Incentives in cryptocurrencies

ECRYPT Workshop on Cryptocurrencies

Joseph Bonneau

Recap: Bitcoin miners

Bitcoin depends on miners to:

• Store and broadcast the block chain
• Validate new transactions
• Vote (by hash power) on consensus

Who are the miners?

Early miners faced high risk

Chilkoot pass,

1898 Klondike gold rush

​

Mining is extremely difficult

Number of attempts to find a block:

2^69.6 = 903,262,006,880,187,187,200

​

Network hash rate = 1,432,691 TH/s

Trillion

Mining difficulty grows over time

bitcoinwisdom.com

Difficulty adjusts every two weeks

bitcoinwisdom.com

10 minutes

2 weeks

Mining has quickly become industrial

CPU GPU FPGA ASIC

gold pan sluice box placer mining pit mining

Bitcoin ASICs

• special purpose
• approaching known limits on feature sizes
• less than 10x performance improvement expected
• designed to be run constantly for life
• require significant expertise, long lead-times
• perhaps the fastest chip development ever!

Market dynamics (2013/2014)

• Most boards obsolete within 3-6 months
• Half of profits made in first 6 weeks
• Shipping delays are devastating to customers
• Most companies require pre-orders
• Most individual customers should have lost...

But... rising prices saved them!

Bitcoin ASICs

Market dynamics (2015/2016)

• Growth rate leveling off
• Mining hardware approaching fab. limits
• Mining becoming professionalized

[Taylor 2013]

Bitcoin and the Age of Bespoke Silicon.

Current hardware (2015/2016)

Case study: Ant Miner S7

• First shipped 2015
• 4.7 TH/s
• 1210 W
• Cost: US$619

​

Still, 4.8 years to find a block!

Market dynamics (2015/2016)

Professional mining centers

Needs:

• cheap power
• good network
• cool climate

Mining center in China

Philosophical questions

• Do ASICs violate the original Bitcoin vision?
• Would we be better off without ASICs?

Hard questions about power usage

• Will Bitcoin drive out electricity subsidies?
• Will Bitcoin require guarding power outlets?
• Can we make a currency with no proof-of-work?

Data furnaces

• ASICs are ~as efficient as electric heaters
• Why not install mining rigs as home heaters?
• Challenges:
• Ownership/maintenance model
• Gas heaters still at least 10x more efficient
• What happens in summer?

Can mining become “virtual”?

If future mining converts Bitcoin to electricity...

​

Why not just vote by Bitcoin holdings?

​

“Proof of stake”

Deviant mining strategies

Assume you control 0 < α < 1 of mining power and the remainder is “compliant”

​

Can you profit from a non-default strategy?

For some α, YES, though not observed in practice

Strategy space for miners

​

• Which transactions to include in a block
• Default: any above minimum transaction fee
• Which block to mine on top of
• Default: longest valid chain
• How to choose between colliding blocks
• Default: first block heard
• When to announce new blocks
• Default: immediately after finding them

What can you do with α > 51%?

• Fork the blockchain and double-spend
• Undermine exponential convergence

​

• Reject all other miners’ blocks
• Undermine fairness

​

• Demand exorbitant transaction fees
• Undermine liveness

All of these attacks are highly visible

Forking attacks

M→M’

M→B

M→M’

M→B

Attackers care about the exchange rate

Source: blockchain.info

Mt. Gox hacked

Mining hardware is illiquid

• High entry costs
• Low salvage value

Result: Miners care about future exchange rate

Forking attacks via bribery

• Buying α > 0.5 is expensive. Why not rent?

​

• Payment techniques:
• Out-of-band bribery
• Run a mining pool at a loss
• Insert large “tips” in the block chain

​

[Bonneau 2016]

Why buy when you can rent? Bribery attacks on Bitcoin consensus

​

In-band bribery possible with scripts

K₀ → K₁

$$$$$$$$$$$ → K₀

K₀→ {t1, t2, t3, t4, ...}

B₀

B₁

B₂

...

Guaranteed bribes

Can we do anything with α < 50%?

Surprising answer: Yes!

