Source-linked AI summary
Majority is not Enough: Bitcoin Mining is Vulnerable
Ittay Eyal, Emin Gun Sirer
TL;DR
The paper challenges Bitcoin’s assumption that mining is incentive-compatible and secure against colluding minorities. It introduces and analyzes Selfish-Mine, showing that excess revenue can attract rational miners and threaten decentralization, then proposes a backward-compatible protocol modification.
Problem
Bitcoin requires miners to follow its protocol honestly, but colluding miners who gain a majority can control the currency and undermine its decentralization.
Method
The paper introduces Selfish-Mine, analyzes when it benefits a mining pool and how majority pools can form, and proposes a backward-compatible progressive protocol modification.
Results
Selfish mining lets colluding pools earn revenue exceeding their mining power, with the current effective threshold close to zero; the proposed modification raises the threshold to 1/4.
Takeaways & Limitations
Higher selfish-mining revenues can drive rational miners to join the pool, potentially causing it to become a majority and collapsing Bitcoin’s decentralized currency.
Takeaways & Limitations
The proposed 25% threshold does not eliminate the practical risk because existing pools already exceed 25% and sometimes even the 33% theoretical limit.
Abstract
from arXiv · showhide
The Bitcoin cryptocurrency records its transactions in a public log called the blockchain. Its security rests critically on the distributed protocol that maintains the blockchain, run by participants called miners. Conventional wisdom asserts that the protocol is incentive-compatible and secure against colluding minority groups, i.e., it incentivizes miners to follow the protocol as prescribed. We show that the Bitcoin protocol is not incentive-compatible. We present an attack with which colluding miners obtain a revenue larger than their fair share. This attack can have significant consequences for Bitcoin: Rational miners will prefer to join the selfish miners, and the colluding group will increase in size until it becomes a majority. At this point, the Bitcoin system ceases to be a decentralized currency. Selfish mining is feasible for any group size of colluding miners. We propose a practical modification to the Bitcoin protocol that protects against selfish mining pools that command less than 1/4 of the resources. This threshold is lower than the wrongly assumed 1/2 bound, but better than the current reality where a group of any size can compromise the system.
1 Introduction
Bitcoin relies on miners to maintain a public transaction blockchain, but the paper shows that rational minority pools can profit by deviating from the prescribed protocol. Selfish mining can therefore drive pool growth toward majority control, while a protocol modification raises the protection threshold to 1/4.
- Motivation: Bitcoin miners maintain the public blockchain by solving cryptographic puzzles, recording transactions, and receiving rewards proportional to their mining opportunities.The reward structure is intended to incentivize resource contribution and preserve decentralization.
- Motivation: The protocol requires honest miners and becomes controlled by a colluding group once that group commands a majority of mining power.Such control can allow the group to prohibit selected transactions or all transactions.
- Contribution: The paper shows that a minority pool can use Selfish Mining to obtain revenue exceeding its fair share, disproving incentive compatibility.The strategy keeps discovered blocks private and reveals them strategically to create a private fork.
- Consequences: Selfish Mining makes honest miners waste proportionally more resources, giving the selfish pool a competitive advantage that can attract rational miners.The resulting incentive favors joining the selfish pool rather than remaining in honest pools.
- Consequences: Above a threshold, selfish-pool revenue rises superlinearly with pool size, potentially driving the pool to majority control and collapsing decentralization.The paper identifies majority-pool formation as a consequence of the revenue advantage.
- Contribution: 33% is the protocol’s upper-bound threshold for safety, while the proposed backwards-compatible modification raises the threshold to 1/4.Partial adoption provides proportional benefits and does not require full client adoption.
2 Preliminaries
Bitcoin records ownership-changing transactions in a blockchain of linked blocks, and miners compete to append valid blocks by solving cryptographic puzzles. The protocol resolves competing branches by selecting the longest chain, while mining pools reduce individual income variance.
- Blockchain: The blockchain is a global append-only log that records transactions and determines Bitcoin ownership from the accumulated transaction history.Transactions are accepted only when the source address has sufficient balance.
- Blockchain: Each block links to its predecessor and contains transactions plus a cryptopuzzle solution tied to the previous block and a reward address.The genesis block is defined by the protocol.
- Mining: Bitcoin mining uses a double-hash puzzle whose difficulty is adjusted so blocks are generated at an average rate of one every ten minutes.The probability of solving a block is proportional to the computational resources used.
- Fork resolution: When miners create competing blocks, the protocol directs them to mine on the longest chain, pruning the other branch and ignoring transactions in pruned blocks.Equal-length branches are resolved using the first branch heard by the miner.
- Fork resolution: Block dissemination takes seconds while average mining intervals last ten minutes, so accidental bifurcations occur only about once every 60 blocks.The timing difference makes ordinary forks relatively rare.
