SMARTPOOL: Practical Decentralized Pooled Mining Loi Luu Yaron Velner National University of Singapore The Hebrew University of Jerusalem [email protected] [email protected] Jason Teutsch Prateek Saxena TrueBit Foundation National University of Singapore [email protected] [email protected] Abstract ning miner’s solution includes a transaction block, which is appended to the distributed ledger that all miners main- Cryptocurrencies such as Bitcoin and Ethereum are op- tain. The reward is substantial (e.g. 12.5 BTC in Bitcoin, erated by a handful of mining pools. Nearly 95% of Bit- or 30;000 USD at present), incentivizing participation. coin’s and 80% of Ethereum’s mining power resides with Nakamoto-based cryptocurrencies, such as Bitcoin less than ten and six mining pools respectively. Although and Ethereum, utilize massive computational resources miners benefit from low payout variance in pooled min- for their mining. Finding a valid solution to a PoW puz- ing, centralized mining pools require members to trust zle is a probabilistic process, which follows a Poisson that pool operators will remunerate them fairly. Further- distribution, with a miner’s probability of finding a solu- more, centralized pools pose the risk of transaction cen- tion within an epoch determined by the fraction of com- sorship from pool operators, and open up possibilities for putation power it possesses in the network. Miners with collusion between pools for perpetrating severe attacks. modest computational power can have extremely high In this work, we propose SMARTPOOL, a novel pro- variance. A desktop CPU would mine 1 Bitcoin block tocol design for a decentralized mining pool. Our pro- in over a thousand years, for instance [2]. To reduce tocol shows how one can leverage smart contracts, au- variance, miners join mining pools to mine blocks and tonomous blockchain programs, to decentralize cryp- share rewards together. In a mining pool, a designated tocurrency mining. SMARTPOOL gives transaction se- pool operator is responsible for distributing computation lection control back to miners while yielding low- sub-puzzles of lower difficulty than the full PoW block variance payouts. SMARTPOOL incurs mining fees lower puzzle to its members. Each solution to a sub-puzzle has than centralized mining pools and is designed to scale to a probability of yielding a solution to the full PoW block a large number of miners. We implemented and deployed puzzle—so if enough miners solve them, some of these a robust SMARTPOOL implementation on the Ethereum solutions are likely to yield blocks. When a miner’s sub- and Ethereum Classic networks. To date, our deployed mitted solution yields a valid block, the pool operator pools have handled a peak hashrate of 30 GHs from submits it to the network and obtains the block reward. Ethereum miners, resulting in 105 blocks, costing miners The reward is expected to be fairly divided among all a mere 0:6% of block rewards in transaction fees. pool members proportional to their contributed solutions. Problem. Centralized pool operators direct the massive 1 Introduction computational power of their pools’ participants. At the time of this writing, Bitcoin derives at least 95% of its Cryptocurrencies such as Bitcoin and Ethereum offer the mining power from only 10 mining pools; the Ethereum promise of a digital currency that lacks a centralized is- network similarly has 80% of its mining power ema- suer or a trusted operator. These cryptocurrency net- nating from 6 pools. Previous works have raised con- works maintain a distributed ledger of all transactions, cerns about consolidation of power on Bitcoin [3,4]. Re- agreed upon by a large number of computation nodes (or cent work by Apostolaki et al. has demonstrated large- miners). The most widely used protocol for agreement scale network attacks on cryptocurrencies, such as dou- is Nakamoto consensus, which rewards one miner ev- ble spending and network partitioning, which exploit ery epoch (lasting, say, 10 minutes as in Bitcoin) who centralized mining status quo [5]. By design, if a single exhibits a solution to a probabilistic computation puzzle pool operator controls more than half of the network’s called a “proof-of-work” (or PoW) puzzle [1]. The win- total mining power, then a classical 51% attack threat- ens the core security of the Nakamoto consensus protocol action set they want to include in a block. If widely [1]. Cryptocurrencies have witnessed that a single pool adopted, SMARTPOOL makes the underlying cryptocur- has commandeered more than half of a cryptocurrency’s rency network much more censorship-resistant. Finally, hash rate (e.g. DwarfPool1 in Ethereum and GHash.io2 SMARTPOOL does not charge any fees 4, unlike central- in Bitcoin) on several occasions. In such cases, the pool ized pools, and disburses all block rewards to pool par- operator’s goodwill has been the only barrier to an attack. ticipants entirely. Furthermore, pools currently dictate which transac- SMARTPOOL can be used to run mining pools for sev- tions get included in the blockchain, thus increasing the