Truthful and Faithful Monetary Policy for a Stablecoin Conducted by a Decentralised, Encrypted Artificial Intelligence

T ruthful and F aithful Monetary P olicy for a Stablecoin Conducted b y a Decen tralised, Encrypted Artificial In telligence Da vid Cerezo Sánc hez david@cal ctopia.com Septem b er 18, 2019 Abstract The Holy Grail of a decentra lised stablecoin is achiev ed on rigor- ous mathematical frame works, obtaining m ultiple adv antageo us pro ofs: stabilit y , conv ergence, truthfulness, faithfulness, and malici ous-security . These prop erties could only be attained by the no vel and in terdisciplinary com bination of previously unrelated fields: model pred ictive con trol, deep learning, alternating direction metho d of multipliers (consensus-ADMM), mec hanism design, secure m ulti-party computation, and zero-knowledge proofs. F or the first time, th is pap er prov es: - th e feasibili ty of decentralisi ng th e central bank while securely pre- serving its indep endence in a decentrali sed computation setting - the benefit s for price stabilit y of com bining mechanism design, pro v - able securit y , and control theory , unlike the heuristics of prev ious stable- coins - t h e implementa tion of complex monetary p olicies on a stablecoi n, equiv alent to ones used b y cen tral banks and b eyond the current fixed rules of crypto currencies that hinder their price stabilit y - method s to circum vent the impossibilities of Guaran teed Output De- liv ery (G.O.D.) and fairness: standing on truthfulness and faithfulness, w e reac h G.O.D. and fairness under the assumption of rational parties As a corollary , a decentralised artificial intell igence is able to conduct the monetary p olicy of a stablecoin, minimising human in terven tion. 1 In tro duction The Holy Grail of a stableco in[Her18], a n asset with all the benefits of decentrali- sation but none o f the volatilit y , remains the mo st elusiv e sing le-horned creature of the cry pto cur r ency market. In fact, price stability is the most want ed feature of a crypto currency : in a recent survey[BCC + 19], hedging agains t deprecia tion risk (i.e., price stabilit y) w as the most important attribute and it has a muc h 1 higher fea ture than a nonymit y (40% vs. 1%) or illiquidity r isk ; how ever, sub- jects of the survey as signed to the anonymous medium-of-payment a v alue on av erag e only 1 .4 4% higher than to the non-anonymous medium-of-paymen t. In monetary economics, monetary po licy r ules r efer to a set of rule of th umb that the central ba nk is committed to, so it can maintain the price stabil- it y of a currency (T aylor rule, McCallum rule, infla tion ta r geting, fixed ex- change rate targeting, nominal income targeting, etc). How ever, the fixed rules for the emiss ion of most crypto currencies[Mo u19 ] ca nnot maintain price sta- bilit y: the inflexibilit y o f their emission rules and their inelas ticit y of supply prov oke part of the hig h volatility of the crypto currency market ; their lack of go o d moneta ry rules preclude their wide used as money[Cac1 8 ] a s they lack clear a c lear fo c us on monetary equilibrium; instead, they feature technical rules for stabilising the difficulty of mining[NO H1 9], but not monetary rules. Stablecoins[MIOT19, BKP19, PHP + 19] w er e bor n to explicitly solve the volatil- it y problem of cry ptocur rencies: ho wev er, their current formulation re lies o n heuristics[Mak19, KKMP19, Lee14, SI19, IKMS14] without a genera l mathe- matical fra mework within which adv antageous prope rties can b e mathemati- cally proven suc h as stabilit y and conv erge nce . Stablecoins lacking stability regimes a nd/or convergence gua r antees suffer from the insta bilities of unstable domains and delev era ging spirals tha t caus e illiquidity during cr ises[KMM19]: these shor tcomings cause pr ice volatilit y , making crypto currencies unusable as short-term stor es o f v a lue a nd mea ns of paymen t, increasing barr ie r s to adop- tion. This pap er in tro duces the no vel com bination of multiple mathematical frame- works in order to desig n a decentralised stablecoin by inheriting m ultiple useful prop erties of said frameworks: stabilit y , conv er gence, truthfulness, faithfulness, and malicious-s ecurity . Con tributions The main and nov el co n tributions ar e: • first forma l treatmen t of dec e ntralised stablecoin within which m ultiple mathematical prop erties can b e pr ov en: stability , conv ergence, truthful- ness, faithfulness, and malicio us-security . • dynamical mo dels o f economic systems: currency prediction with deep learning, a nd stabilisation and emission of stablecoins. • decomp osition of Mo del Predictiv e Controllers with conse n sus-ADMM for their implementation in decentralised netw orks (i.e., blo ck chains). • protection a gainst malicious a dv er saries in said decent r alised net works. • from mechanism design, pro ofs to g uarantee truthfulness fo r all the pa rties in volved and faithfulness of the execution for the decentralised implemen- tation. 2 2 Related Previous crypto curr encies with a c o nt r o lled money suppy similar to a cen- tral bank cur rency were cent r alised[DM15, She16, HLX17, WKCC18]: for first time, this pap er s o lves the decentralisation o f the monetar y p olicy , achieving a fully decent r alised crypto curr ency when combined with a pu blic p e r missionless blo ck chain. Most stablecoins are centralised: the few ones that a re decen tra lised (e.g., [Mak19]), rely on heur istics without a g eneral mathematical framework within which adv antageous prop erties can b e ma thematica lly prov en such as stability and conv erg ence. 3 Bac kground This s e c tio n provides a brief in tro duction to the main technologies of the decen- tralised stablecoin: blo ck chains, mo del predictive control, alternating direction method of multipliers (ADMM), mechanism design, secure multi-part y co mpu- tation, a nd zero -knowledge pro o fs. A high-level and co nceptual rendering of the in ter r elationship betw een these techniques can b e found in Figure 1. Blo ck c hains A blo ckc hain is a distributed ledger that stores a g r owing list of unmo difia ble records called blo cks that are linked to pr e v ious blo cks. Blo ck chains can be used to ma k e online s ecure transactions, authen ticated by the collabo - ration of the P2P no des allowing participants to verify a nd audit trans a ctions. Blo ck chains can b e cla ssified acco rding to their op enness. O pen, p ermissionles s net works don’t hav e a ccess controls and reach decentralised consensus through costly Pro of-of-W ork calculations ov er the most recently a ppended data b y min- ers. Permissioned blo c kchains hav e identit y sys tems to limit participation a nd do not rely on Pro ofs-of-W ork. Blockc hain-based smart c o n tr acts ar e computer progra ms executed b y the no des and implemen ting self-enfor ced contracts. They are usually executed b y a ll o r man y no des ( on-chain smart c ont r acts ), thus their co de must be designed to minimise ex ecution costs. L a tely , o ff-ch a in smar t con- tracts frameworks are b eing developed that allow the execution of more complex computational pro cesses. Mo del Predictiv e Control A dv anced metho d of pro cess con tro l including constraint satisfaction: a dynamica l model of a system is used to pr e dict the future evolution of sta te tra jectories while b ounding the input to an admissible set of v alues determined b y a set of co ns tr aint s, in order to optimise the control signal and acco un t for p oss ible violation of the state tra jectories; at every time step, the o ptimal sequence ov er N steps in determined but only the first element is implemented. Mo del Predictive Control is widely used in industrial settings, and its large litera ture contains pro o fs of feasibilit y , stabilit y , conv ergence, ro - bustness a nd ma n y other useful prop erties that could b e reused in many other settings. 