PaperlayerView exact revision on arXiv

Source-linked AI summary

Be Selfish and Avoid Dilemmas: Fork After Withholding (FAW) Attacks on Bitcoin

Yujin Kwon, Dohyun Kim, Yunmok Son, Eugene Vasserman, Yongdae Kim

arXiv:1708.09790v1cs.CR

TL;DR

Bitcoin mining pools face unfair-reward attacks including BWH and selfish mining, motivating a new attack that combines withholding with intentional forks. The paper analyzes FAW against one or multiple pools and in a two-pool game, finding higher rewards than BWH and a possible larger-pool winner. It also discusses partial defenses but identifies no cheap, efficient countermeasure.

  • Problem

    Bitcoin mining pools remain vulnerable to BWH and fork-based selfish-mining attacks, while the two-pool BWH game produces a miner’s dilemma with diminished revenues.

  • Method

    The paper proposes FAW, analyzes single- and multi-pool attacks, models a two-pool FAW game, and examines possible countermeasures.

  • Results

    56% greater extra reward is achieved against four popular pools than with BWH, while the larger pool can win consistently in some two-pool FAW equilibria.

  • Takeaways & Limitations

    FAW is always profitable regardless of attacker computational power or network capability and is harder to detect than selfish mining despite using intentional forks.

  • Takeaways & Limitations

    The proposed FAW defenses are neither perfect nor practical, leaving a practical defense as an open problem.

Abstract

from arXiv · show

In the Bitcoin system, participants are rewarded for solving cryptographic puzzles. In order to receive more consistent rewards over time, some participants organize mining pools and split the rewards from the pool in proportion to each participant's contribution. However, several attacks threaten the ability to participate in pools. The block withholding (BWH) attack makes the pool reward system unfair by letting malicious participants receive unearned wages while only pretending to contribute work. When two pools launch BWH attacks against each other, they encounter the miner's dilemma: in a Nash equilibrium, the revenue of both pools is diminished. In another attack called selfish mining, an attacker can unfairly earn extra rewards by deliberately generating forks. In this paper, we propose a novel attack called a fork after withholding (FAW) attack. FAW is not just another attack. The reward for an FAW attacker is always equal to or greater than that for a BWH attacker, and it is usable up to four times more often per pool than in BWH attack. When considering multiple pools - the current state of the Bitcoin network - the extra reward for an FAW attack is about 56% more than that for a BWH attack. Furthermore, when two pools execute FAW attacks on each other, the miner's dilemma may not hold: under certain circumstances, the larger pool can consistently win. More importantly, an FAW attack, while using intentional forks, does not suffer from practicality issues, unlike selfish mining. We also discuss partial countermeasures against the FAW attack, but finding a cheap and efficient countermeasure remains an open problem. As a result, we expect to see FAW attacks among mining pools.

1 INTRODUCTION

The paper introduces fork after withholding (FAW), an attack combining block withholding with intentional forks, and argues that it is more rewarding and practical than related attacks. FAW can outperform BWH, alter the two-pool game, and remains difficult to defend against.

  • FAW attack: FAW combines block withholding with intentional forks to obtain extra rewards from mining pools.The attacker withholds a full proof of work found through infiltration mining and later uses it to generate a fork.
  • Multi-pool attack: 56% greater extra reward is obtained by attacking four currently popular pools than by launching a BWH attack.The multi-pool attack yields more extra reward than the single-pool version.
  • FAW attack game: In the two-pool FAW game, the miner’s dilemma may not hold because the larger pool can consistently earn the extra reward.The game has a Nash equilibrium, but under a condition the equilibrium can favor the larger pool.
  • FAW versus selfish mining: Unlike selfish mining, FAW is always profitable and harder to detect despite using intentional forks.The paper characterizes selfish mining as potentially unprofitable, detectable, and impractical.
  • Countermeasures: The proposed countermeasures are partial, and the paper finds no practical defense against FAW attacks.Some parameters can be computed in advance, supporting attack feasibility, but one parameter remains difficult to determine.
  • Rewards: FAW rewards are always at least as high as BWH rewards, with single-pool gains reaching one to four times the BWH gain in a large pool.The large-pool calculation represents a pool controlling 20% of the Bitcoin network’s computational power.

2 PRELIMINARIES

The preliminaries describe Bitcoin’s proof-of-work mining and fork mechanism, then position FAW against selfish mining and block withholding. Existing defenses against BWH use two-phase proof-of-work protocols, but practical defenses against FAW remain unresolved.

