PaperlayerView exact revision on arXiv

Source-linked AI summary

BDoS: Blockchain Denial of Service

Michael Mirkin, Yan Ji, Jonathan Pang, Ariah Klages-Mundt, Ittay Eyal, Ari Juels

arXiv:1912.07497v4cs.CR

TL;DR

Prior blockchain DoS attacks either do not scale to decentralized systems or require resources comparable to all other miners, leaving incentive-based disruption comparatively less explored. This paper presents BDoS, which uses proof of a withheld block to discourage rational miners from mining. Its Bitcoin analysis estimates that 21% mining power could stop all rational miners as of March 2020 under the study’s assumptions.

  • Problem

    Classical network DoS does not scale to decentralized blockchains, while known mining-based DoS attacks require at least as much mining power as all other miners combined.

    Source: §1 · p. 1

  • Method

    BDoS models an attacker who proves a block was mined without revealing its contents, using that signal to manipulate rational miners’ incentives to stop mining.

    Source: §1 · p. 1

  • Results

    21% mining power could stop all rational Bitcoin miners as of March 2020 under the study’s assumptions.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The authors conclude that Nakamoto-based cryptocurrencies are vulnerable to BDoS under realistic settings and propose mitigations.

    Source: §10 · p. 12

    The model considers miners that do not use more elaborate strategic behavior, which the authors say has not been observed in the wild.

    Source: §1 · p. 1

Abstract

from arXiv · show

Proof-of-work (PoW) cryptocurrency blockchains like Bitcoin secure vast amounts of money. Their operators, called miners, expend resources to generate blocks and receive monetary rewards for their effort. Blockchains are, in principle, attractive targets for Denial-of-Service (DoS) attacks: There is fierce competition among coins, as well as potential gains from short selling. Classical DoS attacks, however, typically target a few servers and cannot scale to systems with many nodes. There have been no successful DoS attacks to date against prominent cryptocurrencies. We present Blockchain DoS (BDoS), the first incentive-based DoS attack that targets PoW cryptocurrencies. Unlike classical DoS, BDoS targets the system's mechanism design: It exploits the reward mechanism to discourage miner participation. Previous DoS attacks against PoW blockchains require an adversary's mining power to match that of all other miners. In contrast, BDoS can cause a blockchain to grind to a halt with significantly fewer resources, e.g., 21% as of March 2020 in Bitcoin, according to our empirical study. We find that Bitcoin's vulnerability to BDoS increases rapidly as the mining industry matures and profitability drops. BDoS differs from known attacks like Selfish Mining in its aim not to increase an adversary's revenue, but to disrupt the system. Although it bears some algorithmic similarity to those attacks, it introduces a new adversarial model, goals, algorithm, and game-theoretic analysis. Beyond its direct implications for operational blockchains, BDoS introduces the novel idea that an adversary can manipulate miners' incentives by proving the existence of blocks without actually publishing them.

1 INTRODUCTION

BDoS targets PoW blockchains by manipulating miners’ incentives rather than attacking individual servers, and can make mining unprofitable with substantially less power than prior mining-based DoS attacks require. The paper models miners’ responses, examines attack extensions and Bitcoin’s exposure, and proposes mitigations.

