1. Introduction
In this paper we analyze a stochastic growth process for a family of directed acyclic graphs, and show that the fluid limit of this process is described by a delay differential equation. This stochastic process describes a type of shared ledger which was introduced as the foundation of the cryptocurrency IOTA [Reference Popov20], and the result about the fluid limit was used previously to analyze the persistence of competing transaction records in this ledger [Reference Ferraro, King and Shorten10]. The main contribution of this paper is to provide a precise formulation of the results about the fluid limit. We first prove ergodicity of the growth process. We then use martingale techniques to establish that the process converges weakly in the limit where the arrival rate goes to infinity, and show that the fluid limit is given as the solution of a suitable delay differential equation. We also prove a convergence result for the solutions of the delay differential equation.
The term ‘shared ledger’ refers to a record of transactions which may be amended independently by any member of a group of users. The goal of designing a shared ledger is to allow users to add transactions to the record without centralized control, while at the same time protecting the record against tampering by malicious agents. As background on this topic we will review below the well-known blockchain protocol [Reference Nakamoto16], which involves linking blocks (collections of transactions) by complicated hash function computations. If blocks are represented by vertices on a graph and the hashing link between two blocks is represented by a directed edge between those vertices, then the whole blockchain ledger can be viewed as a directed graph. This point of view leads to our random graph analysis, and will form the basis for the stochastic process that will be analyzed in this paper.
1.1. The blockchain protocol
The blockchain technology underlying Bitcoin is a well-known implementation of a shared ledger which provides security against malicious users [Reference Nakamoto16], [Reference Zheng, Xie, Dai, Chen and Wang24]. Recall that the blockchain is an ordered string of blocks, each containing several hundred transaction records (see Figure 1 for a pictorial representation); each block has a unique numerical ID (256 bits for Bitcoin) that satisfies a challenging constraint. The ID of a block is computed using a complicated hash function, and the input for the hash function involves the block’s own data, the ID of the previous block, and some extra bits which are chosen so that the output satisfies the constraint. Thus, every block’s ID depends on the data of the previous block, and hence also on the data in all previous blocks. Therefore any change in the data of a block would change the IDs of all subsequent blocks, and the altered IDs would almost certainly not satisfy the tight constraint mentioned above. This failure would be a signal to all observers that the ledger had been altered, and so the existence of a ledger with valid IDs for all blocks is its own guarantee of security. The key mechanism for security is the difficulty of computing a valid ID for a block. This task is called the proof of work, and requires finding an input to a complicated hash function which will produce an output of the specified form. Blockchain miners compete to find this inverse, and the first successful one adds the new block to the chain (see Figure 1).
One essential constraint in Bitcoin is that a new block can only be linked to the most recent block in the chain. This constraint ensures that the blockchain is a linear graph. It also ensures that every transaction record in the chain is linked to all subsequent records, and indeed the security of a transaction increases as later blocks are added (a typical rule of thumb is that a transaction record in blockchain is ‘safe’ after at least six subsequent blocks have been added). However this constraint leads to a ‘winner takes all’ rule for the miners, who must compete to be first to add a new block. Consequently mining has become a dedicated enterprise requiring specialized technology, and there is much effort wasted (and energy expended) by the miners.
1.2. Modifying the blockchain protocol
There have been many proposed modifications of the blockchain protocol. In this paper we consider one such proposal [Reference Popov20], which involves removing the constraint that a new block can only be linked to the most recent block in the chain. Removing this constraint has several immediate consequences. First, there is no competition between miners; hence each user can perform their own proof of work (which is much easier than in Bitcoin), and there are no rewards for adding a new block. Second, since a new block can link to any previous block, the graph of links for the ledger is no longer linear, and can be much more complicated than in Bitcoin. Furthermore, since there are many possible ways to link a new block to the ledger, it is reasonable to view the ledger as a randomly growing graph and to investigate its typical properties. We will pursue this point of view for the modification known as the tangle protocol, which was introduced in [Reference Popov20].
1.3. The tangle protocol
In the tangle protocol [Reference Popov20] each new block contains just one transaction. A new transaction links to two existing transactions in the ledger (this is another change from the blockchain protocol), and the proof of work uses the IDs of these two transactions as part of its input. Therefore the ledger grows by the addition of transactions each with two directed edges which link to existing transactions in the ledger. These directed edges indicate that the two existing transactions have been approved. The resulting graph of links is a connected directed acyclic graph (DAG) (see Figures 2 and 3 for examples of how the DAG grows). The proof of work lasts for some amount of time h, so there is a delay between the time when a new transaction starts its proof of work and the time when it is added to the DAG as a new vertex. This time delay h plays a crucial role in the growth of the ledger.
The security of a transaction increases as later transactions are added which are linked either directly or indirectly to it. Although in principle a new transaction may choose to link to any existing transaction in the ledger, it is advantageous to select two recently arrived transactions for linking. Transactions which have not yet been linked by subsequent transactions are called tips; in the tangle protocol all users select tips for linking. Note that for blockchain the security relies on the community solving one exceedingly difficult hash function inversion for each new block, whereas for the tangle the security relies on a large community of users each performing relatively simple computations in parallel.
