arXiv:2104.01918v1 [cs.CR] 5 Apr 2021 ainEgneig hnhnUiest,Seze 518060 [email protected]) Shenzhen University, [email protected]; Shenzhen Engineering, mation ajn nvriyo cec n ehooy ajn 2100 Nanjing Technology, [email protected]). and [email protected]; Science mail: of University Nanjing lcsta r ikdtgte ofr hi.Tega of goal The chain. a form i to recorded together are linked transactions are where that chain, blocks and blocks, tions, [2]–[4]. Inte chains FinTech, supply as and demand such (IoT), integrity, that Things and of applications security various data of critical h foundation Blockchain the agreeme network, Byzantine become decentralized enable permissionless to bet ability a its transactions over to asset Thanks [1]. digital peers transparent and effective, the demonstrate to blockchain results. PoA miners, analytical the the solo si of in of consistency we process that i Finally, mining miners to mining. pooled of compared the the rates reduced disincentivizing generation are thereby res block pool analytical the mining Our PoA, the the respectively. under of miner rates that thi solo generation on verify block block and Based the the pool blockchain. analyze model mining then based to we PoA model, (CTMC) the CTMC empl of chain first We process Markov block. generation time a mined continuous pe successfully mining not a effective have protoco its they from PoW the if native benefit even measure miners the protocol, in to PoA Unlike mainta our (AoW) blockchain. to devoted Age-of-Work of has security using miner the the in that co period lies The mining protocol. effective PoA PoW native of the Pr upon idea called builds discourag protocol that To consensus (PoA) new security. of-Age a develop its blockchain, we mining, harms of pooled spirit and netw core decentralization, the the in the block. undermines power mining the forms computing pooled pool total in the the the the contained of of solve power portion reward computing substantial to form the aggregated power average the can share computing if the However, miners and their reduce individual aggregate together To to of puzzle miner. pool group mining the a a of time, T generation cryptocurrency). power a propor of block computing inversely generates is set the block a successfully a to generate (e.g., puzzle to reward time the waiting a average solved with puzz has along the block, solve who to miner powers computing the devoting secu by the maintain verif blockchain miners to PoW, of Under easy solve. is to crypt hard solution extremely a whose puzzle features mathematical (PoW) graphic Proof-of-Work blockchain, Ethereum Age-of-Work. .SiadT agcnrbtdeulyt hswork. this to equally contributed Wang T. and Shi L. .Wn,adS hn r ihteCleeo lcrnc n I and Electronics of College the with are Zhang S. and Wang, T. .SiadJ iaewt h colo lcrncadOtclE Optical and Electronic of School the with are Li J. and Shi L. lccanfaue he e opnns .. transac- i.e., components, key three features Blockchain secure, for technology supporting a as born was Blockchain Terms Index Abstract oe fPWBokhi sn Age-of-Work Using Blockchain PoW of Power oln sntFvrbe eetaieMining Decentralize Favorable: not is Pooling A h neligcnesspooo fBtonand Bitcoin of protocol consensus underlying the —As Bokhi,PW oldmnn,Proof-of-Age, mining, pooled PoW, —Blockchain, .I I. NTRODUCTION ogSi atoWn,JnL,adSegiZhang Shengli and Li, Jun Wang, Taotao Shi, Long hn (e-mail: China , 4 hn (e- China 94, ngineering, mulate tional ween but y the e ining riod nfor- ork, rnet ,in l, oof- ults rity i.e., le; oy he as re nt o- n n a s hswy h ie ucsflymnsablock. In a network. mines the local in successfully the nodes miner its if of the only updates majority way, the block this node by mined validated Each newly is th the block network. and appending entire transactions by blockchain the the contains to that are immediately nonce and it block nonce, valid in this it a if with part broadcasts block puzzle take a PoW generates the who solve miner can the those PoW, Under and miners. as mining, known called massive nonce). is (called exhaust solution process network a to generate blockchain hard to the extremely resources computing but in verify nodes to PoW The easy native solve. is The solution m whose Ethereum. cryptographic blockchain puzzle complex and computational dominating a Bitcoin features many protocol as which in such [1], deployed networks, (PoW) widely Proof-of-Work been has is prevai the most mechanism guarantee The network. to consensus the paramount of sustainability are and the which security realize variou [5], to goal, agreement implemented global this been Towards have mechanisms nodes. le consensus distributed trustless and different shared, public, among a enable to is blockchain ici lccanacutfroe 0 ftewoeblockch whole the of 90% over for account blockchain Bitcoin taeypooe n[]t nraeisrvnet oethan more to revenue its increase mining to selfish [7] the in use of proposed can 25% power than strategy computing more network occupies total that pool the mining record data a network the blockchain; total with on the tamper of arbitrarily 50% can power than computing more occupies that blockchain, pool mining of sprit core decentralization the pooli i.e., the undermines miners, power the computing to of benefits minin significant pooled thei bring While reduce of indeed rewards. greatly can the approach gain can to this pool time With the waiting in average reward. miners the towards the share mines mining, a pooled and miners incentivizes target participating this same all int result, the where powers a pool, computing their As mining aggregate tiny. a to very miners machine solo is mining of block group ASIC a dedicated sol mine a with to for deployed chance the For even network, block. relatively miner Bitcoin a current with generate the miners may in successfully solo number example, it to the Consequently, power large for computing period. a time small certain long performing a extremely by within take rewards trials computin this large hash the In with of miners gain reward. the the to for harvest likely power more to is process it computin mining context, their the contribute to miners th powers by the Driven cryptocurrency. of mechanism, set incentive a with rewarded is block a 1 ntebokhi ewr,temnrta ucsflymine successfully that miner the network, blockchain the In h optn oeso h ags iemnn ol ntec the in pools mining nine largest the of powers computing The 1 n am t euiy o xml,a example, For security. its harms and , i [6]. ain urrent dger The ling ath ng ed is o o g g g e s s 1 r 2 that of the honest mining. • Model analysis: We model the block generation process To overcome this problem, we develop a new consensus of PoA based blockchain by using a continuous time protocol called Proof-of-Age (PoA) that builds upon the native Markov chain (CTMC) model. In the proposed model, PoW protocol. The objective of PoA is to disincentivize cen- we decouple the highly correlated mining process of tralized pooled mining so that the miners with small computing all miners as two parties, i.e., a typical miner and powers can participant in and earn rewards from the mining treat the impact of other miners as a whole from the competition. The core idea of PoA lies in using Age of Work typical miner’s perspective. Meanwhile, we approximate (AoW) to measure effective mining period that the miner has the block generation process of other miners as a single devoted to maintaining the security of blockchain. Unlike in exponential distribution with a rate parameter. In this the original PoW protocol, in our PoA protocol, the miner context, the CTMC model is well-suited to capture the benefits from its effective mining period even if it has not mining process of PoA. Furthermore, based on the CTMC successfully mined a block that contains a valid nonce. In model, we analyse the block generation rates of the min- particular, PoA exploits the accumulated AoW to reduce the ing pool and each solo miner respectively. In particular, mining difficulty if the miner can prove its effective work for our analytical results verify that the block generation