Abstract
Bitcoin-NG is an extensible blockchain protocol based on the same trust model as Bitcoin. It divides each epoch into one keyblock and multiple microblocks, effectively improving the transaction processing capacity. Bitcoin-NG adopts a special incentive mechanism (i.e., the transaction fees in each epoch are split to the current and next leader) to maintain its security. However, there are some limitations to the existing incentive analysis of Bitcoin-NG in recent works. First, the incentive division method of Bitcoin-NG only includes some specific mining attack strategies of the adversary, while ignoring more stubborn attack strategies. Second, once adversaries find a whale transaction, they will deviate from the honest mining strategies to obtain an extra reward. In this paper, we are committed to solving these two limitations. First, we propose a novel mining strategy named Greedy-Mine attack. Then, we formulate a Markov reward process (MRP) model to analyze the competition of honest miners and adversaries. Furthermore, we analyze the extra reward of adversaries and summarize the mining power proportion required for malicious adversaries to launch Greedy-Mine to obtain extra returns. Meanwhile, we make a backward-compatibility progressive modification to Bitcoin-NG protocol that would raise the threshold of propagation factor from 0 to 1. Finally, we get the winning condition of adversaries when adopting Greedy-Mine, compared with honest mining. Simulation and experimental results indicate that Bitcoin-NG is not incentive compatible, which is vulnerable to Greedy-Mine attack.
1. Introduction
In 2008, Nakamoto proposed the Bitcoin blockchain protocol, trying to achieve consensus under a permissionless setting [1]. Bitcoin blockchain, based on Proof of Work (PoW), effectively deters sybil attacks [2]. The blockchain can be seen as a decentralized ledger, which is composed of contiguous blocks that follow certain rules and link through specific cryptographic methods. In Bitcoin blockchain, the first block (which does not reference any other block) is called the genesis block. Each block is composed of a block header and a block body. The block header mainly includes the hash of previous blocks, time stamps, etc. The block body includes complete transaction data. The successful applications of blockchain in the financial field [3, 4], the Internet of Things [5–8], the network security field [9, 10], the public service field [11, 12], the digital copyright field [13, 14], and the insurance field [15] have made blockchain technology widely concerned by all walks of life. In the process of continuous development of blockchain, its scalability problems are gradually emerging. Compared with the global payment system Visa with an average of 50000 TPS (transactions per second), the current blockchain systems, such as Bitcoin with an average of 7 TPS, ETH with an average of 20 TPS [16], and EOS with an average of 3000 TPS, is not enough to meet the needs of modern financial transactions. In Bitcoin, Nakamoto chooses a fairly secure system parameter, namely, the average block output time is 10 minutes and the block size is limited to 1 MB. Relevant research studies show that modifying the blockchain system parameters (such as increasing the block size limit or reducing the average block output time) can increase TPS to a certain extent but will reduce the security level of the blockchain system [9, 17]. Therefore, redesigning the consensus protocol of the underlying blockchain has become a research hotspot in recent years.
