Sending Spies as Insurance Against Bitcoin Pool Mining Block Withholding Attacks

Abstract

Theoretical studies show that a block withholding attack is a considerable weakness of pool mining in Proof-of-Work consensus networks. Several defense mechanisms against the attack have been proposed in the past with a novel approach of sending sensors suggested by Lee and Kim in 2019. In this work we extend their approach by including mutual attacks of multiple pools as well as a deposit system for miners forming a pool. In our analysis we show that block withholding attacks can be made economically irrational when miners joining a pool are required to provide deposits to participate which can be confiscated in case of malicious behavior. We investigate minimal thresholds and optimal deposit requirements for various scenarios and conclude that this defense mechanism is only successful, when collected deposits are not redistributed to the miners.

A Proof of Theorems

1.1 A.1 Proof of Theorem 1

Proof

(Theorem 1). If no attacks occur in the network both $x=y=0$ by definition. Plugging both in into Definition 1 we get

$$ D_A = \frac{m \alpha - m \alpha x}{m - m \alpha x - m \beta y} =\frac{m \alpha }{m} = \alpha $$

and

$$ D_B = \frac{m \beta - m\beta y}{m - m \alpha x - m \beta y} = \frac{m \beta }{m} = \beta $$

which respecting Definition 2 yields

$$R_A = \frac{D_A + m \alpha x R_B}{m \alpha + m \beta y} = \frac{\alpha }{m \alpha } = \frac{1}{m} $$

and

$$R_B = \frac{D_B + m\beta y R_A}{m \beta + m \alpha x} = \frac{\beta }{m \beta } = \frac{1}{m}. $$

Due to Definition 3 we get $E_A = E_B = 1$.

1.2 A.2 Proof of Theorem 2

Proof

(Theorem 2). For $x > 0$ and $y=0$ plugging in into 1 yields

$$D_A = \frac{m \alpha - m \alpha x}{m - m \alpha x - m \beta y}= \frac{m \alpha - m \alpha x}{m - m \alpha x}= \frac{m (\alpha - \alpha x)}{m (1 - \alpha x)}= \frac{\alpha (1-x)}{1-\alpha x}$$

and

$$D_B =\frac{m \beta - m\beta y}{m - m \alpha x - m \beta y} = \frac{m \beta }{m - m \alpha x} = \frac{m \beta }{m (1 - \alpha x)} = \frac{\beta }{1 - \alpha x}$$

which again can be inserted into 2 and thus since $y=0$ then $R_B$ reduces to

$$ R_B = \frac{D_B + m\beta y R_A}{m \beta + m \alpha x} = \frac{\frac{\beta }{1 - \alpha x} }{m (\beta + \alpha x)} = \frac{\beta }{1 - \alpha x} \cdot \frac{1}{m (\beta + \alpha x)} = \frac{\beta }{m \beta +m \alpha x - m \beta \alpha x - m \alpha ^2 x^2} $$

