A New Outlook on the Profitability of Rogue Mining Strategies in the Bitcoin Network

BY KEYHUNTER 05.03.2025
A New Outlook on the Profitability of Rogue Mining Strategies in the Bitcoin Network

Many of the recent works on the profitability of rogue mining strategies hinge on a parameter called gamma ($\gamma$) that measures the proportion of the honest network attracted by the attacker to mine on top of his fork. These works, see \textsuperscript{GP18b} and \textsuperscript{GP18a}, have surmised conclusions based on premises that erroneously treat $\gamma$ to be constant. In this paper, we treat $\gamma$ as a stochastic process and attempt to find its distribution through a Markov analysis. We begin by making strong assumptions on gamma’s behaviour and proceed to translate them mathematically in order to apply them in a Markov setting. The aforementioned is executed in two separate occasions for two different models. Furthermore, we model the Bitcoin network and numerically derive a limiting distribution whereby the relative accuracy of our models is tested through a likelihood analysis. Finally, we conclude that even with control of 20% of the total hashrate, honest mining is the strongly dominant strategy.

2 Introduction

In this section we aim to explain various fundamental concepts used in our research below and how they are interrelated. To begin with, a description of the three rogue mining strategies investigated in this paper is warranted. Furthermore, the concept of a difficulty adjustment which is exploited in these strategies is of paramount importance. To accompany the aforementioned, it is also essential to explain the importance of \textit{gamma} in these strategies.

Mining a block entails “finding” the target cryptographic hash of the block. The target hash is a hash that begins with a predetermined number of zeros. A miner concatenates the version of the current Bitcoin software, the timestamp of the block, the root of its’ transaction’s merkle tree, the difficulty target and the nonce and inputs them in the SHA-256 hashing function to obtain an output. The nonce is the only variable quantity out of these six elements. Hence, the miner only varies the nonce and inputs it in the SHA-256 hashing function in the hopes of obtaining the target hash. “Obtaining the target hash” does not mean having the identical hash being output from the SHA-256 algorithm; it means obtaining a hash that has the same or more leading zeros. The difficulty is defined as the number of leading zeros contained in the target hash. The Bitcoin network demands a block be mined in 10 minutes and after 2016 blocks the network evaluates whether these blocks have been approximately mined in 20,160 minutes. The difficulty adjustment primarily depends on the number of miners or more precisely the hashing power of the sum of all miners. If the totality of the miners have taken more time to do so than the network adjusts the difficulty by reducing the number of leading zeros and if not the analogous occurs.

In this paper we make use of three rogue strategies. These are: Selfish Mining (SM), Least-Stubborn Mining (LSM) and Equal Fork Stubborn Mining (EFSM). The two latter ones are slight modifications of the popular Selfish Mining attack. SM is a strategy that targets the difficulty adjustment of the protocol by invalidating “honest” blocks through broadcasting a chain of secretly mined blocks which results in slowing down the network and hence the difficulty becomes easier even though the hashing power has not changed. Henceforth, the revenue of a miner per unit time increases. EFSM and LSM differentiate from SM only in terms of the timing on when the secret chain is revealed as well as the fact that the miner also has the choice to strategically reveal blocks instead of the entire chain when it comes to EFSM and LSM. For a complete description of the strategies we refer the reader to [GP18b] and [GP18a].

The parameter $\gamma$ appears when a fork between a rogue chain and an honest chain occurs (see [Nay+16]). In such scenarios, there exists a fraction of honest miners (in other words $\gamma$) that mine on top of the rogue chain. This parameter is instrumental in the investigation of the optimality of rogue mining strategies; thence, we investigate its behaviour in this paper.

3 Bitcoin Network

We are going to outline and motivate the construction of a Bitcoin network, mirroring many aspects of the existing network. This will be used as a proxy to test the relative fitness of our analytical Markov models for the distribution of $\gamma$.

