📈 economics

The Economics of Proof-of-Useful-Work

This paper presents a competitive-equilibrium model demonstrating that Proof-of-Useful-Work (PoUW) blockchains can securely generate valuable external outputs like machine learning inference without compromising security, as the economic cost of attacks remains tied to block rewards while token rewards effectively subsidize and expand socially useful computation in specific adoption regimes.

Original authors: Rafael Pass

Published 2026-06-08

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Rafael Pass

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: From Burning Money to Baking Bread

Imagine a digital currency system (like Bitcoin) that needs to be secured. Currently, to keep this system safe, computers around the world solve incredibly difficult math puzzles. This process is called Proof-of-Work (PoW).

The Problem: These puzzles are designed to be useless. They consume massive amounts of electricity and computer power just to say, "Yes, this transaction is real." It's like a bakery that burns a million dollars worth of wood just to keep the oven hot, but never actually bakes any bread. The heat keeps the bakery secure, but no one gets to eat.

The Proposal: This paper explores a new idea called Proof-of-Useful-Work (PoUW). Instead of burning energy on useless puzzles, the computers would solve puzzles that actually do something helpful, like training Artificial Intelligence (AI) or processing data. So, the bakery would still keep the oven hot to stay secure, but it would also be baking bread that people can eat.

The Big Fear: "Why would an attacker attack if they get paid?"

Critics have a simple objection: "If the work is useful, an attacker could just steal the computer power, do the useful work, sell the results, and use that money to pay for the attack. It's like getting paid to rob a bank!" They argue this makes the system cheap to break.

The Paper's Answer: The authors built a complex economic model to test this. They found that this fear is wrong. Even if the work is useful, the cost to attack the system remains just as high as it is in the current "useless" systems. Why? Because the market adjusts. If attackers try to do the useful work, the price of that work drops, or the cost of the attack rises, until the math balances out. You can't get a "free lunch."

The Three Economic Worlds

The paper describes three different "worlds" or scenarios that can happen depending on how efficient the technology is and how popular the currency is. Think of these as three different stages of a bakery's evolution:

1. Bitconia (The Old Way)

The Scenario: The technology to do "useful work" while securing the system is too clumsy and inefficient. It's like trying to bake bread while simultaneously trying to keep the oven hot, but the oven keeps getting cold.
The Result: The system gives up on the useful part. It reverts to the old way: computers just burn energy on useless puzzles to stay secure. The "bread" (useful work) is made separately by other bakeries.
Takeaway: No gain. It's just like Bitcoin today.

2. Fortessia (The Fortress)

The Scenario: The technology gets better. Now, the computers can do useful work and secure the system at the same time, with only a tiny bit of extra effort (overhead).
The Result: The system stops doing useless puzzles entirely. It switches to the "useful" mode.
The Magic: Because the computers are now doing two things at once, the system becomes much more secure than before, without needing any extra money or energy. It's like a fortress that is now guarded by soldiers who are also building the walls. The walls are stronger, and the soldiers are still paid the same.
Takeaway: We get better security for free, but the amount of "bread" (useful work) stays the same as before.

3. Duplexia (The Double Win)

The Scenario: The technology is very efficient, and the currency is very popular (people really want to use it).
The Result: The system enters a "supercharged" mode. The rewards from the currency act like a subsidy (a discount coupon) for the useful work.
The Magic: Because the currency rewards help pay for the work, the price of the useful work (like AI processing) drops. When the price drops, more people buy it. This creates a feedback loop:
1. Lower prices mean more people want the useful work.
2. More demand means the currency becomes more valuable.
3. A more valuable currency means even bigger rewards for the workers.
4. This allows the system to produce more useful work than ever before, at a lower price.
Takeaway: We get a "double win." The system is more secure, AND we get a massive expansion of useful work (like more AI processing) that wouldn't exist without the blockchain.

The "Strawman" Argument Debunked

The paper spends a lot of time addressing the "Strawman" argument (the idea that attackers get paid to attack).

