On the Security and Scalability of Proof of Work Blockchains

Arthur Gervais

ETH Zurich

Scaling Bitcoin 2016 - Milan

Synchronization

Broadcast of transactions/blocks • All transactions, blocks need to be broadcast into the whole network

• Larger blocks slower propagation increased consensus latency

• Risks of networkpartition (stale blocks…)

Synchronization

Denial of ServiceDouble Spending

Selfish Mining

Decentralised PoW Blockchains

Which one is a better Blockchain?

10 minutes 2.5 minutes 1 minute 20 seconds

Faster block generation Faster payments

Bigger block size More payments / slower propagation

Faster block generation Faster payments

Bigger block size More payments / slower propagation

Bitcoin Litecoin Dogecoin Ethereum

Propagation Time 8.7 s 1.02 s 0.85 s 0.5 - 0.75 s

Medium Block size 534.8 KB 6.11 KB 8 KB 1.5 KB

Quantitative Framework

Compare security of PoW blockchainsAccount for double-spending and selfish mining Determine the optimal adversarial strategies Provide # of secure confirmations depending on tx value Increasing throughput without penalizing security

Understanding Security / Performance of PoW Blockchains

Contributions

Open Source Bitcoin Simulator

Realistic simulation of network and blockchain properties Flexible reparametrizationScalable to thousands of nodes Open Source and documented

Blockchain and Forks

Block 1 Block 2 Block 3 Block 4

Block 3’ Block 4’

Stale blocks

= lost effort

Block 1’’ Block 2’’ Block 3’’ Block 4’’ Block 5’’

Stale blocks

= lost effort

Block 1’’ Block 2’’ Block 3’’ Block 4’’ Block 5’’

Stale blocks

= lost effort

Bitcoin Litecoin Dogecoin Ethereum0.41% 0.273% 0.619% 6.8%Stale Block rates

Double Spending

Security of PoW Blockchains

TXlegitimate - Pays the vendorTXdoublespend - Pays the adversary

TXlegitimate

Double Spending

TXlegitimate

TXdoublespend

Double Spending

TXlegitimate

B’2B’1

TXdoublespend

Double Spending

TXlegitimate

B’2B’1

TXdoublespend

Double Spending

TXlegitimate

B’2B’1

TXdoublespend

What is Selfish Mining? [Eyal and Sirer]

• Instead of publishing, keep a block private

• Release block to compete Other miners will perform wasteful computations Adversary looses block rewards

Selfish Mining vs. Double Spending

Selected findings

Selfish Mining

Increases relative rewardNot necessarily rational

Double Spending

Increase absolute rewardEconomically rational adversary

Consider them independently

Towards a better Blockchain

FasterFaster

payments

BiggerSmaller

SlowerSlower

payments

lesssecurity

bettersecurity

Blockgeneration

Block size

Slower propagation

Faster propagation

Understanding Security / Performance of PoW Blockchains

Framework

PoW Blockchain Security Modelstale block rate

Consensus & Network

parameters

Security parameters

Block propagation times Throughput

Optimal adversarial strategy Security characteristics

Decentralised Blockchain

PoW Blockchain

Blockchain instance can be A real blockchain (e.g. Bitcoin, Ethereum)Simulated blockchain

Simulator captures (Open Source)

Consensus & Network

parameters

PoW Blockchain

Stale block rateBlock propagation times Throughput

Consensus parameter Network-Layer Parameters

Block interval distribution Block size distribution

Mining power dist. Geographical distribution of nodes/miners

Number of connections of nodes/miners

Propagation Protocol

PoW Blockchain

Consensus & Network

parameters

PoW Blockchain

Europe, 5.40%

NorthAmerica,23.70% Asia

Pacific,70.90%

PoW Blockchain

Consensus & Network

parameters

PoW Blockchain

Europe, 5.40%

NorthAmerica,23.70% Asia

Pacific,70.90%

NorthAmerica,38.69%

Europe,51.59%

SouthAmerica,1.13%

Japan,1.19%Australia, 1.66%

Asia Pacific,5.74%

Security Model

Captures optimal adversarial strategies for Selfish Miningfor Double Spending based on Markov Decision Processes

