Mining Pool Selection under Block WithHolding Attack ^†

Abstract

In current Proof-of-Work (PoW) blockchain systems, miners usually form mining pools to compete with other pools/miners in the mining competition. Forming pools can give miners steady revenues but will introduce two critical issues. One is mining pool selection, where miners select the pools to join in order to maximize their revenues. The other is a Block WithHolding (BWH) attack, where pools can inject part of their hash/mining power into other pools to obtain additional revenues without contributing to the mining process of the attacked pools. Reasoning that the BWH attack will have significant impacts on the pool selection, we therefore investigate the mining pool selection issue in the presence of a BWH attack in this paper. In particular, we model the pool selection process of miners as an evolutionary game and find the Evolutionarily Stable States (ESSs) of the game (i.e., stable pool population states) as the solutions. Previous studies investigated this problem from the perspective of pool managers and neglected the revenues from attacked pools (attacking revenues), leading to less accurate and insightful findings. This paper, however, focuses on the payoffs of miners and carefully takes the attacking revenues into consideration. To demonstrate how the problem is solved, we consider the scenario with two mining pools and further investigate the case where one pool attacks the other and the case where the two pools attack each other. The results in this paper show that pools can attract more miners to join by launching a BWH attack and the attack power significantly affects the stable pool populations.

1. Introduction

Blockchain, at its core, is a distributed ledger based on the technologies of encryption and Peer-to-Peer networking. Different from traditional centralized ledgers that reliably manage transactions in a central server, all participants in blockchain systems are synchronized to maintain the same copies of the transactions in order to guarantee the tamper-proof feature. Such a feature renders blockchain a highly promising technology for cryptocurrency platforms, such as Bitcoin [1] and Ethereum [2], as well as other applications like cyber–physical systems [3], access control [4,5,6,7,8], supply chain management [9], data sharing [10] and storage [11], healthcare [12,13,14], real estate [15] and media digital right [16].

Blockchain uses a data structure called block to store transactions. Each block has a hash value, which uniquely identifies the block. A block contains a timestamp, which records the time when the block was created, a difficulty, which is the system-wide difficulty requirement of generating the block (i.e., the leading n bits of the hash must be zeros), a nonce, which is some random number used to calculate the hash value of the block, and the hash of its previous block. Blocks are limited in size [17]. For example, in the current Bitcoin, the block size is limited to about 1 MB [18]. Blockchain, usually Proof-of-Work (PoW) blockchain, relies on a process called mining to create blocks and ensure the tamper-proof feature of the transactions inside. Mining is a competition among the participants of the blockchain system, whose goal is to find the latest valid block (called full PoW). Valid blocks have hash values satisfying the system-wide difficulty requirement. In a mining competition, only the first participant that finds the latest valid block is the winner and will be rewarded. For example, in Bitcoin, the winner will be given some bitcoins as the reward, which includes a fixed Coinbase reward about $12.5$ bitcoins [19] and a varying reward coming from the residual transaction fees.

Mining requires a huge amount of hash calculations, because the only way to find the valid hash is guessing and trying. The system-wide difficulty requirement is difficult to meet, which means that miners have to try a huge amount of different hash values until they find a valid one. This is why blockchain is considered tamper-proof, because an extremely huge amount of calculations are needed to alter the blocks, which is computationally impossible.

Since mining is computationally expensive, it is difficult for solo miners, especially those with low computation powers, to win the mining competition. Therefore, in practical blockchain systems, like Bitcoin, miners prefer to form groups called mining pools to compete with other miners or pools in the mining competition. In a mining pool, each miner contributes his/her computation power to the pool in exchange for rewards. A pool has a manger, who sets another pool-wide difficulty, which is easier to satisfy than the system-wide difficulty. All miners in the pool are required to find the blocks that meet the pool-wide difficulty (called partial PoW) and report them to the manager. The number of partial PoWs (PPoWs) will be used to measure the contributions of the miners. There are several functions to distribute rewards according to miners’ contributions, like proportional reward function, Pay-Per-Share (PPS) reward function and Pay-Per-Last-N-Share (PPLNS) reward function [20]. This paper focuses on the proportional reward function, where the rewards of miners are proportional to their contributions.

Forming pools shortens the average waiting time of miners for upcoming rewards, leading to steady mining revenues for miners. When multiple mining pools exist, miners face the problem of selecting which pool to join in order to maximize its revenues. We call this problem the mining pool selection of miners.