The Myth: "If I attack, I can sell the useful work I generate, so my attack costs nothing."
The Reality: The paper shows that in a balanced market, the price of the useful work adjusts. If an attacker tries to flood the market with useful work, the price of that work drops. The "profit" from selling the work disappears.
The Conclusion: The cost to attack is still tied to the value of the currency rewards. It is not cheap. In fact, in the "Duplexia" world, it might even be more expensive to attack because the system is generating so much value.

The "Free Lunch" Question

Does this mean we get useful work for free?

Sort of, but not really. The paper explains that the "subsidy" comes from the creation of new currency (inflation). This is similar to how governments print money to pay for public services.
The Trade-off: While we avoid the "waste" of useless puzzles, we introduce a small amount of "waste" in the form of deadweight loss. This happens because the subsidy lowers the price so much that some people use the service even though it costs more to produce than they value it.
The Verdict: However, the paper argues that this small waste is usually much smaller than the massive waste of burning energy on useless puzzles in the old system. So, it's still a net positive for society.

Summary in One Sentence

This paper proves that we can build a blockchain that secures itself by doing useful work (like AI) without making it easy for hackers to attack, and in the best-case scenario, this system actually creates more useful work and more security than our current systems, all while keeping the economic costs balanced.

Technical Summary: The Economics of Proof-of-Useful-Work

Problem Statement

Proof-of-Work (PoW) blockchains, such as Bitcoin, secure distributed ledgers through computational expenditure that is intentionally useless in an economic sense. While this "waste" is argued to be necessary to make attacks economically painful, it generates no external value. An emerging alternative, Proof-of-Useful-Work (PoUW), proposes that the same computational resources used for consensus could simultaneously perform economically valuable tasks, such as machine learning (ML) inference.

However, PoUW faces a significant economic critique: if the work is useful, an attacker could theoretically be "paid to attack" by selling the useful output generated during the attack, potentially collapsing the economic cost of compromising the network. This paper seeks to formally investigate whether this intuition holds under competitive equilibrium conditions and to characterize the economic trade-offs of PoUW systems.

Methodology

The authors develop a competitive-equilibrium model of a PoUW blockchain economy. The model abstracts the underlying consensus protocol (assuming a standard Nakamoto-style protocol) and focuses on the allocation of computational resources across three activities:

Pure Mining ( $M$ ): Generates security (hashrate) but no useful output.
Pure Inference ( $L$ ): Generates useful output (e.g., ML inference) but no security.
Duplex/Hybrid Work ( $D$ ): Simultaneously generates security and useful output, but with technological overheads.

Key Parameters:

Overheads ( $\alpha, \gamma$ ): A duplex operation produces $1/\alpha$ units of inference and $1/\gamma$ units of security. $\alpha, \gamma \ge 1$ . If $\alpha=1$ and $\gamma=1$ , duplex is perfectly efficient; typically $\alpha, \gamma > 1$ (e.g., 1.3), representing a ~23% overhead compared to specialized tasks.
Duplex Overhead Index ( $\Delta$ ): Defined as $\Delta = \frac{1}{\gamma} + \frac{1}{\alpha} - 1$ . This determines if duplex is more efficient than splitting resources between pure mining and pure inference.
Token-Inference Ratio ( $\theta$ ): A scalar parameter defined as $\theta = \frac{PR}{pQ}$ , where $P$ is the token price, $R$ is the block reward, $p$ is the inference price, and $Q$ is the total inference supplied. This ratio measures the degree of economic coupling between the token economy and the inference market.

The model assumes a continuum of competitive agents with free entry, driving profits to zero in equilibrium. The inference market is modeled as a Bertrand competition (price equals marginal cost if solo inference is active), while the security market is modeled as a Tullock contest (rewards shared proportionally to hashrate).