1.4. Summary of results
The arrival process is assumed to be deterministic, with arrival times $\{n \lambda^{-1}\}$ for $n = 1,2,\dots$, and each new transaction is assumed to randomly select two tips for linking. There are two time scales in this model, namely the interarrival time $\lambda^{-1}$ and the duration h of the proof of work. We are interested in how the average number of tips in the tangle depends on these quantities as the arrival rate $\lambda$ goes to infinity. Let L(t) be the number of tips at time t. Several approaches to this question [Reference Popov20], [Reference Ferraro, King and Shorten10] have shown that L(t) is roughly proportional to the product $\lambda h$, at least for large $\lambda$. We investigate in this paper the limit where $\lambda$ approaches infinity, so we define the rescaled variable $B^{(\lambda)}(t) = \lambda^{-1} L(t)$. The first result, Theorem 4.1, shows that the stochastic process L(t) converges to a stationary distribution as $t \rightarrow \infty$. The second result, Theorem 4.2, shows that $B^{(\lambda)}(t)$ converges in probability to a deterministic function b(t) as $\lambda \rightarrow \infty$ for t in a fixed interval [0, T]. The bound in Theorem 4.2 also shows that the fluctuations in $|B^{(\lambda)}(t) - b(t)|$ are no larger than $O(\lambda^{-1/2})$. The third result, Theorem 4.3, shows that the function b(t) converges exponentially to 2h as $t \rightarrow \infty$. Putting these results together shows that for large $\lambda$ and large t, L(t) can be written approximately as $2 \lambda h + O(\lambda^{1/2})$. These results support the conclusion that the random tip selection algorithm leads to eventual approval for all transactions in the tangle, which is one of the most important features of the protocol. In Appendix A we discuss some implications of this work for the security of the tangle in our setting of the random tip growth model.
1.5. Relation to previous work
The subject of this paper is the fluid limit of a growth model for shared ledgers, with delays. The precise model for a shared ledger considered in this paper is relatively new; however, there is a vast literature on the related topics of growth models for random graphs, fluid limits for stochastic processes, and delay models. Well-known examples of stochastic growth models for random graphs include the preferential attachment model [Reference BarabÁsi and Albert2], [Reference D’Souza, Borgs, Chayes, Berger and Kleinberg9] and the CHKNS model (named after the authors of the paper [Reference Callaway, Hopcroft, Kleinberg, Newman and Strogatz6]), although in both cases the mechanism of attachment is quite different from the one analyzed here. The notion of attaching new vertices at the tips of the graph is closer in spirit to diffusion-limited aggregation (DLA) models [Reference Halsey14], although the application and the kind of results obtained are quite different. Queueing models arising from the Bitcoin protocol have been analyzed in the papers [Reference Koops15], [Reference Frolkova and Mandjes12]. Our approach to the fluid limit is based on prior work for Markov jump processes [Reference Darling and Norris7], where martingale techniques are used to obtain convergence in probability. The novel ingredient in our work is the delay, which means that the process is not Markov. Stochastic models with delays have been studied in many contexts, including queueing theory [Reference Pender, Rand and Wesson18], [Reference Pender, Rand and Wesson19], [Reference Novitzky, Pender, Rand and Wesson17] and stochastic differential equations [Reference Scheutzow22], [Reference Reiss, Riedle and van Gaans21], [Reference Hairer, Mattingly and Scheutzow13]. The application of these methods to shared ledger models seems to be new.
1.6. Outline of the paper
In Section 2 we formulate a stochastic process for the number of tips on the DAG which represents the tangle. In Section 3 we describe the fluid limit of the rescaled process (the fluid limit refers to the limit where the arrival rate of new transactions goes to infinity) and also describe how initial conditions can be consistently formulated for the process and the fluid limit. The main results of the paper, Theorems 4.1, 4.2, and 4.3, are stated in Section 4, and are proved in Sections 5, 6, and 7. Section 8 contains proofs of some lemmas used in the earlier sections. Future directions of research on this topic are discussed in Section 9. Appendix A describes some implications of this work for security of the tangle.
2. Definition of the DAG model
Let $G=(V,E)$ be a finite connected acyclic directed graph (DAG) where V is the vertex set and E is the edge set. If an edge $e \in E$ is directed from vertex x to vertex y we will write $e = \langle x, y \rangle$ and say that y is the head and x is the tail. A tangle is a DAG with two additional properties: first, there is a unique vertex which is not the tail in any edge—this is called the genesis vertex. Second, every vertex is the tail in at most two edges. The subset of vertices which are not the heads of any edges will be called the tips of the tangle.
We will define a stochastic growth model for the tangle. New transactions are created at the sequence of times $\{t_n = \lambda^{-1} n \,: \, n=1,2,\dots\}$, so the arrival rate of new transactions is $\lambda$. At time $t_n$, two tips $x_1(n)$ and $x_2(n)$ on the tangle are selected for the proof of work by the new transaction (it will be explained shortly how these tips are selected; it may happen that $x_1(n) = x_2(n)$). The proof of work lasts for a fixed length of time h. For simplicity we will assume that $\lambda$ is always chosen so that $\lambda h$ is an integer:
At time $t_n + h = t_{n+m}$ the new transaction is added to the tangle as a tip $y_n$, and the two directed edges $\langle y_n, x_1(n) \rangle$ and $\langle y_n, x_2(n) \rangle$ are also added to the graph. This is the only mechanism by which the tangle grows (see Figure 2 for illustration).
