Past, present, and future of ASIC manufacturing
A cryptocurrency miner is a heterogeneous computing system, which refers to systems using multiple types of processors. Heterogeneous computing is becoming more common as Moore’s Law slows down. Gordon Moore, originator of the eponymous law, predicted that transistor density in semiconductor manufacturing would produce continuous and predictable hardware improvements, but that these improvements had only 10-20 years before they reached fundamental physical limits.
The first generation of Bitcoin ASICs included China's ASICMiner, Sweden's KNC, and Butterfly Labs and Cointerra in the U.S. Application-specific hardware quickly showed its promise. The first batch of ASICMiner hit the market in February 2013. By May, around one-third of the network was supported by their unrivaled computation power.
Integrated circuit competition is all about how quickly a company can iterate the product and achieve economies-of-scale. Without sufficient prior experience about hardware manufacturing, ASICMiner rapidly lost market share due to delay and a series of critical strategic mistakes.
Around the same time in 2013, Jihan Wu and Ketuan Zhan started Bitmain. In the early days of Bitcoin ASICs, simply improving upon the previous generation’s chip density, or tech node, offered an instant and efficient upgrade. Getting advanced tech nodes from foundries is always expensive, so the challenge was less about superior technical design, but more about the ability to fundraise. Shortly after the launch of Bitmain, the company rolled out the Antminer S1 using TSMC’s 55nm chip.
In 2014, the cryptocurrency market entered into a protracted bear market, with the price of Bitcoin dropping nearly 90 percent. By the time the market recovered in 2015, the Antminer S5 (Bitmain’s then-latest machine) was the only product available to meet the demand. Bitmain quickly established its dominance. Subsequently, the lead engineer from ASICMiner joined Bitmain as a contractor, and developed the S7 and S9. These two machines went on to become the most successful cryptocurrency ASIC products sold to date.
The semiconductor industry is fast-paced. Increased competition, innovations in production, and economies of scale mean the price of chips keep falling. For large ASIC mining companies to sustain their profit margins they must tirelessly seek incremental design improvements.
How the hardware game is changing
In the past, producing a faster generation of chips simply required placing transistors closer together on the chip substrate. The distance between transistors is measured in nanometers. As chip designers begin working with cutting-edge tech nodes with transistor distances as low as 7nm, the improvement in performance may not be proportional to the decrease in distance between transistors. Bitmain has reportedly tried to tape-out new Bitcoin ASIC chips at 16nm, 12nm, and 10nm as of March 2018. The tape-out of all these chips allegedly resulted in failure which cost the company almost 500 million dollars.
After the bull run in 2017, many new original equipment manufacturers (OEMs) are entering the Bitcoin ASIC arena. While Bitmain is still the absolute leader in terms of size and product sales, the company is clearly lagging behind on performance of its core products. Innosilicon, Canaan, Bitfury, Whatsminer (started by the same engineer designed S7 and S9), and others are quickly catching up, compressing margins for all players.
As the pace of tech node improvement slows down, ASIC performance becomes increasingly dependent on the company’s architectural design skills. Having an experienced team to implement fully-custom chip design is therefore critical for ASIC manufacturers to succeed in the future. In the long term, ASIC design will become more open-source and accessible, leading to commoditization.
Bitcoin mining started out as a hobbyists’ activity which could be done on a laptop. From the chart above we can see the accelerating move to industrialized mining. Instead of running mining rigs in a garage or basement, industrialized mining groups, cloud mining providers, and hardware manufacturers themselves today build or renovate data-centers specifically tailored for cryptocurrency mining. Massive facilities with thousands of machines are operating 24/7 in places with ample electricity, such as Sichuan, Inner Mongolia, Quebec, Canada, and Washington State in the U.S.
In the cut-throat game of mining, a constant cycle of infrastructure upgrades requires operators to make deployment decisions quickly. Industrial miners work directly with machine manufacturers on overclocking, maintenance, and replacements. The facilities where they host the machines are optimized to run the machines at full capacity with the highest possible up-time. Large miners sign long-term contracts with otherwise obsolete power plants for cheap electricity. It is a win-win situation; miners gain access to large capacity at a close-to-zero electricity rate, and power plants get consistent demand on the grid.
