I still need to research if score-PPLNS works exactly the way I think. But the idea is as sirky said - each share gets a score of 1/difficulty, and the fixed quantity is the total score. So you can set S=2 which means that the number of shares is twice the difficulty, and if the difficulty changed mid-round you take shares up to a total score of 2.

That discussion started here.

LaTeX indeed. I've uploaded a new version, is this what you wanted?

You could just update future shares. But let's not make it too complicated.

Not sure what you mean by "real time", but it's not designed to allow the parameters to change mid-round (though it should be possible with the proper rescaling). You should only change them between rounds (ie, do a change that will take effect starting with the next round).

Right.

Yes, but only if Alice can be trusted not to give in to scams.

Alice can't get the Z back anyway, so compared to following through with the payment, it only costs her X.

How about this. There is a box in which there are two types of coins, "deposit" and "payment". Both parties have permission to open the box. When the box is opened, the deposits go to whoever put them, and the payment goes to the party other than the one who opened it.

So first the buyer and seller both put a small deposit in the box. This is safe since they can get it back. Then the buyer puts the entire sum of the payment in the box. Now:

1. If the seller sends the goods, the buyer will open the box and the seller will receive the funds. He is incentivized not to be lazy or spiteful because he wants his deposit back.
2. If the seller for any reason wants to back out of the deal, he can open the box and have the payment return to the buyer, and is incentivized to do so because he wants his deposit back.
3. If the seller goes with the "reimbursement" plot, the buyer knows he is scamming (since the seller should have just opened the box) and ignore the request. (There is a potential weakness in that the buyer can "defect" and open the box anyway, to get the deposit. This may be alleviated by having the buyer's deposit smaller than the seller's, giving him more bargaining power).
4. A fraudulent seller is not incentivized to try this on N people until it succeeds, since every failure costs him his deposit. Hence, scenario 3 in which the money is burned should very rarely happen.

In any case this isn't supposed to be bullet-proof, just a significant extra protection for sellers who already pass the sniff-test.

Additionally, the box can specify a charity address, agreed upon by both parties, to which the buyer has permission to send all funds, deposits and payment. So in the worst case the money will go to charity.

I'm not sure about the technical implementation details but all this should be very doable.

Only when you receive payment to the address currently selected which appears in the "your bitcoin address" box.

I am happy to announce that after a hiatus of more than a month, Bitcoil is back in business, and with a new design courtesy of Crobbo. If you want to buy or sell bitcoins, and have a bank account in Israel, you're welcome to contact me.

However, as much as I would have wanted to say that the legal concerns are all behind us, and it's "warp speed ahead" from now on, in reality Bitcoil is now at best "not illegal". Bitcoin exchanging in Israel seems to be in legal limbo - the activity pattern is prone to be conducive to money laundering, and hence banks frown upon allowing it without a currency exchange license; but it is not legally a currency, in fact it is legally unprecedented, and hence it seems unlikely that such a license would be granted. Until the matter is clarified one way or the other, I'll need to keep a low profile to avoid raising any red flags.

Thanks for the positive comments. My motivation to work on this is directly related to how useful people consider it. But I have some much bigger things right now so it might take a while.

I agree that PPLNS is a wonderful method and I'll get to it. I need to write the sections in order to get the logical flow right.

I apologize for calling ESMPPS "broken" which was too confrontational. I resent your accusations. If my advice isn't welcome I'll stop wasting my time.

Did you make any attempt to adjust the parameters?

Anyway, you could have used PPLNS which has very little variance and isn't broken.

... And your payouts from the pool will also go down at the exact same time (assuming it is hopping-proof). So this has no bearing on your expected payouts solo vs. pool.

Not really. Difficulty increases have very little to do with it (though when making projections of whether you can take the variance you may want to consider that the variance will increase in the future). It is always the case that solo mining has the same expectation (without fees) and higher variance. And, if it takes a week to find a block, it will take years until your payouts will be anywhere near the statistical average.

It's growth in the score of new shares, but a decay in the value of old shares. It's the unique value that makes the sums come out right. In fact you could choose r first and then find c, the average score fee, in terms of r.

Yes, the fee is large for short rounds. This is because there aren't many participants to receive a reward, otherwise early miners would get a disproportionate reward.

If you do this and keep the score fee as stated, it will be like decreasing the score fee, which means that this is no longer hopping-proof.

