As it is written in the Torah, the Jubilee is the remission year at the end of seven cycles of seven years when slaves and prisoners are freed, properties are returned to their original owners and debts are forgiven 222Deuteronomy 15:1–6, Leviticus 25:8–13, Isaiah 61:1-2 to prevent profiting from the poor 333Exodus 22:25. The first Jubilee was celebrated in AM 2553, starting the count 14 years after entering Eretz Yisrael 444Rambam in Mishneh Torah, Sabbatical Year and the Jubilee 10:2, as it was previously commandeth 555Leviticus 25:2: Jubilees were announced with a shofar 666Ibn Ezra on Leviticus 25:9; Rashi on Leviticus 25:10, an instrument made from a ram’s horn (i.e., a yobhel or yoveil, from which the term Jubilee is derived 777Ramban on Leviticus 25:10) and they provided a regulated and periodical “clean state” for debt forgiveness.
By setting debt forgiveness on a fixed and periodical calendar, the Jubilee resolved the age-old social problem of debt relief: modernly, governments enforce an intricate system of debt collectors, courts and legal procedures. In these cases, third parties are involved to handle conflicts of interests between distrusting parties:
debtors request too much debt forgiveness
creditors grant debt settlements as small as possible, trying to take as many assets as possible from debtors: in some instances, the true amount of debt relief needed is less than the expected revenue from the debtor to fulfil their debt obligations, but the stated debt recovery values from creditors exceed said expected revenue and/or continuation value of the debtor, making it financially impossible for the debtor to compensate the creditors. As a result, future projects from debtors will not be undertaken, even if socially desirable, sacrificed to satisfy the overstated demands from creditors.
For the first time, by combining mechanism design and secure computation we manage to reconcile the demands of debtors and creditors in to create a new debt relief mechanism in which the best course of action is the truthful revelation of their private information: removing most of the conflict from the situation, third parties are no longer needed and frictionless debt settlements can be reached.
In summary, we make the following contributions:
an individually rational, incentive-compatible, truthful/strategy-proof, ex-post efficient, optimal mechanism for debt relief and forgiveness with private information is introduced
further, an implementation using secure computation is presented
In a nutshell, we contribute a new methodology for debt relief and forgiveness in a frictionless and strifeless way without resorting to third parties (i.e., courts, debt collectors), revamping an age-old problem with modern cryptographic techniques such that truthful revelation of private information is the best strategy for all parties involved.
In section 2, we discuss related literature and prior work. In section 3, we first introduce our model, then proceed to describe a direct mechanism for debt settlements, and finally describe the optimal mechanism. In section 4, we describe our implementations of the optimal mechanism and then we conclude in section 5.
The reader interested in the most practical applications may skip to section 4,
2 Related Literature
The literature on the combination of secure computation and mechanism design is surprisingly scarce: it mostly focuses on the problems of secure computation with rational actors [ADGH06, IML05, HT04, GK06, OPRV08], and the combination of secure computation with the incentive-compatible Vickrey auction or its generalisation as the Vickrey–Clarke–Groves mechanism [EL03, NPS99, BS05]. Truthfulness is absolutely necessary for secure computation to gain acceptance in the real world: although any truthful mechanism can be securely computed [Xia11], the converse does not hold. Thus, further research is needed to devise securely computed mechanisms that encourage participants to report their information truthfully.
2.1 Prior Work in Cryptography
This paper also shows that the moral character of cryptographic work [Rog15] goes way beyond preventing “mass surveillance”, as it’s currently customary in the field of cryptography.
2.2 Prior Work in Game Theory
Some seminal papers [O’N81, AM85] started the game-theoretic study of bankruptcy problems in the Talmud: see [HV01, Tho13] for surveys of the extensive literature that followed, including alternative derivations of the Mishnah of the Talmud rule 888Rabbi Nathan in Babylonian Talmud, Kethuboth 93a; Yerushalmi Talmud, Kethuboth 10,4 using cooperative bargaining [DV93] and the strategic Nash cooperative solution [MTY20]. Note that the Talmud rule is so influential that it was adopted as law (halakha) in other contexts 999Rambam in Mishneh Torah, Malveh veLoveh, Chapter 20, Section 4 and it became a source of great discussion101010Rabbi Seadia Gaon in Responsa Sha’arei Zedeq part 4, gate 4; Rabbi Hai Gaon as quoted by Rabbi Isaac Alfasi on Kethuboth 93a; Rabbi Bezalel Ashkenazi in Shitah Mekubetzet on Kethuboth 93a; Piniles H.M. in Darka Shel Torah, p. 64; Rabbi Yehoshua Leib Diskin in Torat Ha’Ohel, vol. 1 page 2b as Talmud scholars were trying to unravel and interpret it.
