Competing (Semi)-Selfish Miners in Bitcoin

Competing (Semi)-Selfish Miners in Bitcoin

Francisco J. Marmolejo-Cossío Supported by the Mexican National Council of Science and Technology (CONACyT)University of Oxford
francisco.marmolejo@cs.ox.ac.uk
   Eric Brigham New College of Florida
eric.brigham15@ncf.edu
   Benjamin Sela University of Maryland
jkatz@cs.umd.edu, benj.sela@gmail.com
   Jonathan Katz University of Maryland
jkatz@cs.umd.edu, benj.sela@gmail.com
Abstract

The Bitcoin protocol prescribes certain behavior by the miners who are responsible for maintaining and extending the underlying blockchain; in particular, miners who successfully solve a puzzle, and hence can extend the chain by a block, are supposed to release that block immediately. Eyal and Sirer showed, however, that a selfish miner is incentivized to deviate from the protocol and withhold its blocks under certain conditions.

The analysis by Eyal and Sirer, as well as in followup work, considers a single deviating miner (who may control a large fraction of the hashing power in the network) interacting with a remaining pool of honest miners. Here, we extend this analysis to the case where there are multiple (non-colluding) selfish miners. We find that with multiple strategic miners, specific deviations from honest mining by multiple strategic agents can outperform honest mining, even if individually miners would not be incentivised to be dishonest. This previous point effectively renders the Bitcoin protocol to be less secure than previously thought.

Keywords:
blockchain, selfish mining

1 Introduction

One of the key innovations in the Nakamoto protocol behind Bitcoin [11] is the assumption that agents involved in the upkeep of the digital ledger, so called miners, are strategic rather than adversarial, which invites a game-theoretic analysis of the underlying protocol. Under this relaxed assumption, Bitcoin enjoys more robust guarantees on its security: the adage being “it is in a miner’s best interest to be honest when there is an honest majority of miners”.

This adage however was famously proven to be incorrect by Eyal and Sirer [4], when they first described “Selfish Mining”, a non-honest miner strategy that gives more returns to miners than honest mining, even if a majority of other agents are honest. Subsequently, there has been much work exploring the extensions and limitations of selfish mining, but most of this work is limited to the case in which there is a single selfish miner and the rest of the network acts honestly. In this paper we study scenarios where more than one miner deviates from the honest mining protocol. We show that there are substantial game-theoretic differences when multiple miners can be strategic with implications to Bitcoin’s security. First of all, there are hash rates where a miner is incentivised to be honest if mining is treated as a one-shot game, yet where the miner is incentivised to be strategic if he is the leader in sequential (Stackleberg) game. Second of all, we show that with multiple strategic miners, specific deviations from honest mining by multiple strategic agents can outperform honest mining, even if individually miners would not be incentivised to be dishonest. These two previous points effectively render the Bitcoin protocol to be less secure than previously thought.

1.1 Our Contributions

We study miner incentives when multiple miners employ variants of selfish mining strategies. Original selfish mining (SM) consists of secretly withholding mined blocks and judiciously publishing private blocks in an attempt to increase stale block rates of other miners. Though such an attack is not immediately profitable, as the block rate of all miners decreases, it can be profitable in a longer time horizon as block difficulty rates decrease. In SM, miners may keep an arbitrarily long private chain, which makes it difficult to analytically solve for relative revenues when more than one miner employs SM. For this reason, we study a truncation of this strategy, semi-selfish mining (SSM), where miners keep a private chain of length at most 2.

SSM falls within the family of generalised selfish mining strategies of [15] and [12], and our paper begins by studying analytic properties of SSM’s performance against honest mining. In Section 4, we show that although SSM achieves less relative revenue than SM against honest mining, it is always a more profitable strategy for a strategic miner than honest mining if the miner has a hash rate larger than of the total system hash rate, and if the strategic miner is able to propagate blocks to other miners quickly, this threshold lowers to around . In fact, we show the relative revenue of SSM is an asymptotically tight lower bound to the relative revenue of SM as a strategic miner’s hash power tends to 0.

As mentioned before, the benefit of SSM is that it can be represented with a reduced state space, and hence we can explicitly solve for relative revenues in the case where multiple strategic miners employ SSM. In Section 5 we focus on systems with two strategic miners and describe the Markov chain that governs block publishing dynamics. This allows us to explicitly solve for relative revenues of all miners in the steady state.

With the steady state solutions in hand, we are able to study the incentives that govern the decision whether a miner uses SSM against another strategic miner. To do so, we define a binary action two-player game amongst both strategic miners which we call the SSM game. In the SSM game both miners are denoted by and and they have corresponding utility functions and . In addition, each miner has the action set representing honest mining and SSM mining. Interestingly, we find multiple scenarios at different hash rates:

  • For all pure strategy profiles, , there exist hash rates of both strategic miners such that is a unique pure Nash equilibrium.

  • When both strategic miners have roughly around 0.2 to 0.27 of the system’s hash power, both and are simultaneously pure Nash equilibria of the SSM game.

  • There exist hash rates where a specific miner is not unilaterally incentivised to employ SSM, yet is the only pure Nash equilibrium of the game. This effectively lowers the minimum hash rate required for SSM to be profitable by virtue of the existence of another strategic miner.