Temporary block-withholding attacks

Strategy: don’t announce blocks right away. Try to get ahead!

Secret Block

Secret Block

All other miners are wasting effort here!

“Selfish mining”

Temporary block-withholding, take 2

What happens if a block is announced when you’re ahead by 1?

Network race

Secret Block

Assume you win races with prob. ɣ

• Always withhold if ɣ = 1
• Ideal network position
• Obtainable through bribery?
• Withhold for α > 0.25 if ɣ > 0.5
• Always withhold for α > 0.33

[Eyal, Sirer 2014]

Majority is not enough: Bitcoin mining is vulnerable.

Surprising theoretical finding, never observed!

Whale mining

Risks of uneven transaction fees

100 BTC

25 BTC

25 BTC

25 BTC

Expected reward: α² x 125

Expected reward: α x 25 BTC

Expected reward: α³ x 125

Transaction fees will matter more

Courtesy:

Brian Warner

Currently, block rewards are > 99% of miner revenue. But:

Eventually, transaction fees will dominate

Transaction fees already increasing

[Möser, Böhme 2015]

Trends, Tips, Tolls: A Longitudinal Study of Bitcoin Trans. Fees

What will set transaction fees?

• Marginal cost of inclusion in a block?
• →0 if block size is big enough
• Otherwise, auction for limited space

​

• Cartel of miners?
• Optimize fees x volume
• Pressure from other currencies?

​

• Exogenous security requirements?
• Not known/proven

​

Mining pools (May 2016)

Economics of being a small miner

• Cost: ≈US$619
• Expected time to find a block: ≈4.7 years
• Expected revenue: ≈$88/month
• Electricity cost:
• $71/month (USA)
• $140/month (EU)

​

Ant Miner S7

Mining uncertainty (4.7 year mean)

Probability density

4.7

years

Time to find first block

Idea: could small miners pool risk?

Mining pools

• Goal: pool participants all attempt to mine a block with the same coinbase recipient
• send money to key owned by pool manager
• Distribute revenues to members based on how much work they have performed
• minus a cut for pool manager

How do we know how much work members perform?

Show work with near-valid blocks (shares)

4AA087F0A52ED2093FA816E53B9B6317F9B8C1227A61F9481AFED67301F2E3FB

D3E51477DCAB108750A5BC9093F6510759CC880BB171A5B77FB4A34ACA27DEDD

00000000008534FF68B98935D090DF5669E3403BD16F1CDFD41CF17D6B474255

BB34ECA3DBB52EFF4B104EBBC0974841EF2F3A59EBBC4474A12F9F595EB81F4B

00000000002F891C1E232F687E41515637F7699EA0F462C2564233FE082BB0AF

0090488133779E7E98177AF1C765CF02D01AB4848DF555533B6C4CFCA201CBA1

460BEFA43B7083E502D36D9D08D64AFB99A100B3B80D4EA4F7B38E18174A0BFB

000000000000000078FB7E1F7E2E4854B8BC71412197EB1448911FA77BAE808A

652F374601D149AC47E01E7776138456181FA4F9D0EEDD8C4FDE3BEF6B1B7ECE

785526402143A291CFD60DA09CC80DD066BC723FD5FD20F9B50D614313529AF3

000000000041EE593434686000AF77F54CDE839A6CE30957B14EDEC10B15C9E5

9C20B06B01A0136F192BD48E0F372A4B9E6BA6ABC36F02FCED22FD9780026A8F

Mining pools

0x00000000000490c6b00...

0x00000000000000003f89...

0x000000000001e8709ce...

0x0000000000007313f89...

0x0000000000045a1611f...

0x00000000000a877902e...

Pool manager

$$$

$$

$

Hey folks! Here’s our next block to work on

coinbase:

25→pool

mrkl_root: H( )

prev: H( )

nonce:

hash:

Do we want pools?

Pros:

• Allow smaller miners to participate by lowering variance

​

Cons:

• Fewer fully-validating nodes
• Mining pools may become too powerful

​

Interesting result [Miller et al. 2015]:

we can design a cryptocurrency so that pools are impossible

None serious deviations observed yet...