3 In this pap er, multiple dynamic systems for Mo del Predictiv e Control w ill be in tro duced: Economic Mo del for an Algor ithmic Stablec o in and Economic Mo del fo r a Co llaterised Stablecoin; Economic Mo del for a Ce ntral-Banked Currency; Decentralised Pre diction of Cur r ency Prices thro ugh Deep L e a r n i n g ; Decen tra lised Stabilisa tion of Stablecoins; and Auction Mechanism for Iss uing Stablecoins. Alternating Direction Metho d of M ul tipliers (ADMM ) Class of al- gorithms to solve distributed conv ex optimisation problems b y break ing them in to sma ller piec e s , and distributing b et ween m ultiple par ties[BPC + 11]. Itself a v ar iant of the augmented Lagra ng ian metho ds that use partial upda tes for the dual v aria ble, it requir es exchanges o f information be t ween neighbor s for every iteration until conv erging to the result. In this pap er, mult iple optimisation problems expressed in Model Predictive Control will b e deco mp ose d with ADMM techniques in or der to decentralise their computation be tw een multiple parties: Decen tra lised Prediction of Cur rency Prices thr o ugh Deep Le arnin g ; Decen tra lised Stabilisa tion of Stablecoins; and Decent r alised Implementation o f Auction Mech a nism. Mec hanism De s ign Also called “reverse game theory”, is a field of game theory and eco no mics in which a “game designer” c ho oses the game structure where play ers a ct ratio na lly and engineers incentiv es or econo mic mechanisms, tow ard desired o b jectives pur suing a pre deter mined game’s o utcome. In this pap er, parties truthfully rep ort pr iv ate informa tio n 5 (stra tegy-pro ofness) and faithfully execute a pr oto col (definition 1 0, theorem 12, theorem 2). Secure M ulti-P art y Com putation Proto cols for secure multi-part y com- putation (MPC) enable m ultiple parties to jointly co mpute a function o ver in- puts without disclosing said inputs (i.e., s ecure distributed computation). MPC proto cols usually aim to a t least satisfy the co nditions of inputs priv acy (i.e., the only information that can be inferred ab out priv ate inputs is whatever can be inferred fro m the output of the function alone) and co rrectness (adversarial parties should not b e able to force honest parties to output a n incorrect result). Multiple security mo dels ar e av a ilable: semi-honest, where corrupted parties are passive adversaries that do not devia te from the proto co l; covert, where adver- saries may deviate ar bitrarily from the proto col sp ecification in an a ttempt to cheat, but do not wis h to b e “caug h t” doing s o ; and ma licio us security , where corrupted parties may arbitra rily deviate from the proto col. W e utilise the framework SPDZ[DPSZ11], a multi-part y protoco l with ma- licious security . Zero-Kno wle dge Pro ofs Zero-knowledge pro ofs are pro ofs that prov e that a certain statement is true and nothing else, without revealing the prover’s secr e t for this s tatemen t. Additionally , zero-knowledge pro o fs of knowledge also prov e that the prov er indeed knows the secr e t. In this paper, zero-knowledge pro ofs are used to pr ov e tha t a lo cal c o mpu- tation was executed corr ectly . 4 Figure 1: Hig h-level rendering o f the c o m binatio n of techniques 4 Economic Mo dels W e formalis e a basic mo del of a cr ypto currency 1 issuing v ariable blo ck rewards and p erio dically auctioning a v ariable amount of unissued coins from its un- capp ed and dynamically adjusted s upply: all these thr e e v ar iables are constantl y adjusted b y a dyna mical system using Sto chastic Mo del Predictive Control in order to maintain price stability (i.e., c ont r olled v aria bles). Let t ∈ T = { 1 , . . . , T } denote the time slots used by the block chain. Let S max ( t ) denote the maximum s upply of a crypto curr ency , S outstanding ( t ) the supply that is visible o n-chain, S initial the initially issued supply b y an initial offering ev ent (i.e., an initial auction) and S unissue d ( t ) is the amoun t of cryp- to currency yet to b e issued. Then, we hav e: 0 ≤ S initial ≤ S outstanding ( t ) ≤ S max ( t ) , ∀ t ∈ T , (4.1) S initial = S outstanding (1) , (4.2) S max ( t ) = S unissue d ( t ) + S outstanding ( t ) . (4.3) P erio dica lly , miner s are b eing rew ar ded for successfully pr o cessing blo cks with 1 DISCLAIMER: the simplified mo dels i n the present pap er are only f or illustrative pur- poses. Complex and parameterised mo dels are needed f or real-world s ettings. 5 a v ariable amount o f blo ck r ewards, B R ( t ) : S outstanding ( t + 1) = S outstanding ( t ) + B R ( t ) , ∀ t ∈ T , (4.4) S unissue d ( t + 1) = S unissue d ( t ) − B R ( t ) , (4.5) 0 ≤ B R ( t ) ≤ B R max . (4.6) Auctions are ca rried o ut to issue coins from the po ol of S unissue d ( t ) , each auction releasing a v aria ble amount of auctioned coins, AU C coins ( t ) , with x i ( t ) denoting the amount of co ins demanded by participant i , ∀ t ∈ T : S outstanding ( t + 1) = S outstanding ( t ) + AU C coins ( t ) , (4.7) S unissue d ( t + 1) = S unissue d ( t ) − AU C coins ( t ) , (4.8) 0 ≤ AU C coins ( t ) ≤ AU C max , (4.9) x min i ( t ) ≤ x i ( t ) ≤ x max i ( t ) , (4.10) X i x i ( t ) − AU C coins ( t ) = 0 . (4.11) Let P ( t ) denote the market price of a coin at time t in a currency (i.e., the n umber of cryptocur rency coins that one unit of currency -EUR, J PY, USD- will buy a t time t ) and we adopt a geo metr ic Br ownian motion mo del: ∆ P ( t ) = P ( t + 1) − P ( t ) , (4.12) dP ( t ) = µP ( t ) dt + σ P ( t ) dW t , (4.13) where W t is a W e iner pro cess . Let { S max ( t ) , B R ( t ) , AU C coins ( t ) } be the con- trolled v ariables. Thu s, in or der to maintain price sta bility , these controlled v ar iables w ill expand when the price is increa sing a nd contract when the pr ice is low ering: S max ( t ) ∼ S max ( t − 1) · P ( t ) P ( t − 1) , (4.14) B R ( t ) ∼ B R ( t − 1) · P ( t ) P ( t − 1) , ( 4 .15) AU C coins ( t ) ∼ AU C coins ( t − 1) · P ( t ) P ( t − 1) . (4.16) 4.1 Economic Mo del for an Algorithmic Stablecoin Consider the sto chastic linear state space s ystem in the form x k +1 = Ax k + B u k + w k (4.17) y k = C y x k + v k (4.18) z k = C z x k (4.19) where A, B , C y , C z are state space matrices , x k ∈ R n x is the sta te vector, u k ∈ R n u is the input vector, y k ∈ R n y is the output vector, z k ∈ R n z is the vector of 6 controlled v aria bles, w k ∈ R n x is the nois e vector o f the pr o cess, a nd v k ∈ R n y is the vector of measur emen t noise. Let N b e the length of the prediction and receding horizon control and define the vectors N i = { 0 + i, 1 + i, . . . , N − 1 + i } u =  u T 0 u T 1 . . . u T N − 1  T , x =  x T 1 x T 2 . . . x T N  T , z =  z T 1 z T 2 . . . z T N  T , w =  w T 1 w T 2 . . . w T N  T Define the following exchange rate function measuring the cumulativ e exchange rate b etw een the price of a currency (e.g., EUR, JPY, USD) and a stablecoin in the sto chastic state space system 4.17 in the following N time steps, ψ xch ( u ; ¯ x 0 , w ) = { φ ( u, x, z ) | x 0 = ¯ x 0 , x k +1 = Ax k + B u k + w k , z k +1 = C x k +1 , k ∈ N 0 } , (4.20) Let P ( t ) b e the spot price of the stablecoin cryptocurr ency denominated in a currency (e.g., EUR, JPY, USD). Then, the cumulative exchange rate at time t is φ ( u, x, z ) = N X t =1 ( P ( t + 1 )) (4.21) F o llowing a cr iterion of so cial welfare maximisatio n, user s a nd holders of the sta- blecoin pr efer to minimise the volatility of the exchange rate, with the following equation describing the minimisation problem minimise ∀ t λE [ ψ xch ] + (1 − λ ) V ar [ ψ xch ] (4.22) with λ ∈ [0 , 1 ] determines the trade-off betw een the exp ected exchange ra te a nd the exchange rate v ariance. 4.2 Economic Mo del for a Collaterised Stablecoin W e extend the basic mo del of a cr yptoc urrency (4), with a reser ve R ( t ) ba cking every issued coin w ith λ units of the reserve asset: for example, λ = 1 for a 1 to 1 peg against a curr ency (e.g., EUR, JPY, USD), a nd λ > 1 for an ov erco llaterised stablecoin backed with other c r ypto currencies. Then, we hav e: R ( t ) = λ · S outstanding ( t ) , (4.23) 0 ≤ R ( t ) ≤ λ · S max ( t ) , (4.24) In o r der to maintain price stability , λ ( t ) could also be a controlled v a riable that will incre a se when the price is lo wering and cont ra ct when the pr ice is increasing : λ ( t ) ∼ λ ( t − 1) · P ( t − 1) P ( t ) , (4.25) 1 ≤ λ ( t ) ≤ λ max . (4.26) 7 4.3 Economic Mo del for a Cen t ral-Bank ed Currency The framework a nd results of this pap er could a lso be applied to the mone- tary p o licy co nducted by central bank s , just by representing their mo dels in the framework of Mo del Predictive Control in a wa y similar to the pre vious Economic Mo del for an Algo rithmic Stablecoin. The T aylor rule[T ay93] is an approximation of the re s po ns iv enes s of the nominal shor t-term in tere s t rate i t as applied by the central bank to changes in inflation π and output y , according to the following formula i t = ϕ y ( y t − y ∗ ) + ϕ π ( π t − π ∗ ) + π ∗ + r ∗ (4.27) where a s tandard mo del descr ibes the evolution of the economy π t +1 = π t + αy t + e π t +1 , (4.28) y t +1 = ρy t − ζ ( i t − π t ) + e y t +1 , (4.29) describing the dynamic relations hip b etw een the manipulate d input i t and the t wo controlled o utputs y t and π t . A t equilibrium, we obtain i t = i ∗ , π t = π ∗ , y t = 0 and r ∗ = i ∗ − π ∗ . Equations 4.28 and 4.29 can b e rewritten in the terms of deviation v aria bles fro m the equilibrium p oint, a s x t +1 = Ax t + B u t + ǫ t +1 , (4.30) where x =  y − y ∗ π − π ∗  , u = ∆ i = i − i ∗ , ǫ =  e y e π  , (4.31) A =  ρ ζ α 1  , (4.32) B =  − ζ 0  (4.33) The cost function of the central bank is o f the s tandard optimal control form α X k =0 β k L  ˆ x t + k | t , u t + k | t  (4.34) where β ∈ (0 , 1) is the discount factor, ˆ x t + k | t is the exp ected v a lue of x at time t + x using all information a v ailable at time t and