I have written recently on the math behind curved token bonding, and done some derivations on a recent dividend token implementation that utilizes it, called PoWH3D. First of all, here is a nice post documenting the failure of its previous iteration.

Despite its creators’ marketing it as a gambling ecosystem, the math behind PoWH3D might prove to be a significant contribution to creating a reliable dividend-based UBI system. Because unlike its predecessor which failed miserably due to math and implementation errors, it works (at least as of writing this). Like clockwork, 10% of every buy, sell and transfer goes to token holders. More than 70,000 ETH (~$30m) were deposited to the contract at the all time high.

But the contract is not perfect. Let’s entertain the following scenario:

Nobody has bought P3D yet, and you send 10,000 ETH to the contract. 9000 ETH worth of P3D are minted, and 1000 ETH is distributed to the only token holder, you. Then you decide to sell the tokens you have just bought. Their worth in ETH is computed, and you receive 9/10th of it. The dividends from the sale go to the only token holder—again, you. So after the purchase and sale, you only have a fraction of your original 10,000 ETH, and the rest is stored in the contract as dividends, belonging to you. So withdrawing the dividends, you should end up with 10,000 ETH, right?

I tested the scenario and, here is the code to replicate the results. Below is the output.

Change in own ETH balance: -885.0215718635744
P3D balance: 0.0
Contract ETH balance: 900.0215718635744
Contract P3D supply: 0.0

All P3D has been burned and dividends withdrawn, but 900 ETH remain in the contract, essentially bricked. This corresponds to ~9% of the initial investment. Why is that?

In a purchase or sale, the relationship between minted/burned tokens and spent/reimbursed ethers is nonlinear, expressed by a non-constant supply-price relationship:

And the dividends correspond to 9/10th of that area. The problem is how the dividends are distributed. Your share is computed from your token balance after the transaction. So if you sell all your tokens at once, your share of the dividends from that sale is zero.

If one intends to sell large amount of tokens, this can be mitigated by dividing the sale into installments. The amount of bricked ETH decreases exponentially with increasing number of installments, as tested in this code.

Percentage of bricked ETH for the scenario above, for token sales consisting of different number of installments.

The computation of the contract becomes exact for an infinite number of installments, given the transactions are costless. The same problem exists for purchases. Buyers are overpaid and sellers are underpaid in dividends, and the effects don’t cancel out for large sums, as demonstrated above.

So how can we design this system to be exact? The computation of dividends needs to account for the varying supply-price relationship.

Purchase Dividends

Let $S_0$ be the initial token supply, $\bar{T}_0$ our initial token balance, and $R_d$ the dividend ratio of the system, e.g. 1/10 for PoWH3D. Let us send $E$ ETH to the contract and received $T$ tokens in return, where $D=R_d E$ is supposed to be distributed as dividends. In PoWH3D, our dividends $\bar{D}$ from this purchase is computed as

Let us define the varying supply $S$ a function of the initial supply $S_0$ and token increment $\delta T$:

Using this, we can formulate the equation above in terms of $S$ instead of $\delta T$:

and the sum of dividends distributed to everyone else can be computed as

However, as demonstrated above, this computation yields inexact results. To achieve exact results, we have to integrate over the $S$-$P$ curve. The relationship between spent ether and received tokens is

For a linear bonding curve

we have $E$ and $T$ in terms of each other:

and

Deriving from $(\ast)$, our exact dividend from the sale is calculated as

Calculation of the exact dividend of everyone else follows similarly using $(\ast\ast)$

Summing these up and substituting $(\dagger)$, we see

which verifies the results.

Similar to PoWH3D, $\tilde{D}$ (sum of the dividends of everyone except the purchaser) is distributed using token balances as weights. The difference is that the dividends of the purchaser and the rest are computed separately.

Sale Dividends

For a sale, the relationship between reimbursed ether and received tokens is

For a linear curve, we have the following relationships of $E$ and $T$:

and

This time, the dividends are calculated according to

and the varying supply is calculated as

Substituting, we see that $(\ast)$ and $(\ast\ast)$ also hold for sale. For our dividends, we have

For the rest, we have

Conclusion

I discovered an inconsistency in a smart contract worth $30m while playing with it. Although it may not be critical, the case proves that people are OK with pouring money into a project that hasn’t even released a whitepaper, as long as they are half-sure that they will profit from it. My intuition makes me doubt that this can allow someone to exploit the contract. But who knows; if someone manages to hack it, the prize is at least 10 times bigger than it was in PoWH.

PoWH3D aside, the formulation above can be used to achieve exactness in any dividend token. I didn’t go into how it can be integrated into a smart contract, because it is out of the scope of this study. The right way of keeping account of dividends is not having a map of addresses to dividends and iterating that map in every transaction, but keeping track of profits per token, which achieves the same result implicitly. This is how PoWH3D does it, but since my concerns are theoretical, I didn’t delve into how this might be implemented.