Sara Biancini
email: sara.biancini@unicaen.fr

David Ettinger
email: david.ettinger@dauphine.fr

Baptiste Venet
email: baptiste.venet@dauphine.fr

Emmanuelle Auriol

François Bourguignon

Attila Tasnádi

Mission Drift in Microcredit and Microfinance Institution Incentives

Keywords: O120, O160, G210 microfinance, donors, poverty, screening

We analyze the relationship between Microfinance Institutions (MFIs) and external donors, with the aim of contributing to the debate on "mission drift" in microfinance. We assume that both the donor and the MFI are pro-poor, possibly at different extents. Borrowers can be (very) poor or wealthier (but still unbanked). Incentives have to be provided to the MFI to exert costly effort to identify the more valuable projects and to choose the right share of poorer borrowers (the optimal level of poor outreach). We first concentrate on hidden action. We show that asymmetric information can distort the share of very poor borrowers reached by loans, thus increasing mission drift. We then concentrate on hidden types, assuming that MFIs are characterized by unobservable heterogeneity on the cost of effort. In this case, asymmetric information does not necessarily increase the mission drift. The incentive compatible contracts push efficient MFIs to serve a higher share of poorer borrowers, while less efficient ones decrease their poor outreach.

Introduction

For the last 30 years, the microfinance industry has been responsible for a massive growth of pro-poor financial services. The growth of the sector and the increasing financial flows into Microfinance Institutions (MFIs) have stimulate a debate on the evolution of the sector. The main elements of the recent evolution are the explosion of for-profit and profit-oriented MFIs and the change in the nature of some external donors (private vs. public). Both these issues have contributed to fuel the debate on the "mission drift" in microfinance. [START_REF] Armendáriz | On mission drift in microfinance institutions[END_REF] state that mission drift arises when a MFI "increases its average loan size by reaching out to wealthier clients neither for progressive lending nor for cross-subsidization reasons. Mission drift in microfinance arises when an MFI finds it profitable to reach out to unbanked wealthier individuals while at the same time crowding out poor clients". [START_REF] Aubert | Designing credit agent incentives to prevent mission drift in pro-poor microfinance institutions[END_REF] define mission drift as a context where "MFIs increasingly tend to work with clients that are less poor".

However, encouraging profitability is not necessarily a sign of abandoning the pro-poor orientation of microfinance. On the contrary, from the origin, financial sustainability and profitability have been considered as necessary conditions for a healthy development of microcredit markets. This clearly appears in [START_REF] Yunus | Banker to the Poor[END_REF], when in its well known book "Banker to the Poor", he states "If Grameen does not make a profit, if our employees are not motivated and do not work hard, we will be out of business. (...) In any case, it cannot be organized and run purely on the basis of greed. In Grameen we always try to make a profit so we can cover all our costs, protect ourselves from future shocks, and continue to expand. Our concerns are focused on the welfare of our shareholders, not on the immediate cash return on their investment dollar." (chapter 11, p. 204). Similarly, in the Key Principles in microfinance published by the Consultative Group to Assist the Poor (CGAP) in 2004, financial sustainability is evoked as the 4th principle and defined as "necessary to reach significant numbers of poor people".

In this spirit, observers and policymakers have increasingly put the accent on the necessity for microfinance institutions to be profitable, or "financially" sustainable, raising interest rates and going through commercialisation to be able to attract private investors (see [START_REF] Cull | Microfinance meets the market[END_REF].

Nonetheless, a report commissioned by Deutschebank research showed that, in 2007, 70% of MFIs were small start-ups, mostly unprofitable, while only the top 150 MFIs were fully sustainable mature entreprises [START_REF] Dieckmann | Microfinance: An emerging investment opportunity[END_REF]. At the same time, the positive view of commercialization and profitability has been challenged in recent years by the critics following the news that the largest microfinance bank in Latin America, the Mexican Compartamos, was offering returns on equity of 53%, while charging interest rates exceeding 100% to the poor. In a famous column appeared in the New York Times on January 14, 2011, Yunus reacted to this debate denouncing a tendency to "sacrificing microcredit for megaprofits".

The main difficulty when trying to assess the extent of "mission drift" is that it is complicated to empirically establish whether a microfinance institution has indeed deviated from its povertyreduction mission. One widely used proxy for poverty is average loan size, but as [START_REF] Armendáriz | On mission drift in microfinance institutions[END_REF] point out, the relationship between mission drift and loan size is not easy to tackle, so that socially responsible investors should be cautious when interpreting empirical evidence on loan size. Another possible sign of mission drift could be a tendency to practice higher interest rates. However, [START_REF] Roberts | The profit orientation of microfinance institutions and effective interest rates[END_REF] shows that, although profit oriented MFIs do usually charge higher interest rate, they are not significantly more profitable, because they tend to have higher costs. He concludes that his analysis finds "no obvious indication of a mission drift".

We believe that additional theoretical work is needed to understand the phenomenon and being able to interpret empirical facts. In the present paper, we present a theoretical analysis aimed at increasing our understanding of the role of donors in affecting mission drift tendencies in microfinance. We propose a model in which both the donor and the MFI are pro-poor, although they can put different weights on the aim of providing credit to the poorest borrowers.

Incentives have to be provided to the MFI to exert costly effort to identify the more valuable projects and to choose the right share of poorer borrowers (the optimal level of poor outreach).

We characterize the optimal contract proposed to MFIs in the aim of balancing outreach, budget considerations and MFIs survival.

We consider both the cases of hidden action (effort is not observable) and hidden types (MFIs have unobservable cost heterogeneity). The two cases are relevant for the sector. For instance, the report "Microfinance in Africa" realised for the United Nations in OSAA and NEPAD (2013), put the accent on the difficulties of operating in a context of lack of transparency and weak institution, an environment which favor hidden action problems. In addition, the same report also points out that the donors should promote the diversification of institutions to "improve range and quality of services, and reduce costs". This suggest the importance of the role of donors in proposing differentiated contracts in a context of heterogeneous institutions as in our framework with hidden types. Hidden type problems are also likely to be very relevant in context like Latin America, where microcredit providers present a wide range of institutional diversity and performances (see for instance the recent Report of [START_REF] Trujillo | Financial inclusion in latin america and the caribbean[END_REF].

We first assume that effort is unobservable (hidden action model) assuming that the donor cannot observe neither the effort level chosen by the MFI, nor the fraction of richer borrowers.

He only discovers the total repayment rate of loans to the MFI. We show that, in this case, asymmetric information can reduce the share of very poor borrowers reached by loans, thus increasing mission drift. This happens when the pro-poor orientation of the MFI is weak as compared to the one of the donor, so that this source of mission drift is more likely to arise in country in which MFIs are profit oriented. Afterwards, we allow for unobserved heterogeneity among MFIs: some of them are more efficient than others and the contract proposed by the donor has to screen among different types of MFI (hidden type model). In this case, the existence of asymmetric information between the donor and the heterogeneous MFIs tends to increase the poor outreach of the more efficient MFIs while decreasing it for less efficient ones so that in some case asymmetric information has the effect of lowering the average level of mission drift (i.e. the share of richer borrowers who are granted a loan).

Related literature

The question of the relationship between MFIs and external donors has gained importance in the last year. Surprisingly, as [START_REF] Ghosh | Funding microfinance under asymmetric information[END_REF] point out, the existing literature on microfinance has not paid much attention to that question1 . An indirectly related literature has considered the broader question of the relationship between external donors and other recipients (such as NGOs). For instance, [START_REF] Besley | Government versus private ownership of public goods[END_REF] consider the issue of the optimal contract between a government and an NGO to carry out a development project, showing how hold-up problems shape the optimal way to delegate responsibility for providing social welfare and development services to nongovernmental organizations. Aldashev andVerdier (2009, 2010), examine the effects of international competition between NGOs to raise funds. They show that if the level of outside options of NGO entrepreneurs is low enough, increased competition among NGOs can lead to higher fund diversion, despite the fact that they care about the impact of their projects.

More recently, the literature has tackled specific issues of microfinance. In this context, [START_REF] Aubert | Designing credit agent incentives to prevent mission drift in pro-poor microfinance institutions[END_REF] focus on the internal organization of MFIs and highlight the importance of the incentives given to the credit agents. They analyze the optimal contract in the presence of moral hazard and investigate the issue of mission drift in this context. In their model, the credit agents are not pro-poor and can under-report repayments so that they have to be given the right incentives to investigate the ability and wealth of borrowers. The MFI can monitor agents. However, when monitoring is costly, a pro-poor MFI can be obliged to provide the agent with incentives based on repayments thus generating mission drift. While [START_REF] Aubert | Designing credit agent incentives to prevent mission drift in pro-poor microfinance institutions[END_REF] concentrate on the internal incentives provided by MFIs, incentive issues are also likely arise in the relationship between MFIs and external donors. In our paper, we concentrate on this relationship as a source of contract frictions and mission drift.

In our context, we find reasonable to assume that both the MFI and the donors are pro-poor, at least to some extent. Although we do not allow the MFI to under-report repayments, in our framework, incentives need to be provided to have the MFI exerting costly effort to discover valuable clients' investment projects (while wealth is easily observable by the MFIs which has better knowledge than the donors of the local conditions). In this context, in addition to moral hazard problems we also consider adverse selection issues. MFIs are heterogeneous and the donor cannot perfectly observe their characteristics. In our context, asymmetric information and contract distortions can have different impacts on mission drift. Ghosh andVan Tassel (2011, 2013) also focus on the relationship between donors and MFIs.

In their first paper, they present a model in which socially responsible MFIs (their main goal is to reduce poverty) must be funded by a profit-seeking investor. They find that competition among MFIs to obtain external funds has two opposite effects: on the one hand, having to pay a high rate of return to the external funder raises the interest rates charged to borrowers; on the other hand, it is also a way to make the funding more efficient by redirecting funding from inefficient MFIs to more efficient ones. If the average increase in the quality of MFIs more than compensates for the higher interest rates, the competition for external funds is pro-poor. In our paper, we do not consider competition and we assume that the donor also has a social objective.

We show that the optimal contract proposed to heterogeneous MFIs does not necessarily exclude inefficient MFIs, unless there are very few of them. We characterize separating contract in which efficient and inefficient MFIs are optimally proposed different contracts. Moreover, we consider asymmetric information.

