Incentive Compatibility of Bitcoin Mining Pool Reward Functions

Abstract

In this paper we introduce a game-theoretic model for reward functions in Bitcoin mining pools. Our model consists only of an unordered history of reported shares and gives participating miners the strategy choices of either reporting or delaying when they discover a share or full solution. We defined a precise condition for incentive compatibility to ensure miners strategy choices optimize the welfare of the pool as a whole. With this definition we show that proportional mining rewards are not incentive compatible in this model. We introduce and analyze a novel reward function which is incentive compatible in this model. Finally we show that the popular reward function pay-per-last-N-shares is also incentive compatible in a more general model.

Appendices

A Proofs

1.1 A.1 Proof of Lemma 1

For a reward function R, a player i has an incentive to report full solutions immediately, iff the following condition holds for all $\{\alpha _i\}_{i=1}^n, \mathbf{b}_t, D, i$:

$$\begin{aligned} \sum _{j=1}^n \alpha _j\cdot \left( R_i(\mathbf{b}_t + \mathbf{e}_j)-R_i(\mathbf{b}_t)\right) \ \le \ \frac{{\mathbb {E}}_{\mathbf{b}}\left[ R_i(\mathbf{b})\right] }{D} \, . \end{aligned}$$

(4)

Proof

$(\Rightarrow )$ This direction is straightforward: when it is beneficial to delay until 1 more share is reported, then there exists a profitable delay (namely $d=1$).

$(\Leftarrow )$ We need to prove that for all d, the following inequality holds:

$$\begin{aligned} \sum _{\mathbf{b}\text { s.t. }||\mathbf{b}||_1 = d}\Pr (\text {seeing }\mathbf{b})\cdot \left( R_i(\mathbf{b}_t + \mathbf{b}) - R_i(\mathbf{b}_t)\right) \ \le \ \frac{d}{D}{\mathbb {E}}_{\mathbf{b}}\left[ R_i(\mathbf{b})\right] \, . \end{aligned}$$

We prove this by induction on d, where the induction hypothesis is Eq. (2). For the base case $d=1$ the statement follows directly from condition (3). So consider the case $d>1$:

where the first inequality follows from condition (3), and the second from the induction hypothesis.   $\square$

1.2 A.2 Proof of Lemma 2

Miners report shares immediately if and only if the reward function R is monotonically increasing each component. That is: for all i, and $\mathbf{b}$:

$$\begin{aligned} R_i(\mathbf{b}+ \mathbf{e}_i) > R_i(\mathbf{b}) \, . \end{aligned}$$

Proof

Since the order or timing of shares does not matter, for analysis purposes we can assume the following scheme: as soon as a full solution is reported the pool operator asks all miners for the shares that they found. If the reward function R is monotonically increasing then each additional share that i reports increases her share, hence she will report all shares. Conversely, if R is not monotonically increasing at some $\mathbf{b}$, then if miner i has $b_i+1$ shares, and all other miners have reported shares according to $\mathbf{b}$, then she will not report her last share.

Now consider the original problem: when a miner finds a share, will she report it immediately? If she finds a share and the reward function is monotonically increasing, then reporting it immediately can only increase her reward, whereas delaying it may mean that someone else reports the full solution before she reports her share, in which case she loses the opportunity to report. Thus she will report immediately.   $\square$

1.3 A.3 Proof of Lemma 3

The proportional rule $R^\text {(prop)}_i(\mathbf{b}) = \frac{b_i}{||\mathbf{b}||_1}$ is not incentive compatible.

Proof

Instantiate (3) for the proportional rule. For the right hand side we have:

$$\begin{aligned} {\mathbb {E}}_{\mathbf{b}}\left[ R^\text {(prop)}_i(\mathbf{b},s)\right] /D&= \frac{1}{D}\sum _{k=1}^\infty \Pr [\text {full solution is found at }k^\text {th} \text { block}]\frac{{\mathbb {E}}[b_i | k]}{k}\\&= \frac{1}{D}\sum _{k=1}^\infty \left( 1-\frac{1}{D}\right) ^{k-1}\frac{1}{D}\frac{k\cdot \alpha _i}{k}\\&= \frac{\alpha _i}{D}\sum _{k=1}^\infty \left( 1-\frac{1}{D}\right) ^{k-1}\frac{1}{D}\\&= \frac{\alpha _i}{D} \, . \end{aligned}$$