This paper fundamentally departs from this line of work found in the game-theoretic literature:
it focuses on debt relief via debt settlements, it’s not restricted to equitable partitions between creditors
creditors are allowed to have private information (i.e., all information is not public)
it uses cryptography as a primary tool to achieve its goals
it performs better than the Talmud rule in neutralising creditor’s conflict of interests
The ultimate reason for this innovation is “mi-p’nei tikkun ha-olam” (i.e., for the bettering of the world, and for repairing the world, as modernly interpreted): as participation is individually rational for creditors (see next condition 3.3), it is economically rational to participate even with the institution of the prozbul 111111Gittin 4:3; Mishnah Sheviit 10, a legal subterfuge to circumvent the commandeth forgiveness of loans even after the Shmitah and the Yovel.
3 Model and Design
This paper is primarily concerned with a setting of distrusting parties, a debtor entity and multiple creditors, holding asymmetric information used as input in a process to settle non-marketable debt (i.e., creditors are assumed not to trade between themselves). The debtor entity is an intentional generalisation in order to abstract away the more specific cases of a private party, a corporation or an indebted sovereign state: note that each of these specific cases may need further refinements to this general model. The results of this section are themselves based on these works: [Mye81].
3.1 Model Setup
A highly indebted entity with total outstanding debt and no cash in hand needs funds from external sources for an investment of (i.e., for debt service and to finance another project) that will generate future cash flows given by the Discounted Cash Flow of the current Asset continuation value plus the Investment value, : if the entity files for bankruptcy, the opportunity of the investment in the other project will be lost. It is assumed that the entity is prohibited by existing covenants from issuing new higher priority debt senior to the existing outstanding debt: in other words, the entity can only undertake the investment if it settles the outstanding debt after successful negotiations with risk-neutral creditors to fully or partially write down the principal of the debt since creditors would be the main beneficiaries of the investment , thus avoiding bankruptcy and ensuring the continuation of the debtor entity.
To ease exposition, we assume that the risk-free interest rate is zero and that each creditor has an identical share of the total outstanding debt, , each with equal priority. The willingness to cancel some of the debt depends on two factors:
The estimated percentage of debt cancellation from other creditors.
The expected recovery value for each creditor in case of bankruptcy if the entity does not receive any investments and/or debt cancellation, and we assume that represents the expected recovery value if the creditor owned claims to his proportional part of the total entire value of the entity.
The creditor type is private information and everyone holds identical expectations about the possible value of
, captured by the random variable
with distribution , density , and . With each creditor acting as Bayesian decision-maker [Har67]
, creditor types are identically and independently distributed, its list denoted by the vectorand the set of all possible types of creditors arise from their different preferences, given by
We assume that each creditor are the only private knowledge, that is, the vector .
We further assume that , , , and are common knowledge. There would be no uncertainty about how much debt forgiveness should be granted if the vector was publicly known.
Additionally, we define
Creditor may also know the expected recovery by other creditors (i.e., using secure computation), in that case, the revised expected recovery value in bankruptcy would be given by the following liquidation value
with non-decreasing revised estimation function defining how the creditor would revise his estimate if he knew the estimate of creditor , and satisfying
implying that would still be the expected recovery value of because
As it is evident, the expected recovery value of cannot exceed the full value of the debt,
In this paper we use the following definition of efficiency:
(Ex-post efficiency). We consider a debt relief process by debt settlement to be ex-post efficient if and only if the entity remains solvent after the new investment is undertaken with probability one when
and if the investment is undertaken with probability zero, the entity goes bankrupt. Debt settlement can only be efficient if there is a surplus in the difference between the value of an entity in solvency and the value of the entity in bankruptcy,
Finally, note that the problem of debt settlement is a problem of asymmetric information: if the debtor entity knew the true value of for every creditor, it would be individually rational to propose a settlement arrangement giving each creditor his expected recovery value if and only if the settlement arrangement is ex-post efficient (i.e., continuation would be Pareto-efficient) and all creditors would accept. Thus, asymmetric information is a key feature of debt settlements and is assumed to be private information: hence the use of secure computation, to enable the privacy-preserving computation of said private information between the distrusting parties.