Our approach is thus similar to [START_REF] Ghosh | Funding microfinance under asymmetric information[END_REF], who extend the previous analysis by introducing asymmetric information and socially motivated donors. In their analysis, the financial return may be used as a screening mechanism by donors to discriminate between MFIs, dissuading high cost MFIs to apply for external funding. In our framework, we show that exclusion of the less efficient MFIs occurs only if their number is small. Otherwise, the donor may propose different contracts to different types of MFIs, which may have different impacts on mission drift. Incentives will be provided not to squeeze out the less efficient MFIs, but to promote effort and to screen among heterogeneous MFIs proposing different contracts to different types of MFIs. In addition, we assume that the donor cares for the survival and long term viability of MFIs, putting a positive weight on the profit of the MFI. This captures the idea that leaving some money to a MFI is not completely wasteful for the donor, because it allows the MFI to survive in the future.

The basic model

We consider the relationship between a donor (the principal, "he") and an MFI (the agent, "she"). The MFI lends a mass 1 of money to a local population of borrowers. The population of borrowers contains an infinity of borrowers, who don't have access to bank lending. Borrowers are heterogeneous: some of them are richer (they are unbanked but less poor, with a positive initial wealth level that is not pledgeable and does not allow to access bank lending) and some of them are poorer (they have no wealth whatsoever). The MFI chooses the proportion α of the money lent to richer borrowers in his loans portfolio and the weight she puts on financing the right level of poorest borrowers measures her pro-poor orientation. In addition, the MFI has to exert effort to screen out valuable projects, when examining the project proposed by both richer and poorer borrowers. This effort level e can be interpreted as the share of loans for which the MFI makes costly effort in order to identify the quality of the project. Without any screening effort on the MFI side, the expected reimbursement of richer borrowers, R R , is strictly higher than the expected reimbursement of poorer borrowers, R P , because richer borrowers have higher collateral. We also assume that the screening effort increases the loans return by a parameter, ∆R and for simplicity we assume that this parameter is identical for richer and poorer borrowers.

The expected reimbursement for the projects financed by the MFI is therefore equal to:

θ(α, e) = R P + α(R R -R P ) + ∆Re (1)
With e, the fraction of loans for which the MFI exerts a screening effort. We assume that the cost associated to the effort e is linear and does not depend on the type of borrowers so that we can denote it µe with µ > 0. This effort translates into a monetary cost, because in order to identify the quality of the borrower projects, the MFI has to pay credit officers who study the quality of the projects. The effort provided by the MFI can thus be simply interpreted as an effort necessary to examine projects and screen the good ones (with higher repayment potentials). Alternatively, this can be interpreted as the effort (and the cost) necessary to provide additional services to the borrowers, thus increasing the potential of their investment projects.

In order to finance the loans, the MFI has no direct access to the financial market so that she has to contract with a donor (the principal). The donor proposes a contract or a menu of contracts to the MFI. The contract specifies the refund, T , that the MFI is supposed to pay to the donor in exchange for the funding and, depending on the informational context that we will specify the effort level, e.

The donor's utility is an increasing function of the refund he receives from the MFI but the donor is also concerned by the loan allocation to the right borrowers and the survival of the MFI. More precisely, we represent his preferences with the following utility function:

V = T -1 + λ 1 ( 1 -( α -α * 1 -α * ) 2 ) + λ 2 (θ(α, e) -µe -T ) (2)
T -1 is the budget balance of the lending process for the donor. λ 1 > 0 is the weight that the donor puts on the distribution of the loans to the right borrowers. α * is the optimal fraction of loans granted to richer borrowers. α * is not necessarily equal to 0. For several reasons, the donor may prefer that some richer borrowers may also be financed. 2

We choose the formula (1 -( α-α * 1-α * ) 2 ) to represent the utility that the donor derives from lending money to borrowers with a fraction of richer borrowers because we wanted to make it clear that the donor derives a positive utility from lending this money. In the version we use, this element that we incorporate in the utility function is always positive. However, after some normalization, we can show that this is equivalent to considering -(α -α * ) 2 which is simpler.

(θ(α, e)-µe-T ) is the amount of money left to the MFI and λ 2 ≥ 0 is a parameter representing the interest of the donor in the survival of the MFI. The higher θ(α, e) -µe -T , the higher the net income of the MFI and her probability to survive. We assume that λ 2 < 1, otherwise the donor could increase his utility by simply transferring money to the MFI.

2 Different values for the optimal share of poorer borrowers can derive from natural welfare functions in which the donor cares for the welfare of the poorest borrowers, while taking into account that richer unbanked borrowers generates higher expected income. For instance, even if the donor only cares about poorer households, she might take into account that lending to some richer individual might generate a trickle-down effect, for instance creating local jobs and increasing the living condition of the poorer borrowers. On the other hand, even if richer households produce higher expected revenue, the donor would want to finance a certain ratio of poorer borrowers to achieve a better distribution of wealth. In addition, unbanked wealthier are relatively more abundant than unbanked poor in many middle-income regions. As noted in [START_REF] Armendáriz | On mission drift in microfinance institutions[END_REF] the fact that many MFIs in these region serves a higher share of less poor borrowers does not necessarily means that they all deviated from their mission.

The MFI also cares about the ratio of poorer and richer borrowers to whom she grants loans.

For the sake of simplicity, we assume that the preferred fraction of richer borrowers for the MFI is the same as for the donor, α * . 3 However, the weight that the MFI gives to this dimension of his utility β 1 > 0, may differ from the λ 1 of the donor. Eventually, the MFI's utility function is defined as follows.

U = θ(α, e) -T -µe + β 1 ( 1 -( α -α * 1 -α * ) 2 ) (3)
Besides, we assume that the MFI has no other external funds at the time she accepts the contract with the donor so that she also faces a budget constraint:

θ(α, e) -T -µe ≥ 0 (4)
The MFI does not accept a contract such that this constraint is not satisfied (perfectly anticipating her own behavior after having accepted the contract).

First case: the donor cannot observe effort e (Hidden action)

In this section, we assume that the donor cannot observe neither the effort level chosen by the MFI, e nor the fraction of richer borrowers, α. However, the donor discovers the reimbursement level, θ, obtained by the MFI (the MFI cannot hide the money). We also assume that e can take any value in the interval [0, 1] and that the value of µ is common knowledge. The timing of the game is the following: •

•
Step 1: The MFI accepts the offer or refuses it. If she refuses it, the game is over without any lending or transfers. If she accepts it, the game continues.

•

Step 2: The MFI chooses e and α.

3 We could also obtain results with an α * M F I and an α * D and α * M F I ̸ = α * D . However, we chose to consider a unique α * in order to show that our results cannot be explained by the different view about the optimal fraction of richer borrowers between the MFI and the donor. Hence, the choice of a unique α * .

• Step 3: Borrowers reimburse the loan. θ(e, α) is common knowledge and the MFI makes her payment to the donor in accordance with the initial contract and the actual value of θ.

This game is aimed at representing, in a simple framework, a situation in which the donor cannot observe the actual effort made by the MFI to discover good projects (or to propose valuable services to borrower) nor the actual wealth of the borrowers. On the other hand, we can think that the donor can more easily observe the total revenue of the MFI and propose a reimbursement of the funds which is a function of the realized revenues, that, for simplicity, we assume to be perfectly observable.

Before focusing on the contract and the decisions of the MFI, we first observe that it is not necessary to consider values of θ c such that θ c < R P + α * (R R -R P ) since both the donor and the MFI agree that α < α * gives a lower utility and a lower reimbursement level than choosing α = α * . Now, let us consider the MFI decision. Since the contract only specifies θ c , the reimbursement level, if she accepts it, she will choose among all the pairs (e, α) such that θ(e, α) = θ c . In order to increase the size of the reimbursement rate, increasing the share of rich borrowers is a substitute to higher effort.

If θ c ≥ R P + α * (R R -R P ), the MFI will choose an α such that α ≥ α * so that the marginal cost of increasing θ by rising the fraction of richer borrowers is

2β 1 R R -R P α-α *
(1-α * ) 2 which is strictly increasing in α. The MFI increases α up to the point when further increasing the share of richer borrowers becomes more costly than increasing effort. The marginal cost of increasing θ by a raise in the effort level is equal to µ ∆R which is a constant. The two costs are equal when

α = α * + (1-α * ) 2 (R R -R P )µ 2β 1 ∆R ≡ α M .
Therefore, there are 3 cases (assuming that T c is small enough, otherwise the MFI will refuse the contract):

• If θ c < R P + α M (R R -R P )
, the MFI will choose an effort level 0 and an α equal to

θ c -R P R R -R P in order to obtain θ c . • If R P + α M (R R -R P ) ≤ θ c ≤ R P + α M (R R -R P ) + ∆R, the MFI will choose α = α M
and an effort level e ∈ [0, 1] such that the reimbursement level is equal to θ c .

• If θ c > R P + α M (R R -R P ) + ∆R,
the MFI will choose an effort level 1 and an α equal

to θ c -R P -∆R R R -R P in order to obtain θ c .
This result appears on Figure 3 which represents all the pairs (α, e) chosen by the MFI depending on the θ c proposed by the donor. When the graph goes northeast, this coincides with a higher θ c chosen by the donor. The graph is uniquely characterized by the value of α M .

Figure 1: MFI's preferences

Now, the donor. We first consider the donor's first best, the choice that he would impose on the MFI if he could choose the pair (α, e) which maximizes his utility while satisfying the MFI budget constraint, T ≤ θ(α, e) -µe. This constraint will always be binding since λ 2 < 1, therefore we can assume that in this first best contract, T = θ(α, e) -µe so that the donor's utility will be equal to:

V = R P + α(R R -R P ) -1 + ∆Re -µe + λ 1 ( 1 -( α -α * 1 -α * ) 2 ) (5)
This is equal to the utility of the MFI given in (3), except that T (the transfer for the MFI) is replaced by 1 and the parameter β 1 is replaced by λ 1 .

