1

Contract Theory
Cong Nguyen

Abstract

Index Terms

Blockchain, proof-of-stake, mobile roaming, fraud prevention, and game theory.

I. P ROBLEM F ORMULATION

A. Stake Pools and Stakeholders

Consider N stakeholders with stake budgets B = (B1 , . . . , BN ) and individual operational

cost C = (C1 , . . . , CN ) and a stake pool with costs c, fees α, and the pool owner’s stake σ in
the network. The pool’s cost is charged for joining the pool and maintaining its operations and
the pool’s fee is the profit margin of the pool’s owner, which usually ranges from 1% to 9%
in real-world stake pools, e.g., [17]–[19]. The stakeholders can freely use their budget to either
invest pi in the pool or to mint (individually participate in the consensus process) with mi , such
that pi + mi ≤ Ci .
1) Pool profit: Let Np denote the set of stakeholders who invest in the pool, the chance that
the pool is elected leader and can collect the block reward R is the proportion of the pool’s
stake in the total network stake, i.e.,
P
σ+ n∈Np pn
P PN . (1)
σ+ n∈Np pn + j=1 mj
When the pool receives the reward, it calculates each stakeholder’s share based on the proportion
of player i’s stake in the total stake of the pool, which is
p
Pi . (2)
σ+ n∈Np pn
 2

The pool then charges a fee of αi percentage from each stakeholder’s reward and a cost of
ci e−pi before the reward is finally delivered to each stakeholder. Thus, when a stakeholder i
invest an amount of pi in the pool, the pool’s profit from the stakeholder, i.e., the amount the
pool charges stakeholder i, is given by
pi α
Uip = P PN R + ce−pi . (3)
σ+ n∈Np pn + j=1 mj

The profit of the pool can then be calculated based on the pool owner’s stake and the amounts
it charges the stakeholders, i.e.,
σ X pi α

−pi
Up = P PN R+ P PN R + ce . (4)
σ+ n∈Np pn + j=1 mj i∈Np
σ+ n∈Np pn + j=1 mj

2) Stakeholder profit: When stakeholder i invests in the pool, the expected reward rip is given
by
P
σ+ pn
  
n∈Np p
rip = PN Pi (1 − α)R − ce−pi ,
σ+ pn
P
σ+ n∈Np pn + j=1 mj n∈Np
(5)
pi −pi
= P PN (1 − αi )R − ci e .
σ+ n∈Np pn + j=1 mj
Nevertheless, if the pool’s cost and fee are too high, the stakeholder will not invest in the pool.
In this case, the stakeholder mints, and the expected reward is
mi
rim = ( P PN )R − Ci . (6)
σ+ n∈Np pn + j=1 mj

B. Contract Theory

To incentivize the stakeholders to invest in the pool, the pool owner should offer the fee
and cost such that the stakeholder can have higher profit compared to minting. Nevertheless,
while the pool knows the stakeholder budgets (each account’s balance can be deduced from the
transactions stored on the blockchain), the operational costs are hidden from the pool owner.
Therefore, the contract designing of the pool can be formulated as a screening problem [?],
where the pool design contracts based on its belief about the type k of each stakeholder.

Definition I.1. Individual Rationality: A stakeholder only invest in the pool if its profit is higher
than when it mints, i.e., rip > rim .
 3

1) Stakeholder strategy: In this game, the stakeholders can use any amount within their budget
to either invest in the pool or to individually participate in the consensus process. However, we
prove in the following theorem that a rational stakeholder will always use all the budget.

T HEOREM 1. Let s0i denote a strategy where stakeholder i invests less than its total budget, and
si is a strategy where stakeholder i invests all its budget. For every s0i , si ∈ Si , s0i is dominated
by si .

Proof: The case where stakeholder i only invests a part of its budget can be further divided
into three sub-cases: invest only in the pool, only mints, and simultaneously invests in the pool
and mints. Consider the first sub-case where the stakeholder only invest an amount pi < Bi in
the pool. In this sub-case, the expected reward is expressed in (5). Now, if the stakeholder invest
all the budget to the pool, the payoff is
Bi
Ui = P PN (1 − α)R − ce−Bi . (7)
σ+ n∈Np pn + j=1 mj

