# On Profitability of Trailing Mining

We compute the revenue ratio of the Trail Stubborn mining strategy in the Bitcoin network and compare its profitability to other block-withholding strategies. We use for this martingale techniques and a classical analysis of the hiker problem. In this strategy the attacker could find himself mining in a shorter fork, but we prove that for some parameter values it is still profitable to not give up. This confirms previous numerical studies.

## Authors

• 9 publications
• 9 publications
• ### On profitability of stubborn mining

We compute and compare profitabilities of stubborn mining strategies tha...
08/02/2018 ∙ by Cyril Grunspan, et al. ∙ 0

• ### Profit lag and alternate network mining

For a mining strategy we define the notion of "profit lag" as the minimu...
10/06/2020 ∙ by Cyril Grunspan, et al. ∙ 0

• ### On the Preliminary Investigation of Selfish Mining Strategy with Multiple Selfish Miners

Eyal and Sirer's selfish mining strategy has demonstrated that Bitcoin s...
02/06/2018 ∙ by Tin Leelavimolsilp, et al. ∙ 0

• ### Valuation of Crypto-Currency Mining Operations

Traditionally, the Net Present Value method is used to compare diverging...
02/04/2018 ∙ by J. Berengueres, et al. ∙ 0

• ### Bitcoin Selfish Mining and Dyck Words

We give a straightforward proof for the formula giving the long-term app...
02/05/2019 ∙ by Cyril Grunspan, et al. ∙ 0

• ### When Blockchain Meets AI: Optimal Mining Strategy Achieved By Machine Learning

This work applies reinforcement learning (RL) from the AI machine learni...
11/29/2019 ∙ by Taotao Wang, et al. ∙ 0

• ### On the insecurity of quantum Bitcoin mining

04/22/2018 ∙ by Or Sattath, et al. ∙ 0

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1. Introduction

In our previous article [4] we gave a rigorous foundation for the profitability of alternative mining strategies in the Bitcoin network [7]. As for games with repetition, it depends on the proper analysis of the revenue and the duration over attack cycles. More precisely, the expected revenue and expected duration over an attack cycle give the “Revenue Ratio”

 Γ=E[R]E[τ]

This is the correct benchmark for the profitability of the strategy.

This analysis was also carried out previously by the authors in [4] to the “Selfish Mining” (SM) strategy from [1] and in [5] to “Lead-Stubborn Mining” (LSM) and “Equal Fork Stubborn Mining” (EFSM) strategies from [8]. In these articles we found for these strategies the exact mathematical formula for the revenue ratios and we compared its profitability in parameter space.

The main technique for these derivations is the application of martingale techniques introduced in [4] that yield, using Doob’s Stopping Time Theorem, the expected duration of the attack cycles. We assume in the computation of the Revenue Ratio that there is no difficulty adjustment inside the attack cycles, or that is much shorter than the period of difficulty adjustment so that its effect in the cycles can be neglected. But, as we proved in [4], the effect of these attacks is to slow down the network, and it is only after a difficulty adjustment that these “block withholding strategies” can become profitable. Then the profitability can also be read on the apparent hashrate. So these rogue strategies are an exploit on the difficulty adjustment formula and we gave in [4] an improvement proposal of the Bitcoin protocol to fix the difficulty adjustment formula.

In this article we apply again these new techniques to another block withholding strategy: The “Trail-Stubborn Mining” strategy from [8]. In this strategy, the block withholder miner does not give up when the honest chain takes over some block advantage, but instead keeps mining on top of his secret chain and only gives up if the advantage of the honest chain reaches blocks. We talk about “-Trail-Stubborn Mining” strategy or in short.

We denote by be the block reward, and the average inter-block validation time for the total network (around minutes for the Bitcoin network). We denote by (resp. ) the relative hashing power of the attacker (resp. honest miners) and . Let be the fraction of the honest network that the attacker attracts to mine on top of his fork. For a miner that after a difficulty adjustment has a Revenue Ratio we define his apparent hashrate by

 ~q=~Γ⋅τ0b .

The apparent hashrate of a miner can also be defined after a difficulty adjustment as the average proportion of blocks mined by the miner in the official blockchain. Our main Theorem is:

###### Theorem 1 (A-Trail-Stubborn mining).

Let . The revenue ratio of the “-Trail-Stubborn mining” strategy is

 Γ=q+(1−γ)pq(p−q)(p+pq−q2)[A+1](([A−1]+1pPA(λ)[A+1])λ2−2√1−4(1−γ)pq+p−q)1+(1−γ)pqp+pq−q2(A+1)([2][A+1]−2A+1)bτ0

where for , and .

