On the Instability of Bitcoin Without the Block Reward

Bitcoin provides two incentives for miners: block rewards and transaction fees. The former accounts for the vast majority of miner revenues at the beginning of the system, but it is expected to transition to the latter as the block rewards dwindle. There has been an implicit belief that whether miners are paid by block rewards or transaction fees does not affect the security of the block chain. We show that this is not the case. Our key insight is that with only transaction fees, the variance of the block reward is very high due to the exponentially distributed block arrival time, and it becomes attractive to fork a "wealthy" block to "steal" the rewards therein. We show that this results in an equilibrium with undesirable properties for Bitcoin's security and performance, and even non-equilibria in some circumstances. We also revisit selfish mining and show that it can be made profitable for a miner with an arbitrarily low hash power share, and who is arbitrarily poorly connected within the network. Our results are derived from theoretical analysis and confirmed by a new Bitcoin mining simulator that may be of independent interest. We discuss the troubling implications of our results for Bitcoin's future security and draw lessons for the design of new cryptocurrencies.

[1]  Kartik Nayak,et al.  Stubborn Mining: Generalizing Selfish Mining and Combining with an Eclipse Attack , 2016, 2016 IEEE European Symposium on Security and Privacy (EuroS&P).

[2]  Rob Jansen,et al.  Shadow-Bitcoin: Scalable Simulation via Direct Execution of Multi-threaded Applications , 2015, IACR Cryptol. ePrint Arch..

[3]  Peter Auer,et al.  The Nonstochastic Multiarmed Bandit Problem , 2002, SIAM J. Comput..

[4]  Aviv Zohar,et al.  Optimal Selfish Mining Strategies in Bitcoin , 2015, Financial Cryptography.

[5]  Emin Gün Sirer,et al.  Majority is not enough , 2013, Commun. ACM.

[6]  Tyler Moore,et al.  Game-Theoretic Analysis of DDoS Attacks Against Bitcoin Mining Pools , 2014, Financial Cryptography Workshops.

[7]  P. Rizun A Transaction Fee Market Exists Without a Block Size Limit , 2016 .

[8]  Nicolas Courtois,et al.  On Subversive Miner Strategies and Block Withholding Attack in Bitcoin Digital Currency , 2014, ArXiv.

[9]  Ghassan O. Karame,et al.  Evaluating User Privacy in Bitcoin , 2013, Financial Cryptography.

[10]  Sanjeev Arora,et al.  The Multiplicative Weights Update Method: a Meta-Algorithm and Applications , 2012, Theory Comput..

[11]  S. Hart,et al.  A Simple Adaptive Procedure Leading to Correlated Equilibrium , 1997 .

[12]  Rainer Böhme,et al.  Trends, Tips, Tolls: A Longitudinal Study of Bitcoin Transaction Fees , 2014, Financial Cryptography Workshops.

[13]  Meni Rosenfeld,et al.  Analysis of Bitcoin Pooled Mining Reward Systems , 2011, ArXiv.

[14]  Jason Teutsch,et al.  Demystifying Incentives in the Consensus Computer , 2015, CCS.

[15]  Joshua A. Kroll,et al.  The Economics of Bitcoin Mining, or Bitcoin in the Presence of Adversaries , 2013 .

[16]  Yishay Mansour,et al.  From External to Internal Regret , 2005, J. Mach. Learn. Res..

[17]  The Economics of Bitcoin Transaction Fees , 2014 .

[18]  Tyler Moore,et al.  Empirical Analysis of Denial-of-Service Attacks in the Bitcoin Ecosystem , 2014, Financial Cryptography Workshops.

[19]  Ittay Eyal,et al.  The Miner's Dilemma , 2015, 2015 IEEE Symposium on Security and Privacy.

[20]  Manfred K. Warmuth,et al.  The Weighted Majority Algorithm , 1994, Inf. Comput..

[21]  Aggelos Kiayias,et al.  Blockchain Mining Games , 2016, EC.

[22]  R. Vohra,et al.  Calibrated Learning and Correlated Equilibrium , 1996 .