Power adjusting attacks impact mining pool payout schemes differently

Power Adjusting Games Under Block-Dependent Pool Payout Schemes

Cryptography and SecurityDistributed, Parallel, and Cluster ComputingInformation Theory

Summary

This paper studies how certain attacks that adjust mining power affect different ways cryptocurrency mining pools pay their members. The researchers show that the actual impact of these attacks depends heavily on the payout method used. Some schemes are more vulnerable to attackers gaining extra rewards, while others handle these attacks better. The authors use mathematics and computer simulation to understand how these attacks work in practice.

What this means in practice

Authors

Mustafa Doger, Sennur Ulukus

Abstract

Advanced power adjusting block withholding attacks such as PAW and T-PAW have been analyzed so far under a global-reset version of the proportional scheme (GRP), which is rarely used in practice. In this paper, we analyze T-PAW, which contains FAW and PAW as special cases, under the block-dependent payout schemes deployed in practice: Pay-Per-Last-N-Shares (PPLNS), round-based Proportional (PROP) and exponential-decay (EXP). We derive the revenue ratios analytically, by renewal arguments for PPLNS and through the stationary carry process of an open round for PROP and EXP. We further introduce Power Adjusting Hopping (PAH), where an adversary of any size adjusts its power allocation towards the pool according to the blockwork age of the round without withholding any block, and derive its revenue ratios under PROP and EXP. We show that GRP misestimates the T-PAW gain in a scheme-dependent direction: it overstates the gain under PROP up to an order of magnitude and understates it under EXP for the original slush decay rate. PROP is highly vulnerable to PAH, while EXP faces a trade-off: a slow decay invites PAH and a fast decay invites T-PAW. PPLNS is the least vulnerable scheme: it is immune to PAH and it mitigates, but does not eliminate, T-PAW. All analytical results are verified by Monte Carlo simulations.