Source-linked AI summary
Bitcoin Blockchain Dynamics: the Selfish-Mine Strategy in the Presence of Propagation Delay
Johannes Göbel, Paul Keeler, Anthony E. Krzesinski, Peter G. Taylor
TL;DR
Propagation delay complicates Bitcoin blockchain inconsistencies and the evaluation of selfish-mine strategies. The paper studies these effects with Markov, spatial Poisson, and simulation models, finding increased orphan production and reduced long-term block production under selfish-mine.
Problem
The paper asks how propagation delays affect blockchain inconsistencies and selfish-mine behavior in Bitcoin.
Method
It uses simplified Markov and spatial Poisson models plus discrete-event simulation of a miner network with propagation delays.
Results
0.44 is the approximate orphan-block creation rate when the pool uses selfish-mine in the reported model.
Takeaways & Limitations
Block-hiding strategies increase orphan production, while selfish-mine can reduce the long-term block-production rate even when the pool earns a larger revenue share.
Abstract
from arXiv · showhide
In the context of the `selfish-mine' strategy proposed by Eyal and Sirer, we study the effect of propagation delay on the evolution of the Bitcoin blockchain. First, we use a simplified Markov model that tracks the contrasting states of belief about the blockchain of a small pool of miners and the `rest of the community' to establish that the use of block-hiding strategies, such as selfish-mine, causes the rate of production of orphan blocks to increase. Then we use a spatial Poisson process model to study values of Eyal and Sirer's parameter $γ$, which denotes the proportion of the honest community that mine on a previously-secret block released by the pool in response to the mining of a block by the honest community. Finally, we use discrete-event simulation to study the behaviour of a network of Bitcoin miners, a proportion of which is colluding in using the selfish-mine strategy, under the assumption that there is a propagation delay in the communication of information between miners.
I. INTRODUCTION
Bitcoin is a peer-to-peer payment system maintained by miners through a computationally secured public blockchain. Propagation delays can create temporary inconsistencies between miners, motivating analysis of both protocol-compliant and selfish-mine behavior.
- Bitcoin enables electronic payments without a central clearing agency, using transmitted messages to identify debits, credits, and change.
- Transactions are verified and recorded in a blockchain maintained by a community of miners.
- Propagation delays can give miners different blockchain versions, so the paper studies how these inconsistencies arise and resolve under honest mining and selfish-mine.
- Miners solve computationally difficult cryptographic problems to add transaction-containing blocks and receive rewards and fees.
- Bitcoin targets an average long-term production rate of six blocks per hour by adjusting mining difficulty after each 2016 blocks.
- Independent mining attempts support modeling block creation as a Poisson process with a constant rate of six per hour.
C. Blockchain dynamics
Propagation delays can cause miners to discover competing blocks before receiving one another’s messages, creating temporary races that may produce orphan blocks. The section models this process and estimates how often such races occur.
- A miner that discovers a block during another block’s propagation can maintain a competing chain version, causing a race between branches.
- 6.5 seconds median, 12.6 seconds mean, and around 40 seconds at the 95th percentile describe measured block-propagation delays.
- The race ends when a subsequent block makes one branch longer, after which miners adopt that branch and the losing block likely becomes an orphan.
- 1/50 is the estimated probability that a new block is discovered during communication and validation of another block.This corresponds to 12.6/600, using the mean propagation time and the 600-second average block interval.
- Two to three such propagation races are expected daily given an average of 144 blocks mined each day.
- The paper also reviews Nakamoto’s confirmation analysis, where the attacker’s block count during z community blocks follows a negative binomial distribution.
E. Selfish-mine
The paper examines selfish-mine as a block-hiding strategy that may increase pool revenue, while noting that its original analysis omitted propagation delay. It introduces simple delay-aware models and simulation to compare honest and selfish mining.
- Selfish-mine hides pool-mined blocks from honest miners while the pool privately extends its blockchain.
- A pool controlling less than half the computational power was claimed to earn more than its fair revenue share under selfish-mine.