Tools from graph theory will be used to construct a numerical model that will be used to stochastically simulate the Bitcoin network using a series of increasing times $\tau$ (see code excerpt 2), that represent the real times since the first instance where two nodes ping the network and the response in terms of $\gamma$ is recorded.

and stored in an array. By sampling from such a sequence, of times, we obtain a time series of values of $\gamma$, whence we compute the transition probabilities between optimal mining strategies in the Markov chain model for gamma, and as a by product, we get its limiting distribution (see code excerpt 1).

The nodes in the network are meant to correspond to mining pools across the world, each in a specific continent. The amount of nodes in each continent is determined by the fraction of the hash rate contributed to the Bitcoin network by each continent respectfully [Aok+19] (see code excerpt 7).

3.1 Construction

The Bitcoin network at any given time $t \geq 0$ will be modelled by a weighted graph

$$G_t = (V_t, E_t)$$

with $V_t = {1, 2, 3, \ldots, 100}$ vertices corresponding to nodes on the network, and $E_t = {{i, j} | \forall 1 \leq i < j \leq 100}$ edges, with a (stochastic – its precise nature will be explained later) weight function

$$W_t : E_t \to \mathbb{R}$$

that measures the latency of nodes between themselves in microseconds.

Key assumptions on the latencies between the nodes that will be explored further below are:

  • network topology
  • historical latency
  • skew normality of latency distribution
  • time separation between the measurements

To account for geographical separation between the nodes, values for the mean latencies between continents in the Bitcoin network in 2019 (see [Aok+19]) were used in the weights of the graph $G_t$.

Additionally, the topology of the network, that is the combinatorial properties of the underlying graph used to model the network itself (see [Tru13], p.76), will have an impact on the connectivity of the nodes therein. More specifically, the notion of eigenvalue centrality plays a crucial role in determining the weights of the network. The utility of this metric lies in that heuristically, nodes with high centrality are connected to proportionately more nodes with high scores [New08]. To make this mathematically precise, one takes the adjacency matrix of the graph upon initialisation of the graph’s weights in the simulation at a given time; some of the weights may take the value $1E7$, which is to be interpreted…

that the connection between the nodes is non existent at that moment. Then, one computes the adjacency matrix of the graph, defined by:

[ A_{ij} = \begin{cases} 1 & \text{if } W(i, j) < 1E7 \ 0 & \text{otherwise} \end{cases} ]

for ( {i, j} \in V ). This is then used to compute the centrality score vector ( \Omega ) which satisfies:

[ \lambda \Omega = A \Omega ]

which satisfies ( \Omega(i) \geq 0 ) for all ( i ) vertices in the graph and

[ \sum_{i \in V} \Omega(i) = 1 ]

We remark that its existence is guaranteed by the Perron-Frobenius Theorem [New08]. With regards to modelling latencies on the network, we observe that on a mining network following the Bitcoin protocol, the latencies follow a multimodal distribution (see [Gen+18], figure 3). For this reason, it will be assumed that the weights of the network will follow a skew-normal distribution with shape parameter ( \alpha ) depending on the combined eigenvector centrality of the nodes comprising an edge.

3.2 Modelling Assumptions

Before diving into the modeling assumptions, it is important to state that mining is a Markov process, see [GP20]. Let ( \gamma_n ) for ( n \in \mathbb{N} ) represent the process modelling ( \gamma ) in discrete time, and consider the modified stochastic process indexed by ( \mathbb{N} ):

[ X_n = \bigcup_{k \in T} 1_{A_k}(\gamma_n) : \mathbb{N} \rightarrow \Xi ]

where

[ 1_{A_k}(x) = \begin{cases} A_k & \text{if } x \in A_k, \ \emptyset & \text{otherwise} \end{cases} ]

and ( T \subset \mathbb{N} ), ( |T| < \infty ), and ( \Xi = { A_k : k \in T } ) such that

[ A_i \cap A_j = \emptyset \quad \forall i \neq j \in T ]

and ( \bigcup_{k \in T} A_k = [0, 1] ) For our following model to predict transition probabilities between strategies we require to satisfy the following ideas:

  1. The probability that ( \gamma ) jumps to an interval that is further away to be smaller than the probability of it jumping to interval nearby.
  1. The probability that $\gamma$ jumps to an interval with greater length to be greater than the probability that it jumps to an interval of smaller length.

