Expert level
Token mechanism design is choosing rules so that people acting in their own interest produce the outcome a protocol needs. The recurring lesson is that participants respond to the incentive you actually pay, not the one you intended: emissions rent liquidity rather than buy it, vote escrow turns emissions into a market for votes, and any metric you reward becomes the thing people manufacture.
Incentives are code that runs on people
Every token mechanism has to survive three questions from mechanism design. Will the people you need take part at all (participation)? Is the behavior you want also the most profitable behavior (incentive compatibility)? And what does it cost to extract the reward without doing the useful thing (cost of subversion)? Most failed designs answered the first two and skipped the third.
Security people phrase the third question as two numbers. The cost of corruption is what an attacker must spend or put at risk to break the mechanism. The profit from corruption is what breaking it pays. A mechanism is safe only while the first exceeds the second, and both move with the token price, the size of the treasury and the depth of the markets the attacker would use. The same test sits under restaking and under every governance vote.
Crypto adds a twist: rewards are usually paid in the protocol's own token, whose price depends on the success of the mechanism. That loop is reflexive in both directions, and it is why a design that looks stable at one price can unravel at half of it. This guide works through the mechanisms builders reach for most, with the math that decides whether they hold. Worked numbers are illustrative unless stated otherwise.
Emissions and liquidity mining
Liquidity mining went mainstream in June 2020, when Compound began distributing COMP to lenders and borrowers and other protocols quickly followed. The mechanism is simple: pay token emissions to whoever supplies the capital you want.
Capital is not loyal, it is priced. It flows in until the total yield falls to what it can earn elsewhere, which gives a rough equilibrium:
| Scenario (E = 20M tokens a year, F = $1M, r = 8%) | Emissions value | Equilibrium deposits |
|---|---|---|
| Token at $0.50 | $10M a year | $137.5M |
| Token falls to $0.25 | $5M a year | $75M |
| Emissions end | $0 | $12.5M |
The protocol pays $10 million a year to hold $125 million it does not keep. That is renting at the market rate, and "mercenary capital" is just the name for capital doing exactly what the mechanism paid it to do. The cost falls on holders through dilution (see supply analysis), and the price cut in the second row shows the reflexive loop: lower price, smaller rewards, less capital, worse product, lower price. Emissions only buy something durable when the product generates organic yield that keeps capital after the subsidy ends, so measure the program by retention and fees per dollar emitted, not by peak deposits.
Also pay for the thing that is scarce. On a concentrated liquidity exchange, rewards paid per dollar deposited subsidize capital parked far out of range that never serves a trade. Rewards paid per unit of in range liquidity, or in proportion to fees earned, buy depth where trades happen (the LP economics are in LP as a strategy). The general rule: reward the output you need, not an input that correlates with it on a good day.
Vote escrow: the veCRV model
Curve's answer to mercenary capital was to make rewards depend on commitment. CRV can be locked for up to four years in exchange for veCRV, which is non transferable, cannot be withdrawn early, and decays linearly to zero as the unlock date approaches.
| Lock | veCRV per CRV at the start | After one year |
|---|---|---|
| 1 year | 0.25 | 0 |
| 2 years | 0.50 | 0.25 |
| 4 years | 1.00 | 0.75 |
veCRV does three jobs. It votes on gauge weights, which decide how CRV emissions are split between pools; votes apply from the next weekly epoch, weights update every Thursday at 00:00 UTC, and a vote for any one gauge can change at most once every 10 days. It earns protocol revenue: as of September 2026, Curve's docs describe 50% of trading fees and a share of crvUSD market interest going to veCRV holders, paid in crvUSD. And it boosts the holder's own liquidity rewards by up to 2.5 times, per Curve's gauge documentation:
Worked example: you provide $1 million of a $10 million gauge and hold 5% of all veCRV. Your working balance is min(400,000 + 0.6 × 10,000,000 × 0.05, 1,000,000) = 700,000, a boost of 1.75×. Full boost needs your share of veCRV to at least equal your share of the gauge, here 10%. CRV's own emissions started at 22% a year and fall by about 15.9% each year toward an eventual supply of about 3.03 billion, so the gauge vote routes a large, predictable stream.
