Blockchain and price volatility

(Preliminary and incomplete)

Peter Zimmerman∗

18 June 2018

Abstract

I show that the blockchain structure of cryptocurrencies makes their prices volatile. Payments in cryptocur-rencies are not final until they are included in blocks on the public ledger (blockchain). A user can purchasepriority by offering fees to the miner who includes her payment in a block. Heightened speculative pressurecan drive these fees up, and price out transaction activity. This undermines the ability of a cryptocurrencyto serve as a medium of payment. A speculator with a stronger signal about future price will pay a higherfee in order to trade more rapidly on the private information. This means that more extreme signals areincorporated into the price more quickly, causing price volatility. My model is the first to show that pricevolatility is an inherent feature of cryptocurrencies. There are important implications for the evolution ofcryptocurrencies as money: speculation may occur first, and only once the price has stabilised will the coinbegin to be widely adopted as a means of payment.

1 Introduction

Market prices of cryptocurrencies such as bitcoin are characterised by very high levels of volatility, evenby the standards of other assets which have been subject to a speculative mania, such as dot-com stocks inthe late 1990s. In this paper, I show that this is a consequence of the limited capacity of the ledger — orblockchain — to handle speculative trading. This is a unique feature of cryptocurrencies, and is not presentin other asset classes.

Transfer of ownership of an amount of cryptocurrency between two parties is finalised only when it is in-cluded in a block and added to the blockchain. Each block is created by a miner, who chooses whichpayments to include in it. Blocks have limited capacity and the average rate of block creation is fixed, sotransactions may take time to be added to the blockchain. The initiator of the cryptocurrency transaction canincentivise miners to prioritise his payment by offering a fee. This can lead to speculators pricing out userswho would otherwise use the currency to purchase goods. In other words, speculation hinders the ability ofcryptocurrencies to function as a medium of exchange. Recently, vendors1 — including criminals2 and even∗Saıd Business School and Oxford Man Institute, University of Oxford. E-mail: peter.zimmerman@sbs.ox.ac.uk. I am grateful

to Arash Aloosh, Andrew Burnie, Bige Kahraman, Alan Morrison, Joel Shapiro and Mungo Wilson, as well as conference participantsat Anglia Ruskin University and Edinburgh Business School. All errors are my own.

1For example, the gaming service Steam stopped taking bitcoin in December 2017 (http://www.bbc.co.uk/news/technology-42264622), and Microsoft also temporarily ceased accepting bitcoin (http://fortune.com/2018/01/10/microsoft-bitcoin-temporary-halt/).

2See https://www.ccn.com/dark-web-users-favoring-litecoin-due-to-bitcoins-costly-slow-transactions/.

1

cryptocurrency conferences3 — have become increasingly reluctant to accept cryptocurrencies as a means ofpayment. Faucette et al. (2017) show that only 3 of the top 500 e-commerce merchants accept bitcoin, andthat this number has fallen since 2016.

Speculators’ trades are also constrained by blockchain capacity, and can offer fees to miners to prioritise theirtransactions. Speculators receive noisy private signals about the long-term value of the cryptocurrency, beforemaking trades on an exchange. A speculator who believes that near-term price movements are likely to belarge will offer higher fees to miners, in order to have his payments settled before his information becomesstale. When fewer blocks are created, it is payments associated with the highest fees — and thus the mostextreme signals — that are settled and incorporated into the price. This generates price volatility, relative toa benchmark in which there is no congestion on the blockchain. Moreover, it suggests that price volatility isinherent to any asset which settles on a public blockchain.

In my model, an informed speculator trades on an exchange against an uninformed market maker who makesinferences about the long-term value, in a set-up similar to Kyle (1985). The speculator has a long-termincentive to buy and hold cryptocurrency if his signal is high, and to sell if his signal is low. However, unlikein models such as Kyle (1985), the speculator also has short-term incentives to trade quickly, because hissignal can contain private information about non-speculative order flows (known as ‘noise trades’ in the Kylemodel). Non-speculative transactions arise naturally as a result of the use of the cryptocurrency as a mediumof payment.

Cryptocurrency exchanges have two important features: they do not allow short-selling, and the price of atrade is agreed before settlement. Blockchain congestion cannot therefore affect the price at which the coinis initially bought or sold. It can, however, affect the ability of the speculator to close a trade and realise herprofits. Consider, for example, a speculator who receives a signal that the long-term value is low, and that theorder flow is such that the price will be low today and higher tomorrow. The speculator can profitably tradeagainst this by selling cryptocurrency tomorrow. The ban on short-selling means that the speculator may needto buy today in order to do this trade. This can be profitable, but only if the buy order is incorporated onto theblockchain by then. She can offer a fee to the miners to expedite this. When her belief about the order flowsand the low long-term value is strong, then she has greater urgency to trade, and so she is willing to offer theminers a higher fee for timely delivery.

Blockchain congestion itself affects the decision of whether to use cryptocurrency for payments, meaningthat there is a conflict between speculative and non-speculative use of the blockchain. This conflict betweenspeculators and transactors resolves an apparent paradox. The long-term value of a cryptocurrency is likelydetermined by its future use as a medium of payment. Recent speculative fever and price increases suggeststhat some agents believe that one or more cryptocurrencies will be used as money in the future. But nocryptocurrency currently enjoys any significant use as a means of payment. Some commentators have pointedout that the speculative frenzy would therefore appear to be irrational.4 This model suggests that it is preciselybecause speculative agents see long-run future value in the cryptocurrency as a means of payment that theytake speculative positions, pushing up fees, and crowding out transactors. Eventually, the price will stabilise,reducing the gains from speculation and thus leading to lower fees paid. This allows the transactors to movein, and begin to use the currency as a means of payment. This suggests that, although no cryptocurrency iscurrently close to being widely accepted as a payment medium, speculation on future values may neverthelessbe rational.

The model explains various stylised facts about Bitcoin and other cryptocurrencies. It demonstrates thatcryptocurrencies should exhibit higher price volatility at times when blockchain congestion is high. This is

3See https://www.cnbc.com/2018/01/10/bitcoin-conference-stops-accepting-cryptocurrency-payments.html.4See, for example, Carney (2018).

2

borne out by empirical evidence. It can be used to show that heightened speculation increases fees and crowdsout transactions. The model predicts a relationship between speculative demand and pricing of coins, and socan be used to empirically estimate the proportion of demand which arises from speculation. The relationshipbetween price volatility and blockchain congestion allows for empirical estimation of parameters that maynot be observable with other types of speculative asset.

This model can be also used to predict the effects of innovations such as the introduction of cash-settledderivatives markets or the Lightning Network.5 These developments allow for payments to be made in acryptocurrency without needing to settle on-chain, so the congestion problems modelled here need not hold.However, even in these cases settlement may eventually need to take place on-chain — albeit netted —suggesting that blockchain congestion is still likely to have an effect on pricing and usage.

The paper is related to a newly developing literature on mining and fees in a blockchain environment. Themost closely related paper is Huberman, Leshno, and Moalleni (2017), who use queueing theory to assessthe effect of blockchain congestion on fees and waiting times. Like my model, users value having shorterwaiting times to process payments, and are willing to pay for it. In their model, cryptocurrency is used onlyto make payments, and there is no trading. Unlike my model, there is no endogenous price formation.

Easley, O’Hara, and Basu (2017) also examine Bitcoin mining fees and their relationship with transactionwaiting times. Their focus is on the evolutionary path of fees, rather than on the long-run steady state inHuberman, Leshno, and Moalleni (2017). They also do not have endogenous price formation or a speculativerole for cryptocurrency. In a related paper, Budish (2018) examines the trade-off for miners between usingtheir computing power to maintain the blockchain and to attack it.

Athey et al. (2016) model the dynamics of cryptocurrency adoption. In their model, cryptocurrency is su-perior to other forms of payment as a means of making international remittances, but there is a risk that thetechnology is flawed and the currency will collapse. Once again, they do not have a role for speculation intheir model.

There is a strand of the literature which focuses on the game between miners, and the incentives formed bythe consensus mechanism. Biais et al. (2017) study the incentives for miners to resolve disagreements on theblockchain (‘forks’) or perpetuate them. Saleh (2017) examines the proposed ‘proof-of-stake’ protocol andshows that it can achieve higher welfare than proof-of-work. This paper has endogenous price formation byassuming that miners can exchange coins for consumption units.

This paper is also related to a theory literature on the role of cryptocurrencies as a monetary asset. Yermack(2013) argues that Bitcoin satisfies few of the requisites of money. Garratt and Wallace (2018) show that theprice of a cryptocurrency is indeterminant due to multiple equilibria; like my model, it is valuable if it is usedto make payments. The focus in my model is on the on order flows resulting from the use of cryptocurrencyas money.

This model contributes to our understanding of speculative trading of monetary assets, by interpreting ‘noisetrading’ in the Kyle (1985) as non-speculative use of the asset as a means of payment. We show that thisendogenously gives rise to private information about the non-speculative trading and thus an incentive totrade against it. Some variations on the Kyle model do consider a speculator with short-lived information(Admati and Pfleiderer (1988)) or with private information about noise trading (Rochet and Vila (1994)), butthey do not consider how this information arises.

5The Lightning Network is a second layer on top of the existing payments network to facilitate small payments without creatingblockchain congestion. Counterparties can open a bilateral channel to make payments off-chain, and then settle net on-chain once thechannel is closed. The code has recently been released for the Bitcoin network. For more detail, see the white paper by Poon and Dryja(2016).

3

2 An overview of the blockchain concept and the cryptocurrency trad-ing environment

There is a wide variety of cryptocurrencies; at the time of writing, coinmarketcap.com listed over 800different coins. To describe all of them is beyond the scope of this paper, so this section focuses on thestructure of Bitcoin — the first and largest cryptocurrency — and its offshoots, such as Bitcoin Cash andLitecoin. Together, these three currencies account for just over half of the total cryptocurrency market.6

Other currencies — notably Ethereum — have more complex structures, especially regarding mining. Whilethe details may be different, the same principles apply.

2.1 Cryptocurrencies and blockchain

A cryptocurrency is a digital asset which has no physical form. Ownership is recorded on a decentralisedpublic ledger (called a blockchain), which is maintained by a network of computer nodes (miners) aroundthe world. The ‘public’ aspect of this is that anybody with a computer and internet access can download thesoftware and join the network.7 When one person — call her Alice — wants to send currency to another(Bob), she notifies the network.8 Her payment is then put into the mempool, which is a ‘waiting room’ ofpotential payments which have not yet been added to the ledger.

The transfer of ownership of a coin is finalised only once the corresponding payment is removed from themempool and added to the blockchain. For this to happen, a miner must include it in a block. Every sooften, a miner is selected to put transactions from the mempool into a block. A block has finite capacity andcan contain only a limited number of payments. Suppose that Minnie the miner is selected to mine the nextblock. Alice can incentivise Minnie to include her payment by attaching a fee to it, denominated as a numberof units of the cryptocurrency. If Minnie includes Alice’s payment in his block, she will receive this fee. Thefee system acts as a blind auction mechanism to assign priority, with those users who are most willing to payfor urgency settled first.

In addition to Alice’s fee, Minnie may receive a certain number of newly minted units of the currency. Forexample, in Bitcoin, a miner currently receives 12.5 new bitcoin per block. This coinbase reward decreasesroughly exponentially as more blocks are created, until all coins have been issued. In the case of bitcoin,this is expected to happen around the year 2140. Thus, as the system matures, fees by design become anincreasingly important part of the incentive system for miners.9

Cryptocurrencies are usually designed so that block creation occurs at a fairly constant rate over time. Forexample, Bitcoin blocks are created according a Poisson process, with a block occurring on average onceevery 10 minutes. Bitcoin employs a ‘proof-of-work’ algorithm, meaning that miners compete for the rightto create the next block by solving a complex computational problem. This problem is different for each pro-posed block and can only be solved by a ‘guess and verify’ method, requiring a large number of computationsto be carried out.10 Other cryptocurrencies use different algorithms to select a miner to create the next block;

6As measured by market capitalisation (circulating supply times price) on coinmarketcap.com on 12 March 2018. Total market capwas $357bn, of which $166bn was due to Bitcoin, $19bn due to Bitcoin Cash and $11bn due to Litecoin.