The intuitive idea behind the above assumptions is the following. As mentioned previously $\gamma$ represents the proportion of people that follow our chain. We want the process of say a change of $\gamma = 0.2$ to $\gamma = 0.21$ to be more probable than a change from $\gamma = 0.2$ to $\gamma = 0.6$. In deed, it seems quite improbable that 20% of people following our chain turn to 60% compared to 21%. Furthermore, since we give $\gamma$ a range rather than a fixed value in the Markov models, it also makes sense that if we jump to greater range of $\gamma$ we are giving ourselves more leeway than if we confined ourselves to a very small one. The above assumptions can be mathematically stated as:

$$\mathbb{P}(X_{n_1} = [x_1, x_2] | X_{n-1} = [y_1, y_2]) \leq \mathbb{P}(X_{n_2} = [x_3, x_4] | X_{n-1} = [y_1, y_2]),$$

if

$$d_p([x_3, x_4], [y_1, y_2]) \leq d_p([x_1, x_2], [y_1, y_2]), \text{ and } d(x_1, x_2) = d(x_3, x_4)$$

Where $d_p(X, Y)$ is a metric defined in the following way:

$$d_p : \mathcal{P}([0, 1]) \times \mathcal{P}([0, 1]) \rightarrow \mathbb{N}$$

$$d_p([x_1, x_2], [y_1, y_2]) = d\left(x_1 + \frac{x_2 – x_1}{2}, y_1 + \frac{y_2 – y_1}{2}\right)$$

Where $d(., .)$ is the standard metric. Moreover, we also require

$$\mathbb{P}(X_{n_1} = [x_1, x_2] | X_{n-1} = [y_1, y_2]) \leq \mathbb{P}(X_{n_2} = [x_3, x_4] | X_{n-1} = [y_1, y_2]),$$

if

$$d_p([x_3, x_4], [y_1, y_2]) = d_p([x_1, x_2], [y_1, y_2]), \text{ and } d(x_1, x_2) \leq d(x_3, x_4)$$

4 Exploration of Models

4.1 1st Markov Model

Based on the above, the following probability model will be used to compute transition probabilities:

$$\mathbb{P}(X_n = [x_1, x_2] | X_{n-1} = [y_1, y_2]) = \frac{\int_{x_1}^{x_2} 1 – d_p([x_1, x_2], [y_1, y_2]) , dx}{\sum_{\xi \in \Xi} \int_{x_1}^{x_2} 1 – d_p([x_1, x_2], \xi) , dx} \quad (1)$$

The interval ([0, 1]) is partitioned into disjoint intervals as will be explained below which is represented by the set (\Xi); the denominator is a sum over all such disjoint intervals.

Fixing the collection of nodes applying this strategy at an hashrate of 20%, according to [GP18b], (\gamma) is partitioned in the following way:

[\Xi = {(0, 0.675], [0.675, 0.76], [0.76, 0.761], [0.761, 1]}]

The set (\Xi) as mentioned previously is the set encapsulating the way (\gamma) is partitioned in correspondence with the mining strategies. From left to right we have: honest mining (HM), selfish mining (SM), Lead-Stubborn mining (LSM), Equal Fork Stubborn mining (EFSM). We will compute the transition probabilities. The same process is analogously applied for all other states.

Representing the results in a transition matrix, we obtain

[ P_1 = \begin{bmatrix} 0.81 & 0.06 & 0 & 0.13 \ 0.59 & 0.12 & 0.01 & 0.28 \ 0.57 & 0.12 & 0 & 0.31 \ 0.5 & 0.11 & 0 & 0.39 \end{bmatrix} ]

The chain is irreducible therefore the limiting distribution (\pi) can be obtained by solving the following equation

[ \pi = \pi P_1 ]

The matrix (P_1) has rank equal to 3 which signifies that the solution has a dependency on one variable. This variable can be chosen to be unique since we require (\sum_{i=1}^{4} \pi_i = 1). Solving the above equation and taking into consideration the aforementioned we obtain the limiting distribution where each term is rounded to significant figures:

[ \pi_1 = \begin{pmatrix} 0.73 & 0.08 & 0 & 0.19 \end{pmatrix} ]

4.2 2nd Markov model

Upon exploring the first Markov model, we proceed with another candidate for the distribution of gamma. This will be motivated by choice of ‘Gaussian’, or squared exponential kernel

[ \kappa(x, y) = \exp \left( -\frac{1}{2} \left( \frac{x – y}{l} \right)^2 \right) ]

where ( l = \frac{1}{4} ) is chosen to be the characteristic length scale of the process ( \gamma_t ).