- Pool formation: Mining rewards include transaction fees and newly created Bitcoins, but individual mining outcomes have high variance because block discovery is probabilistic.This variance makes a single home miner unlikely to mine a block for years.
3 The Selfish-Mine Strategy
Selfish-Mine models a rational mining pool that withholds blocks, privately extends a fork, and reveals blocks selectively. The strategy aims to make honest miners work on stale blocks and can yield revenue above the pool’s mining-power share.
- Model: The paper models miners with normalized mining powers who choose chain heads and discover blocks after exponentially distributed intervals.Mining power determines the expected block-finding rate.
- Model: Miners are assumed rational and may deviate from the protocol to maximize revenue, while a pool acts as one coordinated agent.Pool revenue is its expected fraction of blocks in the longest chain.
- Selfish-Mine: Selfish-Mine keeps a pool’s discovered blocks private, creating a secret branch while honest miners continue mining on the shorter public branch.The strategy is driven by the relative lengths of the private and public branches.
- Selfish-Mine: The strategy forces honest miners to spend computational effort on blocks destined to become stale rather than part of the blockchain.Selective block revelation is used to invalidate honest miners’ work.
- Algorithm: The strategy’s algorithm branches on mining events and on the relative lengths of private and public chains, including tie and lead-handling cases.The illustrated cases include publishing the last private block at equal length and publishing the full private chain when ahead by one.
- Selfish-Mine: When the private branch gains a lead, the pool continues mining privately and publishes blocks selectively as the public branch approaches it.A lead of two blocks provides cushion; when the lead falls to one, the pool publishes its private branch.
4 Analysis
The analysis models Selfish-Mine as a state machine tracking the selfish pool’s private lead, then computes state probabilities, transition revenues, and pool revenue. The analysis and simulation show that selfish mining can outperform honest mining above a γ-dependent threshold.
- State model: The state machine represents the difference between unpublished private blocks and the public branch, with transition frequencies α and 1−α.State 0′ represents two public branches of length one after the selfish pool publishes a matching private branch.
- Revenue calculation: Revenue is counted only for blocks that ultimately enter the main chain, using state probabilities and transition-specific rewards.Intentional forks can make honest miners’ blocks fall outside the blockchain, so actual revenue is measured as each party’s fraction of main-chain blocks.
- Transition rewards: When the lead is two and others find a block, the pool publishes its private branch and obtains revenue of two.When the lead exceeds two, the pool can reveal the corresponding private block while the competing honest block receives no revenue.
- Simulation: The simulator uses 1000 miners, with 1000α selfish miners, to compare Selfish-Mine against honest mining while varying propagation conditions.The simulation replaces cryptopuzzle solving with Monte Carlo block discovery and compares its results with the theoretical analysis.
- Threshold analysis: For γ = 1, selfish mining is always superior; for γ = 0, its threshold is 1/3, while γ = 1/2 yields a threshold of 1/4.The threshold is the minimum pool power at which selfish mining earns more than the pool’s relative mining power.
- Threshold analysis: Above the threshold, pool revenue increases with pool size, so each member’s revenue also increases as the pool grows.The paper expresses this as a revenue slope larger than one above the threshold.
5 Pool Formation
Once a selfish pool exceeds the revenue threshold, miners have incentives to join it and existing members have incentives to accept them. The pool can consequently grow until it becomes a majority, eliminating Bitcoin’s decentralization.
- Pool growth: Above the threshold, rational miners preferentially join the selfish pool because it offers higher revenue.Existing members also benefit from accepting new members, reinforcing the pool’s growth.
- Majority control: The selfish pool can grow unopposed until it becomes a majority and controls the blockchain.After reaching a majority, it can collect all system revenue by following the prescribed protocol and ignoring blocks generated outside the pool.
- Majority control: At majority size, Selfish-Mine is unnecessary because other miners are no longer faster than the pool.The resulting currency is no longer decentralized as originally envisioned.
6 Fixing the Bitcoin Protocol
The current protocol allows selfish-mining thresholds near zero because miners can manipulate propagation, so pools of any size may benefit. A backward-compatible rule that propagates and randomly selects among equal-length branches raises the threshold to 1/4.
- 6 Fixing the Bitcoin Protocol: The current Bitcoin protocol has γ →1, producing a selfish-mining threshold of almost zero.A pool of any size can benefit by running Selfish-Mine.
- 6.1 Problem: When equal-length branches appear, miners currently mine and propagate only the first branch received, favoring whichever branch arrives first.A selfish pool publishes its secret block when it hears a competing honest block.