Now for the left hand side. In the following let $k=||\mathbf{b}_t||_1$:

$$\begin{aligned}&\sum _{j=1}^n \alpha _j\cdot \left( R^\text {(prop)}_i(\mathbf{b}_t + \mathbf{e}_j)-R^\text {(prop)}_i(\mathbf{b}_t)\right) \\&= \alpha _i\cdot \left( \frac{b_i + 1}{k+1}\right) + (1-\alpha _i)\cdot \left( \frac{b_i}{k+1}\right) - \frac{b_i}{k}\\&= \frac{\alpha _ib_i + \alpha _i + b_i - \alpha _ib_i}{k+1} - \frac{b_i}{k}\\&= \frac{\alpha _i + b_i}{k+1} - \frac{b_i}{k}\\&= \frac{\alpha _i}{k+1} + b_i\left( \frac{1}{k+1} - \frac{1}{k}\right) \\&= \frac{\alpha _i}{k+1} - \frac{b_i}{k(k+1)}\\&= \frac{\alpha _i-\frac{b_i}{k}}{k+1} \, . \end{aligned}$$

Recall that for an incentive compatible scheme we need:

$$\begin{aligned} \frac{\alpha _i - \frac{b_i}{k}}{k+1}&\le \frac{\alpha _i}{D}\\ \alpha _i - \frac{b_i}{k}&\le \alpha _i\frac{k+1}{D}\\ \frac{b_i}{k}&\ge \alpha _i\left( 1 - \frac{k+1}{D}\right) \, . \end{aligned}$$

This condition is not guaranteed to be satisfied. In particular, for every $\alpha _i>0$ there exist positive values $b_i, k, D$ such that the condition is violated.    $\square$

1.4 A.4 Proof of Lemma 7

For the reward function $R^\text {(pplns)}$; a miner i reports shares immediately when her mining power $\alpha _i < 1-\frac{D}{N}$.

Proof

We directly calculate the expected revenue for delay versus reporting. When the miner decides to delay reporting a share until one more share/solution is found, she aims to move the sliding window of slots for which the share is eligible to receive reward one further into the future. This means that –as long as no other miner finds a full solution and reports it– the share is active for $N-1$ of the same slots, so any reward she receives from full solutions in those slots she will get regardless of her choice to report immediately versus delaying. On the upshot, it could be the case that the one additional slot she’s eligible for in the future yields a full solution. This will happen with probability 1 / D (since a share constitutes a full solution with probability 1 / D) and in that case the share gets an extra payout of 1 / N for the delayed share, yielding an expected benefit for delaying of 1 / ND.

However, there is also a risk associated with delaying. With probability $1-\alpha _i$ a share will be found by a different miner, and with probability 1 / D it will constitute a full solution. When this happens, miner i will no longer be able to report the share as it was discovered for a previous round. The expected value per share is 1 / D (as it’s active for N rounds, in which in expectation N / D full solutions will be reported for a value of 1 / N each) hence the expected harm for delaying the report is $(1-\alpha _i)\frac{1}{D^2}$.

So the miner will report the share immediately iff $\frac{1}{ND} < (1-\alpha _i)\cdot \frac{1}{D^2}.$ Plugging in $\alpha _i < \frac{D}{N}$ leads to $(1-\alpha _i)\cdot \frac{1}{D^2} \ge \frac{D}{N}\cdot \frac{1}{D^2} = \frac{1}{ND}$ so the condition holds, and miners report shares immediately.   $\square$

1.5 A.5 Proof of Lemma 8

For the reward function $R^\text {(pplns)}$; a miner i reports full solutions immediately when $N\ge D$.