The design of the new blockchain consensus protocol can be roughly divided into three categories: block classification, parallel chains, and directed acyclic graph (DAG). In the area of block classification, FruitChain [18], Bitcoin-NG [19] divide blocks into two categories as follows: the main blocks are responsible for choosing the longest chain of consensus protocol and the microblocks are responsible for packaging transactions, which can effectively improve the system throughput of blockchain. In parallel chains, OHIE [20] provides the formal proof of security and activity, tolerating adversarycomputing resources close to half of the total network resources, while retaining the high throughput achieved by state-of-the-art blockchain protocols. Prism [21] maintains multiple parallel chains that reference each other to construct a complex directed acyclic graph structure and selects the longest valid chain through voting. It can also tolerate attackers with less than half of the system’s network resources and improve transaction processing speed to a multiple positively correlated with the number of parallel chains. Miners in Prism do not verify the legitimacy of transactions during the containing process, and thus, it cannot effectively solve spam attacks. Monoxide [22] proposes an asynchronous consensus zone that linearly extends blockchain systems without compromising decentralization and security. It is based on the Chu-ko-nu mining mechanism, allowing and encouraging miners to use a PoW solution to create multiple blocks in different zones, resulting in an attack standard increase of nearly 50% for each zone. Chainweb [23, 24] combines hundreds or thousands of individually mined peer-to-peer chains into one network. Each chain in the network mines the same cryptocurrency, which can be transmitted across chains through Proof of Burn verification at the smart contract level for untrusted simple payment verification (SPV). They implement a system for simulating how economically rational and Byzantine adversarial agents interact with blockchain protocols and provide statistical estimates of the economic difficulty of attacks. Furthermore, Wang et al. [25, 26] studied the potential vulnerability of Chainweb to selfish mining attacks. Their results indicate that attackers can receive additional rewards when their computing power accounts for at least 38% of the total power of the Chainweb network, which is lower than the required computing power ratio for 51% attacks. In a DAG-based design approach, Inclusive [27] only proposes basic design principles without a detailed introduction to complement the protocol. In Spectre [28], transactions can be confirmed in seconds and the throughput is increased by orders of magnitude over bitcoin. Phantom [29] uses a greedy algorithm to distinguish blocks mined by honest miners legally from blocks mined by malicious miners that deviate from the DAG mining protocol and ultimately provides full order on the BlockDAG in a uniform manner for all honest nodes to meet the specific requirements for ledger timeline in smart contracts. In Conflux [30], it improves the performance of the blockchain through reasonable design and optimization of the system, while ensuring the security of the blockchain. Conflux has improved the throughput of the blockchain at the consensus level and has reduced the waiting time of block confirmation. Among them, Bitcoin-NG blockchain has received extensive attention from blockchain practitioners.
Bitcoin-NG [19] is among the first and the most prominent PoW-based blockchains to approach the near-optimal throughput, which has the same trust model as Bitcoin. It divides blocks into the following two categories: keyblocks and microblocks. Keyblocks are responsible for participating in the consensus protocols, while microblocks are responsible for packaging transactions. Bitcoin-NG improves performance by separating consensus protocols and packaging transactions. More specifically, each keyblock is generated through the leader election process and the corresponding leader will obtain a block reward, which is called the mining process. Furthermore, the leader can package multiple microblocks and receive transaction fees until the next keyblock is generated, which is called the process of packaging transactions. More intuitively, Bitcoin-NG separates the transaction serialization process from the leader election process, which brings Bitcoin-NG to approach the near-optimal throughput since microblocks can be generated at a rate up to the network capacity. It is precisely for this reason that Bitcoin-NG has been applied to cryptocurrency Waves [31] and Aeternity [32].
The idea of separation has inspired many novel blockchain protocols including ByzCoin [33], Hybrid consensus [34], and Prism [21]. Although these protocols can achieve lower latency or higher throughput than Bitcoin-NG, the design and analysis of their incentive mechanisms are still unclear. However, as the foundation of these protocols, Bitcoin-NG still has certain limitations in incentive analysis, which will be explained in detail in Section 3.3.
In Bitcoin-NG, Eyal [19] proposes two possible malicious attacks (transaction inclusion attack and longest chain extension attack), which derives the division proportion of transaction fees. Jiayuan Yin [35] proposes modified transaction inclusion attack, which reallocates transaction fees and improves the imperfection of the original transaction inclusion attack. The above incentive analysis based on Bitcoin-NG only includes the limited mining attacks of adversaries, while ignoring more novel mining strategies. Besides, they do not consider the extreme cases that may occur in the blockchain, e.g., whale transaction. Once whale transactions are detected by adversaries, they will deviate from the honest mining strategy to obtain an extra reward (whale transactions are more profitable).
To address the above issues, we first propose a novel mining strategy, Greedy-Mine, which can increase the reward of adversaries. Furthermore, we model the Greedy-Mine strategy through the Markov reward process (MRP) to analyze the competition of honest miners and adversaries. Finally, we model the Markov reward process and calculate the extra reward of adversaries, which indicates that Greedy-Mine is more profitable than the honest mining strategy. We note that a preprint has previously been published [36]. Specifically, we have the following contributions.