- The strategy publishes a secret block when the honest community finds a block, hoping some honest miners will continue working on the released block.
- Propagation delay was absent from Eyal and Sirer’s analysis, although honest miners receive the community block before the pool’s released block.
- The paper proposes simple propagation-delay models to compare standard protocol behavior with behavior under a selfish-mine pool.
- The study combines a continuous-time Markov model, a spatial Poisson model for γ, and simulation of 1,000 miners with a colluding fraction.
II. A SIMPLE MARKOV CHAIN MODEL
The model represents differing blockchain beliefs between a mining pool and the wider community as a Markov chain with propagation delay. Its stationary behavior quantifies agreement, splits, and orphan-block production under honest mining.
- State representation: The chain state (k, ℓ) records blocks built by the pool and community beyond their last shared fork.State (0, 0) means both sides agree; larger unequal states represent divergent blockchain versions.
- Transition structure: Transitions occur when either group mines a block or when communication returns unequal states to agreement.The model uses rates λ1, λ2, and μ for pool mining, community mining, and communication-based resolution.
- Stationary analysis: The stationary distribution is derived by counting lattice paths with specified visits to diagonal states, then solving the resulting balance equations.The path-counting function n(k, ℓ; i) counts paths reaching (k, ℓ) with i diagonal points; unequal-coordinate counts were not previously identified by the authors.
- Results: 97.5% of time is spent in agreement, while the community-only, pool-only, and one-block-split states occupy about 1.8%, 0.2%, and 0.4%.All other states have stationary probability below 10^-3, indicating that longer splits are rare in this model.
- Results: 0.022 orphan blocks per hour, or about 0.53 per day, are produced under the stated honest-mining parameters.Each visit to state (1, 1) followed by a new block produces approximately one orphan block.
- Limitation: The model underestimates real-network orphaning because communication within the pool and community is assumed instantaneous.The authors report two to three observed orphan blocks per day in the real Bitcoin network, versus about 0.53 per day in the model.
B. The pool uses the selfish-mine strategy
The selfish-mine model represents a pool that withholds blocks and releases them strategically after honest discoveries. Compared with honest mining under the same parameters, it produces more disagreement and orphan blocks.
- Strategy: Selfish mining keeps pool-mined blocks secret and publishes one or more withheld blocks in response to an honest community block.The pool continues extending its private branch while honest miners work on the publicly known chain.
- Model: The selfish-mine chain uses mining transitions at rates λ1 and λ2, with resolution transitions when the community branch is longer or the pool cashes in a lead.These rules encode the pool’s withholding and publication behavior in the Markov model.
- Analysis: The selfish-mine chain lacks a simple closed-form stationary distribution, so the authors approximate it by truncating the state space.Stationary probabilities are reported for states with k, ℓ ≤ 3.
- Results: 82% of time is spent in agreement; the pool works on a secret block for about 8% and the branches differ by one block for about 7.5%.The same parameter setting produced much more disagreement than the honest-mining model.
- Results: 0.4494 orphan blocks per hour, or about 10.8 per day, are produced when the pool uses selfish mining.Orphans arise from both state (1, 1) races and pool publication in response to honest mining.
- Implication: The selfish-mine rate is about 10.8 orphan blocks per day versus 0.5 per day for honest mining under the same parameters.The authors identify the increased orphan rate as a potential diagnostic for block-hiding strategies.
III. EYAL AND SIRER’S PARAMETER γ
The paper models Eyal and Sirer’s parameter γ as a propagation race in which secret-block transmission through pool miners competes with direct honest-miner communication. A spatial Poisson model shows that accounting for multiple possible relays can make γ substantially larger than the single-best-path estimate.
- Model and assumptions: Pool miners are modeled as a spatial Poisson point process, while communication delays have distance-proportional normal means and common variance σ2.The analysis assumes pool miners are distributed over R2 with constant intensity ν and transmission delays are independent.