  • There exist hash rates where (once again, an identical result holds with the roles of miners reversed). This is interesting because although SSM is individually rational for the first strategic miner, the second (larger) strategic miner has the ability to “penalise” the first miner were they to retaliate by using SSM.

We also consider a richer action space for miners: we allow them to partition their hash power into an honest portion and an SSM portion. The game specified by these utilities is called the partition game, and when treated as a one-shot game, it yields the same pure Nash equilibria as the SSM game. The more interesting result stems from treating this game as a Stackelberg game and understanding optimal commitments a miner may make to elicit a desired behaviour in the other miner. It turns out that in the partition game, there exist hash rates with non-trivial Stackelberg equilibria that can result in large gains for leader miners. In fact, there are even hash rates where a miner is honest in the one-shot SSM game, yet strategic in the sequential partition game’s Stackelberg equilibrium. This has important consequences for the security of Bitcoin, as miners with smaller hash rates than what was known before may be incentivised to be strategic in a sequential setting.

In Section 7 we consider the scenario where miners are strategic. For , we compute bounds on the minimal such that if the strategic miners each with hash power have to decide between employing honest mining and SSM, the strategy profile where all such miners employ SSM Pareto-dominates honest mining. For each , we call the uniform profitability threshold for SSM, and we show that not only is it a decreasing function in , but that already for , is as low as 0.11. This is striking, because at such hash rates, miners are far from being individually incentivised to employ SSM, implying that the existence of other strategic miners can effectively hurt the stability of Bitcoin.

As an aside, we also note that in Appendix C we explicitly extend our game-theoretic formalism from Section 5 and Section 6 to the multi-player setting, and we specify how to compute utilities in these games. Furthermore, in Appendix D we extensively map incentives of 3 strategic miners akin to Section 5 and Section 6. We find that the game-theoretic observations of the two-player setting generalise appropriately.

1.2 Related Work

Selfish mining was originally introduced by Eyal and Sirer in [4]. In this work, the authors describe Selfish Mining (SM), a specific mining strategy that deviates from the prescribed honest mining strategy of the Bitcoin network with the key property that it is more profitable than honest mining for miners with over of the hash power of the entire Bitcoin network. Subsequently, [12] and [15] identify a generalised class of selfish mining strategies to which SM belongs and show that in general there are more aggressive and profitable strategies than SM within this family of strategies. In a similar vein, [8] uses game theory to formalise the decision a single strategic miner may take to employ different strategies from the generalised family of selfish mining strategies. In particular, they define analogous complete information games to real-life mining and show that for these games, if no miner has a large enough hash power, honest mining is a Nash equilibrium.

Perhaps most similar to our work is [10], where the authors simulate multiple strategic miners employing strategies other than honest mining. Their results are simulation-based, whereas we provide closed-form results for the specific SSM strategy. In fact, our model can be seen as a variant of the model used in [1], which we developed concurrently to allow for an arbitrary number of strategic agents employing SSM. Furthermore we focus on the game-theoretic considerations miners may take in deciding whether to employ SSM in varying degrees.

Subversive mining strategies can also be combined with network level attacks to exacerbate undue profits. This is discussed in [12] where the authors combine selfish mining strategies with eclipse attacks; an eclipse attack is when an entity holds all connections with a subset of the mining swarm and can thus control all communication between them and the rest of the miners. The authors show that no combination of a selfish mining strategy and eclipse attack is optimal at all times. The choice of what selfish mining strategy to adopt as well as how to eclipse a victim is highly dependent on the network parameters in which one is operating. These parameters include computational power, percentage of the network that can be eclipsed, and the percentage of remaining miners that can be influenced.

There are additional attacks miners can wage outside the family of selfish mining. At the pool level, managers can wage withholding attacks as per [2] [5], where a malicious pool infiltrates a victim pool, submitting shares and withholding full solutions. Indeed this notion of “partitioning” one’s pool is similar to our partition games from section 5. [5] shows that this can be profitable for a single malicious pool, but when multiple pools engage in block withholding attacks, this results in a situation akin to the prisoner’s dilemma, where the equilibrium of all malicious pools is to infiltrate and thus reduce the overall profit of every pool in the network. Withholding attacks are further refined in [9], where a malicious pool still withholds full solutions from a victim pool, but may share said full solutions when it hears of a full solution being found by a miner outside of the malicious and victim pool. The intent of this strategy is to incentivise the victim pool manager to cause a fork, and this behaviour does away with the prisoner’s dilemma of [5], as there are equilibria where larger pools are strictly better off than honest mining. Furthermore, there is some evidence showing that this family of pool-level attacks can be difficult to detect for victim pools [2].

Along with work covering subversive mining attacks and which strategies miners should adopt based on network parameters, there have also been efforts to defeat these attacks. In [3] the authors outline a new blockchain protocol, Bitcoin Next Generation, which decouples leader election and transaction serialization for better scalability. In addition to this they also modify which chain honest miners adopt as the one they will mine on. Currently, when honest miners are presented with two chains of the same length, they will opt to accept the older one. This fact gives selfish miners an advantage in that they become more powerful the more connected they are to the rest of the network and can lower the necessary computational power needed to selfish mine successfully. In their new protocol, they propose that when an honest miner is presented with two chains of the same length, they choose which one to mine on uniformly at random. With this change, the lower bound on computational power needed to selfish mine increases, thus making it harder to act subversively. While this was conjectured to be true and showed to be so with simulation, there are contradictory results. In [14] the authors show that while this change does limit the strength of large selfish miners, it enhances the strength of medium sized selfish miners and that selfish miners with computational power less than 25% can still gain from acting subversively.