We first represent the Bitcoin-NG incentive mechanism and visually redescribe the design principle of Bitcoin-NG, which greatly enhances the understanding of Bitcoin-NG’s underlying design principle.
Second, we propose a novel mining strategy named Greedy-Mine and model the Greedy-Mine strategy through the Markov reward process (MRP) to analyze the competition of honest miners and adversaries. We further calculate the extra reward of adversaries, which demonstrates that Bitcoin-NG mining is not incentive compatible.
Third, we summarize the mining power proportion required for adversaries to launch Greedy-Mine to obtain excess returns. When the greedy pool has more than 18.1% of the system mining power, launching Greedy-Mine is more profitable than honest mining. Furthermore, miners with more mining power are more motivated to adopt Greedy-Mine.
Finally, we make a backward-compatibility progressive modification to the Bitcoin-NG protocol that would raise the threshold of propagation factor from 0 to 1. Meanwhile, we get the winning condition of adversaries when adopting Greedy-Mine and honest mining, respectively, which indicates Bitcoin-NG is vulnerable to Greedy-Mine attack.
2. Preliminaries
2.1. Overview of Bitcoin-NG
Bitcoin-NG is an extensible blockchain protocol based on the same trust model as Bitcoin. On the basis of Bitcoin blockchain, Bitcoin-NG improves the blockchain performance under the Nakamoto consensus by separating consensus protocols and packaging transactions. The time is divided into multiple epochs, and each epoch contains a leader (i.e., block in the main chain). The tenure of each leader is about 10 minutes, during which the transactions in the transaction pool will be packaged. Each leader can obtain the corresponding block reward (coinbase reward) and transaction reward, which ensures that miners are willing to participate in the Bitcoin-NG.
2.2. Keyblock and Microblock
Bitcoin-NG divides blocks into the following two categories: keyblocks and microblocks. Keyblocks are responsible for consensus agreements; meanwhile, microblocks are responsible for packaging transactions.
2.2.1. Keyblocks: Consensus Protocol
Keyblocks are responsible for leader election, which ensures the security of the consensus protocol. Similar to Bitcoin, the keyblock contains reference to the previous block, current GMT time, coinbase transactions to pay out the reward, target value, nonce, and public keys for packaged microblocks. Miners must traverse nonce until the PoW puzzle is successfully solved, which means the hash of the keyblock header is smaller than the target. The miner who finds a valid keyblock will set the coinbase transaction to output to his own account address, which is calculated through the hash of the public key. The process of a miner trying a nonce can be seen as a Bernoulli trail. Multiple Bernoulli trails form a Bernoulli process. Therefore, the process of a miner mining keyblocks is memoryless. Furthermore, Bitcoin-NG adjusts the difficulty of mining puzzles through changing the target value to maintain the average block generation rate, which ensures the security of Bitcoin-NG.
2.2.2. Microblocks: Packaging Transaction
When a miner generates a valid keyblock, he becomes the leader within the current epoch. Leaders can package transactions to generate microblocks at a rate below the predefined maximum rate. The predefined maximum rate of the microblocks is deterministic and can be much higher than the average generation rate of the keyblocks, which increases the throughput of the system. Therefore, leaders will generate microblocks with unpackaged transactions to obtain the corresponding transaction fees. The microblock header contains a reference to the previous block, the current GMT time, the hash of its account, and the signature of the microblock header. Microblocks are responsible for packaging transactions, which is critical to improve Bitcoin-NG’s throughput. However, they have no contribution to the consensus protocol.
2.3. Protocol of Bitcoin-NG
In Bitcoin-NG, the current local state of each node may be inconsistent due to the frequent generation rate of microblocks, which brings forking. As shown in Figure 1, when the keyblock 1 is generated, the microblocks 1′ and 2′ may not have been received yet, which enables them to become orphan blocks. Meanwhile, transactions in these orphan blocks will not be executed. Therefore, users who detect the microblocks in the blockchain should wait for a period of network propagation until other keyblocks are generated on top of these microblocks (e.g., in Bitcoin, users need to wait for 6 blocks (approximately 60 minutes) to ensure that the blocks are executed).