Over time, cryptocurrency networks will behave like evolving organisms, seeking out cheap and under-utilized power, and increasing the utility of far-flung facilities that exist outside present-day industrial centers. Proof-of-Work cryptocurrencies depend on appending blocks to the chain to maintain consensus.
Over the years, many have voiced concern around the high amount of energy consumed in producing Bitcoin. Satoshi Nakamoto himself addressed this concern in 2010, saying:
“It's the same situation as gold and gold mining. The marginal cost of gold mining tends to stay near the price of gold. Gold mining is a waste, but that waste is far less than the utility of having gold available as a medium of exchange. I think the case will be the same for Bitcoin. The utility of the exchanges made possible by Bitcoin will far exceed the cost of electricity used. Therefore, not having Bitcoin would be the net waste.”
The “Delicate balance of terror” when miners rule
In a permissionless cryptocurrency system like Bitcoin, large miners are also potential attackers. Their cooperation with the network is predicated on profitability; should an attack become profitable, it’s likely that a large scale miner will attempt it. Those who follow the recent history of Bitcoin are aware that the topic of miner monopolies is controversial.
Some participants believe ASICs are deleterious to the health of the network in various ways. In the case of hashrate concentration, the community is afraid of miners’ collective ability to wage what is known as a 51 percent attack, wherein a miner with the majority of hashrate can use this computing power to rewrite transactions or double-spend funds. Such attacks are common in smaller networks, where the cost of achieving 51 percent of the hashrate is low.
Any mining pool (or cartel of mining pools) with over 51 percent of the hashrate owns the “nuclear weapon” in the network, effectively holding the community hostage with raw hashrate. This scenario is reminiscent of Cold War-era nuclear strategist Albert Wohlsetter’s notion of a delicate balance of terror:
“The balance is not automatic. First, since thermonuclear weapons give an enormous advantage to the aggressor, it takes great ingenuity and realism at any given level of nuclear technology to devise a stable equilibrium. And second, this technology itself is changing with fantastic speed. Deterrence will require an urgent and continuing effort.”
While large miners can theoretically initiate attacks that bends the consensus history to their likings, they also risk tipping off the market to their attack, causing a sudden collapse of the token price. Such a price collapse would render the miner’s hardware investment worthless, along with any previously-earned coins held long. In the case where manufacturing is highly concentrated, clandestine 51 percent attacks are easier to achieve.
In the past few years, Bitmain has dominated the market both in the form of hashrate concentration and manufacturing concentration. At the time of the writing, analysts at Sanford C. Bernstein %story% Co. estimate that Bitmain controls 85 percent of the market for cryptocurrency-mining chips.
“Tyranny of Structurelessness” when core developers rule
While hostile miners pose a constant threat to permissionless cryptocurrency systems, the dominance of the core software developers can be just as detrimental to the integrity of the system. In a network controlled by a few elite technologists, spurious changes to the code may not be easily detectable by miners and full node operators running the code.
Communities have taken various approaches to counter miners’ overwhelming amount of influence. The team at Siacoin decided to manufacture its own ASIC miner upon learning of Bitmain’s Sia miner. Communities such as Zcash take a cautiously welcoming attitude to ASICs. New projects such as Grin designed the hashing algorithm to be RAM (Random Access Memory) intensive so that ASICs are more expensive to manufacture. Some projects such as Monero have taken a much harsher stance, changing the hashing algorithm just to render one manufacturer’s ASIC machines inoperable. The fundamental divide here is less about “decentralization” and more about which faction controls the means of producing coinbase rewards valued by the marketplace; it is a fight over control of the “golden goose.”
Due to the highly dynamic nature of decentralized networks, to swiftly act against power concentration around miners could lead to the opposite extreme: power concentration around developer figureheads. Both types of concentration are equally dangerous. The latter extreme leads to a tyranny of structurelessness, wherein the community worships the primary committers in a cult of personality, and under a false premise that there is no formal power hierarchy. This term comes from social theorist Jo Freeman, who wrote in 1972:
“As long as the structure of the group is informal, the rules of how decisions are made are known only to a few and awareness of power is limited to those who know the rules. Those who do not know the rules and are not chosen for initiation must remain in confusion, or suffer from paranoid delusions that something is happening of which they are not quite aware.”