3.2 A Direct Mechanism for Debt Settlement
In this sub-section, we obtain an ex-post efficient revelation mechanism to settle the outstanding debt, by making use of the Revelation Principle:
(Revelation Principle [Mye81]). Every equilibrium outcome of any arbitrary mechanism can be implemented as an outcome in a truth-telling equilibrium of an incentive-compatible direct revelation mechanism.
For each creditor, it’s the best response to report his true type in a truth-telling Bayesian equilibrium point of the revelation game, thus creditors and the debtor entity would follow the instructions of the following protocol:
1. Each creditor privately reports their private information
to a trusted party, at the same time.
2. Using the private reports, a trusted party calculates and instructs:
the debtor entity to invest with probability , or go bankrupt
with probability . In case of continuing solvent, the entity
must make payments to the creditors as defined by the vector
The vector of reported types is defined by
the recommended vector of transfer payments be denoted by , and the recommended probability of continuing solvent and receiving investment.
Let denote the mechanism implemented by the trusted party in the ideal model or a Secure Multi-Party Computation program in the real model, then is the payment to creditor , and is the investment probability when creditor reports and all the creditors announce their true types. Note that for the mechanism to be truthful equilibrium, it must be individually rational for all players to participate and an equilibrium for each creditor to report their true .
The expected utility from a mechanism to creditor such that it’s an equilibrium to report their true type for every other creditor, is given by
using the definition of and the properties of the revised estimation function 3.1. The change in expected utility is given by
because in case of no debt settlement, creditors get their expected recovery value and the entity goes bankrupt; but in case of staying solvent, creditors receive payments but they lose the liquidation value. This change in expected utility must be positive for all creditors
for them to participate in the mechanism since debt relief can only be granted willfully outside of bankruptcy, defining the individually rational (IR) participation constraint: in other words, no party is forced to participate in the mechanism, and each creditor is granted veto power over the debt settlement via their joint control of the probability thus effectively imposing negative externalities on each other (note that extensions to this model introducing majority voting rules are also possible).
On the other hand, the expected utility of the debtor entity from the mechanism in a truth-telling equilibrium is
also subject to a positive Ex-Ante Budget Balance (EXABB) participation constraint
An additional incentive-compatibility constraint (IC) for the mechanism must be satisfied for truthful reporting to be an equilibrium, which in conjunction with the individually rational (IR) participation constraint 3.3 define the mechanism as a feasible mechanism:
To obtain incentive-compatibility [Mye81], it’s a first necessary and sufficient condition that
must be decreasing in for all . In other words, the higher the expected recovery value of a creditor the smaller the probability that the entity will remain solvent as expected by that same creditor. The other second necessary and sufficient condition derived from [Mye81] is that ,
granting, for the highest type , the expected change in utility to each creditor plus a positive mark-up: the new rightmost term of the right-hand side is an economic incentive given to creditors of type by the mechanism to induce them to reveal that they are the creditors more inclined to grant debt forgiveness (i.e., an “informational rent”). To derive the equation 3.7, we start denoting by as the maximum utility of creditor from the mechanism : then, by the envelope theorem[Sam47, Mil04, MS02],
Therefore, by reintegration we obtain the previous equation 3.7
Now let’s look at the incentive-compatible mechanism most favourable to the debtor, that is, when : then, the amount the debtor will pay is the expected recovery value plus an additional economic incentive derived from 3.7,
By taking expectations over all possible values of , we obtain
Integrating by parts the term in brackets, we arrive at
By substituting the previous relation on the debtor’s expected utility 3.4, it becomes
(Blessing of the debtor). The willingness of creditors to grant debt forgiveness is higher when using secure computation for their private information. This paradoxical situation is the opposite of the “winner’s curse” from auction theory [BBM19]: given that an agreement on debt forgiveness among creditors must be unanimous 3.3 , then debt forgiveness could only happen if all creditors are willing to grant forgiveness because their expected recovery value from bankruptcy is low, thus the willingness of each creditor gets reinforced from the private information obtained from other creditors.
The expected profits of the debtor are higher when there are differences in private information, and not just differences in preferences, for any incentive-compatible .