Obviously the vertices $x_1(n)$ and $x_2(n)$ are no longer tips after time $t_n+h$; however, it may happen that these vertices had already ceased to be tips at an earlier time, owing to their being linked to some previous new transaction. We say that a tip is pending if it has been selected for proof of work by a transaction but has not yet been linked. We say that a tip is free if it is not pending. See Figure 3 for an example showing new vertices being added to the tangle.
Definition 2.1. We define the following quantities:
We have defined $U_n$ to be the number of the vertices $\{x_1(n), x_2(n)\}$ which are free at time $t_n$, so $U_n \in \{0,1,2\}$. After selection these free vertices immediately become pending vertices; hence they will never contribute to any of the subsequent values $U_{n+1}, U_{n+2}, \dots$. Furthermore at any time there are exactly m new transactions which are each in the process of carrying out their proof of work on two vertices on the graph (this holds because $m = \lambda h$ and we assume that the value of h is fixed and identical for all users). Therefore the total number of pending vertices at any time $t_n$ is the sum of $\{U_n, U_{n-1}, \dots, U_{n-m+1}\}$; that is,
We also have the evolution relations
and the relation
Note that the term ‘$+1$’ appears on the right sides of (2.7) because a new free tip is added to the tangle at each step. Also the term $ - U_{n+1}$ appears in $X_{n+1}$ because this is the number of free tips that are selected at the $(n+1)$th step, and the term $ - U_{n-m+1}$ appears in $L_{n+1}$ because this counts the number of vertices which cease being tips at the $(n+1)$th step. Finally, all tips which were pending at the $(n-m)$th step will no longer be tips at the nth step, and all of the m new arrivals in this interval will still be tips at the nth step; therefore, for all $n \ge m$,
We will refer to $(W_n,X_n,L_n)$ as the tangle process. It follows from (2.9) that the process $\{L_n \}$ (for $n \ge m$) is in fact fully determined by $\{X_n \,{:}\, n \ge 0\}$.
We will discuss shortly how the processes $X_n$ and $L_n$ can be defined using appropriate initial conditions. For this purpose it will be convenient to use the evolution relations (2.7) starting at $n=0$. These relations imply that
2.1. The random tip growth model
The remaining ingredient in the definition of the DAG model is the method of choosing vertices $x_1(n)$ and $x_2(n)$. We will assume in this paper that the tips $x_1(n)$ and $x_2(n)$ are chosen independently and uniformly from the set of tips, and we call this the random tip growth (RTG) model for the tangle process. Thus, the numbers $\{U_n\}$ are random variables whose distributions depend on the number of tips at time $t_n$. The RTG model is one of the tip selection algorithms discussed in [Reference Popov20], [Reference Ferraro, King and Shorten11], and it is expected that the fluid limit methods presented in this paper can be extended to those other tip selection algorithms.
We denote by $\mathcal{F}_n$ the $\sigma$-algebra generated by $\{U_1,\dots,U_n\}$:
It follows from (2.10) that $X_n - X_0$ and $L_{n+m} - L_m$ are measurable with respect to $\mathcal{F}_n$. We also have the filtration relation
The conditional distribution of the random variable $U_{n+1}$ for the RTG model is
Note that
It is clear that $(X_n,L_n)$ is not a Markov process, as the distribution of $L_{n+1}$ depends on $U_{n-m+1}$, which in turn depends on $(X_{n-m}, L_{n-m})$ through (2.13).
2.2. Generating the process from initial conditions
The stochastic process $(X_n,L_n)$ defined by (2.7) and (2.13) must be supplemented with initial conditions in order to be well-defined. This is done most easily by assigning values to the variables $(U_{-m+1},\dots,U_0)$ and $X_0$. Once these assignments have been made, the distribution of the process $(X_n, L_n)$ is determined for all $n \ge 0$, as will be explained below. In particular the variables $X_{-m},\dots,X_{-1}$ and $L_{-m},\dots,L_{-1}$ do not play any role, and we will ignore their values.
Let $(u_{-m+1},\dots,u_0)$ be a sequence with $u_i \in \{0,1,2\}$ for all $i=-m+1,\dots,0$, and let $\xi_0 \ge 1$ be an integer. Then we assign as initial conditions
It follows from (2.15) that $L_0 \ge \xi_0 \ge 1$, so the distribution of $U_{1}$ is well-defined. Similarly $L_n \ge X_n \ge 1$, so the distribution of $U_{n+1}$ is well-defined for all $n \ge 0$.
From (2.10) and (2.15) we also deduce that
and so $L_{1}$ is also fixed by the initial conditions. The same is true for $L_2,\dots,L_m$, and we have the formula
3. The fluid limit
Given the process $\{X_n, L_n\}$ we rescale variables and define for all $t > 0$
The variables $(A^{(\lambda)}(t), B^{(\lambda)}(t))$ are piecewise constant in the intervals $[t_n,t_{n+1})$, and change by at most $\pm \lambda^{-1}$ at each time $t_n$. Therefore it is reasonable that in the limit $\lambda \rightarrow \infty$ these variables will converge to continuous functions a(t) and b(t). Furthermore after rescaling (2.7) the evolution equations become
The left sides of (3.2) are expected to converge to a’(t) and b’(t) as $\lambda \rightarrow \infty$, so it is reasonable to expect that the fast variations on the right side will be averaged out in the limit, leaving the expected values of the variables $U_{n+1}$ and $U_{n-m+1}$. From (2.14) we have
and similarly
Assuming that the right sides of (3.2) converge to these average values, we are led to the following pair of coupled delay differential equations for the fluid limit:
The second equation implies that $b(t) = a(t-h) + c$ for some constant c, and the value of c will be identified in Lemma 3.1.
