj,

thank you very much for sharing your BCAN idea and thought process in detail.

I add some thoughs that very likely occured to you, but not formulated explicitelly:

1. The unique feature of such advertisement network is that it has no owner, just like the Bitcoin network.
If it had an owner, that owner could simply bill for use, but would also be forced to restrict access or apply some sort of censorship.
This is why usage costs is imposed through opportunity cost and not billed.

2. Since opportunity cost of one Bitcoin for a short time period is magnitudes less than its face value, one would need significant
Bitcoin amounts to impose meaningful costs so they have the chance to be included into BCANs purposedly limited bandwidth.
Those who would want to place an ad will often not have sufficient amount of Bitcoin holdings which lets them borrow UTXOs.

3. If borrowed Bitcoin is certain to be returned (as in your construction) then this offers riskless interest for HODLer.

4. Bitcoin’s most popular use is storing wealth whereby this use currently completely relies on the assumption that “the number goes up”.
A service that delivers interest on HODLed coins without exposing the HODLer to credit risk of the borrower is a huge game changer.

5.This scheme allows HODLer a concious decision whom or what project they fund.

For above reasons I think that this is a crucial design pattern to build censorship resistant networks which also give rise to riskless interest on Bitcoin.

My finance examples where abstract and less interesting for this audience but the BCAN should ring the bell for many.

As you said BCAN is possible with current Bitcoin, therefore we should no longer discuss it under the covenant topic.
The idea of debt covenant will likely resurface as soon as this design pattern proves to be useful in practice and one is looking for
a more flexible solution. I am confident we will get there, but not as fast as I initially thought.