Looking at the formula, we observe that if ∆R < µ, the donor prefers e = 0, if ∆R > µ, the donor prefers e = 1 and if µ = ∆R, the donor is indifferent among effort levels. As for the optimal level of α, we can find it by maximizing

α(R R -R P ) + λ 1 (1 -( α-α * 1-α * ) 2
). This gives an optimal α for the donor:

α * + (1-α * ) 2 (R R -R P ) 2λ 1 ≡ α D .
Now, the donor cannot actually choose the pair (α, e) because he does not observe the choice of the MFI. We can consider 3 different cases.

If ∆R ≤ µ, the cost of effort is higher than the social benefit, the donor prefers (α D , 0).

Preferring that the MFI makes no effort, the donor can propose a contract which only cov-ers the costs with no effort when the share of richer borrowers is equal to α D , (θ c , T c ) = (θ(α D , 0), θ(α D , 0)). The MFI will accept the contract and choose (α, e) = (α D , 0) so that the donor will manage to impose his preferred pair to the MFI.

If ∆R > µ and α D ≥ α M , the cost of effort is lower than the social benefit and the optimal α for the donor is higher than the optimal α for the MFI. The donor can obtain that the MFI chooses (α, e) = (α D , 1) by proposing a contract (θ c , T c ) = (θ(α D , 1), θ(α D , 1) -µ). In this case, the donor can obtain the preferred share of richer borrowers by imposing a high reimbursement which forces the MFI to exert effort and to push the share of richer borrowers to α D . Now the richest case is when ∆R > µ and α D < α M . Since ∆R > µ, the donor would prefer the MFI to make an effort equal to 1 (the social cost of the effort is lower than the social profit).

The donor would also like the MFI to choose an α strictly lower than α M since α D < α M . However, we already noted that whatever the contract proposed (θ c , T c ), it is never possible to obtain that the MFI chooses an effort equal to 1 and an α < α M since the MFI will always reduce its effort (with a marginal cost µ ∆R for an increase in θ) and raise the ratio, α of richer borrower (with a marginal disutility for an increase in θ strictly lower than µ ∆R when α < α M ). Therefore, we obtain the following result.

Proposition 1

The donor proposes a contract (θ c , T c ) to the MFI such that:

• If ∆R ≤ µ, the donor proposes a contract inducing effort e = 0, setting θ c = θ(α D , 0) and

T c = θ(α D , 0). • If ∆R > µ and λ 1 > ∆R µ β 1 (equivalent to α D ≥ α M
), the donor proposes a contract inducing effort e = 1, setting θ c = θ(α D , 1) and T c = θ(α D , 1) -µ.

• If µ ≤ ∆R < µ + λ 1 (α M -α D )(α M +α D -2α * ) 1-α * + (α M -α D )(R R -R P ) and λ 1 ≤ ∆R µ β 1
, the donor proposes a contract inducing effort e = 0, setting θ c = θ(α D , 0) and T c = θ(α D , 0).

• If ∆R > µ + λ 1 (α M -α D )(α M +α D -2α * ) 1-α * + (α M -α D )(R R -R P ) and λ 1 ≤ ∆R µ β 1 , the donor proposes a contract inducing effort e = 1, setting θ c = θ(α M , 1) and T c = θ(α M , 1).
In all cases the MFI accepts and executes the proposed contract.

If the social cost of effort is high, µ ≥ ∆R, there is no effort and no distortion due to the asymmetry of information. The donor can implement the lending policy he prefers even if he only observes θ. Even if α M < α D so that in order to obtain the reimbursement rate θ(α D , 0) which would coincide with the preferred choice of the donor (α D , 0), the MFI would rather make strictly positive effort and choose an α strictly lower than α D (as can been seen with point A and A' in Figure 2(a)), the donor can implement (α D , 0). The MFI will never make any effort if she is not compensated for this effort because of her budget constraint. If the donor wants to implement point A, although the MFI would prefer point A' (with the same θ), the donor can force the MFI to choose A.

The α chosen is not equal to α * which may be considered as a mission drift. This is explained by the tradeoff between lending money to poorer borrowers and obtaining a higher reimbursement rate. Since the cost of an increase in the fraction of richer borrowers at the neighborhood of α * is negligible and the marginal increase in reimbursement rate is constant, equal to R R -R P , the chosen α will always be higher than α * .

If the social cost of effort is lower than its social benefit, µ < ∆R, it is socially optimal to make an effort equal to 1. However, this effort will not always be implemented. If α D is higher than α M , the situation is simple, the donor proposes a contract with an α = α D , e = 1 and a repayment such that the MFI makes no profit. Since (α D , 1) is an element of the optimal curve of the MFI, he will accept the contract and choose (α D , 1). This is represented by point B in Figure 2(a). Now, if α D < α M and the donor proposes a contract (θ(α D , 1), θ(α D , 1) -µ), the MFI will not choose (α D , 1). He will choose a lower effort level and a higher α. that the effort level will be equal to 1 but the fraction of richer borrowers will be higher than the donor's first best. In the first case, the effort level is suboptimal, in the second case, the fraction of richer borrowers is too high, a stronger mission drift. The donor will choose among these two contracts the one that minimizes his utility loss.

The model thus shows how mission drift is affected by the objectives of the donor and the MFI. As expected, a high share of richer borrower can depend on the preferences of the donor.

If the donor puts a low weight on the pro-poor mission, then he can decide to push the MFIs to realize his preferred share of poor borrowers asking for a high reimbursement, so that effort alone is not enough for the MFI to generate the required revenue and she is pushed to serve more richer borrowers. The hidden action problems can have an additional (adverse) impact on the mission drift as compared to the benchmark case of complete information. This happens when the MFI put relative low weight on the pro-poor mission while the donor is more pro-poor (as in the case illustrated in Figure 2(b)): in this case, the donor cannot induce the preferred share of poorer borrowers and mission drift increases (as in point G). Alternatively, the donor has to renounce to induce high effort (as in point F ). This could also be interpreted as an other source of mission drift in the sense that, for a given share of richer borrower, the quality of the service provided by the MFI has to be degraded to satisfy the contract proposed by the donor.

We have thus shown that hidden action is likely to have an adverse effect on mission drift when the pro-poor orientation of the MFI is weak compared to the one of the donors. On the contrary, if the MFI is pro-poor, the contract proposed by the donor can induce the desired level of effort and of the share of reacher borrower desired by the donor so that asymmetric information has no particular impact on the mission drift.

To drive some implications from the model, it is first important to note that hidden action is related to the unobservability of effort. In practice, this problem is more relevant when the market is less transparent and the information on the functioning of MFIs is hard to gather.

For instance the report "Microfinance in Africa" (OSAA and NEPAD, 2013) mentions that a widespread weakness of African Microfinance is the prevalence of governance problems coupled with the diffusion of informal enterprises with scarce access to reliable information. In these countries, governments and development institutions should thus probably concentrate their efforts in increasing transparency and support MFIs to improve governance. In addition, we have shown that the distortions are driven from the weak pro-poor orientation of MFIs. In a context in which many MFIs are profit-oriented, like in many Latin American countries for instance, the presence of hidden action is more likely to worsen the mission drift. But things should be different in Asian countries like India and Pakistan with a traditional focus on the social mission (Report on Asian Microfinance edited by [START_REF] Bedson | Microfinance in asia: Trends, challenges and opportunities. The Banking with the Poor Network[END_REF]. This is not to say that moral hazard cannot occur in pro-poor MFIs, but in our framework we show that in this case it is easier for the donors to obtain the desired levels of effort and redistribution through second best contracting with the MFIs.

Second case : the donor cannot observe the type of the MFI θ (Hidden type)

In this section, we consider the case in which MFIs are characterized by unobservable heterogeneity. For simplicity, we assume that there are two types of MFIs, a share η of more efficient ones with low cost of effort µ L , and a share (1 -η) of less efficient MFIs with high cost of effort µ H > µ L . To simplify the analysis, we assume in this section that effort is observable and can take two values, e i ∈ {0, 1}, i = 1, 2. We thus restrict our attention to the hidden type problem faced by the donor. The donor cannot observe the cost of effort of the MFI but he can offer a menu of contracts possibly discriminating between the different types of MFIs. We assume that the donor offers a contract depending on the type of MFI (H, L) in such a way that each MFIs prefers the contract designed for her type rather than the contract designed for the other type (the Revelation Principle ensures that restricting the attention to this kind of contracts is without loss of generality). Thus, in step 0, the donor proposes a menu of contracts depending on the MFI's type (θ H , T H , e H ), (θ L , T L , e L ). The other steps are unaffected.

Because types are unobservable, the proposed contracts have to satisfy an incentive compatibility constraint, to avoid that MFIs mimic a cost of effort different from the true one. As well known, incentives for truthful revelation generally generate additional costs for the principal (the donor) in terms of rents abandoned to the agents (the MFI) and in terms of contract distortions. In some cases the principal (the donor) might also decide to offer the same contract to both types (pooling equilibrium) instead of tailoring the contract on the different cost characteristics, when the distortions created by the separating contracts are too large.

The donor maximizes his expected utility:

V = η [ T L -1 + λ 1 ( 1 -( α L -α * 1 -α * ) 2 ) + λ 2 (θ(α L , e L ) -µ L e L -T L ) ] +(1 -η) [ T H -1 + λ 1 ( 1 -( α H -α * 1 -α * ) 2 ) + λ 2 (θ(α H , e H ) -µ H e H -T H ) ] (6)
Under the two budget constraints:

θ(α L , e L ) -T L -µ L e L ≥ 0 (7) θ(α H , e H ) -T H -µ H e H ≥ 0 (8)
And the incentive compatibility constraints:

θ(α L , e L ) -T L -µ L e L + β 1 (1 -( α L -α * 1 -α * ) 2 ) ≥ θ(α H , e H ) -T H -µ L e H + β 1 (1 -( α H -α * 1 -α * ) 2 ) (9) θ(α H , e H ) -T H -µ H e H + β 1 (1 -( α H -α * 1 -α * ) 2 ) ≥ θ(α L , e L ) -T L -µ H e L + β 1 (1 -( α L -α * 1 -α * ) 2 )(10)
For standard reasons, at the optimal solution, the budget constraint of type H (8) and the incentive compatibility constraint of type L (9) will be binding so that we can replace in the objective function of the donor ( 6) the values of the transfers:

T H = θ(α H , e H ) -µ H e H ( 11
)
T L = T H + β 1 [ ( α H -α * 1 -α * ) 2 -( α L -α * 1 -α * ) 2 ] + (θ(α L , e L ) -θ(α H , e L )) + e H (µ H -µ L )(12)
Replacing ( 11), ( 12) and ( 1) in ( 6) we obtain:

V = η [ λ 1 (1 -( α L -α * 1 -α * ) 2 ) + ∆R + R P + α L (R R -R P ) -µ L e L -1 ] +(1 -η) [ λ 1 (1 -( α H -α * 1 -α * ) 2 ) + ∆R + R P + α H (R R -R P ) -µ H e H -1 ] -η(1 -λ 2 ) [ β 1 [( α H -α * 1 -α * ) 2 -( α L -α * 1 -α * ) 2 ] + e H (µ H -µ L ) ] ( 13
)
Because the MFI revenue θ(α i , e i ) and her effort e i , i = {1, 2} are observable, maximizing (6) with respect to T i , θ(α i , e i ) and e i corresponds to maximizing with respect to e i and α i equation ( 13) subject to the residual constraints ( 7) and ( 10).