After a difficulty adjustment, the apparent hashrate of the stubborn miner is

 ~q=q+(1−γ)pq(p−q)(p+pq−q2)[A+1](([A−1]+1pPA(λ)[A+1])λ2−2√1−4(1−γ)pq+p−q)p+pq−qp+pq−q2+(1−γ)pqp+pq−q2(A+λ)(1[A+1]−1A+λ)

The polynomial vanish at , as well as its two first derivatives, hence is a polynomial in . Making in Theorem 1 we get Theorem 1 of [5] as a particular case. Indeed, we have , i.e. -Trail-Stubborn Mining and Lead-Stubborn Mining strategies are the same. Before proving Theorem 1 we need to study a classical refinement of the Gambler’s Ruin Problem: The hiker problem.

## 2. The hiker problem.

We consider a hiker on with , . His position is denoted by the random process

. The transition probability from

to are

 P(i,j)=P[Xn+1=j|Xn=i]=p1i=j−1+q1i=j+1

for . It is independent of . We make the assumption that and are absorbing boundaries: . The problem is studied in [2] where it is proved that with probability the hiker exits . We need more precise information.

###### Definition 2.1.

For and , let be the stopping time defined by

 νm,k=inf{n;Xn=k|X0=m}

We denote , i.e. is the stopping time for exiting starting from . From [2], we have almost surely. The condition is equivalent to the realization of the event “the hiker exits at ”.

###### Theorem 2.2.

We have:

 E[νm] =Mp−q⋅(1−λm1−λM−mM) P[νm=νm,0] =λm−λM1−λM E[νm|νm=νm,0] =mλm−(2M−m)λM+(2M−m)λM+m−mλ2Mp(1−λ)(λm−λM)(1−λM)

The first two equations are well known classical results that can be found in [2] p. and p.. The last equation is from [10] and is not so classical and, to be self-contained, we give another proof in Appendix B.

We have .

###### Definition 2.4.

We denote by (resp. ) the number of steps to the left (resp. right) realized by the hiker between and .

In other terms, and for

 L(n) =L(n−1)+1X(n)=X(n−1)−1 R(n) =R(n−1)+1X(n)=X(n−1)+1

Note that for .

###### Corollary 2.5.

We have

 E[L(νm)|νm=νm,0] =m2+mλm−(2M−m)λM+(2M−m)λM+m−mλ2M2p(1−λ)(λm−λM)(1−λM) E[R(νm)|νm=νm,M] =M−m2+mλm−(2M−m)λM+(2M−m)λM+m−mλ2M2p(1−λ)(λm−λM)(1−λM)
###### Proof.

If the hiker exits at 1 (resp. ), then (resp. ). So we have

 E[L(νm)|νm=νm,0] =m2+E[νm|νm=νm,0]2 E[L(νm)|νm=νm,M] =M−m2+E[νm|νm=νm,0]2

and the result follows from Theorem 2.2. ∎

In particular, for this gives:

 (1) E[L(ν2)|ν2=ν2,0]=1+1p.1−(M−1)λM−2+(M−1)λM−λ2M−2(1−λ)(1−λM−2)(1−λM)

## 3. Expected duration of the Trail-Stubborn Mining Strategy

### 3.1. Notations and previous results.

We set, and  . We note and the two independent Poisson processes with parameters and representing the number of blocks validated by the honest miners and the rogue miner. We denote by (resp. ) the inter-block validation time for the honest miners (resp. attackers).

We use some notations from [4]. In particular, for the stopping times:

 (2) τ=inf{t≥T1;N(t)=N′(t)+1T1

and

 (3) τLSM=τ+(TN(τ)+1∧T′N(τ)+1)⋅1T′1≤T1

We proved in [4] that

 (4) E[τ]=pp−qτ0,E[τLSM]=(pp−q+q)τ0,andE[N′(τ)]=α′E[τ]=pqp−q

More precisely, for , we have

 (5) P[N′(τ)=n]=Cn−1(pq)n

where denotes the -th Catalan number, whose generating series is .

At the end of an attack cycle, the revenue of a miner following the Lead Stubborn Mining strategy is denoted by .