7Our analysis may also be relevant for private ledger digital currencies, so long as they employ a fee structure to incentivise miners.8If Alice is a node, she can do this directly. Otherwise, she will notify her wallet provider: this is a node who intermediates her

access to the network.9Nakamoto (2008) explains that this predictable and limited supply schedule is designed to eliminate the risk of currency debasement,

which could occur when a monetary authority controls supply.10The exact difficulty of the problem is regularly adjusted, depending on total computational power amongst the miners, in order to

keep the mean block creation rate constant.

4

for example, Ethereum is moving to a ‘proof-of-stake’ protocol. In this paper, the details of the algorithm arenot important, so long as priority in the blockchain is assigned according to user-submitted fees.11

Key to the model is that the capacity of a block is finite, so that a payer who is time-sensitive may wish topay a non-zero fee. For Bitcoin, one block contains approximately 1.8 megabytes of data, which is roughly4,000 transactions.12 The amount of block space required by a transaction varies depending on the amountof information included, and the version of the protocol used.13 The factors that are important in this model(fee, payment amount, and time of submission to mempool) do not directly affect transaction size, so wesimply assume that all transactions take up the same amount of space. Therefore the number of transactionswhich can be contained in a block is assumed to be fixed, constant and exogenous.

The fact that capacity is exogenous and limited is crucial for our model. We take the capacity of the cryp-tocurrency as exogenous and the outcome of an unmodelled decision made by the designers. In the caseof Bitcoin, the block size limit was introduced by Bitcoin’s creator Satoshi Nakamoto in July 2010 with noexplanation. It is likely that he reasoned that, if blocks were too large, then most miners would not havethe memory capacity to store the blockchain.14 This would reduce the number of people who could operateas miners, making it easier for one party to control over 50% of the mining capacity and manipulate theledger.15 In this view, there is a trade-off between maximum block size and security. There is no technicalreason why the parameters could not be adjusted to allow a greater capacity for Bitcoin; indeed, developershave attempted to do this on several occasions, but have not been able to achieve the required consensusamong the developer community.16

Figure 1 shows how Bitcoin fees and payment confirmation times have evolved since December 2011.17 Tosome extent, this increase is by design: as the coinbase reward falls, miners may have demanded higher feesfrom users to compensate them for their mining costs.18 We find a significant positive correlation betweenchanges in waiting times and changes in fees.19

2.2 Exchanges and the trading environment

Trading in cryptocurrencies typically takes place on exchanges, which allow buyers to find sellers. Thereare a large number of exchanges: at the time of writing, the website CryptoCoinCharts.com lists 190. Thesediffer in several respects, such as liquidity, the jurisdictions in which they operate, the trading pairs offered(e.g. trading pairs of cryptocurrencies against each other, or against fiat currency), and the types of orderpermitted. Typically, an exchange will operate double auctions with bids and asks, and charge a commission

11For more details about the proof-of-work mining process, see Harvey (2016). For an analysis of the proof-of-stake algorithm, seeSaleh (2017). The process by which miners are selected is an important design question, and there are several studies looking at miners’incentives; see, for example, Biais et al. (2017). A cryptocurrency designer must trade off between incentivising miners (i.e. making itless expensive to solve the problem) and making the currency secure (i.e. making it more difficult to change the ledger).

12This was increased from 1 megabyte by the SegWit soft fork, which was activated in August 2017.13Matzutt et al. (2018) study the ability to record arbitrary data in the Bitcoin blockchain.14See www.reddit.com/r/Bitcoin/comments/3giend/citation_needed_satoshis_reason_for_blocksize/ctygzmi.

There have been several attempts to raise this limit — see Morgan (2017).15See, for example, Budish (2018).16To make a change to the protocol requires a fork and consensus of agents which control over 50% of the hash rate. In the past, a

lack of consensus has led to hard forks and the creation of new cryptocurrencies, such as Bitcoin Cash.17Prior to December 2011, some days had confirmation times less than one minute. We have excluded these in order to plot a log-chart.18Nakamoto (2008) sees rising fees as a design feature of Bitcoin. It is not inevitable that fees rise: it is also possible that the price of

the coin would increase to compensate the miners, or that they would simply choose to reduce their mining effort. The actual outcomeis an empirical question and depends on relative elasticities of supply and demand curves.

19We regress changes in log-fees against changes in log-waiting times over the period. The data compare changes rather than levels,because we expect the fee level to trend upwards over time due to the reduction in coinbase reward. See Section 6.

5

Figure 1: Bitcoin median waiting times in minutes (LHS) and total fees in USD (RHS), 3 Dec 2011 – 11Mar 2018. Vertical axes in logarithmic scale. Data from blockchain.info and are plotted daily.

on trades — see, for example, Bohme et al. (2015). Once an order has been submitted and matched, therelevant payments will be submitted to the mempool. The trader can choose to attach a fee to the payment, inorder to facilitate settlement.20

No cryptocurrency exchange allows naked shorts. All require immediate settlement — that is, a seller musthave the asset on account at the exchange.21 This ban on shorting is a need for urgent trade in our model. Aspeculator who believes that the long-term value is low cannot simply short the asset and make money, as inKyle (1985). But if the same speculator also expects demand for the asset to be low today and high tomorrow,he can make money by trading against market sentiment; that is, buy today and sell tomorrow.

This creates timing risk for the speculator. Because his information is short-lived, he needs his long positionto be in place at the right time. To facilitate that, he can offer a higher the fee to miners. Note that he neednot offer a positive fee for the second leg, because no urgency is required then.

In the model, we assume that transactions on an exchange must be settled on-chain; that is, they are not settledunless they are recorded on the blockchain. In practice, exchanges may settle off-chain: the exchange simply

20The exchange may suggest or require a particular fee, but we assume that the trader can nevertheless control this by shopping aroundon different exchanges.

21It is possible to bet on downward movements, but it is expensive and risky. See, for example, https://www.ccn.com/want-short-bitcoin-going-cost/ and http://fortune.com/go/finance/bitcoin-bubble-investments-short/. We sim-plify by assuming that it is impossible.

6

debits the paying member’s account and credits the receiver, without actually moving any cryptocurrency.22

This improves settlement times and eliminates fees, at the cost of creating counterparty credit risk betweenthe receiving member and the exchange.23 This trade-off is not a focus of the model, so we assume thatthe transactions always settle on-chain. This assumption can be justified by the fact that the cryptocurrencyexchange industry is fractured.24 We can assume that the speculator wishes to take advantage of pricingdifferences between exchanges, and so it is necessary to move coins on-chain.

Some exchanges offer futures trading in cryptocurrency. Until recently, all exchanges required physicalsettlement, so delivery was ultimately still required. In December 2017, the Chicago Metal Exchange and theChicago Board Options Exchange both launched cash-settled bitcoin futures. These do not require physicalsettlement of bitcoin, so trading can occur entirely off-chain. As these markets develop, they may allowspeculators to gain from short-lived private information without being affected by the congestion describedin this model.25

This paper focuses on frictions due to the limited capacity of the blockchain, and assumes that the tradingenvironment is efficient. However, there is evidence that cryptocurrency exchanges — which are only re-cently coming under regulatory oversight — are beset with frictions such as low liquidity, insider trading andsecurity problems.26 While these other frictions may affect price volatility, our empirical evidence supportsour conclusion that blockchain congestion is a factor in explaining why volatility is high.

3 Model set-up

There are two assets: traditional fiat currency (which we call ‘cash’) and a blockchain-based cryptocurrency(‘crypto’ for short). There is also a consumption good, which acts as the numeraire. The value of a unit ofcash is normalised to one.27 Cash does not bear interest.

There are two periods in the model, which we denote t1, t2, t3. There is no discounting. Trading and paymentstake place over the two periods t1, t2, while the terminal period t3 represents the long-run horizon. At time t3,the long-run value of crypto is publicly revealed, the agents convert their monetary assets into consumptiongoods, and the game ends.

Crypto is a monetary asset with no cash flows or fundamental value. Rather, its value derives from the beliefthat others will continue to accept it as a form of money. Its terminal price at t3 is denoted by v ∈ 0,1per unit. The realisation of v depends on whether it is used as a means of payment during periods t1 and t2.Specifically, v = 1 if crypto is used as a mean of payment during t1 and t2, and v = 0 if it is not.

There are four types of agent in the model: transactors, an informed speculator, noise traders, and a specialist(or market maker). A pair of transactors are chosen randomly to make a payment from one to another. The

22This is analogous to settling in commercial bank money rather than central bank money. For a general explanation of how trans-actions can be batched and how this saves on blockchain space, see https://coinmetrics.io/batching/. This source explains thatexchanges have been making increasing use of off-chain settlement.

23This counterparty risk is considerable. For example, the exchange Mt. Gox failed in 2014 and members have still not received theircoins. Moore and Christin (2013) document failures among cryptocurrency exchanges.

24See Hileman and Rauchs (2017).25Hale et al. (2018) suggest that the introduction of futures markets may have led to a downturn in the price of bitcoin.26See, for example, Gandal et al. (2018) and Griffin and Shams (2018). For a recent overview of problems in the trading landscape,

see https://hackernoon.com/major-problems-in-the-cryptocurrency-market-c9c9ff53b266.27Alternatively, the price of the consumption good could be denominated in crypto. But it is more realistic to use fiat currency as a

unit of account. See Yermack (2013).

7

payer can choose to make the payment in either crypto or cash. Her choice will depend on her preference forprompt payment, which is random and privately observed. The choice of payment medium determines v.

The transactors, speculator and noise trader all trade on an exchange in which the uninformed specialistsets the price based on net order flow, as in Kyle (1985). The transactors have incentives to trade in orderto rebalance their portfolios after making the payment. The speculator observes a noisy signal about thepayer’s preference for prompt payment, and trades accordingly. All agents can only trade a single unit of thecryptocurrency, similar to Glosten and Milgrom (1985).

3.1 Transactors

There are a large number of identical agents who we call consumers. They are initially endowed with portfo-lios of both types of monetary asset: a quantity KA

C of crypto and KAD of cash. There is also a large number of

identical agents known as merchants, endowed with KBC units of crypto and KB

D of cash.

At t1, one consumer (labelled ‘Alice’) and one merchant (labelled ‘Bob’) is randomly selected. Bob agreesto provide a good or service to Alice, in exchange for a payment. This payment must be made at t1 and is ofa fixed size Y . Alice can choose to make this payment either in crypto or cash.

The long-run value of crypto for speculators and specialists will be determined by whether it is used as moneyduring periods t1 and t2. If Alice pays Bob in crypto, then the long-run value of crypto v is commonly agreedto be 1. If Alice pays Bob in cash, then v = 0.

Bob observes the payment medium chosen by Alice, but the other agents in the model do not. Since Bobknows the value of v, he will accept either Y units of crypto or Y units of cash from Alice as payment. AsAlice and Bob are randomly matched at t1, it is not possible for Bob and Alice to negotiate in advance.

Alice values the ability to make punctual payment. Alice earns a non-monetary payoff R if the payment isdelivered to Bob by time t2, and zero otherwise.28 At t1, Alice chooses which payment medium (crypto orcash) she wishes to use. Cash is guaranteed to be delivered by time t2. But crypto is only delivered if Alice’stransaction is added to the blockchain in time, which is not certain. To mitigate this risk, Alice can offer amining fee fT ≥ 0, denominated in crypto, to the miner who adds her transaction to a block. The probabilityof her payment being included in a block by time t2 is then given by a function µ( fT ). The function µ( fT )maps [0,∞) to [0,1) and is strictly increasing, strictly concave and differentiable in its argument, and satisfiesµ(0) = 0.