which can be plugged into $R_A$

$$\begin{aligned} R_A= & {} \frac{D_A + m \alpha x R_B}{m \alpha + m \beta y} = \frac{\frac{\alpha (1-x)}{1-\alpha x} + m \alpha x \frac{\beta }{1 - \alpha x} \cdot \frac{1}{m (\beta + \alpha x)}}{m \alpha } \\= & {} ( \frac{\alpha (1-x)}{1-\alpha x} + m \alpha x \frac{\beta }{1 - \alpha x} \cdot \frac{1}{m (\beta + \alpha x)} ) \cdot \frac{1}{m \alpha } \\= & {} ( \frac{\alpha (1-x)}{1-\alpha x} \cdot \frac{m (\beta + \alpha x)}{m (\beta + \alpha x)} + \frac{ m \alpha x \beta }{1 - \alpha x} \cdot \frac{1}{m (\beta + \alpha x)} ) \cdot \frac{1}{m \alpha } \\= & {} ( \frac{\alpha (1-x) \cdot m (\beta + \alpha x) + m \alpha x \beta }{(1-\alpha x) \cdot m (\beta + \alpha x) } ) \cdot \frac{1}{m \alpha } \\= & {} ( \frac{(\alpha - \alpha x) \cdot (m \beta + m \alpha x) + m \alpha x \beta }{(1-\alpha x) \cdot m (\beta + \alpha x) } ) \cdot \frac{1}{m \alpha } \\= & {} ( \frac{m \beta \alpha - m \beta \alpha x - m \alpha ^2 x^2 + m \alpha ^2 x + m \alpha x \beta }{(1-\alpha x) \cdot m (\beta + \alpha x) } ) \cdot \frac{1}{m \alpha } \\= & {} ( \frac{m \alpha ( \beta - \alpha x^2 + \alpha x)}{(1-\alpha x) \cdot m (\beta + \alpha x) } ) \cdot \frac{1}{m \alpha } \\= & {} \frac{ \beta - \alpha x^2 + \alpha x}{(1-\alpha x) \cdot m (\beta + \alpha x) } \end{aligned}$$

and therefore both efficiencies compute as:

$$ E_A=mR_A = m \cdot \frac{ \beta - \alpha x^2 + \alpha x}{(1-\alpha x) \cdot m (\beta + \alpha x)} = \frac{ \beta - \alpha x^2 + \alpha x}{(1-\alpha x) (\beta + \alpha x)} $$

and

$$ E_B = m R_B = m \cdot \frac{\beta }{(1 - \alpha x)\cdot m (\beta + \alpha x)} = \frac{\beta }{(1 - \alpha x) (\beta + \alpha x)} $$

This shows that $E_A>E_B$ because

$$\begin{aligned} E_A-E_B> & {} 0 \\ \frac{ \beta - \alpha x^2 + \alpha x}{(1-\alpha x) (\beta + \alpha x)} - \frac{\beta }{(1 - \alpha x) (\beta + \alpha x)}= & {} \\ \frac{ \alpha ( x - x^2)}{(1-\alpha x) (\beta + \alpha x)}> & {} 0 \end{aligned}$$

This is true because $( x - x^2)>0$ as $x<1$. This further shows that $E_B < 1$ because:

$$\begin{aligned} E_B= & {} \frac{\beta }{(1 - \alpha x) (\beta + \alpha x)} \\= & {} \frac{\beta }{ \beta + \alpha x - \beta \alpha x + \alpha ^2 x^2} \\= & {} \frac{\beta }{ \beta + \underbrace{\alpha x}_{>0} \underbrace{( 1 - \beta + \alpha x)}_{>0}} < 1 \end{aligned}$$

since the denominator is greater than the numerator. Further we show when $E_A>1$:

$$\begin{aligned} E_A> & {} 1 \\ \frac{ \beta - \alpha x^2 + \alpha x}{(1-\alpha x) (\beta + \alpha x)}> & {} 1 \\ \frac{ \beta - \alpha x^2 + \alpha x}{\beta - \beta \alpha x + \alpha x - \alpha ^2 x^2}> & {} 1 \\ \beta - \alpha x^2 + \alpha x> & {} \beta - \beta \alpha x + \alpha x - \alpha ^2 x^2 \\ - \alpha x^2> & {} - \beta \alpha x - \alpha ^2 x^2 \\ 0> & {} - \beta \alpha x - \alpha ^2 x^2 + \alpha x^2 \\ 0> & {} x (- \beta \alpha - \alpha ^2 x + \alpha x) \\ \end{aligned}$$

which is the case when

$$\begin{aligned} 0> & {} - \beta \alpha - \alpha ^2 x + \alpha x \\ \beta \alpha> & {} x (- \alpha ^2 + \alpha ) \\ \frac{\beta \alpha }{- \alpha ^2 + \alpha }> & {} x \\ x< & {} \frac{\beta \alpha }{\alpha (1 - \alpha )} = \frac{\beta }{ (1 - \alpha )} \end{aligned}$$