Then, the difference in payoff between the two strategies is

Bi − pi
Ui − Ui0 = P PN (1 − α)R + c(e−pi − ce−Bi ). (8)
σ+ n∈Np pn + j=1 mj
Since pi < Bi , the difference Ui − Ui0 is always positive, which means investing all the budget
Bi to the pool always gives a better payoff than that of investing less than the budget. Similarly,
consider the second sub-case where the stakeholder only uses an amount mi < Bi to mint,
the stakeholder can always mint with all the budget. The difference in payoff between the two
strategies is
Bi − mi
Ui − Ui0 = P PN R, (9)
σ+ n∈Np pn + j=1 mj
which is always positive. Finally, consider the third sub-case where the stakeholder simultane-
ously invests in the pool and mints, the expected payoff in this sub-case is
mi + pi (1 − α)
Ui0 = P PN R − Ci − ce−pi . (10)
σ + n∈Np pn + j=1 mj
In this sub-case, the stakeholder can increase mi by the remaining budget amount, which results
in Ui − Ui0 = (9). To sum up, in all sub-cases the stakeholder can always get a better payoff by
 4

using all the remaining budget. Thus, the strategies where the stakeholder invest less than the
budget are strictly dominated, and the proof is now completed.
Since the strategies investing less than the budget are dominated, they can be removed from
S. Then, the strategies of stakeholder i consist of three cases. If the stakeholder chooses to invest
in the pool, the payoff is expressed in (7). If the stakeholder mints, the payoff is
Bi
Ui = P PN R − Ci . (11)
σ+ n∈Np pn + j=1 mj
If the stakeholder i chooses to invest si in the pool and mint with the remaining budget, the
payoff in this case is
Bi − pi + pi (1 − α)
Ui = R − Ci − ce−pi . (12)
σ + n∈Np pn + N
P P
j=1 mj

However, the difference in payoff between the second case and the third case can be calculated
by
 
Bi Bi − pi + pi (1 − α) −pi
( PN )R − Ci − R − Ci − ce ,
σ + n∈Np pn + N
P P P
σ+ n∈Np pn + j=1 mj j=1 mj
(13)
pi α −pi
= P PN R + ce ,
σ+ n∈Np pn + j=1 mj

which is always positive. Therefore, the strategy where the stakeholder both invests in the pool
and mints is dominated and can be removed from S. Then, to maximize the profit, the stakeholder
can choose to invest all the budget in the pool or to use all the budget for minting. The difference
in payoff between the two strategies is
Bi Bi (1 − α)
(11) − (7) = P PN R − Ci − P PN R + ce−Bi ,
σ+ n∈Np pn + j=1 mj σ+ p
n∈Np n + j=1 mj
(14)
Bi αR −Bi
= P PN + ce − Ci ,
σ+ n∈Np pn + j=1 mj

As can be seen from (14), if

Bi αR
Ci < P PN + ce−Bi , (15)
σ+ n∈Np pn + j=1 mj
the difference is positive, which means minting yields more profit than investing in the pool,
and vice versa. Therefore, the stakeholder’s best response is to compare its own cost Ci and
the pool’s cost and fee, and invest accordingly. The best response strategy s∗i of stakeholder i
 5

can then be expressed as s∗i (mi , pi ), where (mi , pi ) can be (Bi , 0) or (0, Bi ). For the sake of
simplicity, we denote the best response of stakeholder i by the amount of stake it invest in the
pool p∗i from now on, since from Theorem 1 we have pi = Bi −mi . As a result, the best response
p∗i of stakeholder i can be expressed as a function of the pool’s cost and fee, i.e.,

αRBi
0


 if Ci < P PN + ce−Bi
σ + n∈Np pn + j=1 mj
p∗i (α, c) = (16)
αRBi
Bi if Ci ≥ + ce−Bi .


 P PN
σ + n∈Np pn + j=1 mj
2) Leader strategy: Based on the best responses of the stakeholders, backward induction can
be used to find the Stackelberg strategy of the leader, which can be formulated as an optimization
problem as follow:

s∗p = argmax(Up (sp , p∗i )

sp =(c,α)
(17)
X p∗i α

σ −Bi
= P PN R+ P PN R + ce .
σ+ n∈Np p∗n + j=1 mj i∈Np
σ+ n∈Np p∗n + j=1 mj
As proven in Theorem 1, the stakeholders will always use all their budget either to invest in the
pool or to participate in the consensus process individually. Therefore, the total network stake
becomes a constant, i.e.,
X N
X N
X
s∗p
n + mj = Bi . (18)
n∈Np j=1 i=1