The fee fT is paid out of Alice’s holdings of crypto, since there is no mechanism to deliver cash to miners inthe blockchain. However, since both miners and Alice use the consumption good as their unit of account, thefee is paid as fT/p1 units of crypto, where p1 is the price set by the specialist at t1.

The reward R can take one of two values RH ,RL, where RH > RL > 0, with equal probabilities 12 each.

Before choosing her payment method, Alice privately observes the value of R. Clearly, Alice has a greaterincentive to use cash when R = RH , and a relatively greater incentive to use crypto when R = RL.

Consumers and merchants aim to buid long-term portfolios for their convenience yield as money, ratherthan for speculative purposes. An optimal portfolio has some mix of crypto and cash,with the optimal mixdetermined by v. The idea here is that crypto will always be somewhat useful as money even if v = 0; forexample, it was used by enthusiasts even when it had no speculative value.29 Similarly, even if crypto is a

28We assume that at least some of the punctuality benefit R accrues to Alice. This can be the case, for example, if Bob does not deliverhis good or service until he receives the payment.

29See, for example, https://www.coindesk.com/bitcoin-pizza-day-celebrating-pizza-bought-10000-btc/.

8

commonly accepted and superior means of payment, we assume that there will be some goods or services forwhich cash is more useful, such as paying taxes or conducting transactions when internet-based technologyis not available.

Given a portfolio of KC units of crypto and KD units of cash at t3, Alice earns the following utility:

UA(KAC ,K

AD) = R ·1delivery occurs by t2+U(KA

C ,KAD), (1)

where 1· denotes the indicator function, and Bob earns the following utility:

UB(KBC ,K

BD) =U(KB

C ,KBD). (2)

where:

U(KC,KD) =

log(1+KC)+β log(1+KD), if v = 1,β log(1+KC)+ log(1+KD), if v = 0,

(3)

and 0 < β < 1. The parameter β determines how the optimal mix of crypto and cash depends on v. The higherβ is, the less v matters to Alice and Bob in selecting their optimal portfolios. Note that Alice’s punctualitybonus R is non-monetary and has a linear relationship with utility.

In addition to making the payment, Alice and Bob can choose to buy or sell a single unit of crypto by tradingon an exchange. The risk-averse utility functions (1) and (2) provide an incentive for Alice and Bob to tradecrypto after making the transaction. First, there is a rebalancing effect due to their knowledge about v: whenv = 1, Alice and Bob will want to hold more relatively more crypto, and when v = 0 is low they will wantto hold less. Second, there is a rebalancing effect due to the payment: if Alice pays out crypto, then she willwant to be relatively long cash and want to buy more crypto, while Bob will be relatively short cash and wantto sell crypto.

Alice can trade crypto only at t1, while Bob can trade only at t2.30 Since Alice and Bob take no furtheractions after placing these orders, there is no urgency for settlement and so they do not include fees with theirexchange orders. We write (u1,u2) ∈ −1,0,1×−1,0,1 for the total order flow from the transactors inperiods t1, t2 respectively.

We assume that KAC > Y +1, KA

D > Y +1, KBC > 1 and KB

D > 1, so that Alice and Bob always have sufficientcrypto and cash to trade if required.

3.2 Speculator

There is a risk-neutral speculator, who buys and sells cryptocurrency for speculative purposes. We assumethat the speculator is subject to a short-selling constraint on crypto and has zero initial endowment of crypto,so can never take a net negative position.

In each of the two periods, the speculator can choose to trade an amount x1,x2 ∈ −1,0,1 of the cryptocur-rency. The short-selling constraint for a speculator means that he must set x1 ≥ 0 and x1 + x2 ≥ 0.

Trading takes place on an exchange. Prices are agreed, and then the sender submits the payment to themempool, which is the ‘waiting room’ for payments to be added to the blockchain. There is a probability µ

30We justify restricting the time of trades by assuming that Alice and Bob have limited attention, so cannot trade or make paymentsvery frequently. See, for example, Corwin and Coughenour (2008). For Alice, it is most convenient to trade when she makes herpayment, and for Bob it is most convenient to trade once he is sure that Alice has made her payment (either because he has receivedcash, or because he can observe that Alice’s crypto payment has been entered in the mempool).

9

that the payment is added to the blockchain before period t2. Transfer of ownership of the coin is not finaluntil it is added to the blockchain. This, coupled with the short-selling constraint, creates risk that a coinpurchased at t1 cannot be sold at t2. We call this blockchain risk, and it is the focus of our model.

The speculator can mitigate blockchain risk by offering a fee fS ≥ 0 to the miners.31 A speculator will onlypay a fee if he buys a coin at t1 that he may wish to sell at t2.32 The speculator privately observes at t2 whetheror not his order was delivered.

Before deciding whether to trade at t1, speculator receives a private signal b about the Alice’s punctualitybonus R. This signal b ∈ 0,1 follows a simple distribution:

If R = RH , then b =

1, with probability 1−a,0, with probability a,

and if R = RL, then b =

1, with probability a,0, with probability 1−a,

(4)where a> 1

2 . The parameter a measures the precision of the speculator’s signal: it is accurate with probabilitya and misleading with probability 1−a.

The signal has two effects on the speculator’s trading decision. First, the signal indicates long-term value:the speculator can infer how Alice makes her payment and thus, after trading is complete, what the terminalvalue of crypto will be. Second, the signal allows the speculator to infer the timing of order flows given thetransactors’ trading strategies, and he can use this information to trade profitably.

3.3 Noise traders

There are a large numbers of noise traders. These are similar to those in Kyle (1985): they place orders on theexchange randomly without regard to price or any other information they may possess about the long-termvalue of the traded asset. In each period t1, t2, exactly one noise trader places an order, which is of size one.The noise trader buys one unit of crypto with probability 1

2 , and sells one unit with probability 12 . We denote

the noise orders in each period as (n1,n2) ∈ −1,1×−1,1.

The noise traders value urgency and so may pay fees, congesting the mempool for speculators. We can modelthis by varying the function µ( f ).

3.4 Specialist

There is a specialist, or market maker. The specialist is risk-neutral, and has a large inventory of bothcryptocurrency and fiat currency to provide market liquidity. The specialist knows the parameters of themodel and observes total orders (from the speculator and transactors) at t1 and t2. Aside from that, she has noinformation.

Each period, she observes total market orders z1 = x1 +u1 +n1 and z2 = x2 +u2 +n2 and sets prices p1, p2 tobe equal to her posterior belief about the long-term value. This is the ‘market efficiency’ condition imposedby Kyle (1985) and similar papers.33

31For simplicity, we assume here that the fee is paid in cash. In reality, fees are paid in units of crypto. We can assume that thespeculator is able to procure sufficient exactly enough crypto to pay the fee without delay and without affecting the price.

32Technically, it is the seller of the coin who inputs the payment into the mempool, not the buyer, but we assume that the cost is passedthrough to the speculator, and cannot be bargained over.

33The justification for this condition is that there is a competitive market for specialists with zero variable costs, so that in equilibriumthe specialist earns zero payoff. This means that the specialist will set the price equal to the expected long-term value, given her

10

We say that there is market efficiency if:

p1 = E[v|z1], p2 = E[v|z1,z2]. (5)

At t2, all agents can observe the price p1 and order z1 from the previous period before placing their orders.

3.5 Equilibrium

The game can be summarised as follows:

1. At t1:

• Alice and Bob are selected by nature from the sets of consumers and merchants, respectively.

• Alice’s punctuality bonus R is selected by nature according to the prior P[R = RH ] =12 = P[R =

RL].

• Alice observes R and chooses her means of payment and fee fT . If she pays in crypto, then v = 1;and if she pays in cash, v = 0.

• The speculator observes a signal b and chooses x1 ∈ −1,0,1 and a fee fS ≥ 0.

• Alice can also choose whether to place an order on the exchange u1 ∈ −1,0,1 and a fee fT ≥ 0.

• The noise trader chooses n1 ∈ −1,1.

• The specialist observes z1 = x1 +u1 +n1 and sets p1 according to the market efficiency condition(5).

2. At t2:

• The speculator observes z1 and p1. If x1 = 1, the speculator learns whether blockchain riskcrystallised. The speculator then chooses x2 ∈ −1,0,1.

• Bob observes v, z1 and p1. He chooses whether to place an order on the exchange u2 ∈ −1,0,1.

• The noise trader chooses n2 ∈ −1,1.

• The specialist observes z2 = x2+u2+n2 and sets p2 according to the market efficiency condition.

3. At t3, the terminal value v is publicly revealed and payoffs are realised. The game ends.

We can write the speculator’s order function x1(b),x2(z1,b) and fee function fS(b)≥ 0. Alice has a paymentchoice function v(R)∈0,1, and also has a fee function fT (R)≥ 0. Alice has order function u1(R) while Bobhas order function u2(v,z1,R). The specialist chooses pricing functions p1(z1) ∈ [0,1] and p2(z1,z2) ∈ [0,1].

Our equilibrium concept is subgame perfect Nash equilibria in pure strategies. Any equilibrium must satisfythe following criteria:

1. Short selling constraint: The speculator must set x1(b)≥ 0 for all b, and x1(b)+ x2(b)≥ 0 for all b.

information set. One subtlety here is that, if the specialist is sure that the speculator has placed an order of zero, then she could set anyprice and still earn an expected payoff of zero. We address this concern by assuming that she has a slight preference for accurate pricing— for example, the owner of the exchange pays her a small amount to set prices correctly. This is not an issue in Kyle (1985), since inhis model the informed speculator places a zero order with probability zero.

11

2. Subgame perfection: At t2, the speculator chooses his order to maximise his expected income:

x2(b) = argmaxx2∈−1,0,1

π2(x2, fS,b), (6)

where:

π2(x2, fS,b) :=

E[v− p2(z1,1+u2 +n2)|b], if x2 = 1,0, if x2 = 0,E[µ( fS)

(p2(z1,−1+u2 +n2)− v

)|b], if x2 =−1

(7)

subject to the short-selling constraint.

Bob chooses his order u2 ∈ −1,0,1 to maximise his expected utility at t3, given v:

u2(v) = argmaxu2∈−1,0,1

E[U(KB

C + vY +u2, KBD +(1− v)Y − p2u2

)]. (8)

Bob also observes z1 and R, but these do not directly affect his payoff.

3. Optimal trading: In the first period, the speculator chooses his order and fee to maximise his expectedfuture income:

(x1(b), fS(b)) = argmaxx1∈0,1, fS≥0

E[π1(x1,b)+π2(x2,b)

]− fS

, (9)

where:π1(x1,b) := x1E[v− p1(z1)|b]. (10)

Alice sets her choice of payment medium v(R), fee fT (R) and order u1(R) to maximise her expectedterminal utility:

(v(R), fT (R),u1(R)) = argmaxv∈0,1, fT≥0,u1∈−1,0,1

(vµ( fT )+1− v

)R

+ E[U(KA

C −fT

p1− vY +u1, KA

D− (1− v)Y − p1u1)]

.

(11)

4. Market efficiency: The specialist always sets the price so that her expected payoff is zero, given herinformation set; i.e. expression (5) applies.

3.6 Discussion

The transactors’ orders play a similar role to the noise traders in Kyle (1985). They help the speculator todisguise his information from the specialist. However, in Kyle (1985) the noise generally has zero mean andis uncorrelated with both the terminal and with itself over time. This means that the speculator always tradeson his information about the long-term value, and so does not require fast settlement.

In this model, the transactors’ trading activity means that the speculator has information not only about theterminal value of the asset but also about the direction of the other market orders.34 This can help him trade

34Rochet and Vila (1994) do consider a set-up where the speculator has private information about noise trading. However, their focusis on establishing an equivalence between a model with market orders and private information about noise trading, and one with limitorders and no such private information.

12

profitably, even if the asset is expected to have a low terminal value. He can do this by buying when the priceis low (due to a negative order flow from Alice) and then selling when it is high (due to a positive order flowfrom Bob). But he faces the risk that the crypto bought at t1 is not delivered by t2. If that happens, he cannotsell it and is stuck with it at t3. We call this ‘blockchain trade risk’, and it can be mitigated by paying miningfees.