In addition, the existence of multiple mining pools causes another problem, i.e., the Block WithHolding (BWH) attack [21,22], where pools can inject part of their hash/mining power to other pools to obtain additional revenues while not contributing to the mining process of the attacked pools. Figure 1 illustrates the details of the BWH attack in the case of two pools, where one pool (say Pool 1) attacks the other (say Pool 2). Suppose Pool 1, i.e., the attacking pool, dispatches some of its miners as spies to Pool 2, i.e., the attacked pool. When the spies find full PoWs (FPoWs), they discard them, while they still report PPoWs to the manager of Pool 2. In this way, the spies can obtain revenues/rewards from Pool 2 by reporting PPoWs, while they actually contribute nothing to the mining of Pool 2. The revenues of the spies can be sent back to Pool 1, which will be re-distributed to the miners in Pool 1 including the spies. The study in [23] shows that a pool can obtain more revenues by launching the BWH attack to other pools.

Reasoning that the BWH attack will have significant impacts on the pool selection, we therefore aim to investigate the mining pool selection issue in the presence of BWH attack in this paper. The mining pool selection problem without considering the BWH attack was investigated in [24] based on the evolutionary game theory. The mining pool selection issue in the presence of BWH attack has also been addressed in [25] from the perspective of evolutionary game as well. The authors solved the problem from the viewpoint of pool managers and investigated how pool managers can change strategies to attract miners, which differs from the objective of this paper. In addition, the authors neglected the revenues from attacked pools, which may lead to less accurate and insightful findings. Motivated by these observations, our research objective is to investigate the mining pool selection issue under the BWH attack from the perspective of miners. Like [24,25], this paper also applies the evolutionary game theory to model the mining pool selection process and find the Evolutionarily Stable States (ESSs) (i.e., stable population states) of the game as the solutions. To achieve this goal, we first derive the expected revenue densities of all pools to determine the expected payoffs of miners in the pools. Based on the expected payoffs, we formulate replicator dynamics to represent the growth rates of the populations in all pools. With the help of the replicator dynamics, we obtain the Nash Equilibria (NE) of the game, i.e., rest points where the population growth rates are zeros, and discuss their stability to identify the ESSs of the game. To demonstrate the process of solving the game, we consider the scenario with two mining pools (Note that the two-pool scenario has been widely adopted in the analysis of mining pool selection [24,25], because this scenario is easy to analyze yet powerful enough to reveal the fundamental findings. In addition, the analysis and results obtained from this scenario can serve as the building blocks for those of more general scenarios with more mining pools.) and further investigate the case where one pool attacks the other and the case where the two pools attack each other. Simulation and numerical results are also provided to corroborate our analysis and to illustrate the theoretical findings. The results in this paper show that pools can attract more miners to join by launching the BWH attack and the attack power significantly affects the stable pool populations.

The conference version of this paper was published in [26], which focused only on the case where one pool attacks the other. This paper extends [26] by including the analysis and numerical results for the case where the two pools attack each other. Compared with the previous work in [25], this paper has the following two main contributions. First, the previous work studied the problem from the viewpoint of pool managers and focused on the payoffs of mining pools, while this paper investigates the mining pool selection problem from the viewpoint of miners and formulates the payoffs of individual miners. To do this, we propose a new concept called revenue density to characterize the revenue per unit hash power of a pool. Second, this paper carefully takes the revenues from attacked pools (i.e., attacking revenue) into consideration, while the previous work neglected the attacking revenue to simplify the analysis. The results in this paper show that neglecting the attacking power may give us inaccurate results and less insightful findings.

The rest of the paper is organized as follows. Section 2 introduces the related work. In Section 3, we model the mining pool selection problem in the presence of BWH attack as an evolutionary game and conduct analysis to solve the game. The case study with two mining pools is presented in Section 4. We provide simulations and numerical results in Section 5 and finally conclude this paper in Section 6.

2. Related Work

Game theory is a widely used method for analyzing the interactions (i.e., competition and cooperation) among rational decision makers, which choose their strategies to maximize their payoffs inside a game. Game models include non-cooperative game, extensive-form game, stochastic game, coalition formation game and evolutionary game, which have found various applications in blockchain to address the security issues and mining management. For example, the non-cooperative game model was applied to investigate the BWH attack [23,27,28,29,30,31]. The stochastic game model was adopted to study the selection between honest mining and selfish mining [32]. The coalition formation game model was chosen to solve the mining pool formation problem [33,34]. The evolutionary game model was used for modeling the mining pool selection behaviors of miners [24,25]. In this section, we focus on the studies of applying the evolutionary game to solve the mining pool selection problem. For a detailed survey on the application of game theory in blockchain, please refer to [35].