Security Parameters Adversarial mining power Stale block rate Connectivity of the adversary Impact of eclipse attacks Mining costs Number of required confirmations

Security parameters

Security Model

Optimal adversarial strategy Security provisions

stale block rate

Security Model

Markov Decision Process

Extension of Markov Chains Adds actions and rewardsState space and action space

B’1 B’2

State: (3, 1)

Security Model

B’1 B’2

State: (3, 1)

Attacker chain

Security Model

B’1 B’2

State: (3, 1)

Honest chainAttacker chain

Security Model

B’1 B’2

State: (3, 1)

Security Model

B’1 B’2

State: (3, 1)

Reward for adversary: 2

Security Model

B’1 B’2

State: (3, 1)

(1, 1)

Reward for adversary: 2

Selected findings

How many confirmations required to match security?

Staleblock rate 6.8 % 0.41 %

Selected findings

smaller block rewards

higher stale block rate

Selected findings

smaller block rewards

higher stale block rate

Litecoin would require 28, and Dogecoin 47 block confirmations respectively to match the security of 6 Bitcoin confirmations.

Matching Blockconfirmations,30% adversary

37 612.4 minutes 60 minutes

Selected findings

Increasing throughput?

1 MB blocks1 Minute Block interval

Based on Simulator results

Selected findings

Stale block rate does not increase substantially

Selected findings

Stale block rate does not increase substantially

From 7 tps to 60 tps, without sacrifising security

Selfish Mining under constant difficulty

Selected findings

Selfish Mining yield fewer block rewards than honest mining.

Mining 1000 blocks

30 % selfish miner mines 209 blocks, instead of 300! (under optimal strategy)

Eyal and Sirer’s strategy yields on average 205.8 blocks

Selected Findings

Influence of Stale Block rate on Selfish Mining

The higher the stale block rate the higher the relative revenue

0.0 0.1 0.2 0.3 0.4 0.5Stale rate rs

e α = 0.1

α = 0.3

Bitcoin Ethereum

Double-Spending

Selected findings

Profitability depends on transaction value Quantifying resilience using minimum vd, s.t. double-spending is profitable

0.0 0.1 0.2 0.3 0.4 0.5Stale rate rs

v dα = 0.1

α = 0.3

Bitcoin Ethereum

Double-Spending

Selected findings

Profitability depends on transaction value Quantifying resilience using minimum vd, s.t. double-spending is profitable

0.0 0.1 0.2 0.3 0.4 0.5Stale rate rs

v dα = 0.1

α = 0.3

Bitcoin Ethereum

Threshold at which double-

spending is more profitable than honest mining

The higher the vd, the better

Number of required confirmations (Bitcoin)

Selected findings

0.0 0.1 0.2 0.3 0.4 0.5

Adversarial mining power α

vd = $100000

vd = $10000

vd = $1000

Double Spending Bitcoin vs. Ethereum

Selected findings

0.0 0.1 0.2 0.3 0.4 0.5

Adversarial mining power α

10−1

100101102103104105106107108

Bitcoin, k = 6, block rew.Ethereum, k = 12, block rew.Ethereum, k = 6, block rew.

10−1

100101102103104105106107108

Bitcoin, k = 6, $Ethereum, k = 12, $Ethereum, k = 6, $

Double-spending resistance of Ethereum (k in {6,12}) vs. Bitcoin (k=6)

Block reward impact

Selected findings

For a fixed transaction valueWe show that the higher the block reward (e.g., in USD), the more resilient it is against double-spending

Merchant can vary the # of confirmations depending on the transaction value

/ 2222

Summary

Compare PoW blockchains objectively

Selfish Mining not always rational

Double Spending is rational

Blockchain Simulatorhttp://arthurgervais.github.io/Bitcoin-Simulation/index.html

/ 2222

Summary

Block confirmation equivalence

6 Bitcoin = 37 Ethereum (20 sec) = 28 Litecoin (2.5 min) = 47 Dogecoin (1 min)The higher the block reward in USD, the more resilient against double spending

/ 2222

Summary

Good block size/interval

1 MB block and1 Minute block interval

+60 transactions/s without scarifying security

(instead of Bitcoin 7 tps)

/ 2222

Summary

Good block size/interval

1 MB block and1 Minute block interval

+60 transactions/s without scarifying security

(instead of Bitcoin 7 tps)

Blockchain Simulatorhttp://arthurgervais.github.io/Bitcoin-Simulation/index.html Thank you!