Our focus is on the conditions under which blockchain trade risk is incurred. This may happen if there isa value of b such that the speculator believes that Alice is likely to place a sell order and Bob is likely toplace a buy order. We shall show that, under certain parameter constellations, this happens if R = RH , so thespeculator may seek to incur blockchain trade risk if b = 0.

4 Solution

4.1 The transactors’ problem

In this section we find the transactors’ optimal actions given some simple parameter restrictions.

As R only takes two values, there are essentially two possibilities: either Alice and Bob vary their means ofpayment depending on R, or they always choose the same payment medium. The following lemma tells usthat, in the latter case, the price of crypto always reflects its long-term value and so there can be no gainsfrom trade in the market.

Lemma 1 (Alice’s choice of payment medium).

1. If RH and KAC are sufficiently high, and RL and KA

D are sufficiently low, then Alice chooses to pay incrypto when R = RL and in cash when R = RH .

2. If the conditions in part 1 do not apply, then Alice always uses the same payments medium regardlessof R. No informed trading takes place on the exchange.

Proof. Part 1: If R is large enough, then the risk of delivery failure is too high and so Alice will choose cash.If R is low, this is less of a concern for Alice than ensuring her portfolio is balanced. That means she pays incrypto if her endowment contains a large amount of crypto relative to cash.

Part 2: If Alice always uses the same payments medium, then v is known by everyone ex ante. The specula-tor’s private information is redundant, and there is no incentive to trade.

For a full proof, see Appendix.

Lemma 1 tells us that, if the conditions in part 1 are not met, then Alice always uses the same paymentsmedium and v is known to everyone ex ante. The specialist sets the price equal to v regardless of order flow,and so price volatility is zero. That does not appear to correspond with the world we observe, so we assumefrom now on that the means of payment does indeed depend on R.

Assumption 1 (Choice of payment medium depends on R). RH and KAC are high enough, and RL and KA

D lowenough, such that v(RL) = 1 and v(RH) = 0.

Next we turn to the orders Alice and Bob place at the exchange. If u1 and u2 are the same regardless of R, thenthe speculator will not be able to time the market, and so he can only trade on expectations of long-term value.This makes it easy for the specialist to infer the speculator’s signal, so that any trading immediately causes

13

his information to becomes public. The speculator cannot make profits in such a market. This demonstratesthat the nature of cryptocurrency as a monetary asset is important in this model, and price volatility cannotbe explained without it.

When Alice observes R = RL and pays out crypto, she may wish to buy more crypto for two reasons: first, toreplenish it and rebalance her portfolio, and second, because she knows v = 1 and so crypto will be valuableat t3. Conversely, when she observes R = RH and pays out cash, she may wish to sell crypto.

For Bob, the two motivations to trade work in opposite directions. When v = 1, he knows crypto will bevaluable, but as he receives crypto from Alice he would also like to rebalance his portfolio by selling some.Conversely, when v = 0, he knows crypto has less long-term value but he would like to rebalance away fromthe cash that Alice sends him. When Y is high enough, the rebalancing effect dominates.

Proposition 1 (Transactors place opposite orders in successive periods). Suppose that Assumption 1 holds.Then, if Y is large enough, then Alice buys crypto when R = RL, and sells when R = RH . Bob sells cryptowhen R = RL, and buys when R = RH .

Proof. When Y is large, the incentive for Alice and Bob to rebalance their portfolios is greater than theirlong-term incentive to hold the more valuable currency. This causes Bob to respond to receiving crypto byselling some, even if v = 1. The smaller β is, the greater the motivation to hold more of the currency whichhas greater long-term value, and so the larger Y needs to be. See full proof in the Appendix.

In the remainder of this paper, we assume that Y is sufficiently high that Alice and Bob do rebalance theirportfolios in the manner described in Proposition 1.

Assumption 2. [Rebalancing effect dominates for transactors] Y is sufficiently large that Alice and Bob set:

(u1,u2) =

(1,−1), if R = RL,

(−1,1), if R = RH .(12)

This allows the speculator to infer information about order flows from b, and potentially trade profitablyon this short-term effect. Without this assumption, the speculator will only be able to trade profitably oninformation about the long-term value of crypto. A speculator who observes b = 1 will therefore buy in oneor both periods, but the short-selling constraint means that a speculator who observes b = 0 does not trade atall. This means that the speculator cannot profit by taking on blockchain risk.

4.2 The speculator’s problem

Proposition 1 suggests that, when Y is high enough, the blockchain risk trade may be feasible for the specu-lator. When R = RH , Alice sells and Bob buys. This means that the market is bearish at t1 and bullish at t2.The speculator can trade against this by buying at t1 and selling at a higher price at t2. There are two risks inthis trade. First, the speculator has only a noisy signal b about R, so when a is low this strategy may not beprofitable. Second, the speculator faces delivery risk, and a trade-off between paying a higher fee fS againsta lower probability of delivery.

We solve the speculator’s problem backwards, by first considering his order at t2.

14

Lemma 2 (Speculator trades on long-term value at t2). If b = 1, a buy order is a weakly dominant strategyfor the speculator at t2. If b = 0, a sell order is a weakly dominant strategy when the speculator holds crypto,and otherwise a zero order is weakly dominant.

These strategies are strictly dominant if the specialist cannot discern v with certainty from the market orders.

Proof. The speculator observes z1 and so has access to all of the information available to the specialist. Inaddition, he privately observes b. This means that a speculator who observes b = 1 will be more optimisticabout the value of crypto v than the specialist, and so will consider the asset to be under-priced. This meansthat he will certainly not wish to sell at t2. He will be indifferent between buying and placing a zero order att2 only if, given x2 = 1, his belief about the price satisfies E[p2] = E[v|z1,b = 1]. This is only possible if thespecialist learns v with certainty from z1, so that the speculator’s additional information b = 1 is redundant.

Similarly, a speculator who observes b = 0 will consider it to be over-priced. The situation is symmetric tothe b = 1 case, except that the speculator cannot sell if he did not buy at t1.

Lemma 2 tells us that the speculator would consider choosing x2 = 0 only if v could be discerned withcertainty from the order flow. Consider such an order flow (z1,z2), such that P[v = 1|z1,z2] = 0 or 1. Sincea < 1, the speculator does not observe R precisely, and so the marginal impact of his actions cannot make thespecialist certain about v. In other words, if the specialist is sure about the value of v given z2 = u2 +n2 +x2,then she would also be sure about it given u2+n2 plus any other feasible order. In such cases, the speculator’saction does not affect the price. As our main interest is in the price, we can simply restrict attention toequilibria with x2(z2,1) = 1 and x2(z2,0) =−1, for all z2.

Assumption 3. Regardless of z1,z2, the speculator places a buy order at t2 if b = 1. If b = 0, he places a sellorder if he can, otherwise he does not trade.

This is not a strong assumption: we are simply assuming that, in the event that v becomes common knowledge,the speculator trades on b even though he obtains zero payoff for sure.

All that remains is for us to specify the speculator’s actions at t1. As the speculator cannot place a sell orderat t1, Assumption 3 tells us that there are only two possible patterns of order flows to consider:

• When b = 1, the speculator plays x2 = 1 for sure, and either x1 = 1 or x1 = 0.

• When b = 0, the speculator either plays x1 = x2 = 0 or x1 = 1,x2 =−1.

This means that we have only four possible equilibria in pure strategies to consider. The next lemma allowsus to rule out one of these.

Lemma 3. If x1(0) = 1, then x1(1) = 1 too.

Proof. Suppose that x1(0) = 1 and x1(1) = 0 in some equilibrium. Then the specialist’s pricing functionat t1 is somewhere downward sloping, since larger orders are associated with b = 0. It is profitable for aspeculator who observes b = 1 to deviate and set x1 = 1, thus being able to buy at a low price. For a full proofsee Appendix.

This motivates the following Proposition.

Proposition 2 (Speculator’s optimal strategy). There are three possible optimal strategies:

1. x1(1) = x2(1) = 1 and x1(0) = 1,x2(0) =−1,

15

2. x1(1) = x2(1) = 1 and x1(0) = x2(0) = 0,

3. x1(1) = 0,x2(1) = 1 and x1(0) = x2(0) = 0.

There is an equilibrium with strategy 1 if and only if:

maxf≥0

14

(1−a+

a+(1−a)µ( f )a+µ( f )

+a2

1+aµ( f )

)µ( f )+

12(1−a)(1−µ( f ))− 1

4− f≥ 0. (13)

There is an equilibrium with strategy 2 if and only if:

maxf≥0

14

(a+a2

)µ( f )− 1

2(2a−1)− f

≤ 0. (14)

There is always an equilibrium with strategy 3.

The only potential equilibrium in which the speculator earns a positive expected payoff is with strategy 1. Inequilibria with strategies 2 or 3, the speculator always has zero expected payoff.

As a increases, the condition (13) for an equilibrium with strategy 1 becomes tighter and, for a given fS,the speculator makes less profit. Conversely, the condition (14) for an equilibrium with strategy 2 becomesslacker.

Proof. If the speculator plays strategy 1, then he takes on blockchain risk when b = 0. The only rationalalternative for a speculator who observes b = 0 is not to trade at all, so there is an equilibrium as long as theexpected payoff is non-negative. As the speculator’s signal accuracy a increases, then buying on a low signalb = 0 becomes more risky, and so the expected payoff falls.

If the speculator plays strategy 2, then there is no blockchain risk. The speculator trades on long-term value,so a low signal means no trade at all. There is no incentive to deviate to the blockchain risk trade if µ( f ) islow. As the signal accuracy a increases, the payoff from deviating to trading on short-term changes in marketorders decreases.

If the speculator plays strategy 3, then the speculator’s private information b is perfectly revealed to thespecialist at t1 and no profit can be earned.

See the Appendix for a full proof.

4.2.1 Speculator’s payoff and optimal fee

We focus on the equilibrium with strategy 1. Under strategies 2 and 3, Proposition 2 tells us that the speculatorearns zero payoff and does not take on blockchain risk.

Lemma 4 (Effect of signal accuracy on speculator’s payoff). Consider an equilibrium with strategy 1. Aspeculator who observes b = 1 pays no fee and has expected payoff:

a− 14− a

4

(a+(1−a)µ∗

a+µ∗+

11+aµ∗

), (15)

where µ is equal to µ( f ∗), and f ∗ is the specialist’s belief about the fee paid by a speculator with b = 0. Thispayoff is increasing in both a and µ∗.

16

A speculator who observes b = 0 has expected payoff:

− f ∗+12·(− 1

2+

12

(1−a+

a+(1−a)µ∗

a+µ∗+

a2

1+aµ∗

)µ∗+(1−a)(1−µ∗)

), (16)

which is decreasing in a and increasing in µ∗.

The speculator’s ex ante expected payoff, unconditional on his signal, is increasing in a and in µ∗, so long as(13) holds.

Proof. For a full proof, see Appendix. With probability 12 , the specialist can figure out v given z1, and the

speculator earns zero from trading. Otherwise, a specialist with b = 1 expects to earn 2a−E[p1]−E[p2] ashe buys one unit of crypto in each period. A specialist with b = 0 expects to earn − f ∗−E[p1]+E[p2]µ∗+(1−a)(1−µ∗), as he buys in the first period, and then tries to sell in the second. With probability 1−µ∗, hecannot sell and is exposed to the long-term value of crypto.

When the speculator trades at t2, the order flow z2 = u2 + n2± 1 is odd. When delivery fails and the b = 0speculator does not sell, then the order flow z2 = u2 + n2 is even. Therefore, when the specialist observesan even z2, she knows that b = 0 and the speculator’s information becomes public, meaning he earns zeropayoff at t2. The lower µ∗ is, the greater the likelihood that the specialist can infer the speculator’s privateinformation at t2. Therefore the speculator’s expected payoff is increasing in µ∗.