Regards,

Tamas Blummer

> On Jul 9, 2019, at 12:31, ZmnSCPxj via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:
> 
> Good morning all,
> 
> I will attempt to restart my thinking from initial principles regarding my proposed "Bitcoin Classified Ads Network".
> 
> Nodes behave this way:
> 
> * Nodes in this network gossip advertisements.
> * These advertisements refer to a UTXO that must be unspent at the chain tip considered by each node, else they would be rejected.
> * The referred UTXO must contain a commitment to the text of the advertisement, else the advertisement is rejected.
> * Nodes have a maximum limit on the total size of all advertisements they retain and propagate to new nodes, or gossip to their peers.
>  This is a deliberate design decision.
> * If nodes exceed the above limit, they will sort advertisements according to a value-rate, the value of the UTXO divided by the storage size of the advertisement, and prune advertisements with low value-rate until they are within the limit again.
> * Once the backing UTXO is spent, the advertisement is removed by nodes that follow that chaintip.
> * As the name ***Classified Ads*** suggests, each advertisement also indicates a "class" in which they belong to.
> 
> Then, from the above, we derive how a seller might behave.
> 
> * Sellers will attempt to put the minimum possible value into a UTXO committing to an advertisement, to reduce the opportunity cost of using the value elsewhere.
> * Thus the rent of the advertisement in this case is paid to joinmarket makers and LN forwarding nodes, as the value used in a UTXO backing an advertisement is not useable in joinmarket/LN.
> * Sellers remain in full control of their advertising UTXO, and can spend it at any time.
> * Sellers may spend part of the UTXO and put the remaining funds into a change address that is a new advertising UTXO, and re-transmit the advertisement, this time pointing to the new change UTXO.
> * However, if the remaining change becomes too low, then its value-rate may drop below the lowest value-rate that BCAN nodes will retain in their (deliberately limited) storage, thus also deleting their advertisement from the BCAN.
> * Presumably, the reason for advertising at all, is that the seller considers the cost of advertising to be less than the expected gain of actually selling their product.
> * Thus, even if the seller has the ability to spend the UTXO at any time, they run the risk of spending too much and thus removing their advertisement from the BCAN, and losing the expected gain of having the advertisement exist on the BCAN.
> * A utility-maximizing seller would therefore not spend a minimal-value UTXO backing the advertisement until it has gained the advantage of actually selling the product, even if it has the option to do so: it is a forced move.
> * The cost of keeping the minimal-value UTXO unspent is the opportunity cost in that the value may have been used in joinmarket or LN instead.
> * The minimum value will largely be dependent on how much the BCAN is used; more sellers advertising over BCAN will increase the minimum value.
> * If the minimum value that is viable to keep its advertisement alive goes higher, then the opportunity cost of the seller using the same value elsewhere might exceed the expected gain from selling the product.
>  However, this is expected of *any* advertising scheme: if the gains from selling is too small to justify the advertisement price, advertising does not happen; this is expected utility-maximizing behavior.
> * If competitors of the seller exist and the BCAN node storage is already filled, competitors can increase the minimum value of a UTXO that can keep an advertisement alive on BCAN by simply adding more of their advertisements to BCAN.
> * Thus we expect that, once the BCAN node storage is at or near the maximum value, the minimum value of a UTXO that can back an advertisement will approach the expected gain from selling the product.
> 
> Thus the system of simply committing UTXOs to particular advertisement texts seems sufficient to extract value from a seller wishing to advertise.
> The purpose of this extraction of value is to ensure that spam does not overload the BCAN.
> 
> Let us now consider some kind of specialization, where a HODLer specializes in owning UTXOs, while an advertiser specializes in trading products that need advertising of some kind.
> 
> * We assume that the specialization means that the HODLer cannot feasibly make and sell products on its own, while the advertiser cannot own and control UTXOs of the minimum value needed to keep their advertisement alive on the BCAN.
> * We assume that the specialization means that the advertiser can make and sell products for cheaper than the HODLer can, while the HODLer can own and control (and secure) UTXOs of the minimum value needed for advertisements to be kept alive, for cheaper than the advertiser can.
> 
> Then:
> 
> * A HODLer may offer to provide a UTXO locked by a 2-of-2 with a commitment to an advertisement of the advertiser's choosing, in exchange for rent of the value, plus an unbreakable promise to return the rented UTXO value back to the HODLer (represented by a `nLockTime` pre-signed transaction that returns the 2-of-2 back to the HODLer control).
> * The HODLer is effectively lending the UTXO out to the advertiser, for the time frame agreed upon by the advertiser.
> * The rent at which the HODLer lends out the UTXO must be between the opportunity cost of instead securely utilizing the UTXO in LN or joinmarket, and the expected gain the advertiser expects from having its product advertised.
>  * The HODLer is assumed to have the ability to secure the UTXO and retain all data it needs to recover the UTXO; this is part of the assumption that the HODLer specializes in such.
>  * The advertiser is assumed to have positive gains from creating, advertising, and selling its product; this is part of the assumption that the advertiser specializes in such.
> * The HODLer and advertiser can agree to refund part of the rent, if the advertiser signs a transaction that immediately returns control of the value to the HODLer, before the agreed `nLockTime`.
> * The above constructions can be done in current Bitcoin.
> * However, the same constructions could be done with a covenant as proposed by Tamas, possibly with reduced communication/coordination costs between the advertiser and HODLer.
> 
> Now, there remains the question as to whether users will actually patronize the BCAN instead of existing advertising systems.
> 
> * We assume that privacy is valuable to users.
> * We assume that users of BCAN will run BCAN nodes.
>  This leaks them as users of BCAN, a small loss of privacy.
> 
> Then:
> 
> * Users can look for advertisements of specific classes by simply querying their own BCAN node.
>  This does not leak privacy ata all as long as the communication channel of the user with their own BCAN node is private.
>  * Compare this to alternatives, which involve some entity observing the behavior of users and thus invading their privacy.
> * Advertisers that misclassify their advertisements will be unable to reach their target audience.
> * Utility-maximizing advertisers will correctly indicate the class of their advertisements, as otherwise they would be paying the advertising cost without gaining the benefit of the advertisement.
> 
> 
> Regards,
> ZmnSCPxj
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Tamas Blummer]

[-- Attachment #1.1: Type: text/plain, Size: 4197 bytes --]


> On Jul 6, 2019, at 01:16, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
> 
> Good morning Eric,
> 
> 
> Sent with ProtonMail Secure Email.
> 
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Saturday, July 6, 2019 3:27 AM, Eric Voskuil <eric@voskuil.org <mailto:eric@voskuil.org>> wrote:
> 
>>> On Jul 4, 2019, at 21:05, ZmnSCPxj ZmnSCPxj@protonmail.com wrote:
>>> Good morning Eric,
>>> 
>>>> As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?
>> 
>> Good morning ZmnSCPxj,
>> 
>>> Using the unspentness-time of a UTXO allows for someone advertising a service or producer to "close up shop" by simply spending the advertising UTXO.
>>> For instance, if the advertisement is for sale of a limited stock of goods, once the stock has been sold, the merchant (assuming the merchant used own funds) can simply recover the locked funds, with the potential to reinvest them elsewhere.
>>> This allows some time-based hedging for the merchant (they may be willing to wait indefinitely for the stock to be sold, but once the stock is sold, they can immediately reap the rewards of not having their funds locked anymore).
>> 
>> This is a materially different concept than proposed by Tamas.
>> 
>> “...he gives up his control of the coins until maturity, he can not use them elsewhere until then.”
> 
> Possibly.
> In a way, this is giving up control of the coin, until he no longer needs the advertisement, i.e. dynamically select the maturity age needed.
> 