- Model and assumptions: γ is the probability that an honest miner receives the pool’s released block before the competing honest block through direct communication.The model considers a secret pool block Bp released after honest Miner M1 publishes Bh, with Miner M2 choosing the branch heard first when lengths are equal.
- Single-candidate estimate: eγ ≤ 0.5 because the shortest-path candidate’s round-trip delay has a nonnegative mean relative to direct communication.Conditional transmission times yield a normally distributed delay difference with mean k(D − d12) and variance 3σ2.
- Single-candidate estimate: As d12 increases, eγ approaches 0.5, with faster convergence at larger ν; eγ is more sensitive to d12 than to pool-node density.The analysis varies d12 and ν with k/σ = 50 and attributes the distance effect to the likelihood of a pool miner near the honest-miner line.
- Multiple candidates: γ exceeds eγ because multiple pool nodes may provide short round-trip paths, reaching above 0.9 when d12 = 12 and ν = 1.6.Higher pool-node density makes γ more sensitive to ν, since more alternative pool nodes can have short round-trip times.
- Implications and scope: With randomly varying delays, the pool benefits from maximizing the number of nodes that release the secret block, while honest miners could potentially use intermediate relays as well.The pool strategy raises the chance that at least one released block reaches honest nodes before direct communication; relay-based honest communication is identified as future work.
IV. BLOCKCHAIN SIMULATION EXPERIMENTS
The study uses discrete-event simulation to examine Bitcoin blockchain behavior under propagation delay, with experiments on a 1,000-node network and repeated runs.
- The simulators modeled a 1,000-node network with miners placed uniformly at random over a 1,000 × 1,000 square.The C++ simulator was used for the network experiments.
- Blocks were mined at Poisson-process times, averaging one block every 10 minutes, while each node maintained a local blockchain copy.
- Communication delay followed a normal distribution whose mean increased with Euclidean distance and whose coefficient of variation remained constant.Unlike the Section III model, the variance here increased with distance between nodes.
- 10,000 blocks were mined per experiment, representing 70 days of mining.
- Each experiment was replicated 12 times, with 95% confidence intervals computed for the reported performance measures.
A. Honest mining
Under honest mining, increasing communication delay produced more blockchain splits and longer periods before the network resynchronized.
- A. Honest mining: The average split rate followed b(t) = 0.2508t^0.9695, indicating an almost linear relationship with average communication delay.Figure 5 varied delay from 1 millisecond to 100 seconds using logarithmic axes.
- A. Honest mining: 2.34 splits per 24 hours occurred on average at a 10-second expected communication delay.This was roughly consistent with the reported Bitcoin-network observation of 2.4 splits at 12.6 seconds.
- A. Honest mining: A dwell time is the interval between a blockchain becoming unsynchronized and subsequently becoming synchronized again.
- A. Honest mining: Average dwell time was also almost linearly proportional to average communication delay.
- A. Honest mining: Dwell time exceeded 10 minutes when average communication delay was around 100 seconds, while splits and resolution time both increased with delay.
B. Dishonest mining
The selfish-mining simulations examine how propagation-delay variability affects γ and the probability that honest miners extend the pool’s block.
- B. Dishonest mining: α denotes the dishonest pool’s fraction of total computing capacity, while γ denotes the probability that an honest miner mines on Bp rather than Bh.
- B. Dishonest mining: With zero communication delay, profitable selfish mining requires α > 0 when γ = 1 and α > 1/3 when γ = 0.
- B. Dishonest mining: When communication-delay variability is zero, Bh reaches M2 before Bp except for the zero-probability case of collinear nodes; when CV > 0, Bp can arrive first.
- B. Dishonest mining: The observed γ was positive with dishonest miners and CV > 0, and increased quickly with α even when CV was small.The authors attribute this to many possible intermediate pool nodes providing alternative communication paths.
- B. Dishonest mining: The probability Γ that the next honest-node block extends Bp closely matched Γ = α + (1 − α)γ.