  • Bitcoin basics: Bitcoin mining generates nonces satisfying a difficulty target, and valid blocks are broadcast to extend the blockchain.The target is adjusted automatically to maintain an average round duration of 10 minutes.
  • Forks: A fork occurs when different valid blocks are broadcast, after which one branch becomes valid and the others are invalidated.Network latency can allow multiple blockchain heads to exist temporarily.
  • Selfish mining: Selfish mining withholds blocks and selectively propagates them to create forks that may invalidate honest miners’ blocks.The related-work discussion describes selfish mining as widely considered impractical.
  • Block withholding: BWH attackers submit partial proofs of work but withhold full proofs, receiving payment while causing losses for the target pool.Managers may detect BWH by comparing submitted work with expected full proofs, although many identities can make detection harder.
  • Existing defenses: Two-phase proof-of-work proposals divide mining into smaller puzzles so miners cannot determine whether their partial solution is a valid block.The paper discusses these protocols as defenses against BWH and related attacks.

3 ATTACK MODEL AND ASSUMPTIONS

The attack model allows solo miners and open or closed pool managers to distribute finite computational power between honest and infiltration mining. The analysis normalizes computational power and rewards while excluding competing attacks and unintentional forks.

  • Attack model: An attacker may be a solo miner or the manager of a closed or open mining pool.The attacker may also create Sybil identities and join multiple open pools, but cannot join closed pools.
  • Attack model: The attacker divides finite computational power between innocent mining and infiltration mining against multiple open pools.An open-pool manager’s infiltration power is assumed to be loyal mining power.
  • Assumptions: The normalized computational power of the Bitcoin system is 1, with each miner or pool assumed to control less than 0.5.The upper bound excludes a 51% attack.
  • Assumptions: Unintentional forks are excluded because the cited recent stale-block rate is about 0.41%.Under this assumption, a miner’s reward equals the probability of finding a block in one round.
  • Pool operation: Pool managers propagate valid blocks and distribute rewards to miners in proportion to their submission shares.This reward rule determines how attacker and pool rewards are calculated.

4 ATTACK OVERVIEW

FAW differs from BWH by withholding an infiltrated full proof of work until an external block creates an opportunity for a fork. The attacker can use this mechanism across pools, while pool-manager behavior affects which withheld block is accepted.

  • Attack overview: FAW combines innocent and infiltration mining, withholding an infiltrated full proof instead of discarding it as in BWH.The withheld proof is retained for a later fork opportunity.
  • Single-pool attack: Against one pool, the attacker submits an infiltrated full proof only after an external miner propagates a block, creating a fork.If the attacker’s branch is selected, the target pool receives the block reward and the attacker also receives pool compensation.
  • Reward mechanism: FAW is at least as profitable as BWH because cases where the withheld block wins provide additional profit.When those blocks are never selected, FAW profit equals BWH profit.
  • Manager behavior: An honest manager may discard the infiltrator’s proof after observing an outside block, whereas a rational manager may accept it when doing so is more profitable.If the attacker submits first, the manager selects the attacker’s proof regardless of profitability considerations.
  • Multi-pool attack: The multi-pool extension distributes the attacker’s computational power across target pools and permits separate withheld proofs for different pools.The two-pool example uses Pool1 and Pool2 as simultaneous targets.
  • Pool game: In the FAW pool game, two pools split computational power between innocent and infiltration mining while infiltrating each other.The game defines winning as earning an extra reward, producing either one winner or no winner.

5 FAW ATTACKS AGAINST ONE POOL

The paper analyzes FAW attacks against one mining pool, modeling their four possible cases, optimal infiltration allocation, attacker rewards, and target-pool losses. FAW is at least as profitable as BWH, while the attacker’s reward and the target pool’s remaining reward both increase with network capability c.

  • Theoretical Analysis: FAW attacks divide each round into four cases: innocent mining, an honest target-pool block, a successful withheld-block fork, or an unsuccessful withheld-block opportunity.The attacker earns rewards in the first three cases; the four case probabilities sum to 1.
  • Theoretical Analysis: An attacker allocates an optimal fraction τ of total computational power α to infiltration mining to maximize reward.The attacker uses (1−τ)α for innocent mining and τα for infiltration mining.
  • Theoretical Analysis: FAW attacks are always more profitable than honest mining, with BWH reward as their lower bound.The result holds regardless of the attacker’s computational power; when c = 0, FAW and BWH rewards coincide, while reward increases with c.
  • Theoretical Analysis: The target pool always earns less after an FAW attack than without one, although its reward increases as c increases.The pool’s loss decreases with c because it receives a reward when the attacker’s block becomes the main-chain block.
  • Quantitative Analysis: For attacker computational power α = 0.2, quantitative analysis shows extra attacker reward for every target-pool size β and network capability c.Increasing c raises the attacker’s extra reward; the FAW reward equals the BWH reward at c = 0 and improves on BWH in all cases.

6 FAW ATTACK AGAINST MULTIPLE POOLS

The multi-pool FAW attack distributes infiltration power across target pools and uses withheld FPoWs to create forks, remaining profitable and outperforming BWH attacks. Its modeled reward increases with network capability and target-pool power, reaching a 56.24% improvement over BWH for four open pools.