rate a certain period without gaining any reward. Specifically, if of the mining pool in PoA is much less than that in PoW, a miner really works but it fails to mine a block, its AoW thereby deincentivizing the pooled mining under PoA. It still increases; and its mining difficulty will be reduced if its is shown that the block generation rate of the mining accumulated AoW reaches a predesigned threshold; the AoW pool under PoA can be reduced to 75% of that under of a miner reduces to the smallest immediately it successfully PoW by a proper difficulty adjustment strategy. Next, we generates a block, resulting in the maximum mining difficulty investigate the distributions of block inter-arrival times of in the next mining round2. The main contributions of this paper the mining pool and solo miners respectively. Particulary, are listed as follows: we verify that the block inter-arrival time of all solo miners is exponentially distributed. • Protocol design: We put forth the design of PoA protocol including the hash puzzle, data structure, mining targets, • Event-driven simulations: We simulate the mining process and difficulty adjustment. Different from native PoA, we in the PoA based blockchain by using the event-driven introduce a new parameter called age ring into the input method. To investigate the block generation rate, we of hash puzzle. From the data structure of age ring, PoA generate the numerical results of the mining pool and also enables a chain of age ring, since the generation each solo miner by the fixed point iteration method and of age ring in the current mining round depends on that compare the numerical results with the simulation results, in the previous round. In addition, we set two different and we show that the numerical results are consistent targets for the mining of age ring and block respectively, with the simulation results. Moreover, we show that the such that the generation of an age ring is much easier simulated distribution of the block generation times of all than that of a block. For each mining round, the AoW solo miners matches well with the theoretical exponential of a miner will be increased if the solution of hash distribution, and the simulated distribution of the block puzzle falls into the predesigned target region (i.e., the generation times of the pool fits well with the analytical associated age ring in this round is effective), while the results. We finally compare the block generation rates of AoW of the miner will be recounted from the initial value PoW and PoA in the simulations. The simulation results immediately the miner successfully generates a block. highlight that not only the block generation rate of the Furthermore, we propose a difficulty adjustment strategy pool in PoA is much less than that in PoW, but also the of block mining, where the miner will be rewarded by a variability of block inter-arrival times of the pool in PoA smaller mining difficulty if its accumulated AoW reaches is much less significant than that in PoW. a predesigned threshold. The rest of this paper is organized as follows. Section II reviews the related work. Section III presents background on 2The idea of PoA originates from the random access problem of wireless the PoW blockchain. Section IV introduces the PoA protocol. channels, where transmitters access the channel to transmit their information Section V proposes the CTMC model of PoA and analyzes the in a distributed manner according to some random access protocol. In [8], block generation rates of PoA blockchain. Section VI provides the concept of Age-of-Information (AoI) [9] is used to design the random access protocol. If a transmitter successfully access the wireless channel by the numerical results. Finally, Section IV concludes this work. sending an information, its instantaneous AoI returns to one; otherwise, its instantaneous AoI is increased by one. AoI is a metric to evaluate the freshness of the information hold at the transmitter for transmissions. The wireless II. RELATED WORKS network can use AoI to coordinate the random access to achieve some kind of fairness among transmitters [8]. A variety of consensus protocols have been developed to In PoA based blockchain, we treat blocks as information transmitted by cope with the shortcomings of native PoW. One shortcoming miners. Then, we can use a metric similar to AoI (i.e., AoW in PoA) to of PoW is the low on-chain transaction processing capa- adjust the mining difficulties of miners. The situation is very similar to the random access of wireless channels. If a miner has successfully mined a block bility. To increase the transaction processing capability of and added the block onto the blockchain, it corresponds to one-time successful PoW blockchain, [10]–[14] modify the data structure of the access of a transmitter to wireless channel. The intuition of our design is that blockchain, and [15]–[18] decouple the functionality of the the miners with relatively lower AoW should access the channel (i.e., add blocks onto the blockchain) with smaller probability, while it is easier for the block. However, the focus of our PoA is not on improving miners with higher AoW to mine a block. the transaction processing capability. The aim of PoA is to Situation I Situation II Situation III
Block mined by Block mined by miner i Blockchain miner i
Block Block Block Block Ċ Ċ Block
Age rings computed Age Age Age ring ring ring by miner i Ċ Ċ 3 deincentivize the centralization of computing powers caused by the pooled mining in blockchain. Block Header To decentralize the pooled mining, the consensus protocols CurrentCu rr en t BlBlockoc k HaHashsh PreviousPr ev io us BBlocklo ck HHashas h of Fruitchain [19] decouples the transaction-carrying function- Previous Next ality of the blockchain. Fruitchain enables two independent Block NonceNo nce Block mining processes on top of each other. In addition to the MerkleMe rk le RootR oo t block mining, Fruitchain requires an additional PoW to mine BlockBlo Bodyody a new type of block called “fruit”. More specifically, the fruit Hash Hash needs to point to an earlier block not too far from the block Hash Hash Hash Hash that records the fruit. In this way, each block confirms a set of its recent fruits, while the fruits confirm transactions in Tx Tx Tx Tx this block. The fruit mining also requires solving partial PoW that corresponds to finding a nonce with a difficulty level Fig. 1. The data structure of the Bitcoin blockchain. much smaller than the block mining. Consequently, the solo miner with small computing power can reap from mining the fruits, once the fruits are confirmed by the block. Different strategies under PoW, i.e., to calculate a selfish miner’s benefit from Fruitchain, PoA largely follows the data structure and as well as to determine the mining power threshold at which communication protocol of native PoW with the cost of this attacker is beneficial.To extend the selfish mining, DTMC negligible overhead caused by age rings. Similar to the fruit is also used in [23] to study the mining revenue of the mining in Fruitchain, the mining difficulty of an age ring is selfish miner under stubborn mining strategies. Later on, [24] much smaller than that of a block. However, the age rings modifies DTMC of selfish mining strategies by incorporating do not contain any transactions, but are used to validate the the impact of transaction fees and studies the corresponding miner’s AoW. Generally, there are three notable disadvantages mining performance. Moreover, [25]–[27] exploit the model of of Fruitchain compared with our PoA. First, broadcasting the Markov Decision Process (MDP) to generalize selfish mining fruits in Furitchain increases the communication overhead of behaviors and find the optimal selfish mining behavior. How- the network. Second, Furitchain needs to modify the consensus ever, as the number of miners in the network increases, using mechanism in the layer one of the blockchain, thus it has diffi- DTMC/MDP results in an unaffordable model complexity due culty in compatibility with the current PoW based blockchains. to the huge state space and