If a greedy attacker is able to assemble more CPU power than all the honest nodes, he would have to choose between using it to defraud people by stealing back his payments, or using it to generate new coins. He ought to find it more profitable to play by the rules, such rules that favour him with more new coins than everyone else combined, than to undermine the system and the validity of his own wealth.

--Satoshi Nakamoto

Many explanations for lack of attacks in practice

Miners are too simplistic?

Too much risk and capital needed?

Hard to profit from double-spends?

Honor among miners?

Attacks are lucrative in a simple model

Infinite:

• attacker capital
• attacker risk tolerance

​

Negligible:

• double-spend overhead
• bribery premium

​

​

Game theory poorly suited to Bitcoin

​

Usual assumptions:

• known set of players
• known utility functions
• synchrony

Most Bitcoin “game theory” is really unilateral optimization

Games at two levels

• Human level
• Slow
• Can change rules/code
• Exchange rates matter
• Other currencies exist

​

• Algorithmic level
• Fast
• Rules are fixed
• Closed world
• Exchange rate fixed?

What if you want to crash Bitcoin?

Goldfinger Attack

I expect you to die, Mr. Bitcoin

[Kroll, Davey, Felten 2013]

The Economics of Bitcoin Mining, or Bitcoin in the Presence of Adversaries

Summary

• Miners are free to implement any strategy
• Very little non-default behavior in the wild
• No complete game-theoretic model exists
• Game changes as fixed rewards dwindle

​

​

Things might be about to get interesting...

Mining hardware is illiquid

• High entry costs
• Low salvage value

Conclusion: Miners care about future exchange rate

To attack, or not to attack?

Revenue

Time

attack

default behavior

Mining pool variations

• Pay per share: flat reward per share
• Typically minus a significant fee
• What if miners never send in valid blocks?
• Proportional: typically since last block
• Lower risk for pool manager
• More work to verify
• Pay per-last-N-shares
• Minimize “pool hopping”
• Some pool hopping still exists!

Rewards structure for pools

Goals:

• Limit risk carried by pool
• Incentivize participants to always submit blocks
• Incentivize participants to mine consistently
• no “pool-hopping”
• Don’t discourage new participants

​

Impossibility result (in progress):

• No system can satisfy all these goals

​

[Schrijvers, Bonneau, Roughgarden, Boneh 2016]

Incentive Compatibility of Bitcoin Mining Pool Reward Functions

Are mining pools a good thing?

• Pros
• Make mining more predictable
• Allow small miners to participate
• More miners using updated validation software
• Cons
• Lead to centralization
• Discourage miners from running full nodes

Can we prevent pools?

Mining pool sabotage

Surprising result:

• For realistic pool sizes, incentives favor sabotage
• Infeasible to prevent with pools as we know them
• Result is an iterated prisoner’s dilemma!

​

​

[Eyal 2015]

The Miner’s Dilemma

Mining pools may attack each other

Goals:

• Increase profitability of your pool
• Increase size of your pool by damaging others

​

Strategies:

• Participate in rival pool but withhold valid blocks
• Denial of service on the network to delay rival pools

​

Mining pool sabotage

α = 50%

α = 50%

Bitcoin network

0.5

0.5

0.5

0.5

Honest behavior: 0.5

Mining pool sabotage

α = 50%

α = 50%

Bitcoin network

0.25

0.33

0.5

0.66

0.25

0.22

Dishonest behavior: 0.555...

Will miners cooperate to enforce fees?

Feather-forking

Goal: blacklist/censor some addresses

​

Strategies:

• Announce you will try to fork if blacklisted addresses appear in a block
• Will try to make fork work until k blocks behind

​

Feather forking

Block with banned tx

Feather forker works here

Chance of success down to α³, give up

Feather-forking

Goal: blacklist/censor some addresses

​

Strategies:

• Announce you will try to fork if blacklisted addresses appear in a block
• Will try to make fork work until k blocks behind

​

Apparent outcome:

• Blacklister will lose some mining revenue
• Others will also lose! Optimal strategy is to enforce blacklist (unless Tx fees are very high)

​