Proof

In delaying a full solution, the hope is to get another share to report before the miner reports the full solution. This happens with probability $\alpha _1\cdot \frac{D-1}{D}$ (we need the share to not be a full solution) and the additional value to this share would be $\frac{1}{N}$ compared to it being reported after the full solution. However, while waiting for a share, with probability $\frac{1}{D}$ the next share will be a full solution, either found by miner i, or one of the other miners. Regardless of who finds the solution, the previous full solution that miner i was sitting on has become worthless: either a different miner reported the full solution ending the round and thus making the delayed full solution worthless, or miner i now has 2 full solutions of which she can report only one. When this happens, she loses the solution whose expected value is 1 / D (as this is counted as a share for future). So the expected upshot for delaying the solution is $\alpha _1\frac{D-1}{D}\frac{1}{N}$ and the expected harm is $\frac{1}{D^2}$.

In addition to this, when the miner chooses to delay until one more share is found, she lets all miners in the pool work on a block for which she already has a solution. If everyone were to spend that effort on a new block, that work would in expectation constitute 1 / D of the work for a new block, of which in expectation miner i would receive $\alpha _i$ of the reward. Thus, the opportunity cost is $\frac{\alpha _i}{D}$. Therefore, a miner will report a full solution immediately iff $\alpha _i\frac{D-1}{D}\frac{1}{N} - \frac{1}{D^2} \le \frac{\alpha _i}{D}$ which holds whenever $N\ge D$.

B Incentive Compatibility When Other Miners Can Find a Block Before You Report

In Sect. 3 we showed that there is a simple condition that precisely characterizes when a reward function R is incentive compatible, under the assumption that no other miner finds and reports a full solution during this delay. In reality a miner does have to take this possibility into account, so in this section we show exactly how the IC condition changes when we drop this assumption.

If we decide to delay reporting the full solution until one additional share is found, then with probability 1 / D that share will actually be a full solution itself. Without loss of generality we may assume that this solution will be reported immediately (otherwise we could simply ignore its effect). Recall that $\mathbf{b}_t$ is the number of reported shares per miner including the unreported full solution that miner i has, and that $\mathbf{e}_j$ is the vector that has zeros everywhere except its $j^\text {th}$ component, where it is 1. So the expected payout for delaying for one round becomes:

$$\begin{aligned} \frac{1}{D}\sum _j \alpha _j R_i(\mathbf{b}_t - \mathbf{e}_i + \mathbf{e}_j) + \frac{D-1}{D}\sum _j \alpha _j R_i(\mathbf{b}_t + \mathbf{e}_j) \, . \end{aligned}$$

Thus the condition of incentive compatibility is:

$$\begin{aligned} \frac{1}{D}\sum _j \alpha _j\left( R_i(\mathbf{b}_t - \mathbf{e}_i + \mathbf{e}_j) - R_i(\mathbf{b}_t)\right)&\\ +\ \frac{D-1}{D}\sum _j \alpha _j\left( R_i(\mathbf{b}_t + \mathbf{e}_j)- R_i(\mathbf{b}_t)\right)&\quad \le \quad \frac{{\mathbb {E}}_\mathbf{b}[R_i(\mathbf{b})]}{D} \, . \end{aligned}$$

For the reward functions that are monotonic increasing in each component (which by Lemma 2 are precisely the reward functions where miners always report all shares) this additional term is negative. Therefore, the IC condition is only easier to satisfy. This means that reward functions that are proven to be incentive compatible using Lemma 1 are still incentive compatible. However, one might worry that our proof that the proportional reward function is not incentive compatible might break. We show next that the thread of being scooped actually does not impact the result qualitatively.

1.1 B.1 Proportional

For the proportional reward function we can instantiate the left-hand side as (taking $||\mathbf{b}_t||_1=k$):

$$\begin{aligned}&\quad \frac{1}{D}\left( \alpha _i\left( \frac{b_i}{k} - \frac{b_i}{k}\right) + (1-\alpha _i)\left( \frac{b_i-1}{k} - \frac{b_i}{k}\right) \right) \\&+ \frac{D-1}{D}\left( \alpha _i\left( \frac{b_i+1}{k+1} - \frac{b_i}{k}\right) + (1-\alpha _i)\left( \frac{b_i}{k+1} - \frac{b_i}{k}\right) \right) \\&= \frac{1}{D}\frac{1-\alpha _i}{k} + \frac{D-1}{D}\frac{\alpha _i-\frac{b_i}{k}}{k+1} \, . \end{aligned}$$

So the proportional reward function is IC if and only if

$$\begin{aligned} \frac{1}{D}\frac{1-\alpha _i}{k} + \frac{D-1}{D}\frac{\alpha _i-\frac{b_i}{k}}{k+1} \le \frac{\alpha _i}{D} \, . \end{aligned}$$

Again this is not guaranteed to be satisfied, in fact the same parameters as last time, i.e. $b_i=2$, $k=10$, $\alpha _i=1/2$ and $D=20$. So including the possibility of another miner finding a full solution does not qualitatively change the incentive compatibility results, although quantitatively there may be situations where a miner would choose to delay if she does not fear being scooped, but choose to report if she does include this possibility.