  • Attack model: The attacker can earn rewards when she finds an FPoW through innocent mining, when a target-pool miner finds one, or when she generates forks from one or multiple target pools.These correspond to cases A, B, C, and D in Figure 3; no reward is earned in case E.
  • Attack model: An attacker targeting n pools distributes infiltration power among them and can find at most n FPoWs in one round, producing forks with up to n+1 branches.The analysis generalizes the attack to n pools while illustrating the two-pool case for exposition.
  • Theoretical analysis: Theorem 6.2 derives the attacker’s total reward Ra for n target pools using target-pool powers βi and infiltration fractions τi.The reward accounts for innocent mining, honest discoveries in target pools, and forks with k branches.
  • Quantitative analysis: As network capability c increases, the attacker’s RER increases; RER also increases when the combined computational power of the two target pools grows.The quantitative analysis fixes attacker power at α = 0.2 and evaluates three two-pool power configurations.
  • Quantitative analysis: 4.63% is the maximum FAW RER versus 2.96% for BWH, giving FAW an extra reward of 56.24% for four open pools in the current distribution.The case models F2Pool attacking AntPool, BTCC Pool, BW.com, and BitFury.
  • Validation: Monte Carlo simulations over 10^8 rounds approximately confirm the theoretical calculations for the three two-pool configurations.The simulations use the cases shown in Figure 4.

7 TWO-POOL FAW ATTACK GAME

The two-pool FAW game models pools that infiltrate one another and choose infiltration powers strategically. Its unique Nash equilibrium can eliminate the miner’s dilemma, with winning outcomes determined by pool size and network capability.

  • Game model: The two-pool game includes innocent discoveries, one-sided infiltration forks, mutual infiltration forks, and discoveries by someone outside both pools.Pools can earn rewards in cases A, B, and C, while case D represents an external discovery.
  • Game model: Each pool’s reward depends on its computational power, infiltration mining power fi, and probabilities that infiltrated FPoWs become the main chain.The model defines fi as Pool i’s infiltration mining power and uses c_i and c′_i for main-chain selection probabilities.
  • Theoretical analysis: Honest mining by both pools is not a Nash equilibrium because either pool can earn extra rewards by executing FAW against a compliant opponent.Best-response dynamics iteratively update each pool’s infiltration power toward its most profitable response.
  • Theoretical analysis: Theorem 7.2 establishes a unique Nash equilibrium, obtained at an interior stationary point or on a restricted-region borderline.Strict concavity under the stated probability conditions guarantees uniqueness.
  • Winning conditions: At equilibrium, pools earn extra rewards above the black borderlines in the (α2, c) parameter space and take losses below them.Figure 6 reports equilibrium infiltration powers and RERs for Pool1 and Pool2 when α1 = 0.2.
  • Winning conditions: Unlike the BWH miner’s dilemma, FAW may produce a winner even when both pools have computational power below 0.5.Figure 7 defines Pool1’s winning range as the region to the right of each equal-reward borderline; Pool2’s conditions swap the axes.

8 FAW ATTACK VS. SELFISH MINING

The paper compares FAW with selfish mining, emphasizing FAW’s profitability and greater resistance to detection despite its use of intentional forks.

  • Profitability: Selfish mining requires at least 0.09 computational power even with optimal network capability, making it unprofitable for most solo miners or closed pools.FAW remains profitable regardless of the attacker’s computational power, making it more practical in those settings.
  • Profitability: FAW is always profitable, whereas selfish mining is not always profitable and is considered impractical.Both attacks use intentional forks, but the paper identifies this practicality problem specifically for selfish mining.
  • Detectability: Selfish mining attackers can be readily detected through delayed block propagation and abnormal blockchain shapes linked to their pools.These signals can reveal an open pool manager before the attacker earns extra rewards.
  • Detectability: FAW attack existence may be detectable through increased fork rates, but identifying the attacker is harder because the attacker’s pool can appear innocent.The target pool instead appears unusual because infiltration miners intentionally generate forks there.

9 NETWORK CAPABILITY C

Network capability c affects the attacker’s optimal FAW strategy and can be estimated or bounded from public computational-power information. Even when c is unknown or changing, FAW can outperform BWH and reduce the region where the miner’s dilemma applies.