A creditor is more willing to grant debt forgiveness when there are differences in private information (i.e., the blessing of the debtor 5) because the expected recovery value conditional on a successful settlement is smaller than the unconditional expected recovery value, given that all creditors consider that debt settlements will only prosper when other debtholders expect a low recovery value. This allows the debtor entity to extract more debt forgiveness from creditors under private information.
Debtor’s expected profits are given by 3.8 if the investment rule is incentive-compatible. When there are only differences in preferences, the revision functions are for all values of and , thus we only need to show that
with . By the definition of , the inequality can be rewritten as
Since is increasing and by definition for all and , there exists an such that as , and we can write
Due to incentive-compatibility we know that is decreasing, hence
A recent impossibility result [JM00] further limits mechanisms’ ability to implement efficient allocations when creditors’ private values aren’t private information (i.e., with secure computation as used here).
(Jehiel-Moldovanu Impossibility Theorem [JM00, Mil04]). Let be a mechanism where the liquidation value depends on the valuations of other creditors but without private information, and suppose that the function depends non-trivially on . Then, no mechanism exists that implements at any Bayes-Nash equilibrium.
The use of secure computation techniques enables debt settlements with higher expected profits, thus attaining the “blessing of the debtor” 5 with efficient allocations for creditors.
3.3 An Optimal Revelation Mechanism
We start choosing the investment rule to maximise the debtor’s expected utility given by 3.10,
In other words, the entity will remain solvent if the continuation value is higher than the sum of the expected recovery values in bankruptcy, plus the terms : this investment rule and the condition that would set debtor’s expected profits. But we also need an explicit solution for , thus the investment rule is rewritten as
We make the following assumption so is strictly increasing.
is strictly increasing (i.e., monotonically non-decreasing) for all and all .
This assumption is satisfied by any uniform distribution on the interval
, the Pareto, exponential, and positive normal distributions.
Thus, there exists a unique value of denoted by for each vector that solves
The pivotal type that creditor can report without forcing bankruptcy according to investment rule is large when low types are being reported by the other creditors: it measures the magnitude of the opportunities for holding out. It’s defined by
The payment to creditor is calculated according to
in the optimal mechanism.
The investment rule can be rewritten by the definition of as
Thus, the change in utility to creditor from the optimal mechanism by constraint 3.6 is
Finally, we arrive to the solution to equation 3.15,
since when , and when . ∎
In the optimal mechanism 9, a payment is received by creditor which is independent of the reported type, but it will depend on the types declared by other creditors as explained in the following:
the function is decreasing in each component of .
the function is increasing in each component of : if other creditors report high expected recovery values, then creditor would increase his own expected recovery value.
If the holding out from dominates the revision of expectations from , then transfers are decreasing in each component of when using the optimal mechanism.
4 Practical Implementation
To ease exposition, we consider the simplest case: consider an example with creditors and their private expected recovery value from bankruptcy be uniformly distributed on .
Assume that the revision function 3.1 is defined by
such that when the constant creditors give more weight to the estimate of other creditors, and vice versa.
The optimal continuation value is given by
the payment to creditor 1 is
and the payment to creditor 2 is
Finally, the amount of debt forgiveness by each creditor is given by .
4.1 Implementation on “The Secure Spreadsheet”
The previously derived closed-form formulae for the probability of the debtor to receive debt relief and continue being solvent 4.1, the payment to creditor #1 4.2 and to creditor #2 4.3 can be securely computed very easily on “The Secure Spreadsheet” (USPTO Patent 10,423,806[Cer14]), available online for download [Cer21b]: first precognised in the article “The G-d Protocols” [Sza97] from 1997, “The Secure Spreadsheet” is the first and only user program for general-purpose secure computation. For maximum performance at an affordable cost, the preferred secure computation protocol used by the “The Secure Spreadsheet” is the dual-execution protocol[MF06]:
(Dual-Execution protocol[HKE12]). If the garbled circuit construction is secure against semi-honest adversaries and the hash function M is modelled as a random oracle, then the Dual-Execution protocol securely computes implementing the ideal functionality 3.1 if for every non-uniform probabilistic polynomial-time adversary in the real model, there exists a non-uniform probabilistic polynomial-time adversary in the ideal model such that
As pictured above on the captured screenshots 4.1, the public values for the debt , the continuation value and the weight to the estimate to the other creditors must be the same on both spreadsheets for creditors 1 and 2. On the top spreadsheet for creditor 1, the only private that is taken into account is the one inputted by creditor 1 (et vice versa for the bottom spreadsheet for creditor 2). The final values computed using secure computation appear on the right-hand side of the captured screenshots, under the column “SECCOMP”.
