On profitability of stubborn mining

08/02/2018 ∙ by Cyril Grunspan, et al. ∙ Pôle Universitaire Léonard de Vinci 0

We compute and compare profitabilities of stubborn mining strategies that are variations of selfish mining. These are deviant mining strategies violating Bitcoin's network protocol rules. We apply the foundational set-up from our previous companion article on the profitability of selfish mining, and the new martingale techniques to get a closed-form computation for the revenue ratio, which is the correct benchmark for profitability. Catalan numbers and Catalan distributions appear in the closed-form computations. This marks the first appearance of Catalan numbers in the Mathematics of the Bitcoin protocol.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

page 11

page 12

page 16

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1. Introduction

In our previous article [3] we gave a rigorous foundation for the profitability analysis of alternative mining strategies in the Bitcoin network [6]. As for games with repetition, it depends on the proper analysis of the revenue and the duration over attack cycles. More precisely, we prove that the expected revenue and expected duration over an attack cycle give the “Revenue Ratio”

This is the correct benchmark for the profitability of the strategy.

This analysis was applied to the “Selfish Mining” strategy from [1]. We also introduced in [3]

martingale tools that yield, by the application of Doob’s Stopping Time Theorem, the expected duration of the attack cycles. With the Markov model (used in

[1] and other articles in the literature) one cannot compute the expected cycle duration . As we prove in [3], it is only after a difficulty adjustment that Selfish Mining or any other “block withholding strategy” can become profitable. To compute the expected time of the next difficulty adjustment it is necessary to be able to compute the expected duration of cyles .

In this article we apply again these new powerful techniques to some of the “Stubborn Mining” strategies presented in [7]. So far only a numerical Monte-Carlo analysis seems to be known for these strategies. For the “Lead-Stubborn Mining” (LSM) and the “Equal Fork Stubborn Mining” (EFSM) strategies we compute the “Revenue Ratios”.

We fix some notations. Let be the block reward, and the average inter-block validation time for the total network (around minutes for the Bitcoin network). We denote by the relative hashing power of the attacker. Let be the fraction of the honest network that the attacker attracts to mine on top of his fork. For a miner that after a difficulty adjustment has a Revenue Ratio we define his apparent hashrate by

The apparent hashrate of a miner can also be defined after a difficulty adjustment as the average proportion of blocks mined by the miner in the official blockchain. We make use of

which is the generating series for Catalan numbers (see Appendix A).

Theorem 1 (Lead-Stubborn mining).

The revenue ratio of the “Lead-stubborn mining” strategy is

After a difficulty adjustment, the apparent hashrate of the stubborn miner is

Theorem 2 (Equal Fork Stubborn mining).

The revenue ratio of the “Equal Fork Stubborn mining” strategy is

After a difficulty adjustment, the apparent hashrate of the miner is

We compare these strategies to “Honest Mining” (HM) and “Selfish Mining” (SM) and we determine in the parameter plane which one performs the best.

2. Generalities.

2.1. Profitability.

In [3], we studied the profitability of integrable repetition games which are composed of cycles, with a finite expected duration . The stopping time is also called a strategy. Mining strategies are repetition games, and sound mining strategies are integrable. For the comparison of profitability of two strategies we only need to compare the Revenue Ratio of each one (see [3])

where is the revenue over a cycle.

The number of blocks and validated by the attacker and honest miners respectively are independent Poisson processes (see [8] for background on Poisson Process). The attack cycle ends when the honest miners catch-up the attackers. The number of validated blocks in a cycle in the official blockchain is . We denote by (resp. ) the inter-block validation time for the honest miners (resp. attackers).

2.2. Profitability after a difficulty adjustment.

The following Theorem describes how the Revenue Ratio changes after a difficulty adjustment (see [3]).

Theorem 2.1.

After a difficulty adjustment the new Revenue Ratio is given by

where

Proof.

After a difficulty adjustment, the expected revenue is the same, , but the expected duration of a cycle is . So, the new revenue ratio is . ∎

2.3. Description of Stubborn strategies.

We describe first the Selfish Mining (SM) strategy. Let be the advance of the secret fork over the public blockchain. When the honest miners validate a block then the selfish miner does the following:

  • If , he mines normally.

  • If then he broadcasts his block. A competition follows.

  • If then he broadcasts his secret fork.

  • If then he broadcasts blocks from his secret fork to match the length of the public blockchain.

  • Except in the first two cases, he keeps working on top of his secret fork.

For the Lead-Stubborn Mining (LSM) strategy, with he proceeds as in the SM strategy for and with he releases all his secret fork and mines normally on top of it.