1 INTRODUCTION

  • Prior mining-based DoS attacks require resources at least equal to all other miners combined, while classical network DoS does not scale to decentralized systems.The paper presents BDoS as an incentive-based alternative that can halt a blockchain with only a fraction of other miners’ resources.Source: §1 · p. 1
  • BDoS uses an attacker’s proof of a mined block to reduce rational miners’ incentive to continue, without initially publishing the block’s contents.The paper identifies publishing only a block header as a way to signal the attacker’s advantage.Source: §1 · p. 1
  • The analysis allows miners to stop mining and assumes they do not use more elaborate strategic behavior; receiving an attacker’s proof can be individually rational even when ignoring it might serve the common good.The paper notes that miners have been observed to mine intermittently and adapt their strategy to external data.Source: §1 · p. 1
  • If other miners ignore an active attack altruistically, a rational miner has an even stronger incentive to stop mining.The authors model miners’ behavior as a game and examine when not mining is the best response.Source: §1 · p. 2
  • Stopping remains an equilibrium when the attack is updated to address miners who use SPV mining on block headers.If a rational miner extends the attacker’s published header, the attacker can abandon that header and invalidate the miner’s block.Source: §1 · p. 2
  • When two cryptocurrencies have similar baseline profitability, even a small attacker can prompt rational miners to defect to the other chain.The paper’s two-coin analysis describes miners moving to the now-more-profitable cryptocurrency.Source: §1 · p. 2
  • The paper proposes hidden-block proofs that make mitigation harder, alongside mitigations based on fork preference and alternative rewards for lost races.The authors state that alternative reward mechanisms can make BDoS ineffective, though similar attacks might still apply.Source: §1 · p. 2
  • 21% mining power could stop all rational Bitcoin miners as of March 2020 under the paper’s assumptions.The empirical study combines mining difficulty, hardware and electricity costs, and historical Bitcoin prices; Bitcoin’s 2020 block-reward drop increased its security risk.Source: §1 · p. 2

2 RELATED WORK

Prior blockchain DoS work either targets isolated network elements, raises transaction costs, or relies on majority mining power. BDoS differs by using incentives to disrupt liveness, rather than seeking revenue or transaction manipulation.

DoS

  • Network DoS methods can disrupt isolated blockchain elements, but nodes outside the attack can continue interacting with the chain.Transaction-saturation attacks instead raise transaction-write costs and require continuous resource expenditure while the attack lasts.Source: §2 · p. 2

Majority (51%) attacks

  • Majority-power attacks can halt progress by producing empty blocks, whereas BDoS requires significantly less than 50% mining power and no continuous expenditure.Goldfinger and bribery attacks can achieve similar effects without directly acquiring mining power, but are discussed as part of the majority-attack family.Source: §2 · p. 3

Revenue-seeking deviations

  • Revenue-seeking deviations analyze miners’ incentives to increase revenue, not exogenous malicious goals of stopping the blockchain.The paper distinguishes BDoS from intermittent mining attacks that seek revenue and do not manipulate other miners’ behavior.Source: §2 · p. 3

Incentive-based attacks

  • Incentive attacks on transaction ordering or exclusion do not address system liveness, while BDoS targets progress on Nakamoto-like chains.The paper says BDoS does not directly apply to Ethereum, where off-main-chain blocks receive partial rewards that favor continued mining.Source: §2 · p. 3

3 MODEL

The model extends a Nakamoto-style mining system with partial block information and an attacker who can prove a block was mined without publishing its contents. It represents miner participation and payoff decisions as a game under stated mining and profitability assumptions.

3.1 Mining Model

  • The model represents miners, an adversary, block structure, and network interaction, with a blockchain that may contain headers without full block data.Unlike the cited prior models, the modeled chain can include partial block information; the longest chain of full blocks defines each miner’s system state.Source: §3 · p. 3, §3.1 · p. 3
  • The attacker can publish proof that a block was mined without publishing its content, and the model uses a rushing factor to describe how miners adopt competing blocks.The system progresses in rounds, selects active miners in proportion to mining power, and distributes competing blocks to simulate connectivity.Source: §3.1 · pp. 3–4

3.2 Game-Theoretic Model

  • Rational miners choose whether to mine or stop to maximize profit, under assumptions including constant coin value and mining costs.The game defines profit as revenue minus cost and treats transaction fees as negligible; it does not consider difficulty adjustment under the stated assumptions.Source: §3.2 · p. 4

4 THE BDOS ATTACK

BDoS uses a withheld block header to signal the attacker’s lead, then publishes the full block if another miner finds a competing block. The resulting race can reduce a rational miner’s expected reward while leaving its mining cost unchanged.