correlation among these miners. To Finally, the rewards contained in the block need to be allocated address this issue, we employ the CTMC to model the mining to the fruits, resulting in instable profits earned by miners. process of PoA with a decoupling hypothesis. With the aid of Nowadays, two decentralized mining pools are proposed the CTMC model, we can further derive the block generation for Bitcoin and Ethereum blockchains. For Bitcoin, P2Pool rate and analyze the distribution of block inter-arrival time. [20] creates a new blockchain wherein the block is generated to record the shares of the miners in the pool. However, the P2Pool network needs to check a massive number of III. BACKGROUND OF BLOCKCHAIN AND POW shares submitted from different participants in the pool in This section presents the background of the PoW based each mining round. Differently, the miners under the proposed blockchain. PoA protocol are required to verify the age rings only from a single miner that are included in the newly generated block. For Ethereum, Smartpool in [21] runs a decentralized mining A. Data Structure of Blockchain pool protocol as a smart contract. In spite of lower cost than centralized pools, miners still need to acquire Ether to pay for Blockchain is a chain of blocks with each block containing the gas when interacting with the smart contract in smartpool. a header and a set of transactions issued by the payers. As an extension of PoW, Proof-of-Contribution (PoC) ad- Specifically, the issued transactions are broadcast over the justs each miner’s mining difficulty by introducing success blockchain network. Participants then collect and include these times (i.e., the number of times the miner has added a valid transactions into blocks and append them to the blockchain. block to the chain) [22]. The higher success times the miner The header of the block encapsulates the hash of the preceding accumulates, the smaller the mining difficulty of the miner block, the hash of this block, the merkle root of all transactions becomes. Therefore, PoC motivates honest mining behaviour contained in this block, and a number called nonce that is by rewarding the difficulty reduction. However, PoC cannot generated according to the consensus protocol of PoW. Since decentralize the pooled mining if the pool’s work is legitimate each block must refer to its preceding block by placing the and honest. Differently, the proposed PoA protocol rewards hash of its preceding block in its header, the sequence of the partial PoW of the miner by adjusting its mining difficulty blocks then forms a chain arranged in a chronological order. if its accumulated AoW meets a predesigned threshold. Thanks to the cryptographic chain structure, blockchain is To analyze the mining behaviors and the mining perfor- tamper-resistant to modification of its past recorded data such mances in blockchain networks, discrete time Markov chain that participants can only append new data to the tail-end of (DTMC) was widely applied in the existing works. For ex- the chain of blocks. Fig. 1 illustrates the data structure of ample, [7] employed DTMC models to analyze selfish mining Bitcoin blockchain. 4
B. Preliminaries of PoW where we use e−1 = lim (1 − 1 )x for the approximation in x→∞ x the last equation when D is very large. Bitcoin blockchain adopts the PoW consensus protocol Consider that a miner has the computation rate (i.e., hash among a number of participants to validate new blocks in rate) of w, i.e., the number of hash trails per unit time slot. If a decentralized manner. In each round, the PoW protocol each trial for the miner takes the time of ∆t = 1/w, then n selects a leader to pack transactions into a block and appends trials take t = n∆t amount of time. Given (4) and p =1/2D, this block to blockchain. To prevent adversaries from tamper- we have ing blockchain, the leader selection must be approximately random. Since anonymity is inherently designed as a goal P r(T ≤ t)= P r(t amount of time or less to mine a block) − t 1 − w t −λ t of permissionless blockchain, it must not be vulnerable to =1 − e ∆t 2D =1 − e 2D =1 − e D , (5) the sybil attack where the adversary simply creates many D participants with different identities to increase its probability where λD = w/2 . of being selected as the leader. To address the above issue, the From (5), the PDF of block generation time is key idea behind PoW is that a participant will be selected as dP r(T ≤ t) p (t)= = λ e−λD t. (6) the leader of each round with probability in proportion to its T dt D computing power. According to (6), the block generation time follows an expo- In particular, blockchain implements PoW by using compu- D nential distribution with rate of λD = w/2 . tational hash puzzles. To create a block at height k, the nonce placed into the header of the block must be a solution to the IV. POA PROTOCOL DESIGN hash puzzle expressed by the following inequality [28]: In this section, we propose a modified PoW consensus hk = H(bk−1, xk,yk) ≤ T (D), (1) protocol, called Proof-of-Age (PoA). Unlike in the native PoW protocol, the miner in PoA benefits from its effective where h is the hash of the candidate block at height k and k mining period (measured by Age-of-Work) as long as it has it is a bit stream of length L, H(·) is the cryptographic hash devoted computing powers to maintaining the security of the function, b is the hash of previous block header at height k−1 blockchain, even if the miner has not successfully mined a k − 1, x denotes the solution string of the nonce, y denotes k k block. the binary string assembled based on the other data contained in the candidate block (e.g., the Merkle root of the included transactions), T (D)=2L−D is a target value, and D is the A. Hash Puzzle of PoA current difficulty level of the hash puzzle (i.e., the number of The miners can either mine the block independently and leading zeros in the hash of a valid candidate block). Using individually (i.e., solo mining) or mine the block together by the blockchain terminology, the process of computing hashes aggregating their power into a pool (i.e., pooled mining). The to find a nonce is called mining, and the participants involved design of PoA ensures that there is no incentive to form the are called miners. mining pools, i.e., the average profit per miner in the mining With a difficult level D and the corresponding target T (D), pool is less than the average profit of a solo miner. each single query to the PoW puzzle expressed in (1) is an As in the PoW protocol, a new block in PoA is generated i.i.d. Bernoulli test whose success probability is given by by solving a computational hash puzzle. The mining process of the original PoW protocol aims to solve the hash puzzle in T (D) −D (2) (1). To introduce the metric of AoW to the mining process of P r(xk : H(bk−1, xk,yk) ≤ T (D)) = L =2 , 2 PoA, we add a new parameter called age ring into the input When D is very large, the above success probability of a single of the hash puzzle. For the exposition of our PoA protocol, query is very tiny. Moreover, it is known that, with a secure we consider the mining process of a typical miner (either a hash algorithm (e.g., the SHA-256 hash used for Bitcoin), the mining pool or a solo miner) indexed by i at the blockchain only way to solve (1) is to exhaustively search every possible height k. At height k, miner i executes the mining process by nonce. Therefore, the probability of finding such nonce to querying the hash of the following form: solve (1) is proportional to the computing power of the miner. That is, the faster the hash function in (1) can be computed H(bk−1, xk,yk, rk,PKi), (7) in each trial, the more nonces can be tried per unit time. where rk is the age ring of the miner at blockchain height Let −D in (2). The probability that the miner can find p =2 k, and PKi is the address of the miner (i.e., the hash of its a block by n trails follows a geometric distribution: public key). In (7), all the inputs are concatenated into a single P r(n trails used to mine a block) = (1 − p)n−1p, (3) string that is processed by the hash computation.