Yes.

All in all the method was designed for everything to be 100% accurate in expectation, though this means relatively high variance and some counterintuitive situations.

(Updated November 17, 2011)

I have completed my Analysis of Bitcoin Pooled Mining Reward Systems.

This document analyzes the foundations of mining pools and explores the various reward systems in existence, as a resource to anyone who would like to know more about the subject. It includes both discussion and mathematical results, some of which I have already haphazardly posted around the forum.

It is technical, though it is my intention that it will be approachable to everyone. Any feedback is welcome, and there used to be a bounty for helping improve it.

If you're looking for a more concise overview, also available is Summary of mining pool reward systems. There are also slides prepared for the San Jose conference.

Enjoy!


Table of contents:

1 Introduction
1.1 Bitcoin and mining
1.2 Variance of solo mining
1.3 Pooled mining
2 Simple reward systems
2.1 Proportional
2.2 Pay-per-share (PPS)
3 Score-based methods
3.1 Slush's method
3.2 Geometric method
3.3 Pay-per-last-N-shares (PPLNS)
3.4 Score-based methods myths
4 Attempts for risk-free pay-per-share
4.1 Maximum pay-per-share (MPPS)
4.2 Shared maximum pay-per-share (SMPPS)
4.3 Equalized SMPPS (ESMPPS)
5 Advanced methods
5.1 Double geometric method
5.2 General unit-based framework
5.3 PPLNS variants
6 Attack vectors
6.1 Pool-hopping
6.2 Block withholding
7 Nonstandard reward systems
7.1 Shares as a future payment contract
7.2 Variable block rewards
7.3 Hybrid reward methods
7.4 Heterogeneous pools
7.5 Variable difficulty shares
7.6 Proxy mining
7.7 Score cashout
7.8 Score markets
7.9 Streamlined PPS investments
8 Conclusion
A Properties of proportional pools with constant hashrate
B Pool-hopping in proportional pools
C Safety nets for PPS pools
D The hopping immunity theorem
E Properties of the geometric method
F Properties of *MPPS pools
G Hashrate fluctuation pool-hopping

ArsBitcoin uses SMPPS, not PPS. SMPPS is a bad method.

SMPPS is not truly hopping-proof. You can hop by mining for it only when its balance is positive, enjoying 0-fee 0-variance payouts when it is, and leaving others to worry about the inevitable collapse when it's negative.

It might be true that combining PPLNS with PPS can lead to a more optimal balance of variance between the operator and participants.

It's simpler this way, and will be less disruptive than might first appear.

Only if he can convince all Bitcoin users to switch to a software following his new protocol. And it is generally agreed that the coin generation schedule is one thing that must never be changed, so no.

Yes. Remember that coins aren't physical objects that are created, strictly speaking they aren't even digital objects that are created - they're just an agreement between all nodes on the network that address X is entitled to number of coins Y. This agreement is written in the block chain, which can be viewed in http://blockexplorer.com . There are rules that specify how bitcoins are moved and generated, and the rules say that anyone who finds a block can specify a coinbase transaction which adds 50 new bitcoins out of thin air to an address of their choice. If they try creating more than 50 the block will be invalid and everyone will ignore it, and it will not become a part of the block chain.

That's more or less like asking what happens if an employee doesn't have a bank account, working at a place that only pays salaries to bank accounts. If he wants to work for free great (might be illegal in the real world), but it makes more sense to have an account and receive payment. Mining is serious business and no one will want to do it for free.

If mining for a pool, the pool basically tells you where to send the payments, and you tell the pool where to send your part of the loot.

The only pool I know to say this, is one that thinks they're using a hopping-proof method and falsely represents themselves as such, making this irrelevant (and for pools which are truly hopping-proof, the statement "hoppers welcome" is technically true but meaningless). Is there a proportional pool which says hoppers are welcome? If so I guess it's ok to hop them.

After 210,000 blocks are found, the exact time of which is unknown but should be about 16 months from now. That would put it on November 2012.

No. You will just not receive payment for the shares you could have submitted during that time. But keep in mind that there is variance involved, e.g. it could be that a block is found during these hours and you'll miss out, or it could be that nothing will be found and in hindsight the downtime didn't decrease your payouts at all. But on average, your reward is always exactly proportional to the amount of work done.