4.2 Implementation on a blockchain
The previous implementation on spreadsheets 4.1 is also realised on a blockchain using Raziel [Cer17] smart contracts and Pravuil [Cer21a] consensus: identical secure computations as the ones carried out on “The Secure Spreadsheet” are executed among creditors and debtors interfacing the blockchain with a mobile app.
Note the special suitability of Pravuil [Cer21a] consensus integrating real-world identity on this blockchain: debt management requires real-world identities, otherwise Sybil attacks could create unlimited fake debts. Due to this reason, this is the only valid blockchain consensus protocol [Cer21a] for the purpose of debt management.
The present paper has tackled and successfully solved the problem of debt relief and forgiveness by securely computing optimal debt settlements. The mathematical proofs hereby provided demonstrate that participation in the proposed mechanism is within the economically rational interests of all the involved parties by truthfully providing their private information, thus removing the need for third parties. Additionally, the provided implementations demonstrate the practicality of the securely computed mechanism.
Ittai Abraham, Danny Dolev, Rica Gonen, and Joe Halpern.
Distributed Computing Meets Game Theory: Robust Mechanisms for Rational Secret Sharing and Multiparty Computation, 2006.https://www.cs.cornell.edu/home/halpern/papers/podc06.pdf.
- [AKL12] Emmanuel A. Abbe, Amir E. Khandani, and Andrew W. Lo. Privacy-Preserving Methods for Sharing Financial Risk Exposures, 2012. https://www.princeton.edu/~eabbe/publications/AKL_AER.pdf.
- [AM85] Robert J. Aumann and Michael Maschler. Game Theoretic Analysis of a Bankruptcy Problem from the Talmud, 1985. https://www.cs.cmu.edu/~arielpro/15896s15/docs/paper8.pdf.
- [BBM19] Dirk Bergemann, Benjamin Brooks, and Stephen Morris. Countering the Winner’s Curse: Optimal Auction Design in a Common Value Model, 2019. https://cpb-us-w2.wpmucdn.com/campuspress.yale.edu/dist/3/352/files/2020/11/TE3797-printed-version.pdf.
- [BP20] David Byrd and Antigoni Polychroniadou. Differentially Private Secure Multi-Party Computation for Federated Learning in Financial Applications, 2020. https://arxiv.org/abs/2010.05867.
- [BS05] Felix Brandt and Tuomas Sandholm. Efficient Privacy-Preserving Protocols for Multi-unit Auctions, 2005. http://dss.in.tum.de/files/brandt-research/fc2005.pdf.
- [Cer14] David Cerezo Sánchez. Secure Multiparty Computation on Spreadsheets, 2014. https://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&p=1&u=/netahtml/PTO/srchnum.html&r=1&f=G&l=50&d=PALL&s1=10423806.PN.
- [Cer17] David Cerezo Sánchez. Raziel: Private and Verifiable Smart Contracts on Blockchains, 2017. https://ia.cr/2017/878.
- [Cer21a] David Cerezo Sánchez. Pravuil: Global Consensus for a United World, 2021. https://ia.cr/2021/669.
- [Cer21b] David Cerezo Sánchez. The Secure Spreadsheet, 2021. https://www.calctopia.com.
- [DDN15] Ivan Damgård, Kasper Damgård, Kurt Nielsen, Peter Sebastian Nordholt, and Tomas Toft. Confidential Benchmarking based on Multiparty Computation, 2015. https://eprint.iacr.org/2015/1006.
- [DV93] Nir Dagan and Oscar Volij. The Bankruptcy Problem: A Cooperative Bargaining Approach, 1993. https://www.nirdagan.com/research/199301/full.pdf.
- [EL03] Edith Elkind and Helger Lipmaa. Interleaving Cryptography and Mechanism Design: The Case of Online Auctions, 2003. https://eprint.iacr.org/2003/021.
- [FAZ05] Keith Frikken, Mikhail Atallah, and Chen Zhang. Privacy-Preserving Credit Checking, 2005. https://www.cs.purdue.edu/homes/mja/sscc/documents/EC2005.pdf.
