The article was written on June 9, 2017.
NOTE: I mention the names of various projects below simply for the purpose of comparing and contrasting their token sale mechanics; this should not be taken as an endorsement or criticism of any specific project as a whole. It’s entirely possible for any given project to be total garbage and still have an awesome token sale model.
The past few months have seen an increasing amount of innovation in token sale models. Two years ago, the space was simple: capped sales, selling a fixed number of tokens, so they were sold at a fixed price, so the value was fixed and they generally sold out quickly, and there was no limit on sales, selling as many as people were willing to buy. Now, we’ve seen interest in hybrid capped sales, reverse Dutch auctions, Vickrey auctions, proportional refunds, and many other mechanisms, both in theoretical investigation and, in many cases, in practical implementation.
Many of these mechanisms have emerged as responses to perceived failures in previous designs. Almost all major sales, including Brave’s Basic Attention Token, Gnosis, upcoming sales like Bancor, as well as older products like Maidsafe, and even the Ethereum sale itself have been met with a great deal of criticism, all of which points to one simple fact: to date, we have not found a mechanism that has all, or even most, of the properties we would like.
Let’s review a few examples.
Maidsafe
The decentralized internet platform raised $7 million in five hours. However, they made the mistake of paying in two currencies (BTC and MSC) and gave MSC buyers a favorable rating. This caused the MSC price to temporarily increase by 2x as users rushed to buy MSC at a favorable price to participate in the sale, but the price then dropped significantly after the sale ended. Many users converted their BTC to MSC to participate in the sale, but then their sales closed too quickly, causing them to lose about 30%.
This sale and several others after it (cough cough WeTrust, TokenCard) show a lesson that should be uncontroversial by now: selling at a fixed exchange rate that accepts multiple currencies is dangerous and disadvantageous. Don’t do it.
revenge
The Ethereum sale was uncapped and ran for 42 days. The first 14 days of sales started at 2000 ETH for 1 BTC, then began a linear growth, ending at 1337 ETH for 1 BTC.
Almost all unlimited sales have been criticized as “greedy” (a criticism I have significant reservations about, but we’ll come back to that later), though there is another, more interesting criticism of these sales: they create high uncertainty for participants about the valuation of what they are buying. Taking a sale that hasn’t even started yet as an example, there are probably a lot of people who would be willing to pay $10,000 for a bunch of Bancor tokens if they knew the fact that this represented 1% of all Bancor tokens in existence, but many of them would become very worried if they bought a bunch of 5000 Bancor tokens, not knowing whether the total supply is 50,000, 50,000, or 500 million.
In the Ethereum sale, buyers who really care about valuation predictability typically buy on the 14th day, reasoning that this is the last day of the full discount period, so they have maximum predictability and full discount on that day, but the pattern above is hardly economically optimal behavior; the equilibrium is as if everyone buys in the last hour of the 14th day, making a private tradeoff between certainty of valuation and making a 1.5% profit (or, if certainty is really important, buying might spread to the 15th, 16th, and later days). So the model certainly has some rather strange economic properties that we would really like to avoid if there is a convenient way to do so.
bat
Throughout 2016 and early 2017, capped sale designs were most popular. The property of a capped sale is that interest is likely to be oversubscribed, so there is a huge incentive to start in the first place. Initially, sales took several hours to complete. Soon, however, the pace began to accelerate. First Blood generated a lot of news by completing a $5.5 million sale in two minutes — while active denial-of-service attacks on the Ethereum blockchain were taking place. However, this race-to-Nash equilibrium example was not realized until the BAT sale last month, when a $35 million sale was completed in 30 seconds due to massive interest in the project.
Not only was the sale completed within two blocks, but it also included:
Total transaction fees paid was 70.15 ETH (> $15,000), with the highest single fee being $6,600
185 successful purchases, over 10,000 failed
After the sale started, the Ethereum blockchain was full for 3 hours
So the way we start to see sales limited is their natural equilibrium: people trying to outdo each other’s transaction fees until potentially millions of dollars in surplus are burned into the hands of miners. That’s what happens before the next phase starts: large mining pools bump up against the beginning of the line and simply buy up all the tokens themselves before anyone else can.
intuition
The Gnosis sale attempts to alleviate these issues with a new mechanism: a reverse Dutch auction. The simplified form of these terms is as follows. There is a capped sale, capped at $12.5 million. However, the portion of tokens actually given to purchasers is dependent on when the sale is completed. If it is completed on the first day, then only ~5% of the tokens will be distributed to purchasers, with the rest going to the Gnosis team; If it is completed on the second day, then it will be ~10%, and so on.