2 Model Assumptions and Notation

The decentralised design of Bitcoin consists of clients: users of Bitcoin, who own accounts designated by addresses. A client can send Bitcoin from an address he owns to an arbitrary address by broadcasting a transaction to the Bitcoin P2P network. This transaction will eventually be appended to a a global ledger called the Blockchain. The upkeep of the Blockchain is performed by miners, who collect transactions in blocks and append these blocks to the chain. For this task, miners are rewarded with Bitcoin, either in the form of a block reward or transaction fees.

We model the Blockchain system as a set of strategic miners, , and an implicit honest miner . Each strategic miner , controls an portion of the system hash power (we don’t consider strategic miners strong enough to perform a 51 percent attack), and the honest miner controls a portion of the system hash power. The implicit honest miner is without loss of generality for if any number of miners (beyond the strategic miners ) employ honest mining, this is equivalent to one miner of their combined hash power employing honest mining. For convenience we denote the set of valid strategic miner hash rates by .

Given strategic miner hash rates , any found block has an probability of being found by the -th strategic miner , and a probability of being found by . We also assume that the system overall finds blocks at a rate of according to a Poisson process. In terms of the actual implementation of the Bitcoin protocol, is roughly one block every 10 minutes, which is ensured by dynamically adjusting the difficulty of the block hash target.

The append-only nature of the block renders the Blockchain into a tree with a root at the genesis block. Since the longest path of the tree is the agreed-upon transaction history, a miner’s revenue consists of his block rewards and transaction fees arising from blocks that eventually become a part of the longest path in the Blockchain. In this paper we focus on block rewards and normalise such rewards to unit value, hence the revenue of a miner is the number of his blocks that are accepted in the longest path of the blockchain.

Indeed it could be the case that a longest path in the blockchain is eventually surpassed by a competing path: this is a key aspect to selfish mining strategies. This of course makes it difficult to ascertain revenues when miners are arbitrary agents. In our paper however we pit specific mining strategies against each other and hence obtain a well-defined block creation rates for all agents involved. Furthermore, we assume that agents are rational and that the utility they wish to maximise is their relative revenue: which is for a miner is the expected number of blocks publishes in the blockchain normalised by the expected number of blocks produced by all miners . The justification behind this utility function comes from the fact that Bitcoin dynamically adjusts its difficulty, hence relative revenue in the long-term corresponds to overall revenue.

3 Miner Strategies

Mining strategies are often defined with an implicit assumption that a miner following the strategy will be pitted against miners employing a specific strategy (i.e. honest mining). Since our paper focuses on miner incentives when multiple miners deviate from honest mining, we find ourselves in need of rigorously defining miner strategies with respect to all possible changes in the blockchain, not just those changes that can occur against a specific kind of miner.

In this vein, we formally describe three specific mining strategies: honest mining, selfish mining, and semi-selfish mining. We describe the strategies for an arbitrary miner denoted by .

To execute these strategies, must keep track of their private chains, the public chain, a block upon which to mine and an internal state . As for additional notation, denotes the private chain of , denotes the public chain and (frontier) denotes the set of blocks at the ends of the longest paths of the public chain. Arbitrary blocks are usually denoted by . We also let and denote the length of the longest path in the miner’s private chain and the length of the longest path of the public chain respectively. For a given set of a blocks , we let denote the oldest block in of which was aware. Finally, we let be the block at the end of the miner’s private chain and be the block upon which is mining.

The integer of the internal state, represents a miner’s “lead”: how much longer the miner’s private chain is than the public chain. For all three mining strategies states 0 and 0’ will not only mean that the miner has no lead with respect to the public chain, but that the miner’s private chain is in fact the public chain (a fact which follows from the rules governing the strategies). Finally, the difference between 0 and 0’ is that the latter state occurs when there is a tie on the public chain, i.e. . The choices available to miners are where to mine, , and whether to reveal parts of their private chain.

3.1 Honest Mining

Honest miners are those who follow the prescribed Bitcoin mining protocol faithfully. We describe the strategy in terms of what actions takes when in states :

  • Case 1: finds a block, .

    • publishes .

    • .

    • .

  • Case 2: changes to with frontier .

    • If , then .

    • If , then .

    • .

It is straightforward to check that if all miners mine honestly, their expected relative revenue is precisely their hash rate:

Lemma 1

For any , if all strategic miners are honest, the expected (block) reward of any strategic miner is (and for the extra honest miner ).

3.2 Selfish Mining

Eyal and Sirer introduced Selfish Mining (SM) in [5] as a specific strategy that outperforms honest mining when a rational agent has sufficient computational resources. SM can be described by the actions takes in the following states:

and

  • Case 1: finds a block: .

    • keeps private.

    • .

    • .

  • Case 2: changes to with frontier

    • If , then .

    • If , then .

and

  • Case 1: finds a block: .

    • publishes .

    • .

  • Case 2: changes to with frontier .

    • If , then .

    • If , then .

and

  • Case 1: finds a block: .

    • keeps private.

    • .

    • .

  • Case 2: changes to with frontier and .

    • publishes -prefix of .

    • .

    • .