To motivate miners to mine honestly and ensure the security of the system, leaders in each epoch will obtain two rewards: the coinbase reward for generating keyblocks and transaction fees for generating microblocks. Meanwhile, the transaction fees should be shared by two adjacent leaders before and after the current epoch. Specifically, 40% of these transaction fees are earned by the leader of the current epoch and 60% by subsequent leaders, as illustrated in Figure 2 for details. The reason for choosing this distribution is explained in Section 3.
3. Incentive Analysis of Bitcoin-NG
3.1. Original Incentive Analysis
Original incentive analysis of Bitcoin-NG contains two types of malicious attack strategies: transaction inclusion attack and longest chain extension attack. To analyze the incentive, we first describe some parameters. In the PoW-based blockchain, the relative mining power determines the probability of the miner to find a new valid block. We denote the total mining power of the adversary pool . In the case of a tie between the adversary’s chain and some other chain, we let be the fraction of other miners choosing to mine on the adversary’s branch when this forking competition occurs. In addition, the transaction fee is a significant incentive in Bitcoin-NG and we let denote the fraction of the transaction fee earned by the leader in the current epoch.
3.1.1. Transaction Inclusion Attack
When adversaries generate a keyblock and a series of microblocks with transactions, they may potentially increase their revenue from transaction fees through selfish mining. To do so, adversaries first generate (reserve) microblocks of transactions but do not publish them. Meanwhile, they try to mine on top of these unpublished microblocks, while other honest miners have to mine on published keyblocks. If adversaries find a subsequent keyblock, they will publish it at once, which brings them 100% of the transaction fees (with probability ). However, if other honest miners find a subsequent keyblock and publish microblocks with these secret transactions, adversaries will try to mine on top of these microblocks, which brings them only of the transaction fees (with probability ). Figure 3 shows the transaction inclusion attack in Bitcoin-NG. In order to urge all miners to adopt the honest mining strategy, the revenue through transaction inclusion attach should be smaller than the revenue through honest mining. Therefore, we can get equation (1).
According to equation (1), we can get . We assume that adversary owns the mining power , and we can get .
3.1.2. Longest Chain Extension Attack
In order to improve revenue, the adversary can avoid microblocks and directly mine on the previous keyblock to generate a new valid keyblock. Then, he would generate microblocks of transactions. Once he finds a subsequent keyblock, he will obtain of the transaction fees (with probability ). Otherwise, he obtains of the transaction fees (with probability ). Figure 4 shows the details of the longest chain extension attack in Bitcoin-NG. The revenue that adversaries can obtain by the longest chain extension attack must be smaller than the revenue obtained by honest mining. Therefore, we can derive equation (2)
According to equation (2), we can get . Assuming that adversary owns the mining power , we can get .
3.2. Modified Incentive Analysis
3.2.1. Modified Transaction Inclusion Attack
Yin et al. [35] improve Bitcoin-NG transaction inclusion attack in relevant research, which modifies the transaction inclusion attack. More specifically, when adversaries find a valid keyblock on top of these secret microblocks, they will publish these secret microblocks with transactions and the new valid keyblock, which brings them of transaction fees (with probability ). However, once honest miners find a valid keyblock, they will publish it and microblock with transactions. Meanwhile, adversaries will try to mine on top of these microblocks, which bring them of transaction fees (with probability ). Modified transaction inclusion attack in Bitcoin-NG is shown in Figure 5. Therefore, we can derive equation (3).
According to equation (3), we can get . Assuming that adversaries own the mining power , we can get .
To sum up, we can get . Assuming that adversaries own the mining power , we can get . Therefore, the incentive parameter selected in Bitcoin-NG meets the security requirements.