3.1. Delay differential equations
The equations (3.5) must be supplemented with suitable initial conditions. We will say that the combination $\alpha = (a(0), \{u(t) \,{:} -h \le t \le 0\})$ is a DDE initial condition if $a(0) > 0$, u(t) is integrable, and
These initial conditions can be used to define a solution of the fluid equations (3.5) for $t \ge 0$ using the method of steps [Reference Driver8] in the same way as the initial conditions (2.15) were used to construct the tangle process. The idea is that the function u(t) plays the same role as the initial sequence $\{u_i\}$ for the discrete process. Therefore we first define the initial value b(0) as
and we then define b(t) for $0 \le t \le h$ as the solution of the delay equation
This leads to the solution
We then compute a(t) for $t \in [0,h]$ as the solution of the equation
which gives
where
Note that (3.9) implies $b(t) \ge a(0) > 0$ for all $0 \le t \le h$, so (3.12) is well-defined for $(x,y) = (0,t)$ with t in this interval, and (3.11) also implies that $a(t) > 0$ for all $0 \le t \le h$. The equation (3.9) also implies that $b(h) = a(0) + h$. Having obtained the functions (a(t), b(t)) in the interval [0, h], we then extend the solutions to the interval [h, 2h] by first defining
and then solving the differential equation for a(t) to obtain
From (3.13) we have $b(t) \ge h$, and thus Q(h, t) is well-defined for $h \le t \le 2h$ and again implies positivity of a(t). This construction can be continued in the same way for subsequent intervals $[2h,3h],\dots$, and produces a solution of the equations (3.5) for all $t > h$. We collect our results about this solution in the following lemma, which will be proved in Section 8.
Lemma 3.1. Let $\alpha$ be a DDE initial condition. There are unique functions (a(t), b(t)) defined for all $t > 0$ which satisfy the equations (3.9) and (3.11) in the interval [0, h], and which satisfy the differential equations (3.5) for all $t > h$. For $t \ge h$ the solutions also satisfy the following conditions:
3.2. Fluid limit: initial conditions for the tangle from DDE initial condition
Let $\alpha$ be a DDE initial condition. As Lemma 3.1 shows, $\alpha$ provides the necessary information to generate a unique solution of the delay equations (3.5). We will now show that $\alpha$ can be used to generate the initial conditions for a tangle process. Recall that $L_0,\dots,L_{m}$ are determined by the initial conditions $\xi_0,u_{-m+1},\dots,u_0$ through the relation (2.17), and that the function $\{b(t) \,:\, 0 \le t \le h\}$ is determined by $a(0), \{u(s)\,{:}\,-h \le s \le 0\}$ through the formula (3.9). We will choose the initial values $u_{-m+1},\dots,u_0$ for the tangle process depending on the function u(s) in such a way that the difference $B^{(\lambda)}(t) - b(t)$ is small for all $t \in [0,h]$, where $B^{(\lambda)}(t)$ is the rescaled variable defined in (3.1). Define the set of all initial value sequences:
Definition 3.1. Let $\alpha = (a(0), \{u(s) \,{:} -h \le s \le 0\})$ be a DDE initial condition, and let $b_{\alpha}(t)$ be defined for $0 \le t \le h$ by the formula (3.9). Let $\xi_{\alpha} = \max (\lfloor \lambda a(0) \rfloor, 1 )$. Given an initial condition $(\xi_{\alpha}, v)$ for the tangle process, where $v \in \mathcal{S}(m)$, let $\{ B_v^{(\lambda)}(t) \,:\, 0 \le t \le h \}$ be given by (3.1), where $L_0,\dots,L_{m}$ are defined by the formula (2.17) with $\xi_0 = \xi_{\alpha}$ and $u_i = v_i$. Define
Lemma 3.2. The set $F(\alpha, \lambda)$ is non-empty.
The result of Lemma 3.2, which will be proved in Section 8, implies that for each DDE initial condition it is possible to define initial conditions for the tangle process so that $B^{(\lambda)}(t) - b(t)$ is small for all $t \in [0,h]$. This will allow us to prove that the difference $B^{(\lambda)}(t) - b(t)$ is small for all t, as stated in Theorem 4.2.
4. Statement of results
The first result establishes ergodicity for the process $\{X_n\}$. We will write $\psi = (u_{-m+1},\dots,u_0;\ \xi_0)$ to denote a set of initial conditions as described in (2.15) in Section 2.2, and write $\mathbb{P}_{\psi}(\!\cdot\!)$ for the probability distribution of $\{X_n \,{:}\, n \ge 0\}$ when the process is created with initial condition $\psi$.
Theorem 4.1. There is a unique stationary distribution $\pi$ such that
The next result concerns the limiting behavior of the process when the arrival rate $\lambda \rightarrow \infty$.