My proposal would separate the owner of the funds from the one using the advertizement service. Yes, the owner lock up until maturity. But those using the UTXO for the advertizement service could transfer (sell) the UTXO to someone else as soon as they do not need it, so it is dynamic maturity for them The new owner could use them for an other advertizement or for an entirely different purpose.

Regarding burning: I think burning is unsustainable as usage of services is unlimited while coin suply is limited.

>> 
>> And as I have shown above, nor can a “locked-up” coin be unlocked to do the same.
> 
> You have shown no such thing, merely shown that you have not understood the proposal.
> 
> Regards,
> ZmnSCPxj

I also struggle to communicate to Eric and likely many other reader the generic utility of temporary control of an UTXO. Let me try again:

Bitcoin offers a memory with remarkable properties:
- it can be read by anyone anywhere
- anyone anywhere who knows a key controlling an UTXO, and only them, can initiate an update to the memory
- global replicas guaranteed to apply updates of the memory within a short time period.

This is a utility that is sufficient to implement money.

Such a reliable shared memory could have however more uses than tracking money, It could keep track of, and thereby make scarce, arbitary other things.

We can unlock these uses by separating the money use of memory from other uses.

The covenant achives this separation temporarily. A UTXO with a covenant that guarantees that current owner re-gains control at a later time means,
that the current owner temporarily forgoes the UTXOs use as money and thereby allows its temporary use to keep track of something else.
UTXOs with different covenants or without covenant are not fungible.

Why use UTXOs of significant value to track something that is not money? Because the reason the registry is used is to create scarcity and scarcity can be tailored to more or
less severe by requiring more or less satoshis to track something.

The current owner of a regular UTXO will want to be paid for temporarily giving up control, and that payment represents interest. Riskless, since it is certain to re-gain control.

Regards,

Tamas Blummer






[-- Attachment #1.2: Type: text/html, Size: 14796 bytes --]

[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

[-- Attachment #1: Type: text/plain, Size: 5624 bytes --]



> On Jul 6, 2019, at 03:12, Tamas Blummer <tamas.blummer@gmail.com> wrote:
> 
> 
>> On Jul 6, 2019, at 01:16, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>> 
>> Good morning Eric,
>> 
>> 
>> Sent with ProtonMail Secure Email.
>> 
>> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
>> On Saturday, July 6, 2019 3:27 AM, Eric Voskuil <eric@voskuil.org> wrote:
>> 
>>>> On Jul 4, 2019, at 21:05, ZmnSCPxj ZmnSCPxj@protonmail.com wrote:
>>>> Good morning Eric,
>>>> 
>>>>> As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?
>>> 
>>> Good morning ZmnSCPxj,
>>> 
>>>> Using the unspentness-time of a UTXO allows for someone advertising a service or producer to "close up shop" by simply spending the advertising UTXO.
>>>> For instance, if the advertisement is for sale of a limited stock of goods, once the stock has been sold, the merchant (assuming the merchant used own funds) can simply recover the locked funds, with the potential to reinvest them elsewhere.
>>>> This allows some time-based hedging for the merchant (they may be willing to wait indefinitely for the stock to be sold, but once the stock is sold, they can immediately reap the rewards of not having their funds locked anymore).
>>> 
>>> This is a materially different concept than proposed by Tamas.
>>> 
>>> “...he gives up his control of the coins until maturity, he can not use them elsewhere until then.”
>> 
>> Possibly.
>> In a way, this is giving up control of the coin, until he no longer needs the advertisement, i.e. dynamically select the maturity age needed.
>> 
> My proposal would separate the owner of the funds from the one using the advertizement service.

No, it would not. I have seen no proposal requiring identity in the two roles, which is necessary to show that two distinct individuals operate in the roles. Furthermore, even identity would be insufficient, as two individuals can clearly collude in these roles.

> Yes, the owner lock up until maturity. But those using the UTXO for the advertizement service could transfer (sell) the UTXO to someone else as soon as they do not need it, so it is dynamic maturity for them The new owner could use them for an other advertizement or for an entirely different purpose.

Agree, and it is the unremovable time constraint that ensures the opportunity cost. This is why in your proposal it is of no consequence that both roles can be the same person.