3.3. Defects of the Traditional Incentive Analysis
The above incentive analysis based on Bitcoin-NG only includes the limited mining strategies, while ignoring more stubborn mining strategies. For example, in the first stage, the adversary fails to package the whale transaction, but he may reverse the longest chain by generating new keyblocks, which could bring them more reward. On the basis of Bitcoin-NG’s original incentive analysis, we propose a novel mining strategy named Greedy-Mine and model it through the Markov reward process (MRP) to analyze the competition of honest miners and adversaries (in Section 4). We further calculate the extra reward of adversaries, which demonstrates that Bitcoin-NG mining is not incentive compatible (in Section 5).
4. Model of the Greedy-Mine Strategy
4.1. Assumption
To simplify our analysis, we make some reasonable assumptions. Our assumptions are similar to those of other selfish mining attacks, such as selfish mining [37], stubborn mining [38], bribery semiselfish mining, and bribery stubborn mining [39].(1)We normalize the total mining power of the system to 1. The normalized mining power of the adversary is a value greater than 0 but less than 1.(2)Miners are profit-driven. Honest miners can adopt the optimal mining strategy they consider to increase their profits but will not launch mining attacks. This is reasonable because miners are honest but profit-motivated. When the blockchain forks and the length of each branch are equal, miners could choose any branch.(3)There are no unintentional forks in the Bitcoin system. This assumption is rational because the probability of unintentional forks occurring in the Bitcoin system can be negligible, approximately 0.41% [40].(4)Block rewards can be ignored compared to the whale transactions. In our analysis, miner’s rewards are expected as well as normalized.(5)We only consider one whale transaction in each epoch. When a whale transaction appears in the network, the attacker will desperately include it to his own block to obtain enormous rewards. In Bitcoin-NG, however, the likelihood of a whale transaction occurring is extremely low, about 0.0001% [41]. When the subsequent potential whale transaction appears, the rate of the competition regarding the previous whale transaction not ending is less than . Hence, it is reasonable to consider only one whale transaction in each epoch of competition related to whale transactions.
4.2. Greedy-Mine Strategy
For the sake of simplicity and generality, we assume that the mining power is divided into two categories: one is the minority mining pool following the Greedy-Mine strategy and the other is the majority pool following the honest mining strategy. Furthermore, it is not significant whether honest miners are a single pool, a series of pools, or individual miners.
The key intuition of the Greedy-Mine strategy is that the greedy pool has the motivation to compete with the honest pool for the longest legal chain, which diminishes the mining power of the honest pool on the nonlongest legal chain. Along with the decrease of the effective computing resources in the network, the greedy attackers have more chances to win in the forking competition. Therefore, they have the motivation to exploit the Greedy-Mine strategy to obtain excess returns. The honest miners follow the prescribed protocol given in Algorithm 1. Each honest miner observes the state structure of the blockchain, choosing the longest valid main chain and mining on it. Once a new keyblock is found, he broadcasts it to everyone in the network. Also, he updates the status of the local blockchain and then continues to mine the next keyblock. By contrast, the greedy pool deviates from the honest protocol and mines on his own branch strategically to obtain the whole whale transaction fees. Once a whale transaction occurs, the greedy pool immediately mines on the block containing the whale transaction, which brings about the forking competition. In this case, there are both the greedy pool and some honest miners who received the greedy block first contributing to the greedy branch. Furthermore, due to the default confirmation is about six blocks in the Bitcoin-NG system, the greedy pool has to give up if its branch length falls behind the public branch by more than six blocks.
|
When the greedy pool finds a new keyblock, he will publish it selectively, which makes greedy branch the longest legal chain and brings the greedy pool all transaction fees in each epoch. Generally, once a whale transaction occurs (whale transaction refers to the transaction involving very high transaction fees, and block rewards can be ignored, compared with a whale transaction), the greedy pool will try to generate keyblocks and microblocks with whale transactions, even if the whale transactions have been packaged into microblocks by other honest pools. Greedy pool will attempt to make their branch the longest legal chain, which wastes the mining power of honest pool. In this case, adversaries can obtain a disproportionate reward under the Greedy-Mine strategy.