The last term in the donor's objective (13),

β 1 [( α H -α * 1-α * ) 2 -( α L -α * 1-α * ) 2 ]+e H (µ H -µ L )
, represents the information rent of the most efficient type L. Efficient MFIs get a (weakly) positive rent from their information advantage. This rent is null if and only if µ H e H = µ L e L (which can occur only if e H = e L = 0) and α H = α L . The objective function of the donor is decreasing in the information rent, but its weight in donor's utility is decreasing in λ 2 (the higher λ 2 the more the donor is willing to abandon positive profits to the MFIs to ensure their survival and thus the less costly is the information rent in terms of utility for the donor).

Proof : see Appendix

Analysis.

Type 1 contract (no effort) is optimal if and only if ∆R < µ L . Otherwise, the principal would induce effort of at least the more efficient type L.

If µ L ≤ ∆R ≤ µ H the donor proposes a type 2 contract, inducing high effort only for type L, because effort of type H is too costly to be desirable. This type of contract does not generate any information rent and allows the donor to obtain its preferred share of richer borrowers α D .

Because type H is not incited to exert effort, its contract is not attractive for type L, who will be indifferent between the contract for type H MFI and the one proposed for its type. Similarly, type H is not attracted by the contract proposed to L because this contract does not allow to cover a high cost of effort µ H . The richest case is the one in which ∆R > µ H . In this case, effort of the two types of MFI is socially efficient, it would always be induced under complete information. However, under asymmetric information the principal needs to satisfy the incentive compatibility constraint (9), which becomes costly because an MFI of type L has a lower cost of effort and an incentive to pretend to be of type H.

Therefore, in order to obtain that both types of MFI make the effort, it is necessary to leave an information rent to the efficient MFIs. Even when ∆R > µ H , it may be the case that the donor prefers a type 2 contract in which inefficient MFIs do not make the effort in order to reduce the information rent given to efficient MFIs. This will be the case if ∆R -µ H (the efficiency gain associated to the effort of an inefficient MFI) and 1 -η (the proportion of inefficient MFIs) are low.

However, for reasonable values of the parameters of the model, the optimal contract for the donor will be a separating type 3 contract in which both types of MFI make the effort. This requires that ∆R > µ H which means that effort of the less efficient type also bring some efficiency gain, and that 1 -η is not too small, which means that there is not a overwhelming majority of more efficient MFIs. We will elaborate on type 3 contracts in the remaining part of this section.

Let us first consider the nature of these contracts. The donor wants both types of MFI to make the effort. In order to do so, he may propose the following two contracts: (e H , α H , T H ) =

(1, α D , θ(α, 1) -µ H ) and (e L , α L , T L ) = (1, α D , θ(α, 1) -µ L ). But both types of MFI would choose the first contract pretending to be inefficient and obtaining to pay back to the donor the lower amount of money θ(α D , 1) -µ H . In order to deter efficient MFIs from choosing the contract designed for inefficient ones, the donor has to make the contract designed for inefficient MFIs less attractive. A natural way to do so, since T H cannot be lower than θ(α D , 1) -µ H (otherwise inefficient MFIs will not be able to cover their costs) is to increase α H . Lowering the fraction of loans provided to poorer borrowers is costly for the MFI who also cares about the ratio of poorer and richer borrowers financed by his loans. Then, an efficient MFI will prefer a contract with α = α D and a higher T rather than the contract designed for inefficient MFIs with both a higher T and a higher α. As a result, we observe a stronger mission drift with an α > α D when the MFI is inefficient even though both the MFI and the donor would prefer α to be equal to α D . This mission drift is explained by the hidden type of the MFI. The donor chooses the stronger mission drift as a way to reduce the information rent given to the efficient type. Now, this is not the end of the story. Usually, in the principal-agent theory, the no distortion at the top rule applies. The contract designed for the most efficient agent is not distorted, not affected by the asymmetric information (except for the amount of the transfer). A natural interpretation of this rule in the environment we consider would be that the contract proposed to the efficient agent should specify an effort level and an α equivalent to the one we would observe with perfect information: e = 1 and α = α D . This is not the case. It is possible here to obtain a contract which is socially preferable to the one obtained in the perfect information case.

For the sake of simplicity, we will first present the intuition for the case λ 2 = 0. Suppose that the donor wants both types of MFI to make the effort and α to be equal to α D . He can obtain this outcome with a contract (e, α, T ) = (1, α D , θ(α, 1) -µ H ). Both types of MFI accept the contract and efficient MFIs obtain a revenue equal to µ H -µ L . This means that efficient MFIs are no longer budget constrained. Then, the donor could propose a contract

(1, α D -ε, θ(α D -ε, 1) -µ H + ε(2α D -2α * -ε)β 1 (1-α * ) 2 ), ε(2α D -2α * -ε)β 1 (1-α * ) 2
, being the MFI's increase in utility when α decreases from α D to α D -ε. This contract can be interpreted as follows. The donor proposes to efficient MFIs a reduction of α and an increase in the money that he is paid back by an amount equivalent to the increase in utility obtained by reducing α. This means that the donor derives both his extra utility by lowering α and the extra utility that the MFI derives by lowering α (through the increase of T ), a total equal to (λ

1 +β 1 ) (α D -α * ) 2 -(α D -ε-α * ) 2 (1-α * ) 2 .
If the donor receives all the social surplus associated to a decrease in α, his optimal value of α is no longer α D but it coincides with the social optimal value of α (taking into account the MFI and the donor's preferences):

α D+M F I ≡ α * + (1-α * ) 2 (R R -R P ) 2(λ 1 +β 1 )
< α D so that the donor is better off if the efficient MFI accepts the contract (as long as α D -ε ≥ α D+M F I ) and the MFI will accept it as long as ε(2α

D -2α * -ε)β 1 (1-α * ) 2 ≤ µ H -µ L (
otherwise the budget constraint is no longer satisfied and she goes bankrupt). This explains why in the optimal contract designed for the efficient MFI, the α is strictly lower than α D , getting closer to α D+M F I , the value of α which maximizes the joint utility of the donor and the MFI. Distorting downwards the share of richer borrowers served by the efficient MFI, the donor can obtain an higher surplus, so that he always chooses to do it in the optimal contract.

Because at the optimal contract the share of richer borrowers is distorted upwards for the inefficient MFIs an lower for the inefficient, the total share of richer borrower can be lower or higher than the one prevailing under complete information. The impact of hidden types on mission drift is thus ambiguous. Intuitively, if the share of efficient MFIs, η, is high enough, then the average share of richer borrowers served by the two types of MFI would decrease, because the downward distortion of α would prevail for a large number of contracts. To see this, we have computed the share of richer borrower α = ηα L +(1-η)α H and compared it with the benchmark level α D (obtained under complete information) in anumerical example. As an illustration, if we set α * = 0.2, β 1 = λ 1 = 0.3, λ 2 = 0, R P = 0.5, R R = 0.1, ∆R = 0.7, µ H = 0.4, µ L = 0.1, then the average share of richer borrowers α is lower than α P whenever the share of efficient MFI η is higher than 0.5. Thus, in this example if more than one half of the MFI are efficient, mission drift is reduced when information is asymmetric. The same qualitative behavior holds in general (but of course the particolar threshold of η moves when modifying the values of the parameters), as shown in the Appendix.

In our context, in which both the MFI and the donor are pro-poor (although they can put different weight on pro-poor orientation and also care about revenues), incomplete information can deliver a result which is socially more desirable than complete information. The necessity to discriminate among MFIs types pushes the donor to decrease the share of richer borrower served by more efficient MFI while demanding higher transfers to compensate for this deviation from the preferred level α D . This allows the donor and the MFI to increase efficiency and may have an unexpected beneficial effect on the pro-poor orientation of lending activities (when the average share of poorer borrowers is increased).

Discussion.

A noticeable feature of the hidden type problem is that the impact of asymmetric information does not necessarily go in the direction of increasing the mission drift with respect to the benchmark case of complete information. As shown above, in the separating equilibrium with different shares of richer borrowers, this share is distorted upwards for the inefficient MFI but downwards for the more efficient.

At the separating contract of type 2 with equal shares of richer borrower, the shares are not distorted with respect to full information. However, the agency problem of the donor induces an inefficiently low level of effort for high cost MFIs. This can be perceived as a higher difficulty for some types of (relatively inefficient) MFIs to increases services to poor borrowers, when contracting with an external donor.

Hidden types issues are particularly relevant in markets in which the level of heterogeneity among MFI is high. This is for instance in many Latin American countries, as stressed for instance in the recent report by [START_REF] Trujillo | Financial inclusion in latin america and the caribbean[END_REF]. In this context, our analysis could offer arguments to suggest that governments and development institutions have a role to play to help MFIs to build capacity, provide better services and increase efficiency. In our model, to discriminate among MFIs under hidden types, the donor must set the contract such as the share of richer borrowers is smaller for more efficient MFIs. This allows the donor and the MFI to increase efficiency and may have an unexpected beneficial effect on the pro-poor orientation of lending activities. This indirect positive effect can occur if number of efficient MFIs is large enough and it is greater when their number increases. Therefore, governments and development institutions aiming to strengthen the fight against poverty could play a role by helping MFIs to increase their efficiency.

