Bobtail: Improved Blockchain Security with Low-Variance Mining George Bissias Brian N. Levine University of Massachusetts Amherst University of Massachusetts Amherst [email protected] [email protected] Abstract—Blockchain systems are designed to produce blocks systems craft blocks by repeatedly changing a nonce in the at a constant average rate. The most popular systems currently block header until the cryptographic hash of that header is less employ a Proof of Work (PoW) algorithm as a means of creating than a target value t, 0 < t < S, where S is the largest hash these blocks. An unfortunate limitation of all deployed PoW value (typically S = 2256 − 1). In other words, the hash of blockchain systems is that the time between blocks has high each header is a sample from [0;S] taken randomly from a variance. For example, Bitcoin produces, on average, one block discrete uniform distribution. A block is discovered when the every 10 minutes. However, 5% of the time, Bitcoin’s inter-block time is at least 30 minutes. first order statistic (i.e., the minimum value) of all sampled values is less than target t. The resulting inter-block times are In this paper, we show that high variance is at the root exponentially distributed (a result we show formally), and have of fundamental attacks on PoW blockchains. We propose an a variance equal to the square of the mean. alternative process for PoW-based block discovery that results in an inter-block time with significantly lower variance. Our Intuitively, variance explains why a miner with a small algorithm, called Bobtail, generalizes the current algorithm, fraction of the system’s total hash rate can successfully which uses a single PoW sample, to one that incorporates k doublespend. Whenever the honest miners are unlucky and samples. We show that the variance of inter-block times decreases encounter high inter-block times, it’s an opportunity for the as k increases. Bobtail significantly thwarts doublespend and selfish mining attacks. For example, for Bitcoin and Ethereum, attacker to conversely be lucky, mine with relatively smaller a doublespending attacker with 35% of the mining power will inter-block times, and produce a longer chain. In sum, if PoW succeed with 44% probability when the merchant sets up an mining could be achieved with a lower inter-block time variance, embargo of 1 block; however, when k ≥ 40, the probability of then doublespend and selfish mining attacks would fail more success for the same attacker falls to less than 1%. Similarly, often. for Bitcoin and Ethereum currently, a selfish miner with 45% of the mining power will claim about 71% of blocks; however, In this paper, we propose an improved process for PoW- when k ≥ 20, the same miner will find that selfish mining is less based block discovery that results in an inter-block time successful than honest mining. We also investigate attacks newly with significantly lower variance. As a result, our approach made possible by Bobtail and show how they can be defeated. The is significantly more secure against doublespend and selfish primary costs of our approach are larger blocks and increased mining attacks. Our algorithm generalizes the current algorithm, network traffic. which uses a single PoW sample, to one that incorporates k samples. We show that the variance of inter-block times I. INTRODUCTION decreases as k increases. For example, if our approach were Blockchain systems are designed to produce blocks of applied to Bitcoin, nearly every block would be found within 5 validated transactions at a constant average rate. The most to 18 minutes; and the average inter-block time would remain popular systems employ a Proof of Work (PoW) algorithm as at 10 minutes. In comparison, currently 5% of Bitcoin’s blocks a means of creating these blocks [35], including Bitcoin [8], have inter-block times of at least 30 minutes. We call our Bitcoin Cash [9], Ethereum [21], and Litecoin [33]. Whether approach Bobtail mining. a pure PoW or hybrid approach [11, 16, 31], the two most As a result, in Bobtail, doublespend and selfish mining fundamental attacks on PoW blockchains are selfish mining [23] attack efficacies are drastically reduced. For example, in either and the doublespend [35]. Bitcoin or Ethereum, a doublespending attacker with 35% of A direct consequence of using a PoW algorithm is that the mining power will succeed with 44% probability when the the time between blocks has high variance and the distribution merchant sets up an embargo of 1 block; however, for Bobtail, of inter-block times has a very long tail. As we show in this the probability of success for the same attacker falls to less paper, high variance is responsible for enabling doublespend than 1% (when k ≥ 40). Similarly, for Bitcoin and Ethereum and selfish mining attacks. Generally, miners in all deployed currently, a selfish miner with 45% of the mining power will claim about 71% of blocks; however, when k ≥ 20, the same miner will find that selfish mining is defeated, resulting in a Network and Distributed Systems Security (NDSS) Symposium 2020 smaller fraction of blocks than honest mining. 