C Multiple Pools

In the main text we’ve assumed that there are no other pools that compete for finding solutions to the cryptographic puzzle. This is reasonable from the perspective of proving positive results: any incentive compatible scheme should be incentive compatible regardless of how much mining power other pools have.

However, to convincingly reject the proportional rule as not incentive compatible, we should take the effect of other pools into account. In the following let $\sum _{i=1}^n\alpha _i = \alpha _P<1$ be the total mining power of the pool, so all other mining power —of both other pools and solo miners— is $1-\alpha _P$. For notational simplicity we do not consider being scooped by a different miner in our own pool; it’s obvious how this can be included by comparing the results to the one in Appendix B. When we consider to delay reporting a full solution until one more share is found —either inside or outside the pool— then our expected utility for doing so is

$$\begin{aligned} \sum _j \alpha _j R_i(\mathbf{b}_t + \mathbf{e}_j) + (1-\alpha _P)\left( \frac{1}{D}\cdot 0 + \frac{D-1}{D}R_i(\mathbf{b}_t)\right) \, . \end{aligned}$$

We don’t really care if some other pool finds another share. This does not affect us. But if another pool finds a full solution and reports it, then our mining pool misses out on a complete payment that it could have received. So the condition for incentive compatibility becomes

$$\begin{aligned} \sum _{j=1}^n \alpha _j\cdot \left( R_i(\mathbf{b}_t + \mathbf{e}_j)-R_i(\mathbf{b}_t)\right) - (1-\alpha _P)\frac{R_i(\mathbf{b})}{D}\ \le \ \alpha _P\frac{{\mathbb {E}}_{\mathbf{b}}\left[ R_i(\mathbf{b}_t)\right] }{D} \, . \end{aligned}$$

Under the assumption that the pool in expectation will collect $\alpha _P$ of the total reward among pools, and that miner i collects $\frac{\alpha _i}{\alpha _P}$ of the pool she is in, the right-hand side will remain $\frac{\alpha _i}{D}$. The new term on the left-hand side is simply $(1-\alpha _P)\frac{b_i}{kD}$. The other term on the left-hand side changes slightly:

$$\begin{aligned}&\sum _{j=1}^n \alpha _j\cdot \left( R^\text {(prop)}_i(\mathbf{b}_t + \mathbf{e}_j)-R^\text {(prop)}_i(\mathbf{b}_t)\right) \\&= \alpha _i\cdot \left( \frac{b_i + 1}{k+1}\right) + (\alpha _P-\alpha _i)\cdot \left( \frac{b_i}{k+1}\right) - \frac{b_i}{k}\\&= \frac{\alpha _ib_i + \alpha _i + \alpha _Pb_i - \alpha _ib_i}{k+1} - \frac{b_i}{k}\\&= \frac{\alpha _i + \alpha _Pb_i}{k+1} - \frac{b_i}{k} \,. \end{aligned}$$

This cannot be simplified to the same convenient expression we had in Sect. 3. Combining these terms the condition for incentive compatibility of the proportional reward function becomes:

$$\begin{aligned} \frac{\alpha _i + \alpha _Pb_i}{k+1} - \frac{b_i}{k} - (1-\alpha _P)\frac{b_i}{kD} \le \frac{\alpha _i}{D} \end{aligned}$$

and after rewriting this:

$$\begin{aligned} \frac{\alpha _i}{k+1} +\alpha _Pb_i\left( \frac{1}{kD}+\frac{1}{k+1}\right) - \frac{b_i}{k}\left( 1+\frac{1}{D}\right) \le \frac{\alpha _i}{D} \, . \end{aligned}$$