SMARTPOOL: Practical Decentralized Pooled Mining Loi Luu Yaron Velner National University of Singapore The Hebrew University of Jerusalem [email protected] [email protected] Jason Teutsch Prateek Saxena TrueBit Foundation National University of Singapore [email protected] [email protected] Abstract ning miner’s solution includes a transaction block, which is appended to the distributed ledger that all miners main- Cryptocurrencies such as Bitcoin and Ethereum are op- tain. The reward is substantial (e.g. 12.5 BTC in Bitcoin, erated by a handful of mining pools. Nearly 95% of Bit- or 30;000 USD at present), incentivizing participation. coin’s and 80% of Ethereum’s mining power resides with Nakamoto-based cryptocurrencies, such as Bitcoin less than ten and six mining pools respectively. Although and Ethereum, utilize massive computational resources miners benefit from low payout variance in pooled min- for their mining. Finding a valid solution to a PoW puz- ing, centralized mining pools require members to trust zle is a probabilistic process, which follows a Poisson that pool operators will remunerate them fairly. Further- distribution, with a miner’s probability of finding a solu- more, centralized pools pose the risk of transaction cen- tion within an epoch determined by the fraction of com- sorship from pool operators, and open up possibilities for putation power it possesses in the network. Miners with collusion between pools for perpetrating severe attacks. modest computational power can have extremely high In this work, we propose SMARTPOOL, a novel pro- variance. A desktop CPU would mine 1 Bitcoin block tocol design for a decentralized mining pool. Our pro- in over a thousand years, for instance [2]. To reduce tocol shows how one can leverage smart contracts, au- variance, miners join mining pools to mine blocks and tonomous blockchain programs, to decentralize cryp- share rewards together. In a mining pool, a designated tocurrency mining. SMARTPOOL gives transaction se- pool operator is responsible for distributing computation lection control back to miners while yielding low- sub-puzzles of lower difficulty than the full PoW block variance payouts. SMARTPOOL incurs mining fees lower puzzle to its members. Each solution to a sub-puzzle has than centralized mining pools and is designed to scale to a probability of yielding a solution to the full PoW block a large number of miners. We implemented and deployed puzzle—so if enough miners solve them, some of these a robust SMARTPOOL implementation on the Ethereum solutions are likely to yield blocks. When a miner’s sub- and Ethereum Classic networks. To date, our deployed mitted solution yields a valid block, the pool operator pools have handled a peak hashrate of 30 GHs from submits it to the network and obtains the block reward. Ethereum miners, resulting in 105 blocks, costing miners The reward is expected to be fairly divided among all a mere 0:6% of block rewards in transaction fees. pool members proportional to their contributed solutions. Problem. Centralized pool operators direct the massive 1 Introduction computational power of their pools’ participants. At the time of this writing, Bitcoin derives at least 95% of its Cryptocurrencies such as Bitcoin and Ethereum offer the mining power from only 10 mining pools; the Ethereum promise of a digital currency that lacks a centralized is- network similarly has 80% of its mining power ema- suer or a trusted operator. These cryptocurrency net- nating from 6 pools. Previous works have raised con- works maintain a distributed ledger of all transactions, cerns about consolidation of power on Bitcoin [3,4]. Re- agreed upon by a large number of computation nodes (or cent work by Apostolaki et al. has demonstrated large- miners). The most widely used protocol for agreement scale network attacks on cryptocurrencies, such as dou- is Nakamoto consensus, which rewards one miner ev- ble spending and network partitioning, which exploit ery epoch (lasting, say, 10 minutes as in Bitcoin) who centralized mining status quo [5]. By design, if a single exhibits a solution to a probabilistic computation puzzle pool operator controls more than half of the network’s called a “proof-of-work” (or PoW) puzzle [1]. The win- total mining power, then a classical 51% attack threat- ens the core security of the Nakamoto consensus protocol action set they want to include in a block. If widely [1]. Cryptocurrencies have witnessed that a single pool adopted, SMARTPOOL makes the underlying cryptocur- has commandeered more than half of a cryptocurrency’s rency network much more censorship-resistant. Finally, hash rate (e.g. DwarfPool1 in Ethereum and GHash.io2 SMARTPOOL does not charge any fees 4, unlike central- in Bitcoin) on several occasions. In such cases, the pool ized pools, and disburses all block rewards to pool par- operator’s goodwill has been the only barrier to an attack. ticipants entirely. Furthermore, pools currently dictate which transac- SMARTPOOL can be used to run mining pools for sev- tions get included