mo del 4.30; u t + k | t is the input v alue at time t + k decided o n at time t ; and the M function is usually defined as M  ˆ x t + k | t , u t + k | t  = ˆ x T t + k | t Q ˆ x t + k | t + R 2 u 2 t + k | t (4.35) with R 2 ≥ 0 and Q  0 . The prev ious e quations 4.34 and 4 .35 can b e r eformu- lated as a n ob jectiv e for Mo del Predictive Control a s min u n P N − 1 k =0 β k  ˆ x T t + k | t Q ˆ x t + k | t + R 2 u 2 t + k | t + S 2 δ u 2 t + k | t  + ˆ x T t + N | t β N ¯ Q ˆ x t + N | t + β N S 2 δ u 2 t + N | t o (4.36) 8 where Q =  1 − λ 0 0 λ  ≻ 0 , 0 < λ < 1 , (4.37) u =  ∆ i t | t . . . ∆ i t + N − 1 | t  T , (4.38) δ u t + k | t = u t + k | t − u t + k − 1 | t , k = 0 , . . . , N (4.39) u t + k | t ≥ − i ∗ , k = 0 , . . . , N − 1 , (4.40) u t + k | t = u t + m − 1 | t , k = m, . . . , N − 1 , (4.41) ˆ x T t + k | t = k − 1 X l =0 A l B u t + k − l − 1 | t + A k x t , k = 1 , . . . , N (4.42) with ˆ x t | t = x t and the v alues of 1 − λ and λ determine the trade-off betw een the output gap and inflation. The decentralised implemen tatio n of the previous Mo del Predictive Co ntrol 4.36 using the ADMM decomp osition technique is left as an exer c is e to the cent r al ba nker. 4.3.1 Closed-Lo op Stabilit y The following closed-lo op structure is obtained from 4.27 a nd 4.30: x t +1 = A ′ x t + ǫ t +1 , (4.43) where A ′ = A + B c T =  ρ − ζ ϕ y ζ − ζ ϕ π α 1  (4.44) Theorem 1. The M o del Pr e dictive Contro l ler for the T aylor rule 4.36-4.42 has close d-lo op stability, if and only if, 0 . 1 ϕ π − 2 . 1 < ϕ y (4.45) ϕ y < 0 . 0 6 ϕ π + 8 . 5 , (4.46 ) ϕ π > 1 . (4.47) Pr o of. The characteristic equation for the matrix A ′ is: f ( µ ) = µ 2 − µ ( αζ − ζ ϕ y − αζ ϕ π + 1 + ρ ) + ( ρ − ζ ϕ y ) (4 .48) where µ is an e ig env a lue of matrix A ′ . The closed-lo o p s ystem is stable when bo th eigenv alues of A ′ are inside the unit disk (Jury[Jur7 4] and Routh[Rou77]- Hurt wiz[Hur9 5] stabilit y criteria), if and only if, 2 + 2 ρ − 2 ζ ϕ y + αζ ( ϕ π − 1) > 0 , (4.49) 1 − ρ + ζ ϕ y − αζ ( ϕ π − 1) > 0 , (4.50) αζ ( ϕ π − 1) > 0 . (4.51) Similar stability results can b e der ived for the Model Predictiv e Controllers o f the Economic Mo del for an Algorithmic Stablecoin and the Eco nomic Mo del for a Co llaterised Stablecoin. 9 4.3.2 On Negativ e In terests The Mo del Predictiv e Cont r o ller for the T aylor r ule (4.36)-(4.42) includes a constraint for the zero low er bo und on the interest rate, equa tion (4.40): u t + k | t ≥ − i ∗ , k = 0 , . . . , N − 1 . In case the central bank wan ts to implement negative interest rates, said equa - tion (4.40) m ust b e remov ed. A p ossible implemen tatio n of negative int er ests for a crypto curr ency star ts by cons ider ing co ina ge ep o chs a nd then defining a depreciation rate for every coinage ep o ch as time ela pses. In the basic mo del of a crypto curr ency (4), we c o uld add the following equa tion: S outstanding ( t ) = T X t =0 ( S minted ( t ) − D T ( t )) , (4.52) S initial = S minted (1) = S outstanding (1) , (4.53) 0 ≤ S initial ≤ S outstanding ( t ) ≤ S minted ( t ) ≤ S max ( t ) , (4.54) where S minted ( t ) is the amount of minted coins at time t and D T ( t ) is the depreciation of coins minted at time t ev aluated at time T , for example, D T ( t ) = min (( T − t ) · D r ate · S minted ( t ) , S minted ( t )) , (4.55) D r ate = 0 . 0 1 , (4.56) for a 1 % depreciation r ate for every coinage ep o ch since the first ep o ch. 5 Decen tralised Prediction of Currency Prices through Deep Learning As noted in previous publications a bo ut predicting markets using Sto chastic Mo del Predictiv e Con tro l techniques[PB17], this appro ach is only justifiable o nly for consisten t pr ediction of the direction of price changes (i.e., s ign changes): th us, it’s a requisite to use artificial int ellige nce techniques to predict price move- men ts in order to maintain price s tabilit y . Of cour s e, price data can b e shifted b y one sampling interv al to the pas t, thereby making the economic mo dels in- dependent of any predictive p ow er : howev er, the corr ect formulation is to use any potential go o d estimate of step-ahead prices as this is the co re of Sto chastic Mo del Predictive Co n tro l. Therefo r e, the exchange rate function 4.2 1 of the mo dels is formulated with one step-ahea d prices ( P ( t + 1) ). A neural netw ork ha s L layers, each defined b y a linear op erator W l and a neural non-linear activ ation function h l . A lay er computes and outputs the non-linear function: a l = h l ( W l a l − 1 ) (5.1) on input a ctiv ations a l − 1 . By nesting the lay ers, compos ite functions are ob- tained, for exa mple, f ( a 0 , W ) = W 4 ( h 3 ( W 3 ( h 2 ( W 2 h 1 ( W 1 a 0 ))))) (5.2) 10 where the co llection of weight matrice s is W = { W l } . T r a ining a neural net work for deep le a rning is the task of finding the W that matches the output activ ations a L to targets y , given inputs a 0 : it’s equiv a lent to the following minimisation problem, given loss function l , minimise W l ( f ( a 0 ; W ) , y ) (5.3) And this is equiv alent to solving the following pr o blem: minimise { W l } , { a l } , { z l } l ( z L , y ) (5.4) sub ject to z l = W l a l − 1 , for l = 1 , 2 , . . . , L, ( 5 .5 ) a l = h l ( z l ) , for l = 1 , 2 , . . . , L − 1 , (5.6) where a new v ariable sto res the output of lay er l , z l = W l a l − 1 , and the output of the link function is r epresented as a vector of activ ations a l = h l ( z l ) . By following the penalty metho d, a ridge penalty function is added to obtain the following unconstrained problem minimise { W l } , { a l } , { z l } h z L , λ i + l ( z L , y ) + β L k z L − W L a L − 1 k 2 + P L − 1 l =1 h β l k z l − W l a l − 1 k 2 + γ l k a l − h l ( z l ) k 2 i (5.7) where { γ l } and { β l } are constants controlling the w eight of ea ch co nstraint, and h z L , λ i is a La g range mul tiplier term. The a dv antage of the previo us formulation resides in that each sub-step has a simple closed-for m solution with only one v ar iable, thus these s ub- pr oblems can b e solved glo bally . The up date steps o f each v ar iable in the minimisation problem 5 .7 are con- sidered as follows: • T o obtain W l , each lay er minimises k z l − W l a l − 1 k 2 : the solution of this least squar e problem is W l ← z l a + l +1 (5.8) where a + l +1 is the pseudo-inv ers e of a l +1 . • T o obtain a l , another leas t-s quares problem mu s t b e solved. The solutio n is a l ←  β l +1 W T l +1 W l +1 + γ l I  − 1  β l +1 W T l +1 z l +1 + γ l h l ( z l )  (5.9) • The upda te for z l requires minimising arg min z γ l k a l − h l ( z ) k 2 + β l k z l − W l a l − 1 k 2 • Finally , the up date of the Lag range multiplier is g iven by λ ← λ + β L ( z L − W L a L − 1 ) (5.10) 11 All the previous steps are listed in the next Algorithm 1: do for l = 1 , 2 , . . . , L − 1 do W l ← z l a + l +1 a l ←  β l +1 W T l +1 W l +1 + γ l I  − 1  β l +1 W T l +1 z l +1 + γ l h l ( z l )  z l ← a r g min z  γ l k a l − h l ( z ) k 2 + β l k z l − W l a l − 1 k 2  end for W L ← z L a + L − 1 z l ← a r g min z  l ( z , y ) + h z L , λ i + β L k z − W L a l − 1 k 2  λ ← λ + β L ( z L − W L a L − 1 ) un til conv er ged; Algorithm 1: ADMM a lgorithm for Deep Learning Finally , note that more adv anced metho ds for tra ining neural netw o rks for deep learning hav e app eared in the litera ture[XWZ + 19, WYCZ19], also considering their co n vergence. 6 Decen tralised Stabilisa tion of Stablecoins F o llowing the Economic Mo del for a n Algor ithmic Stablecoin and its minimisa- tion problem (4.22), the exp ectation of the exchange r ate and the v aria nce of the exchange rate ar e traded off in a mean-v ar ia nce Optimal Cont r o l Problem with the following ob jective function ψ = λE w [ ψ xch ] + (1 − λ ) V ar w [ ψ xch ] (6.1) with λ ∈ [0 , 1 ] determining the tra de-off b etw een the exp ected exchange rate and the exchange rate v ariance. Estimates of prices for the ex p ected exc hang e rate, E w [ ψ xch ] , and the v ariance, V ar w [ ψ xch ] , ar e intro duced as follows E w [ ψ xch ] ≈ µ = 1 S X i ∈ S ψ xch  u ; ˆ x 0 , w i  (6.2) V ar w [ ψ xch ] ≈ s 2 = 1 S − 1 X i ∈ S  ψ xch  u ; ˆ x 0 , w i  − µ  2 (6.3) where w i is sampled from the distribution w and S is the set o f scenarios: when the num b er of sc e narios is large, then ψ ≈ ˜ ψ = λµ + (1 − λ ) s 2 (6.4) The open- lo o p input tra jectory is defined as the tra jectory , u ∗ ∈ U , that minimises (6.4), with U being some input constra in t set. F or the sto chastic 12 linear system (4.1 7), u ∗ can b e express e d a s the solution to the following Optimal Control Problem, minimise { u j ∈ U,x j ,z j ,ψ j } S j =1 ,µ λµ + ˜ λ X j ∈ S  ψ j − µ  2 (6.5) sub ject to  x i , u i , z i  ∈ H  ˆ x 0 , w i  , i ∈ S, (6.6) ψ i ≥ φ  u i , x i , z i  , i ∈ S, (6.7) µ = 1 S P j ∈ S ψ j , (6.8) u i k = u j k , i, j ∈ S, j ∈ M (6.9) where ˜ λ = 1 − λ S − 1 , M = { 0 , 1 , . . . , M } , M ≤ N , H ( ˆ x 0 , w ) = { ( x, z , u ) | x 0 = ˆ x 0 , x k +1 = Ax k + B u k + w k , z k +1 = C z x k +1 , k ∈ N 0 } The prev ious O ptimal Control Problem (6.5) is a conv ex optimisation problem when U is a conv ex s e t and φ is a c onv ex function: an ADMM-based decomp o- sition algo r ithm for (6.5) is presented b elow. 6.1 ADMM Decomp osition The Optimal Control Problem (6.5 ) is r e -written as minimise u ∈ ˜ U ,x, z, ψ, µ λµ + ˜ λψ T ψ + S ˜ λµ 2 − 2 ˜ λµ 1 T ψ , (6.10) sub ject to ˜ Ax + ˜ B u + ˜ w = 0 , (6.11) z = ˜ C x, (6.12) ψ ≥ ˜ φ ( u, x, z ) , (6.13) µ = 1 T ψ /S, (6.14) ˜ Lu = 0 , (6.15) where u =      u 1 u 2 . . . u S      , x =      x 1 x 2 . . . x S      , z =      z 1 z 2 . . . z S      , ψ =      ψ 1 ψ 2 . . . ψ S      , 1 =  1 1 . . . 