Liquid wrappers and bribe markets
Locking creates demand for liquidity, and liquidity always finds a wrapper. Convex locked CRV permanently, gave depositors a liquid claim, and aggregated a large share of all veCRV; its own locked token then decided how that veCRV voted. Marketplaces such as Votium let protocols pay those voters directly for gauge votes. A vote became a yield bearing asset with a price.
The price has a ceiling set by what the vote controls. If a round directs emissions worth $2 million across 500 million votes, each vote directs $0.004 of emissions. A protocol that wants liquidity in its pool will pay up to that, since the alternative is paying rewards itself. A passive voter will accept almost anything above zero. Where bribes clear below the value of the emissions they direct, $1 of bribes buys more than $1 of rewards for the briber's pool, which is exactly why the market grew.
Whether that is a bug depends on scope. As a transparent auction for emissions it arguably allocates them better than an apathetic vote. The danger comes when the same votes also control treasuries, parameters or upgrades, because then control of the protocol can be bought at emissions prices. That is a governance design problem, covered in onchain governance.
Fee switches, buybacks and distributions
A fee switch sends part of protocol revenue somewhere other than liquidity providers. Uniswap governance passed its UNIfication proposal in December 2025 (executed on December 27), which turned on protocol fees, starting with v2 and a set of v3 pools, and directed them to a UNI burn; it also provided for burning 100 million UNI from the treasury. Curve distributes instead, paying veCRV holders in crvUSD. The choice between buying back and distributing matters less than people argue, and more in specific places.
In a frictionless world the two are equivalent: holders who do nothing end up with the same value either way. They diverge on the frictions:
| Mechanism | Who captures value | Where it leaks |
|---|---|---|
| Buyback and burn | Holders who stay, through a smaller supply | Price impact, and front running if the schedule is public |
| Buyback into treasury | Nobody yet; the treasury can resell later | Future dilution is one vote away |
| Pro rata distribution | Every holder, in cash or stablecoins | Tax treatment varies by jurisdiction; holders must act |
| Distribution to stakers or lockers | Only those who lock | Liquidity cost; concentrates rewards |
One asymmetry deserves attention: a buyback at a price above what the token is worth transfers value from the holders who stay to the ones who sell. Buybacks executed as slow, unannounced schedules or auctions leak less to traders than a published calendar. None of this is investment advice about any token; it is the arithmetic a designer should run before choosing.
Value accrual can also come from capturing value that currently leaks. The UNIfication proposal described a Protocol Fee Discount Auction: the right to swap without the protocol fee, for one address and a short window, is auctioned, with the winning bid feeding the burn. The aim is to internalize some of the arbitrage profit that would otherwise go to searchers and validators (see MEV). Whatever its results, the design move is worth noting: before raising a fee, look for value already leaving the system and sell the right to it.
Bonding curves and launch mechanics
A bonding curve makes price a deterministic function of how much has been sold. pump.fun's public program documentation describes a Uniswap v2 style constant product curve over synthetic reserves, so the very first buyer faces a finite price with no liquidity seeded. As published, each new coin starts with virtual reserves of 30 SOL and 1,073,000,000 tokens, 793,100,000 of its 1 billion tokens are sold on the curve, and when they run out the curve is complete and liquidity migrates to PumpSwap, with the LP tokens burned (the graduation step).
| Using the published starting parameters | Result |
|---|---|
| Tokens bought with the first 1 SOL | About 34.6 million, 3.46% of supply |
| Tokens bought with the last 1 SOL before completion | About 2.46 million |
| SOL raised when the curve completes | About 85.0 |
| Price at completion versus the first trade | About 14.7× |
The curve's shape is the point: early units are cheap, which rewards whoever buys first. That makes the first block the contested one, and is why snipers and bundled launches cluster there (more on the platform itself at pump.fun). Other launch designs trade different things. A Dutch auction starts high and falls until demand appears. A batch auction clears everyone at one price, which makes being first worthless. A liquidity bootstrapping pool shifts pool weights over time so the price drifts down unless people buy, discouraging an opening rush.