in the blockchain, thus increasing the eral different cryptocurrencies. In this work, we demon- threat of transaction censorship significantly [6]. While strate concrete instantiations for Bitcoin and Ethereum. some Bitcoin pools currently offer limited control to SMARTPOOL can be run natively within the protocol of miners of transaction selection via the getblocktemplate a cryptocurrency — for instance, it can be implemented protocol [7], this protocol only permits a choice between in Ethereum itself. We believe SMARTPOOL can sup- mining with a transaction set chosen by the pool or min- port a variety of standard payoff schemes, as in present ing an empty block. The situation is worse in Ethereum mining pools. In this work, we demonstrate the standard where it is not yet technically possible for miners in cen- pay-per-share (or PPS) scheme in our implementation. tralized pools to reject the transaction set selected by the Supporting other standard schemes like pay-per-last-n- operator. For example, users recently publicly speculated shares (PPLNS) and schemes that disincentivize against that a large Ethereum pool favored its own transactions block withholding attacks [9–11] is left for future work. in its blocks to gain an advantage in a public crowdsale 3. Results. We have implemented SMARTPOOL prototypes One can combat these security issues by running a for Bitcoin and Ethereum mining and deployed them on pool protocol with a decentralized network of miners in Ethereum’s testnet. We measure the costs for miners place of a centralized operator. In fact, one such solution when submitting their contributions to the pool. Our ex- for Bitcoin, called P2POOL [8], already exists. How- periments show that these operating costs are negligible ever, P2POOL has not attracted significant participation compared to the projected income from block rewards from miners, and consequently its internal operational (e.g. less than 1% of gross income) for both Bitcoin and network remains open to infiltration by attackers. Sec- Ethereum. This cost is lower than fees offered by central- ondly, technical challenges have hindered widespread ized pools. Furthermore, each miner has to send only a adoption. Scalable participation under P2POOL’s cur- few messages per day to SMARTPOOL. Finally, although rent design would require the system to check a mas- being decentralized, SMARTPOOL still offers the advan- sive number of sub-puzzles. Furthermore, P2POOL only tage of low variance payouts like centralized pools. works for Bitcoin; we are not aware of any decentralized ASMARTPOOL implementation has been released and mining approach for Ethereum. deployed on the main network via a crowd-funded com- Solution. This work introduces a new and practical so- munity project [12]. As of 18 June 2017, SMARTPOOL- lution for decentralized pooled mining called SMART- based pools have mined in total 105 blocks on both POOL. We claim two key contributions. First, we ob- Ethereum and Ethereum Classic networks and have suc- serve that it is possible to run a decentralized pool mining cessfully handled a peak hashrate of 30 GHs from 2 sub- protocol as a smart contract on the Ethereum cryptocur- stantial miners. SMARTPOOL costs miners as little as rency. Our solution layers its security on the existing 0:6% for operational transaction fees, which is much less mining network of a large and widely deployed cryp- than 3% fees taken in centralized pools like F2Pool 5. tocurrency network, thereby mitigating the difficulty of As a final remark, SMARTPOOL does not make cen- bootstrapping a new mining network from scratch. Sec- tralized pooled mining in cryptocurrencies impossible, ondly, we propose a design that is efficient and scales nor does it incentivize against centralized mining or alter to a large number of participants. Our design uses a the underlying proof-of-work protocol (as done in work simple yet powerful probabilistic verification technique by Miller et al.[13]). SMARTPOOL simply offers a prac- which guarantees the fairness of the payoff. We also in- tical alternative for miners to move away from central- troduce a new data structure, the augmented Merkle tree, ized pools without degrading functionality or rewards. for secure and efficient verification. Most importantly, Contributions. We claim the following contributions: SMARTPOOL allows miners to freely select which trans- • We introduce a new and efficient decentralized 1https://forum:ethereum:org/discussion/5244/ dwarfpool-is-now-50-5 pooled mining protocol for cryptocurrencies. By 2https://www:cryptocoinsnews:com/warning-ghash-io- nearing-51-leave-pool/ 4The caveat here is that cryptocurrency miners will pay Ethereum 3https://www:reddit:com/r/ethereum/comments/6itye9/ transaction fees to execute SMARTPOOL distributively. collecting information about f2pool/ 5https://www:f2pool:com/ethereum-blocks leveraging smart contracts in existing cryptocurren- have a (predetermined) big dataset of 1 GB (increasing cies, a novel data structure, and an efficient verifi- over time).