From (3), we have B. Data Structure of Age Ring P r(n trails or fewer used to mine a block) Suppose that miner i’s most recently mined block is at n−1 blockchain height k−n, where n> 0. The miner is allowed to p≈0 = (1 − p)n−1p =1 − (1 − p)n −−→ 1 − e−np, (4) compute a single age ring at each blockchain height, and the i=0 age ring must be involved in the mining process, as expressed X 5
HbxyrPK() kkkki-1, ,,,
Outcome I Outcome II Outcome III
L 0 TM TA 2
Fig. 2. An illustration for three different mining outcomes. in (7). From its latest successful mining at blockchain height The AoW is used to adjust the mining difficulty in the k − n to the mining at blockchain height k, miner i has n PoA protocol. Before delving into the adjustment of mining age rings {rk, rk−1,...,rk−n+1}, where rl is the age ring difficulty with AoW, we discuss how to obtain effective age of this miner attached to the block at blockchain height, rings and how to generate a block under PoA respectively. l = k − n +1, k − n +2,...,k − 1, k. The data structure of the age ring rl attached to the block l is given by D. Mining Outcomes of PoA
hrl−1,bl−1, wli, l = k − n +2,...,k − 1, k Unlike in the PoW protocol, we set two mining targets TA rl = (8) hbl−1, wli, l = k − n +1 and TM in the PoA protocol, where TA and TM correspond to the mining of age ring and block respectively. Furthermore, where h·i is a concatenation operator and b is the hash of l−1 we have T 6 Block mined by Block mined by miner i Blockchain miner i Block Block Block Block Block k-n-1 k-n k-n+1 Ċ Ċ k-1 k Age rings computeded Age Age Age ring Ċ Ċ ring ring by miner i k-n+1 k-1 k Fig. 3. An illustration for the mining process under the PoA protocol. increased by one, i.e., ∆i(l) = ∆i(l − 1)+1, due to a E. Difficulty Adjustment factor that the age ring r is effective now. After that, the k The essence of our PoA protocol is to construct a function miner includes the age ring r into the input of the hash k f(·) that maps the AoW of each miner, i.e., ∆ (l), to a mining function to mine the block. The mining target T of age i A difficulty level D = f(∆ (l)) ∈ {d , d ,...,d ,...}, where ring is fixed for all miners over all blockchain heights. i 1 2 w d denotes the mining difficulty level when ∆ (l) = m. In The value of T is preset according to the mining power m i A this paper, we consider a case that the difficulty level D can unit p. In this paper, we need to ensure that each miner only take two values, i.e., D ∈ {D ,D }, where D ≫ D . with p can compute an effective age ring that satisfies (12) 1 2 1 2 Specifically, the function f(·) that maps the AoW mining with probability approaching one in the mining process difficulty levels is given by at each blockchain height. • Outcome III: the computed hash result is larger than T , D , ∆ (l) <δ A D = f(∆ (l)) = 1 i (14) i.e., i D , ∆ (l) ≥ δ 2 i H(bk−1, xk,yk, rk,PKi) >TA. (13) This mapping of mining difficulty level means that if the AoW is no less than a threshold δ, the miner mines with a If this outcome happens, the miner fails to compute an larger mining difficulty D1; otherwise, the miner mines with effective age ring, not to mention the successful block L−D a smaller difficulty D2. From (1), we have T (D)=2 , mining. In this case, the age-ring proof keeps at its initial which means that a larger D gives a smaller TM . Recall that value w = NULL, and the AoW of this miner at k the mining target of age ring TA is preset and fixed for all blockchain height k is invariant. miners. The general form of the multi-level mining difficulty mapping function f(·) will be considered in the future work. Regarding our PoA protocol, we have the following remarks. We illustrate the mining process of miner i at blockchain Remark 1 (Age-ring chain): The idea on the mining pro- height k in Fig. 3, where green squares represent the blocks cess in (7) and the recursive data structure of age rings in (8) mined by miner i, blue squares represent the blocks mined by is that all age rings between two adjacent blocks generated other miners, green rounds represent the age rings computed by the same miner form a chain, i.e., the current age ring by miner i, and arrows represent the dependency among blocks is computed using the previous age ring. Due to the chain and age rings. This figure illustrates the case that mine i has of age rings, the age rings cannot be computed at the same generated two blocks k−n and k in sequence. Notably, the age time and can only be computed one by one along with each rings of a miner also form a chain between any two adjacent block. Thus, the miner has no incentive to split its power into blocks mined by this miner. Since the mining of block k is multiple parts and use these parts to simultaneously generate multiple age rings in each mining round. performed based on the hash of the previous block header bk−1 Remark 2 (Negligible overhead of age ring): If the miner and age ring rk (as specified by the hash form in (7)), there are two arrows coming out of block k that point to block k−1 has generated a block (i.e., finding a nonce satisfying (8)), it needs to include the eligible nonce together with current and age ring rk, respectively. Since age ring rl links to rl−1 through the recursive data structure of age rings (as defined in age ring into the block. Note that the age ring is just a set of hashes; hence the storage overhead introduced by the age (8)), there is an arrow coming out of age ring rl that points to rings is negligible. age ring rl−1. Meanwhile, the computation of age ring rl also incorporates the hash of block header bl−1, and thus these is Remark 3 (Block verification): Once a miner successfully also an arrow coming out of rl pointing to the block at height generates a block, it will include the nonce, the age ring, l − 1. We stress that i) the AoW of miner i returns to zero and its address into the block, and broadcast the block to the at the blockchain height where it has successfully generated whole network. The network can easily validate this block by the block; ii) AoW keeps increasing with the generation of checking if the nonce satisfies (8) and the age rings satisfy effective age rings. (12), respectively. 