Source-linked AI summary
On Subversive Miner Strategies and Block Withholding Attack in Bitcoin Digital Currency
Nicolas T. Courtois, Lear Bahack
TL;DR
The paper investigates whether miners can increase revenue through subversive strategies that exploit Bitcoin’s reliance on miners and pools. It analyzes several attacks and proposes a practical block-withholding attack, reporting superior gains and substantial tolerance before detection. The paper also identifies trust in pool participants and pool size as important boundaries for defense.
Problem
Bitcoin relies on miners to validate transactions and create coins, yet not every rogue behavior is detectable and miner incentives may encourage subversive strategies.
Method
The paper analyzes miner strategies and historical wasted blocks, then describes and analyzes a new practical block-withholding attack generalized from the Sabotage attack.
Results
The proposed block-withholding strategy achieves superior gains for subversive miners and can tolerate up to 20% participation without detection by small pools or individual miners.
Takeaways & Limitations
Block-withholding attacks are difficult to avoid without trusting pool participants, motivating personally trusted pool membership and smaller pools as the paper’s identified defense direction.
Takeaways & Limitations
The attack’s defense depends on trust within pools, while the paper notes that miners are strongly incentivized to join large pools, creating a practical tension.
Abstract
from arXiv · showhide
Bitcoin is a "crypto currency", a decentralized electronic payment scheme based on cryptography. Bitcoin economy grows at an incredibly fast rate and is now worth some 10 billions of dollars. Bitcoin mining is an activity which consists of creating (minting) the new coins which are later put into circulation. Miners spend electricity on solving cryptographic puzzles and they are also gatekeepers which validate bitcoin transactions of other people. Miners are expected to be honest and have some incentives to behave well. However. In this paper we look at the miner strategies with particular attention paid to subversive and dishonest strategies or those which could put bitcoin and its reputation in danger. We study in details several recent attacks in which dishonest miners obtain a higher reward than their relative contribution to the network. In particular we revisit the concept of block withholding attacks and propose a new concrete and practical block withholding attack which we show to maximize the advantage gained by rogue miners. RECENT EVENTS: it seems that the attack was recently executed, see Section XI-A.
I. INTRODUCTION
Bitcoin is presented as a cryptographic, peer-to-peer payment ecosystem whose miners both validate transactions and create new coins. Because miners have financial incentives and may deviate from expected behavior, their strategies can affect Bitcoin’s fragility and governance.
- Bitcoin is described primarily as an electronic payment system based on cryptography rather than a conventional currency.
- C. Critical Nodes: Miners: Miners validate transactions, help establish Bitcoin’s Main Chain, solve cryptographic puzzles, and receive newly created coins and transaction fees.
- C. Critical Nodes: Miners: Mining requires substantial computing equipment and electricity, with specialized ASIC devices increasingly used for the task.
- C. Critical Nodes: Miners: The system assumes honest miners will have better chances of receiving rewards, but miners may instead deviate from ideal behavior for profit.
- Bitcoin is characterized as a financial system with miners’ vested interests rather than a fully decentralized utopian network.
D. Big Uncertainties
Bitcoin’s payment infrastructure is portrayed as imperfect, fragile, and exposed to uncertainty about software, governance, miners, and cryptographic security. The paper therefore examines miner strategies and argues that these risks warrant open discussion.
- D. Big Uncertainties: Bitcoin’s design may evolve in directions dictated by miner minorities, while its cryptography and security certification remain uncertain.
- The paper studies how miners can increase revenue, focusing on subversive strategies and moral hazards that may be difficult to resist.
- Bitcoin lacks a single authoritative specification, although one dominant software implementation and a purported primary specification currently exist.
- The system is described as a distributed electronic notary that maintains a public transaction ledger through peer-to-peer consensus.
- Mining uses repeated double SHA-256 trials, with winning probabilities proportional to computing power and approximately 2^-64.
III. HOW POOLS WORK
Mining pools reduce miners’ income uncertainty by aggregating computing power and distributing rewards, while shares provide lower-difficulty proofs of effort. Statistical results describe the behavior of repeated independent mining trials.