  • Case 3: changes to with frontier and .

    • publishes , resulting in with frontier

    • If , then .

    • If , then .

    • .

At a glance, this characterisation of SM may look different to how it is usually described. Upon closer inspection however, one can see that this is equivalent to what was presented in [5]. In particular, the fact that in state , , means that when a tie involves a block mined by (as would be the case if they had published a previously private block), they will indeed continue mining upon it, as they will have necessarily seen it first amongst blocks in .

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

*

Figure 1: SM Dynamics. A square with is a block mined by . The circle with represents the value of . A solid line means that portion of the chain is public, and a dashed line means that portion of the chain is private. If a miner employing SM has a lead of that is diminished, he publishes his private chain and hopes to win the tie (Top). If the miner has a larger lead that is partially encroached, he publishes a prefix of his private chain to push other miners into a race (Middle). If a miner of lead sees his lead encroached to , he publishes all blocks to overtake (Bottom).

3.3 Semi-Selfish Mining

SM can be generalised to a class of strategies where a miner maintains a private chain and has the following actions at hand: publishing a portion of his private chain, mining upon his private chain, and foregoing his private chain to mine upon the public chain. Indeed, this general class of selfish mining strategies is studied in [13] and [15].

We focus on the simplest selfish mining strategies from this family by looking at strategies where the selfish miner never maintains a private chain of length greater than 2. Notice that this is necessary if the selfish miner is to gain any benefit from selfish mining, for if the miner only maintains at most one private block, he can only hurt his chances of having this block (and hence any block) published when facing honest miners. On the other hand, for private chains of length 2, we exhibit a specific strategy Semi-Selfish Mining (SSM) that much like the original SM strategy, leads to increased revenue ratios for the selfish miner if they have sufficient hash power.

The reason we study such a simple strategy from the rich space of selfish mining strategies is that it still obtains higher relative revenues than honest mining in certain parameter regimes, yet it has a much simpler state space than most selfish mining strategies. This reduced state space will eventually allow us to explicitly solve for expected relative revenues when two selfish miners play against each other. SSM can be described by the actions takes in the following states:

and

  • Case 1: finds a block: .

    • keeps private.

    • .

    • .

  • Case 2: changes to with frontier

    • If , then .

    • If , then .

and

  • Case 1: finds a block: .

    • publishes .

    • .

  • Case 2: changes to with frontier .

    • If , then .

    • If , then .

and

  • Case 1: finds a block: .

    • keeps private.

    • .

    • .

  • Case 2: changes to with frontier and .

    • does nothing.

  • Case 3: changes to with frontier and .

    • publishes , resulting in with frontier

    • If , then .

    • If , then .

    • .

and

  • Case 1: finds a block: .

    • publishes .

    • .

    • .

  • Case 2: changes to with frontier and .

    • does nothing.

  • Case 3: changes to with frontier and .

    • publishes , resulting in with frontier

    • If , then .

    • If , then .

    • .

*

*

*

*

*

*

Figure 2: SSM as a truncation of SM. Once again, a square with is a block mined by . The circle with represents the value of . A solid line means that portion of the chain is public, and a dashed line means that portion of the chain is private. Here has a lead of and upon mining a block, publishes his oldest private block.

4 One Strategic Miner

We begin by studying how one strategic miner of hash power performs against honest miners of hash power in terms of relative revenue. As in [5], we let be the proportion of honest miners who mine upon an SSM chain in the case of a tie, a parameter which we call the propagation of the strategic miner. In what follows, we let and be the expected block creation rate of a single miner using SM and SSM respectively against honest miners. Consequently, we let be the block creation of other honest miners in the system (this is dependant upon whether SM or SSM is used, but we use the same term for the sake of simplicity). Finally, we let and denote the relative revenues of a single miner using SM and SSM respectively against honest miners.

Theorem 4.1 (Selfish Mining Relative Revenue [5])

A single strategic miner of hash power and propagation , attains the following revenue ratio using SM against honest miners:

Asymptotically around the expression is the following:

We can use similar Markov chain methods to derive the revenue ratio of SSM against honest miners. The details of the analysis can be found in Appendix A.

Theorem 4.2

A strategic miner of hash power and propagation , attains the following revenue ratio when using SSM against honest miners:

Asymptotically around , the expression is the following:

4.1 Comparing Performance of SM and SSM

Asymptotically SM and SSM have the same performance as . In fact . For all parameter settings SM outperforms SSM, as evidenced in the graphs in Figure 3. At SM becomes profitable at and SSM becomes profitable at . At SM becomes profitable at and SSM becomes profitable at . Finally, at SM becomes profitable at and SSM becomes profitable at

Figure 3: and against honest miners at , and

5 Two Strategic Miners

The benefit of SSM lies in the fact that it can be a rational strategy distinct from honest mining and more importantly, describing it in terms of a Markov chain does not require many states. The simplicity of the state space allows us to explore the scenario where two agents of different hash rates employ SSM and analytically solve for relative revenues.

5.1 Markov Chain Analysis

Suppose that is the strategic hash rate of the system. Since we have two strategic miners, our state space, , consists of nine states of the form where . These represent the relative lead SSM miners 1 and 2 have with respect to the public chain. Given our description of SSM we can describe the state transitions in the same way as we did for the single SSM case. Both of these can be found in Appendix B.