### 3.2. Description of the A-Trail-Stubborn mining strategy

At the beginning of an attack cycle both, the rogue miner and the honest miners start mining on top of the same common block. Then, either the first block is discovered by the honest miners, and the attack cycle ends, or the attacker is the first one validating a block. Then, he keeps mining secretly until he is being caught up by the honest miners. During this period, each time the honest miners publish a new block, the rogue miner broadcasts the part of his fork sharing the same height. Once he has been caught up, there is a “decisive competition” to decide which fork prevails. In this competition, the rogue miner does not withold his block. There are two cases depending on who the winner is. Either the new block is mined on top of a block validated by the rogue miner (by himself or by a fraction of the honest miners) and then the attack cycle ends immediatly. Otherwise, the attacker has a fork which is one block behind the official blockchain. We call this event . His delay is defined as the difference between the height of the official blockchain and his fork. Then, he keeps mining until his delay exceeds a fixed threeshold , or ends up leading the official blockchain by one block. Then, in both cases, the cycle attack ends. The trailing mining strategy is a repetition of these attack cycles.

### 3.3. Stopping time

We denote by the stopping time of an attack cycle corresponding to the Trail-Stubborn mining strategy (TSM). At the end of an attack cycle the revenue of a rogue miner following TSM is denoted by . Note that when , there is a “decisive round” which starts at and ends at . So, and from to the two strategies and are the same.

### 3.4. Blocks of the rogue miner in the official blockchain

For , we denote by the number of blocks mined by a miner following the Trail-Stubborn Mining strategy at -time and present in the official blockchain. We have that is non-decreasing. Before , the two strategies “Trail-Stubborn Mining Strategy” and“Lead Stubborn Mining Strategy” are the same. So, by [5] we know that

 (6) E[Z(τ)|N′(τ)=n]=n−1−(1−γ)nγ
###### Lemma 3.1.

The following conditions are equivalent to :

1. [label=() ]

2. ;

3. ;

4. (the -th honest block is found on top of a block mined by a honest miner).

If one of these conditions is satisfied then , and . We have that is -measurable and .

###### Proof.

If (i) holds then otherwise . Moreover, at , at least one block mined by the rogue miner has not been recognized by the official blockchain (otherwise, the cycle ends at and ). So, . If (ii) is true then . So, the miner has at least mined a block during the attack cycle. So, (otherwise as before and )). Moreover, the rogue miner has lost the “decisive competition”. Otherwise, we have . Also, by the same argument, the block found by the honest miners during this round cannot have been validated on top of a block mined by the rogue miner. So, we get (iii). Finally, if (iii) holds, then the rogue miner has lost the “decisive competition”. Hence, by definition of an attack cycle and so (i), (ii) and (iii) are equivalent. Also, if one of these conditions is satisfied, then the rogue miner did not mine a block during the period whereas the honest miner has found exactly one. So, and . Moreover the block found by the honest miners has been found on top of an honest block by (iii). So we have, . By (ii), is -measurable. Moreover, the condition occurs with probability and the two last conditions of (iii) occur with probability . Therefore, we have . ∎

### 3.5. Trail-mining.

We consider that after a possible second phase of the attack cycle (after ), the rogue miner following will give up if his delay exceeds with . Note that at the beginning of this second phase, the delay of the miner is . So, . Note also that in order to win, it is not enough for the miner to catch-up the official blockchain. He needs to lead it by block. So, his delay is in between and . Therefore, he behaves as the hiker studied in Section 2 with delay and .

###### Proposition 3.2.

We have

 ξ=τLSM+σ.1Σ

where is the stopping time defined by

 σ=inf{t∈R∗+;(~N′(t)=~N(t)+2)∨(~N(t)=~N′(t)+A−1)}

with and .

In particular, we have that and are two independent Poisson processes with respective parameters and , and is independent with .

###### Proof.

The stopping time of the Trail-Stubborn Mining Strategy is the same as the stopping time of the Lead Stubborn Mining strategy studied in [5] except when the stubborn miner has been first mining a block, then has been caught-up by the honest miners, and at has lost the final “competition” (when a fraction of the honest miners finds a new block on top of a honest block). We have called this event. If it occurs, then the stubborn miner keeps on mining until he catches up the honest miners or his delay becomes too big. In this case, he needs to catch-up the honest miners and also lead the official blockchain by . The start time of this possible second round is with and the miner will stop at with or . The first equality is equivalent to and the second is equivalent to . Moreover, by the strong Markov property is independent with . So, by Lemma 3.1, it is also independent with . ∎

Note that the condition is equivalent to with . So we have that the miner is a hiker on as studied in section 2 starting from with . In Appendix A we prove the following Proposition:

###### Proposition 3.3.

We have

 E[σ]=A+1p−q(1−λ21−λA+1−2A+1)τ0
###### Proposition 3.4.

