Selfish mining

From Bitcoin Wiki
Jump to navigation Jump to search

Selfish mining is a block-withholding strategy in which a miner or pool finds a block, keeps it private, and releases it later in order to orphan honest miners' competing blocks. The attacker then earns a larger share of block rewards than its fraction of hash power. The strategy was described by Ittay Eyal and Emin Gün Sirer in 2013 (Majority is not Enough). It is an incentive attack on Nakamoto consensus, not a cryptographic break.

Bitcoin's fork-choice rule is most accumulated work (often called longest chain). An honest miner publishes a block immediately so that the rest of the network builds on it. If two miners find a block at about the same height, a short fork occurs and one block is stale. Conventional analysis treated mining as incentive-compatible for any minority: the best strategy was to publish and to extend the heaviest known chain. Eyal and Sirer showed that a miner who withholds can, under a range of conditions, cause honest hash power to waste work on blocks that will be discarded, increasing the attacker's relative revenue.

The selfish miner maintains a private branch. When it finds a block, it does not announce it, and it continues mining on the private tip. If the private branch is one block ahead and an honest miner announces a competing block, the attacker publishes the private block immediately and the network races. The attacker's chance of winning the race depends on connectivity (the parameter γ in the paper: the fraction of honest miners who see the attacker's block first). If the private branch is two or more blocks ahead, the attacker can publish just enough blocks to overtake a public block when one appears, so that the honest block is always orphaned. If honest miners catch up completely before the attacker extends, the attacker may have to publish and accept a fair race.

Whenever an honest block is orphaned, the attacker has used honest work to increase its share of the remaining rewards. The paper showed that, with the original protocol and with γ = 1 (the attacker always wins ties), the strategy is profitable at arbitrarily small hash power. With more realistic γ, profitability typically requires a substantial fraction of hash power. No strategy of this family can be made unprofitable above one third of hash power. Eyal and Sirer's proposed countermeasure (randomizing among equal-work tips rather than preferring the first seen) raises the threshold toward one quarter if widely adopted. Bitcoin Core still prefers the first-seen equal-work block, so that particular fix is not deployed. Difficulty retargeting continues on the public chain of most work and does not by itself prevent the strategy.

Selfish mining is distinct from a majority attack. A majority miner can ignore the heaviest honest chain indefinitely. Selfish mining is a way for a minority (or a slim majority) to earn extra rewards and, if profitable enough, to attract more hash power. It is also distinct from block withholding against a pool (a miner submits no shares to the pool while using the pool's work). Practical detection is difficult because short forks occur naturally from propagation delay. Compact block relay (BIP 152) and well-connected peering reduce γ for a poorly connected attacker but do not change the strategy itself. Isolation attacks such as an Eclipse attack can improve an attacker's effective γ by controlling what the victim hears.

There is no Bitcoin Core feature called selfish mining. The client publishes blocks it finds. Academic simulators and later papers (including optimal selfish-mining strategies) study the attack. Public evidence of sustained selfish mining on Bitcoin mainnet at a scale that matches the theoretical strategy is not established in the literature the way the original vulnerability is.

See also

External links