  • Information requirements: An FAW attacker needs the target pool’s computational power because optimal τ depends on both attacker and target computational power.The target’s approximate computational power can be obtained from the public distribution of network power.
  • Definition and range: Network capability c is the probability that an infiltrator’s FPoW is selected as the main chain.The paper discusses possible ranges for c and attacker behavior when c is constant but unknown or changes frequently.
  • Unknown and changing c: Even when c is unknown, FAW improves upon BWH and the miner’s-dilemma region decreases compared with the known-c case.The paper also expresses c as γ(1 − α − β) + α + β when the target is one rational pool.
  • Definition and range: For rational target managers, c has a minimum determined by the attacker’s and target pool’s computational power, while honest miners’ power is 1 − α − β.The lower bound is positive in practice because an attacker may hear external block propagation faster using Sybil nodes.
  • Definition and range: With two pools at 20% and 10% computational power, the maximum value of c is about 0.914.When honest-miner power is distributed across many nodes, c may approach 1.
  • Unknown and changing c: Using τ0 when c is unknown still gives the FAW attacker a reward at least as large as the BWH attacker’s reward.For a rational target manager, using τα+β makes the FAW reward certainly greater than the BWH reward.
  • Winning conditions: Figure 8 plots Pool1’s winning conditions against c, with each line marking equal reward to an honest miner and the region to its right indicating Pool1’s winning range.Pool2’s conditions are obtained by swapping the axes.
  • Unknown and changing c: Assuming c = 0 against four open pools yields an RER of up to 3.99%, improving RER by up to 34.62% over BWH.In the two-pool game, lowering assumed c also decreases the region affected by the miner’s dilemma.

10 DISCUSSION

The discussion evaluates FAW detection and defenses, showing that infiltration-miner detection has limited effect while reward-based and two-phase protocols face practical constraints. A cheap, efficient, backward-compatible defense remains unresolved.

  • Countermeasures: Backward-compatible defenses are important because major Bitcoin protocol changes could reduce security by affecting total mining power.Oblivious Shares is described as impractical on these grounds.
  • Detecting FAW Attacks and Attackers: Detection rarely affects FAW attackers because multiple infiltration miners can continue earning after one detected miner is expelled.Using L infiltration miners leaves L−1 miners able to receive rewards, reducing the impact of detection as L increases.
  • Countermeasures: A frequently updated beacon can flag stale FPoWs, but it only affects attackers who detect external block propagation before the manager.Even then, remaining infiltration miners can still receive rewards, and the attacker may earn more than a BWH attacker.
  • Countermeasures: Two-phase PoW defenses improve backward compatibility relative to Oblivious Shares but increase operational costs and are considered unsuitable for adoption.The paper also notes concerns about pool-manager withholding and inconvenience for closed pools and solo miners.
  • Countermeasures: A manager can make honest mining more profitable than FAW by assigning a suitable reward fraction t to miners who find FPoWs.Theorem 10.1 establishes this condition, with the resulting attacker reward Ra less than the honest miner’s reward α.
  • Countermeasures: Reward-based defenses may deter FAW but can create high reward variance, making miners hesitant to join and potentially reducing the pool manager’s ability to attract mining power.The paper therefore advises caution even when the scheme decreases FAW risk.

11 CONCLUSION

The paper proposes FAW attacks that combine block withholding with intentional forks. It reports rewards at least as high as BWH, a possible larger-pool winner in FAW games, and no cheap, efficient defense yet.

  • 11 CONCLUSION: FAW attackers withhold a block in a target pool and submit it when an external miner propagates a valid block, generating an intentional fork.The attack combines withholding with selective submission to exploit fork selection.
  • 11 CONCLUSION: FAW rewards are equal to or greater than BWH rewards, while FAW improves the practicality of selfish mining.The conclusion contrasts FAW’s practicality with selfish mining and its reward with BWH.
  • 11 CONCLUSION: In the FAW attack game, the larger mining pool can gain while the smaller pool loses at a Nash equilibrium, unlike the BWH miner’s dilemma.The conclusion also states that rational target-pool-manager behavior makes FAW more profitable.
  • 11 CONCLUSION: Finding a cheap and efficient FAW defense without major protocol changes or side effects remains open.The paper leaves development of such a defense for future work.

APPENDIX A

The appendix presents pseudocode for FAW attacks against one pool and multiple pools, defining miner sets, found FPoWs, and operations for submission, publication, discarding, and fork generation.

  • Algorithm 1 FAW attack against one pool: Algorithm 1 specifies the FAW attack against one pool, including publication cases and a fork-generation branch.The listed operations include publishing F1 for a fork and returning to fork generation when k is not 1.
  • Algorithm 2 FAW attack against n pools: Algorithm 2 extends FAW attack pseudocode to multiple pools by defining target-pool miner sets and shared attacker operations.The algorithm includes publication to individual pools and a common fork-generation procedure.
  • Algorithm notation: The appendix defines submit, publish, and discard as the attacker’s core FPoW-handling operations.Submission sends an FPoW to a pool manager, publication makes the manager publish it, and discard removes it from consideration.
  • Fork generation: Fork generation is an explicit control-flow stage in both the single-pool and multi-pool attack procedures.Both algorithms include labeled fork-generation steps followed by publication cases.
Loading 1708.09790v1…