The Economics of Proof-of-Useful-Work

Source: arXiv:2606.06700 · Published 2026-06-04 · By Rafael Pass

TL;DR

This paper develops a rigorous competitive-equilibrium economic model to analyze Proof-of-Useful-Work (PoUW) blockchains, where computational effort simultaneously secures consensus and produces externally valuable work. Unlike traditional Proof-of-Work (PoW) systems like Bitcoin whose mining computations are purely wasteful, PoUW aims to recycle this expended compute into useful outputs such as machine learning inference. The primary obstacle to PoUW adoption has been a pervasive economic criticism: that useful work enables attackers to be "paid to attack," potentially lowering the true costs of a majority takeover and weakening security.

Rafael Pass constructs a tractable single-period model with three compute activities—pure mining, pure useful work (ML inference), and duplex compute producing both simultaneously at some overhead—and characterizes the unique competitive equilibria parameterized by the token–inference ratio (T/I ratio) and duplex efficiency. The model identifies three regimes: Bitconia (classical PoW with no duplex use), Fortessia (duplex replaces mining to improve security without increasing useful output), and Duplexia (duplex subsidizes inference, lowering prices and expanding useful computation). Contrary to the common strawman argument, the economic cost of a 50% attack remains tied to the block reward regardless of useful work and duplex overheads. Moreover, the system can increase social value by generating additional useful work that would not exist without the blockchain, with the magnitude of this effect increasing in token adoption and duplex efficiency.

Key findings

• Competitive equilibria depend primarily on the duplex overhead index ∆ = 1/γ + 1/α – 1 and the token–inference ratio θ = PR / (pQ).
• If ∆ < 0, duplex is inefficient and the system reduces to classical PoW (Bitconia): mining and inference are separate, inference price p = e, and security S = M.
• If ∆ > 0 and θ < θ_low = α – 1, duplex replaces solo mining, raising security above classical PoW but inference output and price remain unchanged (Fortessia).
• If ∆ > 0 and θ > θ_low, solo inference disappears; duplex compute subsidizes inference prices below cost (p < e), expanding demand and increasing both security and useful computation (Duplexia).
• The economic cost to mount a 50% attack remains exactly PR/2 in equilibrium across all regimes, aligning with classical PoW attack cost despite useful work.
• In Duplexia, block rewards act like rebates on inference prices, generating additional socially useful computation that would not occur without the blockchain.
• For parameters α = γ = 1.3 and price elasticity ε = 2, duplex regimes can increase total useful work and security expenditure simultaneously.
• Social deadweight losses arise in Duplexia due to subsidized inference output consumed below resource cost, but these losses are second order and typically small when subsidy is modest.

Threat model

The adversary is an economically rational attacker seeking to perform a majority attack on the blockchain by acquiring a controlling fraction of the computational power securing consensus. The attacker can allocate compute to mining or duplex operations but does not have cryptographic breaks or unlimited resources. The model assumes the attacker cannot counterfeit tokens or bypass the underlying PoW puzzle requirements. The attacker is subject to market prices for tokens and inference revenue; attacks cost real economic resources net of any gains from useful work. The threat model captures integrity attacks aiming to violate consensus by controlling >50% of effective hashrate.

Methodology — deep read

1. Threat Model & Assumptions: The model assumes a Nakamoto-style PoW blockchain where compute contributes to consensus security measured by hashrate, alongside an economic market for useful computation (instantiated concretely as machine learning inference). The adversary aims to launch majority attacks by acquiring computational power, with costs derived from compute expenditure net of any useful-work revenue during attacks. The attacker cannot counterfeit tokens or break cryptography; focus is on economic costs of securing majority share of compute.

2. Data and Setup: No empirical dataset is used; instead the paper constructs a formal equilibrium economic model with a continuum of agents each controlling a single GPU unit. Compute operations occur per time period (blocktime), assumed to be 10 minutes. Compute cost e represents all-in rental and operating cost per GPU per blocktime, normalized to ~$1. Block rewards R tokens per block valued at price P USD. Demand for useful inference D(p) is exogenous and downward-sloping with assumed elasticity > 1.

3. Architecture/Algorithm: The model includes three compute activities: pure mining (M), pure useful inference (L), and duplex (D) that simultaneously generates fraction 1/γ of a mining op and 1/α of an inference op but with overhead (α, γ ≥ 1). Per-op profits incorporate costs minus revenue from token rewards (for mining portion) and payment for inference results (for useful work portion).

Inverse free entry competition conditions require zero profit for active activities. Equilibrium enforces market clearing for inference (supply = demand) and security measured by S = M + D/γ. The token–inference ratio θ = PR / pQ parametrizes the equilibrium. Duplex efficiency measured by Δ = 1/γ + 1/α – 1 determines viability of duplex use.

4. Training Regime: Not applicable; this is an economic model with analytical closed-form equilibrium characterization rather than computational training.