7 D D D2 l 2 l 1 l b b b 0 l D1 1 l D1 2 d - d d + b b 1 1 l l l l l l l l l l l s o s o s o s o s o s D l 1 D D D b l 1 l 1 l 2 l D2 s1 b s2 b sd -1 b sd b sd +1 Fig. 4. CTMC of the block arrival process under PoA. Remark 4 (Sybil attack resistance): Each miner i on the model complexity1 due to the huge AoW state space for blockchain is identified by its address PKi and the age rings handling all of the miners. Specifically, the number of AoW are tied to the address. It is impossible that a miner can mine states of all the miners is exponentially related to the total the block using the age rings obtained by other miners with number of the miners in the network. To address this issue, we different addresses. If a newcomer (i.e., a miner with a new propose to model the mining process of PoA with a decoupling address) begins to mine, its AoWs is defaulted tos be zero. hypothesis, where we focuss on the mining process of a typical This mechanism can prevent malicious miners from making miner and treat the aggregation of all other miners as the multiple addresses to carry out sybil attacks, since each new surroundings of this typical miner. Let us define one other address needs to mine with the largest difficulty. miner with respect to the typical miner as an exterior miner. Remark 5 (Memoryless mining): When a miner generates Under this decoupling hypothesis, we only need to model the an effective age ring at a blockchain height before any other interior states of the typical miner and the interaction between miner successfully generates a block, this miner can include the typical miner and its surroundings, i.e., the aggregation of this effective age ring into (7) and continue to mine the block all exterior miners. at this height. Due to the memoryless property of the mining The interior state of the typical miner will transit as long process [29], the block generation probability of this miner as either it finds a block/an effective age ring or any exte- after an effective age ring is found is still the same as the rior miner finds a block. Given fixed mining difficulty level probability when it mines at the very beginning at this height. and AoW, the inter-arrival time of blocks (i.e., the block generation time) found by a miner follows an exponential V. MODEL ANALYSIS distribution. Moreover, since the generation of effective age In this section, we mathematically model the mining process rings is also made from the mining process, the inter-arrival of PoA and analyze the block generation rate (i.e., block time of effective age rings found by the typical miner also throughput) of the PoA based blockchain. follows an exponential distribution. However, since the AoW states of different exterior miners are diverse and correlated, A. CTMC Model different exterior miners may have different mining difficulties, and the mining processes of different exterior miners follow We consider a blockchain network consisting of N miners exponential distributions with different rates. As a result, it each with unit computing power. The total mining power of is challenging to characterize the block inter-arrival time of the network is N. Suppose that in the network, there exists a all exterior miners. Fortunately, as we will show in Section single mining pool that aggregates N1 miners, and each of the V-C, the block inter-arrival time of all exterior miners can other N2 = N − N1 miners performs the solo mining. The be well approximated by a single exponential distribution. power of the pool is N1, i.e., the sum power of its members. Now, since the inter-arrival time of each event that triggers the The investigation on the block throughput of the PoA state transitions under PoA can be treated as an exponential blockchain is related to the stochastic process of block arrival distribution, we can model the mining process of a typical on the blockchain. The average rate of block arrival process is miner under the PoA protocol using the tool of Continuous- impacted by the hash powers and the mining difficulties of the Time Markov Chain (CTMC) [30], described as follows. miners. According to our PoA protocol, the mining difficulty Fig. (4) shows the proposed CTMC model under the PoA of each miner is determined by its AoW that changes with protocol consisting of two types of states: the interactions among different miners in the mining process. Consequently, the AoW states of the miners are correlated and • State i, i ∈{0, 1,...,δ,δ+1,...}, means that the current coupled together. In this context, we need to track the AoW AoW value of this typical miner is i. The effective age states of the miners for the block throughput analysis. ring has not been generated at the current blockchain The most accurate way to analyze the block throughput height, and thus it can be generated; of the PoA blockchain is to model the AoW states of each • State s¯i, s¯i ∈ {s¯1, s¯2,..., s¯δ, s¯δ+1,...}, means that the individual miner. However, this will lead to unaffordable current AoW value of this typical miner is i. The effective 8 age ring has been generated at the current blockchain By some mathematical manipulation, we have height, and thus it is not allowed to be generated again. i P0(Φ1) , 1 ≤ i ≤ δ − 1 Assume that the typical miner of interest is in state i. Pi = δ−1 i−(δ−1) (16a) P0(Φ1) (Φ2) ,i ≥ δ Following the PoA protocol, the typical miner attempts to λs i−1 mine the block by conducting the hash queries in (7). The P0 D1 (Φ1) , 1 ≤ i ≤ δ − 1 (λb +λo) Ps¯i = λs δ−1 i−1−(δ−1) (16b) mining result that will trigger the state transition of the miner P0 D (Φ1) (Φ2) ,i ≥ δ (λ 2 +λ ) is either a nonce satisfying (11) or a nonce satisfying (12). If a b o nonce that satisfies (11) is found, a new block is found by this λsλo λsλo where Φ1 = D D and Φ2 = D D . (λ 1 +λ )(λ 1 +λ ) (λ 2 +λ )(λ 2 +λ ) typical miner and then the state of this miner transits to state b s b o b s b o Plugging (16a) and (16b) into (15e), we have 0. If a nonce that satisfies (12) is found, an effective age ring is generated by the typical miner and the state of this miner ∞ P0 =1 − (Pi + Ps¯i ) transits to state s¯i, where the miner updates its AoW using the effective age ring and adjusts its mining difficulty with updated i=1 X 1 AoW accordingly. Note that after the miner generates the = . (17) λs λsλo δ−1 λs λs 1+ D1 + ( D1 D1 ) ( D2 − D1 ) effective age ring at the current blockchain height, it continues λb (λb +λs)(λb +λo) λb λb to mine the block at this height. As a result, the typical miner Given (16a), (16b), and (17), the block generation rate of can either generate a block ahead of all exterior miners in the the typical miner is given by current mining round, or increase its AoW for the successor mining rounds if any exterior miner generates the block ahead. δ−1 ∞ D1 Since the AoW value of the typical miner drops to zero (i.e., ρtypical = (Pi + Ps¯i )+ (Pi + Ps¯i ) = (λb + λs)P0 the state of this miner transits to zero) if the block