A simple analogy presented in the form of a Lego Brick War, where the kid strategically reveals his fort to stay tall and mighty. Image makes more sense as you read\u00a0through!<\/p>\n
In my previous article, \u201cBlockchain and Its Commitment Issues<\/a>\u201d, I discussed how colluding miners can work together to occupy a larger share of the hash rate. If they follow the simple blockchain protocol, the colluding party needs to constitute a majority of the miners\u200a\u2014\u200ai.e., at least\u00a051%.<\/p>\n However, if we distribute the gains equally among the colluding miners, how do we realize the upside? Easy\u200a\u2014\u200aoccupying a majority of the hash rate (say x%) assures the colluding party of discovering roughly x out of every 100 blocks. It reduces the variance compared to a node working alone. The entire colluding party gets to earn a piece of the cake at more steady intervals. The proportions align over time as the total number of blocks increases.<\/p>\n But what if the colluding party wanted to increase their reward even further? Or better yet\u200a\u2014\u200awhat if they could trade some of that predictability for earning disproportionately larger shares of rewards using significantly less hash power (considering revenue earned by occupying majority hashrate and following the Bitcoin protocol as the benchmark)?<\/p>\n This is where we get into the specifics of \u201cHow to Get Away with Mm..Theft\u00a0:)\u201d.<\/p>\n Collaboration is the key to success, but strategic collaboration is even better. Let\u2019s say my friend and I are competing in a petty Lego Brick War, where we earn cash proportional to the height of whichever fort is chosen as the winner\u200a\u2014\u200awith one condition: whenever we compare forts (that is, when either kid makes their fort public), we must adopt the taller one as the new standard, rendering all effort on the shorter fort completely worthless (sobs).<\/p>\n In this case, the kid mimicking the selfish mining pool would utilize the height differential strategically, keeping his fort private and only revealing it at the right moment. Every time the honest kid\u2019s fort gets rejected, all his effort is rendered worthless. The selfish kid makes bank not by building faster, but by timing his reveal to ensure the honest kid\u2019s work never counts. This is one of the ways of gaming the system while still following a globally compliant version of the blockchain protocol.<\/p>\n Let\u2019s go deeper into how the timing of revealing the blockchain is decided by the selfish miner. It really is a game of numbers\u200a\u2014\u200ajust as the selfish kid assesses his lead to decide when to reveal, the different states (determined by the selfish mining pool\u2019s lead over the honest pool) are organized into a Markov chain by Eyal and Sirer. This helps derive the minimum hash rate the colluding party needs to profit from selfish\u00a0mining.<\/p>\n In a distributed system that resolves forks by choosing the longest chain, the private colluding pool can only strategically choose when to make its version public by keeping it secret. Otherwise, the network may adopt the honest pool\u2019s chain, wasting the entire withheld chain and diminishing their earnings.<\/p>\n Now let\u2019s come to the different states that decide what action to take. I will describe the expected value of each state, which together help determine the minimum hash rate threshold required for selfish mining to be profitable.<\/p>\n \u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u00a0\u2014<\/p>\n Note<\/strong>: The subscript numbers (e.g., S\u2080, S\u2081, S\u2082\u2026) indicate the lead<\/strong> the selfish pool currently has over the honest pool in terms of private\u00a0blocks.<\/p>\n \u03b1<\/strong> = probability that the selfish pool discovers the next\u00a0block.1 \u2212 \u03b1<\/strong> = probability that the honest pool discovers the next\u00a0block.\u03b3<\/strong> = probability that, in the event of a tie (both pools publish competing chains of equal length), honest miners mine on the selfish pool\u2019s chain\u00a0first.1 \u2212 \u03b3<\/strong> = probability that honest miners continue mining on their own (public)\u00a0chain.<\/p>\n The number of blocks earned in each phase within a pool is subject to whether or not we publish it. The private pool is typically the one that publishes its forked chain strategically, timing its reveal to maximize the blocks earned while rendering the honest pool\u2019s work worthless. The honest pool, on the other hand, only ever earns 1 block at a time, accounting solely for the block just discovered, never its accumulated past work, since it never gets the chance to publish its full chain before the selfish pool overtakes it.