Theorem 4.2. Let $\alpha$ be a DDE initial condition, and let $(a_{\alpha}(t),b_{\alpha}(t))$ be the associated solutions of the fluid equations (3.5) as described in Lemma 3.1. Let $v \in F(\alpha, \lambda)$, and let $(A_v^{(\lambda)}(t), B_v^{(\lambda)}(t))$ be the rescaled tangle process with initial conditions $(\xi_{\alpha},v)$ as described in Sections 2.2 and 3.2. For all $T \ge h$, and for all $\delta > 0$, there is a constant $C < \infty$ (depending on $T,\alpha$) and $\lambda_0 < \infty$ (depending on $T, \delta,\alpha$) such that for all $\lambda \ge \lambda_0$
Remark. Theorem 4.2 confirms that the rescaled processes $(A^{(\lambda)}(t), B^{(\lambda)}(t))$ converge in probability to the deterministic solutions of the delay equations as $\lambda \rightarrow \infty$ for all t in the interval [0, T]. This kind of behavior is familiar for Markov jump processes. One novelty of Theorem 4.2 is that although the processes are not Markov, because of the delay time h, nevertheless the same kind of limiting behavior holds, albeit with the more complicated delay differential equation.
The proof of Theorem 4.2 relies on martingale techniques. The constants C and $\lambda_0$ that appear in the theorem depend on $\alpha$, the initial conditions for the process. Simulations of the tangle process [Reference Ferraro, King and Shorten10] have shown that the delay equations (3.5) give an accurate representation of the tangle even for relatively small values of $\lambda$.
The next result shows that the solution of the delay equation (3.5) converges to a constant as $t \rightarrow \infty$.
Theorem 4.3. Let $\alpha$ be a DDE initial condition, and let $(a_{\alpha}(t),b_{\alpha}(t))$ be the associated solutions of the fluid equations (3.5) as described in Lemma 3.1. Define
Then for all $t \ge 3 h$,
Theorem 4.3 shows that the solutions of the delay equation converge exponentially to their stationary values with rate at least $\mu$. This limiting behavior shows that the number of tips behaves as $2 \lambda h$ to leading order for large arrival rates.
5. Proof of Theorem 4.1
Theorem 4.1 will be proved by embedding the process $\{X_n\}$ in a discrete Markov chain $\{\mathcal{X}_n\}$ and using standard techniques to prove ergodicity of $\{\mathcal{X}_n\}$. We define the extended state space
and for $n \ge m$ we define the $\Omega$-valued process
The transition matrix for $\mathcal{X}_n$ is defined by
The conditional distribution of $X_{n+1}$ is determined by $X_n$ and $X_{n-m}$, as shown in (2.7), (2.8), (2.9), and (2.13), and these values are determined by $\mathcal{X}_n$. Hence $\{\mathcal{X}_n\}$ is a Markov chain on $\Omega$. Let $\omega$ denote the state
Every state in $\Omega$ communicates with $\omega$ (meaning that for every $v \in \Omega$ there is a path with positive probability from v to $\omega$, and vice versa), so the chain is irreducible. Furthermore $\mathbb{P}(\mathcal{X}_{n+1}= \omega \,|\, \mathcal{X}_{n}= \omega) > 0$; hence the chain is also aperiodic. Shortly we will prove the existence of a unique stationary distribution $\sigma$ for $\{\mathcal{X}_n\}$. Assuming this for the moment, a standard coupling argument can be applied to show that for any initial condition $\psi$ and every state $v \in \Omega$,
We define for each $k \ge 1$
and note that
We also define
and hence immediately deduce the desired convergence result
In order to prove the existence of a unique stationary distribution $\sigma$ for $\{\mathcal{X}_n\}$, we will prove that the chain is positive recurrent. We will use the following lemma.
Lemma 5.1. Recall the definition of the state $\omega$ (5.4). There are positive constants $\gamma$, c such that for all $u, v \in \Omega$ with $u_m > 4 m, \, v_m \le 4 m$, and all $n \ge m$,
and
Lemma 5.1 will be proved in Section 8. We now apply the result to prove that the chain is positive recurrent. First, (5.10) implies that the subset $A = \{v \in \Omega \,|\, v_m \le 4m\}$ is a small set [Reference Baxendale3]: let $\mu_{\omega}$ be the atom at $\omega$, and let $\mathbb{P}_v$ denote the distribution of $\mathcal{X}$ with initial value $\mathcal{X}_0 = v$; then
for all $B \subset \Omega$. Second, (5.11) implies that $\mathbb{E}_{\psi}[V(\mathcal{X}_{n+1}) \,|\, \mathcal{X}_n = u] \le V(u) - c$ for $u \in A^c$ where $V(u) = u_m$ (and of course V is uniformly bounded on A). We now apply Proposition 2.3 from [Reference Baxendale3] (which is a version of Theorem 9.1 in Tweedie [Reference Tweedie23]) to deduce that the chain is positive recurrent. So in particular the chain has a unique stationary distribution $\sigma$, as required.
6. Proof of Theorem 4.2
Theorem 4.2 will be proved using standard martingale techniques, as presented, for example, in [Reference Darling and Norris7]. For convenience we will drop the subscripts v, $\alpha$ on the variables. We assume that $\lambda$ is sufficiently large so that $\xi_{\alpha} = \lambda a(0) \ge 1$. Define
The quantity l will appear in many of the bounds derived later in this proof, and will represent the effect of the initial conditions on the constants C and $\lambda_0$ appearing in Theorem 4.2. It follows from (2.17) and (2.9) that
and from (3.9) and (3.13) that
Define for $t \in [0,T]$
so that the quantity of interest in Theorem 4.2 is $\mathbb{P}(g(T) > \delta)$.