- [GK06] S. Dov Gordon and Jonathan Katz. Rational Secret Sharing, Revisited, 2006. https://www2.cs.duke.edu/nicl/netecon06/papers/ne06-rational.pdf.
- [Har67] John C. Harsanyi. Games with incomplete information played by Bayesian players, 1967. http://www.dklevine.com/archive/refs41175.pdf.
- [HFT21] Marcella Hastings, Brett Hemenway Falk, and Gerry Tsoukalas. Privacy-Preserving Network Analytics, 2021. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3680000.
- [HKE12] Yan Huang, Jonathan Katz, and David Evans. Quid-Pro-Quo-tocols: Strengthening Semi-Honest Protocols with Dual Execution, 2012. https://www.cs.virginia.edu/~evans/pubs/oakland2012/quidproquotocols.pdf.
- [HT04] Joseph Halpern and Vanessa Teague. Rational Secret Sharing and Multiparty Computation: Extended Abstract, 2004. https://theory.stanford.edu/~vteague/STOC04.pdf.
- [HV01] Carmen Herrero and Antonio Villar. The Three Musketeers: Four Classical Solutions to Bankruptcy Problems, 2001. http://www.ivie.es/downloads/docs/wpasad/wpasad-2000-23.pdf.
- [IML05] Sergei Izmalkov, Silvio Micali, and Matt Lepinski. Rational Secure Computation and Ideal Mechanism Design, 2005. http://economics.mit.edu/files/1084.
- [JM00] Philippe Jehiel and Benny Moldovanu. Efficient Design with Interdependent Valuations, 2000. https://philippe-jehiel.enpc.fr/wp-content/uploads/sites/2/2018/03/fineff3.pdf.
- [MF06] Payman Mohassel and Matthew Franklin. Efficiency Tradeoffs for Malicious Two-Party Computation, 2006. https://www.iacr.org/archive/pkc2006/39580468/39580468.pdf.
- [Mil04] Paul Milgron. Putting Auction Theory to Work, 2004. https://www.cambridge.org/us/academic/subjects/economics/microeconomics/putting-auction-theory-work.
- [MS02] Paul Milgron and Ilya Segal. Envelope Theorems for Arbitrary Choice Sets, 2002. https://web.stanford.edu/~milgrom/publishedarticles/Envelope%20Theorems.pdf.
- [MTY20] Juan D. Moreno‑Ternero, Min‑Hung Tsay, and Chun‑Hsien Yeh. A Strategic Justification of the Talmud Rule Based on Lower and Upper Bounds, 2020. http://www.upo.es/serv/bib/wps/econ2002.pdf.
- [Mye81] Roger B. Myerson. Optimal Auction Design, 1981. https://www.cs.princeton.edu/courses/archive/spr09/cos444/papers/myerson81.pdf.
- [NPS99] Moni Naor, Benny Pinkas, and Reuben Sumner. Privacy preserving auctions and mechanism design. pages 129–139. ACM Press, 1999. http://www.wisdom.weizmann.ac.il/%7Enaor/PAPERS/nps.ps.gz.
- [O’N81] Barry O’Neill. A Problem of Rights Arbitration from the Talmud, 1981. http://www.sscnet.ucla.edu/polisci/faculty/chwe/austen/oneill1982.pdf.
- [OPRV08] Shien Jin Ong, David Parkes, Alon Rosen, and Salil Vadhan. Fairness with an Honest Minority and a Rational Majority, 2008. https://eprint.iacr.org/2008/097.
- [Rog15] Phillip Rogaway. The Moral Character of Cryptographic Work. Cryptology ePrint Archive, Report 2015/1162, 2015. https://eprint.iacr.org/2015/1162.
- [Sam47] Paul Samuelson. Foundations of Economic Analysis, 1947. https://www.hup.harvard.edu/catalog.php?isbn=9780674313033.
- [Sza97] Nick Szabo. The God Protocols, 1997. https://nakamotoinstitute.org/the-god-protocols/.
- [Tho13] William Thomson. Game-theoretic Analysis of Bankruptcy and Taxation Problems: Recent Advances, 2013. https://doi.org/10.1142/S0219198913400185.
- [Xia11] David Xiao. Is privacy compatible with truthfulness?, 2011. https://eprint.iacr.org/2011/005.