  Proof-of-work blockchains reward each miner for one completed block by an
amount that is, in expectation, proportional to the number of hashes the miner
contributed to the mining of the block. Is this proportional allocation rule
optimal? And in what sense? And what other rules are possible? In particular,
what are the desirable properties that any "good" allocation rule should
satisfy? To answer these questions, we embark on an axiomatic theory of
incentives in proof-of-work blockchains at the time scale of a single block. We
consider desirable properties of allocation rules including: symmetry; budget
balance (weak or strong); sybil-proofness; and various grades of
collusion-proofness. We show that Bitcoin's proportional allocation rule is the
unique allocation rule satisfying a certain system of properties, but this does
not hold for slightly weaker sets of properties, or when the miners are not
risk-neutral. We also point out that a rich class of allocation rules can be
approximately implemented in a proof-of-work blockchain.