The idea is to create a plan where if you buy at time T, then you are guaranteed to buy at a valuation of at most 1/T.
The goal is to create a simple mechanism for an optimal strategy. First, you personally decide what maximum valuation you are willing to buy at (call it V). Then, when a sale starts, you don’t buy immediately; instead you wait until the valuation drops below that level and then send in your trade.
There are two possible outcomes:
The sale will be over before the valuation drops below five. Then, you are happy because you didn't make what you thought was a bad deal.
Once the valuation drops below five, the deal is closed. Then, you send in your trade, and you are happy because you got into what you thought was a good deal.
However, many predicted that many would “irrationally” buy in on the first day, without even seeing the valuation, due to “fear of missing out” (FOMO). That’s exactly what happened: the sale was completed in a matter of hours, with the result that the sale hit its cap of $12.5 million, as it only sold 5% of all tokens that would ever exist — an implied value of over $300 million.
All of this would of course be perfect evidence to support a narrative that the market is completely irrational, something people don’t know until they invest a ton of money in it (often as subtext that the entire space needs to be suppressed to prevent further exuberance), if it weren’t for an inconvenient fact: The traders who bought the market were correct.
Even in ETH terms, despite the sharp increase in ETH prices, the price of 1 GNO has increased from about 0.6 ETH to about 0.8 ETH.
What happened? A few weeks before the sale began, facing public criticism that if they ended up holding a majority of the coins, they would be as capable as a central bank to severely manipulate the GNO price, the Gnosis team agreed to hold 90% of the coins that were not sold for a year. From a trader’s perspective, coins that are locked up for a long time are coins that do not move the market, and therefore analysis in the short term may not exist. This is what initially propped up Steem to such high valuations in July last year and the early moments of Zcash’s price per coin exceeding $1,000.
Now, a year isn’t a long time, and locking coins for a year is nowhere near as good as locking them forever. However, the reasoning goes further. Even after the one-year holding period expires, you could argue that it would only be advantageous to release the locked coins if the Gnosis team thought that doing so would make the price go up, so if you trust the Gnosis team’s judgment, that means they would do something at least as good for the GNO price as locking the coins forever. So, in reality, the GNO sale was really more like a cap sale, with a cap of $12.5 million and a valuation of $37.5 million. And the traders involved in the sale aptly reacted, leaving dozens of internet commentators wondering what was going on.
There has certainly been a strange effervescence about crypto assets, with various no-name assets reaching $1-100 million market caps (including BitBean at $12 million, PotCoin at $22 million, PepeCash at $13 million, and SmileyCoin at just $14.7 million as of this writing). However, a good case can be made that participants in the sales phase in many cases did nothing wrong, at least as far as they were concerned; rather, traders who bought into the sales were simply (correctly) predicting the existence of a persistent bubble that had been brewing since 2015 (and arguably, since early 2010).
What’s more, aside from the frothy behavior, there is another legitimate criticism of the Gnosis sale: despite their 1-year no-sales promise, eventually they will get all of their coins back, they will be able to heavily manipulate the GNO price to the extent that central banks can, and traders will have to deal with the monetary policy uncertainty that all of this brings.
Specify the problem
So what would a good sales mechanism look like? One way we could start from scratch is to look at the criticisms we’ve seen of existing sales models and come up with a list of desired features.
Let’s do this. Some natural properties include:
Certainty of valuation - If you participate in a sale, you should have certainty about at least an upper limit of the valuation (in other words, what percentage of all tokens you get).
Certainty of Engagement - If you attempt to engage in sales activities, you should generally be able to count on success.
To avoid being seen as greedy (or perhaps risk mitigating regulatory attention), limit the amount raised - sales should limit the amount they collect.
No Central Bank - Token sale issuers should not be able to control the market with an unexpectedly large percentage of tokens.
Efficiency - The sale should not result in economic inefficiency or deadweight loss.
Does that sound reasonable?
Okay, here comes the not so fun part.
(1) and (2) cannot be fully satisfied simultaneously.
(3), (4), and (5) cannot be satisfied simultaneously, at least without resorting to very clever tricks.
These may be referred to as the “First Token Sale Puzzle” and the “Second Token Sale Puzzle”.