1  , ˜ A = blkdiag  ¯ A, ¯ A, . . . , ¯ A  , ˜ B = bl kdiag  ¯ B , ¯ B , . . . , ¯ B  , ˜ C = blkdiag  ¯ C , ¯ C , . . . , ¯ C  , ¯ B = blkdiag ( B , B , . . . , B ) , ¯ C = blkdiag ( C , C, . . . , C ) , 13 ¯ A =      − I A − I . . . . . . A − I      , ¯ w i =      w i 0 w i 1 . . . w i N − 1      +      Ax 0 0 . . . 0      , i ∈ S, ˜ w = h  ¯ w 1  T  ¯ w 2  T . . .  ¯ w S  T i T , ˜ φ ( u , x, z ) =  φ  u 1 , x 1 , z 2  . . . φ  u S , x S , z S  T , ˜ L =      L − L L − L . . . . . . L − L      , L =  I 0  , Lu i = h  u i 1  T  u i 2  T . . .  u i M  T i T The previous O ptimal Control Problem (6.1 0) is then tr ansformed into ADMM form, minimise y 1 , y 2 f 1 ( y 1 ) + f 2 ( y 2 ) , (6.16) sub ject to M 1 y 1 + M 2 y 2 = 0 , (6.17) with the optimisation v ariables defined as y 1 =  ˇ u T x T z T ˇ ψ T ˇ µ  T , (6.18) y 2 =  u T ψ T µ T  T (6.19) where g =  0 0 0 0 λ  T , H =   0 0 0 0 ˜ λI − ˜ λ 1 T 0 − ˜ λ 1 S ˜ λ   , (6.20) M 1 =     0 0 0 0 1 0 0 0 0 1 I 0 0 0 0 0 0 0 I 0     , M 2 =     0 − 1 T S 0 0 0 − 1 − I 0 0 0 − I 0     , (6.21) f 1 ( y 1 ) = g T y 1 + I Y 1 ( y 1 ) , (6.22) f 2 ( y 2 ) = y T 2 H y 2 + I Y 2 ( y 2 ) , (6.23) Y 1 = n y 1 | ˜ Ax + ˜ B ˇ u + ˜ w = 0 , z = ˜ C x, ˇ ψ ≥ ˜ φ ( ˇ u, x, z ) o , (6.24) Y 2 = n y 2 | ˜ Lu = 0 o (6.25) 14 6.2 Decen tralised Iterated Computation The Lagr a ngian of (6.16) and (6.17) is L ( y 1 , y 2 , ζ ) = f 1 ( y 1 ) + f 2 ( y 2 ) + ζ T ( M 1 y 1 + M 2 y 2 ) (6.26) where ζ is a vect o r of Lagr angian multipliers for (6.17). In ADMM, p oints satisfying the optimalit y co nditions for (6.1 6) and (6.17) are obtained via the recursions with iteration num be r j y 1 ( j + 1) = arg min y 1 L ρ ( y 1 , y 2 ( j ) , ζ ( j )) = ar g min y 1 f 1 ( y 1 ) + ρ 2 k M 1 y 1 + M 2 y 2 ( j ) + η ( j ) k 2 2 (6.27) y 2 ( j + 1) = arg min y 2 L ρ ( y 1 ( j + 1) , y 2 , ζ ( j )) = ar g min y 2 f 2 ( y 2 ) + ρ 2 k M 1 y 1 ( j + 1) + M 2 y 2 + η ( j ) k 2 2 , (6.28) η ( j + 1) = η ( j ) + ( M 1 y 1 ( j + 1) + M 2 y 2 ( j + 1)) (6.29) where the augmented Lag rangian with p enalty pa r ameter ρ > 0 is defined as L ρ ( y 1 , y 2 , ζ ) = L ( y 1 , y 2 , ζ ) + ρ 2 k M 1 y 1 + M 2 y 2 k 2 2 and η = ζ /ρ is a scaled dual v aria ble. Stopping criteria for the previous recursio ns (6.27), (6.28) and (6.29) is given b y k M 1 y 1 ( j ) + M 2 y 2 ( j ) k 2 ≤ ε P , (6.30) ρ   M T 1 M 2 ( y 2 ( j + 1) − y 2 ( j ))   2 ≤ ε D , (6.31) indicating tha t the algorithm s hould b e stopp ed when the opt ima lit y conditions for (6.16) a nd (6.17) are satisfied w ith accuracy a s defined b y the small tolerance levels ε P and ε D . The following Algorithm 2 describ es the steps of the implementation of the ADMM recursions (6.27)-(6.29): further o ptimisations are p oss ible to parallelise the alg o rithm in S . while not co nverged do // ADMM update of y 1 =  ˇ u T , x T , z T , ˇ ψ T , ˇ µ   ˇ u T , x T , z T , ˇ ψ T , ˇ µ  ← compute via 6.27 // ADMM update of y 2 =  u T , ψ T , µ T   u T ψ T µ T  ← compute via 6 .2 8 // ADMM update of η η ← co mpute via 6 .29 end while Algorithm 2: ADMM a lgorithm for the Optimal Co n tro l Pro blem 6.5-6.9 15 Theorem 2. The pr op ose d d e c entr alise d me chanism in Algorithm 2 is a faithful de c entra lise d implementation. Pr o of. The steps that every ra tional user i will faithfully complete a re the v ari- able up date s teps of (6.2 7)-(6.29) in Algor ithm 2 . Under the as s umption of rational players in a n ex-p ost Na s h equilibrium (11), users can maximise their own utility o nly by maximising the so cial w elfar e (theorem 5). Therefore, ev ery user will faithfully execute the v a r iable upda te steps of (6.27)-(6.29) s ince it’s the only way to maximise s o c ia l w elfar e when all the other rational users ar e following the int ended strateg y . 7 Auction Mec hanism for Issuing Stablecoins A t the b eginning of an auction, each user rep or ts its demand to the a uction manager. W e define the dema nd of user i a s θ i =  x min i ( t ) , x i ( t ) , x max i ( t )  (7.1) Users can mis r epo rt their demands: let ˆ θ i =  ˆ x min i ( t ) , ˆ x i ( t ) , ˆ x max i ( t )  denote the r epo rted demand of user i . The auction manager determines the outcome of the auction including stablecoin allo cation and paymen ts according to the stablecoin allo ca tion r ule, al () . Denote the following v ariable definitions x i = [ x i, 1 , . . . , x i,T ] , y = [ y 1 , . . . , y T ] , v i ( x i ) = P t ∈ T v i,t ( x i,t ) , c ( y ) = X t ∈ T c t ( y t ) . where v i,t ( x i,t ) is a co ncav e function for the v aluatio n of user i at time t and c t ( y t ) is an always-positive conv ex function for the cost of the auction ma nager at time t (i.e., this cost is the market v alue of the a uctioned c o ins, plus other exp enditures for carr ying out the auction). The utilit y of user i is defined as the v aluation minus the paymen t u i  al  ˆ θ  , θ i  = X t ∈ T v i,t ( x i , t ) − X t ∈ T p i,t  ˆ θ  , (7.2) and the utilit y of the a uction manager is the total paymen t min us the total cost, X i ∈ N X i ∈ T p i,t  ˆ θ  − X t ∈ T c t ( y t ) (7.3 ) The stablecoin allo cation rule of the auction mechanism is defined b y the following so cial welfare maximisation pr o blem S : maximise x,y P i ∈ N v i ( x i ) − c ( y ) , (7.4) such that x i ∈ X i , ∀ i ∈ N , (7.5) y ∈ Y , (7.6) P i ∈ N A i x i + B y = 0 , (7.7) 16 where X i is the constraint set of user i for satisfying (4.10) ∀ t ∈ T ; Y is the constraint set of the blo ck chain satisfying (4.1)-(4.9) and (4.12)-(4.16) ∀ t ∈ T ; A i and B i are the constraint set fo r s a tisfying (4.11) ∀ t ∈ T equiv alent to constraint (7.7). The optimal solution to the socia l welfare maximisation problem S is de- noted by { x ∗ , y ∗ } , in whic h x ∗ is the outcome o f stablecoin a llo cation to users whenever all users truthfully rep ort their dema nds to the auction mechanism. The pa yment by user i at time slo t t is defined as the following eq ua tion according to the VCG paymen t r ule[NR07, PS04], p i,t ( θ ) = X j 6 = i v j,t  x − i j,t  − X j 6 = i v j,t  x ∗ j,t  + c t ( y ∗ t ) , (7.8) where x − i =  x − i j,t | j ∈ N \ { i } , t ∈ T  : at the same time, the paymen t by user i at time slo t t is the optimal solution to the following max imisa tion problem that excludes user i , S − i : maximise x P j 6 = i v j ( x j ) , (7.9) such that x j ∈ X j , ∀ j ∈ N \ { i } (7.10) 7.1 Prop erties of the Auction Mec hanism In the propo s ed a uction mec hanism, each user a chieves maximum utility only when said us e r truthfully rep or ts its demand θ i : a mechanism is incentiv e- compatible if truth-revelation by users is o btained in an equilibrium[NR07, PS04]. Let s i ( θ i ) denote the s tr ategy of user i g iven θ i and let θ − i = { θ 1 , . . . , θ i − 1 , θ i +1 , . . . , θ N } Definition 3. (Dominant-Strategy Equilibrium[SPS03 ]). A strategy profile s ∗ is a domina n t-stra tegy equilibrium of a game if, for all i , u i ( f ( s ∗ i ( θ i ) , s − i ( θ − i )) , θ i ) ≥ u i ( f ( s i ( θ i ) , s − i ( θ − i )) , θ i ) (7.11) holds s i ( θ i ) ∈ Θ i , ∀ θ i , ∀ θ − i and ∀ s i 6 = s ∗ i . Definition 4. (Strateg y-Pro of Mechanism[SPS03]). A mechanism is s trategy- pro of if truthfully rep orting demand θ i is the bes t strateg y of user i , no matter what the other users rep o rt: that is, the incen tive-compatibility of a mechanism in a do mina n t-str a tegy equilibrium is o nly achiev ed when the following condition holds u i  f  θ i , ˆ θ − i  , θ i  ≥ u i  f  ˆ θ i , ˆ θ − i  , θ i  (7.12) The pr o po sed auction mec hanism is incentiv e-compa tible a nd s trategy-pro o f in a dominant-strategy equilibrium. 