We have

 E[ξ]τ0=pp−q+q+(A+1)⋅(1−γ)pqp−q⋅(1−λ21−λA+1−2A+1)
###### Proof.

By Proposition 3.2, we have

 E[ξ] = E[τLSM]+P[Σ]⋅E[σ]

So, we get the result using (4), Lemma 3.1 and Proposition 3.3. ∎

## 4. Revenue ratio of the Trail-Stubborn Mining Strategy

###### Proposition 4.1.

We have:

 R(ξ)=R(τLSM)⋅1ξ=τLSM+(N′(τ)+L(ν2))b⋅1(ξ>τLSM)∧(ν2=ν2,0)+Z(τ)b⋅1(ξ>τLSM)∧(ν2=ν2,A+1)

In this Proposition is the number of blocks validated by the rogue miner during the second phase of the strategy. The event (resp. ) means that the cycle is made of two distinct phases: in the first one the rogue miner looses the first phase of the attack, and in the second one he wins (resp. looses) the second phase.

###### Proof.

If , then the miner tries to catch-up the official blockchain. He is in the position of a hiker starting from and winning when . Each move to the left (towards ) corresponds to a new block mined by the stubborn miner. So, if he succeeds (case ), then he earns a reward . If he fails (case ) then he earns only and the attack cycle ends. Otherwise, the strategy ends at and . The result then follows from Lemma 3.1. ∎

Now we compute the expected revenue of the -Trail-Stubborn Mining Strategy in an attack cycle.

###### Proposition 4.2.

We have

 E[R(ξ)]b=(p+pq−q2p−q)q+(1−γ)pq⋅ ⋅[(1+1p⋅1−AλA−1+AλA+1−λ2A(1−λ)(1−λA−1)(1−λA+1))λ2−λA+11−λA+1−2p√1−4(1−γ)pq+p−q1−λ21−λA+1]
###### Proof.

Consider the events, for , , and . From [4] and [5] we have

 P[En] =p1n=0+(pq)nCn−11n>0 P[G] =λ2−λA+11−λA+1

and for ,

 P[En∩F]=P[En](q+γp)

Note also that

• If occurs then .

• If occurs (with ) then with probability and with probability .

• If occurs then .

• If occurs then .

So, by conditioning on and using (6) and Corollary 2.5 together with we have:

 E[R(ξ)]b =0⋅P[E0]+∑n>0((n+1)q+nγp)P[En] +∑n>0(n−1−(1−γ)nγ)(1−γ)p1−λ21−λA+1P[En] +∑n>0(n+E[L(ν2)|ν2=ν2,0])(1−γ)pλ2−λA+11−λA+1P[En] =E[N′(τ)]+(1−γ)pγ1−λ21−λA+1(1−γ)pqC((1−γ)pq) +(q−(1−γ)pγ1−λ21−λA+1+(1−γ)pE[L(ν2)|ν2=ν2,0]λ2−λA+11−λA+1)(1−P[E0]) =(pp−q+q)q−(1−γ)pq1−λ21−λA+1[1−(1−γ)pC((1−γ)pq)]γ +(1−γ)pqE[L(ν2)|ν2=ν2,0]λ2−λA+11−λA+1

Moreover for , we have

 1−(1−γ)pC((1−γ)pq) =1−1−√1−4(1−γ)pq2q =√1−4(1−γ)pq−(p−q)2q =1−4pq+4γpq−(p2−2pq+q2)2q[√1−4(1−γ)pq+p−q] =2pγ√1−4(1−γ)pq+p−q

and we get the result using (1). ∎

Proposition 3.4 and Proposition 4.2 give the revenue ratio of the strategy and the first part of Theorem 1.

###### Proposition 5.1.

We have

 E[N(ξ)∨N′(ξ)]=pq+p−qp−q+(1−γ)pqp−q((Ap+q)1−λ21−λA+1−1)
###### Proof.

We keep the same notations as in the proof of Proposition 4.2. Note that

• If occurs, then .

• If occurs (), then .

• If occurs (), then .

• If occurs (), then .