4 THE BDOS ATTACK

  • BDoS reduces a miner’s chance of receiving a reward while leaving its mining costs unchanged.The attack aims to make a rational miner’s expected payoff from mining lower than stopping; its effect depends on profitability and mining-power parameters.Source: §4 · p. 5
  • The attacker mines on the main chain and, after finding a block, publishes only its header while withholding the block’s transactions.The withheld block is not yet part of the main chain, and this state is called active.Source: §4 · p. 5
  • If another miner finds a block, the attacker publishes the withheld block and races to have it included in the main chain.The first block extended in the race becomes part of the main chain; if all other miners stop, the system reaches a standstill.Source: §4 · p. 5

5 ANALYSIS

The analysis models miners’ choices during BDoS as a game and derives conditions under which stopping is preferable, then examines attack thresholds and partial shutdown. The results show that thresholds depend on miner profitability and attacker characteristics, while partial shutdown links lower throughput with lower attacker cost.

5.1 Game-Theoretic Analysis

  • The section compares miners’ stop and mine strategies using expected profit per second, calculated with a continuous-time Markov chain.It considers an infinite-horizon game and assumes honest mining is profitable for all players absent an attack.Source: §5.1 · p. 5
  • When condition (9) holds for every miner, stopping is each miner’s dominant strategy, regardless of other miners’ actions.The tight condition is derived at αB*=0, and the analysis assumes honest mining is profitable without an attack.Source: §5.1 · pp. 5–6

5.2 Threshold Values

  • With αA=0.2, γ=½, and αi=0.1, the successful-attack threshold for ωb_i is almost 1.6; the threshold is lower at γ=0 and higher at γ=1.For those same αA and αi values, the thresholds are ωb_i<1.15 at γ=0 and ωb_i<2.7 at γ=1; γ=1 is not attainable in a real setting.Source: §5.2 · p. 6
  • With αA=0.2 and αi=0.16, a miner stops at ωb_i<2 when all other rational miners keep mining, versus ωb_i<1.45 when none do.The passage identifies the partial-shutdown threshold as significantly higher than the complete-shutdown threshold.Source: §5.2 · p. 7

5.3 Partial Shutdown

  • Relative throughput and attacker cost are both 1−p1; when σ=0, throughput and attacker cost fall to zero.As σ approaches zero, relative cost becomes smaller even for small attackers; the passage also identifies possible panic and a price-fall chain reaction as consequences of a significant slowdown.Source: §5.3 · p. 7

6 BDOS IN THE PRESENCE SPV MINING

The SPV extension adds mining on the attacker’s published header as a rational miner strategy. The attacker abandons that header if a miner extends it, and the analysis concludes that SPV mining does not reduce BDoS effectiveness.

6.1 Model Updates

  • A rational miner’s added SPV strategy is to mine on the attacker’s header during an attack, under the petty-compliance model.Petty-compliant miners may extend the longest chain, leave the protocol, or engage in SPV mining.Source: §6.1 · p. 8
  • If a rational miner extends the attacker’s header, the attacker abandons it and never publishes its contents, invalidating the miner’s block.The model assumes the attacker is aware when a rational miner finds such a block; the authors describe pool monitoring as a practical way to do this.Source: §6.1 · p. 8
  • The authors leave unmodeled the setting where the attacker can ignore or be unaware of a miner’s block extending her header, although they state that the attack would become stronger there.They also note that SPV-mined blocks in that setting are likely to be empty.Source: §6.1 · p. 8

6.2 BDoS Effectiveness in the Presence of 𝑆SPV

  • The analysis concludes that rational miners do not choose SPV mining because its next block would not enter the main chain, so the attack’s quantitative conditions still hold.The formal justification uses iterated elimination of strictly dominated strategies.Source: §6.2 · p. 8

7 TWO-COIN MODEL

The two-coin model lets miners switch from an attacked coin to a competing coin with the same mining mechanism. The analysis finds that profitability differences can prompt migration, and estimates that realistic Bitcoin–Bitcoin Cash profitability ratios could permit an attack with 10% mining power.