A lack of formal structure becomes an invisible barrier for newcomer contributors. In a cryptocurrency context, this means that the open allocation governance system discussed in the last section may go awry, despite the incentive to add more development talent to the team (thus increasing project velocity and the value of the network).
Dominance of either miners or developers may results in changes to the development roadmap which may undermine the system. An example is the erroneous narrative perpetuated by “large block” miners. The Bitcoin network eventually split into two on August 1, 2017 as some miners pushed for larger blocks, which would have increased the costs for full node operators, who play a crucial role in enforcing rules on a Proof-of-Work blockchain. Higher costs might mean fewer full node operators on the network, which in turn brings miners one step closer to upsetting the balance of power in their own favor.
Another example of imbalance would be Ethereum Foundation. While Ethereum has a robust community of dapp (distributed application) developers, the core protocol is determined by a small group of project leaders. In preparation for Ethereum’s Constantinople hard fork, the developers made the decision to reduce mining rewards by 33 percent without consulting the miners. Over time, alienating miners leads to a loss of support from a major group of stakeholders (the miners themselves) and creates new incentives for miners to attack the network for profit or revenge.
Market consensus is achieved when humans and machines agree
So far we have discussed human consensus and machine consensus in the Bitcoin protocol. Achievement of these two forms of consensus leads to a third type, which we will call market consensus
The three legs are deeply intertwined, and they require each other for the whole system to work well. Many cryptocurrency projects including Bitcoin, have suffered from either a “delicate balance of terror” and/or “tyranny of structurelessness” at various times in their history; this is one source of the rapidly-changing perceptions of Bitcoin, and the subsequent price volatility. Can these oscillations between terror and tyranny be attenuated?
Attenuating the oscillation between terror and tyranny
Some projects have chosen to reduce the likelihood of a “delicate balance of terror” by resisting the participation of ASIC miners. A common approach is to modify the Proof-of-Work algorithm to require more RAM to compute the block hash; this effectively makes ASIC miners more expensive (and therefore riskier) to manufacture. However, this is a temporary measure, assuming the network grows and survives; as the underlying cryptocurrency becomes more valuable, manufacturers are incentivized to roll out these products, as evidenced in Zcash, Ethereum, and potentially the Grin/Mimblewimble project.
Some think that mining centralization in Proof-of-Work systems is an ineluctable problem. Over the years there have been various proposals for different consensus protocols that do not involve mining or energy expenditure. The most notable of these approaches is known as Proof-of-Stake.
Proof-of-Stake consensus is a poor alternative
While there are various way to implement Proof-of-Stake, an alternative consensus mechanism to Proof-of-Work, the core idea is that in order to produce a block, a miner has to prove that they own a certain amount of the network coins. In theory, holding the network asset reduces one’s incentive to undermine the network, because the value of one’s own positions will drop.
In practice, the Proof-of-Stake approach proves to be problematic in systems where the coins “at stake” were not created through Proof-of-Work. Prima facie, if coins are created out of thin air at no production cost, the value of one’s stake may not be a deterrent to a profitable attack. This is called the “Nothing-at-Stake” critique.
So far in this section, we have not discussed other ways of producing coins besides Proof-of-Work mining. However, in some alternative cryptocurrency systems, it is possible to create pre-mined coins, at no cost, with no Proof-of-Work, before the main blockchain is launched. Projects such as Ethereum called for the pre-mining of a vast majority of the circulating supply of coins, which were sold to insiders at a fraction of miners’ cost of production. Combining a pre-mine with Proof-of-Work mining for later coins is not necessarily a dishonest practice, but if undisclosed, gives the erroneous impression that all coins in existence have a cost-of-production value. In this light, Ethereum’s stated transition to Proof-of-Stake should be viewed with some skepticism.
Fully dressing-down Proof-of-Stake consensus is beyond the scope of this essay, except to say that it is not a viable replacement for Proof-of-Work consensus mechanisms. Some Proof-of-Stake implementations try to circumvent attack vectors with clever incentive schemes, such as in Ethereum’s yet-to-be-released Slasher mechanism.