17 Theorem 5. The pr op ose d auction me chanism (7.4)-(7.7) and (7.8) is str ate gy- pr o of. Pr o of. W e prove that each user will truthfully rep ort their demand in order to show that the auction mechanism is strategy-pr o of. F o r their demanded a mount x i ( t ) , the pa yment r ule (7.8) was desig ned a c- cording to the VCG payment rule[NR07, PS04] so that user’s utilit y is max- imised only when it truthfully rep or ts its demand. F o r the low er bound x min i ( t ) , user i will not understa te x min i ( t ) to ensure that the minimum demanded is satisfied. A user will no t overstate x min i ( t ) to av oid limiting the growth of the so cial welfare: to understand the underlying reason, we write the utility of the user with the paymen t rule expa nded u i  al  ˆ θ  , θ i  = v i ( x ∗ i ) − X j 6 = i v j  x − i j  + X j 6 = i v j  x ∗ j  − c ( y ∗ ) , and note that a user ca nno t influence the seco nd term by misrep o rting their demand ˆ θ . A user maximising utility can only maximise the other terms (i.e., so cial welfare). Therefore, user i will not ov ersta te x min i ( t ) . F o r the upper b ound x max i ( t ) , for s imilar r e a sons to the previous x min i ( t ) , understating x max i ( t ) would only limit the growth of the so cial welfare, th us user i is no t incentivised to understate x max i ( t ) . On the other side, overstating x max i ( t ) w ould lead to a larger stablecoin a llo c ation than the r eal user’s demand: the auction manager w ould detect such a situation when later the user is unable to pay the ov erstated a llo cation, and p e nalises the user with m uch higher pr ices for a muc h low er amoun t of coins. Thus, user i will not ov er state x max i ( t ) in order to pre vent p enalties. Theorem 6. The pr op ose d auction is budget-b alanc e d, that i s, the r e c eive d p ay- ment is no less than the total c ost. Pr o of. The total paymen t that the auction manager receives is X i ∈ N X i ∈ T p i,t ( θ ) = X i ∈ N X j 6 = i v j  x − i j  − X i ∈ N X j 6 = i v j  x ∗ j  + N · c ( y ∗ ) Note that X j 6 = i v j  x − i j  ≥ X j 6 = i v j  x ∗ j  bec a use x − i is the optimal solution to (7.9 ) a nd that, by definition, c ( y ∗ ) ≥ 0 . Therefore, we co nclude X i ∈ N X i ∈ T p i,t ( θ ) ≥ N · c ( y ∗ ) ≥ c ( y ∗ ) . 18 8 Decen tralised Implemen tati on of Auction Me c h- anism A decentralised implementation of the centralised auction mec hanism (7.4 ) is achiev ed in this section: proximal dual consensus ADMM[BPC + 11, Cha14] is used to solve problem S . 8.1 Dual Consensus ADMM W e start adding a polyhedra constraint to the stablecoin allo cation r ule (7.4)- (7.7): S : maximise x,y P i ∈ N v i ( x i ) − c ( y ) , (8.1) such that x i ∈ X i , ∀ i ∈ N , (8.2) y ∈ Y , (8.3) P i ∈ N A i x i + B y = 0 , (8.4) C i x i  d i , i = 1 , . . . , N , (8.5) where each x i in (8.5) is a lo c a l constraint s e t of user i co nsisting of simple po lyhedra constraint C i x i  d i , such that there would b e closed-form solutions to efficiently solve all the subproblems a t every iter ation. Let λ b e the dua l v ar iable of constra in t (8.4), and z i be the dual v ar iable of (8.5): the La grange dual problem of S , equiv alent to s olving pro blem S since it’s a concav e maximisation pro blem, is defined by minimise λ,z i X i ∈ N φ i ( λ, z i ) + z T i d i + ψ ( λ ) , (8.6) where φ i ( λ, z i ) = maximise x i ∈ X i  v i ( x i ) − λ T A i x i − z T i ( C i x i + r i )  , ∀ i ∈ N , (8.7) ψ ( λ ) = maximise y ∈ Y  − c ( y ) − λ T B y  (8.8) where r i are slack v ariables. Let’s obtain a cop y of λ for ev ery user i , denoted b y λ i , by rewriting the previous problem into the following equiv alent problem, minimise λ,z i , { λ i } , { λ ′ i } P i ∈ N φ i ( λ i , z i ) + z T i d i + ψ ( λ ) (8.9) such that λ i = λ ′ i , ∀ i ∈ N , (8.10) λ = λ ′ i , (8.11) In blo ck chain se ttings, there co uld b e so me users offline and/or some communi- cation links could b e interrupted: at each itera tio n, each user i has pro babilit y 19 α i ∈ (0 , 1] of being online, and each link ( i, j ) has pro ba bilit y p e ∈ (0 , 1] of be ing in ter r upted; the probabilit y tha t user i and user j are b oth a ctive and a ble to exchange messag es is given by β ij = α i α j (1 − p e ) . F or each iteration k , let Ω k be the set of a ctiv e users and Ψ k ⊆  ( i, j ) | i, j ∈ Ω k  be the set of a ctiv e edges . The v ariable up date steps of the a uction manager at iteration k are given b y the following equations: µ [ k ] = µ [ k − 1] + q X i ∈ N  λ [ k − 1] − λ [ k − 1] i  , (8.12) y [ k ] = arg min y ∈ Y n c ( y ) + q 4 N    1 q B y − 1 q µ [ k ] + P i ∈ N  λ [ k − 1] + λ [ k − 1] i  k 2 2 o , (8.13) λ [ k ] = 1 2 N 1 q B y [ k ] − 1 q µ [ k ] + X i ∈ N  λ [ k − 1] + λ [ k − 1] i  ! (8.14) with µ represen ts the dual v ariables λ i = λ ′ i and q is a p os itiv e constant . The v ar iable up date steps of user i a t iteratio n k a re given by the following eq uations: ∀ i ∈ Ω k : µ [ k ] i = µ [ k − 1] i + 2 q  λ [ k − 1] i − t [ k − 1] ij  , (8.15)  x [ k ] i , r [ k ] i  = arg min x i ∈ X i ,r i ≻ 0 n − v i ( x i ) + q 4    1 q A i x i − 1 q µ [ k ] i +2 t [ k − 1] ij k 2 2 + 1 2 σ i   C i x i + r i − d i + σ i z k − 1 i   2 2 o , (8.16) z [ k ] i = z [ k − 1] i + 1 σ i  C i x [ k ] i + r [ k ] i − d i  , (8.17) t [ k ] ij = ( λ [ k ] i + λ [ k ] j 2 , if ( i , j ) ∈ Ψ k , t [ k − 1] ij , otherwise , (8.18) λ [ k ] i = 1 2 q A i x [ k ] i − 1 2 q µ [ k ] i + t [ k − 1] ij , (8.19) ∀ i / ∈ Ω k : x [ k ] i 6 = x [ k − 1] i , r [ k ] i 6 = r [ k − 1] i , λ [ k ] i 6 = λ [ k − 1] i , z [ k ] i 6 = z [ k − 1] i , µ [ k ] i 6 = µ [ k − 1] i , t [ k ] ij 6 = t [ k − 1] ij ∀ j ∈ N i , (8.20) where σ i are p enalty par a meters. The following stopping cr iteria for the success of the co n vergence a re applied by the auction manag er    λ [ k ] − ¯ λ [ k ]    2 2 + X i ∈ N    λ [ k ] i − ¯ λ [ k ]    2 2 ≤ ε 1 , (8.21)    ¯ λ [ k ] − ¯ λ [ k − 1]    2 2 ≤ ε 2 , (8.22) 20 where ε 1 and ε 2 are sma ll po sitive constants and ¯ λ [ k ] = λ [ k ] + X i ∈ N λ [ k ] i ! / ( N + 1) The following Algorithm 3 s hows the dual consensus ADMM for p roblem S : k = 0 Auction manag er only: µ [0] = 0 , y [0] ∈ R 15 T , λ [0] ∈ R 3 T User i only: µ [0] i = 0 , x [0] i ∈ R 15 T , r [0] i ∈ R 15 T , z [0] i ∈ R 15 T , λ [0] i ∈ R 3 T and t [0] ij = λ 0 i + λ 0 j 2 rep eat k ← k + 1 Auction manag er only: send λ [ k − 1] to every user i Auction manag er only: up date µ [ k ] , y [ k ] and λ [ k ] according to (8.12)-(8.14) for parallel i ∈ N do User i o nly: send λ [ k − 1] i to auction manager User i o nly: up date µ [ k ] i , x [ k ] i , r [ k ] i , z [ k ] i , t [ k ] ij and λ [ k ] i according to (8.15)-(8.20) end for un til convergence is achiev ed by stopping cr iteria (8.21) and (8.22); Algorithm 3: Dual Co ns ensus ADMM for Problem S Theorem 7. Algo rithm 3 c onver ges to the optimal solution of pr oblem S in the me an, with a O (1 /k ) worst-c ase c onver genc e r ate. Pr o of. F o llows from Theor em 2 from [Cha14]. Note that althoug h this ADMM algorithm 3 is only resis tan t aga inst ra ndom failures α i of user s and interruptions p e of the links, and not against p oiso ning attacks that would cor rupt inputs, it’s also poss ible to design ADMM a lgorithms resistant against By zant ine attackers: how ever, it would a lso increa se the num- ber of iterations k , sp ecially whenev er under a ttac k, th us the c ho s en trade-off to ignore the Byzantine setting given the truthfulness of theorem 5 and faithfulness of theorem 12 prop erties of the Decentralised Implementation of Auction Mechanism. 8.2 Decen tralised Mec hanism The decentralised mech a nism features the following steps: 21 Proto col 1 : Decentralised Mechanism of Auction 1. User i rep or ts his demand ˆ θ i to the a uction manager . 2. User i so lv es the following maximisa tion problem S i x ′ i = maximise x i ∈ X i v i ( x i ) (8.23) and s ends the r esult x ′ i to the auction manager: since pr oblem S i only re- quires lo ca l information, it can be solved without collab or ating with other users. The a uction manager so lves problems S − i , ∀ i ∈ N , b y calculating x − i = n x ′ j | j ∈ N \ { i } o (8.24) from the collected x ′ i , thus o btaining { S − 1 , S − 2 , . . . , S − N } . 3. T o obtain the so lution to problem S , Alg orithm 3 is executed: the auction manager obtains results y ∗ and λ ∗ , and every user i obtains x ∗ i and λ ∗ i ; every user i sends x ∗ i to the a uction manager . 4. The a uction manager calculates paymen ts a ccording to (7.8) using the received x ∗ and x − i , and obtains the stablecoin allo ca tion x ∗ . 8.3 Prop erties of the Decen t ralised Mec hanism In the follo wing, we prove that us ers will faithfully e x ecute all the actions of the Decen tra lised Mechanism without ma nipulating the outcome of the auction by strategically mo difying r esults. Definition 8. (Decent r alised Mechanism [PS04]). A decentralised mech a nism d M = ( g , Σ , s m ) defines an outcome rule g , a feasible strategy space Σ = (Σ 1 × . . . × Σ N ) , and a n intended strategy s m = ( s m 1 , . . . , s m N ) . Definition 9. (Intended Strateg y [PS04]). A stra tegy s m is the in tended strat- egy of a decentralised stra tegy-pro of dir ect-revelation mech a nism M d that im- plemen ts outcome f ( θ ) , when f ( θ ) = g ( s m ( θ ) ) for all θ ∈ Θ . Thu s, an in tended strategy s m is a strategy that every user is exp ected to follow: in the Decentralised Mechanism , the intended strategies are all the steps that us e rs must faithfully ex ecute to pr o duce the same outcome as the cent r alised auction mechanism. 