<\/p>\n \u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u200a\u2014\u00a0\u2014<\/p>\n Markov Chain<\/p>\n S\u2080 (the \u201csquare one\u201d state): <\/strong>This is the state where the selfish pool holds no private blocks and both pools are even. It is typically encountered at the beginning, or after the selfish pool publishes its withheld chain, forcing the honest pool to discard its own and adopt the longer one, resetting both to square\u00a0one.<\/p>\n Selfish mines next block \u2192 blocks earned in selfish pool = 1 S\u2080\u2019 (The \u201crace condition\u201d): <\/strong>This is the state where the honest pool catches up with the selfish pool, forcing a tie. The selfish pool must now play its next move carefully to ensure the honest pool\u2019s efforts get discarded. Who wins the race comes down to the value of \u03b3. If \u03b3 equals 1, honest miners will always build on the selfish pool\u2019s chain during the race in the case that they discover the next block, meaning the selfish pool wins every\u00a0tie.<\/p>\n What would be the minimum threshold for the selfish mining pool in this\u00a0case?<\/p>\n In the contrary case, where the selfish pool discovers the next block first, it earns two blocks\u200a\u2014\u200athe tied block it had been withholding and the newly discovered one. It must publish its chain at this moment to cash out both blocks, since waiting any longer risks losing everything if the honest pool takes the\u00a0lead.<\/p>\n Selfish mines next block \u2192 blocks earned in selfish pool = 2 (the tied block + new one) EV: \u03b1 \u00d7 2 \u00d7 P(S\u2081) = 2\u03b1 \u00d7\u00a0P(S\u2081)<\/strong>Honest mines next block \u2192 lead drops to 0, both chains tied, race begins (\u03b3 case\u200a\u2014\u200aselfish wins race, earns 1) S\u2081 (narrow lead): <\/strong>This is the state where the selfish mining pool is 1 block ahead of the honest pool, i.e., it is withholding 1 block from the honest pool. This case could either lead to P(S\u2082) or P(S\u2080\u2019), based on whether or not the selfish mining pool discovers the next block. If the honest pool catches up in this state, the selfish pool will feel threatened and immediately publish its withheld block to force a tie, entering the race condition at S\u2080\u2019. From there, the outcome depends on\u00a0\u03b3.<\/p>\n Selfish mines next block \u2192 blocks earned in selfish pool = 1 S\u2082 (absolute lead): <\/strong>This is the state where the selfish pool is 2 blocks ahead of the honest pool, i.e., it is withholding 2 blocks from the honest pool. This case could either lead to S\u2083 or S\u2080, based on whether or not the selfish mining pool discovers the next block. If the selfish pool were to discover the next block, it would move from S\u2082 to S\u2083, having earned a single block since there is no need to redeem its efforts and computation just\u00a0yet!<\/p>\n However, if the honest pool discovers the next block, it will feel threatened and publish its chain, leading to S\u2080, square\u00a0one.<\/p>\n Selfish mines next block \u2192 blocks earned = 1 Thus, it really just becomes a game of when to redeem the pool\u2019s efforts for building the secret chain. The higher the threat from the honest pool, the greater the chances of redeeming efforts to ensure we don\u2019t \u201close it\u00a0all\u201d.<\/p>\n Coming back to my previous question of what the minimum threshold should be if \u03b3 were equal to 1. Well, there wouldn\u2019t be a minimum threshold! We could have any number of miners in the selfish mining pool, and the pool would still be able to stay ahead at all times, since in the race condition, honest miners always build on the private chain\u2019s block with a probability of\u00a01.<\/p>\n In reality, \u03b3 is decided by how quickly and how many miners in the honest pool the selfish mining pool is able to reach with its version of the chain. If the honest miners see the selfish pool\u2019s chain first and happen to discover the next block, they will add that block to the selfish pool\u2019s chain, putting it at a lead and helping it redeem its efforts and computation.<\/p>\n This allows the selfish pool to manipulate the value of \u03b3 by allocating the majority of the hardware in their pool solely to broadcast their blockchain to the honest pool during a race condition, thus artificially bringing the value of \u03b3 close to 1 or at least higher than what it was before, thus reducing the minimum threshold for the number of members needed in the selfish mining\u00a0pool.