So, by conditioning as before and using Corollary 2.5, we get

 E[N(ξ)∨N′(ξ)] =1⋅P[E0]+∑n>0(n+1)(q+γp)P[En] +∑n>0(n+1+12E[ν2|ν2=ν2,0])(1−γ)pP[En]P[ν2=ν2,0] +∑n>0(n+1+A+12−1+12E[ν2|ν2=ν2,A+1])(1−γ)pP[En]P[ν2=ν2,A+1] =P[E0]+∑n>0(n+1)P[En]+∑n>0(A+12−1)(1−γ)pP[En]P[ν2=ν2,A+1] +∑n>0(1−γ)pP[En]E[ν2]2 =E[N′(τ)]+1+(1−γ)pq((A+12−1)P[ν2=ν2,A+1]+E[ν2]2) =pq+p−qp−q+(1−γ)pqp−q((Ap+q)P[ν2=ν2,A+1]−1)

###### Theorem 5.2.

The parameter updating the difficulty of the -trail stubborn mining strategy is given by

 δ=p+pq−q2p−q+(A+1)⋅(1−γ)pqp−q⋅(1−λ21−λA+1−2A+1)pq+p−qp−q+(1−γ)pqp−q((Ap+q)1−λ21−λA+1−1)
###### Proof.

From [4] we have that . ∎

### 5.1. Observations

We denote by the long-term apparent hashrate of the -Trail-Stubborn-mining strategy. As we have already observed, the lead-stubborn mining strategy LSM is a particular case of the -Trail-Stubborn-mining strategy with (in tis case, there is no possible second phase of the attack after ). We note that Theorem 1 yields one of the results of [5]: if we choose in Theorem 1, we get Theorem 1 of [5]. In Figure 1 below, we compare (the long-term apparent hashrate of the strategy LSM) with . Depending on , this shows when a second phase of the attack increases the efficiency of the strategy LSM. In general, when is small, TSM is an amelioration of LSM.

For greater than , TSM with dominates all other trailing strategies whatever is. See Figure 2.

Also, if , then

On the other hand, when , the apparent hashrate after a difficulty adjustment for the selfish mining strategy is . It turns out that for ,

 limq→12˜qTSM=1−1A+1<1=limq→12˜qSM

Hence, when and , SM dominates all TSM strategies.

## 6. Mixed strategies.

### 6.1. Weight of a mining strategy

We consider a miner mining according to a strategy .

###### Definition 6.1.

The weight of a mining strategy is the average number of official blocks mined during an attack cycle. It is denoted by the greek letter .

Note that if the strategy leads to a difficulty adjustment , then we have: .

### 6.2. Apparent hashrate of a mixed strategy

We consider now a miner implementing a mixed strategy. He starts mining according to strategy 1, then at the end of an attack cycle, he decides to follow another strategy 2, and so on until he comes back to strategy 1 after implementing of different strategies. Thus the attack cycle is a given pattern of attack cycles of different strategies.

We denote by the revenue ratio, revenue, duration time, long-term apparent hashrate, difficulty adjustment and weight over an attack cycle of strategy . We denote by and , the revenue ratio, revenue, duration time, long-term apparent hashrate, difficulty adjustment and weight after an attack cycle of the mixed strategy.

###### Theorem 6.2.

We have that is barycenter of weighted by .

###### Proof.

The number of official blocks mined after a whole attack cycle of the mixed strategy is . Moreover, . Therefore,

 D=n∑i=0E[τi]τ0DiμDi=n∑i=0μiμDi

Similarly, we have

 ~Γ =ΓD=E[R]E[τ]D=∑ni=1E[Ri]E[τ]D=1μn∑i=1E[Ri] =1μn∑i=1ΓiE[τi]=1μn∑i=1~ΓiE[τi]Di=1μn∑i=1μi~Γi

###### Corollary 6.3.

We have with equality if and only if the strategy is not mixed.

Therefore, there is no advantage in implementing mixed strategies.

## 7. Comparison with other strategies

We compare Trailing-Stubborn Mining strategies with and other strategies HM, SM, LSM and EFSM studied in [5]. We observe that LSM is the dominant strategy in a very thin region between SM, EFSM and TSM2. Below to the right (but for not too small), the dominant strategy is TSM3. The strategy TSM4 is dominant in a very little domain with and %. For less than 5% and large (but less than ), SM is the dominant strategy confirming the observation at the end of section 5.

## Appendix A Poisson processes and random walk.

Let and be two independent Poisson processes with parameters and starting at : . For , with , let

 ¯Sn =inf{t∈R+;N(t