We next derive the first inequality in (4.2). Recall from (3.15) that $b(t) = a(t - h) + h$ for all $t \ge h$, and from (2.9) that $L_{n} = X_{n-m} + m$ for all $n \ge m$. Therefore if $t \ge h$ and $t \in [t_n,t_{n+1})$ we have
and therefore (since $g(\!\cdot\!)$ is non-decreasing)
This establishes the first inequality in (4.2). The following lemma extends the bound (6.6) to the interval [0, t].
Lemma 6.1. For all $t \ge h$,
Lemma 6.1 will be proved in Section 8. Next we will derive a bound for the quantity $A^{(\lambda)}(t) - a(t)$. For all $j \ge 0$ we define
Then since $X_0 = \lambda a(0) = \lambda a(t_0)$ we have
The sum $\sum_{j=0}^{n-1} G_{j+1}$ is a martingale, and we will use this fact to bound the probability that it grows too large. The following bounds are derived in Section 8.
Lemma 6.2. We have
Lemma 6.3. We have
We will apply the bounds in Lemmas 6.2 and 6.3 to (6.10). Define the event
so that we have
Combining (6.10), (6.11), and (6.12), it follows on the event E that for any $0 \le n \le \lfloor \lambda T \rfloor$,
where
Since $g(t) \ge 0$, and (6.15) holds for all $0 \le n \le \lfloor \lambda T \rfloor$, this also implies that
Furthermore if $t \in [h,T]$ and $t \in [t_k,t_{k+1})$ we have
where we used the bound $|a'(s)| \le 1$ for all $s > 0$ (which follows from (3.5)). Therefore, on the event E,
Now applying the discrete Gronwall inequality [Reference Agarwal1] to (6.18) we deduce that on the event E, for all $0 \le n \le \lfloor \lambda T \rfloor$,
Given $\delta > 0$ we choose
Then for $\lambda \ge \lambda_0$ we have $\rho + \lambda^{-1} \le 3 \, \theta$ and
and hence (6.19) implies that $g(T) \le \delta$ on the event E. Therefore
and this completes the proof with
7. Proof of Theorem 4.3
Recall the delay equation (3.5) for a(t). Applying Lemma 3.1 we get
Given the solution a(t) for $t \le T$, (7.1) is a linear equation for a(t) in the interval $[T,T+h]$, and we can write down an explicit solution in terms of the solution in the interval $[T-h,T]$. Then by translating coordinates the equation (7.1) can be viewed as providing a map from the space of functions on [0, h] into itself. In order to prove (4.4) we will consider instead $a(t) - h$, so define for $t \in [0,h]$
then from (7.1) we derive
As explained above, we will view (7.3) as a map from x to y. Define the functional $\mathcal{M}$ as the map which takes x to the solution y of the equation (7.3):
with the norms
We will prove the following bounds: for all differentiable x,
where $\kappa$ was defined in (4.3). Before proving (7.6) we note that it implies the bound (4.4): indeed for $t \ge 4 h$, there is an integer $n \ge 2$ such that $(2 n - 1) h \le t < (2 n+1) h$. The first inequality in (7.6) implies that
Define $x_0(s) = (a(s) - h)/2$ for $s \in [h,2h]$. Then for any $t \in [(2 n - 1) h, (2 n+1) h]$ the inequalities (7.6) and (7.7) imply
where we used $C_1 = 2 \| x_0 \|$, and also that $\kappa$ is an increasing function.
So we have reduced the proof to that of (7.6). Given x, let y be the solution of (7.3), and let $t \in [0,h]$. There are three cases.
Case 1.1: $y'(t) = 0$ In this case it follows from (7.3) that $y(t) = x(t)/2$, and hence
Case 1.2: $y'(t) > 0$. Define
Then $y(t_1) < y(t) < y(t_2)$. By assumption x is differentiable, so y $^{\prime}$ is continuous, so if $t_1 > 0$ then $y'(t_1) = 0$, and so $y(t_1) = x(t_1)/2$. If $t_1=0$ then $y(t_1) = y(0) = x(h)$. Therefore in either case
Similarly, if $t_2 < h$ then $y'(t_2) = 0$, and so $y(t_2) = x(t_2)/2$. If $t_2 = h$ then $y(t_2) = y(h)$ and $y'(h) > 0$, so $y(h) < x(h)/2$. Therefore in either case
Therefore
and so we deduce that
Case 1.3: $y'(t) < 0$. Define
Then $y(t_3) > y(t) > y(t_4)$. By assumption y$^{\prime}$ is continuous, so if $t_3 > 0$ then $y'(t_3) = 0$, and so $y(t_3) = x(t_3)/2$. If $t_3=0$ then $y(t_3) = y(0) = x(h)$. Therefore in either case
Similarly, if $t_4 < h$ then $y'(t_4) = 0$, and so $y(t_4) = x(t_4)/2$. If $t_4 = h$ then $y(t_4) = y(h) > x(h)/2$, and thus in either case
Therefore
and so we deduce again that for this case
Putting together these three cases we have the bound
This immediately implies that $\| y \| \le \| x \|$, which is the first inequality in (7.6). For the second inequality, we will provide a bound for $|y(h)|$ in terms of $\| x \|$, which will be combined with (7.20) to derive (7.6). Again we examine several cases.
Case 2.1: $y'(h) = 0$. In this case $y(h) = x(h)/2$ and so $|y(h)| \le \|x\|/2$.