It is also worth noting that the optimal menu of contracts of type 3 could also be interpreted as follows. For less efficient MFIs , the donor imposes a level α H and get all the revenue minus µ H . In a sense, the donor covers exactly all the MFI's costs assuming that she is inefficient. For more efficient MFIs, the donor also imposes α but a lower level, α L and state a fix repayment rate so that the most efficient MFIs freely choose to exert the effort and keeps a positive margin.4

Conclusion

The present paper contributes to the debate on the recent evolution of the microfinance sector, fueled by the explosion of for-profit and profit-oriented MFIs and by a change in the nature of some external donors (private vs. public). The entry of new market players raises the fear for a deviation from the poverty-reduction mission, the so-called "mission drift". We build a model in which we analyze the relationship between donors and MFIs, assuming that both are pro-poor. Assuming that the effort to screen valuable investment projects is costly, incentives have to be provided to the MFI by the donor to exert the right effort level and to choose the desired share of poorer borrowers. We first concentrate on hidden action issues. We show that, in this context, asymmetric information can reduce the share of poorer borrowers reached by loans, thus increasing the mission drift.

In the second part of the paper we concentrate on hidden type issues. Incentives have to be provided to screen among heterogeneous MFIs, while inducing the optimal level of effort. In this case, the impact of asymmetric information does not necessarily increase the mission drift.

The share of richer borrower can be distorted upwards for inefficient MFIs but downwards for the more efficient ones. The incentive compatible contract pushes efficient MFI to serve a higher share of poorer borrowers, while less efficient ones decrease their poor outreach. Our results confirm the idea that mission drift is a complex phenomenon and that observing that MFIs are serving unbanked wealthier populations should not, as such, be considered as alarming by socially responsible investors and observers. Our model shows a relationship between contracting under asymmetric information and the level of the mission drift. But this relationship is not univocal. In markets in which hidden action is likely to be the main issue, our model confirms that profit oriented MFIs may increase the mission drift. On the other hand, in markets in which the main problem is unobserved MFI heterogeneity, contract frictions between donors and MFIs do not necessarily increase the level of the mission drift. The fact that donors push some types of MFI to increase the share of wealthier borrower can be compatible with a larger poor outreach for more efficient MFIs, with an ambiguous effect on total mission drift.

We first intend to show that the donor cannot maximize his utility by choosing a menu of contracts such that α

H < α L or α H = α L ̸ = α D .
Suppose that the donor can maximize his utility by proposing two contracts with α H ≤ α L .

Because of the incentive constraints, we must have

T L = T H -β 1 ((1 -( α L -α * 1 -α * ) 2 ) -(1 -( α H -α * 1 -α * ) 2 ))
If this equality is not satisfied, one of the two incentive constraints is not satisfied.

Besides, the budget constraint of type L can be written: T H ≤ θ(α H , 1) -µ H so that the best contracts the donor can propose for a fixed (α L , α H ) with α H < α L gives him a utility:

(

1 -η)(θ(α H , 1) -1 -µ H -β 2 (1 -( α H -α * 1 -α * ) 2 )) +η(θ(α L , 1) -1 -µ H -β 2 (1 -( α L -α * 1 -α * ) 2 ) -β 1 ((1 -( α L -α * 1 -α * ) 2 ) -(1 -( α H -α * 1 -α * ) 2 )))
If we put aside the last term:

β 1 ((1 -( α L -α * 1-α * ) 2 ) -(1 -( α H -α * 1-α * ) 2 )), by definition of α D , this expression is maximized choosing α H = α L = α D . Besides, since α H ≤ α L ,
the last term is always negative or null and by choosing α H = α L = α D , the donor minimizes the value of this last expression putting it equal to zero. Hence, this cannot be maximized by choosing α

H < α L or α H = α L ̸ = α D .
Eventually, neither α H < α L nor α H = α L ̸ = α D can be part of an optimal menu of contracts for the donor. Now we intend to prove that α H = α L = α D , necessarily with T L = T H = θ(α D , 1) -µ H , cannot be part of an optimal menu of contracts for the donor. In order to prove it, we will propose a pair of contracts that gives a higher utility to the donor.

Consider the following pair of contracts

: (1, α D , θ(α, 1) -µ H ) and (1, α D -ε, θ(α -ε, 1) - µ H + ε(2α D -2α * -ε)β 1 (1-α * ) 2
-ε 2 ) with ε strictly positive and arbitrarily small.

The type H will never choose the second contract since this would mean making the effort and having to repay to the MFI an amount strictly higher than her reimbursement minus µ H . She does not respect her budget constraint with this contract and goes bankrupt so that she chooses the first contract. Now, let us verify that the type L prefers the second contract.

With the first contract, she gets:

µ H -µ L + β 1 (1 -( α D -α * 1 -α * ) 2 (14)
With the second contract, she gets: 16) is strictly higher than (15) since ε 2 > 0.

µ H -µ L + β 1 (1 -( α D -ε -α * 1 -α * ) 2 - ε(2α D -2α * -ε)β 1 (1 -α * ) 2 + ε 2 (15) Equal to µ H -µ L + β 1 (1 -( α D -α * 1 -α * ) 2 + ε 2 (16) (
Now, is the donor strictly better off if a type L MFI chooses the second contract rather than the first one?

If a type L MFI chooses the first contract, the donor gets:

θ(α D , 1) -µ H -1 + λ 1 (1 -( α D -α * 1 -α * ) 2 ) + λ 2 (µ H -µ L ) (17)
If a type L MFI chooses the second contract, the donor gets:

θ(α D -ε, 1) -µ H -1 + ε(2α D -2α * -ε)β 1 (1 -α * ) 2 -ε 2 + λ 1 (1 -( α D -ε -α * 1 -α * ) 2 ) +λ 2 (µ H -µ L + ε 2 - ε(2α D -2α * -ε)β 1 (1 -α * ) 2 )
Computing the value of ( 18) -(17), we obtain:

θ(α D -ε, 1) -θ(α D , 1) + ε(2α D -2α * -ε)β 1 (1 -α * ) 2 -ε 2 + λ 1 ( (α D -ε -α * ) 2 -(α D -α * ) 2 (1 -α * ) 2 ) +λ 2 (ε 2 - ε(2α D -2α * -ε)β 1 (1 -α * ) 2 )
Remembering that θ(α D -ε, 1) -θ(α D , 1) = -ε(R R -R P ), this is equal to:

-ε(R R -R P ) + ε(β 1 + λ 1 ) (1 -α * ) 2 (2α D -2α * -ε) -ε 2 + λ 2 (ε 2 - εβ 1 (1 -α * ) 2 (2α D -2α * -ε)) (18)
Which can be written:

ε[-(R R -R P ) + β 1 (-α 2 ) + λ 1 (1 -α * ) 2 (2α D -2α * -ε) -ε 2 (-λ 2 )] (19)
Now, by definition, α D = α * + (1-α * )(R R -R P ) 2λ 1 so that ( 19) is equal to:

ε[-(R R -R P ) + (R R -R P ) β 1 (-α 2 ) (1 -α * ) 2 (2α D -2α * -ε) -ε 2 (-λ 2 )] (20)
Equivalent to:

ε[ β 1 (-α 2 ) (1 -α * ) 2 (2α D -2α * -ε) -ε 2 (-λ 2 )] ( 21
)
If ε is sufficiently small this is strictly positive since α D > α * .

The donor is strictly better off if the type L chooses the second contract rather than the first one. Since the type L also strictly prefers the second contract rather than the first one, the donor will be strictly better off proposing both contract 1 and contract 2 than if he only proposes contract 1. Hence, α H = α L = α D , necessarily with T L = T H = θ(α D , 1) -µ H , is not an optimal menu of contracts for the donor.

Illustration: non binding budget constraint for type L

Consider the case in which the budget constraint of type L, given in (7), is not binding at the optimal solution. In this case, the optimal shares of richer borrowers α H and α L are obtained maximising the objective of the donor as given in ( 13) with no further constraints, as long as α L < α H . In fact, as long as α L < α H , the incentive compatibility of type H, (10), is always satisfied because type H cannot choose the contract designed for type L without violating the budget constraint (8). The following result holds:

Result 1 Suppose that µ H < ∆R and µ H -µ L > β 1 -(1-α * ) 2 (R R -R P ) 2 4(β 1 (1-λ 2 )+λ 1 ) 2 so that the budget constraint ( 7) is not binding. Then there exists a threshold η(α * , λ 1 , λ 2 , β 1 , R R -R P ) ≡ η ∈ (0, 1) such that:

• If, 0 < η ≤ η the donor proposes the separating contract with different shares of richer borrowers described in case 3, the MFIs accept the contract and choose

α H = { α D + (1-α * ) 2 β 1 η(1-λ 2 )(R R -R P ) 2(λ 1 (1-η)-β 1 η(1-λ 2 )) , if η ≤ 1 - 2β 1 (1-λ 2 ) (1-α * )(R R -R P )+2β 1 (1-λ 2 )+2λ 1 ; 1, otherwise. ( 22
)
α L = α D - (1 -α * ) 2 β 1 (1 -λ 2 )(R R -R P ) 2λ 1 (λ 1 + β 1 (1 -λ 2 )) (23)
• If η < η ≤ 1 the donor proposes the separating contract with equal share of richer borrowers described in case 2. Type L exerts high effort and type H doesn't. Both types choose

α H = α L = α D .
Proof : Suppose for now that ( 7) is not binding (the condition under which this is satisfied will be checked ex-post). Then, the optimal contract from the point of view of the donor is obtained by the unconstrained maximisation of (13) with respect to α H and α L . Because ( 13) is a concave function of α L and α H the optimal solution is obtained from the first order conditions:

∂V ∂α H = (1 -η)(R R -R P - 2(α H -α * ) (1 -α * ) 2 ) + ηβ 1 2(α H -α * ) (1 -α * ) 2 = 0 ∂V ∂α L = η(R R -R P - 2(α L -α * ) (1 -α * ) 2 ) = 0
Solving the system of first order conditions (and imposing 0 ≤ α H ≤ 1 and 0 ≤ α L ≤ 1)

gives the values of α H and α L in ( 22) and ( 23). We have now to verify the conditions under which these contracts respect type L budget constraint (7). Replacing these values in (7),

and developing computations we obtain that ( 7) is not binding if and only if µ H < ∆R and µ H -µ L > β 1 -(1-α * ) 2 (R R -R P ) 2 4(β 1 (1-λ 2 )+λ 1 ) 2 . Equations ( 22) and ( 23) thus characterize the best separating contract from the point of view of the donor when the latter condition is satisfied. Now consider the (weighted) average share of richer borrowers is given by α = ηα L + (1η)α H . Replacing for the values of α H and α L given by ( 22) and ( 23) respectively and developing computations, we find that α is smaller than α D if and only if η > 1-

(1-α * )β 1 (1-λ 2 )(R R -R P ) λ 1 (2λ 1 +2β 1 (1-λ 2 )-(1-α * )(R R -R P )) ≡ η.
Replacing for α * = 0.2, β 1 = λ 1 = 0.3, λ 2 = 0, R P = 0.5, R R = 0.1, ∆R = 0.7, µ H = 0.4, µ L = 0.1, we obtain the numerical example given in the main text. We remind here that for very low values of 1 -η the contract of type 2 illustrated in Proposition 2 can be preferred by the donor to the contract of type 3 here illustrated. Replacing for the value of the parameters in the utility of the donor (13) one can check that this only happens if η > 0.8.