> Regarding burning: I think burning is unsustainable as usage of services is unlimited while coin suply is limited. 

Loss is perpetual, so this implies Bitcoin is unsustainable.

>>> 
>>> And as I have shown above, nor can a “locked-up” coin be unlocked to do the same.
>> 
>> You have shown no such thing, merely shown that you have not understood the proposal.
>> 
>> Regards,
>> ZmnSCPxj
> 
> I also struggle to communicate to Eric and likely many other reader the generic utility of temporary control of an UTXO. Let me try again:

No, you do not. This is not the point at issue. See my previous response.

> Bitcoin offers a memory with remarkable properties:
> - it can be read by anyone anywhere
> - anyone anywhere who knows a key controlling an UTXO, and only them, can initiate an update to the memory
> - global replicas guaranteed to apply updates of the memory within a short time period.
> 
> This is a utility that is sufficient to implement money. 

No, it isn’t. Ownership must be perpetually (actually) transferable, not just known. The use of a covenant breaks this transferability, see previous posts.

> Such a reliable shared memory could have however more uses than tracking money, It could keep track of, and thereby make scarce, arbitary other things.

For the same reason this cannot work for money, it cannot work for any perpetual asset. See previous posts.

> We can unlock these uses by separating the money use of memory from other uses. 
> 
> The covenant achives this separation temporarily. A UTXO with a covenant that guarantees that current owner re-gains control at a later time means, 
> that the current owner temporarily forgoes the UTXOs use as money and thereby allows its temporary use to keep track of something else.

Only if the asset expires at or before the covenant maturity.

> UTXOs with different covenants or without covenant are not fungible.

Of course.

> Why use UTXOs of significant value to track something that is not money? Because the reason the registry is used is to create scarcity and scarcity can be tailored to more or
> less severe by requiring more or less satoshis to track something.

Only 1 satoshi is required for tracking. It is only the scarcity of a satoshi that creates this scarcity, not the covenant on it. The covenant represents only the destruction of opportunity of the value represented by the 1 satoshi, not a new system of scarcity.

> The current owner of a regular UTXO will want to be paid for temporarily giving up control, and that payment represents interest.

Yes, opportunity cost.

> Riskless, since it is certain to re-gain control.

But of no value to anyone as money.

Best,
Eric

> Regards,
> 
> Tamas Blummer

[-- Attachment #2: Type: text/html, Size: 16724 bytes --]

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[Eric Voskuil]

> On Jul 5, 2019, at 12:27, Eric Voskuil <eric@voskuil.org> wrote:
> 
> 
>> On Jul 4, 2019, at 21:05, ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:
>> 
>> Good morning Eric,
>> 
>>> As with Bitcoin mining, it is the consumed cost that matters in this scenario, (i.e., not the hash rate, or in this case the encumbered coin face value). Why would the advertiser not simply be required to burn .1 coin for the same privilege, just as miners burn energy? Why would it not make more sense to spend that coin in support of the secondary network (e.g. paying for confirmation security), just as with the burning of energy in Bitcoin mining?
> 
> Good morning ZmnSCPxj,
> 
>> Using the unspentness-time of a UTXO allows for someone advertising a service or producer to "close up shop" by simply spending the advertising UTXO.
>> For instance, if the advertisement is for sale of a limited stock of goods, once the stock has been sold, the merchant (assuming the merchant used own funds) can simply recover the locked funds, with the potential to reinvest them elsewhere.
>> This allows some time-based hedging for the merchant (they may be willing to wait indefinitely for the stock to be sold, but once the stock is sold, they can immediately reap the rewards of not having their funds locked anymore).
> 
> This is a materially different concept than proposed by Tamas.
> 
> “...he gives up his control of the coins until maturity, he can not use them elsewhere until then.”
> 
>> Similarly, an entity renting out a UTXO for an advertisement might allow for early reclamation of the UTXO in exchange for partial refund of fee; as the value in the UTXO is now freed to be spent elsewhere, the lessor can lease it to another advertiser.
> 
> You appear to be proposing a design whereby either the owner or the renter (not entirely clear to me which) can spend the “locked up” coin at any time (no maturity constraint), by dropping the covenant.
> 
> If the renter can do this he can simply steal the coin from the owner.
> 
> If the owner can do this there is no value to the renter (or as a proof of cost), as the owner retains full control of the coin.
> 
> If you mean that the age of the encumbrance is the proof of cost, this requires no covenant. I don’t believe this is what you intended, just covering all bases.
> 
>> Burnt funds cannot be "un-burnt" to easily signal the end of a term for an advertisement.
> 
> And as I have shown above, nor can a “locked-up” coin be unlocked to do the same.
> 
>> Similarly for miner fees.
> 
> Well that’s the point, money spent is no longer under one’s control. The provable cost of this surrender was your stated objective. Renting at a fractional cost of coin face value is a non-recoverable spend by the renter to the owner. Burning or spending the same amount in a way that is provably not to one’s self achieves the exact same result.
> 
>> The best that can be done would be to have the nodes of the classified ads network automatically decay the spent value of older advertisements to let them be dropped from their advertisements pool.
> 
> The advertiser can presumably trade control of as space on the ad network. It’s not clear to me why this is not simply an independent chain of limited ad space ownership. It might as well be namecoin.
> 
>> Less importantly, burning currently has bad resource usage for practical applications.
>> Practical burning requires spending to a provably-unspendable P2PKH or P2SH or similar output.
>> This adds UTXO entries to the UTXO database that will never be removed.

