Majority is not Enough: Bitcoin Mining is Vulnerable
Yüklə 0,67 Mb. Pdf görüntüsü
|
actions are included, as well as an amount of new Bitcoins that did not exist before.
2 2.2
Pool formation The probability of mining a block is proportional to the computational resources used for solving the associated cryptopuzzle. Due the nature of the mining pro- cess, the interval between mining events exhibits high variance from the point of view of a single miner. A single home miner using a dedicated ASIC is unlikely to mine a block for years [ 31 ]. Consequently, miners typically organize themselves into mining pools. All members of a pool work together to mine each block, and share their revenues when one of them successfully mines a block. While joining a pool does not change a miner’s expected revenue, it decreases the variance and makes the monthly revenues more predictable. 3 The Selfish-Mine Strategy First, we formalize a model that captures the essentials of Bitcoin mining be- havior and introduces notation for relevant system parameters. Then we detail the selfish mining algorithm. 3.1
Modeling Miners and Pools The system is comprised of a set of miners 1, . . . , n. Each miner i has mining power m i
n i=1
m i = 1. Each miner chooses a chain head to mine, and finds a subsequent block for that head after a time interval that is exponentially distributed with mean m −1 i
try to maximize their revenue, and may deviate from the protocol to do so. A group of miners can form a pool that behaves as single agent with a centralized coordinator, following some strategy. The mining power of a pool is the sum of mining power of its members, and its revenue is divided among its members according to their relative mining power [ 30 ]. The expected relative revenue, or simply the revenue of a pool is the expected fraction of blocks that were mined by that pool out of the total number of blocks in the longest chain. 3.2 Selfish-Mine We now describe our strategy, called Selfish-Mine. As we show in Section 4 , Selfish-Mine allows a pool of sufficient size to obtain a revenue larger than its ratio of mining power. For simplicity, and without loss of generality, we assume that miners are divided into two groups, a colluding minority pool that follows the selfish mining strategy, and a majority that follows the honest mining strat- egy (others). It is immaterial whether the honest miners operate as a single group, as a collection of groups, or individually. 2 The rate at which the new Bitcoins are generated is designed to slowly decrease towards zero, and will reach zero when almost 21 million Bitcoins are created. Then, the miners’ revenue will be only from transaction fees. Algorithm 1: Selfish-Mine 1 on Init 2 public chain ← publicly known blocks 3 private chain ← publicly known blocks 4 privateBranchLen ← 0 5 Mine at the head of the private chain. 6 on My pool found a block 7 ∆
← length(private chain) − length(public chain) 8 append new block to private chain 9 privateBranchLen ← privateBranchLen + 1 10 if ∆
prev = 0 and privateBranchLen = 2 then (Was tie with branch of 1) 11 publish all of the private chain (Pool wins due to the lead of 1) 12 privateBranchLen ← 0 13 Mine at the new head of the private chain. 14 on Others found a block 15 ∆ prev ← length(private chain) − length(public chain) 16 append new block to public chain 17 if ∆
prev = 0 then
18 private chain ← public chain (they win) 19 privateBranchLen ← 0 20 else if ∆ prev = 1 then
21 publish last block of the private chain (Now same length. Try our luck) 22 else if ∆ prev = 2 then
23 publish all of the private chain (Pool wins due to the lead of 1) 24 privateBranchLen ← 0 25 else
(∆ prev
> 2) 26 publish first unpublished block in private block. 27 Mine at the head of the private chain. The key insight behind the selfish mining strategy is to force the honest min- ers into performing wasted computations on the stale public branch. Specifically, selfish mining forces the honest miners to spend their cycles on blocks that are destined to not be part of the blockchain. Selfish miners achieve this goal by selectively revealing their mined blocks to invalidate the honest miners’ work. Approximately speaking, the selfish mining pool keeps its mined blocks private, secretly bifurcating the blockchain and cre- ating a private branch. Meanwhile, the honest miners continue mining on the shorter, public branch. Because the selfish miners command a relatively small portion of the total mining power, their private branch will not remain ahead of the public branch indefinitely. Consequently, selfish mining judiciously reveals blocks from the private branch to the public, such that the honest miners will switch to the recently revealed blocks, abandoning the shorter public branch. This renders their previous effort spent on the shorter public branch wasted, and enables the selfish pool to collect higher revenues by incorporating a higher fraction of its blocks into the blockchain. Armed with this intuition, we can fully specify the selfish mining strategy, shown in Algorithm 1 . The strategy is driven by mining events by the selfish pool or by the others. Its decisions depend only on the relative lengths of the selfish pool’s private branch versus the public branch. It is best to illustrate the operation of the selfish mining strategy by going through sample scenarios involving different public and private chain lengths. Yüklə 0,67 Mb. Dostları ilə paylaş:
|