Points programs and Goodhart's law
When a measure becomes a target, it ceases to be a good measure. Points are that law with a token attached: an undeclared liability that pays whoever produces the measured action most cheaply. Reward volume and you get wash trading (see wash trading). Reward deposits and you get recursive loops that deposit, borrow and redeposit the same capital several times. Reward transactions and you get scripts. Reward wallets and you get farms of wallets.
Designs that hold up reward outcomes that are expensive to fake: fees actually paid, balances weighted by time and net of borrowing, activity that persists after the program ends. Keeping part of the criteria retroactive reduces gaming at the cost of transparency, a real tradeoff with users. Concave reward curves and per identity caps limit whales but raise the payoff for splitting, which leads straight to the next problem. The user's side of this is in airdrops and points.
Sybil resistance is a cost equation
Sybil resistance never identifies people perfectly. It raises c or lowers R for identities that look cheap. The subtle part is how rewards scale with size. With linear rewards, splitting a stake across wallets gains nothing. With concave rewards, such as square root voting weights, splitting one wallet into four doubles the reward (in quadratic funding, the matching it attracts quadruples), so any concave scheme is only as strong as its identity layer.
| Approach | How it raises the cost | Tradeoff |
|---|---|---|
| Minimum stake or balance | Capital per identity | Excludes small real users |
| Onchain history and clustering | Time and gas per convincing wallet | False positives; farmers learn the rules |
| Proof of personhood | A unique human per identity | Privacy, access, a new trusted party |
| Attestations and social graphs | Reputation that is slow to build | Favors the already connected |
| Linear, uncapped rewards | Removes the gain from splitting | Whales capture more |
A design checklist
Name the behavior, then the cheapest fake
For every reward, write the behavior you want and the cheapest way to produce the measured signal without it. If the fake is cheaper than the reward, it will be produced.
Price the mechanism at half the token price
Rerun every equilibrium at a lower price. If participation collapses, the design depends on price going up, which is a bet, not a mechanism.
Separate what votes control
If a vote can be rented cheaply to route emissions, it must not also control the treasury or upgrades on the same terms.
Model the exit
What happens when emissions end, locks expire in a cluster or a large holder leaves? Unlock schedules are part of the mechanism (see supply analysis).
Measure outcomes, not activity
Retention, fees per token emitted and net new users, tracked after the incentive, not during it.
Common questions
Why does mercenary capital leave when emissions end?
Because it came for the yield, and capital moves to wherever it earns most. Emissions raise the return on deposits above what capital earns elsewhere; when they stop, deposits fall back toward what organic fees alone can support. Programs keep capital only if the product produces real yield or usefulness on its own.
How does veCRV voting power work?
You lock CRV for up to four years and receive veCRV equal to the amount locked times the fraction of four years remaining. It decays linearly to zero at unlock, cannot be transferred or withdrawn early, and is used to vote on gauge weights, earn a share of protocol revenue and boost your own liquidity rewards up to 2.5 times.
What is a bribe market in DeFi?
A marketplace where protocols pay holders of vote escrowed tokens to vote for their pool in emissions votes. The payment is rational while the emissions a vote directs are worth more to the protocol than the bribe. It is transparent, but it means governance power can be priced and rented.
Is a token buyback better than distributing fees?
In a frictionless model the two deliver the same value to holders. They differ in practice through price impact, front running, tax treatment that varies by jurisdiction, who benefits, and whether the treasury can later resell. A buyback at a price above what the token is worth moves value from holders who stay to sellers.
How does a pump.fun style bonding curve set the price?
The price comes from a constant product formula over virtual reserves, so it rises with every token sold and falls with every token sold back. Early units are the cheapest. When the tokens allocated to the curve run out, the curve completes and liquidity moves to a regular pool.
Where to go next
Next: Onchain governance: attacks, timelocks and delegation
Guide 16 of 16 in the Expert level. Your place is kept on this device, so you can pick up exactly here next time.