I forgot to add that it is certainly possible to burn using a nonstandard script, such as the non-zero OP_RETURN you suggested, without a consensus change. This can be, as you say, made more practical with a policy change. But such changes are up to individual node operators as they require no deviation from consensus. Yet ultimately this is a miner preference, and anyone can mine. Finally, as I pointed out, burning is not necessary. Simply spending the coin as a fee is sufficient.

> If an output is provably unspendable (burned) it is not a UTXO.
> 
> It is worth noting that not all full node implementations require a store of UTXOs, this is an implementation detail. For example, libbitcoin uses a flag on each output to indicate its spentness on the strong branch. As such the store size is linear by height.
> 
>> This will of course be remedied by compact UTXO representations later, but not today.
>> Similarly, it would be very nice to have non-0-amount `OP_RETURN` outputs, as `OP_RETURN` outputs are never stored in the UTXO database.
>> However, this will require a change in node relay policy, which again will take time to make possible, and would not be practical today.
>> 
>> Thus I think use of UTXO is better than burning or mining-fee-spending.
> 
> I don’t believe you have shown this.
> 
> Best,
> Eric
> 
>> Also, mostly trivia:
>> The use of UTXOs to advertise services is not original to me --- I found the LN channel gossip to be the inspiration for this.
>> Publicly-announced channels indicate the backing UTXO that funds the channel.
>> The purpose of publicly announcing the channels is to be able to provide the service, of forwarding across the Lightning Network; thus the public announcement serves as an advertisement for the service.
>> Channel closure immediately spends the UTXO, and also doubles to "revoke" the existing "advertisement".
>> I found this ability to "revoke" the advertisement appealing, and thereby designed the Bitcoin Classified Ads Network around the UTXO spentness mechanism.
>> 
>> Regards,
>> ZmnSCPxj

Re: [bitcoin-dev] Generalized covenants with taproot enable riskless or risky lending, prevent credit inflation through fractional reserve

[David A. Harding]

On Fri, Jun 28, 2019 at 10:27:16AM +0200, Tamas Blummer via bitcoin-dev wrote:
> The value of these outputs to Charlie is the proof that he has
> exclusive control of the coins until maturity.
>
> Alice can not issue promissory notes in excess of own capital or
> capital that she was able to borrow. No coin inflation or fractional
> reserve here, which also reduces the credit risk Charlie takes.

I believe these goals are obtainable today without any consensus
changes.  Bob can provably timelock bitcoins using CLTV or CSV in a
script that commits to the outpoint (txid, vout) of an output that will
be used as a colored coin to track the debt instrument.  The colored
coin, which has no appreciable onchain value itself, can then be
trustlessly traded, e.g. from Alice to Charlie to Dan as you describe.  

Anyone with a copy of the script Bob paid, the confirmed transaction he
included it in, and the confirmed transaction history of the colored
coin can trustlessly verify the ownership record---including that no
inflation or fractional reserve occurred.

I believe the RGB working group has set for itself the goal[1] of making
trustless colored coin protocols more efficient when performed on top of
Bitcoin.  I'd also suggest reading about Peter Todd's concept of
single-use seals[2].  You may want to investigate these ideas and see
whether they can be integrated with your own.

[1] https://github.com/rgb-org/spec/blob/master/00-introduction.md
[2] https://petertodd.org/2016/commitments-and-single-use-seals#bitcoin-transaction-outputs-as-single-use-seals

-Dave