The proof of the first puzzle is straightforward: suppose you have a sale that gives users certainty of a $100 million valuation. Now suppose users try to put $101 million into the sale. At least some will fail. The proof of the second puzzle is a simple supply and demand argument. If you satisfy (4), then you are selling all or some fixed large fraction of all tokens, so the valuation you are selling is proportional to the price you are selling at. If you satisfy (3), then you are setting a ceiling on the price. However, this means that the equilibrium price at which you sell the quantity you have set is likely to exceed the price ceiling you set, so you will create a shortage, which inevitably leads to (i) the digital equivalent of waiting in line for 4 hours at a very popular restaurant, or (ii) the digital equivalent of ticket scalping—both are massive death losses, contradicting (5).
The first dilemma is insurmountable; some valuation uncertainty or participation uncertainty is unavoidable, but when the choice exists, it seems better to try to choose participation uncertainty over valuation uncertainty. The closest we can come is to compromise full participation in exchange for guaranteed partial participation. This can be done by refunding shares proportionally (e.g., if $101 million is purchased at a $100 million valuation, then everyone gets a 1% refund). We can also view this mechanism as an unrestricted sale, where part of the payment comes in the form of locked capital rather than spent; but from this view, it is clear that the requirement to lock up capital is an efficiency loss, so this mechanism cannot satisfy (5). If ether holdings are not well-balanced, then it can undermine fairness by favoring wealthy stakeholders.
The second difficulty is difficult to overcome, and many attempts to overcome it can easily fail or backfire. For example, the Bancor sale is considering capping the gas price for buy transactions at $50 (which is 12x the normal gas price). However, right now this means that the best strategy for a buyer is to set up a large number of accounts, and send a transaction that triggers the contract from each of those accounts, and then attempt to buy (indirectly to make it impossible for a buyer to accidentally buy more than they want, and to reduce capital requirements). The more accounts a buyer sets up, the more likely they are to get in. So, in equilibrium, this could lead to the Ethereum blockchain being clogged more often than a BAT-style sale, where at least $6,600 in fees is spent on a single transaction rather than a denial-of-service attack on the entire network. Also, any kind of on-chain transaction spam contest would severely undermine fairness, as the cost of entering the contest is constant, while the reward is proportional to how much money you have, so the outcome disproportionately favors wealthy stakeholders.
go ahead
There are three smarter things you could do. First, you could do a reverse Dutch auction like Gnosis did, but with a twist: instead of holding onto the unsold tokens, use them for some kind of public good. Simple examples include: (i) an airdrop (i.e., redistribution to all ETH holders), (ii) a donation to the Ethereum Foundation, (iii) a donation to Parity, Brainbot, Smartpool, or other companies and individuals independently building infrastructure in the Ethereum space, or (iv) some combination of all three, perhaps in proportion to votes cast by token buyers.
Second, you could keep the unsold tokens but solve the “central bank” problem by committing to a fully automated program. The reasoning here is similar to why many economists are interested in rule-based monetary policy: even if a centralized entity has a lot of control over powerful resources, much of the political uncertainty about outcomes can be reduced if the entity credibly commits to applying them according to a set of programmed rules. For example, unsold tokens could be put to work as a market maker tasked with maintaining price stability for the token.
Third, you could have a capped sale, limiting the amount each person can buy. Doing this effectively requires a KYC process, but the nice thing is that the KYC entity can do this once, whitelist the user’s address after confirming that the address represents a unique individual, and can then reuse those addresses for each token sale, along with other applications that can benefit from per-person sybil resistance like Akash’s quadratic voting. There is still deadweight loss (i.e. inefficiency) here, as this results in tokens with no personal interest participating in the sale, knowing they’ll be able to quickly dump them on the market for a profit. However, this is arguably not that bad: it creates a kind of universal basic income for crypto, and if behavioral economics assumptions like the endowment effect are more true, it will also succeed in its goal of ensuring widely distributed ownership.
Is single-round sales even good?