The critical fault of Proof-of-Stake systems is the source of pseudorandomness used to select block producers. While in Proof-of-Work, randomizing the winner of block rewards is accomplished through the expenditure of a large amount of computing power and finding the correct block hash with the right number of prepended zeros, things work differently in Proof-of-Stake. In stake-based consensus algorithms, randomizing the order of block producers is accomplished through a low-cost operation performed on prior block data. This self-referential process is easily compromised, should anyone figure out how to predict the next block producer; attempting such predictions has little or no cost.
In short, consensus on history built with Proof-of-Stake is not immutable, and is therefore not useful as the basis for a digital economy. However, corporate or state-run projects may successfully deploy working Proof-of-Stake systems which limit attack vectors by requiring permission or payment to join the network; in this way, Proof-of-Stake systems are feasible, but will be slower-growing (owing to the need to vet participants) and more expensive to operate in practical terms (for the same reason, and owing to the need for security measures that wouldn’t otherwise be needed in a PoW system, which is expensive to attack).
The necessary exclusivity required for PoS to function limits its utility, and limits the growth potential of any network which relies upon PoS as its primary consensus mechanism. PoS networks will be undermined by cheaper, more reliable, more secure, and more accessible systems based on Proof-of-Work.
Proof-of-Stake as an abstraction layer on top of Proof-of-Work
Whether some form of Proof-of-Stake will ever replace Proof-of-Work as the predominant consensus mechanism is currently one of the most-debated topics in cryptocurrency. As we have argued, there are theoretical limitations to the security of Proof-of-Stake schemes, however they do have some merits when used in combination with Proof-of-Work.
In Nakamoto Proof-of-Work consensus, it can be said that “one *****U is one vote.” In Proof-of-Stake, it can be said that "one coin is one vote.” Distributing influence over coin holders arguably creates a wider and more liquid distribution for coinbase rewards than the mere paying of miners, who (as we have discussed) have incentive to cartelize in an attack scenario. Therefore, Proof-of-Stake may be an effective addition to Proof-of-Work systems if used to improve human consensus about network rules. However, it is not robust enough to be used alone.
Taking a step back, Proof-of-Work and Proof-of-Stake can be considered to exist at two different abstraction layers. Proof-of-Work is the layer that is closest to the bare metal, connecting hardware and physical resources to create distributed machine consensus. Proof-of-Stake may be useful for coordinating dynamic human behavior in such a system, once immutability of the underlying ledger and asset is guaranteed by Proof-of-Work.
An interesting architectural design is to use Proof-of-Work to produce blocks, and Proof-of-Stake to give full-node operators a voice in which blocks they collectively accept. These systems split the coinbase reward between miners and full-node validators instead of delivering 100 percent of rewards to miners. Stakeholders are incentivized to run full-nodes and vote on any changes miners want to make to the way they produce blocks.
The thinking goes like this: When compensated, full node operators can be trusted to act honestly, in order to collect the staking reward and increase the value of their coins; similarly, miners are incentivized to honestly produce blocks in order that their blocks are validated (not rejected) by stakers’ full nodes. In this way, networks with Proof-of-Work for base-layer machine consensus, and Proof-of-Stake for coinbase reward distribution and human consensus, can be said to be hybrid networks.
Such hybrid PoW/PoS architectures may prevent the network from descending into a delicate balance of terror (miner control) or into tyranny of structurelessness (developer control). These systems allow decisions about the rules of machine consensus to be taken by more than one group of stakeholders, instead of solely among core developers (as in traditional open allocation) or among large miners in a cartel.
Summary
In this section, we have elucidated how computers on the Bitcoin network achieves decentralized and distributed consensus at a global scale. We’ve examined why Proof-of-Work is a critical enabler of machine consensus, and how Proof-of-Stake, while flawed, may be used in addition to Proof-of-Work to make human consensus (ie., project governance) more transparent and inclusive. In the next section, we will discuss the value of public cryptocurrency systems when stakeholders are held in a stable balance of power.
Additionally, there are a few terms from the above description that are worth clarifying. Let’s take a look.A 2006 paper by Mihir Bellare enables signature aggregation in O(1) size, which means that it will not take more space to have multiple signers. Bellare-Neven reduces to Schnorr for a single key. Bellare-Neven has been implemented.robot bitcoin