<\/p>\n To counteract this loophole, Eyal and Sirer in their paper proposed setting the value of \u03b3 to 1\/2. This way, miners in the honest pool make an equal choice between whether to append their discovered block to the selfish mining pool\u2019s chain or their own, regardless of how strong the network is, increasing the minimum threshold to a decent value of 25% (anything is better than no threshold at\u00a0all!).<\/p>\n Eyal and Sirer calculate the minimum threshold by finding the value of \u03b1 at which the expected blocks earned by the selfish mining pool divided by the total expected blocks earned across both pools exceeds \u03b1, which is the selfish pool\u2019s hash rate and what it would have earned under honest mining. When this ratio exceeds \u03b1, selfish mining becomes more profitable than playing by the\u00a0rules.<\/p>\n Well, if you were an honest miner watching your peers get ahead of you, would you join their scam? This is the biggest threat to decentralized systems\u200a\u2014\u200athe exploitation of loopholes in protocols that entice all the nodes to join in, making it centralized eventually!<\/p>\n Eyal and Sirer\u2019s paper<\/strong>\u200a\u2014\u200a\u201cMajority is not Enough: Bitcoin Mining is Vulnerable\u201d by Ittay Eyal and Emin G\u00fcn Sirer, 2014. https:\/\/arxiv.org\/abs\/1311.0243<\/a><\/p>\n How to Get Away With Theft (Crypto Version)<\/a> was originally published in Coinmonks<\/a> on Medium, where people are continuing the conversation by highlighting and responding to this story.<\/p>","protected":false},"excerpt":{"rendered":" A simple analogy presented in the form of a Lego Brick War, where the kid strategically reveals his fort to stay tall and mighty. Image makes more sense as you read\u00a0through! In my previous article, \u201cBlockchain and Its Commitment Issues\u201d, I discussed how colluding miners can work together to occupy a larger share of the […]<\/p>\n","protected":false},"author":0,"featured_media":178569,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-178568","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-interesting"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/178568"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=178568"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/178568\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/178569"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=178568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=178568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=178568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
EV: \u03b1 \u00d7 1 \u00d7 P(S\u2081) = \u03b1 <\/strong>\u00d7\u00a0P(S\u2081)<\/strong>Honest mines next block \u2192 blocks earned in selfish pool = 0
EV: (1\u2212\u03b1) \u00d7 0 \u00d7 P(S\u2080) =\u00a00<\/strong>Honest mines next block \u2192 blocks earned in honest pool = 1
EV: (1\u2212\u03b1) \u00d7 1 \u00d7 P(S\u2080) = (1\u2212\u03b1) \u00d7\u00a0P(S\u2080)<\/strong><\/p>\n
EV: (1\u2212\u03b1) \u00d7 \u03b3 \u00d7 1 \u00d7 P(S\u2081) = (1\u2212\u03b1)\u03b3 \u00d7\u00a0P(S\u2081)<\/strong>Honest mines next block \u2192 lead drops to 0, selfish immediately publishes, race begins (1\u2212\u03b3 case, honest chain wins, selfish pool earns 0)
EV: (1\u2212\u03b1) \u00d7 (1\u2212\u03b3) \u00d7 0 \u00d7 P(S\u2080) =\u00a00<\/strong>Honest mines next block \u2192 lead drops to 0, selfish immediately publishes, race begins (1\u2212\u03b3 case, honest chain wins, honest pool earns 1)
EV: (1\u2212\u03b1) \u00d7 (1\u2212\u03b3) \u00d7 1 \u00d7 P(S\u2080) = (1\u2212\u03b1)(1\u2212\u03b3) \u00d7\u00a0P(S\u2080)<\/strong><\/p>\n
EV: \u03b1 \u00d7 1 \u00d7 P(S\u2082) = \u03b1 \u00d7\u00a0P(S\u2082)<\/strong>Honest mines next block \u2192 lead drops to 0, selfish immediately publishes, race begins (\u03b3 case\u200a\u2014\u200aselfish wins race, earns 1)
EV: (1\u2212\u03b1) \u00d7 \u03b3 \u00d7 1 \u00d7\u00a0P(S\u2080\u2019)<\/strong>Honest mines next block \u2192 lead drops to 0, selfish immediately publishes, race begins (1\u2212\u03b3 case, honest chain wins, selfish pool earns 0)
EV: (1\u2212\u03b1) \u00d7 (1-\u03b3) \u00d7 0 \u00d7 P(S\u2080\u2019) =\u00a00<\/strong>Honest mines next block \u2192 lead drops to 0, selfish immediately publishes, race begins (1\u2212\u03b3 case, honest chain wins, honest pool earns 1)
EV: (1\u2212\u03b1) \u00d7 (1-\u03b3) \u00d7 1\u00d7\u00a0P(S\u2080\u2019)<\/strong><\/p>\n
EV: \u03b1 \u00d7 1 \u00d7 P(S\u2083) = \u03b1 \u00d7\u00a0P(S\u2083)<\/strong>Honest mines next block \u2192 selfish immediately publishes a 2-block lead, resetting the state to S\u2080 <\/strong>\u2192 blocks earned = 2
EV: (1\u2212\u03b1) \u00d7 2 \u00d7 P(S\u2080) = 2(1\u2212\u03b1) \u00d7\u00a0P(S\u2080)<\/strong><\/p>\nReferences<\/strong><\/h4>\n