22 Definition 10. (F aithful Implemen tation). A decen tralised mechanism d M = ( g , Σ , s m ) is an (ex-p ost) faithful implementation of so cial-choice r ule g ( s m ( θ ) ) when intend ed strateg y s m is a n ex-p ost Nash e q uilibrium. That is, users will follow the in tended strategy in a faithful implementation of a decentralised mec ha nis m if no unilateral deviation can increase their utilit y . Definition 11. (Ex-Post Nash Equilibrium [PS04 , SPS03]). A stra tegy pro file s ∗ = ( s ∗ 1 , . . . , s ∗ N ) is an ex- pos t Nash equilibrium when u i  g  s ∗ i ( θ i ) , s ∗ − i ( θ − i )  ; θ i  ≥ u i  g  s ′ i ( θ i ) , s ∗ − i ( θ − i )  ; θ i  for all a gents, for all s ′ i 6 = s ∗ i , for every demand θ i and for all demands θ − i of other ag en ts. In an ex-p ost Nas h equilibrium, all the other us e r s are assumed rational: th us, user i will no t deviate from s ∗ i when o ther users are following stra tegy s ∗ − i . Theorem 12. The pr op ose d D e c ent r alise d Me chanism is a faithf u l de c ent r alise d implementation. Pr o of. In the Decentralised Mechanism, the steps that every rationa l user i will faithfully complete are the fo llowing: 1. Rep orting ˆ θ i to the a uction manager 2. Solving S i 3. Sending result x ′ i of the pr e vious step 4. Up dating v ariable upda te steps µ [ k ] i , x [ k ] i , r [ k ] i , z [ k ] i , t [ k ] ij and λ [ k ] i of (8.15)- (8.20) 5. Sending λ [ k ] of (8.1 9) to the auction manag er 6. Sending resulting x ∗ i obtained from the last step of (8.16) Users will truthfully execute step 1 due to the truthful-revelation prop erty in a domina n t-stra tegy eq uilibrium o f Theorem 5 that also implies truthful- revelation in an ex-p ost Na sh equilibrium. F urther , the ca lculation o f S i is done lo c a lly without any input fro m other users (i.e., the input from Byza n tine attack er s is never considered) and the auction manager will only take a result x ′ i from each identified user using a sec ur e channel. Mor eov er, the computation o f S i do es not solve pro blems S − i and it cannot mo dify the term P j 6 = i v j  x − i j  in the paymen t rule (7.8) (i.e., the user cannot low er its payment ). Thus, a rational user will faithfully execute steps 2 and 3. Finally , users can ma ximise their own utilit y only b y maximising the so cial welf a re, according to Theorem 5. Therefore, every user will faithfully execute actions 4 - 6, s ince it’s the only wa y to maximise so cial w elfare when all the other rational users are following the intended stra tegy . 23 9 Encrypting ADMM Previous works on encrypting ADMM or Mo del Predictive Control are very scarce: there are some w or ks a b out encrypting mo dels from con tro l theory o r mo del predictive control but only for cloud settings[DRS + 18, AMP18, Aa17, A GS + 18, AMP19], th us non-decentralised; another pap er encr ypts ADMM mo d- els, but using differential priv acy[WID + 19]; yet ano ther pap er encr ypts ADMM mo dels, but in the semi-honest setting[ZA W1 8]; o nly Helen[ZPGS19] encrypts ADMM in the malicious setting, thus it will be our chosen framework . Helen[ZPGS19] s o lves a co ope tive machine learning b etw een multiple par- ties in a malicious setting. Like other works wher e multip le pa rties collab or ate with their own data using secur e multipart y computation[AGP15], they c a n’t handle settings where the pa rties lie a bo ut their inputs (i.e., po isoning attacks). One co uld ar gue that priv acy only makes lying worse: that is, pr iv acy without truthfulness and faithfulness is troublesome ( Pr overbs 12:22 , [Sol3 0]). F ortu- nately , the pr e s en t pa p er solves all these issues by leaning on o ur previous theorems ab o ut truthfulness of theorem 5 and faithfulness o f theorem 12 fo r the Decen tra lised Implementation of Auction Mechanism. 9.1 Cryptographic Gadgets W e utilise the SPDZ fra mew o rk[DPSZ11]: an input a ∈ F p k is re pr esented as h a i = ( δ, ( a 1 , . . . , a n ) , ( γ ( a ) 1 , . . . , γ ( a ) n )) where δ is public, a i is a share of a and γ ( a ) i is the MAX share authenticating a under a SPDZ glo bal key α that is not revealed until the end of the proto col. F o r an SPDZ execution to b e considered as cor rect, the following prop erties m ust hold a = P i a i , α ( a + δ ) = P i γ ( a ) i F r o m Helen[ZPGS19], we re-use the following gadg ets: A zero-knowledge pro o f for the statement: “Given public par ameters: public key P K , encr yptions E X , E Y and E z ; priv ate par ameters X , • D ec S K ( E Z ) = D ec S K ( E X ) · D ec S K ( E Y ) , and • I know X such that D ec S K ( E X ) = X ” Gadget 1 . Plaintext-ciphertext ma trix mult iplica tio n pro of 24 A zero-knowledge pro o f for the statement: “Given public par ameters: public key P K , encr yptions E X , E Y and E z ; priv ate par ameters X a nd Y , • D ec S K ( E Z ) = D ec S K ( E X ) · D ec S K ( E Y ) , and • I know X , Y and Z such that Dec S K ( E X ) = X , D ec S K ( E Y ) = Y and D ec S K ( E Z ) = Z ” Gadget 2. Plaintext-plain text matrix mult iplicatio n pro of F o r m par ties, each pa rty having the public k ey P K a nd a share of the secr et key S K , given public ciphertext E nc P K ( a ) , con vert a int o m shares a i ∈ Z p such that a ≡ X a i mo d p Each par t y P i receives s ecret share a i and do es not learn the o riginal secret v alue a . Gadget 3. Conv erting ciphertexts into arithmethic MPC shares Given public parameters : e ncr ypted v alue E nc P K ( a ) , encrypted S P DZ input shares E nc P K ( b i ) , encrypted S P DZ MACs E nc P K ( c i ) , and interv al pro ofs of plaint ex t knowledge, verify that: 1. a ≡ P i b i mo d p , a nd 2. b i are v alid S P DZ shar e s and c i ’s are v alid MA Cs on b i . Gadget 4. MPC conv ersion verification 9.2 Initialisation Phase During initialisation, the m pa rties compute us ing SPDZ the para meters for threshold encr yption[FPS00], generating a public key P K known to ev er yone. Each party m r eceives a s ha re of the cor r esp onding secret key S K i : all the parties must a gree to decrypt a v alue encr ypted with the shar ed P K . 9.3 Input Preparation Phase In this pha se, each party commits to their inputs b y bro adcasting their en- crypted inputs to all the other parties: additionally , all the par ties prove that they know the encrypted v a lues using zero-knowledge pro ofs of knowledge. Note that encry ptions a ls o serve a s a commitment scheme[Gro09 ]. T o e ns ure that each party consis ten tly uses the same inputs during the en tire proto col a nd to av o id deviations based on what other parties hav e co ntributed, each par t y encrypts and bro adcasts: Enc P K  ˆ θ i  =  ˆ x min i ( t ) , ˆ x i ( t ) , ˆ x max i ( t )  , Enc P K  x ′ i  , Enc P K ( x i ) and Enc P K ( y ) . These encry ptions are accompanied with pro ofs that the co mmitted inputs ar e within a certain ra nge[Bou00]. 25 9.4 Compute Phase In this phase, the v ariable up date steps of the ADMM ar e execu ted, in which parties successively compute lo cally on encrypted data, follow ed by coo r dina- tion steps with other par ties using MPC computation. No party learns any in ter media te step beyond the final results, proving in zero-knowledge that the lo cal computations were p erformed cor rectly us ing the data committed during the input pr eparation phase. 9.4.1 Initialisation and Pre-Computations Initial v a riables ar e initialised to ze r o: µ [0] , λ [0] , µ [0] i , λ [0] i , r [0] i , z [0] i , t [0] ij . A dditionally , the auction manager so lves problems S − i , o btaining x − i from the collected x ′ i in the prepa ration phase. 9.4.2 Local Optim isation Since Algorithm 3 is fully pa rallel a nd decentralised, no te that the v ar iable upda te steps of auction manag er (8.12)-(8.14), or the steps (8.1 5)-(8.2 0) of user i , only require lo cal informa tion a nd iterative exchange of λ [ k ] and λ [ k ] i with its neighbors. Each par t y can independently calculate all the v ar iable upda te steps by doing plaint ex t sca ling a nd plain text-ciphertext matrix multiplication: each par t y also needs to gener ate pro ofs proving that they have calculated the v a riable up date steps corr ectly , using Ga dget 1 (9.1) and Ga dget 2 (9.1). 9.4.3 Co ordination After the lo cal optimisation step, each party exchanges λ [ k ] and λ [ k ] i with its neighbors, and ea c h party als o publishes interv al pr o o fs o f knowledge. W e may not need to use MPC: it’s only required if steps (8.13) o r (8.1 6) a re implemen ted using non-linear functions, which itself depe nds on the concrete functions c ( y ) and − v i ( x i ) . In the b est case, simple c lo sed-form s o lutions with only linear functions could be chosen. But when MPC is needed, the encry pted v aria bles need to b e conv erted to arithmetic SPDZ shares using Ga dget 3 (9.1 ) and calculate the function using SPDZ. After the MPC computation, ea ch party receives shares of the v aria bles and its MAC shares: these shares ar e conv erted back in to encr ypted form by encrypting the sha res, publishing them, a nd summing up the encrypted share s . After all the ADMM calculation, every user i sends x ∗ i to the auction man- ager, which mu st c a lculate payment s acco rding to equation (7.8) to obtain the stablecoin allo ca tion x ∗ : these calculations may also r equire MPC con version and computation. 