5.2 Transition Matrix and Steady State

The above state space gives rise to an ergodic Markov chain, so there is a unique stationary distribution we can solve for. In order to do so, we define the following transition matrix, , on , where the coordinate axes of (in ascending order) represent probability mass in states , and respectively. Each is the probability of transitioning to state from state in the Markov chain.

Since this is an ergodic chain, there is a unique steady state distribution, , such that , which we can solve for with Gaussian elimination.

5.3 Propagation and Revenues

In the original selfish mining paper, much attention was given to the propagation parameter . Indeed block dissemination is important because it allows an attacker to persuade other miners to work on their chain in the case of a tie. We also note from the previous section that the steady state distribution is independent of the propagation of the system. The expected number of blocks published per state however, crucially depends on the propagation of the system, and these two objects specify the relative revenue of agents.

In our work, when there is a single strategic miner employing SSM, the ability to propogate blocks is parametrised by as in the original analysis of SM. When there are strategic miners employing SSM however, how propagation is modelled becomes more complicated, since different strategic miners may have a different influence on the P2P network topology. For the rest of the paper we assume that propagation is uniform. In other words, whenever there is a tie in the public chain (of arbitrary size), all miners not involved in the tie are assumed to have a uniformly random chance of contributing their hash power to any element of the tie. Under the assumption of uniform propagation, we can compute the expected block rate per state of the Markov chain for both strategic miners and honest miners. The following matrix encodes this information: the first and second row are expected block rates per state for the first and second strategic miners respectively, the third column is the block creation rate for honest miners. If is a steady state vector for above, then gives steady state expected block creation rates for all miners.

For the sake of completeness, in Appendix B we include a model for different propagation rates when two strategic miners are involved as well as their effects on relative revenues of all miners.

5.4 To SSM or not to SSM? A Revenue Analysis

Although our Markov chain analysis gives us a closed-form solution for the relative revenue of both strategic miners when using SSM, the expression is unwieldy. We can however explicitly solve the expression for specific hash values, and and use these values to describe a two-player, binary action game governing the decision as to whether a player employs SSM or not.

Suppose that describes the hash rates of both strategic miners. We let be the revenue ratios of all miners (including the honest miner ) when both strategic miners employ SSM. Specifically, is the revenue ratio of for . With this in place we can define a two-player binary action game governing the incentives behind employing SSM or not for and .

Definition 1 (Two-player SSM Games)

Suppose that is a strategic hash distribution. We define the SSM Game, as a two-player binary action game. In each strategic miner has a binary action set , where represents mining honestly and represents employing SSM. We define the utilities of all pure strategy profiles as follows:

  • ,

  • ,

  • ,

  • ,

For notational convenience, we interchangeably denote a pure strategy profile of all players by either a tuple, as in for both miners employing honest mining, or a string, as in

As a first region of interest, in Figure 4 we display hash rates where . For such , although SSM may be unilaterally rational for the first strategic miner, a larger miner can penalise the first strategic miner for deviating from the honest protocol by retaliating with SSM. As a specific example of this phenomenon, let us consider the hash distribution which leads to with utilities summarised in Table 1. The second, larger, strategic miner can retaliate from by deviating to , in which case is worse off by approximately in utility than if he had mined honestly at the outset.

  HH HS SH SS
 0.33  0.26794954  0.35517387  0.29387121
0.48 0.57777649 0.46196499 0.61890781
Table 1: Example of where can retaliate against SH
Figure 4: Hash rates where and subsequent penalty values given by .

Now that we have defined the game , it is natural to ask about what equilibria it has. Our results suggest that for all values of , has at least one pure Nash equilibrium (PNE), so that if we let PNE denote the PNE of a given game , PNE for . In the first image of Figure 5 we show which regions of demonstrate different combinations of PNE. For the most part, hash rates lead to a single PNE in , with distinct regions where each pure strategy profile , and occurs as a sole equilibrium. The most interesting observation however, is that for roughly in the region , . For all of these hash rates, Pareto dominates as it results in more utility for both agents involved. As a concrete example, consider for with utilities in Table 2. Clearly and are PNE in , and the utility surplus between and is approximately for and .

  HH HS SH SS
 0.24  0.24293956  0.23069139  0.25911617
0.24 0.23069139 0.24293956 0.25911617
Table 2: Example of with HH and SS as PNE

The second image in Figure 5 focuses on and visualises the difference in utility between and for . The difference in utility for is symmetric since is an anonymous game, meaning the role and can be interchanged.

Figure 5: PNE types and the welfare surplus of SS over HH for when both are PNE.

Interestingly, there are hash rates where is an equilibrium, yet is not profitable relative to for . This means that the existence of another strategic miner can make mining with SSM profitable and stable for whereas this is not the case when with hash power is the only strategic miner in the system. For these we say the profitability threshold of SSM has decreased. The set of such that the profitability threshold of SSM decreases is graphed in Figure 6. Furthermore, there are hash rates in this region where is the only PNE, such as which leads to with utilities in Table 3.

  HH HS SH SS
 0.235  0.22352621  0.22418585  0.23160125
0.345 0.37698013 0.34987697 0.42917647
Table 3: Example where SSM Profitability Threshold Decreases
Figure 6: Hash rates where the profitability threshold of SSM is reduced.