  Step 0: The donor makes an offer (θ c , T c ) to the MFI. The offer may be interpreted as: I propose you a capital of 1 in order to lend money to local borrowers. If I observe that you obtain a reimbursement rate equal to θ c , I ask you a repayment T c . If I observe a reimbursement rate different from θ c , I ask you a repayment T > θ(1, 1) and you go bankrupt.

Figure 2 :

 2 Figure 2: MFI's preferences and optimal contracts under hidden action.

  The donor can choose to induce equal or different effort level and propose different or equal transfers (and thus shares α i , i ∈ {H, L}). Proposition 2 Depending on the value of the parameters, the optimal menu of incentivefeasible contracts takes one of the following forms: Type 1: The donor induces no effort for both types (e H = e L = 0). The share of richer borrowers are α L = α H = α D . Transfers are equal for the two types of MFI, T H = T L = θ(α D , 0). Type 2: The donor induces effort only from the efficient type L (e H = 0, e L = 1). The shares of richer borrowers are α L = α H = α D respectively. The transfer from the less efficient MFI is T H = θ(α D , 0) and T L = θ(α D , 1) -µ L (or more precisely T L is arbitrarily closed to θ(α D , 0) -µ L ). Type 3: The donor induces effort from the two types (e H = e L = 1) and proposes a separating contracts with different shares of richer borrowers α L < α H and T L < T H .

Most papers are dedicated to the contracting between MFIs and their clients: see[START_REF] Ghatak | The economics of lending with joint liability: theory and practice[END_REF],[START_REF] Rai | Is grameen lending efficient? repayment incentives and insurance in village economies[END_REF],[START_REF] Jeon | When is the optimal lending contract in microfinance state non-contingent[END_REF] or[START_REF] Shapiro | Microfinance and dynamic incentives[END_REF].

To a certain extent, this is equivalent to a price-cap incentive scheme.

Appendix: Proof of Proposition 2

Let us first show that (e H , e L ) = (1, 0) cannot be part of an optimal choice for the donor. Suppose that there exists an optimal menu of contracts for the donor ((e H , T H , α H ), (e L , T L , α L ))

with (e H , e L ) = (1, 0) for some values of the parameters of the model.

In order to satisfy the incentive constraints, the two following conditions must be satisfied:

Therefore:

which cannot be verified since µ L < µ H . Hence, there cannot exist an optimal menu of contracts for the donor with (e H , e L ) = (1, 0).

Assume now that there exists an optimal menu of contracts for the donor such that e H = e L = 0.

Because no effort is made, there is no asymmetric information issue. The donor in order to maximize his objective function chooses his preferred α: α D and a transfer equal to the expected repayment without effort and an α = α D for both types: θ(α D , 0).

Consider the case in which the donor would like to impose (e H , e L ) = (0, 1).

Suppose that there were only MFI of type type L and the donor would like them to make effort. Then, by definition of α D and because of the budget constraint, the donor would impose the following optimal contract (e L , α L , T L ) = (1, α D , θ(α D , 1) -µ L ). On the other hand, if there were only MFIs of type H and the donor would like them to make no effort, by definition of α D and because of the budget constraint, the donor would impose the following optimal contract (e H , α H , T H ) = (0, α D , θ(α D , 0)). Now, even in the presence of the two types of MFI exist, these two contracts satisfy the budget constraints and the incentive constraints so that the donor cannot obtain a higher utility than what he obtains by proposing these two contracts if he wants to implement (e H , e L ) = (0, 1).

Eventually, suppose that the donor wants both types of MFI to make the effort.


Benoît Fournier

Gilles Guette

Valérie Viet

Triem Tong

Jean-Louis Lanet

SEER4US, Secured Energy Efficient Routing for UAV Swarms

Keywords: Network security, UAV swarm, energy efficiency, ad hoc routing protocol

This article introduces SEER4US a secured routing protocol designed for UAV swarm networks. SEER4US is the first protocol providing integrity of routing messages and authentication of their sender with low energy consumption for battery preservation. SEER4US prevents the UAV swarms from usual routing attacks enabled when routing messages are modified or replayed by nodes external to the swarm. SEER4US is an extension of the pro-active routing protocol OLSR designed for mobile ad-hoc networks. SEER4US is also inspired from TESLA, a protocol designed for stream signature allowing authentication of stream messages sender. After specifying SEER4US, we evaluate here the energy requirements of this protocol and we show that the use of lightweight cryptography allows a significant energy saving compared to traditional cryptographic schemes.

I. INTRODUCTION

Unmanned aerial vehicle (UAV) applications and development have increased over the past few years as this technology has become more accessible and less expensive. Its primarily purpose is divided in two main sectors: transport and coverage. Drones are used for the transport of goods, or people and serve as interconnected air vehicles.

Coverage applications can take different aspects. Basically UAV will move in an area and carry a payload that interacts with the environment (monitoring for instance).

Nowadays, most applications rely on only one single device, but it is natural to think that in the near future, swarms will be able to cooperate to achieve a mission. A swarm will increase reliability, as it is tolerant to individual failure. It will also be faster in discovery mission by splitting workload among several devices. We focus here on autonomous UAV, able to dynamically change their behavior and adapt to unplanned event. This is not a reality yet, but we already see swarm that execute full-planned mission successfully. Some important issues remain to be solved: secured communications, control of the swarm, resilience to malicious behaviors.

On a single UAV scenario, communication is a keystone to transmit commands and retrieve data from UAV sensors. It is even more critical in swarm where cooperation and inter messaging is fundamental. The communication between the nodes of a swarm is based on a suitable routing algorithm. The routing must allow each node to send messages to each other, by successive hops between different neighbors.

A UAV swarm is a particular mobile ad-hoc networks where nodes run independently but form a cooperative communication newtwork. Routing information in these networks is a broadly explored domain. Many classes of routing protocol exists, most popular are reactive and proactive protocol (AODV [START_REF] Perkins | Ad hoc on-demand distance vector (AODV) routing[END_REF] and OLSR [START_REF] Clausen | Optimized link state routing protocol (olsr)[END_REF]). A UAV swarm shares common characteristics with VANET (vehicular ad hoc network), sensors network or mobile phone network but also strongly differs on specific points. The mobility model of UAV swarm is in a 3D space, since they do not follow road or marked path contrary to vehiculars. VANET routing protocols [START_REF] Brown | Ad hoc UAV ground network (AUGNet)[END_REF] rely on specific characteristics of the vehicle i.e. positioning system, infrastructure access, almost unlimited energy and high computing capacities. On the contrary, any computation on a UAV is a permanent trade off between volume, weight and power consumption, with no infrastructure access.

It also differs from sensor networks that are mainly stable networks where communication is made from the sensor to the sink with more or less stable routes. In UAV networks, communication is more critic thus latency and disconnection have to be minimized. Mobility of nodes is also quite dissimilar. And to finish, it differs from mobile phones network mainly with the network infrastructure, cellular network are not part of our assumption for UAV deployment.

UAV network have always one or two major differences with other kind of MANET and cannot use off the shelf technologies to achieve best effectiveness. Existing routing protocols are not well suited but attack scenarii are. UAV network is also subject to many known routing attacks: black hole [START_REF] Bala | Performance analysis of MANET under blackhole attack[END_REF], wormhole [START_REF] Maulik | A study on wormhole attacks in manet[END_REF], Sybil attacks [START_REF] Douceur | The sybil attack[END_REF] . . . Attacker's goal is to disturb or completely stop communication between specific nodes of the network while remaining stealth. Such attacks can lead to disconnection from the swarm, false environment awareness, incorrect behavior. This can therefore be exploited in conjunction with other attacks. For example to take control of UAV, retrieve data from it, capture it or even just crash it. As part of a swarm, a compromised node can threaten the others. Security issues need to be addressed with minimal cost, to not impact flight autonomy.

In this article, we aim to address current threats on routing in UAV swarm. More precisely, we presents three contributions:

• SEER4US the first routing protocol dedicated to UAV swarm ensuring integrity and authentication of routing messages with low energy consumption.

• A measure of theoretical latency threshold we can achieve with SEER4US. • An evaluation of energy consumption of SEER4US protocol with present-day hardware In the remainder, Section II discusses existing protocols dealing with routing and security in mobile ad-hoc networks, Section III introduces two protocols namely OLSR and TESLA [START_REF] Perrig | Efficient authentication and signing of multicast streams over lossy channels[END_REF] that inspired SEER4US. The core of our protocol is detailed in Section IV, latency is deeply studied in Section V, security properties are detailed in Section VI. Finally, in Section VII we compare energy consumption with other solutions.

II. RELATED WORKS

Our problem covers both routing and security issues in mobile ad-hoc networks. Different approaches exist, covering each side, but rarely both. Routing in UAV network has been addressed on the literature.

In [START_REF] Tiwari | Mobility aware routing for the airborne network backbone[END_REF], authors focus on airborne network, comparing their protocol to OLSR and AODV. They conduct their evaluation on a defined scenario with four nodes that have circular trajectory with fixed radius and speed. They focus on latency and throughput. Their protocol assumes that flight plans of all nodes are common knowledge.