- 6.1 Problem: Virtual miners can slow honest-block propagation and let a pool achieve γ close to 1, yielding a threshold close to zero.The virtual miners disseminate information without mining new blocks.
- 6.2 Solution: The proposed change requires miners to propagate all equal-length branches and choose one uniformly at random.For two branches of length 1, half the nodes are expected to mine on each branch, setting γ = 1/2 and the threshold to 1/4.
- 6.2 Solution: The modification is backward compatible and does not require a hard fork because its improvement is independent of adoption by other miners.Each implementing miner reduces the selfish pool’s ability to increase γ through propagation control.
7 Related Work
Related work distinguishes this attack from earlier cryptocurrencies, transaction-dissemination incentives, client-behavior analysis, and other Bitcoin incidents. The authors state that their results apply to mining-based global-log cryptocurrencies.
- 7 Related Work: Earlier decentralized digital currencies did not center on a global log, so their techniques and challenges are unrelated to this work.
- 7 Related Work: The authors state that their results apply to cryptocurrencies using mining to maintain a global log, including Litecoin.Several dozen cryptocurrencies followed Bitcoin’s success.
- 7 Related Work: Prior work on transaction dissemination addresses miners’ preference to collect transaction fees, unlike this paper’s mining incentive mechanism.
- 7 Related Work: A prior survey identifies incentive compatibility as critical and describes a possible path to majority control; this paper demonstrates an imminent Bitcoin vulnerability.
- 7 Related Work: Studies of Bitcoin client behavior and transaction graphs are not directly related to the selfish-mining analysis.
- 7 Related Work: The March 2013 bug-induced blockchain bifurcation and its manual resolution differ fundamentally from the intentional forks exploited by Selfish-Mine.
- 7 Related Work: Block withholding reduces a pool’s revenue by hiding blocks and is unrelated to Selfish-Mine, which attacks the system through the pool’s strategy.
- 7 Related Work: Services built on Bitcoin’s global log, including anonymity, namespace, and notary services, are at risk if Bitcoin collapses.
8 Discussion
The discussion defines collapse as single-entity control and examines limits of the proposed defense, altruistic miners, detection, and infiltration. The authors warn that existing pools may already exceed the repaired threshold, enabling rapid growth toward collapse.
- 8 Discussion: A Bitcoin-system collapse is defined as a state in which a single entity controls the entire currency system.
- 8 Discussion: Collapse does not immediately imply that Bitcoin’s value drops to 0, but the behavior of a Bitcoin monopolist remains outside the paper’s scope.The authors believe single-entity control may deter many clients.
- Altruistic Agents: Altruistic miners may refuse Selfish-Mine regardless of compensation.Their presence may deter attacks if enough remain outside selfish pools to keep them below threshold.
- Naive Lines of Defense: Selfish-Mine behavior is difficult to detect because pools can hide their identity and adapt to public detection parameters.
- 8 Discussion: Infiltration defenses are weakened because pool managers can selectively reveal blocks and expel members who leak information.
- Imminent danger: The Bitcoin system is immune to Selfish-Mine only when no pool exceeds the threshold, which the current near-zero threshold fails to ensure.
- 8 Discussion: Pools already exceeding the proposed 25% threshold, and sometimes the 33% theoretical hard limit, constrain the fix’s practical protection.
- 8 Discussion: Once a pool exceeds the threshold, rational miners may join it, producing a phase transition that leads to system collapse.
9 Conclusion
The paper concludes that Bitcoin mining is not incentive-compatible: Selfish-Mine lets colluding pools exceed their mining-power share, potentially drawing rational miners into a centralized takeover. A backward-compatible modification raises the effective threshold to 1/4.
- 9 Conclusion: Selfish-Mine enables colluding pools to earn revenues exceeding their mining power, exposing Bitcoin’s ecosystem to manipulation and potential takeover.
- 9 Conclusion: Higher selfish-mining revenues can attract rational miners, causing pool growth and potentially collapsing the decentralized currency.
- 9 Conclusion: The current Bitcoin system has a selfish-mining threshold close to zero, while the proposed backward-compatible modification raises it to 1/4.
A Probability Calculation
The analysis models the system as a state machine and derives state probabilities by relating the states through equations. It then expresses all probabilities in terms of p1 to obtain the remaining values.
- A Probability Calculation: The state machine's analysis cuts define equations for the probabilities of its different states.Figure 4 provides the state-machine structure and analysis cuts used in the derivation.
- A Probability Calculation: The derivation uses Equations 11 and 12 as intermediate relations in the probability calculation.
- A Probability Calculation: Substituting p2 into Equation 10 yields Equation 16, relating p0 and p1.
- A Probability Calculation: Equations 13, 15, and 16 express every state probability in Equation 14 as a function of p1.This produces p1 and therefore the other state probabilities.