The logical next step is to ask about mixed Nash equilibria in , however the meaning of mixed strategies is not well-suited for selfish mining attacks. For example, what would the mixed strategy represent? One interpretation could be a randomised commitment, where with probability a miner commits to and with probability a miner commits to SSM. This however does not make much sense for selfish mining attacks, since their profitability takes time (due to adjustments in the block difficulty of the system), meaning that an opposing agent would have ample time to perform a best response to the realised commitment over the initial randomisation.

Another approach is to have mean that a miner partitions his hash power into honest mining and SSM mining and commits to this partition henceforth. Although utilities of mixed strategies do not directly correspond to convex combinations of utilities, we use this approach to study an extended action space for miners.

6 Partition Games and Strong Stackelberg Equilibria

As mentioned at the end of the previous section, we also study incentives when miners are given a richer set of pure strategies beyond that of choosing between honest mining and SSM. In particular, we now allow a given miner with hash power to partition his computational power into a portion following SSM and a portion using honest mining. Before continuing we also clarify notation: for , we use to denote the Hadamard product of and .

Definition 2 (Two-player Partition Games)

Suppose that is a strategic hash distribution. We define the Partition Game, , as a two-player game, where each player has the same action set , representing the proportion of their hash power dedicated to employing SSM. For a given pure strategy profile , we define the utilities of as follows:

In Figure 7, for we graph the pure strategy utilities of and as a function of . The most glaring observation is that for fixed , is a convex function of , attaining local maxima at and . This is clear from the fact that the blockchain eventually has one common history, so both sides of a miner’s partition inherently compete with one another.

Figure 7: Utilities in for .

Game theoretically, this means best responses for any are always from the set . Immediately, this tells us that the set of pure Nash equilibria of are the same as those in , since restricted to pure strategy profiles in is isomorphic to (recall that and in ). It may thus seem the augmented strategy space of buys us nothing, however if we treat as a leadership game, where gets to commit to a pure strategy, , to which retaliates, then we get a different story.

To formally treat as a leadership game, we let be the leader and the follower. For a given pure strategy of , we let denote the best response has to . Since we have observed that best responses for any are always from the set , it follows that . If , then we let , so that breaks ties in favour of . The value of commitment for is denoted by and for the value of commitment for miner 2 is denoted by .

In a leadership game, a common solution concept is that of a Strong Stackelberg Equilibrium (SSE), which is a strategy pair such that and . This can be seen as a subgame perfect equilibrium of , or the optimal commitment under . Furthermore, we let denote the SSE of an arbitrary game .

In Figure 8 we graph (optimal) commitment values for at the SSE of for different values of . Furthermore, we graph the value of these optimal commitments when compared to utility players obtain at their respectively optimal PNE of at the given hash rate.

6.1 Non-trivial SSE

Since can be seen as an augmented action space to , we categorise depending on how the sets and compare.

Definition 3 (Commitment/SSE Types)

For every we associate a commitment type denoted defined as follows:

  • If , then .

  • If , then .

  • If , and such that , then .

  • If , and such that , then .

If we say gives rise to a trivial commitment and that the collection of SSE in are trivial. Accordingly, if , we say gives rise to a non-trivial commitment and the collection of SSE in is non-trivial. Furthermore, we also say that if is such that , then all are of type as well. In the two-miner scenario, we make the following observations about with non-trivial commitment types:

  • occurs at hash values such that the PNE of are and . commits to to nudge the system to converge to the equilibrium which Pareto-dominates in .

  • occurs at hash rates where there is one SSE of , , yet does not correspond to a PNE of . is unstable in from the perspective of , who would prefer deviating from when pitted against . These SSE make use of the sequentiality of but not of the extended action space given by partitioning.

  • occurs at hash rates such that is the only PNE of , but where is close to the region in where arises as the sole PNE of . At these values, only slightly prefers to , hence can bait into playing by reserving a small portion of hash power to mine honestly.

For any non-trivial SSE, is lower bounded by the lowest-utility obtains amongst PNE in . On the other hand, if , the SSE of are such that is strictly greater than the highest utility obtains amongst PNE in . This strict surplus in utility is visible in the latter graphs of Figure 8, and we can see that these non-trivial commitments also benefit in spite of being the follower.

Figure 8: SSE types for , optimal commitments for , and relative surplus of SSE against best PNE for and for respectively.

6.2 Plots of Non-Trivial SSE by Type

We now focus on plotting optimal that exhibit SSE of types 1, 2 and 3. For SSE of type 1, it suffices to look at Figure 5 and Table 2 for visualisation of the benefit of SSE over PNE (Since it is just the difference in welfare between PNE in this case).

As for SSE of type 2, these are plotted in more detail in Figure 9. For these values of , we can see that is the only PNE in , but is the SSE of , which is forcibly unstable in the one shot game, , as prefers to . Table 4 shows the utilities for at a specific value of exhibiting this behaviour. Note that in this example, the leader, , has a hash rate of , at which normally they would not be incentivised to unilaterally employ SSM in the one-shot SSM game. The power to commit makes SSM viable at smaller hash rates than in the one-shot game.

  HH HS SH SS
 0.2  0.20352746  0.18016529  0.20179681
 0.225 0.21133109 0.23057851 0.23905979
Table 4: Example where the SSE in is of type 2
Figure 9: Optimal Commitments for , as well as SSE surplus against best PNE for , and for respectively in the region . This region exhibits SSE of type 2.