is generated i=0 i=δ X 1 X by the typical miner, the recurrence time of state 0 is the block = , (18) 1 λs δ λo δ−1 1 1 inter-arrival time of the typical miner (i.e., the time between D1 + ( D1 ) ( D1 ) ( D2 − D1 ) λb λb +λs λb +λo λb λb two successive visits of state 0). In view of these transitions, 5 D1 we define the transition rates in the CTMC as where ρtypical = λb if either δ goes to infinity (i.e., no one can reach state δ) or D = D (i.e., the difficulty control of • effective age ring generation rate under difficulty level 1 2 D2 PoW), and ρtypical = λ if δ =1 (i.e., the difficulty reduces Ds, i.e., λs; b as long as a single effective age ring is generated). From (18), • block generation rate of the typical miner under difficulty D1 D2 D1 D2 D1 we further have λ ≤ ρtypical ≤ λ , since λ ≤ λ . level D1, i.e., λ ; b b b b b For a miner in the PoW based blockchain network, the block • block generation rate of the typical miner under difficulty D2 generation rate of the miner is the ratio of its computing power level D2, i.e., λ ; b to the total computing power of the whole network; moreover, • block generation rate of all exterior miners, i.e., λo. the variance of block inter-arrival time is proportional to the where λD1 = w/2D1 , λD2 = w/2D2 , and λ = w/2Ds . Due b b s inverse of its computing power [29]. Therefore, the block to the memoryless property of exponential distributions, the inter-arrival time usually exhibits very large variance for a transition rate from states i to s¯ is independent of that from i solo miner with relatively small computing power. As a states i +1 to 0. From Remark 5, if the typical miner has result, it may take extremely long time for the solo miner generated an effective age ring, he does not become any closer to successfully mine a block. In reality, this result incentivizes to the block generation than he was in the beginning. the solo miners to aggregate their computation powers into a mining pool, where all participating miners work together B. Block Throughput Analysis to mine and share the revenue as long as any miner in Let Pi denote the steady-state probability that the chain is the pool successfully finds a block. With this approach of in state i, i ∈{0, 1,...,δ,δ +1,...}. By equating the rates of pooled mining, the miners in the pool can greatly reduce their flow into and out of each state, the steady-state probabilities variances of the block inter-arrival time and get paid regularly in the irreducible6 CTMC yield in every day, although the block generation rate of each miner in the pool is not changed. The pooled mining can indeed (λD1 + λ )P = λ P , 1 ≤ i ≤ δ − 1, (15a) b s i o s¯i bring significant benefits to the miners; however, the pooling D2 (λb + λs)Pi = λoPs¯i ,i ≥ δ, (15b) of computing power undermines the decentralized nature of D1 the blockchain, which can potentially cause serious security (λb + λo)Ps¯i = λsPi−1, 1 ≤ i ≤ δ − 1, (15c) D2 threats to the blockchain. (λb + λo)Ps¯i = λsPi−1,i ≥ δ, (15d) ∞ ∞ In the following, we will reveal that the PoA protocol discourages the pooled mining, and thus it is not worthwhile P + P =1. (15e) i s¯i for the miners to form the mining pool. To this end, we first i=0 i=1 X X characterize the block generation rates of the mining pool and 5It is customary not to show the self-transition from state i to state i in the all exterior miners (i.e., solo miners) based on (18), and then CTMC, since the transition rate can be cancelled out in the balance equation prove that the block generation rate of the mining pool under at equilibrium for state i. 6A Markov chain is irreducible if every state can be reached from every PoA is not proportional to its aggregated computing power other state. and can even be much less than its proportion. 9 Let us use the CTMC in Fig. 4 to track the mining process Algorithm 1 Fixed-point iteration of the mining pool. In this case, the typical miner becomes the 1: Initialization: N, N1, N2, δ, D1, D2, Ds, ǫ, {ρpool(1),ρsolo(1)} = D1 D1 mining pool, and the decoupling assumption still holds. Using {N1/2 , 1/2 } 2: while γ > ǫ do (18), we can specify the block generation rates of the mining 3: k ← k + 1 pool and each solo miner respectively as 4: Update {ρpool(k),ρsolo(k)} by plugging {ρpool(k − 1),ρsolo(k − 1)} into (19) and (20) − − 2 − − 2 N1 (ρpool(k) ρpool(k 1)) +(ρsolo(k) ρsolo(k 1)) ρpool = , (19) 5: γ = − 2 − 2 2D1 + φ (ρpool(k 1)) +(ρsolo(k 1)) pool 6: end while 1 (20) 7: Output: {ρpool(k),ρsolo(k)} ρsolo = D , 2 1 + φsolo where D1+D2 Therefore, we conclude that the pooling under PoA can 2 δ N2ρsolo δ−1 φpool =( ) ( ) × disincentivize the pooled mining from the block generation 2D2+Ds +2D1+D2 N /2D1 + N ρ 1 2 solo rate perspective. (2D2 − 2D1 ), (21) D1+D2 2 δ φsolo =( ) × C. Distributions of Block Inter-Arrival Time 2D2+Ds +2D1+D2 In this part, we analytically validate the distributions of (N2 − 1)ρsolo + ρpool ( )δ−1(2D2 − 2D1 ), block inter-arrival times of the mining pool and the solo miner D1 1/2 + (N2 − 1)ρsolo + ρpool respectively. The key point of the following analysis is the (22) relative magnitudes of the “time it takes for the state 0 to where, for the pool in (19), the aggregated block generation reach δ” and the “time to generate a block at difficulty level rate of all exterior miners is λo = N2ρsolo; for each solo miner of D1”. If the former is much shorter than the latter, then the in (20), the aggregated block generation rate of all exterior effective difficulty level is D2. miners is λo = (N2 − 1)ρsolo + ρpool. Using the fixed-point First, let us consider a solo miner. For the solo miner, the iteration (FPI) in Algorithm 1, we can compute the block average time to generate an effective age ring is 2Ds , and generation rates of the mining pool and each solo miner. the average time to move from state s¯i to state i is less than From (19) and (20), total throughput of the PoA based 2D1 /(N − 1). In total, the average time from state 0 to state D1 blockchain network is given by Ds 2 s¯δ is therefore less than δ(2 + N−1 ). Note that the average D1 time to generate a block at difficulty level D1 is 2 . In our ρtotal = ρpool + N2ρsolo. (23) setting, N is large and D1 ≫ Ds. Thus, the state almost Furthermore, the relative rate gain of the pool over all always reaches s¯δ before a block is generated at D1. Thus, exterior miners is defined as the ratio between the block as an approximation, we can treat the effective difficulty level generation rates of the pool and all solo miners, given by of a solo miner as D2. Its average block generation time is therefore