The Miner's Dilemma

Miners and Pools

Bitcoin's security stems from the vast compute resources of many participants called miners. These participants contribute their compute power, called mining power, and the system rewards them with Bitcoin. We assume that the miners follow the honest mining protocol, and therefore the payoff of a miner is proportional to its ratio of mining power out of all mining power in the system. Reward distribution occurs as blocks are discovered with proofs of work, and each miner produces proof of work with probability proportional to its mining power.

Bitcoin gives out a block reward, 25 BTC as of today, every 10 minutes on average. This means that a miner whose power is a small fraction of the total mining power is unlikely to win in a very long time. Since this can take years, miners congregate in pools. A pool has a manager, and whenever a participant in the pool finds proof of work, the reward goes to the manager, which distributes it among the participants according to their contribution to the pool.

In order to estimate the effort exerted by its participants, the pool manager receives from its miners not only the full proofs of work that go to the Bitcoin system, but also partial proofs of work. Partial proofs are similar to full proofs, but are much easier to produce, so small miners produce them at a sufficient frequency to allow a good estimate of their power. These partial proofs of work enable the pool manager to make sure that a miner indeed put effort into working on behalf of the pool, as a miner would naturally discover them during the effort to find a full proof of work, and they demonstrate just how much effort that miner put into discovering a solution.

Many of the pools are open pools. They have a public web interface where miners log in to register. After registering, miners point their mining hardware to a designated server and receive mining tasks. They send back to the server partial proofs of work as well as full proofs of work, and the pool manager credits their account based on their contribution and the pool's revenue.

Currently, mining pools are much larger than they should be. A pool smaller than 5% can provide sufficient stability for a miner. But large pools sometimes get close to 50%, which can have serious consequences. Moreover, even pools smaller than 50% can break the system. As we will see below, it now turns out that this problem may resolve itself.

The Classical Block Withholding Attack

The classical block withholding attack is as old as pools themselves. It is an attack performed by pool participants to sabotage the revenue of the pool and its other participants. An attacking miner sends to the pool only partial proofs of work, but discards full proofs if it finds them. The pool therefore shares its revenue with the attacker, but does not benefit from its mining power. This reduces the revenue of all participants in the attacked pool, but also the revenue of the attacker itself, which could earn more by just mining fairly.

We note that a proof of work can only be used by the creator of the task. The attacker cannot repurpose it to collect any revenue.

Attack Strategy

A pool has many loyal miners that work on what the pool manager tells them to. A standard pool uses all its loyal miners for mining on its own behalf. An attacker, however, does the following: The manager uses some of its miners for its own mining, as usual. Concurrently, he infiltrates a victim pool by registering as a regular miner. He then receives mining tasks from the victim, and sends them to some its loyal miners. The mining power the attacker redirects towards the victim's tasks is called the infiltration rate and the miners are infiltrating miners. When the attacker receives partial proofs of work from its infiltrating miners, it sends them to the victim, which estimates their true mining power. However, when it receives full proofs of work from the infiltrating miners, it withholds and discards them, and thereby does not contribute to the victim's revenue (note that the miner could have used the infiltration rate for its own mining, so it incurs a cost of opportunity by diverting these miners). The victim pool is tricked into thinking that the infiltrating work force is doing effective mining and shares its revenue with the attacking pool. The attacker distributes its revenue from its own mining and from its infiltration among all its loyal miners.

The Pool Game

The revenue of the pools is influenced by several factors. A victim pool's effective mining rate is unchanged by an attack, but its total revenue is divided among more miners. An attacker's mining power is reduced, since some of its miners are used for block withholding, but it earns additional revenue through its infiltration of the other pool. And finally, the total effective mining power in the system is reduced, causing the Bitcoin protocol to reduce the difficulty.

Taking all these factors into account, we observe that, counter to one's intuition, a pool might be able to increase its revenue by diverting its mining power to attack other pools. Each pool therefore makes a choice of whether to attack each of the other pools in the system, and with what infiltration rate. This gives rise to the pool game.

The Miner's Dilemma

My analysis of the pool game shows that a pool can always increase its revenue by attacking an honest pool. Whatever the pool sizes may be. This is somewhat surprising: the attacker increases its profit by discarding proofs of work. As always in life and research, the devil is in the details, but here are two factors that are in the attacker's favor. First, he doesn't lose much by discarding proofs of work, since he still submits partial proofs of work to the infiltrated pool, and the victim pays back pretty well. Second, by reducing the overall effective mining power, the revenue of his own mining increases.

But what if the other pool retaliates? This is when things get even more interesting. If two pools attack each other (while the others are mining as usual), the pools should adjust their infiltration rates to their optimum. At this equilibrium point, neither pool can improve its revenue by using more or less miners to infiltrate the other. So the pools have a choice -- whether to attack by optimizing their revenue, or mine without attacking. This is a version of the prisoner's dilemma.

In the classical prisoner's dilemma two partners in crime have to decide whether to testify. If neither testifies, they both go to prison for a year. If one testifies, he is released and his partner is imprisoned for 5 years. If both testify, they are both imprisoned for 2 years. So testifying is a dominant strategy; a prisoner will be better off testifying whatever his partner does. However, if they follow the dominant strategy they end up in a tragedy of the commons where both are worse off than if neither testifies.

The situation in the pool's case is similar. If neither attacks, they both work fairly and their miners earn what they deserve. If one attacks, it improves its revenue, and the revenue of the other deteriorates. If both attack, at equilibrium, each earns less than if neither had attacked, but more than if only the other had attacked. Attacking is therefore a dominant strategy. A pool will improve its revenue by attacking, whether the other pool attacks or not.

Defenses

To hide the pool block withholding attack, an attacker can register with the victim pool as multiple miners, each with small mining power. Although the victim will realize he is under attack from his reduced revenue, it is difficult for him to realize which of his miners are attacking it. They all send partial proofs of work, but each seldom finds a full proof of work, therefore it takes a long time to have a statistically significant proof that blocks are withheld. This makes defense against block withholding difficult. The attack can also be performed anonymously, since pool registration typically requires only a Bitcoin address for revenue collection and / or an email address. The victim has no idea who his miners are.

Further reading and related work

The pool block withholding attack described here is distinct from and orthogonal to the selfish mining strategy. In block withholding attacks, blocks are discarded, whereas in selfish mining, they are just kept secret until the right time to publish them. Block withholding is done by infiltrating another pool whereas in selfish mining other miners are treated as opaque, or closed pools.

Pools use various methods to distribute their revenues among their participants. For the interested reader, Meni Rosenfeld's overview is a good start.

The bottom line

The analysis I outlined here shows that it is better for all pools to refrain from attacking. However, for short term profits, a pool might decide to attack its peers and break the balance. If the profits of open pools are reduced, miners will look for alternatives such as smaller, closed pools. They can get steady income from pools well below 10%, and they have only little incentive to use very large pools; it's mostly convenience and a feeling of trust in large entities.

The dismantling of overly large pools is one of the most important and difficult tasks facing the Bitcoin community. My analysis shows that short-term incentives can cause this dismantling to occur spontaneously, making the Bitcoin infrastructure more distributed, and so more robust and secure.