- III. HOW POOLS WORK: Mining pools exist primarily to reduce income uncertainty by replacing individual lottery-like mining with more regular rewards.
- III. HOW POOLS WORK: Pool miners work under the pool manager’s public key, who collects rewards and redistributes them according to contribution.
- III. HOW POOLS WORK: A share is a lower-difficulty proof of mining effort that miners send to the pool manager when they find a qualifying hash.
- III. HOW POOLS WORK: The pool analysis models a static union of miners that combines computing power and shares rewards approximately uniformly.
- For many independent repeated events, the aggregate standard deviation is approximately √n times the original standard deviation, with large deviations becoming unlikely.
B. On Rare Events and Bitcoin Mining
The paper models Bitcoin mining as a rare-event process using Poisson approximations derived from many independent trials. It notes that practical applications also depend on assumptions about network power, difficulty, and pool size.
- Mining outcomes for a fixed group of devices or miners are treated approximately using a result that also applies to static mining pools.
- If a group expects to mine K blocks, the actual count is modeled with a standard deviation approximately equal to √K under the Poisson distribution.
- The derivation assumes constant block-winning probability without memory, although pool membership, difficulty, and competing hash power vary in practice.
- The Bitcoin-specific derivation models miners as combinations of many equal-sized mini miners performing independent hash trials.
- The analysis is approximate when network power is not uniformly distributed over time or mining difficulty is not constant.
- Applying the theorem in practice requires estimating a pool’s computing power from the number of blocks it has mined.
V. BASIC ATTACK STRATEGIES FOR SUBVERSIVE MINERS
The paper reviews subversive miner strategies that seek rewards exceeding miners’ fair share, including pool hopping, cartel behavior, and secret-chain attacks.
- Subversive miner attacks aim to obtain expected mining revenue higher than miners’ fair share of contributed computing power.
- Pool Hopping Attack: Pool hopping exploits pools with many submitted shares but no block, making it profitable to switch elsewhere before rewards are distributed.The attack can remain profitable even when pools penalize miners who leave before completing a shift.
- Pool Hopping Attack: Pool hopping effectiveness depends on pool-management rules and other miners’ actions, while some reward methods are immune to it.
- The analysis assumes miners do not frequently change pools and are paid approximately in proportion to their long-run contribution.
- Mining Cartel Attack: A mining cartel can ignore blocks produced by nonmembers, allowing a large colluding fraction of miners to achieve higher gains.The described example involves roughly 50% of miners.
- Secret-Chain Attack: A powerful attacker can secretly build an alternative chain while manipulating difficulty adjustment so it may surpass the public honest chain and enable double-spending.
VI. CONFIDENTIAL CRYPTOGRAPHIC OPTIMIZATION ATTACK
The paper presents confidential cryptographic optimization as a subversive advantage in Bitcoin mining. By exploiting reusable SHA-256 computation structure, the method reduces mining cost substantially, although further gains may be limited.
- Cryptographic optimization improves Bitcoin mining by reducing the cost of trying one double-SHA-256 header from 3.0 to about 1.86 compression-function computations.The optimized test targets hashes with at least 64 leading zeros, representing a 38% improvement.
- The method decomposes double SHA-256 into three compression-function applications, precomputes reusable data, and omits some final computations through early rejection.
- Confidentially paying cryptologists to develop improvements benefiting one miner group is presented as a potential subversive strategy.
- The authors argue that the 1.86-computation figure may be near theoretical limits, leaving perhaps only 1–2% additional improvement.
- Selfish Mining Attack: Selfish mining withholds and selectively reveals information, causing other miners to work on blocks whose effort may later be wasted.
- Selfish Mining Attack: The simplified selfish-mining description assumes miners normally extend the single longest public chain and models at most two competitive branches, one possibly secret.
- Selfish Mining Attack: The selfish-mining strategy is complex, and its profitability is not obvious from the simplified analysis.
A. Discussion of the Selfish Mining Attack
The authors question the practical importance of selfish mining despite accepting that its main result was confirmed by simulation. Their historical analysis finds little wasted effort, while they describe a block-selection recommendation intended to reduce such strategies.