26 9.5 Release Phase The encrypted model obta ined at the end o f the previous phase is decrypted: all parties must agr ee to decrypt the results and r elease the final data. B efore said releas e, parties must prov e that they correctly executed the conversions betw een ciphertext and MPC shares using Gadget 4 (9.1), in order to preven t that different inputs from the committed o nes were used. After a ll the SPDZ v alue ha ve b een v erified b y Gadget 4 (9.1), the par ties aggre g ate the encr ypted share s of the stableco in allo ca tio n x ∗ in to a single ciphertext, and then run the joint decryption proto co l[Bou00]. 9.6 Analysis of Prop erties F o llowing the line of w or k merg ing secure computation and mechanism design[IML05], that as sumes that pla yers are ra tional and no t only honest o r malicious, w e reach Guaranteed O utput Delivery (G.O.D.) and fairness[CL14], cir cum ven ting their classical imp ossibility re sults. Definition 13. f C RS : ideal functionality to gener ate co mmon reference string s and secret inputs to the parties. Definition 14. f S P D Z : ideal functionalit y computing ADMM using SPDZ. Theorem 15. f DI S T R − AU C T I ON − M E C H AN I S M is in the ( f C RS , f S P D Z ) -hybrid mo del under standar d crypto gr aphic assumptions, against a malicious adversary who c an s tatic al ly c orrupt up to m − 1 out of m p arties in an ex-p ost Nash e quilib- rium, r e aching G.O.D. and fairness, t hus cir cumventing the imp ossibility r esults of f S P D Z . Pr o of. Malicious security follows fro m Theorem 6 [ZPGS19]. The pr o per ties of truthfulness of theo r em 5 and faithfulness of theor em 12 of the Decen tra lised Implement a tion of Auction Mechanism, imply that ev ery ra- tional party i will faithfully complete all the steps of f DI S T R − AU C T I ON − M E C H AN I S M : in other w o rds, it w on’t be rational to cheat or a bo rt the protoco l for mali- cious parties r estricted to the rational b ehaviors o f an ex-p ost Nas h equilibrium. Therefore, we reach G.O.D. and fairness, th us their imp ossibility res ults are cir- cum vent ed. 10 Discussion The history of control theory for stabilisation in economics go es back to the 1950s : for a recent survey , s ee [Nec08]. Ho wever, the “Prescott critique” [KP77, Pre77] of the time-inconsistency of optimal con tro l re s ults precluded its real- world applicability: fortunately , the problem of time inconsistency ca n be ad- equately tr e a ted within the framework of Model Predictive Control[SCMP18]. 27 And even though it might seem that decentralising economic s ystems is a mo d- ern trend bo r n from crypto currencies and block chains, there are already pub- lications ab out these topics starting from the 197 0s: [Aok76, Myo76, Pin77, Nec83, Nec87, Aok88, Nec13]. This pap er subsumes a ll these previous works bec a use: 1) Model Predictiv e Control provides a more expressive lang uage to define economic p olicies; 2) the decentralisation provided b y the ADMM de- comp osition a llows for more than the 2 -3 parties previously co nsidered) the mechanism design techni ques used in this pa per g uarantee mo re robust results. Economists hav e recently created multiple mo dels showing the b enefits of Cent r ally-Banked Digital Currencies (CBDC): said results als o apply to a CBDC implemen ted in the techn ica l fra mework of a fully decen tra lised cr ypto currency , as in the present pa p er. F or exa mple: • Monetary transmission would strengthen[MDBC18]. • A practical costless medium of exchange, and facilitate the systematic and transparent conduct of monetar y p olicy[BL17]. • Permanen tly ra is e GDP by as m uch as 3%, due to reductions in re al in ter e s t rates, distortio nary taxes , and monetary transaction costs; and improv e the ability to s ta bilise the business cycle[BK16]. • Increas e s financial inclusion, diminishes the demand for ca sh, and e xpands the dep ositor base of pr iv ate banks[And18]. • Address comp etition problems in the banking sector[K R W1 8]. Common ob jections to the gen uineness of decen tra lisation i n stablecoins ar e trav ersed here: 1. Need for centralised holding o f funds: no t b y using other cry pto cur r encies as colla teral. 2. Auditors a re req uir ed for verification: no t by using zer o -knowledge pro ofs and o ther mathematical gua rantees. 3. Centralised price feeds: m ultiple verified agents could po st the re al-time prices on the blo ck chain, or use a n authent ica ted data feed for smar t contracts[ZCC + 16]. The is sue of a dv er sarial attac ks to neural net works is not re lev ant her e b ecause all price feeds are supp osed trustw orthy . Finally , consensus-ADMM as describe d in this pap er offers ma ny adv antages ov er s mart contracts r unning on replicated state ma c hines (e.g., Ethereum): 1. Data int ensive tasks such as deep-learning (5) are nea r ly imp ossible to execute due to ga s limits and storag e costs. 2. Not all mining no des would need to participate on the currency stabilisa- tion pro cess: this sp ecial r ole could b e reserved to a trustw or th y subset of no des. 3. The lack o f priv acy in public p ermissionles s blockc hains renders algorithms such a s the decentralised auction (8) unfeasible to run. 28 11 Conclusion The pr esent paper has tackled and successfully solved the problem of designing a decentralised stablecoin with pr ic e stability guara n tees inherited from co n tro l theory (i.e., Closed-Lo op Stability) and model predictiv e co nt r o l (i.e., conv er- gence of theore m 7). F urther guar ant ees r equired in a decentralised setting come from mechanism design: truthfulness (definition 4, theorem 5) a nd faithfulness (definition 10, theore m 12, theorem 2 ). Additi o nal security against ma licious parties of theorem 15 is obtained from the com bination of secur e m ulti-party computation and zer o-knowledge pro ofs. The flexibilit y of this framew o rk including mo del predictiv e cont r ol, whic h can acco mmo da te a grea t v a riety o f econo mic p olicies, combined with the p ow- erful pr edictiv e capa bilities of a rtificial in telligence techniques (e.g., neural net- works and deep learning) foretell a whole rang e of p o ssibilities that will lead to better crypto cur r encies and blo ck chains. References [Aa17] Andr eea B. Alexandru and Konstan tinos G atsis a nd. Pri- v acy pre serving Cloud-based Quadratic Optimization, 2017. https:// www.georgejpap p as.org/papers/Paper235.pdf . [AGP15 ] Pablo Daniel Azar, Shafi Goldw asser, and Sunoo Pa rk. How to Incen tivize Data-Driv en Collab oration Among Competing Part i es, 2015. https:// eprint.iacr.or g /2015/178 . [AGS + 18] Andreea B. Al exandru, Konstan tinos Gat si s, Y asser Shouk ry , Sanjit A. Seshia, Pa ulo T abuada, and George J. Pappa s. Cl oud-based Quadratic Optimization with Pa rtially Homomorphic Encryption, 2018. https ://arxiv.org/ab s/1809.02267 . [AMP18] Andreea B. Alexandru, Manfred Morari, and George J. Pappas. Cloud-based MPC with Encrypted Data, 2018. https: //arxiv.org/abs /1803.09891 . [AMP19] Andreea B. Alexandru, Manfred Morari, and George J. Pappas. Secure Multi- part y Computation f or Cloud-based Cont rol, 2019. https:// arxiv.org/abs/ 1 906.09652 . [And18] Da vid Andolfatto. Assessing the Impact of Cen tral Bank Digi tal Currency on Priv ate Banks, 2018. https://d oi.org/10.20955 / wp.2018.026 . [Aok7 6] Masana o Aoki. On Decen tralized Stabilization P oli - cies and Dynamic As s ignmen t Problems, 1976. https:// www.sciencedir e ct.com/science/article/pii/0022199676900106 . [Aok8 8] Masana o Aoki. Decen tralized Monetary Rules in a Three-Coun try Mo del and Time Series Evidence of Structural Dependence, 1988. https:// doi.org/10.100 7 /978- 3- 642- 74104- 3_12 . [BCC + 19] Emanuele Borgono vo, Stefano Caselli, Alessandra Cillo, Donato Mascian- daro, and Giov anni Rabitti. Priv acy and Money: It Matters, 2019. https:// papers.ssrn.co m /sol3/papers.cfm?abstract_id=3330494 . [BK16] John Barrdea r and Mich ael Kumhof. The M acroeco- nomics of Cen tral Bank Issued Digital Currencies, 2016. https:// papers.ssrn.co m /sol3/papers.cfm?abstract_id=2811208 . [BKP19] Dirk Bul lmann, Jonas Kl emm, and Andrea Pinna. In searc h for stabili t y in crypto-assets: ar e stablecoins the sol ution?, 2019. https:// www.ecb.europa . eu/pub/pdf/scpops/ecb.op230~d57946be3b.en.pdf . 