2.1. Mining Pool Selection without BWH Attack

The authors in [24] formulated the process of mining pool selection as an evolutionary game, while they focused on the case without the BWH attack. Each pool adopts different strategies, which are the size of blocks to be mined by the pool and the minimum hash power required for joining the pool. Miners select pools based on these parameters. To obtain the ESSs (i.e., stable population states), where the population of each pool remains unchanged, they investigated the time variation of population fractions for the special case with two pools. This work was later extended to various scenarios. For instance, the authors in [36] extended [24] by considering different reward sharing strategies (i.e., PPS strategy and PPLNS strategy) rather than the proportional reward sharing strategy in [24]. The authors in [37] extended [24] by additionally considering the impact of temporary fork on the revenues of miners and pools.

2.2. Mining Pool Selection under BWH Attack

The authors in [25] investigated the process of mining pool selection under BWH attack. In this study, they also used the evolutionary game theory to model the mining pool selection process of miners. However, they focused on this problem from the perspective of mining pool managers and formulated the rewards of mining pools instead of miners, which is quite different from this paper. In addition, the authors did not consider the revenues from attacked pools in the formulation, which may result in less accurate and convincing insights into the problem and make the incentive of launching the BWH arguable. In addition to the minimum required hash power and the size of blocks to be mined, the authors also considered the population of attackers as an additional strategy parameter. They investigated the properties of the population states and described how pool managers can change the mining strategies to drive the population of miners to stable states. The authors in [38] considered a scenario where miners can select to join an attacking pool to perform honest mining or the BWH attack to another pool, and modeled the selections between miners and attacking pools by indicator variables. A novel anti-attack mining revenue optimization algorithm was proposed to determine the pool selection so as to improve the group revenue of the attacking pools. In [39], the BWH game among multiple mining pools was modeled as a stochastic game and the reinforcement learning techniques were applied to analyzed the game. During the game analysis, the pool selection of miners was also considered, where each miner randomly chooses the pool to join based on the attractiveness of the pools. In [40], the authors investigated the power splitting problem of a miner under the BWH attack from the game-theoretic perspective, where a miner can choose to devote its mining power to one pool or split its mining power among multiple pools to maximize its payoff. The power splitting game can be regarded as one variant of the mining pool selection problem.

3. Evolutionary Game for Mining Pool Selection

Similar to [24], we also applied the evolutionary game theory to model the mining pool selection process of miners in the presence of BWH attack. Our goal was to obtain the ESSs and investigate the impact of the BWH attack on the ESSs. The analysis flow to solve the game is as follows. First, we define the game and parameters. We then determine the expected payoffs of miners in all the pools, which will be further used to obtain the replicator dynamics, i.e., the growth rates of population fractions of all pools. Based on the replicator dynamics, we obtain the NEs of the population fractions, where the replicator dynamics of all pools are zeros, i.e., the populations of all pools remain unchanged. Finally, we analyze the stability of the NEs to identify the ESSs.

3.1. Game Definition

We consider a blockchain network consisting of N miners and M pools. The game can be defined as $\mathcal{G}=<\mathcal{N},\mathcal{M},\mathit{x},y_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})>$. The details of the game parameters are shown in

Table 1. Game parameters.

Parameters	Meaning
$\mathcal{N}$	The set of miners with $\left|\mathcal{N}\right|=N$, where N is the number of miners.
$\mathcal{M}$	The set of mining pools. $\mathcal{M}=\{1,2,\cdots ,M\}$, where M is the number of mining pools.
$x_i$	The population fraction of miners in pool i.
$\mathit{x}$	The population state, $\mathit{x}=[x_1,x_2,\cdots ,x_M]$.
${\omega }_i$	The minimum hash power required to join pool i.
$\mathbf{\omega }$	The hash power requirement profile, $\mathbf{\omega }=[{\omega }_1,{\omega }_2,\cdots ,{\omega }_M].$
$s_i$	The size of blocks to be mined by pool i.
$a_{ij}$	Attack size, i.e., the fraction of hash power used by pool i to attack/infiltrate pool j.
${\mathit{a}}_{\mathit{i}}$	The attack profile of pool i, ${\mathit{a}}_{\mathit{i}}=[a_{i1},a_{i2},\cdots ,a_{iM}]$.
$\mathit{a}$	The total attack profile of all pools, $\mathit{a}=[{\mathit{a}}_{\mathit{1}},{\mathit{a}}_{\mathbf{2}},\cdots ,{\mathit{a}}_{\mathit{M}}]$.
$y_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})$	The expected payoff of miners in pool i.