Figure 10 focuses on hash rates where SSE are of type 3. Furthermore, Figure 11 looks specifically at , which is a hash rate such that has an SSE of type 3, and graphs utilities and best responses as a function of the leader commitment in . This gives a better way of visualising how is an optimal commitment where is rendered indifferent between and .

Figure 10: Optimal Commitments for , as well as SSE surplus against best PNE for , and for respectively in the region . This region exhibits SSE of type 2.
Figure 11: Partition Game Analysis for . The top left image plots follower utilities when playing or against a leader commitment partition. The bottom left image plots follower utility when best responding to a leader commitment. The best response at a given commitment dictates which of the two utilities the leader obtains in the top right plot. Putting everything together, the bottom right plot gives the value of a leader commitment (for the leader) as a function of their commitment. Note how this function is maximised at approximately 0.98, where the follower is indifferent between and .

7 Strategic Miners

Our analysis from Section 5 extends in a straightforward fashion to when there are strategic miners. Consequently, for any hash distribution , we can compute , the revenue ratio of all strategic miners and all other honest miners, when all strategic miners of hash power employ SSM. The full details of the corresponding Markov chain and reward vectors can be found in Appendix B.

It is also straightforward to extend the game-theoretic formalism of Section 5 to study incentives when strategic miners interact. This formalism can also be found in Appendix C. In Appendix D we also plot similar graphs to Section 5 for at different hash rates to visualise strategic miner behaviour. When however, it becomes difficult to visualise how aspects of and precisely vary with . That being said, we do find very similar structures as in the and case, such as: penalising coalitions, existence of PNE, and for some regions multiple PNE, in , non trivial commitments in , and finally, hash rates where the SSM profitability threshold decreases with the existence of other strategic miners. We expand upon this final point to specifically see how the number of strategic miners affects the profitability threshold of SSM.

7.1 Decreasing SSM Profitability Threshold

To study the effect of the number of miners on the profitability threshold of SSM, we define the following:

Definition 4 (Uniform Profitability Threshold for SSM)

For miners we say the uniform profitability threshold for SSM is the smallest such that and (all players employing SSM is a PNE in .

With our methods from Appendix C, we can approximate the uniform SSM profitability threshold for various values of . In particular, Figure 12 shows these threshold values for . Furthermore, the second plot takes the uniform SSM profitability threshold, , and for , computes the utilities of both and which are both PNE in . Interestingly, for , not only does the uniform profitability threshold decrease as a function of , but all miners employing SSM is a PNE that Pareto dominates all miners being honest. These results thus show that the presence of multiple strategic miners may have more of an impact on the stability of Bitcoin than previously thought.

Figure 12: Upper bounds on the uniform profitability threshold for SSM as a function of the number of strategic miners. We also plot the welfare of (all SSM) versus (all honest).

8 Conclusion and Further Work

In this paper we have described a specific miner strategy, semi-selfish mining (SSM) that is a truncated variant of Selfish Mining (SM). SSM has the benefit of being a profitable strategy for large enough miners (in the same way as SM), and also structured enough for us to explicitly solve for relative revenues when more than one strategic miner employs SSM. With this in hand, we have been able to use a game-theoretic lense to glean some information on miner incentives when more than one miner is strategic within the bitocin system.

In particular, for any , we define the SSM game which governs strategic miner incentives in choosing to employ SSM or mine honestly, and the partition game , which extends the action space of to allow miners to partition their hash power between honest mining and SSM. For strategic miners we find the following main takeaways from studying and :

  • All seem to lead to with pure Nash equilibria. Furthermore, there are regions in such that has multiple PNE.

  • A single miner might prefer to use SSM over honest mining in , but there can exist a coalition of miners who may retaliate against this action and punish the original SSM miner into receiving less utility than their hash power.

  • Though the set of PNE in is identical to those of , when treating as a sequential game leads to non-trivial commitments, some of which involve a miner employing SSM even though SSM is not rational in the one-shot SSM game.

  • Finally, there exist hash rates, such that does not unilaterally prefer to employ SSM, but some PNE of includes employing SSM, effectively reducing the profitability threshold of SSM and consequently affecting the stability of Bitcoin.

The action spaces in and may seem limited due to the fact that they only interpolate between honest mining and SSM, but there is nothing barring a variant and from studying the choice of employing other subversive mining strategies over honest mining. In fact, and can be defined by using empirical estimates to steady state payoffs instead of closed form solutions, which could glean some information into how mining dynamics change when a larger palette of subversive strategies is available to interdependent strategic miners. In fact, could be extended so that the action space of miners is no longer simply partitioning mining power between honest mining and SSM, but any partition of mining power amongst a given list of subversive mining strategies.

In addition, the fact that penalising coalitions exist hints at the possibility of modelling such structures in a repeated game framework. The issue of course comes in modelling how much utility a penalising coalition gains in maintaining everyone honest, but there could be interesting subgame perfect Nash equilibria in an appropriate model. Finally, along the same vein of penalising coalitions, there is also scope for a more fine-grained cooperative game theoretic analysis of SSM and Partition games.

