actions are included, as well as an amount of new Bitcoins that did not exist
before.
2
2.2
Pool formation
The probability of mining a block is proportional to the computational resources
used for solving the associated cryptopuzzle. Due the nature of the mining pro-
cess, the interval between mining events exhibits high variance from the point of
view of a single miner. A single home miner using a dedicated ASIC is unlikely to
mine a block for years [
31
]. Consequently, miners typically organize themselves
into mining pools. All members of a pool work together to mine each block, and
share their revenues when one of them successfully mines a block. While joining
a pool does not change a miner’s expected revenue, it decreases the variance and
makes the monthly revenues more predictable.
3
The Selfish-Mine Strategy
First, we formalize a model that captures the essentials of Bitcoin mining be-
havior and introduces notation for relevant system parameters. Then we detail
the selfish mining algorithm.
3.1
Modeling Miners and Pools
The system is comprised of a set of miners 1, . . . , n. Each miner i has mining
power m
i
, such that
n
i=1
m
i
= 1. Each miner chooses a chain head to mine, and
finds a subsequent block for that head after a time interval that is exponentially
distributed with mean m
−1
i
. We assume that miners are rational; that is, they
try to maximize their revenue, and may deviate from the protocol to do so.
A group of miners can form a pool that behaves as single agent with a
centralized coordinator, following some strategy. The mining power of a pool
is the sum of mining power of its members, and its revenue is divided among
its members according to their relative mining power [
30
]. The expected relative
revenue, or simply the revenue of a pool is the expected fraction of blocks that
were mined by that pool out of the total number of blocks in the longest chain.
3.2
Selfish-Mine
We now describe our strategy, called Selfish-Mine. As we show in Section
4
,
Selfish-Mine allows a pool of sufficient size to obtain a revenue larger than its
ratio of mining power. For simplicity, and without loss of generality, we assume
that miners are divided into two groups, a colluding minority pool that follows
the selfish mining strategy, and a majority that follows the honest mining strat-
egy (others). It is immaterial whether the honest miners operate as a single
group, as a collection of groups, or individually.
2
The rate at which the new Bitcoins are generated is designed to slowly decrease
towards zero, and will reach zero when almost 21 million Bitcoins are created. Then,
the miners’ revenue will be only from transaction fees.
Algorithm 1: Selfish-Mine
1
on Init
2
public chain ← publicly known blocks
3
private chain ← publicly known blocks
4
privateBranchLen ← 0
5
Mine at the head of the private chain.
6
on My pool found a block
7
∆
prev
← length(private chain) − length(public chain)
8
append new block to private chain
9
privateBranchLen ← privateBranchLen + 1
10
if ∆
prev
= 0 and privateBranchLen = 2 then
(Was tie with branch of 1)
11
publish all of the private chain
(Pool wins due to the lead of 1)
12
privateBranchLen ← 0
13
Mine at the new head of the private chain.
14
on Others found a block
15
∆
prev
← length(private chain) − length(public chain)
16
append new block to public chain
17
if ∆
prev
= 0 then
18
private chain ← public chain
(they win)
19
privateBranchLen ← 0
20
else if ∆
prev
= 1 then
21
publish last block of the private chain
(Now same length. Try our luck)
22
else if ∆
prev
= 2 then
23
publish all of the private chain
(Pool wins due to the lead of 1)
24
privateBranchLen ← 0
25
else
(∆
prev
> 2)
26
publish first unpublished block in private block.
27
Mine at the head of the private chain.
The key insight behind the selfish mining strategy is to force the honest min-
ers into performing wasted computations on the stale public branch. Specifically,
selfish mining forces the honest miners to spend their cycles on blocks that are
destined to not be part of the blockchain.
Selfish miners achieve this goal by selectively revealing their mined blocks to
invalidate the honest miners’ work. Approximately speaking, the selfish mining
pool keeps its mined blocks private, secretly bifurcating the blockchain and cre-
ating a private branch. Meanwhile, the honest miners continue mining on the
shorter, public branch. Because the selfish miners command a relatively small
portion of the total mining power, their private branch will not remain ahead of
the public branch indefinitely. Consequently, selfish mining judiciously reveals
blocks from the private branch to the public, such that the honest miners will
switch to the recently revealed blocks, abandoning the shorter public branch.
This renders their previous effort spent on the shorter public branch wasted,
and enables the selfish pool to collect higher revenues by incorporating a higher
fraction of its blocks into the blockchain.
Armed with this intuition, we can fully specify the selfish mining strategy,
shown in Algorithm
1
. The strategy is driven by mining events by the selfish
pool or by the others. Its decisions depend only on the relative lengths of the
selfish pool’s private branch versus the public branch. It is best to illustrate
the operation of the selfish mining strategy by going through sample scenarios
involving different public and private chain lengths.