As a result, the profit from the pool owner’s stake is also a constant and can be removed to
simplify the problem. Moreover, since p∗i (α, c) can only take two values, it can be represented
by a set of binary decision variables xi to transform the optimization problem (17) into a Mixed-
Integer Programming (MIP) model as follows:
N  
X Bi Rα −Bi
max x i PN + ce
α,c,xi
i=1 j=1 Bj
Bi Rα (19)
s.t. PN + ce−Bi < L(1 − xi ) + Ci ∀i ∈ N
B
j=1 j

xi ∈ {0, 1} ∀i ∈ N ,
where L is a sufficiently large number. The goal of (19) is to decide the values of (α, c, xi ) to
maximize the pool’s profit. The objective function represents the profit of the pool, where the
 6

leader can only charges the stakeholders who invests in the pool. The first set of constraints
ensures that only when the pool’s cost and fee are sufficiently low compared to the stakeholder
i’s cost, xi can take the value of 1 and the profit can be added to the total profit of the pool.
The second set of constraints ensures that every xi is a binary number. However, the objective
function is nonlinear, which makes it much more complex to solve [21]. Thus, we transform
(19) into a Mixed-Integer Linear Programming (MILP) model as follows:
N
X
max yi
α,c,xi ,yi
i=1
Bi Rα
s.t. PN + ce−Bi < L(1 − xi ) + Ci ∀i ∈ N
B
j=1 j

yi − Lxi ≤ 0 ∀i ∈ N , (20)
Bi Rα
yi − L(1 − xi ) ≤ PN + ce−Bi ∀i ∈ N ,
B
j=1 j

xi ∈ {0, 1} ∀i ∈ N ,

yi ∈ R+ ∀i ∈ N .
In (20), yi represents the profit the pool can yield from stakeholder i. The second and third sets
of constraints set the upper bound for yi . If xi = 0, i.e., stakeholder i does not invest in the
Bi Rα
pool, yi will be upper-bounded by 0. If xi = 1, yi will be upper-bounded by PN + ce−Bi .
j=1 Bj
The optimal solution of this MILP model consists of the values for α and c which constitute the
optimal leader’s strategy s∗p . The existence of the Stackelberg solution is proven via the existence
of the optimal solutions of (20) in the following theorem.

T HEOREM 2. There exists at least one Stackelberg solution in the considered stake pool game.

Proof: To prove the existence of the Stackelberg solution, we first prove the existence
of p∗i . As can be seen from (16), for every fixed strategy sp = (α, c) of the leader, there is a
uniquely defined response p∗i (α, c) of each stakeholder i. Therefore, for every leader’s optimal
strategy s∗p , there exists an unique optimal response p∗i (α, c).
Then, we prove that there exists at least one optimal solution of (20), which means there
exists at least one leader’s optimal strategy. Let x = [x1 , . . . , xN ], the MILP can be decomposed
 7

into 2N Linear Programming (LP) problems, where in each problem a different combination of
x is fixed. Each LP problem is then defined as
N  
X Bi Rα −Bi
max x i PN + ce
α,c
i=1 j=1 Bj
(21)
Bi Rα
s.t. PN + ce−Bi < L(1 − xi ) + Ci ∀i ∈ N ,
j=1 Bj
PN
where x are constant instead of decision variables. Then, in case i xi = 0, the optimal

objective value is 0. In case N

P
i xi > 0, the feasible region of each LP problem is bounded by
Bi Rα
the set of constraints { PN + ce−Bi = Ci |xi = 1} and α, c ≥ 0. Since the feasible region
j=1 Bj
is bounded, the LP problem has both a maximum and a minimum value on the feasible region,
and these values occur at the vertices of the feasible region [21].
Since these 2N LP problems enumerate all possible combinations of x and each of these LP
has at least one optimal solution, there exists at least one optimal solution of the MILP with
objective value equals to that of the LP with highest objective value. As a result, there exists at
least one Stackelberg solution (s∗p , s∗i ) in this game.

R EFERENCES

[1] GSMA Intelligence, “The Mobile Economy 2019,” GSM Association, rep., Feb. 2019.
[2] L. Papachristou, “Report: US$32.7 Billion Lost in Telecom Fraud Annually,” Organized Crime and Corruption
Reporting Project. [Online]. Available: https://www.occrp.org/en/27-ccwatch/cc-watch-briefs/9436-report-us-32-7-billion-
lost-in-telecom-fraud-annually. [Accessed: 16-Aug-2019].
[3] G. Macia-Fernandez, P. Garcia-Teodoro, and J. Diaz-Verdejo, “Fraud in roaming scenarios: an overview,” IEEE Wireless
Communications, vol. 16, no. 6, pp. 88–94, 2009.
[4] C. T. Nguyen, D. T. Hoang, D. N. Nguyen, D. Niyato, H. T. Nguyen, and E. Dutkiewicz, “Proof-of-Stake Consensus
Mechanisms for Future Blockchain Networks: Fundamentals, Applications and Opportunities,” IEEE Access, vol. 7, pp.
85727–85745, 2019.
[5] IBM, “Reimagining telecommunications with blockchains,” IBM Institute for Business Value. [Online]. Available:
https://www.ibm.com/thought-leadership/institute-business-value/report/blockchaintelco. [Accessed: 16-Aug-2019].
[6] Deutsche Telekom AG, “Deutsche Telekom and SK Telecom pave the way for the future,” Deutsche Telekom, 26-
Feb-2019. [Online]. Available: https://www.telekom.com/en/media/media-information/archive/deutsche-telekom-and-sk-
telecom-pave-the-way-for-the-future-564180. [Accessed: 16-Aug-2019].
[7] A. Kulichevskiy, “Bubbletone blockchain white paper,” 03-Oct-2017 [Online]. Available:
https://icos.icobox.io/uploads/whitepaper/2017/10/59e8dcfa89537.pdf [Accessed: 16-Aug-2019].
 8