With the above intuition, we propose the Greedy-Mine strategy, which is driven by the mining events of greedy pool or honest pool. The decision of the greedy pool is determined by the specific state of whale transactions. We divide into three categories: refers that whale transaction has not been packaged, refers that whale transaction has been packaged by greedy pool, and refers that whale transaction has been packaged by the honest pool. The initialization of Greedy-Mine is described in Algorithm 2.
|
When the greedy pool finds a keyblock and whale transactions have not been packaged at this time, he will publish the keyblock with whale transactions, which brings the to 1 and adds one to the length of the adversarial branch. If whale transactions have been packaged by the greedy pool and the length of the adversarial branch is not shorter than the length of the honest branch, he will publish the keyblock and add one to the length of the greedy branch. If whale transactions have been packaged by the honest pool and the length of the honest branch is longer than the adversarial branch, the greedy pool will generate the keyblock and add one to the length of the branch. The specific strategy of the greedy pool is described in Algorithm 3.
|
When the honest pool finds a keyblock, he will continue to mine with the honest strategy. If whale transactions have not been packaged, he will generate the keyblock with whale transactions and set . If whale transactions have been packaged, the strategy of the honest pool is determined by the system state. If the length of the honest branch is longer than the greedy branch, the honest pool will publish a keyblock on the honest branch and add one to the length of the honest branch. If the length of the honest branch is equal to the length of the adversarial branch, the result of the competition is determined by the choice of the honest pool. Specifically, if an honest pool appends an honest branch, the length of the honest branch adds one. Otherwise, the length of the adversarial branch adds one. If the length of adversarial is longer than the length of honest branch, the competition ends and the adversarial pool gets all whale transaction fees. The specific strategy of honest pool is described in Algorithm 1.
Under the Greedy-Mine strategy, the greedy pool can obtain all whale transaction fees if he attacks successfully. On the contrary, nothing is gained.
4.3. State Transition Process
We model the state transition process of the Greedy-Mine strategy in Figure 6. The state indicates that the whale transaction has not been packaged. The state indicates that the whale transaction is packaged by the greedy pool and there are no keyblocks on top of it. The state is a termination state, which means that the whale transaction is packaged by the greedy pool and another keyblock on top of it is also generated by the greedy pool. In this case, all transaction fees are obtained by the greedy pool. The states indicate that the whale transaction is packaged by a greedy pool and keyblocks on top of it are generated by the honest pool. Meanwhile, the length of the honest branch is . The state indicates that the whale transaction is packaged by the greedy pool, and the length of the honest branch is equal to the greedy branch. The states indicate that the whale transaction is packaged by the greedy pool, and the length of honest branch is longer than the greedy branch. The state indicates that the whale transaction is packaged by the honest pool and no new keyblocks are on top of it. The state indicates that the whale transaction is packed by an honest pool and an honest keyblock is on top of it. The states indicate that whale transactions are packaged by the honest pool and honest keyblocks are on top of it. Meanwhile, the length of the honest branch is . The state indicates that the whale transaction on the honest branch is packaged by the honest pool, and an honest block is on top of it. In this case, the greedy pool may choose to launch the Greedy-Mine to obtain more reward than honest mining. The states indicate that the whale transaction on the honest branch is packaged by the honest pool, and an honest block is on top of it. Meanwhile, new honest keyblocks are generated on top of the honest branch, and the length of honest branch is longer than that of the greedy branch. The states indicate that the whale transaction on the honest branch is packaged by the honest pool, and an honest block is on top of it. Meanwhile, new keyblocks are generated on top of both honest and greedy branches, and the difference between the length of honest branch and greedy branch is . The detailed state transitions are shown in Supplementary Material A.
4.4. Equation of State Probability
According to the state transition process in Figure 6 and Supplementary Material A, we can derive the following equation:
We divide the state probability transition process into two parts. Since the termination state probability is determined by the probabilities of state probability and , we analyze the state probability and , respectively. Furthermore, we can derive the state probability through the state probability (as shown in equation (5)). Similarly, the state probability can be expressed by the state probability (as shown in equation (6)).