7 TWO-COIN MODEL

  • When coins use similar mining algorithms and have similar profitability, miners can switch to the other coin rather than stop mining altogether.The paper describes this model as more realistic given the number of coins and shared or similar mining schemes.Source: §7 · p. 8

7.1 Model Changes

  • BDoS creates an artificial profitability difference that causes rational miners to abandon the attacked coin for the competing coin.The model considers a rational miner choosing between C1 and a competing C2 with the same mining mechanism; at equal honest-setting profitability, the attack has no threshold according to the text.Source: §7 · p. 8, §7.1 · p. 8

7.2 Analysis

  • The minimum r permitting the attack, r*, does not depend on an individual miner’s mining power.At γ=½ and αA=0.2, r*=0.9; the text says this permits an attack when C1’s profitability is at least 11% below C2’s.Source: §7.2 · p. 9

7.3 Estimating Practical 𝑟

  • Bitcoin and Bitcoin Cash profitability ratios were often within a 5% error range around r=1, values the authors say would allow an attacker with 10% of mining power to succeed.The paper cites prior findings of frequent migration between coins according to profitability and a correlation between profitability changes and hashrate changes.Source: §7.3 · p. 9

8 PRACTICAL CONCERNS

The practical-concerns section examines who might mount BDoS, how miners and attackers could act in practice, and Bitcoin’s exposure under changing profitability. Its Bitcoin estimates show that relatively modest mining power can stop rational miners or significantly reduce throughput.

8.1 Motivation of the Attacker

  • An attacker’s motives may include government goals, short-position profits from destabilizing a coin, or weakening a competing coin.The paper notes that a partial attack may suit an attacker seeking temporary destabilization rather than a complete shutdown.Source: §8.1 · p. 9

8.2 Rationality of Miners

  • The model allows miners to stop mining when it benefits them, while treating them as non-strategic beyond that choice.The authors argue that altruistic miners need not be assumed for security analysis; their model represents them as miners with zero electricity costs, which can limit an attack to a partial shutdown.Source: §8.2 · p. 9

8.3 Header-Publication Method

  • Miners can learn of an attack through a dedicated webpage or headers sent directly to them, including through Bitcoin’s BIP152 protocol.BIP152 nodes do not propagate a header before validating the full block, so direct connections to other miners are required for the second method.Source: §8.3 · p. 10

8.4 Alternative Proofs of Block Possession

  • A smart-contract commitment or a zero-knowledge proof can demonstrate possession of a hidden block without exposing its header.For the contract approach, collateral is returned if the attacker later reveals a valid header, or forfeited otherwise; both approaches make the attacker’s block difficult to distinguish during a race.Source: §8.4 · p. 10

8.5 Practical 𝝎𝒃

  • Bitcoin profitability fluctuates with mining costs, hardware changes, seasonal electricity prices, and the block-reward halving.The authors report that lower CAPEX can bring more miners into the system and reduce baseline profitability, making smaller attackers able to mount BDoS; they estimate Bitcoin profitability using historical blocks, hardware, electricity, and prices.Source: §8.5 · p. 11
  • 21% attacker hashrate was the lowest estimated threshold for a complete Bitcoin shutdown, below the previously known 51% bound.This threshold occurred on March 13, 2020; after the May 2020 halving, the complete-shutdown threshold ranged from 24% to 34% through June 5.Source: §8.5 · p. 11

8.6 Partial Attack and Its Costs

  • As of March 13, 2020, an attacker with 21% mining power could stop all rational miners, while less than 10% could suffice with at least 20% altruistic miners.The estimated daily operating cost was under $1 million; by comparison, a 51% attack would cost $10.6 million with Antminer S9 SE rigs or $5.2 million with Antminer S17 Pro rigs.Source: §8.6 · pp. 11–12

8.7 Simulation of Realistic Miners

  • In the simulated Nash equilibrium, 20% attacker mining power could reduce throughput by 40% even at profitability 1.75 with 20% altruistic miners.As attacker power grows, the simulation shows small and then medium-sized miners choosing to stop mining.Source: §8.7 · p. 12

9 MITIGATION

The section describes two possible mitigations: rewarding uncle blocks and preferring blocks that appear not to be attacker-generated. Each has a stated boundary on its effectiveness.

9 MITIGATION

  • Uncle-block rewards can blunt BDoS in cryptocurrencies such as Ethereum because miners receive rewards for blocks directly connected to the main chain.The authors note that this reduces how much publishing a block header can lower rational miners’ expected profit.Source: §9 · p. 12
  • A timing-based rule could classify blocks received long after their headers as suspicious, but it applies only when the attacker uses header publication.The proposed approach compares the interval between header and block reception; it does not work with smart-contract or zero-knowledge proofs.Source: §9 · p. 12

10 CONCLUSION

The conclusion presents BDoS as an incentive-manipulation attack that makes mining less profitable and reports vulnerability under realistic settings for Nakamoto-based cryptocurrencies. The accompanying analyses establish when miners prefer not to switch actions within a round and when mining is better in states 0 and 2.