As signal accuracy a increases, the payoff from trading on long-term value rises, and so the b = 1 speculatoris better off. When b = 0, increasing accuracy will make the speculator more sure that the transactors’ orderflows will make his trade work. However, that effect is dominated by the fact that the expected selling priceE[p2|b = 0] is decreasing with a, since a high order flow z2 is more likely, which means a lower price p2.

In Kyle (1985), the informed speculator earns a positive expected payoff, while the specialist always earnszero expected payoff, by the market efficiency condition. The speculator profits by picking off the noisetraders, who trade without regard to information about any long-term value contained in the price. Instead,they are assumed to trade for other reasons, such as hedging or liquidity requirements.

In this model, the informed speculator earns his profits from the transactors, especially Bob, who trade basedon considerations other than the listed price. This is because, while the noise traders simply place randomorders, Bob places orders which are actually negatively correlated with v and with the price. This means thateven the random noise traders in our model can pick off Bob, and potentially earn positive expected payoffs.

In the limit as the speculator’s signal becomes uninformative (i.e. as a→ 12 ), the speculator always earns

positive expected trading payoff from strategy 1; i.e. for all f ∗, (15) is positive, and (16) is greater than− f ∗. It may seem surprising that, when the speculator essentially becomes a noise trader, this strategy canbe profitable. Bob’s contrary trading allows this profitability. Essentially, Bob is willing to pay for the abilityto rebalance his portfolio in a manner according with his risk-averse preferences.

Let us now focus on the optimal fee paid by the speculator. Clearly the speculator pays a fee only if he playsstrategy 1 and if b = 0; otherwise, he never sells in period t2 and thus never needs to trade urgently at t1.

Proposition 3 (Optimal fee). A speculator with b = 0 pays a fee f ∗ which satisfies the following first-ordercondition:

14

(a+(1−a)µ( f ∗)a+µ( f ∗)

+a2

1+aµ( f ∗)− (1−a)

)µ′( f ∗) = 1. (17)

17

This has at most one solution in f ∗ ≥ 0. An equilibrium with strategy 1 exists if and only if:

µ′(0) ≥ 4a(1+a)

. (18)

The optimal fee f ∗ is increasing in signal accuracy a.

Proof. Full proof in the Appendix. The speculator sets f to maximise his expected payoff given the special-ist’s pricing rule. Concavity of µ( f ) ensures that the unconstrained first-order condition (17) has at most onesolution. Condition (18) is a necessary condition for the solution to lie in [0,∞).

As a increases, a speculator who observes b = 0 is more confident that the transactors’ orders will make theblockchain risk trade profitable. At the same time, he believes that crypto is worth less, so the risk of deliveryfailure is greater. Therefore he offers a higher fee to the miner, to mitigate against this risk.

As a increases, the necessary condition (18) for the existence of an equilibrium with strategy 1 is relaxed.This is because, as the accuracy of the speculator’s signal goes up, the potential payoff from the blockchainrisk trade is higher. This implies a more general result: when the signal accuracy a rises, the speculator paysa higher fee.

4.2.2 Price volatility

As a increases, a speculator who receives a low signal b = 0 reduces his belief about the expected value ofcrypto. This reduces his expected payoff, so long as there is a risk that he may end up holding the asset at t3.Later, we shall examine the effect of changes in a on the fee, which allows the speculator to hedge againstthe risk that he may end up with long-term exposure to the asset.

For the remainder of the paper, we focus on the equilibrium where strategy 1 is played. This is for two reasons.First, the speculator makes no money playing strategies 2 or 3. Second, equilibria with those strategies do notinvolve blockchain risk, so the capacity of the blockchain plays no role in price formation and cannot explainprice volatility.

Proposition 4 considers the effect of changes in parameters on the moments of the ex ante distribution of p2;that is, the prior that the uninformed specialist has about the price.

Proposition 4 (Price volatility is decreasing in blockchain capacity). Consider an exogenous decrease inblockchain capacity — that is, we reduce the speculator’s equilibrium probability of delivery µ∗ = µ( fS).Then, in an equilibrium where the speculator plays strategy 1:

1. the ex ante expected price p2 is equal to 12 and is independent of blockchain congestion,

2. the ex ante variance of price p2 is Σ, where:

Σ :=14(1−a)+

a2

8

(1− aµ∗

a+µ∗+

11+aµ∗

), (19)

which is decreasing in blockchain capacity µ∗.

If a is sufficiently low and µ∗ is sufficiently high, then Σ is decreasing in a.

18

Proof. Market efficiency suggests that the specialist’s belief about the expected price should be equal to themean value of v, which is not affected by µ∗.

As µ∗ falls, the probability of a successful blockchain risk trade falls. At the same time, p2 rises along thisequilibrium path because the specialist places higher probability on the event v = 1. These two effects meana higher variance in the price.

An increase in a has two effects. First, the speculator pays a higher fee (by Proposition 3), raising µ∗ andthus decreasing Σ. Second, an increase in a makes the speculator more informed, so the specialist place moreweight on the order flow in setting the price. This makes the price variance increase. Third, when deliveryfails the specialist always sets price E[v|b = 0] = 1−a, so higher a makes this price lower and increases theoverall variance. When µ∗ is high, this third effect is diminished.

Full proof in the Appendix.

Proposition 4 tells us that, if the probability of delivery falls — because, for example, the gross volume ofnoise trading increases — then the volatility of price rises. That demonstrates that the activities of others canhave an effect on an individual speculator’s payoff, and raise price volatility.

5 Crowding out

This analysis aims to resolve the apparent paradox between transaction and speculative activity in cryptocur-rencies. In times of heavy speculation — such as during mid-2017 — the price of cryptocurrencies suchas bitcoin soared even as its use as a payments medium declined. Carney (2018) discusses the deficienciesof cryptocurrencies as money, and Faucette et al. (2017) show that its usage costs have increased even astransactions usage has fallen.

Under the assumption that the long-term value of crypto depends on its use as a payments medium, thissuggests that speculation can reduce the value of the asset. But then the speculative trading would not berational in the first place. In this section, we resolve this apparent paradox.35

We examine the role of the fee paid by Alice and its interaction with the speculator’s fee. The speculator paysa higher fee f ∗ if he can profit from short-term price movements. But this deprioritises other payments withfees lower than f ∗. Alice knows that, if she pays in crypto and sets v = 1, then there is a non-zero probability1− a that the speculator pays a fee and increases blockchain congestion. This may make paying in cryptounattractive for Alice, even when R = RL. But then, if v = 0 for all R, then there can be no gains fromspeculation (Lemma 1). By allowing Alice to adopt mixed strategies when choosing v, we show that there isa unique equilibrium where Alice sometimes chooses crypto and sometimes cash when the punctuality bonusis low, making speculation rational.

We can model this congestion concretely as follows. Suppose that Alice offers a fee fT and the speculatoroffers a fee fS. We generalise the delivery probability function µ( fT ) to a function with two argumentsµ( fT ; fS). As before, µ( f ; f ′) is positive and strictly increasing, concave and differentiable in fT . It is strictlydecreasing and convex in fS. This captures the idea that, as the speculator offers a higher fee fS, miners tendto prioritise the payment with the higher reward and so Alice can expect to wait longer for her payment to be

35Another explanation is that there is a bubble: speculators buy in the expectation that another speculator will buy from them later.That does not work in this model, as there is only one speculator and a definite time when the terminal value is realised. Brunnermeierand Oehmke (2012) discuss the literature on speculative bubbles.

19

added to the blockchain. We assume µ(0; fS) = 0 for all fS > 0. As users of the blockchain are anonymous,the speculator’s probability of delivery is µ( fS; fT ).

Lemma 5. An equilibrium may not exist in pure strategies.

Proof. Suppose that Alice sets v = 1 when R = RL and v = 0 when R = RH , as in Section 4.1. Suppose alsothat the optimal fee for the speculator when he observes b= 0 is fS = f ∗. Then, if f ∗ is high enough, µ( fT ; f ∗)may be so low that Alice’s payoff is negative when v = 1 for all fT . In that case, she profitably deviates tov(RL) = 0. But then p1 = p2 = 0 for sure. As the speculator cannot profit from trading, he deviates to fS = 0.There is no equilibrium strategy. For a full proof see Appendix.

Alice will only pay Bob using crypto if she thinks that the speculator will not pay a high fee and congest theblockchain. But it is the possibility that v has value that makes the price uncertain and gives the speculatorthe opportunity to profitably trade. When b = 0, this could be optimally done by setting a high fee. Since thespeculator cannot commit to a low fee, Alice may prefer not to pay in crypto at all.

There are welfare implications here. When RL is sufficiently low, it is socially optimal for Alice to set v = 1.But she will not do so if she believes that the speculator may set a high fee.

In the remainder of this section, we show that if Alice can adopt mixed strategies in her selection of v(RL)then a unique equilibrium may emerge.

5.1 Dealing with crowding out

We now allow Alice to employ mixed strategies over her choice of v. That is, she can choose v = 1 withprobability q(R), and v = 0 with probability 1− q(R), for a given observation of R ∈ RH ,RL. All otheractions remain in pure strategies. We assume that, if f ∗ = 0, then she would choose to set v(RL) = 1 andv(RH) = 0, as in Lemma 1. That immediately implies that q(RH) = 0, so we only need to focus on q(RL).Let us write q as shorthand for this term.

For a given q, the specialist’s prior expectation about v is q2 . A speculator who observes b applies the following

probability distribution to v:

P[v = 1|b] =

qa, if b = 1,q(1−a), if b = 0.

(20)

Alice and Bob’s optimal choice of u1 and u2 is determined by v, not directly by R, so we can replace As-sumption 2 with the following:

Assumption 4 (Rebalancing effect dominates for transactors). Y is sufficiently large that Alice and Bob set:

(u1,u2) =

(1,−1), if v = 1,(−1,1), if v = 0.

(21)

We focus on equilibria where the speculator plays strategy 1, since that is the only case in which fS > 0. Ifthe speculator plays strategies 2 or 3, then fS = 0 for sure and Alice can set q = 1.

Proposition 5 (Unique equilibrium to resolve congestion paradox). Consider an equilibrium where Aliceplays v(RL) = 1 with probability q, and where the speculator plays strategy 1 with fee fS(0) = f ∗. Then:

20

1. f ∗ is increasing in q,

2. q is decreasing in f ∗,

3. there is a unique solution (q, f ∗) if . . .

Proof. For a full proof see the Appendix. As q increases, the specialist’s posterior belief about v will behigher for any given order flow. The speculator therefore expects p2 to be higher and so, if he observes b = 0,he infers a higher expected payoff from buying at t1 and then selling at t2. To ensure he can sell at t2, he offersa higher fee. This reduces Alice’s payoff (59) from playing v = 1, but not her payoff (60) from playing v = 0,so she reduces q. This suggests that there exists at most one pair (q, f ∗) which constitutes an equilibrium.

(To be completed.)

6 Empirical implications

6.1 Predictions

The model posits a connection between blockchain capacity, speculation, and the use of a cryptocurrency as amedium of payment. As capacity decreases, there is greater competition between speculators and transactorsfor space on the blockchain. This causes fees to increase, reducing the utility of the cryptocurrency as amedium of payment, and increases price volatility.

This suggests the following empirical predictions:

• greater blockchain capacity reduces fees and price volatility, and increase the use of the cryptocurrencyas a medium of payment;

• greater demand for blockchain space (either due to speculative pressure or demand for the currency asa means of payment) reduces blockchain capacity, raises fees, and increases price volatility;

There are essentially three ways in which we can exploit variation in blockchain capacity:

1. Random inter-arrival time of blocks: Typically, the rate of block creation follows a Poisson processwith fixed mean — for example, one block every 10 minutes in the case of Bitcoin. This generatesexogenous variation in blockchain capacity over time.

