Effect of the Distribution of Block Interarrival Time On Blockchain Security

[sebbysebbybinx]

I wrote up a paper on assessing the effect of the distribution of block interarrival time on the security of the bitcoin blockchain. I haven't seen anyone analyze this before. The idea basically is that as transaction fees replace mining rewards, incentives for miners change in such a way that the distribution between block interarrivals changes. I ask the question of how this may affect the probability of double spending in the Bitcoin blockchain since confirmations won't follow a Poisson process in the future.

More details and thoughts are in the paper:
https://drive.google.com/file/d/0Bx3C8uU5BbrGR0JnNDZfZUhJSVk/view

Please let me know your thoughts.

< proof of existence'd - 2d011f33d61655f36ad9dd9665c97b1425637f086375cce6f744a421cfc4d0ef >

[virtualx]

I wrote up a paper on assessing the effect of the distribution of block interarrival time on the security of the bitcoin blockchain. I haven't seen anyone analyze this before. The idea basically is that as transaction fees replace mining rewards, incentives for miners change in such a way that the distribution between block interarrivals changes. I ask the question of how this may affect the probability of double spending in the Bitcoin blockchain since confirmations won't follow a Poisson process in the future.

More details and thoughts are in the paper:
https://drive.google.com/file/d/0Bx3C8uU5BbrGR0JnNDZfZUhJSVk/view

Please let me know your thoughts.

< proof of existence'd - 2d011f33d61655f36ad9dd9665c97b1425637f086375cce6f744a421cfc4d0ef >

Could you post the abstract here?

[sebbysebbybinx]

It is best summed up with the following figure:
http://imgur.com/EUB3trY

This is a plot showing the probability density function for block interarrival times assuming expected total reward (mining reward plus transaction fees) is fixed. Notice that the distribution reduces in variance as the mining reward decreases. This reduced variance in the interarrival time between blocks makes it harder for an attacker with fixed hashing rate to double-spend. However, the miners become vulnerable to a "leasing" attack.

[TierNolan]

The main assumption is that hashing power can be switched on/off.

There are some possible futures where there could be a market price

• Electricity costs dominate
• Altcoin based hashing power market

If there are multiple altcoins and mining pools which aim to mine on the most profitable coin, then pools would switch large amounts of hashing power based on profitability.  The hashing power would target other altcoins which transactions build up on bitcoin and then suddenly the hashing power would increase.

If ASICs are cheap but electricity is expensive, then switching off hashing power might be worth doing.

The paper assumes that the switch is proportional to the total payout.  In a market, there is a market price.  If the fees paid out by bitcoin are less than market price, then they get zero hashing.  Likewise, once the payout goes above market price, the coin gets hit with massive hashing power.

This doesn't weaken the paper's assumptions, if anything, it makes them much stronger.

I don't think any of the current swapping altcoin pools do sub-block switching though.  Altcoins are generally dominated by subsidy, so it isn't worth it.

The difficulty decides how expensive a block is to produce.  This means that when transaction volume is low, fewer blocks would be produced.  It could force the blocks to 10 minutes per block, but only if fees per minute is constant.

[virtualx]

I haven't seen anyone analyze this before. The idea basically is that as transaction fees replace mining rewards, incentives for miners change in such a way that the distribution between block interarrivals changes.

This means higher fees for the actual users. If there are no mining rewards, where will bitcoins be created? 

[Cryddit]

I don't think any of the current swapping altcoin pools do sub-block switching though.  Altcoins are generally dominated by subsidy, so it isn't worth it.

Actually not true. When one mining pool is masquerading as a member of another, it can sometimes increase profits by sub-block switching once it reaches the point where a share award would be split with a lot of other shares. 

It's a well-known profitable strategy for individual miners, despite a number of pools that engage in various schemata to try to eliminate its profitability.  And everything that's profitable for individual miners has been done, in at least a few incarnations, by pools.

[gmaxwell]

Please let me know your thoughts.

The assumption we've historically made is that there would be a generally be a backlog of fee paying transactions in excess of the blocksize limit.

I believe this would suppress the effect your work anticipates, do you agree?

As far as the impact: You must consider the attacker's success distribution and not just its expectation; the network the network is less likely to get unlucky is also less likely to get lucky, increasing the low probability success rate even if the expectation is down. Attacker utility is not a linear function; that an attacker would lose money on average but potentially win big with low chances isn't a great comfort.

You must also consider the hashrate lost to forking-- otherwise your same argument would apply generally and conclude security goes up as variance goes down as a rule; which can be easily demonstrated to be untrue (in theory, and -- thanks to some rather inadvisable constructed altcoins like "liquidcoin", in practice).

Consider an extreme hypothetical where there are few txn but they pay fees far more than the expected electrical power for the whole network to find a block. The hashate goes from 0 to 100% the moment a transaction appears; and so a block would probably be found near instantly, lets assume instantly.  What would then happen is that all the honest miners would end up on separate forks-- effectively diluting their hashpower. An attacker conspiracy is now no longer in competition with the whole network, but just the strongest fork (which if all honest miners are equal in power and the block find was actually instant, he'd be in competition with just a single miner until the fork resolves!).  (In this extreme example the network would eventually never converge, in fact, even absent an attacker; with less extreme examples it's not as bad but you still might need to wait many blocks to be confident there wouldn't be a long reorg; due to a long chain of blocks being found 'concurrently' (within the communications diameter of the network)).

The observation of the spare power in that situation is a good one (but again, also addressed by the backlog).