exponentially distributed with rate of 1/2D2 . ρpool N1 FPoA = = G, (24) Next, consider the mining pool. The average time to gen- N2ρsolo N2 erate an effective age ring (go from state i to state s¯i+1) is where Ds 2 /N1. With the approximation in the previous paragraph, 2D1 + φ the average time to go from state s¯ to state i is 1/λD2 = solo (25) i b G = D . D2 2 1 + φpool 2 /N2. In total, the average time to go from state 0 to state s¯ is therefore t¯ = δ(2Ds /N +2D2 /N ). The associated Furthermore, it is clear that F = N /N is the relative δ δ 1 2 PoW 1 2 random variable is a sum of 2δ random variables. Using the rate gain under PoW. As such, we refer to as the gap of G law of large numbers, we can approximate the generation time relative rate gains between PoA and PoW. From (25), it can of s¯ as a Gaussian distribution with mean t¯ and variance be verified that G =1 holds if either N =1 (i.e., no pooled δ δ 1 σ2 = t¯ /δ (i.e., t ∼ N (t¯ , σ2)), when δ is sufficiently large. mining) or goes to infinity. In this case, . δ δ δ δ δ δ FPoW = FPoA In addition, the average time for the mining pool to generate To show that PoA can discourage the pooled mining, we a block at difficulty level of D is 1/λD1 =2D1 /N . first verify that G< 1, i.e., 1 b 1 Let tδ be a realization of the time to reach state s¯δ. Let t be ρpool N1 the block inter-arrival time. Given tδ, we have the conditional FPoA = < FPoW = . (26) N2ρsolo N2 PDF of the block inter-arrival time of the pool as D1 To prove (26), it is equivalent to proving that D1 −tλ λ e b u(tδ − t), for t D2 D1 Fig. 9 shows the normalized block generation rates of with Q(·) being the Q-function and η = λb − λb . Fig. 7 in Section VI will demonstrate the distributions of the mining an individual miner inside the pool under PoW and PoA pool and solo miners. respectively, where the y-axis is the block generation rate of an individual miner and the x-axis is the power ratio of the VI. NUMERICAL AND SIMULATION RESULTS mining pool. First, under PoA, the block generation rate of each individual miner inside the pool decreases as the pool’s We use event-driven simulations to model the block gen- power ratio increases. This is due to a fact that as the increase eration process under PoA, where an event represents a state of the pool’s power ratio (i.e., the increase of the number of the of the CTMC in Fig. 4. With the event-driven simulations, we miners in the pool), the increase of block generation rate of the only focus on the time that a state holds before it moves to the pool is negligible. Second, under PoW, the block generation other state. In this way, we can record the block inter-arrival rate of each individual miner inside the pool is the same as times of both mining pool and solo miner. that outside the pool, and keeps invariant over the range of power ratio; however, its variance is deceased by participating A. Simulations of Throughput and Block Inter-arrival Time in the pool. Consider that a blockchain network with N = 100 miners 6 VII. CONCLUSION for 10 blocks, where D1 = 32,D2 = 25, and Ds = 15. Fig. 6 shows total throughput of the PoA based blockchain In this paper, we have proposed a novel consensus protocol, network with δ = 10 and δ = 50, respectively. Consider called PoA, to disincentivize the pooled mining. Following the N1/N2 ∈ [1/100, 1/3]. The numerical results of total through- native PoW protocol, the miners under PoA reap the rewards put of the blockchain network and the block generation rates by solving the mathematical puzzles. In contrast to PoW, we of mining pool and solo miners are obtained from the FPI in introduced AoW to measure the effective mining period that Algorithm 1. First, it is observed that the numerical results the miner has spent solving the puzzles, and included the match the simulation results. Second, each subfigure shows age ring in the block head as the input of hash puzzle to that the throughput decreases as the pool becomes larger. prove AoW. Regarding the protocol design, we proposed two Compared with Fig. 6(a), both total throughput and block different mining targets for the effective age ring and block generation rates in Fig. 6(b) reduce due to a higher δ. respectively. In each mining round, the AoW will be increased Fig. 7 plots the histograms of block inter-arrival times of the by one if the miner can solve the puzzle of age ring (i.e., the mining pool and solo miners under δ = 10. The height of each age ring is effective). The miner will be rewarded by either bar in the histogram plot indicates the number of block inter- the reduced difficulty of block mining if its accumulated AoW arrival times that fall into the corresponding range. Figs. 7(a) is beyond a threshold, or the block reward if it generates and 7(b) consider that N1 = 10 and N1 = 30 respectively. For a block. To facilitate the performance analysis, we use the reference purpose, we also numerically plot the exponential CTMC to model the mining process of the mining pool and distributed curves with rate of λo = N2ρsolo obtained by the solo miners under PoA. Based on this CTMC, we show that FPI in Algorithm 1 and the derived distribution of p(t) in the block generation rate of the pool under PoA can be Section V-C. First, it is observed from Figs. 7(a1) and 7(b1) reduced to 75% of that under PoW by a proper difficulty that the block inter-arrival times of all solo miners follow the adjustment strategy. In addition, we not only approximated exponential distributions with rates of λo = N2ρsolo, N2 = 90 the distribution of block generation time of the mining pool, and N2 = 70, respectively. This validates our assumption in but also validated that the block generation time of all solo the formulation of CTMC in Section V-A. Second, Figs. 7(a2) miners is exponentially distributed. Finally, we used the even- and 7(b2) show the distributions of block inter-arrival time of driven simulations to demonstrate the consistency between the the mining pool follow our analytical result in Section V-C. numerical and simulation results. Situation I Situation II Situation III Block mined by Block mined by miner i Blockchain miner i Block Block Block Block Ċ Ċ Block Situation I Situation II Situation III Age rings computed Age Age Age ring ring ring by miner i Ċ Ċ Block mined by Block mined by miner i Blockchain miner i Block Block Block Block Ċ Ċ Block Block Header Current Block Hash Age rings computed Age Age Age ring Previous ĊBlockĊ Hash ring ring Previous by miner i Next Block Nonce Block Merkle Root BlockBlock Header Body CurrentHash Block Hash Hash Previous Block