Once again, pertaining to the above assumptions, the transition probabilities will also be estimated as

[ \mathbb{P}(X_n = [x_1, x_2]|X_{n-1} = [y_1, y_2]) = \frac{\int_{y_1}^{y_2} \int_{x_1}^{x_2} \kappa(x, y) , dx , dy}{\int_{0}^{1} \int_{y_1}^{y_2} \kappa(x, y) , dx , dy} \quad (2) ]

Heuristically, this is used to determine how close two points have to be to influence each other significantly. This model allows for interiors of intervals to interfere with each other and make contributions to the total probability of a specific transition. Using figure 4.2 as a guide, one notices that the length scale ( l ) is chosen in a fashion such that if the separation of two points is greater than half the length of the domain of ( \gamma ), then, their contribution to the probability becomes minimal.

It is clear that the farther apart two disjoint intervals are, one possible way to gauge this is using their Hausdorff distance, the probability given by the model will be expected to be less than if the intervals were close so that the mean separation between points in the intervals is within the ‘support’ of the kernel.

Also, by the mean value theorem for integrals, one obtains up to a constant of proportionality that for intervals ([x_1, x_2]) and ([x’_1, x’_2])

[ P(X_n = [x_1, x_2] \mid X_{n-1} = [y_1, y_2]) \sim (x_2 – x_1) \int_{y_1}^{y_2} \kappa(\xi_1, y) , dy ]

[ P(X_n = [x’_1, x’2] \mid X{n-1} = [y_1, y_2]) \sim (x’_2 – x’1) \int{y_1}^{y_2} \kappa(\xi_2, y) , dy ]

where ( \xi_1 = (x_1, x_2) ) and ( \xi_2 \in (x’_1, x’_2) ). If now one chooses the above intervals such that ( d(\xi_1, [y_1, y_2]) \approx d(\xi_2, [y_1, y_2]) ), then the relative lengths of the intervals drives the relative behaviour of the probabilities of landing in said intervals.

Thus, the modelling assumptions laid out above are adequately addressed by this model.

The transition matrix and transition diagram are as follows:

[ P_2 = \begin{bmatrix} 0.84 & 0.07 & 0 & 0.09 \ 0.50 & 0.15 & 0.002 & 0.348 \ 0.43 & 0.16 & 0.002 & 0.408 \ 0.32 & 0.158 & 0.002 & 0.52 \end{bmatrix} ]

Applying the exact same procedure as we did with the previous stochastic matrix, we obtain the following limiting distribution

[ \pi_2 = \begin{pmatrix} 0.7 & 0.1 & 0 & 0.2 \end{pmatrix} ]

5 Numerical Results

In the simulation, the network will be sampled at constant intervals of length one unit of time, staying consistent with the first two Markov Models. Thus, in the above framework, we take $\tau$ to be

$$\tau = {0, 1, 2, \ldots, T – 1}$$

where $T$ is some predefined constant. For the transition probabilities, a value of $T = 1000$ will be used.

Below are the matrix of frequencies of each transition and the resulting transition probability matrix using $T = 5000$ samples; though a time series for $\gamma$ (see figure 5) with $T = 200$ is included for convenience.

$$N = \begin{bmatrix} 2977 & 205 & 0 & 690 \ 213 & 10 & 1 & 34 \ 8 & 1 & 0 & 6 \ 676 & 42 & 0 & 136 \end{bmatrix}$$

Useful information for enthusiasts:

Contact me via Telegram: @ExploitDarlenePRO