( 02 October 2019 )
Bitcoin is a "crypto currency", a decentralized electronic payment scheme based on cryptography. Bitcoin economy grows at an incredibly fast rate and is now worth some 10 billions of dollars. Bitcoin mining is an activity which consists of creating (minting) the new coins which are later put into circulation. Miners spend electricity on solving cryptographic puzzles and they are also gatekeepers which validate bitcoin transactions of other people. Miners are expected to be honest and have some incentives to behave well. However, in this paper we look at the miner strategies with particular attention paid to subversive and dishonest strategies or those which could put bitcoin and its reputation in danger. We study in details several recent attacks in which dishonest miners obtain a higher reward than their relative contribution to the network. In particular, we revisit the concept of block withholding attacks and propose a new concrete and practical block withholding attack which we show to maximize the advantage gained by rogue miners.
Reward distribution mechanism. The reward distribution mechanisms determine the approaches to assign rewards to the miners in a mining pool. Currently, ten biggest mining pools which have the largest hash rates possess over 93% of total computational power, and many of these pools adopt different distribution mechanisms, such as Pay-Per-Share(PPS), Slush Method, Pay-Per-Last-Nshares (PPLNS), etc. In the analysis of a reward mechanism, fairness is a key factor to be considered. It is expected that each submitted share deserves a similar amount of rewards and the fluctuation of the received reward is not affected by the time factor. In 2016, Schrijvers et al. defined that the incentive-compatibility of a reward distribution mechanism means reporting a full solution at once is every miner’s best strategy. Incentive-compatibility is considered as a good evaluation metric to analyze fairness in recent mining pools. In this section, some popular reward distribution mechanisms, including their advantages and disadvantages, are investigated.
Fig-1: Reward Distributions Round Wise.
The idea of this mechanism is to split the reward according to the proportion of shares that a miner submits in the all submitted shares in a round. At the end of each round, if a mining pool can successfully find a block in a round, the mining pool can obtain a reward of B, and the pool manager takes a fraction f of reward B as the pool operating fee. Suppose the total number of submitted shares is N and a miner submits n out N shares in this round, then the miner could get an amount of reward n(1−f) B N. Although the length of any round cannot be predicted, the number of shares already submitted during a round can be counted. Hence, the amount of reward of each share in a round is affected by the time. In other words, the proportional mechanism is not incentive compatible, which may lead to the following problems. Delay Submission. The delay submission problem occurs when the proportion of a miner’s submitted shares in all the submitted shares within a round is less than the proportion of the miner’s mining power in the mining pool’s mining power. In this situation, the miner may gain more benefit by holding a full solution. Theorem 3 Suppose a miner p with hash power α out of 1 finds a full solution after submitting n out of N submitted shares in a round. Let U1 be the expected reward for immediate submission and U2 be the expected reward for holding one or more shares. If α > n N, we have U2 > U1. Proof. The block reward is denoted by B, and the pool operating fee is represented by fB. There exist two strategies for the miner p to choose when he successfully finds a full solution: (i) he submits the full solution immediately; and (ii) he holds one or more shares of the full solution. In the first case, the miner p performs honestly. Thus, he could get the reward corresponding to the proportion of the shares he submits, which is computed in Eq.
However, if the miner p chooses to hold one or more shares, there is a probability of α that he can successfully find the next share, obtaining an expected reward α(n+1) N+1 × B. Accordingly, the expected reward that p can not find the next share is (1−α) n N+1 × B. Thus, the total expected reward for holding one or more shares is:
Pay-Per-Last-N-Share mechanism. Pay-Per-Last-N-Share (PPLNS) mechanism is a variant version of PPS scheme and is also commonly used in real-world. Instead of paying miners for each submitted share, PPLNS rewards miners according to every N submitted shares. In PPLNS mechanism, there is no definition of round. Instead, shares fall into slots. In particular, rewards are sent out for every N shares received by a pool manager. Regardless of whether there exist any blocks found in a slot, the pool manager distributes the reward to every share that are submitted within prior N shares. Thus, the expected reward for each share is (1−f) BL N, where L is the number of full solutions among the next N shares. As shown in the example of Figure 2, the pool manager uses the rewards got in slot 2 to pay for each share submitted in slot 1, which is like a credit card payment.
Fig-: Reward Distributions Slot wise.
Moreover, prior research found that the number of full solutions L follows a standard poison distribution with λ = 1. Thus, the average number of full solutions is 1 in each slot. Schrijvers et al. proved that PPLNS mechanism is incentive compatible when a proper value of N is selected. Recent work proposed by Zolotavkin et al. used a game theory model to derive the specific conditions when PPLNS method is incentive compatible.
Comments