Hash Previous Hash Hash Hash Hash Next Block Nonce Block Tx MerkleTx RootTx Tx Block Body Hash Hash Hash Hash Hash Hash 11 Tx Tx Tx Tx (a) (b) Fig. 5. The gap of relative throughput gain between PoA and PoW: (a) when D1 = 32, D2 = 25, D3 = 15; (a) when D1 = 25, D2 = 20, D3 = 10. (a) (b) Fig. 6. Throughputs under FPI and simulations with (a) δ = 10 and (b) δ = 50. ACKNOWLEDGEMENT [5] C. Natoli, J. Yu, V. Gramoli, and P. Esteves-Verissimo, “Decon- structing blockchains: A comprehensive survey on consensus, mem- The authors would like to thank Dr. He Chen for his bership and structure,” arXiv preprint, 2019, [Online]. Available: https://arxiv.org/abs/1908.08316. valuable discussions on the topic of age-of-information, which [6] “Pool share from BTC.com,” https://btc.com/stats/pool, Accessed inspires the idea of this work. March, 2021. [7] I. Eyal and E. G. Sirer, “Majority is not enough: Bitcoin mining is vulnerable,” in Proc. Int. Conf. Financial Cryptogr. Data Secur. Springer, 2014, pp. 436–454. REFERENCES [8] H. Chen, Y. Gu, and S.-C. Liew, “Age-of-information dependent random access for massive iot networks,” in Proc. IEEE INFOCOM 2020- [1] S. Nakamoto, “Bitcoin: A peer-to-peer electronic cash system,” [Online]. IEEE Conference on Computer Communications Workshops (INFOCOM Available: http://bitcoin.org, 2008. WKSHPS). IEEE, 2020, pp. 930–935. [2] K. Fanning and D. P. Centers, “Blockchain and its coming impact on [9] A. Kosta, N. Pappas, and V. Angelakis, “Age of information: A new financial services,” Journal of Corporate Accounting & Finance, vol. 27, concept, metric, and tool,” Foundations and Trends in Networking, no. 5, pp. 53–57, 2016. vol. 12, no. 3, pp. 162–259, 2017. [3] H.-N. Dai, Z. Zheng, and Y. Zhang, “Blockchain for internet of things: A [10] Y. Lewenberg, Y. Sompolinsky, and A. Zohar, “Inclusive block chain survey,” IEEE Internet of Things Journal, vol. 6, no. 5, pp. 8076–8094, protocols,” in Proc. Int. Conf. Financial Cryptogr. Data Secur. Springer, 2019. 2015, pp. 528–547. [4] S. A. Abeyratne and R. P. Monfared, “Blockchain ready manufacturing [11] C. Li, P. Li, D. Zhou, W. Xu, F. Long, and A. Yao, “Scaling nakamoto supply chain using distributed ledger,” International Journal of Research consensus to thousands of transactions per second,” arXiv preprint in Engineering and Technology, vol. 5, no. 9, pp. 1–10, 2016. arXiv:1805.03870, 2018. 12 Situation I Situation II Situation III Block mined by Block mined by miner i Blockchain miner i = N1 10 = Block Block Block Block Block N1 10 Ċ Ċ d = 10 d =10 Age rings computed Age Age Age ring ring ring by miner i Ċ Ċ Block i Block Header Current Block Hash Previous Block Hash (a1) (a2) Block i Nonce Bloc i Merkle Root Block Body = = Hash Hash N1 30 N1 30 d =10 d =10 Hash Hash Hash Hash Tx Tx Tx Tx (b1) (b2) Fig. 7. Block inter-arrival times of the pool and solo miners with (a) N1 = 10 (b) N1 = 30. 1 -2 0.1 10 PoW An individual miner inside the pool (PoW) 0.9 0.08 PoA An individual miner inside the pool (PoA) -3 0.8 0.06 10 0.04 0.7 -4 0.02 10 0.6 0 -6 -5 -4 -3 -2 -1 0.5 10 10 10 10 10 10 10 -5 0.4 -6 0.3 10 Normalized block generation rate 0.2 -7 Normalized block generation rate 10 0.1 0 0 0.05 0.1 0.15 0.2 0.25 0.3 10 -8 Power ratio of the pool 10 -6 10 -5 10 -4 10 -3 10 -2 10 -1 10 0 Power ratio of the pool Fig. 8. Comparison of normalized block generation rates of the pool under PoW and PoA. Fig. 9. Comparsion of normalized block generation rate of an individual miner in the pool under PoW and PoA [12] Y. Sompolinsky and A. Zohar, “Secure high-rate transaction processing in bitcoin,” in Proc. Int. Conf. Financial Cryptogr. Data Secur. Springer, 2015, pp. 507–527. [14] Y. Sompolinsky and A. Zohar, “Phantom,” IACR Cryptology ePrint [13] Y. Sompolinsky, Y. Lewenberg, and A. Zohar, “Spectre: A fast and Archive, Report 2018/104, 2018. scalable cryptocurrency protocol.” IACR Cryptol. ePrint Arch., vol. 2016, [15] I. Eyal, A. E. Gencer, E. G. Sirer, and R. Van Renesse, “Bitcoin-NG: p. 1159, 2016. A scalable blockchain protocol,” in Proc. 13th USENIX Symposium on 13 Networked Systems Design and Implementation (NSDI), 2016, pp. 45– 59. [16] P. R. Rizun, “Subchains: A technique to scale bitcoin and improve the user experience,” Ledger, vol. 1, pp. 38–52, 2016. [17] TierNolan, “Decoupling transactions and pow,” https://bitcointalk.org/index.php?topic=179598.0, Accessed March, 2021. [18] V. Bagaria, S. Kannan, D. Tse, G. Fanti, and P. Viswanath, “Prism: Deconstructing the blockchain to approach physical limits,” in Proc. the 2019 ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), 2019, pp. 585–602. [19] R. Pass and E. Shi, “Fruitchains: A fair blockchain,” in Proc. the ACM Symposium on Principles of Distributed Computing, 2017, pp. 315–324. [20] “P2Pool: Decentralized bitcoin mining pool,” http://p2pool:org/, Ac- cessed March, 2021. [21] L. Luu, Y. Velner, J. Teutsch, and P. Saxena, “SmartPool: Practical de- centralized pooled mining,” in Proc. 26th USENIX Security Symposium, 2017, pp. 1409–1426. [22] T. Xue, Y. Yuan, Z. Ahmed, K. Moniz, G. Cao, and C. Wang, “Proof of contribution: A modification of proof of work to increase mining efficiency,” in Proc. 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC), vol. 1. IEEE, 2018, pp. 636– 644. [23] K. Nayak, S. Kumar, A. Miller, and E. Shi, “Stubborn mining: Gener- alizing selfish mining and combining with an eclipse attack,” in Proc. IEEE Eur. Symp. Secur. Privacy (EuroS&P), 2016, pp. 305–320. [24] M. Carlsten, “The impact of transaction fees on bitcoin mining strate- gies,” Master’s thesis, Princeton University, 2016. [25] A. Sapirshtein, Y. Sompolinsky, and A. Zohar, “Optimal selfish mining strategies in bitcoin,” in Proc. Int. Conf. Financial Cryptogr. Data Secur., 2016, pp. 515–532. [26] Y. Sompolinsky and A. Zohar, “Bitcoin’s security model revisited,” arXiv preprint arXiv:1605.09193, pp. 1–26, 2016. [27] A. Gervais, G. O. Karame, K. W¨ust, V. Glykantzis, H. Ritzdorf, and S. Capkun, “On the security and performance of proof of work blockchains,” in Proc. the 2016 ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), 2016, pp. 3–16. [28] W. Wang, D. T. Hoang, P. Hu, Z. Xiong, D. Niyato, P. Wang, Y. Wen, and D. I. Kim, “A survey on consensus mechanisms and mining strategy management in blockchain networks,” IEEE Access, vol. 7, pp. 22 328– 22 370, 2019. [29] M. Rosenfeld, “Analysis of bitcoin pooled mining reward systems,” arXiv preprint arXiv:1112.4980, 2011. [30] W. J. Anderson, Continuous-time Markov chains: An applications- oriented approach. Springer Science & Business Media, 2012.