Let’s get back to the topic of “greed”. I don’t think many people object in principle to the idea of development teams that are able to spend $500 million to create a really awesome project that gets $500 million. Rather, what people object to is (i) the idea of brand new, untested development teams getting $50 million at the same time, and (ii) more importantly, the timing mismatch between developer rewards and token buyers’ interest. In a round of sales, developers only have one chance to get funding to develop a project, and that’s close to the beginning of the development process. Without any feedback mechanism, teams first get small amounts of funding to prove themselves, and then get more and more funding over time as they prove themselves to be reliable and successful. There is very little information to filter out good development teams from bad ones during the sales process, and once a sale is done, developers have relatively low incentives to continue working compared to traditional companies. “Greed” is not about getting lots of money, but getting lots of money without making an effort to demonstrate that one can spend the money wisely.
If we want to get to the heart of this problem, how would we solve it? I would say the answer is simple: start moving to other mechanisms beyond single round sales.
I can offer a few examples for inspiration:
Angelshares - This project ran a sale in 2014 where a fixed percentage of all AGS was sold every day over a period of several months. On each day, one could contribute an unlimited amount to the crowdsale, and that day's allocation of AGS would be divided among all contributors. Basically, it was like having a hundred "unlimited cap" sales limits for most of the year; I would claim that the duration of the sale could have been extended further.
Mysterium ran a splashy micro-sale event six months before the big show.
Bancor recently agreed to convert all funds above the cap into market makers, which will maintain price stability while maintaining a price floor of 0.01 ETH. These funds cannot be withdrawn from market makers for two years.
It may seem hard to see how Bancor’s strategy relates to solving the time mismatched incentives, but an element of the solution is there. To see why, consider two scenarios. As a first scenario, suppose sales are raised by $30 million with a cap of $10 million, but after a year, everyone thinks the project is a failure. In this scenario, the price will try to drop below 0.01 ETH and the market maker will lose all its funds to maintain the price floor, so the team only needs $10 million to cooperate. As a second scenario, suppose sales are raised by $30 million with a cap of $10 million, and after two years everyone is happy with the project. In this scenario, the market maker is not triggered and the team can get the full $30 million.
A related proposal is Vlad Zamfir’s “Security Token Sale Mechanism.” This concept is a very broad one that can be parameterized in many ways, but one way to parameterize it is to sell coins at a capped price, then put a price floor slightly below that cap, and then let the two diverge over time, freeing up capital for development over time if the price remains constant.
Arguably, none of the above three are indicative of a problem. We would like the sales to be spread out over a longer period of time, giving us more time to see which development teams are the most valuable before giving them the bulk of the funding. But this seems to be the most productive direction to explore.
Out of the woods
As you can see above, while there is no way to resist the going-forward dilemma and trilemma, there are ways to look at the problem by thinking outside the box and ignoring the edges, and looking at the problem from a simplistic perspective with variables that are not obvious. We can slightly increase the guarantee of participation, mitigating the impact by using time as the third dimension: if you don’t get in at round N, you can wait until round N+1, which will be in a week, and the price may not be that different.
We could have an overall uncapped sale, but structured into different periods where sales within each period are capped; this way, teams don’t ask for large amounts of money without demonstrating they can handle smaller rounds first. We could sell small portions of the token supply all at once, removing the political uncertainty that comes with such a demand by pooling the remaining supply into a contract that automatically sells according to a pre-specified formula.
Here are some possible mechanisms in the spirit of the above ideas:
Hold a Gnosis-style reverse Dutch auction with a low cap (e.g. $1 million). If the auction sells less than 100% of the token supply, automatically put the remaining funds into another auction two months later with a 30% higher cap. Repeat until the entire token supply is sold.
Sell an unlimited number of tokens at a price of $X, and stake 90% of the proceeds into a smart contract that guarantees a price floor of $0.9*X. The price ceiling is hyperbolic toward infinity, and the price floor decreases linearly to zero over a five-year time frame.
Doing the exact same stuff as AngelShares, though stretched out over 5 years instead of a few months.
Hold a Gnosis style reverse Dutch auction. If the auction sells less than 100% of the token supply, the remaining funds are put into an automated market maker to try to ensure price stability for the token (note that if the price continues to rise, then the market maker will sell the tokens and some of the revenue can be provided to the development team).
Immediately put all tokens into a market participant with parameters + variables X (minimum price), s (fraction of all tokens sold), t (time since start of sale), T (expected time of sale, e.g. 5 years) at a price of k / (t/T - s) tokens (this code is weird and may need more economic research).
Note that there are other mechanisms that should try to solve other problems with token sales; for example, revenue going to a multi-curator that only distributes funds when milestones are reached is a very interesting idea that should be done more. However, the design space is highly multi-dimensional and there are many more things that could be tried.