10 CONCLUSION

  • BDoS manipulates Nakamoto consensus incentives by proving a mining advantage without publishing the complete block; the paper reports realistic-setting vulnerability and proposes mitigations.The conclusion also describes header-only publication as a realistic extension of the standard analysis model.Source: §10 · p. 12
  • The header-only publication capability is presented as a realistic extension that opens study of equilibria and strategies aimed at increasing miner revenue.Source: §10 · p. 12

A CHANGING ACTION IN THE MIDDLE OF THE ROUND

  • A miner who chooses an action at the start of a round gains nothing by changing it before that round ends, under the model’s assumptions.The argument relies on constant coin price and no block withholding; the text notes that the latter assumption does not hold during active selfish mining.Source: A CHANGING ACTION IN THE MIDDLE OF THE… · p. 15

B MINE IN STATE 0 AND STATE 2 ALWAYS BETTER ACTION THAN STOP

  • When the honest-game profitability factor is greater than 1, mining is more profitable than stopping in states 0 and 2.The proof compares the utilities of strategies differing only in the action taken in those states.Source: B MINE IN STATE 0 AND STATE 2 ALWAYS… · p. 15

C COST OF 51% ATTACK

The appendix estimates the equipment and electricity costs of a Bitcoin 51% attack and introduces a formal analysis of BDoS when miners can use SPV mining.

C COST OF 51% ATTACK

  • 2.4 million S17 Pro rigs would cost $5B, with daily electricity costs of $5.2M; using S9 SE rigs would cost $2.7B with $10.6M in daily electricity costs.Source: C COST OF 51% ATTACK · pp. 15–16

D BDOS ATTACK WITH SPV MINING

D.1 Analysis Changes

The SPV-mining analysis modifies the state-transition model, compares strategies, and derives conditions for stopping to dominate. It then uses iterated elimination to identify an equilibrium and supplies pseudocode for the model.

D.1 Analysis Changes

  • The SPV-mining analysis adds transitions back to state 0 for other miners extending the attacker’s block and, for the SPV strategy, for the rational miner extending its header.The analysis calculates state probabilities and utilities for the strategies in the expanded state model.Source: §D.1 · p. 16

D.2 Narrowing down the possible number of strategies

  • The rational miner’s SPV strategy is strictly dominated by mining, so the analysis thereafter compares mining and stopping for that miner.Source: §D.2 · pp. 16–17

D.3 Conditions for Successful Attack

  • The condition for stopping to dominate can be solved for specific values of γ, α_A, and α_i, but is not analytically solvable in the parametric case.Source: §D.3 · p. 17

D.4 Iterated Elimination of Strictly Dominated Strategies

  • After eliminating dominated strategies, stopping is the only Nash equilibrium if the stated condition holds for all rational miners; it is best regardless of their other rational strategies.Source: §D.4 · p. 17

E PSEUDO-CODE FOR MODEL

  • The model pseudocode covers the scheduler, adversary, and rational miner, including the adversary’s option to publish a block header rather than the full block.Source: E PSEUDO-CODE FOR MODEL · pp. 17–18

F ANALYSIS WITH DIFFERENT ELECTRICITY PRICES

The analysis finds lower attacker hash-rate thresholds at higher electricity prices across the evaluated period.

F ANALYSIS WITH DIFFERENT ELECTRICITY PRICES

  • At $0.05/kWh, the minimum attacker hash-rate threshold was 7.7% before halving and 10% after; at $0.06/kWh, it was below 1% both before and after halving.The analysis assumes no altruistic miners and selects the minimum threshold because the attacker can choose when to attack.Source: F ANALYSIS WITH DIFFERENT ELECTRICITY… · p. 19, Figure 11 · p. 19

Related papers

Loading 1912.07497v4…