C. The relative pool revenue
The simulations characterize relative pool revenue as a function of network size and pool computing share under a fixed 10-second communication delay.
- C. The relative pool revenue: Relative pool revenue is defined as R = Np/(Nh + Np), using included blocks mined by the pool and honest miners.
- C. The relative pool revenue: At a 10-second average communication delay, revenue was roughly constant across networks of 100 to 1,000 miners and increased with α.
- C. The relative pool revenue: R exceeded 0.5 when the pool’s computing-power fraction α reached 0.4.
D. Detecting the presence of dishonest miners
The simulation examines whether dishonest mining can be detected through blockchain splits and reduced honest-miner revenue. Increasing dishonest-pool size raises split frequency and lowers honest earnings below the 0.15-bitcoin hourly benchmark.
- Simulation setup: The simulation models 1,000 miners with a 10-second average communication delay and CV = 0.001.These settings define the network used to examine detection signals.
- Blockchain splits: An order-of-magnitude increase in blockchain splits accompanied larger dishonest-pool size.Figure 10 reports average splits per 24 hours as a function of dishonest-pool size α.
- Miner revenue: 0.15 bitcoins per hour is the expected average revenue for each equal-power miner in the 1,000-node network.The benchmark is calculated as 25 × 6/1000.
- Miner revenue: As dishonest miners increased, honest miners earned less than the 0.15-bitcoin-per-hour expectation.The paper identifies reduced honest-miner revenue as another possible detection signal.
E. Dishonest mining is not profitable
The paper finds that selfish mining can raise a dishonest pool’s relative revenue above α = 0.25, while reducing total main-branch block incorporation and disadvantaging both pool and honest miners under fixed difficulty. Its idealized models and omitted relay counter-effect limit the scope of these conclusions.
- Profitability: For α > 0.25, dishonest mining outperformed honest mining in relative pool revenue.The result does not mean the pool incorporated more main-branch blocks than under honest mining.
- Main-branch outcomes: Both the dishonest pool and honest miners were worse off when selfish mining was present.The total number of blocks incorporated into the main branch was always lower than without dishonest mining.
- Difficulty assumption: With fixed mining difficulty, dishonest mining reduced the long-term rate of successfully mined blocks.In the real blockchain, difficulty would decrease after an overall reduction in successful block production, potentially providing another detection signal.
- Adoption threshold: For 0 < α ≤ 0.25, solo miners had no incentive to adopt selfish mining because the pool’s relative revenue was lower than under honest mining.Solo honest miners nevertheless benefited in relative revenue from the dishonest pool’s activities in this range.
- Scope and limitations: The analysis uses simple models and simulation to study propagation-delay effects without reproducing the Bitcoin network’s detailed structure.The authors propose future work using network tomography and note that honest miners’ analogous relay behavior was not studied.
APPENDIX
Algorithm 1 specifies how a dishonest node maintains a public blockchain and a secret extension, publishing withheld blocks according to its lead and race state. Secret mining extends the private chain, while public mining updates state and releases blocks under defined conditions.
- Initialization: The dishonest node initializes its public blockchain, empties secretExtension, clears race, and mines on the public chain’s last block.This establishes the node’s initial public and private state.
- Secret mining: During SECRETMINE, the node appends a block to secretExtension, increments ns, and mines on that secret block.If a race is active, the block is published and the private extension is cleared; extensions longer than five trigger publication of the first unpublished block.
- Public mining: PUBLICMINE appends a public block and increments np before computing the lead Δ = ns − np.The lead determines whether the node abandons private mining, enters a race, or publishes secret blocks.
- Lead handling: When Δ = −1, the node clears race and secretExtension before mining on the public block.This is the catch-up case after the public chain has overtaken the secret extension.
- Lead handling: When Δ = 0 or Δ = 1, the node publishes selected secret blocks, updates race or secretExtension, and continues mining on the indicated chain.For Δ > 1, it publishes the first unpublished secret block and mines on the secret tip.