References

  • [1] Q. Bai, X. Zhou, X. Wang, Y. Xu, X. Wang and Q. Kong (2018) A deep dive into blockchain selfish mining. Note: Cryptology ePrint Archive, Report 2018/1084\urlhttps://eprint.iacr.org/2018/1084 Cited by: §1.2.
  • [2] N. T. Courtois and L. Bahack (2014) On subversive miner strategies and block withholding attack in bitcoin digital currency. arXiv preprint arXiv:1402.1718. Cited by: §1.2.
  • [3] I. Eyal, A. E. Gencer, E. G. Sirer and R. Van Renesse (2016) Bitcoin-ng: a scalable blockchain protocol.. In NSDI, pp. 45–59. Cited by: §1.2.
  • [4] I. Eyal and E. G. Sirer (2014) Majority is not enough: bitcoin mining is vulnerable. In International conference on financial cryptography and data security, pp. 436–454. Cited by: §1.2, §1.
  • [5] I. Eyal (2015) The miner’s dilemma. In Security and Privacy (SP), 2015 IEEE Symposium on, pp. 89–103. Cited by: §1.2, §3.2, §3.2, Theorem 4.1, §4.
  • [6] J. Grossklags and B. Preneel (Eds.) (2017) Financial cryptography and data security - 20th international conference, FC 2016, christ church, barbados, february 22-26, 2016, revised selected papers. Lecture Notes in Computer Science, Vol. 9603, Springer. External Links: Link, Document, ISBN 978-3-662-54969-8 Cited by: 15.
  • [7] (2016) IEEE european symposium on security and privacy, euros&p 2016, saarbrücken, germany, march 21-24, 2016. IEEE. External Links: Link, ISBN 978-1-5090-1751-5 Cited by: 13.
  • [8] A. Kiayias, E. Koutsoupias, M. Kyropoulou and Y. Tselekounis (2016) Blockchain mining games. In Proceedings of the 2016 ACM Conference on Economics and Computation, pp. 365–382. Cited by: §1.2.
  • [9] Y. Kwon, D. Kim, Y. Son, E. Y. Vasserman and Y. Kim (2017) Be selfish and avoid dilemmas: fork after withholding (FAW) attacks on bitcoin. See Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, CCS 2017, dallas, tx, usa, october 30 - november 03, 2017, Thuraisingham et al., pp. 195–209. External Links: Link, Document Cited by: §1.2.
  • [10] H. Liu, N. Ruan, R. Du and W. Jia (2018) On the strategy and behavior of bitcoin mining with n-attackers. In Proceedings of the 2018 on Asia Conference on Computer and Communications Security, pp. 357–368. Cited by: §1.2.
  • [11] S. Nakamoto (2008) Bitcoin: a peer-to-peer electronic cash system. Cited by: §1.
  • [12] K. Nayak, S. Kumar, A. Miller and E. Shi (2016) Stubborn mining: generalizing selfish mining and combining with an eclipse attack. In Security and Privacy (EuroS&P), 2016 IEEE European Symposium on, pp. 305–320. Cited by: §1.1, §1.2, §1.2.
  • [13] K. Nayak, S. Kumar, A. Miller and E. Shi (2016) Stubborn mining: generalizing selfish mining and combining with an eclipse attack. See 7, pp. 305–320. External Links: Link, Document Cited by: §3.3.
  • [14] A. Sapirshtein, Y. Sompolinsky and A. Zohar (2016) Optimal selfish mining strategies in bitcoin. In International Conference on Financial Cryptography and Data Security, pp. 515–532. Cited by: §1.2.
  • [15] A. Sapirshtein, Y. Sompolinsky and A. Zohar (2016) Optimal selfish mining strategies in bitcoin. See Financial cryptography and data security - 20th international conference, FC 2016, christ church, barbados, february 22-26, 2016, revised selected papers, Grossklags and Preneel, pp. 515–532. External Links: Link, Document Cited by: §1.1, §1.2, §3.3.
  • [16] B. M. Thuraisingham, D. Evans, T. Malkin and D. Xu (Eds.) (2017) Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, CCS 2017, dallas, tx, usa, october 30 - november 03, 2017. ACM. External Links: Link, Document, ISBN 978-1-4503-4946-8 Cited by: 9.

Appendix A SSM vs. Honest Mining

We can use a similar Markov chain analysis to derive the revenue ratio of SSM against honest miners. We recall that the strategic miner, , has hash power and the honest miner has hash power . Let us define the state space corresponding to the number of private blocks belonging to the miner employing SSM. We can now describe the transitions and their corresponding revenues (expected block creation rate per state):

a.0.1 Transitions from state

  • occurs if find a block. The probability of this transition is and wins a block.

  • occurs if finds a block. The probability of this transition is and no players win a block.

a.0.2 Transitions from state

  • occurs if finds and publishes a block, which occurs with probability . A fork is created when subsequently publishes his hidden block and from here three events can occur: A first scenario occurs when finds another block to resolve the tie in his favour, resulting in two blocks for . This occurs with probability . A second scenario occurs when an honest miner finds a block that resolves the tie in favour of , resulting in one block for and one block for . This occurs with probability . A final scenario occurs when an honest miner finds a block that resolves the tie in favour of which results in two blocks for . This final event occurs with probability . In all aforementioned scenarios the resulting state is , thus the probability of the transition to state is .

  • occurs if finds a block and keeps it private as per SSM. This event occurs with probability and no blocks are awarded to any agent.

a.0.3 Transitions from state

  • occurs when finds a block. The probability of this transition is and wins two blocks.

  • occurs if finds a block. The probability of this transition is