The Bitcoin System

Bitcoin is a cryptocurrency that has recently emerged as a popular medium of exchange, with a rich and extensive ecosystem. The Bitcoin network runs at over 42 × 1018 FLOPS, with a total market capitalization around 1.5 billion US Dollars as of October 2013. Central to Bitcoin’s operation is a global, public log, called the blockchain, that records all transactions between Bitcoin clients. The security of the blockchain is established by a chain of cryptographic puzzles, solved by a loosely-organized network of participants called miners. Each miner that successfully solves a cryptopuzzle is allowed to record a set of transactions, and to collect a reward in Bitcoins. The more mining power (resources) a miner applies, the better are its chances to solve the puzzle first. This reward structure provides an incentive for miners to contribute their resources to the system, and is essential to the currency’s decentralized nature.

The Bitcoin protocol requires a majority of the miners to be honest; that is, follow the Bitcoin protocol as prescribed. By construction, if a set of colluding miners comes to command a majority of the mining power in the network, the currency stops being decentralized and becomes controlled by the colluding group. Such a group can, for example, prohibit certain transactions, or all of them. It is, therefore, critical that the protocol be designed such that miners have no incentive to form such large colluding groups. Empirical evidence shows that Bitcoin miners behave strategically and form pools. Specifically, because rewards are distributed at infrequent, random intervals, miners form mining pools in order to decrease the variance of their income rate. Within such pools, all members contribute to the solution of each cryptopuzzle, and share the rewards proportionally to their contributions.

To the best of our knowledge, so far such pools have been benign and followed the protocol. Indeed, conventional wisdom has long asserted that the Bitcoin protocol is incentive-compatible; that is, the best strategy of a rational minority pool is to be honest, and a minority of colluding miners cannot earn disproportionate benefits by deviating from the protocol. Because the protocol is believed to reward miners strictly in proportion to the ratio of the overall mining power they control, a miner in a large pool is believed to earn the same revenue as it would in a small pool. Consequently, there is no advantage for colluding miners to organize into ever-increasing pools. Therefore, pool formation by honest rational miners poses no threat to the system.

The conventional wisdom is wrong: the Bitcoin protocol, as prescribed and implemented, is not incentive-compatible. We describe a strategy that can be used by a minority pool to obtain more revenue than the pool’s fair share, that is, more than its ratio of the total mining power. The key idea behind this strategy, called Selfish Mining, is for a pool to keep its discovered blocks private, thereby intentionally forking the chain. The honest nodes continue to mine on the public chain, while the pool mines on its own private branch. If the pool discovers more blocks, it develops a longer lead on the public chain, and continues to keep these new blocks private. When the public branch approaches the pool’s private branch in length, the selfish miners reveal blocks from their private chain to the public. This strategy leads honest miners that follow the Bitcoin protocol to waste resources on mining cryptopuzzles that end up serving no purpose.

While both honest and selfish parties waste some resources, the honest miners waste proportionally more, and the selfish pool’s rewards exceed its share of the network’s mining power, conferring it a competitive advantage and incentivizing rational miners to join the selfish mining pool. Above a certain threshold size, the revenue of a selfish pool rises superlinearly with pool size above its revenue with the honest strategy. The implications of this statement are devastating for the system. Once a selfish mining pool reaches the threshold, rational miners will preferentially join selfish miners to reap the higher revenues compared to other pools. Such a selfish mining pool will quickly grow to become a majority, at which point the pool will be the only creator of blocks, the decentralized nature of the currency will collapse, and a single entity, the selfish pool manager, will control the system

Since a selfish mining pool that exceeds threshold size poses a threat to the Bitcoin system, we characterize how the threshold varies as a function of message propagation speed in the network. We show that, for a mining pool with high connectivity and good control on information flow, the threshold is close to zero. This implies that the Bitcoin system is safe only when 100% of the miners are honest. The first selfish miner will earn proportionally higher revenues than its honest counterparts, and the revenue of the selfish mining pool will increase superlinearly with pool size.