Ittay Eyal and Emin Gun Sirer
Department of Computer Science, Cornell University
Abstract. The Bitcoin cryptocurrency records its transactions in a public log called the blockchain. Its security rests critically on the distributed protocol that maintains the blockchain, run by participants called miners.
Conventional wisdom asserts that the protocol is incentive-compatible and secure against colluding minority groups, i.e., it incentivizes miners to follow the protocol as prescribed.
We show that the Bitcoin protocol is not incentive-compatible. We present an attack with which colluding miners obtain a revenue larger than their fair share. This attack can have signicant consequences for
Bitcoin: Rational miners will prefer to join the selsh miners, and the colluding group will increase in size until it becomes a majority. At this point, the Bitcoin system ceases to be a decentralized currency.
Selsh mining is feasible for any group size of colluding miners. We propose a practical modication to the Bitcoin protocol that protects against selsh mining pools that command less than 1=4 of the resources. This threshold is lower than the wrongly assumed 1=2 bound, but better than the current reality where a group of any size can compromise the system.
Bitcoin is a cryptocurrency that has recently emerged as a popular medium of exchange, with a rich and extensive ecosystem. The
Bitcoin network runs at over 42 1018 FLOPS , with a total market capitalization around 1.5 billion US
Dollars as of October 2013 . Central to Bitcoin’s operation is a global, public log, called the blockchain, that records all transactions between Bitcoin clients. The security of the blockchain is established by a chain of cryptographic puzzles, solved by a loosel organized network of participants called miners. Each miner that successfully solves a cryptopuzzle is allowed to record a set of transactions and to collect a reward in Bitcoins. The more mining power (resources) a miner applies, the better are its chances to solve the puzzle rst.
This reward structure provides an incentive for miners to contribute their resources to the system, and is essential to the currency’s decentralized nature.
The Bitcoin protocol requires a majority of the miners to be honest; that is, follow the Bitcoin protocol as prescribed. By construction, if a set of colluding miners comes to command a majority of the mining power in the network, the currency stops being decentralized and becomes controlled by the colluding group. Such a group can, for example, prohibit certain transactions, or all of them. It is, therefore, critical that the protocol be designed such that miners have no incentive to form such large colluding groups.
Empirical evidence shows that Bitcoin miners behave strategically and form pools. Specically, because rewards are distributed at infrequent, random intervals, miners form mining pools in order to decrease the variance of their income rate. Within such pools, all members contribute to the solution of each cryptopuzzle, and share the rewards proportionally to their contributions. To the best of our knowledge, so far such pools have been benign and followed the protocol. Indeed, conventional wisdom has long asserted that the
Bitcoin protocol is incentive-compatible; that is, the best strategy of a rational minority pool is to be honest, and a minority of colluding miners cannot earn disproportionate benets by deviating from the protocol . Because the protocol is believed to
reward miners strictly in proportion to the ratio of the overall mining power they control, a miner in a large pool is believed to earn the same revenue as it would in a small pool. Consequently, there is no advantage for colluding miners to organize into ever-increasing pools. Therefore, pool formation by honest rational miners poses no threat to the system.
In this paper, we show that the conventional wisdom is wrong: the Bitcoin protocol, as prescribed and implemented, is not incentive-compatible. We describe a strategy that can be used by a minority pool to obtain more revenue than the pool’s fair share, that is, more than its ratio of the total mining power.
The key idea behind this strategy, called Selsh Mining, is for a pool to keep its discovered blocks private, thereby intentionally forking the chain. The honest nodes continue to mine on the public chain, while the pool mines on its own private branch. If the pool discovers more blocks, it develops a longer lead on the public chain, and continues to keep these new blocks private. When the
public branch approaches the pool’s private branch in length, the selsh miners reveal blocks from their private chain to the public.
This strategy leads honest miners that follow the Bitcoin protocol to waste resources on mining cryptopuzzles that end up serving no purpose. Our analysis demonstrates that, while both honest and selsh parties waste some resources, the honest miners waste proportionally more, and the selsh pool’s rewards exceed its share of the network’s mining power, conferring it a competitive advantage and incentivizing rational miners to join the selsh mining pool.
We show that, above a certain threshold size, the revenue of a selsh pool rises superlinearly with pool size above its revenue with the honest strategy. The implications of this statement are devastating for the system. Once a selsh mining pool reaches the threshold, rational miners will preferentially join selsh miners to reap the higher revenues compared to other pools. Such a selsh mining
pool will quickly grow to become a majority, at which point the pool will be the only creator of blocks, the decentralized nature of the currency will collapse, and a single entity, the selsh pool manager, will control the system.
Since a selsh mining pool that exceeds threshold size poses a threat to the Bitcoin system, we characterize how the threshold varies as a function of message propagation speed in the network. We show that, for a mining pool with high connectivity and good control on information ow, the threshold is close to zero. This implies that the Bitcoin system is safe only when 100% of the miners are honest. The rst selsh miner will earn proportionally higher revenues than its honest counterparts, and the revenue of the selsh mining pool will increase superlinearly with pool size.