Case 2.2: $y'(h) < 0$. In this case $y(h) > x(h)/2$. We assume that $y'(t) < 0$ for all $t \in [0,h]$: if this is not true, then as with Case 3 we deduce the existence of $t_3$ such that $y(h) < y(t_3) = x(t_3)/2$, and then we have $x(h)/2 < y(h) < x(t_3)/2$, which implies $|y(h)| \le \|x\|/2$. We also assume that $y(h) > 0$: if $y(h) \le 0$ then the inequality $y(h) > x(h)/2$ implies $|y(h)| \le \| x \|/2$. Since y(t) is monotone decreasing and $y(h) > 0$, this implies that $y(t) > 0$ for all $t \in [0,h]$. Also $y'(t) < 0$ implies
Suppose first that there is some $t \in [0,h)$ such that
Then
and therefore
If no such t exists then we have
and hence (since by assumption $y(t) > 0$)
We immediately deduce that
Putting together these two possibilities we get
Case 2.3: $y'(h) > 0$. The analysis of this case is identical to that of Case with some signs reversed, and the same conclusion holds.
Combining Cases , , and , we conclude that the bound (7.28) holds in all cases. Using (7.20) we conclude that
Finally we return to the second inequality in (7.6), and deduce from (7.29) that
8. Proofs of lemmas
8.1. Proof of Lemma 3.1
The formulas (3.9) and (3.11) show that (a(t), b(t)) is uniquely defined and differentiable in the interval (0, h), and is continuous at $t=h$. The iterative construction described for the intervals $[0,h], [h,2h], \dots$ produces a unique differentiable solution in every interval $(j h, (j+1) h)$ for $j=1,2,\dots$. The solution is clearly continuous at $t= j h$ for all $j \ge 1$. It is also differentiable at $t= j h$ for all $j \ge 2$, because it satisfies the differential equations (3.5) in both intervals $((j-1) h, jh)$ and $(j h, (j+1) h)$. Properties (1), (2), (3) follow by construction. To see that Property (4) holds, let $c(t) = b(t) - a(t)$ and consider first the interval [0, h], where we have
Therefore for some constant K we have
Evaluating at $t=0$ we see from (3.7) that $K=0$, and hence we have at $t=h$ the relation
Now for $t \ge h$ we have
and thus for some constant K $^{\prime}$
Evaluating at $t=h$ we deduce that $K'=0$, and this establishes Property (4). Property (5) follows immediately.
8.2. Proof of Lemma 3.2
From (2.17) and (3.9) we derive for $0 \le n \le m$ that
where
We also have from the definition of $\xi_{\alpha}$ that
We now introduce a product probability measure on $\mathcal{S}(m)$ so that the coordinates $v_{-m+1},\dots,v_0$ are independent random variables: for any sequence $(u_{-m+1},\dots,u_0)$,
The distribution $\mathbb{P}_j$ is chosen so that
(since $0 \le x_j \le 2$ this is always possible). Define
Since the $\{v_j\}$ are independent with finite variances and (8.10) holds, we can apply Kolmogorov’s maximal inequality [Reference Billingsley4] and deduce that for any $\delta > 0$
Since $|v_j| \le 2$ for all j, we have ${\rm Var}[v_j - x_j] \le 4$, and hence by independence
Taking $\delta = 4 h^{1/2} \, \lambda^{1/2}$ we deduce that
Therefore, using (8.8) and the formula (8.6), we get
and so we deduce that $F(\alpha, \lambda)$ is non-empty.
8.3. Proof of Lemma 5.1
For every $v \in A$, we have $|v_m - m| \le 3 m$. Thus, there is a sequence $\mathcal{X}_n,\mathcal{X}_{n+1},\dots,\mathcal{X}_{n+3m}$ with positive probability such that $\mathcal{X}_n=v$ and $X_{n+3m}=m$. We choose $X_{n+3m+1}=m,\dots,X_{n+4m}=m$, so that $\mathcal{X}_{n+4m}=\omega$, and thus we have constructed a path with positive probability leading from $\mathcal{X}_n=v$ to $\mathcal{X}_{n+4m}=\omega$. Let
then we have
This establishes (5.10) with $\gamma = \kappa^{4m}$.
We also have for $u \in A^c$ that
and this establishes (5.11) with $c = 1/12$ (since $m \ge 1$).