- The authors regard selfish-mining claims as potentially exaggerated because the analysis assumes one colluding minority pool and an honest majority.
- The paper notes that multiple subversive groups could exist, and miners inside a selfish pool could themselves deviate to pursue higher gains.
- The paper does not seek the best Bitcoin-mining strategy; instead, it analyzes historical wasted blocks across Bitcoin’s history since early 2009.
- The authors report that wasted computational effort has been marginal and has decreased over time.
- Only 0.01% of miners’ combined effort is identified as mining children of wasted blocks, the main channel through which selfish mining could impose disproportionate losses.
- If waste increased substantially, miners might support protocol changes such as penalizing forks that create more wasted effort.
- The authors call selfish mining largely academic but highlight random block selection during forks as a recommendation that can eliminate selfish-miner strategies in practice.
VIII. A BLOCK DISCARDING ATTACK VS. SELFISH MINING
The paper distinguishes block discarding from selfish mining by their assumptions, mechanisms, countermeasures, and profitability conditions. It then introduces a practical block withholding attack that generalizes prior sabotage and lets rogue miners earn more than their proportional contribution.
- Comparison with Selfish Mining: Block discarding and selfish mining differ because the former targets solo miners, whereas the latter is designed for mining pools.The papers also make different assumptions about keeping blocks secret and pool participation.
- Comparison with Selfish Mining: Selfish mining explicitly models influence through miners choosing the first block they receive, unlike the less-defined network influence in block discarding.The block-discarding analysis leaves open whether influence comes from manipulating latency or controlling ordinary network nodes.
- Profitability and Countermeasures: The block-discarding strategy is profitable if and only if the subversive-miner fraction is at least 1−ns 3−2ns; random fork-branch mining corresponds to ns = 1/2.The cited countermeasure therefore maps to a specific network-superiority assumption.
- New Block Withholding Attack: The proposed attack generalizes the earlier Sabotage attack and, unlike that original attack, allows rogue miners to profit while using a concrete practical instantiation.The paper also gives a numerical example and analyzes variants.
- New Block Withholding Attack: Rogue miners receive a reward share exceeding their computing-power contribution, and the paper states that no easy way exists to stop the attack.This reproduces the central advantage identified for related selfish-mining strategies.
A. Can Block Withholding Attacks Be Prevented?
The paper argues that preventing the attack depends on trust within mining pools and may require restricting participation. Its generalized analysis shows that splitting rogue capacity between infiltration and normal mining maximizes their gain at β = 1/2, while pool structure can also facilitate centralization.
- Prevention: Pools function well only when pool managers can trust participants, because the paper argues existing private-key possession does not prevent withholding attacks.The authors do not know whether current pools have implemented countermeasures and suggest miners may previously have been honest because they overlooked such strategies.
- Prevention: The proposed defense is to admit only personally known and trusted participants and dissolve a pool when its earnings fall below the computational effort expected.This is presented as the only defense the authors identify.
- Alternative Versions and Optimization: Under the generalized attack, rogue miners split capacity between infiltrated pools that discard winning blocks and independent pools that mine normally.Theorem 4 assigns proportions αβ and α(1 −β) to these two activities.
- Alternative Versions and Optimization: For fixed α, rogue-miner gain is maximized when β = 1/2, meaning half of their capacity infiltrates pools and half mines normally.The paper contrasts this profitable strategy with total free riding, which does not produce a gain above proportional computing power.
- Centralization: The attack can contribute to centralization because pools below a minimum size will not detect it, while the paper notes that mining power was already approaching concentration in January 2014.Table II is introduced as evidence that Bitcoin could hardly be called decentralized, with one company approaching 50% of network power.
A. Detection of Block Withholding
The paper argues that individual miners generally cannot detect the attack because mining observations are too sparse and naturally variable. More detailed statistics could improve detection, but large pools must be trusted to collect and report them accurately.
- Individual Detection: A miner observing K = 18 blocks over one year has an estimated standard deviation of about 4.2 blocks, or 24% of K.The paper uses the Gaussian approximation from Theorem 1 to characterize this variability.
