Princeton University researchers: Bitcoin will face major security issues after block rewards are cancelled (paper download)

Note: The author of this article, Arvind Narayanan, is a computer scientist and an assistant professor at Princeton University, specializing in data deanonymization.

Miles Carlsten, Harry Kalodner, and Matt Weinberg and I co-authored a paper titled "On the instability of Bitcoin without the block reward" (download the full text on Coin Library). In this paper, we pointed out that once miners' income is completely transferred from block rewards to transaction fees, the mining reward mechanism will be completely messed up. The theoretical analysis in the paper is almost completely consistent with the conclusions drawn by our Bitcoin mining simulation equipment.

Bitcoin miners have two sources of income: block rewards and transaction fees. Currently, miners' income mainly comes from block rewards. But as these rewards gradually decrease, in the long run, most of their income will still come from transaction fees. This model has been discussed and tested a lot, but the relevant research is only based on monetary policy, not security. People subconsciously assume that the change in miners' income will not affect the security and stability of the blockchain. For them, it doesn't matter whether the 25 BTC (for example) is a fixed reward or a transaction fee.

We repeatedly tested this hypothesis in the paper, but the final result still shows that it is not conducive to the security of Bitcoin and many other cryptocurrencies. Our main point is that when miners can only rely on transaction fees, their income will become very unstable because there is randomness in the block generation time. At that time, miners are likely to fork "rich" blocks (blocks involving higher transaction amounts) and "steal" rewards from them.

The problem here is not caused by the high or low transaction fees, but by the randomness of block generation. In our experiments, we simulated the generation of transaction fees and the fees were consistent; in the real world, the fees are not consistent and the situation is more complicated. A common theme throughout our paper is that even the simplest simulations produce worrying results. This is definitely bad news because we think that in the real world, things will behave much worse, and we hope that the problems with cryptocurrency mining can be solved through analysis and simulation. But in our experiments, the results are more complicated than we thought.

Now let me talk about the problems caused by the cancellation of block rewards. Since the possibility of forks exists, the default strategy (reward) no longer applies; we show a lot of interesting alternative strategies in the paper. The most worrying phenomenon at present is "undercutting", where miners steal transaction fees that are relatively small, so they are difficult to track, and other miners in the mining pool are more inclined to increase the number of transactions in the block rather than re-create the block.

After transaction fees completely replace block rewards, the phenomenon of selfish mining will become more and more serious. Especially when the following situation occurs: suppose you have successfully created a block and are now mining a new block, but the transaction fee is zero, so you may think that you might as well use this block for selfish mining. When the block reward is fixed, this trick does not make sense; however, once the block reward is cancelled and the transaction fee becomes unstable, miners are likely to have the idea of ​​selfish mining.

Once miners have these ideas, mining power will be wasted on constant forks, excessive cuts and block generation delays, and the blockchain will become no longer secure.

Our conclusions were drawn from two approaches: first, theoretical analysis, or game theory (which studies the interactions between formalized incentive structures); and second, simulations of the mining process, which gave us greater confidence in our experimental results. For example, in one setting, the theoretical analysis showed that the Lambert W function was in equilibrium, and several pages of the paper are devoted to this; and in the simulations with the same conditions, the miners in the Lambert W setting performed the best. We hope that our theoretical analysis techniques and simulation setup will be helpful to other researchers. Our simulator code is now open source.

What are the implications of our findings? In order to ensure long-term development, the Bitcoin community must address this issue , most likely by forking the network to prevent the above malicious behavior. We are not saying that these malicious strategies will emerge in the short term, but we are saying that in the long run, it is time to take appropriate measures to gradually solve these problems. In fact, the current block size limit of 1MB and the increasing transaction volume can reduce the difference in transaction fees between blocks to a certain extent, thus alleviating the above problems, but it is not a perfect solution. For example, at the time of publishing this article (original text), the transaction fees of the latest 1000 blocks ranged from 0.03 BTC to 4.51 BTC, with an average of 0.49 BTC and a standard deviation of 0.25 BTC. Therefore, simply limiting the block size will not solve the above problems.

At a deeper level, our results overturn the traditional role of block rewards in cryptocurrency systems. The community generally believes that block rewards are necessary in this environment without a central authority, but they are only a temporary and even harmful way to initially distribute the currency. The transaction fee model is seen as the ideal state for system stability. However, our research shows that transaction fees are more difficult to gain acceptance from miners than block rewards. Therefore, creators of new cryptocurrencies should ensure the durability of block rewards and accept the fact of inflation; transaction fees can exist at the same time, but they should only be used as an additional reward for miners to package block transactions.

One final note: There is a lot of science in the design of economic incentives, a discipline called mechanism design. Only reasonable designs can keep participants in line. Every cryptocurrency creator (including the creators of blockchain applications like DAO) is doing mechanism design. But this type of design is not simple, and there have been many papers pointing out the flaws in cryptocurrency mechanism design long before us. However, sadly, the cryptocurrency community and the mechanism design community are completely separate. This is why I am excited that mechanism design expert Matt Weinberg has joined Princeton University. In this paper, he puts forward a lot of complex theories. Stay tuned for more cryptocurrency design research!