2. Changes to blockchain capacity: Occasionally there may be adjustments to the cryptocurrency mar-ket which affect the capacity of the blockchain. One example is the SegWit soft fork of Bitcoin inAugust 2017, which increased the block size. Another example is the introduction of cash-settledfutures markets in December 2017, which allowed access to naked shorting technology.

3. Cross section of cryptocurrencies: Different cryptocurrencies vary in blockchain capacity. For ex-ample, Litecoin — a forked clone of Bitcoin — has an average block inter-arrival time of 2.5 minutes,rather than 10 minutes.

None of these three sources of variation can be considered to be completely exogenous. The first factor —exogenous variations in the time between blocks — assumes a constant rate of block creation. In fact, therate of block creation is proportional to the total amount of computing power (called ‘hash rate’) dedicatedto mining, so day-to-day changes in the hash rate can affect the block creation process. At regular intervals,the protocol adjusts the mining difficulty, so that the rate of block creation returns to its target. In the case

21

of Bitcoin, this occurs every 2016 blocks, which is roughly every two weeks. Other cryptocurrencies tend toreadjust more frequently. The decision of a miner to change her hash rate may not be exogenous; for example,a rise in price may encourage her to mine more. Therefore it may be difficult to argue that this is truly anexogenous factor in the case of cryptocurrencies such as Bitcoin which are slow to adjust.36

The second factor — changes to blockchain capacity as a result of adjustments to the protocol — suggeststhe possibility of an event study. But these adjustments are announced well in advance and thus anticipated.In some cases they do not occur; for example, the proposed SegWit2x fork for Bitcoin was cancelled inNovember 2017 a week before its scheduled occurrences, due to a lack of consensus in the community.However, it seems that in case any effect would be due to changes in expectations rather than actual changesto blockchain capacity.

The third factor — exploiting cross-sectional differences between cryptocurrencies — will work only if otherfactors can be held constant. In particular, the markets for some cryptocurrencies are deeper than for others,and this is obviously a crucial factor in determining price volatility. A confounding issue for our analysisis that Bitcoin trading is typically the most liquidity cryptocurrency market, and yet Bitcoin has the greatestblockchain congestion among major cryptocurrencies.37 It may be possible to account for exchange liquidityin any empirical analysis, but the relatively short lifespans of rivals to Bitcoin may mean that insufficient datais available to obtain statistically significant results.

6.2 Analysis for Bitcoin

The website blockchain.info provides data on Bitcoin exchange prices (in USD), block sizes (in megabytes),fees (in USD), median confirmation time and exchange volumes. We extract data for the period 18 July 2010to 12 March 2018. The data are daily. We define price volatility on a given day T as the variance of thelogarithm of the prices posted on the seven days T,T + 1, . . . ,T + 6. ‘Block size’ is the average amount ofspace used on each block, and is a measure of how congested the blockchain is.

We show that periods with high block sizes — that is, where blocks typically are full — tend to be associatedwith high price volatility. We run a contemporaneous regression:

price volT = α+βblock sizeT + εT , (22)

and a lagged version:price volT = α+βblock sizeT−1 + εT . (23)

The lagged version helps us to determine causality. It is possible, for example, that there is an exogenouscause for high price volatility, and this volatility attracts speculators who then increase blockchain congestion.

For each of these two, we consider the full data set, and also consider an alternative model where we selectonly days where the blockchain size is above its 75th percentile. The idea here is that we might expect anincrease in block size to have a minor effect at low levels, because the capacity limit does not bind. However,if blocks are nearly at their limit, then any additional payments must pay a high fee and this will have a largereffect on price volatility.

When the top quartile of observations are taken (third and fourth models), the relationship is significantand positive, as we would expect. When the blockchain is nearly full, then an increase in utilisation has asubstantial effect on price volatility.

36In a related paper, I show that Bitcoin miners do increase their hash rates in response to higher prices, so that the supply curve ofthe currency is actually increasing in the short-term between difficulty adjustments, rather than constant as is commonly supposed.

37See, for example, Wei (2018).

22

Table 1: Regression of 7-day forward-looking price volatility on block size. Standard errors are givenin parentheses. ‘75%’ means that that the data is censored to include only days when the blockchainsize is in the top quartile. One star denotes significance at 10% level, two stars at 5% level, and threestars at 1% level.

Contemporaneous Lagged Contemporaneous, 75% Lagged, 75%

Intercept 0.0070 *** 0.0070 *** -0.0117 *** -0.0112 ***(0.0003) (0.0003) (0.0012) (0.0012)

Block size -0.0059 *** -0.0059 *** 0.0158 *** 0.0152 ***(0.0006) (0.0006) (0.0013) (0.0013)

Adjusted R2 0.0342 0.0345 0.1790 0.1658N 2795 2794 699 698

Oddly, the relationship is significant and negative in the full sample, so that an increase in block utilisationleads to a decrease in price volatility. The effect is economically small: a one standard deviation increase inblock size causes a fall in volatility of one-fifth of one standard deviation. A possible reason for this is that,on days when there is a lot of trading, there is greater utilisation of the blockchain but also greater marketliquidity.

(To be completed.)

7 ReferencesAdmati, A. R. and P. Pfleiderer (1988). “A theory of intraday patterns: volume and price variability”. Review

of Financial Studies 1.1, pp. 3–40.Athey, S., I. Parashkevov, V. Sarukkai, and J. Xia (2016). “Bitcoin pricing, adoption and usage: theory and

evidence”. Mimeo.Biais, B., C. Bisire, M. Bouvard, and C. Casamatta (2017). “The blockchain folk theorem”. Toulouse School

of Economics working paper 817.Bohme, R., N. Christin, B. Edelman, and T. Moore (2015). “Bitcoin: economics, technology, and gover-

nance”. Journal of Economic Perspectives 29.2, pp. 213–38.Brunnermeier, M. K. and M. Oehmke (2012). “Bubbles, financial crises, and systemic risk”. NBER working

paper 18398.Budish, E. (2018). “The economic limits of bitcoin and the blockchain”. Mimeo.Carney, M. (2018). “The future of money”. Speech. URL: https://www.bankofengland.co.uk/speech/2018/mark-carney-speech-to-the-inaugural-scottish-economics-conference.

Corwin, S. A. and J. F. Coughenour (2008). “Limited attention and the allocation of effort in securitiestrading”. Journal of Finance 63.6, pp. 3031–3067.

Easley, D., M. O’Hara, and S. Basu (2017). “From mining to markets: the evolution of bitcoin transactionfees”. Mimeo.

Faucette, J., B. Graseck, J. Moore, S. Shah, and C. Chan (2017). “Bitcoin decrypted: a brief teach-in andimplications”. Morgan Stanley Research.

Gandal, N., J. T. Hamrick, T. Moore, and T. Oberman (2018). “Price manipulation in the Bitcoin ecosystem”.Journal of Monetary Economics, forthcoming.

Garratt, R. J. and N. Wallace (2018). “Bitcoin 1, bitcoin 2, ... : an experiment in privately issued outsidemonies”. Economic Inquiry, forthcoming.

23

Glosten, L. R. and P. R. Milgrom (1985). “Bid, ask and transaction prices in a specialist market with hetero-geneously informed traders”. Journal of Financial Economics 14.1, pp. 71–100.

Griffin, J. M. and A. Shams (2018). “Is Bitcoin really un-Tethered?” Mimeo.Hale, G., A. Krishnamurthy, M. Kudlyak, and P. Shultz (2018). “How futures trading changed bitcoin prices”.

Federal Reserve Bank of San Francisco Economic Letter 12.Harvey, C. R. (2016). “Cryptofinance”. Mimeo.Hileman, G. and M. Rauchs (2017). “Global cryptocurrency benchmarking study”. Cambridge Centre for

Alternative Finance.Huberman, G., J. Leshno, and C. Moalleni (2017). “Monopoly without a monopolist: an economic analysis

of the bitcoin payment system”. CEPR discussion paper 12322.Kyle, A. S. (1985). “Continuous auctions and insider trading”. Econometrica 3.6, pp. 1315–1335.Matzutt, R., J. Hiller, M. Henze, J. H. Ziegeldorf, D. Mullmann, O. Hohlfeld, and K. Wehrle (2018). “A

quantitative analysis of the impact of arbitrary blockchain content on Bitcoin”. Mimeo.Moore, T. and N. Christin (2013). “Beware the middleman: empirical analysis of bitcoin exchange risk”.

Financial Cryptography and Data Security. Ed. by S. A.-R. Springer-Verlag Berlin Heidelberg.Morgan, D. (2017). “The great Bitcoin scaling debate — a timeline”. URL: https://hackernoon.com/the-great-bitcoin-scaling-debate-a-timeline-6108081dbada.

Nakamoto, S. (2008). “Bitcoin: a peer-to-peer electronic cash system”. Mimeo.Poon, J. and T. Dryja (2016). “The Bitcoin Lightning Network: scalable off-chain instant payments”. Mimeo.

URL: https://lightning.network/lightning-network-paper.pdf.Rochet, J.-C. and J.-L. Vila (1994). “Insider trading without normality”. Review of Economic Studies 61.1,

pp. 131–152.Saleh, F. (2017). “Blockchain without waste: proof-of-stake”. Job market paper.Wei, W. C. (2018). “Liquidity and market efficiency in cryptocurrencies”. Economics Letters 168, pp. 21–24.Yermack, D. (2013). “Is bitcoin a real currency? An economic appraisal”. NBER working paper 19747.

8 Appendix

8.1 Proof of Lemma 1

Part 1: The only source of uncertainty for Alice is the value of p1. This is a function of z1 = u1 + x1 +n1,so is not directly affected by her choice of v.

For a given choice of u1 and fT , Alice prefers to set v = 1 if:

E[

log( KA

C −fTp1−Y +u1

KAD−Y − p1u1

)]−βE

[log( KA

C +u1

KAD− p1u1

)]> (1−µ( fT ))R (24)

The left-hand side of (24) is increasing in KAC and decreasing in KA

D. If Alice is endowed with a relativelylarge amount of crypto, she prefers to pay it out in order to rebalance her portfolio. If she is endowed withrelatively little, then she prefers to pay out cash instead. Thus she chooses v = 1 if KA

C is high and KAD is low.

A decrease in R or an increase in µ( fT ) reduce the risk that a crypto payment won’t be delivered by t2, and somake paying in crypto relatively more attractive. Clearly, if RH is high enough then Alice will choose v = 0when R = RH . Similarly, if RL is low enough, then Alice will choose v = 0. Because RL must be positive, the

24

following condition must hold for the lemma to be true:

E[

log( KA

C −fTp1−Y +u1

KAD−Y − p1u1

)]> βE

[log( KA

C +u1

KAD− p1u1

)], (25)

which is true if KAC is sufficiently high and KA

D is sufficiently low.

Note that the effect of β is ambiguous: in general an increase in β will make v = 1 more attractive to Alice ifKA

C is low and KAD is high, and otherwise it will make v = 0 more attractive. The effect of Y is also ambiguous:

higher Y makes paying in crypto more attractive when KAC − KA

D is high and Alice wants to rebalance bypaying out crypto.

Note also that, for a fixed fT , crypto is less attractive when µ( fT ) is lower. This suggests that an exogenousdecrease in blockchain capacity makes Alice less like to make payments in crypto.

Part 2: Alice’s payment choice function v : RH ,RL → 0,1 maps from a two-member set to anothertwo-member set, and so there are only four cases to consider. The right-hand side of (24) is increasing in R,so if Alice chooses v(RL) = 0 then she must also choose v(RH) = 0.

Suppose that the conditions in part 1 do not hold. Then we do not have v(RH) = 0 and v(RL) = 1. This leavesonly two cases: either v(RH) = v(RL) = 1 or v(RH) = v(RL) = 0. Either way, Alice always chooses the samepayment medium regardless of the realisation of R, so v is known by everyone before the game starts and thespeculator’s private information is redundant. The specialist therefore sets p1 = p2 = v without regard to theorder flow, and the speculator earns a payoff of zero for sure.