/ 2223

/ 2224

/ 2225

Proof of Work Blockchains

B3B2B0

Proof of Work Blockchains

Mining • Find Nonce N, s.t. H(H(B3)|txs|N) < target

B3B2B0

On the Security and Scalability of Proof of Work Blockchains · On the Security and Scalability of...

Transcript of On the Security and Scalability of Proof of Work Blockchains · On the Security and Scalability of...

On the Security and Scalability of Proof of Work Blockchains · On the Security and Scalability of...

Documents

Transcript of On the Security and Scalability of Proof of Work Blockchains · On the Security and Scalability of...

Performance and Scalability of Private Ethereum Blockchains · Performance and Scalability of Private Ethereum Blockchains? MarkusSchäﬀer,MonikadiAngelo[0000 −0002 4217 4530],andGernot

Proof-of-Stake Protocols for Privacy-Aware Blockchains › 2018 › 1105.pdf · leadership, they publish a block together with a proof of winning the lottery, and in the case of committee

FUTURE- PROOF€¦ · The Web is entering its second act and becoming increasingly wearable, conversational, and visual. Digital transformation is our destination, and blockchains

Does blockchain hold the key to a new age of supply chain ... · blockchain. For enterprise use, private or permissioned blockchains also offer greater scalability because they use

Sharding - Vitalik · 2020-03-23 · Sharding Making blockchains scalable, decentralized and secure. The Scalability Triangle Scalability Decentralization Security. Semi-formally

Soylent Blockchains

We Power Blockchains€¦ · blockchains change the way people transact with each other. 6 Blockchains Explained Blockchains are decentralized digital ledgers that record and enable

Proof-of-Proof and VeriBlock Blockchain Protocol Consensus ......and sidechains, benefit from a hierarchical security model which enables all blockchains to operate under the security

TEZOS DEEP DIVE DECK€¦ · Current USPs of private blockchains (like privacy, scalability) will erode with further technological developments that are already under way (e.g. zkSNARKS,

Blockchains : Risk or Mitigation?

On the Security and Performance of Proof of Work Blockchains › 8b32 › 309a7730de87... · interval time to 1 minute do not considerably penalize security. => PoW blockchains can

Blockchains in agriculture

ACHIEVING FUTURE-PROOF SCALABILITY IN YOUR DC OPERATIONS · Achieving Future-Proof Scalability in Your DC Operations | Key Components of a Future-Proof, Scalable DC 6 Existing System

BLOCKCHAINS - REDmoney Events...Sunnah Money Commodities $$$ Bitcoin Intrinsic Value representation Inﬂation Proof unknown debt based Acceptabilty limited growing daily. SLIDE #

Bitcoin, Blockchains and Efficient Distributed Spacecraft ... Blockchains and Distributed... · Bitcoin, Blockchains and Efficient Distributed Spacecraft Mission Control Dan Mandl

The Balance Attack Against Proof-Of-Work Blockchains: The ...

Flux: Revisiting Near Blocks for Proof-of-Work Blockchains · Flux: Revisiting Near Blocks for Proof-of-Work Blockchains Alexei Zamyatin; y, Nicholas Stifter z, Philipp Schindler

Blockchains with Proof-of-StakeHaoChung(鍾豪) Blockchainwith Proof-of-Stake 5/30 Let’s recall how Bitcoin works How do the miners decide “who can issue Block #101?” In Bitcoin,

Industry-specific blockchains

Ouroboros Genesis: Composable Proof-of-Stake Blockchains ...static.tongtianta.site › paper_pdf › a2764f62-6b34-11e... · Ouroboros/Ouroboros Praos [16, 25], which is implemented