In other words, a stubborn miner following the Lead Stuborn Mining strategy (LSM) waits until the honest miners catch up with him to broadcast all of his secret fork. Then, when this happens, there is a final round. Notice that a selfish miner following SM strategy does not take the risk of being caught by the honest miners. If his advance shrinks to , then he broadcasts his fork.

For the Equal Fork Stubborn Mining (EFSM) strategy, everything is equal to LSM, but for if he finds a new block he does not reveal it.

In other words a stubborn miner following the Equal Fork Stubborn Mining strategy (EFSM) waits for the official blockchain to overcome his secret fork by one block. He only gives up when the length of the official blockchain equals the length of his secret fork plus one. In particular, the last round of the attack cycle of the strategy is always lost by such a miner. His reward comes only when blocks of the official blockchain are built by honest miners on top of one of his blocks. Indeed, the rogue miner never adds new blocks to the official blockchain. He only tries to replace old blocks mined by the honest miners with some of his blocks.

3. Lead-Stubborn Mining strategy

3.1. Stopping time.

For each mining strategy we consider the stopping time associated with an attack cycle. Let be the stopping time of the “Lead-Stubborn” Mining strategy.

Proposition 3.1.

We have

with

In other words, either and the attack cycle ends at or and the attack cycle ends up a final round after the honest miner catch up with the attacker.

We calculate the expected duration time of an attack cycle.

Lemma 3.2.

We have

and

Proof.

By the strong Markov property (see [8]), we have

where with and . Both and are Poisson processes with parameters and . Thus, from Appendix 2 on Poisson Games, we have

and

If then

. Otherwise (and this event occurs with probability

), once the honest miners catch-up with the attacker at -time, there is a final round. ∎

Note that if then, and . Otherwise, and .

3.2. Revenue Ratio.

For , we denote by the -th Catalan number

We present in Appendix A the combinatorial properties of Catalan numbers used in this article, and the definition of -Catalan distributions.

The link between Catalan numbers and Bitcoin appears in the following lemma.

Lemma 3.3.

The random variable

follows the second type -Catalan distribution, more precisely, we have and for ,

Proof.

For we have . Consider . The event is the disjoint union of sub-events of the form where for each there is such that , and . The sequence of points with coordinates form a path starting at and ending at which stays strictly above the first bisector in the Euclidean plane. For example, with ,

The number of such paths is (see Proposition A.4 in Appendix A). Moreover, the number of (resp. ) in the sequence of is equal to . ∎

From the expected value computation of a second type -Catalan random variable (Proposition A.2 in Appendix A) we get:

Corollary 3.4.

We have

Remark 3.5.

An alternative probabilistic proof follows from Doob’s Theorem: We have for and we let (similar to Theorem C.1 in Appendix C).

Next we compute the expected revenue per attack cycle.

Proposition 3.6.

Let be the revenue over an attack cycle. We have

with

Proof.

Note that for ,

Moreover, during an attack cycle, each time the honest miners find a block (except for the first block which is mined on a common root), there is a probability that it is found by a miner mining on top of the attacker’s fork. If and , this can happen at most times over an attack cycle. So, by Lemma B.1 from Appendix B,

Therefore, by conditioning on and using Lemma 3.2, Lemma 3.3 and Corollary 3.4, we get

Theorem 3.7.

The revenue ratio of the Lead Stubborn strategy is

Proof.

We have . Use Lemma 3.2 and Proposition 3.6. ∎

3.3. Difficulty adjustment.

We compute now the revenue ratio and the apparent hashrate after a difficulty adjustment.

Lemma 3.8.

We have .

Proof.

For all , is a bounded stopping time. So, by proceeding as in Appendix 2, Doob’s theorem yields and . Taking limits when , the monotone convergence theorem yields and . Now, we observe that at the end of an attack cycle, we have necessarily . So, . Hence we get the result by taking expected values on both sides of the last equality. ∎

The following proposition is now a consequence of Theorem 2.1.

Proposition 3.9.

The parameter updating the difficulty is

Proof.

Using  Theorem 2.1, Lemma 3.2 and Lemma 3.8, we have

3.4. Apparent hashrate after a difficulty adjustment

From Proposition 3.9, we can deduce the hashrate of the strategy on the long term.

Corollary 3.10.

After a difficulty adjustment, the apparent hashrate is

Proof.

By Theorem 2.1, we have:

4. Equal Fork Stubborn Mining strategy

4.1. Stopping time.

Let be the stopping time of an attack cycle for the Equal Fork Stubborn Mining strategy.

Proposition 4.1.

We have

Proof.

If , then we have . Otherwise, we wait for the honest miners to catch up with the stubborn miner and win the last round. ∎

From Theorem C.1 in Appendix C we get:

Lemma 4.2.