According to equations (4)–(6), we can derive the following equations:
5. Revenue Analysis
5.1. Revenue Analysis of the Honest Mine
(1)When the adversary pool finds a keyblock with whale transactions and then finds another keyblock on top of it, he obtains of whale transaction fees (probability ).(2)When the adversary pool finds a keyblock with whale transactions and then the honest pool finds another keyblock on top of it, the adversary pool obtains of whale transaction fees (probability ).(3)When the honest pool finds a keyblock with whale transactions and then the adversary pool finds another keyblock on top of it, adversary pool obtains of whale transaction fees (probability ).According to the revenue analysis of honest mining, we calculate the revenue expectation that the honest pool with mining power of can obtain, as shown in the following equation:
5.2. Revenue Analysis of Greedy-Mine
(1)When state transitions to termination state , the greedy pool can obtain revenue of (2)When state transitions to termination state , the greedy pool can obtain revenue of (3)When state transitions to termination state , the greedy pool can obtain revenue of (4)When state transitions to termination state , the greedy pool can obtain revenue ofAccording to the revenue analysis of Greedy-Mine, we calculate the revenue expectation that the greedy pool with mining power can obtain, as shown in the following equation:
6. Simulation and Experimental Results
We implement a Monte Carlo simulator by using MATLAB to verify the accuracy of our analysis of Greedy-Mine attack in Bitcoin-NG. Specifically, we simulate a system with 1000 miners, where the greedy pool controls 500 miners at most. We run over rounds and receive the greedy miners’ relative rewards in twenty scenarios while the greedy miners follow the designed protocol in Algorithm 3 and the honest miners in Algorithm 1 (with the attacker’s mining power and the system parameter ). The experimental results are consistent with our theoretical analysis, as shown in Table 1.
We next present a systematic evaluation of the revenue of the adversary exploiting the Greedy-Mine strategy. Furthermore, we evaluate the minimum mining power threshold that the greedy pool is willing to exploit the Greedy-Mine strategy to obtain the disproportionate reward. Figure 7 shows the revenue that an adversary with different mining power can obtain by launching Greedy-Mine strategies under different propagation factor parameters compared with the honest mining protocol in Bitcoin-NG.
Figure 7 indicates that the simulation results are consistent with the theoretical analysis, both of which show that the greedy pool with higher mining power will obtain higher revenue by adopting the Greedy-Mine strategy. Moreover, it demonstrates that the Bitcoin-NG mining is not incentive compatible even in the presence of honest pool majority. More specifically, we set the propagation factor to four cases . The experimental results show that when , the minimum mining power owned by the greedy pool to launch Greedy-Mine is . Furthermore, once the greedy pool possesses more than 0.181 of mining power, adopting Greedy-Mine is always the optimal mining strategy, which could bring him more reward compared with honest mining. Figure 8 shows the minimum mining power owned by the adversary that could obtain disproportionate revenue under different propagation factor parameters when adopting Greedy-Mine, compared with honest mining. The solid line represents no extra reward, which means that no matter whether Greedy-Mine or honest mining is adopted, the reward of adversary is the same. The right side of the solid line indicates that adopting Greedy-Mine is the optimal strategy. Furthermore, the winning area of Greedy-Mine is larger than honest mining, which is consistent with our theoretical analysis.
When the propagation factor is larger, honest miners are more likely to contribute to the greedy branch. The minimum mining power owned by the adversary to exploit the Greedy-Mine strategy to obtain extra revenue is 0.181, compared with honest mining in Bitcoin-NG, which indicates that Bitcoin-NG mining is not incentive compatible.
Considering the adversary with mining power in a mining game under Greedy-Mine and honest mining, we define that the winning condition for the adversary is obtaining a higher reward than the honest mining strategy. To provide a more detailed description, we define the relative extra reward (RER) to show the performance of Greedy-Mine, which can be expressed as follows:where and indicate different mining strategies (i.e., Greedy-Mine or honest mining) and represents the reward of adversary when adopting the mining strategy.