[8] L. Luu, D. Chu, H. Olickel, P. Saxena, and A. Hobor, “Making Smart Contracts Smarter,” Proceedings of the 2016 ACM
SIGSAC Conference on Computer and Communications Security - CCS16, 2016.
[9] A. Kiayias, A. Russell, B. David, and R. Oliynykov, “Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol,”
Advances in Cryptology – CRYPTO 2017 Lecture Notes in Computer Science, pp. 357–388, 2017.
[10] I. Bentov, A. Gabizon, and A. Mizrahi, “Cryptocurrencies without proof of work,” International Conference on Financial
Cryptography and Data Security. Springer, pp. 142–157, 2016.
[11] Y. Gilad, R. Hemo, S. Micali, G. Vlachos, and N. Zeldovich, “Algorand: Scaling byzantine agreements for cryptocurren-
cies,” in Proceedings of the 26th Symposium on Operating Systems Principles. ACM, pp. 51–68, 2017.
[12] J. Kwon, “Tendermint: Consensus without mining,” Draft v. 0.6, fall, 2014.
[13] I. Bentov, A. Gabizon, and A. Mizrahi, “Cryptocurrencies without proof of work,” International Conference on Financial
Cryptography and Data Security. Springer, pp. 142–157, 2016.
[14] I. Bentov, C. Lee, A. Mizrahi, and M. Rosenfeld, “Proof of activity: Extending bitcoin’s proof of work via proof of stake
(extended abstract),” ACM SIGMETRICS Performance Evaluation Review, vol. 42, no. 3, pp. 34–37, Dec. 2014.
[15] V. Buterin and V. Griffith, “Casper the friendly finality gadget,” arXiv preprint arXiv:1710.09437, 2017.
[16] Cardano, “Ouroboros Proof of Stake Algorithm,” Cardano. [Online]. Available: https://cardanodocs.com/cardano/proof-
of-stake/. [Accessed: 14-Mar-2019].
[17] “Ultrapool,” Decred Voting Service - Welcome. [Online]. Available: https://ultrapool.eu/. [Accessed: 16-Aug-2019].
[18] “Stakecube,” Crypto Shib. [Online]. Available: https://cryptoshib.com/stakecube/. [Accessed: 16-Aug-2019].
[19] “Earn profits by holdings cryptoassets,” MyCointainer. [Online]. Available: https://www.mycointainer.com/. [Accessed:
16-Aug-2019].
[20] Z. Han, D. Niyato, W. Saad, T. Başar, and A. Hjørungnes, Game theory in wireless and communication networks: theory,
models, and applications. Cambridge: Cambridge University Press, 2012.
[21] M. X. Goemans, Advanced algorithms. Massachusetts Institute of Technology. Laboratory for Computer Science, 1994.
[22] StakingRewards, “Cardano,” Digital Asset Research Platform for Staking & Dividends. [Online]. Available:
https://stakingrewards.com/asset/ada. [Accessed: 16-Aug-2019].
[23] StakingRewards, “Algorand,” Digital Asset Research Platform for Staking & Dividends. [Online]. Available:
https://stakingrewards.com/asset/algo. [Accessed: 16-Aug-2019].
[24] StakingRewards, “Cosmos,” Digital Asset Research Platform for Staking & Dividends. [Online]. Available:
https://stakingrewards.com/asset/atom. [Accessed: 16-Aug-2019].
[25] StakingRewards, “Tezos,” Digital Asset Research Platform for Staking & Dividends. [Online]. Available:
https://stakingrewards.com/asset/xtz. [Accessed: 16-Aug-2019].
[26] StakingRewards, “NEM,” Digital Asset Research Platform for Staking & Dividends. [Online]. Available:
https://stakingrewards.com/asset/xem. [Accessed: 16-Aug-2019].