In [START_REF] Rosati | Speed-aware routing for UAV ad-hoc networks[END_REF] they emulate two different scenarii: one with four nodes, and one with 32, in both cases most of them are not moving. They focus on increasing routing performance by taking GPS position and movement of nodes.

In [START_REF] Cheng | A comparison of MANET routing protocols on airborne tactical networks[END_REF] they evaluate best routing protocols for another use case. They used fixed path for UAV movement and simulate 40 nodes. They focus on latency and network overhead, moreover they choose to have heterogeneous network composition: some nodes will be dedicated for long range communications.

In [START_REF] Adjih | Securing the olsr protocol[END_REF], Adjih et al. proposed a secured proactive routing protocol based on OLSR. It provides integrity, authentication and timestamping of routing messages. It can use either symmetric or asymmetric signature algorithms. They assume that necessary keys are available on each node to perform suitable verifications.

Very closely, in [START_REF] Guerrero | Secure ad hoc on-demand distance vector routing[END_REF], Zapata proposed a secured reactive routing protocol based on AODV. It provides integrity and authentication of routing messages. It uses asymmetric signature and a key management scheme. On each hop, message signature is verified and if valid the message is processed.

Ariadne protocol [START_REF] Hu | Ariadne: A secure on-demand routing protocol for ad hoc networks[END_REF] is based on DSR a reactive routing protocol. In order to provide integrity and authentication of routing messages the protocol uses a signature mechanism. The choice of this mechanism is left to end user among private/public key, secret shared key and TESLA mechanism. The setup of those keys needs a specific initialization and during execution some nodes act as trusted key managers.

To our knowledge there is only one previous work that explore both routing and security on UAV network, the SUANET project [START_REF] Maxa | Survey on uaanet routing protocols and network security challenges[END_REF]. They propose a routing protocol based on AODV. They use public key cryptography to provide confidentiality, integrity and authentication of routing messages. They also include packet leashes security mechanism. To conduct their simulation they used scenarii with 4 nodes extracted from a single UAV real traces. Energy consumption overhead is out of scope of their studies.

III. BUILDING BLOCKS

SEER4US, is based on two existing protocols: a pro-active ad hoc routing protocol (OLSR) and an authentication protocol (TESLA) mainly dedicated to stream signature.

OLSR is a proactive routing protocol, developed to address routing problem in mobile ad hoc network and other wireless ad hoc networks [START_REF] Clausen | Optimized link state routing protocol (olsr)[END_REF]. When running OLSR, all nodes periodically exchange Hello message to advertise neighbours of their presence. Hello messages sent by a node also contains the list of the neighbours learned from previous received Hello messages. Hello messages are one hop message, they are broadcast but not retransmitted. The nodes are able to construct a 2-hops view of the network topology thanks to Hello messages,. To access the entire network, a node elects some other nodes as Multi Point Relay (MPR). For a given node the set of its MPR is the minimum set allowing to reach all the two hops neighbors. MPR sends periodically Topology Control (TC) messages. A TC message contains information about the MPR initiator of the message and nodes that elected it. When a MPR A receives a TC message from one node B that has elected it as MPR, A forwards it to its one hop neighbors. With TC and Hello messages all nodes are able to construct the topology of entire network. As messages are periodical, network topology is updated accordingly. With OLSR, nodes are able to route message in ad hoc network, assuming execution is correct. Unfortunately anybody can inject malicious node in the network and perform incorrect behavior. Those kinds of attack is made possible because routing messages are not protected. They are received and processed without any form of checking about integrity or authentication. That means even a single malicious node can block a large amount of traffic, forbidding communications between nodes [START_REF] Bala | Performance analysis of MANET under blackhole attack[END_REF]. This lack of security has to be addressed to deploy a reliable network.

TESLA [START_REF] Perrig | Efficient authentication and signing of multicast streams over lossy channels[END_REF] is a security scheme initially proposed in the constrained context of continuous authentication of data stream needing strong packet-loss robustness, high scalability, and minimal overhead (as radio and TV Internet broadcasts, and authenticated data distribution by satellite). TESLA relies on hash function and global time. To use TESLA on a message stream, a sender owns an arbitrary long hash chain. Elements of hash chain will be used as keys in reverse order. We use last chain element h n (S 0 ) as first key K 0 . Any message m i broadcasted by the source node is composed of three elements:

p i , K i-1 , H MAC (p i , K i-1 , K i ). p i is the data payload contained in the packet. K i-1 is the previous key used in the chain, disclosed in m i . H MAC (p i , K i-1 , K i ), H MAC (Keyed-
hash message authentication code) of m i , using yet undisclosed key K i . To process m i through verification steps, receivers have to know if it was received before sending of m i+1 and then disclosure of K i . To ensure this property, keys revelation is scheduled and node are synchronized with a bounded error. On m i reception, m i-1 verification will be allowed and m i will be buffered, waiting for m i+1 reception in order to be verified. To verify m i , receivers check that h(K i ) = K i-1 with K i disclosed in m i+1 . This step will ensure that m i belongs to message stream. Additionally receivers will compute H MAC (p i , K i-1 , K i ) and compare it with H MAC in m i . By assuming that h cannot be reversed only the owner of the key chain can produce legitimate message on time. Those message cannot be stealthy tampered due to H MAC . That ensures integrity of message and authentication of sender. The very first message needs an external method of authentication or the prior transmission of K 0 .

OLSR alone can be used for UAV swarm but, according to its latest definition [START_REF] Perkins | Ad hoc on-demand distance vector (AODV) routing[END_REF], it is strongly recommended to add mechanism to ensure message integrity and authentication. Many attacks are, indeed, based on unsecure routing message: replay attack [START_REF] Goyal | Manet: vulnerabilities, challenges, attacks, application[END_REF], blackhole attack [START_REF] Bala | Performance analysis of MANET under blackhole attack[END_REF]. On the other hand, TESLA alone allows authentication of sender of a data stream but is not a routing protocol. It relies on hash function and loose synchronization rather than heavy computational cryptographic functions and bring two good properties we want: low energy consumption and less computation. In the rest of this article, we design SEER4US, a secure ad hoc routing protocol providing authentication and integrity of routing messages, based on OLSR and TESLA, well suited to UAV swarm due to its low energy consumption (see section VII).

IV. SEER4US

SEER4US is designed for autonomous UAV swarm where UAVs share a common knowledge initialized offline.

1) Common knowledge: We assume that all nodes share a global clock: each node has its own local clock but maximum deviation is supposed to be bounded by a fixed parameter . In SEER4US, each node A of the swarm is equipped with an arbitrary fixed-length key chain (K A 0 , . . . , K A n ) where the ending value K A n is randomly chosen by each node and

K A j-1 = h(K A j )
where h is a one way hash function. The set of all the starting values {K N 0 } (where N is in the set of nodes) is part of the common knowledge of the swarm. Each node will disclose the keys of its key chain according to a frequency that is assumed to be known by all nodes in the swarm. Starting form a arbitrary value k, it is easy to verify that k is the an element of the chain by checking if h x (k) is equal to a previously disclosed key for some value of x in {0, ..n}. One or more key may be missing in the disclosed key chain. Each node collects information about the network by exchanging Hello and Topology Control (TC) messages with the same purpose as in OLSR. Hello messages will be periodical 1-hop message and TC will be periodical message broadcasted in the entire network through MPR mechanism. Hello will contains addresses of neighbours nodes and TC addresses of nodes choosing TC's senders for MPR.

2) Messages formatting: In SEER4US, each message is linked to its predecessor through the key chain of their sender, in order to ensure the integrity of message and authentication of the sender. More precisely, both Hello and TC messages contain two additional fields: a MAC field and a key field. Thus, instead of sending a series of messages {m 1 }, {m 2 }, . . . , {m i }, . . . of common Hello or TC messages, a node A will send:

{m A 1 } = (p A 1 ,K A 0 , H MAC (p A 1 ,K A 0 ,K A 1 )), {m A 2 } = (p A 2 ,K A 1 , H MAC (p A 2 ,K A 1 ,K A 2 )), . . . , {m A i } = (p A i ,K A j-1 , H MAC (p A i-1 ,K A j-1 ,K A j )), . . . ,
3) Verification step: When a node B receives a series of messages supposedly sent by A, he can, at each message reception, check the integrity of previous message and that A is indeed the sender of the message. On reception of a message m A i two verifications are performed: first that m A i is received on time according to K A j disclose time and B internal clock. Secondly that K A j-1 belongs to the key chain of A, to verify this property, B applies h on K A j-1 until it can compare it with the last revealed K A known, or ultimately K A 0 . If one of the verification failed the message is discarded, otherwise the message is stored awaiting for authentication and the revealed key chain of A is updated.

On reception of a next message from A, m A i+1 , which disclose K A j further verification are performed. Firstly same two verifications are done and will update A's revealed key chain. As m A i+1 is sent after m A i key revealed on it is the next one or is the same as the key used to sign m A i . So B is able to retrieve K A j by applying h on K A j-1 . With this new knowledge B can computed if H MAC (d A i , K A j ) is same as received or not (for convenience we note

d A i = p A i , K A j-1
). If it is the same then m A i is authenticated and p A i can be transmit to the routing algorithm. If verification is incorrect then payload of m A i is discarded. is the key used to sign m A i and K A j-1 is is the disclosed key. With this verification process we ensure integrity and authentication of routing messages.

A B - - - - - - - - - - - - - - d A i p A i , K A j-1 , H MAC(d A i ,K A j ) p A i+1 ,K A j , H MAC(d A i+1 ,K A j+1 ) p A i+2 ,K A j+1 , H MAC(d A i+2 , K A j+2 ) Verification m A i Verification m A i+1
SEER4US scheme as previously exposed in Section IV uses fixed frequencies for message sending. But in fact OLSR is much more flexible and can overload frequency by sending message sooner in case of topology updates. This feature better copes in UAV swarm where low latency routing is critical and topology update are potentially high. To include this reactivity, we can use a faster key disclosure frequency in SEER4US.

Since a node has to wait upon key disclosure, the key lifetime has to be long enough for message to be received, a balance for key disclosure rate is needed. In the following, we discuss the minimum value for key lifetime.