23–26 February 2020, San Diego, CA, USA ISBN 1-891562-61-4 One disadvantage of Bobtail is that new withholding and https://dx.doi.org/10.14722/ndss.2020.23095 denial-of-service attacks are possible. However, we show how www.ndss-symposium.org these attacks can be thwarted with careful protocol design. Miner-2 block header seeking a value near tk, a threshold that varies Header Proof 1 Miner-3 Miner-3 with security parameter k. As illustrated in Fig. 1(Left), once Proofs Proof 2 (Graphene) a suitable header is found, a miner announces it to all other Proof 3 Miner-1 Coinbase miners; for clarity we call the announcement a proof set and its Proof 4 … Signature hash value simply a proof. If the mean of the k-lowest proofs Txns is equal to or lower than the target tk, then a new block is Proof k Miner-4 (Graphene) Proof k+1 found. The miner with the lowest of all proofs is the only one that can announce the new block and is the one that controls Fig. 1: (Left) In Bobtail, miners each broadcast proof sets whose the list of transactions confirmed by the block, as shown in hash values are called proofs. When the average of k proofs is Fig. 1(Right). To be clear, Bobtail blocks are not the result at or below the target, a new block is found. (Right) The miner of of k proofs from one miner, but the k-lowest from all miners. the lowest proof selects the transactions that are included in the The coinbase reward is split evenly among all contributors new block and announces that block to the network. Coinbase (proportional to number proofs contributed), which leads to is rewarded to miners proportional to the number of proofs a smoother short-term distribution of rewards among lower they contributed. Proofs (and transactions) in the block can be hash rate miners than does the status quo. We now define this efficiently announced using Graphene [38]. process more formally. A. Problem Statement Contributions. Our contributions are summarized as follows. Imagine that the mining process is carried out for exactly h hashes during time interval I, generating hash values • We derive the statistical characteristics of our approach H ;:::;H from [0;S] uniformly at random. Now define V and validate each empirically. For example, we derive 1 h i to be the value of the ith order statistic at the end of I, i.e. expressions for the expectation and variance of Bobtail V = H in standard notation. Let W be a random variable block times and the amount of work performed for any i (i) k representing the average value over the k-lowest order statistics value of k. Using these expressions, we quantify the after h hashes. reduction in variance of inter-block time for values of k k > 1. We show that variance in block discovery time is 1 X W = V : (1) reduced by O(1=k) relative to the status quo. k k i i=1 • We demonstrate that low-variance mining significantly Wk constitutes the collective mining proof for the entire mitigates the threats to security posed by doublespend and network. Our Bobtail mining criterion says that a new block is selfish mining attacks, as stated above. discovered when a realized value of Wk falls at or below the • We demonstrate that, due to our protocol mechanisms, target tk: Bobtail mining has the same or lower orphaned block rate wk ≤ tk: (2) as existing schemes. Notably, this approach is a generalization of current systems, • We quantify the increased network overhead of Bobtail, which are the special case where k = 1. and demonstrate how these costs can be kept minimal by The primary goals of our paper are therefore to show the leveraging the statistical characteristics that we derive. following, given values of k > 1. • We show that new intra-block DoS and withholding attacks • Inter-block time variance is significantly reduced (Sec- are possible for Bobtail. However, through careful protocol tion IV). design, these attacks are mitigated. • Selfish mining and doublespend attacks are significantly Bobtail is also a convenience for consumers, who would more difficult to carry out as k increases (Section V). benefit from reduced block time variance and a more consistent • Costs are relatively small. Orphan rates are no worse than flow of validated transactions through the system. for k = 1 (Section VI), and the increases in block size and network traffic are small and manageable (Section VII).