We show the relative extra reward and winning condition of the adversary in Figure 9. More specifically, the right side of the solid line is the winning condition of the adversary when adopting Greedy-Mine. When and are relatively large, adversary could obtain higher relative extra reward under Greedy-Mine. The reason is that the more miners choose to mine on the greedy branch in the forking competition, the higher probability of the adversary winning. Meanwhile, compared with honest mining, miners with larger mining power have an advantage in adopting Greedy-Mine. Therefore, miners with relatively large mining power have the motivation to use Greedy-Mine. The experimental result of the adversary’s relative extra reward with different mining power under different propagation factor parameters is given in Table 2. The experimental result indicates that the adversary with more mining power has the motivation to adopt the Greedy-Mine strategy, regardless of propagation factor parameters . Moreover, with the increasing , the adversary can obtain more relative extra reward than the honest mining strategy, regardless of adversary’s mining power , which is consistent with our theoretical analysis.
7. Discussion
We present two countermeasures to mitigate the Greedy-Mine in Bitcoin-NG. First of all, honest miners are encouraged to select the keyblock they first detect as the main chain and mine on it. For instance, when an honest miner detects the block containing a transaction , and then receives the block containing transactions and in another branch, he is supposed to select as the valid main chain. Due to the lag in the blocks released by miners who launch Greedy-Mine attacks, these malicious blocks are more likely to be detected after honest blocks. Therefore, more honest miners selecting honest branches as the main chain enable system parameters to decrease, thereby diminishing the rate of attackers winning in the forking competition.
Moreover, we suggest shortening the transaction confirmation time in Bitcoin-NG while ensuring system security. The default transaction confirmation time for Bitcoin-NG is about 60 minutes, which is also the time for six consecutive keyblocks to be generated. When there is a whale transaction in the system, excessive transaction confirmations lead to attackers launching Greedy-Mine with less expenses, which increases the rate of reversal of transactions and reduces the cost of attackers. Through the Markov state transition model constructed, we observe that the longer the transaction confirmation of the system, the more undetermined states there are in the Markov model, which increases the rate of attackers winning in the forking competition. Therefore, reducing transaction confirmation and increasing the attack cost for attackers is the most effective measure to alleviate Greedy-Mine. Through experimental simulation, we obtain the minimum computational power that can achieve excess returns in different transaction confirmations by activating Greedy-Mine attacks, as shown in Table 3. As expected, the simulation results verify our theoretical analysis.
8. Conclusion
Although Bitcoin-NG is scalable, it is vulnerable to novel mining attacks (e.g., Greedy-Mine). In our work, we present a novel mining attack named Greedy-Mine and demonstrate that in PoW-based blockchain systems such as Bitcoin-NG, the Greedy-Mine strategy can bring adversaries more relative extra reward compared with honest mining. Furthermore, comparing with honest mining, once the adversary possesses more than 18.1% of mining power, adopting Greedy-Mine is always the optimal mining strategy, which could bring him more reward. Finally, we get the winning condition of adversaries when adopting Greedy-Mine and honest mining, respectively, which indicates Bitcoin-NG is vulnerable to Greedy-Mine attack. Finally and hopefully, the Greedy-Mine strategy that we propose in this paper can serve as a crucial reference for future research studies of blockchain.
Data Availability
No data were used to support the findings of this study.
Disclosure
The full version of the manuscript can be found in the preprint arXiv:2306.03540 [36].
Conflicts of Interest
The authors declare that there are no conflicts of interest.
Acknowledgments
This work was in part supported by the National Nature Science Foundation of China (Grant nos. 61872060 and 62002050), in part by the Key Research and Development Program of Sichuan (Grant no. 2021YFG0158), in part by Sichuan Science and Technology Program (Grant no. 2020JDTD0007), and in part by Central University Basic Research Funds Foundation (Grant nos. A030202063008083 and ZYGX2020ZB027).
Supplementary Materials
A. State Transitions of Greedy-Mine in Bitcoin-NG. We describe the state transition process of Greedy-Mine in Bitcoin-NG and analyze the probability of each state transition in detail. (Supplementary Materials)