Hello messages will be send every ∆ Hello and TC messages every ∆ T C . Those periods do not form an exact schedule nor are respected all the time. First because of common wireless link, packets can be delayed on sending, to avoid collision. Second because when a node received a new Hello or TC it can sooner advertise its others neighbours by immediately sending a new message. Still, to avoid complete flooding, there is a minimum time to wait before sending another message.

To comply with this dynamic rate we set minimum validity time of key δ = ∆ tt + ε + g as depicted in Figure 2. Where ∆ tt is an upper bound of transmission time, ε an upper bound of synchronization error and g an upper bound of jitter time. Even in worst case, a message is valid at reception if it is sent δ before its key expiration. The minimum time to wait before sending another message has to be greater or equal to δ.

Keys used to sign the chain of message will not be necessarily direct successor in the keys chain. So verification step will repetitively apply h on the key to link it to a previous disclosed one.

A B M i-1 M i M i+2 M i+1 K A j-3 K A j-2 K A j-1 K A j K A j+1 K A j+2 K A j+3 g ∆ tt ε δ Fig. 2. Key disclosure
Base routing and signature are now in place but we aim to deploy our protocol on a fast and high dynamic network. Waiting for upcoming message introduce extra latency to reduce.

V. ADDRESSING LATENCY

As authentication of a message implies to wait the next one, extra latency is introduced by SEER4US. Being able to communicate flawlessly is critical for an UAV, as without communication it is more vulnerable, perform worst or even being a danger for the swarm. Latency of routing message can lead to partial disconnection when node will no longer being able to communicate with others. To ensure that our protocol is suitable for UAV swarm we aim to reduce this extra latency to the minimal as described in the following Section.

In Figure 3, we see journey of a T C A i from A to D. On the first hop, B will authenticate T C A i with T C A i+1 , introducing one round of latency. On T C A i+1 reception, if we

A B C D T R (i, 1) T R (i, 2) T R (i, 3) Verification of ↑ T C A i T C A i T C A i+1 T C A i+2 T C A i+4
Fig. 3. Latency over hop neglect verification time, B will re emit T C A i immediately after verification. So C will received T C A i with two rounds of latency. Only T C A i+2 (or later message) can allows C to authenticate T C A i . But T C A i+2 will first pass trough B and so have additional latency. C will only be able to authenticate T C A i with three rounds of latency. Finally, three-hop node D will receive T C A i from C but will wait until reception of T C A i+4 to authenticate it. T C A i+4 will pass trough B and C leading to a final seven round latency for T C A i authentication. Authentication latency seems to growth exponentially with number of hops.

We discretize here the time to interval of equal length so that there is one TC sent per unit of time. We define ∆ ll , the link latency, the time for a message to be received by another node, 0 < ∆ ll ≤ 1, as communication are not immediate but shorter than message period. Let T R (i, n) time to receive TC sent at i, that is emitted from n hops. Let T A (i, n) time to authenticate TC sent at i, that is emitted from n hops. TC is broadcast as soon as they are authenticated and we assume validation time is negligible:

T R (i, n) = T A (i, n -1) + ∆ ll .
TC is authenticated when a message sent after its reception is received:

T A (i, n) = T R ( T R (i, n) , n). Easily we have: T R (i, n) ≥ i + 2 n-1 -1 + n • ∆ ll and T A (i, n) ≥ i + 2 n - 1 + n • ∆ ll .
So the farer a TC will be broadcast, the longer it will take to authenticate it. The exponential growth of this latency does not suit our short latency constraint.

To reduce latency we make every node re authenticate TC message. By replacing message signature on each hop we reduce authentication to one hop waiting. On Figure 4 we can see the same scenario as on Figure 3 but with each node applying is own signature before re emission.

Actually we have

T A (i, n) = T R ( T R (i, n) , 1
). As all messages will be authenticated with direct neighbors key chain, that leads to

T R (i, n) ≥ i + n -1 + n • ∆ ll T A (i, n) ≥ i + n + n • ∆ ll .
So now latency to authenticate and receive message grows linearly with the size of the network.

Verification time can also be speed up by introducing a new mechanism: Validation message. This new kind of message will be sent after all message after δ time. Validation message will not carry any routing information and their only With this modification we reach the theoretical threshold 2 * (δ tt + g) + of minimum latency for one hop signature. After every Hello or TC message a Validation message is sent as soon as possible for validation process.

A B C D T R (i, 1) T R (i, 2) T R (i, 3) T C i T C i+1 T C i+2 Verification ↑ of T C A i

VI. SECURITY DISCUSSION

Our threat model supposed an attacker that can interact with the transmission layer. It can effortlessly record all messages sent by any node. It can also emit all messages it can forged with its current knowledge and send them to any set of nodes he wants. We assume that an attacker may be deployed on the entire network. In its initial knowledge are nodes addresses. The attacker is neither able to reverse the hash function nor to forge a valid signature. We assume that one goal of the attacker is to modify routing information while leaving stealth, so jamming attack is out of scope of our study.

Before being process by routing routine we choose to buffer all messages and wait for authentication. One policy can be to directly use those routing information and make a proper validation after. This behavior can lead to energy depletion attack. One attacker can send a lot of incorrect messages to force heavy and useless topology processing. Same choice can be applied on TC broadcasting, we choose to wait to be sure TC messages are correct before MPR spread them. An hybrid policy approach may also be applied: at the beginning node can process message immediately and check authentication later but in case of error they switch in a vigilant mode in which they buffer and wait for verification.

On reception two checks are performed before message is buffered for authentication. First lifetime of the packet is checked, if the key that is used to sign it is already disclosed (or disclosed in a time inferior than the synchronization error ) the packet is discarded. Second the revealed key in the packet is verified, by iteratively computing hash function on it. The key must be part of a known key chain, otherwise the packet is discarded. If the key is correct then packet is stored for future authentication. The verified disclosed key may be use to authenticate buffered packets from the same transmitter.

VII. EVALUATION

In order to evaluate our protocol we conduct a theoretical comparison with OLSR and SOLSR, a secured version of OLSR, using RSA 2048 signature for routing messages and SEER4US. These experiments highlight that SEER4US protocol consume less energy for the same security properties and same information exchanged.

Most evaluations on MANET protocols use either real data or dynamic simulation, while others choose static configurations [START_REF] Johansson | Scenario-based performance analysis of routing protocols for mobile ad-hoc networks[END_REF], [START_REF] Tiwari | Mobility aware routing for the airborne network backbone[END_REF]. Mobility models range from extremely specific (one node move at a time) to common and consensual model like random walk, random waypoint. Those two last models have become quite popular in evaluation of MANET protocols but for our use case, in which we want to simulate behaviour of coordinated swarm, those models cannot render coordination between nodes as explain in [START_REF] Hong | A group mobility model for ad hoc wireless networks[END_REF] and [START_REF] Camp | A survey of mobility models for ad hoc network research[END_REF]. Other model begin to emerge for this specific use case: in [START_REF] Bouachir | A mobility model for UAV ad hoc network[END_REF] they render swarm mobility by combining tool for flight planning and markov chain. In [START_REF] Camp | A survey of mobility models for ad hoc network research[END_REF] by combining existing basic mobility model they construct a more suitable mobility model for group mobility. Unfortunately even if they are quite promising we choose to do not use them yet: according to [START_REF] Bouachir | A mobility model for UAV ad hoc network[END_REF] there is no consensual method to evaluate those models and measure if they correctly render reality. For our first evaluation we choose to stick to a simple setup: fixed position, we choose best case option for all the evaluated protocols, ideal link layer, no collision, ideal topology and so no movement.

We study 3 protocols: OLSRv1 as a baseline, SEER4US and SOLSR. For this experiments, we used the recommended configuration parameters from OLSR and TESLA. Adresses are ipv4 on 4 bytes. We use SHA-256 hash function for both key chain and hmac. We truncate hashes on message to reduce its size to 10 bytes as recommended in [START_REF] Perrig | Efficient authentication and signing of multicast streams over lossy channels[END_REF]. TC period is 5s and Hello period is 2s. Timestamp is on 4 bytes. SOLSR uses RSA2048 with 256 bytes signature. We count energy consumption on a ten seconds time frame.

There is four ways to spend energy: sending messages, receiving messages, signing and verifying a message received. We consider no energy consumption for OLSR on sign and verify operation. We also do not take into account energy spent to perform routing calculation like MPR set election, route processing and so on, as such operation will be the same on each protocol and do not introduce useful element of comparison.

As our model is simple enough, we don't need an external simulation tool, we will add cost of every tasks performed by all nodes successively over the time frame. All 49 nodes form the best case topology for OLSR. For each of them we have S n , R n the set of messages sent, received respectively. We can construct and measure size of all message that will give us the overhead. We re-use values published in [START_REF] Kumar Saha | Power-throughput tradeoffs of 802.11n/ac in smartphones[END_REF] about energy cost for sending and receiving. We took experimental values from [START_REF] Montenegro | What do software developers need to know to build secure energy-efficient android applications[END_REF] for hash/signature consumption, by adding each verify and signing operation for each protocol we can then have energy consumption for both SEER4US and SOLSR. For SEER4US, messages are signed at every hop but for RSA signature only the first sender performs signature.

For SOLSR, another cost per message is the access to the key for verification but we neglect this cost here since it highly depends of the infrastructure. I give a hints on how cryptography drastically increased energy consumption. So signatures come at a cost, but we see that our protocol cost nearly twice less than SOLSR still guaranteeing integrity and authentication. We can also see that even if our protocol sends more messages due to double sending mechanism, SEER4US still have a smaller overhead than SOLSR compared to baseline.

VIII. CONCLUSION

  Fig 1 displays few round of communication from A to B. Where p A i is the payload of the routing message, K A j

Fig. 1 .

 1 Fig. 1. Messages Exchanges diagram

Fig. 4 .Fig. 5 .

 45 Fig. 4. Latency over hop with re-signature

We have presented SEER4US a proactive routing protocol for UAV swarm based on OLSR and TESLA, that provides integrity of routing message and authentication of senders. We show in our evaluation that this protocol consumes less energy and has significantly less overhead than SOLSR, another proactive routing protocol. Future work will focus on improving SEER4US by handling dynamic arrival and departure of node in the network and cooperation with other networks. At last, we will propose a proper mobility model that we will use to measure throughput, latency or packet drop.