29 [BL17] M ic hael D. Bordo and Andrew T. Levin. Centr al Bank Digi tal Currency and the F uture of Monetar y P oli cy, 2017. https://w ww.nber.org/papers/w23711 . [Bou00] F abrice Boudot. Effi cien t Proofs that a Committed Numb er Lies in an Inter v al, 2000. http s://www.iacr.or g/archive/eurocrypt2000/1807/18070437- new.pdf . [BPC + 11] Stephen Boyd, Neal Parikh, Eric Chu, Borja Pelea to, and Jonathan Eckstein. Distributed Optimization and Statistical Learn- ing via the Alternating Direction Method of Multipli ers, 2011. https:// web.stanford.e d u/~boyd/papers/admm_distr_stats.html . [Cac18] Nicolas Cacha nosky . Can Bitcoin Become Money? The Monetar y Rule Problem, 2018. http s://papers.ssrn .com/sol3/papers.cfm?abstract_id=3124359 . [Cha14] T sung-Hui Chang. A Proximal Dual Consensus ADMM Metho d for Multi-Agent Constrained Optimization, 2014. https://ar xiv.org/abs/1409.3307 . [CL14] Ran Cohen and Y ehu da Lindell. F airness versus Guara nteed Output Delivery i n Secure Multipart y Computation, 2014. https ://eprint.iacr .org/2014/668 . [DM15] George Danezis and Sarah Meiklejohn. Cen trally Bank ed Cryptocurrenc ies, 2015. https:// arxiv.org/abs/ 1 505.06895 . [DPSZ11] I. Damgard, V. P astro, N.P . Smart, and S. Zak arias. Multi- part y Computation from Somewhat Homomorphic Encryption, 2011. https:// eprint.iacr.or g /2011/535 . [DRS + 18] Moritz Sc hulze Darup, Adrian Redder, Iman Shames, F arhad F arokhi, and Daniel Quevedo. T ow ards encrypted MPC for l i near constrained systems, 2018. http://c ontrolsystems. u pb.de/fileadmin/Files_Gruppe/pdfs/artikel/SchulzeDarup2018_LCSS.pdf . [FPS00] Pierre-Alain F ouque, Guillaume Poupard, and Jacques Stern. Shar- ing Decryp tion in the Contex t of V oting or Lotteries, 2000. https:// hal.inria.fr/i n ria- 00565275/document . [Gro09] Jens Groth. Homomorphic T rapdo or Commitmen ts to Group Elements, 2009. https:// eprint.iacr.or g /2009/007 . [Her18] The Sydney M orning Herald. The search for the Hol y Grail of cryptocurrencies, 2018. https:// www.smh.com.au / business/markets/the- search- for- the - holy- grail- of- cryptocurrencies- 20180222- p4z 1 7 1 . h t m l . [HLX17] Xuan Han, Y amin Liu, and Haixia Xu. A User-F riendly Cent rally Banked Cryp- tocurrency , 2017. http s://doi.org/10. 1007/978- 3- 319- 72359- 4_2 . [Hur95] Ado l f Hurwitz. Ueber die Bedingungen, unter welc hen eine Gle- ich ung nur W urzeln mit negativen reellen Theilen besitzt, 1895. https:// link.springer. c om/article/10.1007%2FBF01446812 . [IKMS14] Mitsuru Iwam ura, Y ukinobu Kitamura, T sutom u Matsumoto, and Kenji Saito. Can W e Stabilize the Price of a Cryptocurrency?: Understanding the De- sign of Bi tcoin and Its Poten tial to Comp ete wi th Cen tral Bank Money, 2014. http://h dl.handle.net/ 1 0086/26940 . [IML05] Sergei Izmalko v, Silvio Micali, and Matt Lepinski. Rational Secure Computation and Ideal M ec hanism Design, 2005. http: //economics.mi t.edu/files/1084 . [Jur74] El iah u Ibraham Jury . Inners and Stability of Dynamic Syste ms , 1974. https:// doi.org/10.100 2 /nme.1620100428 . [KKMP19] Ev an Kereiak es, Do Kw on, Marco Di Maggio, and Nicholas Platias. T erra Mone y: Stability and A doption, 2019 . https:// s3.ap- northeast- 2.amazonaws.com/terra.money .home/static/Terra_White_paper.pdf . [KMM19] Ariah Kl ages-Mundt and Andreea Mi nca. (In)St abil it y for the Blo c kc hain: De l ev eraging Spirals and Stablecoin At tacks, 2019. https:// arxiv.org/abs/ 1 906.02152v1 . [KP77] Fi nn E. Kydland and Edw ard C. Prescott. Rules rather than discretion: the inconsistency of optimal plans, 1977. http s://www.jstor.o rg/stable/1830193 . 30 [KR W18] Charles M. Kahn, F rancisco Riv adeneyra, and T sz-Nga W ong. Should the Cen tral Bank Issue E-money?, 2018. https:// www.bankofcana d a.ca/2018/12/staff- working- paper- 20 18- 58/ . [Lee14] J ordan Lee. Nu, 2014. htt ps://nubits.co m/NuWhitepaper.pdf . [Mak19] Mak er. The Dai Stablecoin Syste m, 2019. https:// makerdao.com/e n /whitepaper/ . [MDBC18] Jac k Meaning, Ben Dyson, James Bark er, and Emi ly Clayton. Broadening Narro w Money: Monetary Policy wi th a Centra l Bank Digital Currency , 2018. https:// papers.ssrn.co m /sol3/papers.cfm?abstract_id=3180720 . [MIOT19] Makiko M i ta, Kensuk e Ito, Shohei Ohsaw a, and Hideyuki T anak a. What is Sta- blecoin?: A Surv ey on Price Stabilization Mec hanisms for Decentr alized P aymen t Systems, 2019. ht tps://arxiv.org /abs/1906.06037 . [Mou19] Floren t Moulin. Crypt o Monetar y Policies, 2019. https:// medium.com/mes s aricrypto/crypto- monetary- policies- bef1779e1422 . [Myo76 ] Ha jime My oken. Opt i mal Stabilization P oli cies for Decen tral- ized Macroeconomic Systems wi th Conflicting T argets, 1976. https:// doi.org/10.100 7 /978- 1- 4684- 3572- 6_14 . [Nec83] Reinhard Neck. Dece ntralized con trollability of an economic policy mo del, 1983. [Nec87] Reinhard Neck. Decentr ali zed Sta bil ization of a Dynamic Economic System by Local F eedbac k, 1987. https: //doi.org/10.1 01 6/S1474- 6670(17)55777- 8 . [Nec08] Reinhard Nec k. The Cont ribution of Con trol Theory to the Analysis of Economic Po l i cy, 2008. http://dx .doi.org/10.3182/20080706- 5- KR- 1001.00716 . [Nec13] Reinhard Nec k. An Application of Decen tralized Con- trol Theor y to an Econo mi c Policy Mo del, 2013 . http://w ww.wseas.org/m u ltimedia/journals/economics/2013/115707- 165.pdf . [NOH19] Shun ya No da, Ky ohei Okumur a, and Y oshinori Hashimoto. A Lucas Cri- tique to the Difficulty Adjustmen t Algorithm of the Bi tcoin System, 2019. https:// papers.ssrn.co m /sol3/papers.cfm?abstract_id=3410460 . [NR07] Noam Nissam and Amir Ronen. Computationally F easible VCG Mechanisms, 2007. http ://robotics.sta nford.edu/~amirr/vcgbased.pdf . [PB17] Mogens Graf Plessen and Alb erto Bemp orad. Stock T rading vi a F eedbac k Control: Sto cha stic Model Predictive or Genetic?, 2017. https:// arxiv.org/abs/ 1 708.08857 . [PHP + 19] Ingolf G.A. Pe rnice, Sebastian Henningsen, Roman Prosk alovic h, Martin Flo- rian, Hermann El endner, and Björn Sche uermann. Monetary Stabiliza- tion in Cryptocurrencies - Design Appro aches and Op en Questions, 2019. https:// arxiv.org/abs/ 1 905.11905 . [Pin77] Robert Pindyck. Optimal Economic Stabilization P olicies Un- der Decentr ali zed Contro l and Conflicting Ob jectiv es, 1977. https:// ieeexplore.iee e .org/abstract/document/1101557 . [Pre77] Edwar d C . Prescott. Sho uld contr ol the- ory be used f or econo mi c stabili zation?, 19 77. https:// www.sciencedir e ct.com/science/article/pii/0167223177900173 . [PS04] Da vid C. Park es and Jeffrey Shneidman. Distributed im - plemen tations of Vic krey-Clark e-grov es mecha nism s, 2004. http://n rs.harvard.edu / urn- 3:HUL.InstRepos:4054438 . [Rou77] Edwa rd John Routh. A T reatise on the Stabilit y of a Given State of Motion: Pa rticularly Steady Motion, 1877. [SCMP18] Sumeet Singh, Y i n-Lam Cho w, Anirudha Ma jumdar, and Marco Pa vone. A F ramew ork for Time-Consistent, Risk-Sensitive Mo del Predictive Contro l : The- ory and Al gorithms, 2018. https:// arxiv.org/abs/ 1 703.01029 . 31 [She16] Matthew D. Sheppard. Implementing the Cen tral Bank F unc- tionalit y of RSCoin, a Centr all y Bank ed Crypto curren cy , 2016. https:// iamjustatad.fi l es.wordpress.com/2016/11/rscoin_thesis.pdf . [SI19] Kenji Saito and Mitsuru Iwa mura. How to Make a Digital Currency on a Blo c kc hain Stable, 2019. https ://arxiv.org/ab s/1801.06771 . [Sol30] Solomon. Alepp o Co dex - Prov erbs 11:14 - 12:25, 930. https:// upload.wikimed i a.org/wikipedia/commons/thumb/f/f6/Aleppo- HighRes3- Ketuvim3- Job- Proverbs- R uth- S o n g . p d f / p a g e 3 3 - 1 2 4 0 p x - A l e p p o - H i g h R e s 3 - K e t u v i m 3 - J o b - P r o v e r b s - R u t h - S o n g . p d f . j p g . [SPS03] Jeffrey Shneidman, David C. Park es, and Margo Seltzer. Ove rcoming Rational Manipulation in Di stributed Mech anism Implementations, 2003. http://n rs.harvard.edu / urn- 3:HUL.InstRepos:25104435 . [T ay93 ] John B. T a ylor. Discretion v ersus p olicy rules in prac tice, 1993. https:// web.stanford.e d u/~johntayl/Papers/Discretion.pdf . [WID + 19] Xin W ang, H i deaki Ishii, Link ang Du, Peng Cheng, and Jiming Chen. Priv acy- preserving Distributed M ac hine Learning via Lo cal Randomization and ADMM Pe rturbation, 2019. https://a rxiv.org/abs/1908.01059 . [WKCC18 ] Karl W ÃŒst, K ari Kostiainen, V edran Capkun, and Srdjan Capkun. PR Cash: F ast, Priv ate and Regulated T ransactions for Di gi tal Currencies, 2018. https:// eprint.iacr.or g /2018/412 . [WYCZ19] Junxiang W ang, F uxun Y u, Xiang Chen, and Liang Zhao. ADMM for Efficient Deep Learning with Global Conv ergence, 2019 . https:// arxiv.org/abs/ 1 905.13611 . [XWZ + 19] Xingyu Xie, Jianlong W u, Zhisheng Zhong, Guangcan Liu, and Zhouch en Lin. Differen tiable Linearized ADMM, 2019. http s://arxiv.org/ abs/1905.06179 . [ZA W18] Ch unlei Zhang, Muaz Ahmad, and Y ongqiang W ang. ADMM Based P riv acy-preserving Decentr ali zed Optimization, 2018. https:// arxiv.org/abs/ 1 707.04338 . [ZCC + 16] F an Zhang, Ethan Cecch etti, Kyle Croman, Ari Juels, and Elai ne Shi. T own Crier: An Authentica ted Data F eed for Smart Contra cts, 2016. http://w ww.initc3.org/ f iles/tc.pdf . [ZPGS19] W ent ing Zheng, Raluca Ad a P opa, Joseph E. Gonzalez, and Ion Stoica. Helen: Mali ci ousl y Secure Coopetitive Learning for Linear Mo dels, 2019. https:// arxiv.org/abs/ 1 907.07212 . 32