「Zhikuang University Q&A」What is a block withholding attack?

Question from @The Secret That Cannot Be Told:

What is a block withholding attack, and why is it said that it causes losses to the mining pool without harming the interests of miners?

Answer from Zhikuang University editor @OWEN :

There are two types of block withholding attacks. One is an attack launched for "double spending" and was proposed by Hal Finney, the first recipient of Bitcoin chain transactions. Therefore, this attack is also called "Finney attack."

The second type of block withholding attack is when miners find a legitimate block and then withhold it privately without publishing it to the public. @The question of a secret that cannot be told refers to this type of block withholding attack. Let’s introduce this type of block withholding attack.

01
Block Withholding Attack

To talk about block deduction attacks, we have to start with the concept of mining pools. Zhikuang University introduced in "What are Bitcoin mines and mining pools?" :

The mining pool is equivalent to the project manager, and the computing power connected to the mining pool is the project team members who obey the work arrangements of the project manager. The project is mining, and finding a solution that meets the requirements of the Bitcoin system as soon as possible. All project team members advance their work tasks according to the arrangements of the project manager and submit their work results. The project manager rewards project members according to the specific situation of completing their tasks in a "more work, more pay" manner.

The problem with block withholding attacks lies in the submission of work results.

For a single miner, finding a solution that meets the requirements of the Bitcoin system is an extremely low probability event. In order to better measure the workload of miners, the mining pool will set a reasonable threshold for miners to submit work results (Share).

The mining process is similar to a game of tossing 256 coins. Suppose the system stipulates that to mine a new block, at least 20 consecutive coins must be facing up starting from the first coin. This difficulty is too difficult for a single miner. In order to better measure the workload of the miners, the mining pool stipulates that as long as the miner has at least 10 consecutive coins facing up starting from the first coin, it will be counted as the miner's effective proof of work.

A block withholding attack is when a malicious miner finds a result that meets the requirements of the mining pool but does not meet the requirements of the Bitcoin system. The miner submits a proof of work to the mining pool as normal; once the miner obtains a result that meets the requirements of the Bitcoin system, that is, when the block is actually mined, the miner withholds the result privately and does not submit it to the mining pool, causing the mining pool to lose the corresponding reward .

02
The dangers of block deduction attacks

Block deduction attacks are very harmful to mining pools. After the third halving, one block was deducted, resulting in a loss of 6.25 BTC (ignoring the miner fee), which is about ¥400,000 at the current price. Mining pools continue to suffer block deduction attacks, and the mining pool's luck value is long-term low, resulting in huge losses, and serious cases may even lead to the closure of the mining pool.

Why is it said that launching a block deduction attack will have almost no impact on malicious miners? This starts with the settlement method of the mining pool. The current mainstream settlement methods are FPPS and PPS+. The mining pool settles the income for the miners based on the proof of work submitted by the miners, that is, according to the theoretical output.

Malicious miners who want to launch a "block deduction attack" on the mining pool will definitely choose this settlement method. For malicious miners, the frequency ratio of submitting proof of work (Share) that meets the requirements of the mining pool and submitting proof of work that meets the requirements of the Bitcoin system is quite different. It is roughly estimated that the former is hundreds of thousands of times the latter. In other words, miners have to submit hundreds of thousands of proofs of work to the mining pool before they have the chance to encounter a block deduction attack. 100,000 valid workloads become 99,999,000 times , and the impact on miners' income can be ignored. Although the frequency of this behavior is very low, each time it is a loss of hundreds of thousands of yuan, which is particularly harmful to the mining pool.

▲Diagram of the frequency of block deduction attacks launched by miners

So the question is, why do miners launch block deduction attacks, which is a "harmful to others and not beneficial to themselves" behavior? The answer is the vicious competition between mining pools . Mining pools are a very competitive track. In order to bring down competitors, some mining pools will "undercover" their computing power in other mining pools, intending to launch block deduction attacks, causing economic losses to the other party and weakening the strength of competitors.

▲ Shenyu once publicly criticized this malicious competition on Weibo

03
Can block withholding attacks be prevented?

Due to the underlying Bitcoin protocol, mining pools currently have no effective means of preventing block deduction attacks at a technical level. Mining pools can only check the block output of individual users after noticing an abnormal luck value. If it is found that the block output data of some users is significantly lower than the average level, these miners with obvious suspicion will be removed from the mining pool. Of course, this approach may lead to wrong killings, and miners who have not launched block deduction attacks will be judged as malicious miners, but in order to cut losses, mining pools can only kick suspected miners out of the mining pool, which is also a last resort.

The mining pool can prevent miners from launching block deduction attacks by changing the distribution model of income. The mining pool changes the distribution model from PPS to PPLNS. Under the PPLNS distribution model, the relationship between the mining pool and the miners is equivalent to that between the company and the company's partners. The partners and the company share a common destiny, and their profits and losses are synchronized with the company.

In this case, the mainstream distribution model of mining pools is PPS instead of PPLNS? Due to space limitations, we will not expand on this here, and will find an opportunity to analyze it later.

Thanks to Li Shisheng and Lightning for their guidance on this article.