8.2 Proof of Proposition 1

Suppose that v = 1. Then Alice’s expected payoff is:

πA(1) := µ( fT )R+E[

log(KAC −

fT

p1−Y +u1)

]+βE

[log(KA

D− p1u1)]. (26)

She chooses u1 to maximise this, given a pricing function p1(z1) and beliefs about x1 and n1. Let Ω1 be theset of z1 which occur with non-zero probability given v = 1.

Suppose that the specialist observes some z1 ∈ Ω1. Her posterior that P[v = 1|z1] > 0, so market efficiencysuggests that she will set a price p1 > 0. Since this is true for every z1 ∈ Ω1, Alice knows that p1 > 0 withprobability 1, and so (26) is finite.

The expression (26) is decreasing in Y and has positive mixed partial derivative ∂2πA(1)/∂u1∂Y > 0. As Ybecomes larger, the marginal benefit of increasing u1 grows without limit. Therefore, for any pricing functionp1(z1), there is some Y such that if Y > Y then Alice should set u1 = 1.

Now consider Alice’s expected payoff when v = 0:

πA(0) := R+βE[

log(KAC +u1)

]+E[

log(KAD−Y − p1u1)

]. (27)

Once again her payoff is decreasing in Y and has a negative mixed derivative. By a similar argument tobefore, when Y is sufficiently large she will set u1 =−1.

A similar intuition applies to Bob. His expected payoff is, when v = 1:

πB(1) := E[

log(KBC +Y +u2)

]+βE

[log(KB

D− p2u2)], (28)

25

which is increasing in Y and has negative mixed partial derivative ∂2πB(1)/∂u2∂Y < 0. When Y is sufficientlylarge, he sets u2 =−1. When v = 0 his expected payoff is:

πB(0) := βE[

log(KBC +u2)

]+E[

log(KBD +Y − p2u2)

], (29)

which is increasing in Y and has a positive mixed partial derivative. When Y is sufficiently large, Bob setsu2 = 1.

8.3 Proof of Lemma 3

Suppose that the lemma is false. Then, by Lemma 2, we have an equilibrium with (x1(0),x2(0)) = (1,−1)and (x1(1),x2(1)) = (0,1).

The specialist applies the following pricing function at t1:

p1(z1) =

0, if z1 =−2 or −1,a, if z1 = 0,1−a, if z1 = 1,1, if z1 = 2 or 3.

(30)

When z1 = 0, we must have x1 = 0 so b = 1. When z1 = 1, we must have x1 = 1 so b = 0. The speculator’sorder at t1 always reveals his private information to the specialist, so the speculator will earn zero expectedpayoff at t2. Note also that this makes p1 downward-sloping from z1 = 0 to 1, as the more pessimisticspeculator places a higher order. We shall show that this gives the more optimistic an incentive to deviate.

As the speculator earns zero expected payoff at t2, it is enough to find a deviation which improves his payoffat t1. Suppose that a speculator who observes b = 1 considers a deviation to x1(1) = 1,x2(1) = 0. We shallshow that such a deviation is profitable.

Under this deviation, there are two cases where v is not revealed at t1. These occur when v = 1 and n1 =−1or when v = 0 and n1 = 1. In all other cases, the speculator’s payoff is exactly zero. In these two cases, z1 = 1and the speculator faces a price 1−a. Given b = 1, his expected payoff E[v− p1|b = 1] is:

aP[v = 1,n1 =−1|b = 1]− (1−a)P[v = 0,n1 = 1|b = 0] =a4(2a−1), (31)

which is strictly positive. This is a profitable deviation, so we cannot have an equilibrium.

8.4 Proof of Proposition 2

8.4.1 Strategy 1

To show that the strategy 1 can be consistent with an equilibrium, we need only show that it earns a non-negative payoff for the speculator when b = 0. By Lemma 3, a speculator with b = 1 would not wish todeviate from x1 = 1 = x2. By Assumption 3, a speculator with b = 0 would only consider deviating to astrategy x1 = x2 = 0, which earns exactly zero. Let us write µ as shorthand for µ( fS).

First, let us consider the distribution of the order flow z1 under strategy 1, and the price p1(z1) set by thespecialist under market efficiency. Since x1 = 1 for sure, and u1 + n1 ∈ −2,0,2, the specialist will onlyobserve z1 ∈ −1,1,3 on the equilibrium path.

26

The events z1 =−1 and z1 = 3 reveal v with certainty, and so p1 = p2 = v on these paths and the speculator’sprivate information is redundant. It is only when z1 = 1 (which occurs with probability 1

2 , regardless of b)that there is not complete revelation of v at t1. The specialist therefore sets:

p1(z1) =

0, if z1 =−1,12 , if z1 = 1,1, if z1 = 3.

(32)

Clearly p2(z1,z2) = p1(z1) for z1 ∈ −1,3, so we need only consider p2 when z1 = 1. On this path, thespecialist knows that x2 = 1 if b = 1. When b = 0, then x2 = −1 with probability µ, and x2 = 0 otherwise.Market efficiency then implies the following pricing rule:

p2(z1,z2) =

0, if z1 =−1,1, if z1 = 1 and z2 =−3 or −2,a+(1−a)µ

a+µ , if z1 = 1 and z2 =−1,

1−a, if z1 = 1 and z2 = 0,a

1+aµ , if z1 = 1 and z2 = 1,

0, if z1 = 1 and z2 = 2 or 3,1, if z1 = 3.

(33)

The pricing rule p2(z1,z2) is sometimes downward sloping in z2, since higher u2 is associated with lower v.

Table 2 below summarises the possible outcomes and the probabilities of each, given b and strategy 1:

Table 2: Outcomes under strategy 1

v z1 z2 p1 p2 Probability given b = 1 Probability given b = 01 3 any 1 1 1

2 a 12 (1−a)

1 1 -3 12 1 0 1

4 (1−a)µ1 1 -2 1

2 1 0 14 (1−a)(1−µ)

1 1 -1 12

a+(1−a)µa+µ

14 a 1

4 (1−a)µ1 1 0 1

2 1−a 0 14 (1−a)(1−µ)

1 1 1 12

a1+aµ

14 a 0

0 1 -1 12

a+(1−a)µa+µ 0 1

4 aµ0 1 0 1

2 1−a 0 14 a(1−µ)

0 1 1 12

a1+aµ

14 (1−a) 1

4 aµ0 1 2 1

2 0 0 14 a(1−µ)

0 1 3 12 0 1

4 (1−a) 00 -1 any 0 0 1

2 (1−a) 12 a

The speculator’s expected payoff is exactly zero when z1 6= 1, so the speculator’s expected payoff given b = 0is:

µP[z1 = 1|b = 0]E[p2|z1 = 1,b = 0,x2 =−1,delivery]+ (1−µ)E[v|z1 = 1,b = 0]P[z1 = 1|b = 0]−E[p1|z1 = 1,b = 0]P[z1 = 1|b = 0]− fS.

(34)

27

Using Table 2, expression (34) works out to:

14

(1−a+

a+(1−a)µa+µ

+a2

1+aµ

)µ+

12(1−a)(1−µ)− 1

4− fS. (35)

Strategy 1 is an equilibrium if (35) is non-negative, and so deviating to not trading does not make the specu-lator better off. This gives us the required condition (13). The first derivative of expression (35) with respectto a is:

− 14

(1−µ∗+

µ∗3

(a+µ∗)2 +1

(1+aµ∗)2

)< 0. (36)

Note that the expected payoff for a speculator with b = 0 is concave and unimodal in fS, and equal to 12 (1−

a)− 14 < 0 when fS = 0, so there is no guarantee that there exists any equilibrium with strategy 1.

8.4.2 Strategy 2

Consider an equilibrium where the speculator plays strategy 2. If b = 1, then x1 = 1 and z1 is odd. If b = 0,then x1 = 0 and z1 is even. Therefore the specialist is able to infer b from z1, and the speculator’s privateinformation is immediately revealed. The speculator always earns zero profit.

A speculator with b = 1 has no incentive to deviate. If he sets x1 = 0,x2 = 1, he still earns zero profit at t1,and he will still reveal his information at t2.

However, there may be an incentive for a speculator with b = 0 to deviate. The only alternative strategy thisspeculator would consider is the blockchain risk trade x1(0) = 1,x2(0) =−1, along with a choice of fee.

If the speculator follows this alternative strategy, then z1 ∈ −1,1,3. Since the specialist then believes thatb = 1, she sets the following price:

p1(z1) =

0, if z1 =−1,a, if z1 = 1,1, if z1 = 3.

(37)

If the t1 delivery is not fulfilled by t2, then the speculator cannot sell. Then z2 is even. A sequence of orderswith z1 odd and z2 even is not on the equilibrium path, so market efficiency will not help us determine theprice. In any case, as there is no trade, the exact value of the price is irrelevant to the speculator’s payoff,so long as it is high enough that he is not tempted to change to a buy order. It would suffice to set p2 = 1whenever z1 = 1 and z2 is even.

If the t1 delivery is fulfilled, then the speculator can sell and z2 is odd. This allows him to continue to disguisehis signal. There is still one possible outcome that does not lie on the equilibrium path: z1 = 1 and z2 =−3,which occurs when x1 = 1,x2 = −1 and v = 1,n1 = −1,n2 = −1. For simplicity, we assume that if thespecialist observes z2 =−3 she then she sets p2 = 1, as she infers that u2 =−1 and so v = 1 for sure.38

38This can be rationalised if she assigns a tiny but positive probability to the event that the speculator deviates to u1 = 1,u2 =−1.

28

That assumption, along with market efficiency, means that the specialist sets the following prices at t2:

p2(z1,z2) =

0, if z1 =−1,1, if z1 = 1 and z2 =−3 or z2 =−1,a, if z1 = 1 and z2 = 1,0, if z1 = 1 and z2 = 3,1, if z1 = 3.

(38)

Under this proposed deviation, a speculator who successfully executes this trade earns nothing if z1 6= 1 or if(z1,z2) = (1,1). He earns 1−a if z1 = 1 and z2 = −3 or z2 = −1. If z1 = 1 and he is unable to sell then heearns 1−2a (as he pays a for an asset with expected value 1−a). His expected payoff from this deviation istherefore:

14(2−a)(1−a)µ− 1

2(2a−1)(1−µ)− f , (39)

which is the expression in the braces in (14). So long as there is no f for which it is strictly positive, there isno incentive for the speculator to deviate to this alternative strategy.

Note that this alternative payoff is decreasing in a, so that as the speculator’s signal becomes more accurate,he trades more on the terminal value (buying if it is high, not trading if it is low) rather than trying to profiton changes in the price.

8.4.3 Strategy 3

By a similar argument to that for strategy 2, the speculator reveals his private information as soon as hetrades. At t1, neither type of speculator trades and z1 is even. At t2, only a speculator with b = 1 trades so thespecialist knows that b = 1 if and only if z2 is odd.

It is straightforward to show that there are no profitable deviations, so long as the specialist sets p1 sufficientlyhigh when she observes the off-equilibrium outcome that z1 is odd. Suppose, for example, that she sets p1 = 1whenever z1 is odd. Then it cannot be profitable for either type of speculator to set x1 = 1. The speculator’sexpected terminal value is lower than the price, so there is no long-term value in buying at this price. Hecannot possibly sell at a higher value than 1 at t2, so there is no short-term value in buying either.

8.5 Proof of Lemma 4

The expected payoffs (15) and (16) can be calculated using the payoffs and probabilities in Table 2.

