Token Design Primer

Designing a cogent design for a token is extraordinarily challenging. As of writing, most of the existing tokens out there have been designed around various mechanisms for rewarding block producers. In Bitcoin and Ethereum for example, the solver of the current Proof-of-Work (PoW) challenge gains the right to propose the next block of transactions to be appended to the blockchain. If this block is approved, then the proposer gains a block reward. In this note, I’ll review various designs for tokens and explain their basic mechanics.

Much of the variation between blockchains really centers on who can be a block proposer and how the block proposer for the current block is selected. PoW changes are open and permissionless, so anyone can compete to become a block proposer. However in PoW chains, the current block proposer needs to have solved a mathematical puzzle (finding a particular pre-image of a hash function). Solving this puzzle requires significant computational effort, so most block proposers (“miners”) typically invest heavily in custom hardware (ASICs) that accelerate the computation of these hash pre-images. In practice, this means that the set of block proposers is heavily constrained by capital constraints. Most blockchains in wide use today are PoW, although that is slowly starting to change as concerns about the energy expenditure of ASIC backed miners is becoming more widespread.

Proof of Stake (PoS) provides an alternative method of selecting the current block proposer. Generally, a prospective block proposer must obtain some of the network’s token and must “stake” it, that is lock it, to be considered as a block proposer. The current block proposer is selected typically with a “verifiable random function” (VRF) of some sort that picks one block proposer from the set of staked parties in the network. There are various constructions for VRFs out there that different chains have picked. Once a block is proposed, there must be a mechanism for ratifying the block. There are various processes for the ratification of a proposed block, but in general, signatures from a sufficient fraction of prospective block proposers must be gathered to approve the block. These signatures are typically aggregated using BLS aggregation or a similar set-up. At the time of writing, most proof-of-stake systems are limited to having somewhere between 20 to a few hundred block proposers. This is mostly due to the fact that signature aggregation technology is still maturing. Ethereum 2.0’s beacon chain will be the first live PoS chain with thousands to hundreds of thousands of prospective block producers (called “validators”). If the proposed block is ratified, then the original proposer is rewarded with some newly created tokens. Some PoS systems have stringent controls on who can be a block proposer, while others allow for open systems.

In both PoW and PoS systems, the token is essentially a bookkeeping system that rewards various parties for some useful service rendered to the network. Why do these tokens have any value? This question is still a bit of a mystery. The most honest answer might simply be that there exists a market for scarce digital goods. The fact that it is challenging to obtain Bitcoin/ETH/etc creates scarcity that results in non-zero prices. It’s worth noting that both Bitcoin and ETH have a natural secondary use, which is to pay “transaction fees.” Block proposers typically have some freedom of choice in deciding which transactions to add on to their current block. Participants in the network typically have to provide a small bribe (“transaction fee”) to incentivize the block proposer to include their transaction over others. This natural use case has spurred would-be token designers to consider a new class of “utility tokens.” The reasoning goes that a token perhaps should have value since it serves some natural purpose. A number of promising experiments are underway experimenting with tokens that are issued for useful work such as streaming video data (Livepeer), maintaining certification authorities (Handshake, and storing files Filecoin). Most of these projects are still in experimental stages, and it remains to be seen which will succeed in establishing stable value for their native tokens. The standard question that such network have to answer is why they can’t simply re-use a more basic token such as Bitcoin or Ethereum for their needs.

One interesting type of utility token worth highlighting is the “governance token.” Holders of such governance tokens gain the ability to vote on critical network design questions. For example, Tezos allows for its block proposers (“bakers”) to vote on and ratify upgrades to its native codebase. Tezos has just (as of writing) completed its first upgrade that was authorized “on-chain” by its governance token. It remains to be seen whether governance tokens will emerge as a stable class of token. A major concern is how the effect of “whales” (wealthy individuals or institutions) will play out. Some evidence has emerged that governance token voting could be vulnerable to manipulation by whales. It remains to be seen whether governance tokens can overcome these design limitations in future iterations.

A final class of token design worth pointing out is the “dividend token.” Holders of such tokens expect to receive cash dividends based on their holdings. MKR in MakerDao is a good example of such a token. MakerDAO is a “stablecoin” system that attempts to construct a currency (Dai) whose value is pegged to that of the dollar. Dai is backed by ETH invested by network participants who create Collateralized Debt Positions (CDP). These CDPs are loans taken on ETH that create Dai. CDP creators have to pay interest, at a rate that is decided by the MKR token holders. MKR functions as a governance token in this fashion, but MKR holders are also paid out dividends (implicitly) from interest payments made by CDP holders. It’s worth noting that MKR holders also theoretically take on market risk since future versions of MakerDAO will dilute MKR supply if the Dai stablecoin slips from its peg to the dollar. In this vein, MKR functions as an investment since MKR holders profit from dividends generated by payments in the base currency (ETH). REP in Augur is another example of a “dividend token.” Augur operates prediction markets in which reporters stake REP (for reputation) on possible outcomes of the market. Reporters who reported incorrect outcomes have their REP redistributed to reporters who reported correct outcomes on the market. REP holders can earn a dividend in this fashion, but have to do some work to gain it, making REP a “work token.” Augur’s upcoming V2 upgrade will force work by punishing inactivity on the part of REP holders.

Token design remains something of an art today. There are a number of different hypotheses on good designs for tokens that hold long term value, but few are rigorously proven. Perhaps none are proven even, with the possible exception of Bitcoin. It’s important to note that most tokens launched typically fall back on a pattern established by an existing network.This isn’t a failing, but rather good sense on the part of designers. Blockchain projects are immensely complicated constructs, and re-using proven designs whenever possible is good sense that helps de-risk parts of the project design.

1 Like