eral different cryptocurrencies. In this work, we demon- threat of transaction censorship significantly [6]. While strate concrete instantiations for Bitcoin and Ethereum. some Bitcoin pools currently offer limited control to SMARTPOOL can be run natively within the protocol of miners of transaction selection via the getblocktemplate a cryptocurrency — for instance, it can be implemented protocol [7], this protocol only permits a choice between in Ethereum itself. We believe SMARTPOOL can sup- mining with a transaction set chosen by the pool or min- port a variety of standard payoff schemes, as in present ing an empty block. The situation is worse in Ethereum mining pools. In this work, we demonstrate the standard where it is not yet technically possible for miners in cen- pay-per-share (or PPS) scheme in our implementation. tralized pools to reject the transaction set selected by the Supporting other standard schemes like pay-per-last-n- operator. For example, users recently publicly speculated shares (PPLNS) and schemes that disincentivize against that a large Ethereum pool favored its own transactions block withholding attacks [9–11] is left for future work. 3 in its blocks to gain an advantage in a public crowdsale . Results. We have implemented SMARTPOOL and a sta- One can combat these security issues by running a ble SMARTPOOL implementation has been released and pool protocol with a decentralized network of miners in deployed on the main network via a crowd-funded com- place of a centralized operator. In fact, one such solution munity project [12]. As of 18 June 2017, SMARTPOOL- for Bitcoin, called P2POOL [8], already exists. How- based pools have mined in total 105 blocks on both ever, P2POOL has not attracted significant participation Ethereum and Ethereum Classic networks and have suc- from miners, and consequently its internal operational cessfully handled a peak hashrate of 30 GHs from 2 sub- network remains open to infiltration by attackers. Sec- stantial miners. SMARTPOOL costs miners as little as ondly, technical challenges have hindered widespread 0:6% for operational transaction fees, which is much less adoption. Scalable participation under P2POOL’s cur- than 3% fees taken in centralized pools like F2Pool 5. rent design would require the system to check a mas- Furthermore, each miner has to send only a few mes- sive number of sub-puzzles. Furthermore, P2POOL only sages per day to SMARTPOOL. Finally, although being works for Bitcoin; we are not aware of any decentralized decentralized, SMARTPOOL still offers the advantage of mining approach for Ethereum. low variance payouts like centralized pools. Solution. This work introduces a new and practical so- As a final remark, SMARTPOOL does not make cen- lution for decentralized pooled mining called SMART- tralized pooled mining in cryptocurrencies impossible, POOL. We claim two key contributions. First, we ob- nor does it incentivize against centralized mining or alter serve that it is possible to run a decentralized pool mining the underlying proof-of-work protocol (as done in work protocol as a smart contract on the Ethereum cryptocur- by Miller et al.[13]). SMARTPOOL simply offers a prac- rency. Our solution layers its security on the existing tical alternative for miners to move away from central- mining network of a large and widely deployed cryp- ized pools without degrading functionality or rewards. tocurrency network, thereby mitigating the difficulty of Contributions. We claim the following contributions: bootstrapping a new mining network from scratch. Sec- ondly, we propose a design that is efficient and scales • We introduce a new and efficient decentralized to a large number of participants. Our design uses a pooled mining protocol for cryptocurrencies. By simple yet powerful probabilistic verification technique leveraging smart contracts in existing cryptocurren- which guarantees the fairness of the payoff. We also in- cies, a novel data structure, and an efficient verifi- troduce a new data structure, the augmented Merkle tree, cation mechanism, SMARTPOOL provides security for secure and efficient verification. Most importantly, and efficiency to miners. SMARTPOOL allows miners to freely select which trans- • We implemented SMARTPOOL and deployed real 1https://forum:ethereum:org/discussion/5244/ mining pools on Ethereum and Ethereum Classic. dwarfpool-is-now-50-5 The pools have so far mined 105 real blocks and 2https://www:cryptocoinsnews:com/warning-ghash-io- nearing-51-leave-pool/ 4The caveat here is that cryptocurrency miners will pay Ethereum 3https://www:reddit:com/r/ethereum/comments/6itye9/ transaction fees to execute SMARTPOOL distributively. collecting information about f2pool/ 5https://www:f2pool:com/ethereum-blocks have handled significant hashrates while deferring 0:6 Pr[Finding a share in a day] 2:5 · 106 only 0:6% of block rewards to transaction fee costs. No. of messages 2 · 106 0:4 2 Problem and Challenges 1:5 · 106 1 · 106 We consider the problem of building a decentralized pro- 0:2 tocol which allows a large open network to collectively No.