We have

4.2. Revenue ratio.

We denote by the revenue of the stubborn miner after an attack cycle.

Lemma 4.3.

The random variable is a -Catalan distribution, i.e. for , we have

Proof.

The event can be decomposed as a disjoint union of sub-events of the form where for each there is such that , and and . The sequence of points with coordinates for form a path starting at and ending at which never crosses the first diagonal in the Euclidean plane before reaching the point . For example,

The number of such paths is (see Proposition A.4 from Appendix A). Moreover, the number of (resp. ) in the sequence of is equal to (resp. ). Hence we get the result. ∎

From the expected value computation of a -Catalan random variable (Proposition A.2 in Appendix A) we get:

Corollary 4.4.

We have

We compute now .

Proposition 4.5.

We have

with

Proof.

By definition of , if we know that , then the honest miners have mined blocks at time . Except for the first block, the probability that the block validated by the honest miners is mined on a fork created by the stubborn miner is . So, by Lemma B.1 from Appendix B,

Therefore, we have

Theorem 4.6.

The revenue ratio of the “Equal Fork Stubborn mining” strategy is

Proof.

Use Lemma 4.2 and Proposition 4.5. ∎

4.3. Difficulty adjustment.

Proposition 4.7.

The parameter updating the difficulty is

Proof.

At the end of an attack cycle, the number of new blocks in the official blockchain is and . Therefore we have

4.4. Apparent hashrate after a difficulty adjustment.

It’s now easy to get the long term apparent hashrate of the EFSM strategy.

Corollary 4.8.

After a difficulty adjustment, the apparent hashrate is

Proof.

Use Theorem 2.1 and Proposition 4.7. ∎

5. Comparison of strategies.

For different values of the parameters and , we can compare the profitability of the different strategies after a difficulty adjustment by comparing the revenue ratios after a difficulty adjustment, or, equivalently, their apparent hashrate.

We consider the four strategies:

  • Honest Mining (HM).

  • Selfish Mining (SM).

  • Lead-Stubborn Mining (LSM).

  • Equal Fork Stubborn mining (EFSM).

We color the region according to which strategy is more profitable, and we obtain Figure 1.

Figure 1. Profitability. From left to right: HM, SM, LSM, EFSM.

From left to right, the best strategy is successively HM, SM, LSM and EFSM. Note that, the LSM strategy is superior only on a thin domain.

A similar picture is numerically computed by Montecarlo simulations in [7] where only a numerical study is carried out. See Figure 2 (disregard regions R4 to R7 that correspond to “Trail Stubborn Mining” strategies that are studied in [4]).

Figure 2. Figure from [7].

Regions R1, R2 and R3 correspond respectively to HM, SM and EFSM. We notice the absence of the region corresponding to LSM in between R2 and R3. Apparently the numerical methods did not detect it (also it is noticeable how in their figure the boundary between R2 and R3 is more blurred than other boundaries, as for example the one separating R1 and R2).

Appendix A Catalan distributions.

For , we denote by the -th Catalan number

We refer to [5] for background and combinatorial properties of Catalan numbers. Their generating series is

Observe that and , which justifies the following definition:

Definition A.1 (Catalan distributions).

Let and . A random variable taking values in is a -Catalan random variable if it follows the -Catalan distribution, that is, for

The second type -Catalan distribution is defined by and for ,

Proposition A.2.

The expected value of a -Catalan random variable is

If is a second type -Catalan random variable then

Lemma A.3.

We have

Proof of the Lemma.

We have and the result follows. ∎

Proof of the Proposition.

For the -Catalan random variable we have

For the second type -Catalan random variable we have

The main geometric combinatorial property of Catalan numbers used in this article is the following well known enumeration (see section 9 of [5] p.259)

Proposition A.4.

The number of paths in going up and right at each step that start at and end-up at without touching the first diagonal is .

Appendix B Biased coin tossing.

The following lemma is useful for both LSM and EFSM strategies.

Lemma B.1.

Let and . Let denotes the outcome of tossing a biased coin times with for . Let . Then we have .

Proof.

Note that where is the number of trials (stopping time) before getting ”Heads” when a coin is flipped repeatedly with a probability of getting ”Heads” each time. We have

Appendix C Poisson Games.

Theorem C.1.

Let (resp. ) be a Poisson process with parameter (resp. ). Let be the stopping time defined by . If then and .

Proof.

The proof is similar to the proof of Theorem 4.4 from [2]. For , the stopping time is bounded. So, by applying Doob’s Theorem ([9]) to the martingales and , we get

So we have and

Therefore,

Making , by monotone convergence we have and . Moreover, using Doob’s Theorem again, we have for ,