Key Contributions and Results

1. Characterization of Three Economic Regimes

The paper provides a complete closed-form characterization of equilibrium allocations and prices, revealing three distinct regimes determined by the duplex efficiency ( $\Delta$ ) and the T/I ratio ( $\theta$ ):

Bitconia ( $\Delta < 0$ ): Duplex is technologically inefficient. The economy reduces to a classical PoW system where mining and inference are fully decoupled ( $M > 0, L > 0, D = 0$ ). Inference prices equal compute costs ( $p=e$ ), and security is produced entirely by wasted computation.
Fortessia ( $\Delta > 0, \theta < \theta_{low}$ ): Duplex is efficient, but the token economy is relatively small. Duplex replaces pure mining ( $M=0, D>0$ ), while solo inference remains active ( $L>0$ ). Inference prices remain pinned at $p=e$ , so the volume of useful computation is unchanged from Bitconia. However, security strictly increases because the overhead of duplex is less than the "waste" of pure mining. Security is "fortified."
Duplexia ( $\Delta > 0, \theta > \theta_{low}$ ): Both technology and token adoption are strong. Solo inference disappears ( $L=0$ ), and all inference is produced via duplex work. Crucially, the inference price falls below the compute cost ( $p < e$ ). Block rewards effectively act as a subsidy, expanding the inference market beyond the standalone optimum. This creates a positive feedback loop: lower prices increase inference demand, which increases token value (under fixed $\theta$ ), further amplifying the subsidy.

2. Refutation of the "Paid to Attack" Strawman

The paper formally addresses the criticism that PoUW makes attacks cheap because attackers can sell useful output.

Result: In any competitive equilibrium, the economic cost of a 50% attack is exactly $\frac{PR}{2}$ , regardless of the regime.
Mechanism: While an attacker using duplex compute earns inference revenue ( $p/\alpha$ ), the equilibrium price $p$ adjusts such that the net cost of acquiring security weight remains tied to the block reward budget. If the attacker uses duplex, the revenue earned is exactly offset by the reduction in the token price or the specific equilibrium conditions, ensuring the cost of attack is not lower than in a classical PoW system. In Duplexia, the cost is actually weakly higher than in Bitconia due to the increased token value driven by the expanded inference market.

3. Social Value and Efficiency

The paper analyzes the net social value ( $\Delta SV$ ) of PoUW compared to a standalone inference market and classical PoW.

Comparison to Bitcoin: At the same block reward ($PR$), Duplexia strictly dominates Bitcoin because the same expenditure produces valuable inference rather than pure waste.
Comparison at Fixed $\theta$ : When comparing equilibria at the same T/I ratio, Duplexia avoids the mining waste of Bitcoin but introduces two costs:
1. Duplex Overhead: The inefficiency of performing useful work while mining.
2. Deadweight Loss: The subsidy lowers prices below marginal cost, inducing consumption of units valued by consumers less than their resource cost.
Condition for Dominance: Under isoelastic demand with elasticity $\varepsilon > 1$ , Duplexia strictly dominates Bitcoin if and only if $\theta < \frac{1}{\varepsilon - 1}$ . For $\varepsilon = 2$ , Duplexia dominates whenever inference market revenue exceeds block reward revenue.

4. Robustness and Heterogeneity

The results extend to settings with heterogeneous compute costs (modeled via an upward-sloping supply curve). The regime structure (Bitconia, Fortessia, Duplexia) remains invariant, with the fixed cost $e$ replaced by an endogenous marginal cost $e^*$ . The attack cost result ($PR/2$) also holds in this setting.

Significance and Claims

The paper claims to provide the first formal economic equilibrium analysis of PoUW, moving beyond heuristic arguments. Its primary significance lies in:

Validating Security: It demonstrates that the "paid to attack" argument is a strawman; equilibrium prices neutralize the apparent cost reduction, maintaining security costs tied to the block reward.
Identifying Value Creation: It shows that under specific conditions (high token adoption and efficient duplex technology), PoUW can generate a "duplex" gain: simultaneously increasing network security and expanding the supply of socially useful computation (inference) beyond what would exist without the blockchain.
Incentive Alignment: The model suggests natural incentive alignment where token holders benefit from technological improvements in duplex efficiency (which lower inference prices and raise token value), and inference providers benefit from token adoption.

The authors conclude that while PoUW does not eliminate all inefficiencies (overhead and potential deadweight loss remain), it offers a mechanism to convert the "waste" of PoW into socially useful output, provided the economic parameters (specifically the T/I ratio and demand elasticity) fall within the "Duplexia" regime.