5. Evaluation Protocol: Theoretical analysis derives closed-form solutions for equilibrium allocations (M, L, D), prices (p, P), total security S, and useful work Q as functions of parameters (α, γ, θ, e, R) and demand D(p). Results include comparative statics and regime classification (Bitconia, Fortessia, Duplexia). Sensitivity analysis for demand elasticity and duplex overhead is provided. Theorems on economic cost of attacks and social value are proven mathematically. Graphical illustrations show transitions between regimes.

6. Reproducibility: The model is fully specified mathematically with proofs, but no software code or empirical datasets are involved or released. Theory is general and analytic, relying on standard assumptions about demand and cost structures. The model is extendable to multi-epoch block rewards and fees as described in appendices.

Example walk-through: Given fixed duplex overheads α = γ = 1.3 and token-inference ratio θ, competitive equilibrium prices and allocations can be computed from closed form expressions provided (Table 1). If θ is large enough, the economy enters Duplexia, solo inference drops out, and duplex compute activity expands above Bitconia baseline, lowering inference price and improving security simultaneously.

Technical innovations

• Competitive equilibrium model linking mining (security) and useful computation through duplex operations with overheads α,γ, extending PoW economic analysis to PoUW settings.
• Introduction of the token–inference (T/I) ratio θ as a scalar summarizing blockchain token adoption relative to useful compute demand, parametrizing equilibrium outcomes.
• Closed-form classification of equilibrium regimes (Bitconia, Fortessia, Duplexia) based on duplex efficiency Δ and T/I ratio θ, explicitly characterizing allocations, security, prices, and social value.
• Economic security theorem proving attack cost remains tied to block reward despite useful work, refuting strawman "paid to attack" argument.
• Demonstration that block rewards can subsidize inference prices in Duplexia regime generating additional socially valuable computation not otherwise supplied.

Baselines vs proposed

• Classical PoW (Bitconia): Attack cost = PR/2; Inference price p = e; Total security S = M.
• Fortessia (duplex replaces mining but solo inference remains): Attack cost = PR/2; Inference price p = e; Security S > Bitconia baseline.
• Duplexia (duplex subsidizes inference demand): Attack cost = PR/2; Inference price p < e; Security and useful work Q both greater than Bitconia baseline.

Limitations

• Model assumes perfectly competitive market of agents with identical compute cost e; does not explicitly model strategic miners with market power.
• Focuses on single time period equilibrium with fixed block rewards and ignores dynamic effects such as multi-epoch token issuance and transaction fees (though discussed in appendix).
• Assumes fixed demand curve D(p) for inference that is exogenous and elastic; real demand and substitution may be more complex or less elastic.
• Technological overhead parameters α, γ are treated as fixed; real PoUW schemes may have more nuanced efficiency tradeoffs and verification costs.
• No empirical validation or simulation of attacker behavior beyond economic cost definition; real adversaries may employ tactics violating model assumptions.
• Deadweight loss analysis relies on classical economic assumptions without integrating user behavior beyond demand curve.

Open questions / follow-ons

• How do strategic miner behaviors with heterogeneous compute costs and market power affect equilibrium and security in PoUW systems?
• Can dynamic multi-period models incorporating transaction fees and stochastic block production refine the analysis of T/I ratio and attack costs?
• How do real-world technological parameters of PoUW constructions (verification complexity, latency) impact duplex overheads α,γ and thus equilibria?
• What empirical evidence from deployed PoUW blockchains supports or challenges the equilibrium regimes identified theoretically?

Why it matters for bot defense

Bot-defense and CAPTCHA engineers designing or evaluating PoUW-based blockchain systems should consider this paper’s insights on the fundamental economic tradeoffs governing security and useful output production. The work clarifies that adding useful work does not inherently compromise security costs once equilibrium market prices are factored — an important reassurance against the common "paid to attack" critique. It also highlights that careful design of duplex efficiency and fostering sufficient token adoption (high T/I ratio) can unlock regimes where security is strengthened and useful work subsidized.

Practitioners should note that optimizing PoUW schemes for low duplex overhead (α, γ close to 1) is critical to enter the economically desirable Duplexia regime where useful work expands and token rewards produce positive externalities rather than deadweight losses. When implementing CAPTCHAs or bot-detection puzzles leveraging PoUW concepts, the analysis suggests focusing on tasks that balance public verifiability, utility, and computational overhead to maximize economic and security efficiency. Finally, understanding these equilibria aids in assessing risks of economic attacks and verifying that incentive structures align hostile actor costs with system security.

Cite

@article{arxiv2606_06700,
  title={ The Economics of Proof-of-Useful-Work },
  author={ Rafael Pass },
  journal={arXiv preprint arXiv:2606.06700},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.06700}
}

Read the full paper

• arXiv:2606.06700 (abstract)
• arXiv:2606.06700 (PDF)