The first derivative of (15) with respect to a is:

14

(3− 1

(1+aµ∗)2 +aµ∗(a+2µ∗)(a+µ∗)2

)>

14

(2+

aµ∗(a+2µ∗)(a+µ∗)2

)> 0. (40)

The first derivative of (16) with respect to a is:

− 14

(1−µ∗+

µ∗3

(a+µ∗)2 +1

(1+aµ∗)2

)< 0. (41)

29

Taking the average these two expressions gives us the first derivative of the expected payoff unconditional onthe signal b:

14

(1− 1

(1+aµ∗)2

)+

18

(µ∗+

aµ∗(a+2µ∗)−µ∗3

(a+µ∗)2

)>

18

(2a2µ∗+4aµ∗2

(a+µ∗)2

)> 0. (42)

The first derivative of (15) with respect to µ∗ is:

a2

4

( a(a+µ∗)2 +

1(1+aµ∗)2

)> 0. (43)

The first derivative of (16) with respect to µ∗ is:

a2

4(1+aµ∗)2 +a3

4(a+µ∗)2 > 0. (44)

Clearly, the average of these first derivatives with respect to µ∗ must also be positive. This completes theproof.

8.6 Proof of Proposition 3

The specialist sets the price according to her belief about the speculator’s choice of fS. In equilibrium, thespeculator’s optimal choice of fS given this pricing rule should be consistent with the specialist’s belief.

Let µ∗ be the specialist’s belief about the probability that the speculator’s t1 order is delivered. Suppose thatthe speculator sets a fee f when b = 0. Then, using the prices in Table 2, his expected payoff is:

π( f ;µ∗) :=14

µ( f )(

1−a+a+(1−a)µ∗

a+µ∗+

a2

1+aµ∗

)+

12(1−µ( f ))(1−a)− 1

4− f . (45)

The unconstrained first-order condition is:

∂

∂ fπ( f ;µ∗) =

14

µ′( f )(a+(1−a)µ∗

a+µ∗+

a2

1+aµ∗− (1−a)

)−1 = 0, (46)

and any solution must satisfy this first-order condition when µ∗ = µ( f ).

We wish to find a sufficient condition to rule out multiple solutions for f . Any solution f ∗ must satisfy thefollowing condition:

14

µ′( f ∗)(a+(1−a)µ( f ∗)

a+µ( f ∗)+

a2

1+aµ( f ∗)− (1−a)

)−1 = 0. (47)

We shall show the left-hand side of (47) is strictly decreasing in f ∗, so that it can have at most one root. Wetake the derivative with respect to f ∗:

14

µ′′( f ∗)(a+(1−a)µ( f ∗)

a+µ( f ∗)+

a2

1+aµ( f ∗)− (1−a)

)− 1

4µ′( f ∗)2a2

( 1(a+µ( f ∗)2 +

a(1+aµ( f ∗))2

). (48)

As a+(1−a)µa+µ > 1−a, this derivative is negative everywhere, so there can be at most one solution for f ∗.

30

As f ∗→∞, µ′( f ∗)→ 0 and µ( f ∗) tends to a limit no greater than one, so the left-hand side of (47) tends to -1.Since it is continuous in f ∗, the intermediate value theorem tells us that a necessary and sufficient conditionfor (47) to have a solution in f ∗ ≥ 0 is that the left-hand side is non-negative when f ∗ = 0. That means:

14

µ′(0)(

1+a2− (1−a))−1≥ 0, (49)

which is the required result (18).

Take the total derivative of the speculator’s first-order condition (47) with respect to a:

0 = µ′( f ∗)(

1− µ( f ∗)2 +(1−a)µ( f ∗)(a+µ( f ∗))2 +

2a+a2µ( f ∗)(1+aµ( f ∗))2

)+(

µ′′( f ∗)(a+(1−a)µ( f ∗)

a+µ( f ∗)+

a2

1+aµ( f ∗)− (1−a)

)−µ′( f ∗)2

( a2

(a+µ( f ∗))2 +a3

(1+aµ( f ∗))2

))∂ f ∗

∂a.

(50)

The first term on the right-hand side of (50) is positive, since µ(·) is everywhere strictly increasing, and theexpression inside the parentheses is positive when a ∈ (0.5,1) and µ ∈ (0,1).

As µ(·) is strictly concave, the second-term on the right-hand side of (50) is a strictly negative term multipliedby ∂ f ∗/∂a. For the equality to hold, we must have ∂ f ∗/∂a > 0, which is the required result.

8.7 Proof of Proposition 4

Using Table 2 and the fact that P[b = 1] = P[b = 0] = 12 , it is straightforward to show that E[p2] =

12 , inde-

pendent of µ∗. This is not very surprising: market efficiency and the law of total expectations implies that thespecialist should have the same priors about v and about the prices p1 and p2.

The ex ante variance of p2 is equal to E[p22]−

14 , which is:

Σ =18(1−a)+

(a+(1−a)µ∗)2

8(a+µ∗)+

18(1−a)2(1−µ∗)+

a2

8(1+aµ∗). (51)

This is equal to:18

(1+(1−a)2− a3µ∗

a+µ∗+

a2

1+aµ∗

), (52)

which is decreasing in µ∗. Therefore greater blockchain congestion (lower µ∗) increases the volatility of theprice.

Now consider the total derivative of Σ with respect to a. By the chain rule:

dΣ

da=

∂Σ

∂µ∗µ′( f ∗)

∂ f ∗

∂a+

∂Σ

∂a. (53)

We have already shown that Σ is decreasing in µ∗. By Proposition 3, we know that f ∗ is increasing in a, andby assumption µ( f ∗) is increasing in f ∗. Therefore the first term in (53) is negative. A sufficient conditionfor dΣ/da < 0 is to show that ∂Σ/∂a < 0.

Taking partial derivatives, we can show that:

∂Σ

∂a= −1

4(1−a)+

a8

( 1(1+aµ∗)2 +

11+aµ∗

− aµ∗(2a+3µ∗)(a+µ∗)2

), (54)

31

and so:

limµ∗→0

∂Σ

∂a=

14(2a−1)> 0, and lim

µ∗→1

∂Σ

∂a= − (1+a−a2)

4(1+a)2 < 0. (55)

Taking second-order partial derivatives:

∂2Σ

∂a2 =14

(1−aµ∗+

1(1+aµ∗)3 +

a4µ∗

(a+µ∗)3

)> 0, (56)

and∂2Σ

∂a∂µ∗= −a2

8

( 3+aµ∗

(1+aµ∗)3 +2a(a+2µ∗)(a+µ∗)3

)< 0. (57)

Σ is convex in a, with a unique minimum in a ∈ ( 12 ,1). The gradient of Σ with respect to a is decreasing in

µ∗. Thus ∂Σ/∂a is negative for sufficiently low a and high µ∗. This completes the proof.

8.8 Proof of Lemma 5

Suppose in equilibrium that Alice believes that the speculator sets fS(0) = f ∗, and fS(1) = 0 (we know thatthe speculator buys when b = 1 so will not pay a fee). If Alice observes R = RL, she earns the followingexpected payoff when she sets v = 1 and offers a fee fT :(

(1−a)µ( fT ; f ∗)+aµ( fT ;0))

RL +E[

log(KAC −

fT

p1−Y +u1)

]+βE

[log(KA

D− p1u1)]. (58)

The value of R does not play directly a role in Alice’s choice of u1, except to the extent that it influences v.Therefore, if Assumption 1 holds, then by Proposition 1, Alice sets u1 = 1. The price p1 =

12 if n1 =−1 and

p1 = 1 if n1 = 1. This means Alice’s expected payoff when she sets v = 1 is:((1−a)µ( fT ; f ∗)+aµ( fT ;0)

)RL

+12

log(

KAC − fT −Y +1

)+

12

log(

KAC −2 fT −Y +1

)+

β

2log(

KAD−1

)+

β

2log(

KAD−

12

).

(59)

Rational expectations on the part of Alice mean that f ∗ is given by Proposition 3.

When v = 0, Alice sets u1 =−1 and her expected payoff is:

RL +β log(

KAC −1

)+

12

log(

KAD−Y +1

)+

12

log(

KAD−Y +

12

). (60)

If f ∗ is high enough, then (59) may be lower than (60) for all fT . This means that Alice prefers to choosev = 0 when R = RL. As RH > RL, she will also prefer v = 0 when R = RH . But then v = 0 for sure, so thespecialist always sets p1 = p2 = 0, and the speculator cannot profit from trading. But then he will profitablydeviate to fS = 0, which violates Proposition 3, so this cannot be an equilibrium.

8.9 Proof of Proposition 5

The speculator plays strategy 1, so x1(b) = 1 for b ∈ 0,1. This means that z1 = x1 +u1 +n1 ∈ −1,1,3.Assumption 4 holds so, as before, the speculator sets p1(−1) = 0 and p1(3) = 1. When z1 = 1, all the

32

speculator can infer is that n1 =−u1, so she sets p1(1)=q2 , her uninformed prior. This occurs with probability

12 .

Suppose that the speculator chooses fS(0) = f ∗ and Alice chooses fT (RL) = fT when she pays in crypto. Letµ∗ = µ( f ∗; fT ). Table 3 below gives the prices for each outcome of v, z1 and z2. When q = 1, this is identicalto Table 2.

Table 3: Outcomes under strategy 1 when Alice plays q

v z1 z2 p1 p2 Probability given b = 1 Probability given b = 01 3 any 1 1 1

2 qa 12 q(1−a)

1 1 -3 q2 1 0 1

4 q(1−a)µ∗

1 1 -2 q2 1 0 1

4 q(1−a)(1−µ∗)1 1 -1 q

2qa+q(1−a)µ∗

qa+µ∗14 qa 1

4 q(1−a)µ∗

1 1 0 q2 q(1−a) 0 1

4 q(1−a)(1−µ∗)1 1 1 q

2qa

1+(1−q+qa)µ∗14 qa 0

0 1 -1 q2

qa+q(1−a)µ∗

qa+µ∗ 0 14 (1−q+qa)µ∗

0 1 0 q2 q(1−a) 0 1

4 (1−q+qa)(1−µ∗)0 1 1 q

2qa

1+(1−q+qa)µ∗14 (1−qa) 1

4 (1−q+qa)µ∗

0 1 2 q2 0 0 1

4 (1−q+qa)(1−µ∗)0 1 3 q

2 0 14 (1−qa) 0

0 -1 any 0 0 12 (1−qa) 1

2 (1−q+qa)

Under strategy 1, a speculator’s expected payoff upon observing b = 1 is:

qa− 14− qa

4

(qa+q(1−a)µ∗

qa+µ∗+

11+(1−q+qa)µ∗

), (61)

and conditional upon observing b = 0:

− f ∗+12·(− 1

2+

12

(q(1−a)+

qa+q(1−a)µ∗

qa+µ∗+

qa(1−q+qa)1+(1−q+qa)µ∗

)µ∗+q(1−a)(1−µ∗)

). (62)

Given the specialist’s belief about f ∗, she sets the pricing rule specified in Table 3, and so a speculator whoobserves b = 0 sets fS to maximise:

− fS +12·(− 1

2+

12

(q(1−a)+

qa+q(1−a)µ∗

qa+µ∗+

qa(1−q+qa)1+(1−q+qa)µ∗

)µ( fS)+q(1−a)(1−µ( fS))

). (63)

The speculator therefore sets fS to solve the corresponding first-order condition. In equilibrium we haveµ∗ = µ( f ∗), so:

1 =14·(qa+q(1−a)µ( f ∗)

qa+µ( f ∗)+

qa(1−q+qa)1+(1−q+qa)µ( f ∗)

−q(1−a))

µ′( f ∗). (64)

33

We are interested in the behaviour of f ∗ as q changes. Take the total derivative of (64) with respect to q:

0 =(qa+q(1−a)µ( f ∗)

qa+µ( f ∗)+

qa(1−q+qa)1+(1−q+qa)µ( f ∗)

−q(1−a))

µ′( f ∗)

+(qa+q(1−a)µ( f ∗)

qa+µ( f ∗)+

qa(1−q+qa)1+(1−q+qa)µ( f ∗)

−q(1−a))

µ′′( f ∗)∂ f ∗

∂q

+(qa+q(1−a)µ( f ∗)

qa+µ( f ∗)+

qa(1−q+qa)1+(1−q+qa)µ( f ∗)

−q(1−a))

µ′( f ∗)∂ f ∗

∂q.

(65)

34