- Individual Detection: A miner with this observation history cannot detect rogue groups as large as 20% that obtain a 6% competitive advantage, because the difference remains below natural variation.The paper concludes that this miner cannot detect the described block-withholding attack.
- Individual Detection: Most existing miners are even less able to detect the attack because mining 18 blocks in one year is already rare and an average miner produces fewer than one block annually.The cited estimate uses BTCGuild’s reported population and network block-production capacity.
- Detection Frequency: If mining events occurred every second instead of every ten minutes, the standard deviation would be roughly 24 times smaller and detection thresholds would decrease proportionally.The paper nevertheless states that current individual miners cannot detect these attacks, even in theory.
- Pool-Level Detection: Publishing detailed mining statistics and exact trial counts would improve detection precision, but large pools would need to be trusted to detect and report the attack accurately.Pools may have incentives to conceal information because disclosure could encourage miners to switch pools.
B. Have Rogue Strategies Been Applied?
The paper finds no evidence that rogue miner strategies had previously been applied, while analyzing incentives and mechanisms that could let dishonest miners gain more than their proportional contribution. It also discusses centralization and block-withholding risks in Bitcoin mining.
- BTCGuild statistics were used to test whether block withholding had occurred by comparing expected pool rewards with observed payouts.The calculation multiplied currency difficulty by BTCGuild’s overall Pay Per Share rate on 05/01/2014.
- At least 23 BTC plus approximately 0.1–0.2 BTC in transaction fees was expected after pool fees, broadly matching the observed result.The expected baseline was 25 BTC plus transaction fees, minus 5+3% pool fees.
- No evidence was found that rogue miner strategies had ever been applied.
- The paper analyzes attacks that can increase some miners’ gains at the expense of others, including pool hopping, cartel behavior, and block withholding.It presents these strategies as threats to Bitcoin’s incentives and reputation.
- The proposed block-withholding attack generalizes the Sabotage attack, produces superior gains for subversive miners, and can reportedly tolerate participation by as much as 20% of miners without detection by small pools.
- Mining centralization creates incentives to join large pools even though the paper argues that subversive strategies may eventually encourage miners to avoid them.The paper notes that one pool was approaching half of the network’s computing power and that miners joined large pools despite fees as high as 8%.
A. Recent Developments - June 2014
The section reports suspected and apparently executed block-withholding attacks, including a large-scale attack against Eligius. The paper disputes claims that such attacks are purely destructive, arguing that its optimized variant can be profitable.
- Early reports of suspected block withholding attacks date to late 2013.
- About 300 BTC in losses were attributed to a reported June 2014 attack against Eligius, which blocked approximately 200 BTC of attackers’ payouts.
- Contemporaneous commentary and Cornell researchers characterized block withholding as destructive rather than directly beneficial to attackers.
- The paper argues that block withholding can be profitable and that the Eligius attack may have been conducted for profit, possibly using the paper’s optimized strategy.
- Selective withholding in some pools while mining normally in others is identified as the observation that can make these attacks profitable.
- The paper claims correctly executed attacks are difficult for pools to detect or attribute to a single attacker identity.Attackers can fragment activity across many identities, while conspicuous mining under one address may expose them.
APPENDIX
The appendix frames Bitcoin mining as a centralized and potentially fragile ecosystem shaped by concentrated control of mining hardware. It catalogs possible frauds and unethical practices by ASIC manufacturers and sellers.
- A major threat identified is the centralization of mining hardware supply and the resulting trust and fraud risks.
- About a dozen ASIC manufacturers controlled 100% of Bitcoin’s mining-device market, while their devices used up to 10,000 times less power than ordinary computers.
- The appendix warns that manufacturers could exploit information asymmetries because customers and the public cannot readily observe private business decisions.
- The paper cautions that it is not accusing specific companies and considers moderate delivery delays unsurprising for new ASIC products.
- Reports cited in the appendix describe severe delivery delays and allegedly fraudulent mining-device sellers, including delays of up to one year.
- Listed threats include nonexistent production, fake retailers, secret production information, and other deceptive practices.