8.4. Proof of Lemma 6.1
We derive a uniform bound for the difference $B^{(\lambda)}(s) - b(s)$ in terms of the function g and an error term coming from the initial conditions. Recall that by assumption $v \in F(\alpha, \lambda)$; therefore
Furthermore, if $t \in [0,h]$ and $t \in [t_n,t_{n+1})$, then
Therefore (8.22) and (8.23) together imply that
where we have used $ h \lambda \ge 1$. Combining (6.6) and (8.24) we get the uniform bound
8.5. Proof of Lemma 6.2
We use the martingale property to bound the first sum on the left side of (6.10). Using (6.8) we have
It follows that $G_{j+1}$ is $\mathcal{F}_{j+1}$-measurable, and
Furthermore $|G_{j+1}| \le 2$, so $\{G_j\}$ is a bounded martingale difference series relative to the filtration $\mathcal{F}_n$. Therefore $\sum_{j=0}^{n-1} G_{j+1}$ is a martingale, and $\big(\!\sum_{j=0}^{n-1} G_{j+1}\big)^2$ is a submartingale, so we can apply Doob’s martingale inequality [Reference Billingsley4] to deduce that for $N = \lfloor \lambda T \rfloor$ and any $\theta > 0$,
8.6. Proof of Lemma 6.3
We write
Using the bounds $A^{(\lambda)}(s) \le B^{(\lambda)}(s)$ and (6.2), (6.3), (6.4), and (6.7), we have from (8.31) that
Therefore we deduce from (8.30) that
which gives the bound
9. Discussion and future directions
Theorem 4.2 confirms that the tangle process converges (in probability) to the solution of the delay differential equation (3.5). This convergence was explored using numerical simulations in the paper [Reference Ferraro, King and Shorten10], and was observed to give an accurate representation of the behavior even for relatively small values of the arrival rate $\lambda$. There are several interesting questions which arise out of this result. One question is to describe fluctuations of the rescaled process $A^{(\lambda)}(t)$ around the deterministic solution a(t) of the delay differential equation. Theorem 4.2 shows that the scale of fluctuations is not larger than $\lambda^{-1/2}$. This is also the scale of the martingale central limit theorem, and it would be interesting to determine whether the fluctuations are Gaussian in leading order. Another interesting question concerns h, the duration of the proof of work. In this paper we assumed throughout that h is constant; however, it would be natural to consider h as a random variable. Finally, the convergence of the tangle model to its fluid limit for other tip selection algorithms is also an interesting problem.
Appendix A. Remarks on the security of the tangle
The result of Theorem 4.1 has some implications for the security properties of the tangle, as we now discuss. The cumulative weight C (u, t) of a transaction u at time t is defined to be the number of transactions which approve u at time t. Recall that a transaction v is said to approve a transaction u if there is a directed walk which starts at v and ends at u. The security of a transaction u is directly related to its cumulative weight; if an attacker wishes to alter the transaction u without destroying the consistency of the ledger, then the attacker must also alter all transactions which approve u. The most secure situation arises when the cumulative weight of every transaction grows linearly in time, meaning that every transaction in the tangle is approved by a fixed fraction of all new arrivals. (This is automatic for the blockchain, but it is not guaranteed for a DAG-based ledger). As we will describe below, the ergodicity results in Theorem 4.1 can be used to show that the tangle has this property.
Let y label the vertex which starts the approval process at time $t_0 = t_{n_0}$, and which is subsequently attached to the tangle at time $t_{0} + h$ (see Figure 2). Let $n_1$ be the smallest integer such that the tangle contains the directed edge $\langle y_{n_1}, y \rangle$, so that $y_{n_1}$ is the first subsequent vertex which approves y. Similarly, let $y_{n_2}$ be the first transaction which approves $y_{n_1}$, and so on for $y_{n_3}$, $y_{n_4}$, etc. Then the cumulative weight of u at time t can be bounded below by
In order to show that C(u, t) grows linearly as a function of t, it is sufficient to show that the right side of (A.1) grows linearly. We now present a heuristic argument for why this should be true. The sequence $\{n_j\}$ can be regarded as an arrival process, so the right side of (A.1) is the number of arrivals in the interval $[t_0 +h, t]$. It is reasonable to suppose that the sequence of interarrival times $\{t_{n_{j+1}} - t_{n_j}\}$ is well-behaved, and behaves like a renewal process with finite mean. By analogy with the elementary renewal theorem, this would support the conclusion that the right side of (A.1) would grow linearly in t (almost surely as $t \rightarrow \infty$), and thus we would have a guarantee that the cumulative weight also grows linearly in t. This would be an important security feature of the tangle, as it would compel an attacker to ‘outrun’ the honest users on the tangle.
As noted before, this is a heuristic argument, but we can use the result of Theorem 4.1 to analyze one piece of the argument, namely to establish finiteness of the interarrival time $\{t_{n_{j+1}} - t_{n_j}\}$. We let $D = n_1 - n_0$ denote the number of steps until the first approval of the vertex y. Then
The relation (A.2) can be shown by conditioning on the process $\{X_j,L_j\}$ and noting that for $l \ge 1$,
Fix $k, c >0$ and let $E_l(c,k)$ denote the event
Then
Theorem 4.1 can be used to show that $l^{-1} \, | \{j \in [n_0,n_0+l] \, \text{such that} \, L_j \le k\} |$ converges almost surely to a positive constant as $l \rightarrow \infty$. This follows because the quantity $l^{-1} \, | \{j \in [n_0,\break n_0+l] \, \text{such that} \, L_j \le k\} |$ can be expressed as a function defined on the Markov chain $\{\mathcal{X}_n\}$, and then the ergodic theorem for Markov chains gives the convergence [Reference Breiman5]. Therefore for c sufficiently small, $\mathbb{P}(E_l(c,k)) \rightarrow 0$ as $l \rightarrow \infty$. This establishes the result (A.2). Furthermore, it may be possible to derive large deviation bounds for the sequence $\{X_n\}$, which could be used to provide an estimate for the exponential rate of convergence in (A.2).
Acknowledgements
The author thanks R. Shorten and P. Ferraro for helpful discussions and suggestions, and J. Pender for communicating the results of the papers [Reference Novitzky, Pender, Rand and Wesson17], [Reference Pender, Rand and Wesson18], [Reference Pender, Rand and Wesson19].