.

Each pool i uses ${\omega }_i$, $s_i$ and ${\mathit{a}}_i$ as its parameters in the game. As in [24], we assume that all miners in pool i adopt the same hash power ${\omega }_i$ for mining. Thus, the total hash power of pool i is $N{x}_i{\omega }_i$. We assume that pools can not detect the existence of infiltrated hash power. All the parameters are pre-fixed before the game and will remain unchanged during the playing of the game.

3.2. Expected Payoff

We first derive the expected payoff of a miner in pool i, which is the revenue of the miner minus the cost for mining. The revenue can be given by the product of the miner’s hash power and the revenue density of pool i (i.e., the revenue obtained per unit hash power). The cost comes from the power consumption (e.g., electricity fee) for mining. We use p to denote the power charge required for unit hash power and use $r_i$ to denote the revenue density of pool i, which is a function of $\mathit{x}$, $\mathbf{\omega }$, $s_i$ and $\mathit{a}$ as will be shown in Section 3.2.1. The expected payoff of miners in pool i can be expressed as

$$y_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})=(r_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})-p){\omega }_i.$$

(1)

3.2.1. Revenue Density

Next, we consider the revenue density $r_i$, which is calculated as the total revenue of pool i divided by the total hash power seen by pool i. As pools can not detect the existence of infiltrated hash power, the total hash power seen by pool i includes the hash power of pool i and those from other pools that attack pool i. Letting $R_i$ be the total revenue of pool i and $H_i$ be the total hash power of pool i, we can formulate the revenue density of pool i as

$$r_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})=\frac{R_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})}{H_i(\mathit{x},\mathbf{\omega },\mathit{a})}.$$

(2)

The total revenue of pool i consists of the revenue obtained from honest mining (i.e., winning the mining competition) and that obtained by attacking other pools. We call the former mining revenue and the latter attacking revenue. The mining revenue consists of the residual transaction fees and a fixed amount of revenue from the coinbase of the new block. Let C denote the fixed revenue from the coinbase and $\rho$ denote the transaction fee per unit block size. The mining revenue is thus given by $C+\rho s_i$. Since pool i can obtain the mining revenue only when it wins the mining competition, we need to consider the winning probability. Defining the winning probability by $P_i^{win}$, we obtain the expected mining revenue of pool i as $(C+\rho s_i)P_i^{win}$.

Attacking revenues are the revenues obtained from attacking other pools. Suppose pool i attacks pool j with an attack size $a_{ij}$, i.e., pool i injects a fraction $a_{ij}$ of its own hash power into pool j for launching the BWH attack. The attacking revenue from pool j is the product of attacking hash power and the revenue density of pool j, which is given by $N{x}_i{\omega }_i{a}_{ij}{r}_j$, where $N{x}_i{\omega }_i$ is the hash power of pool i and $r_j$ is the revenue density of pool j. Summing up the attacking revenues from all the attacked pools gives the total attacking revenue of pool i, which is $N{x}_i{\omega }_i{\sum }_{j=1,j\ne i}^M{a}_{ij}{r}_j$. Finally, combining the expected mining revenue and the total attacking revenue yields the following expression of the total revenue of pool i:

$$R_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})=(C+\rho s_i)P_i^{win}+N{x}_i{\omega }_i\sum _{j=1,j\ne i}^M{a}_{ij}{r}_j.$$

(3)

For the case without considering the attacking revenue as in [25], we can simplify the total revenue of pool i to

$$R_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})=(C+\rho s_i)P_i^{win},$$

(4)

by simply ignoring the second term in the right-hand side of (3).

The total hash power seen by Pool i can easily be given by

$$H_i(\mathit{x},\mathbf{\omega },\mathit{a})=N{x}_i{\omega }_i+\sum _{j=1,j\ne i}^{M}N{x}_j{\omega }_j{a}_{ji}.$$

(5)

Substituting (3) and (5) into (2) yields the expression of the revenue density $r_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})$ of pool i.

3.2.2. Probability of Wining Mining Competition

We can see from Section 3.2.1 that the probability $P_i^{win}$ of pool i wining the mining competition is essential to determine the expected mining revenue of pool i. In the mining competition, each pool aims to mine a block with a valid hash (i.e., an FPoW). Finding such a block is a random event, because the only way is just to try different hash values relentlessly. Since all pools and solo miners join the competition, the probability that pool i mines a valid block is proportional to the ratio between its effective hash power to the network total effective hash power [34]. By effective, we mean the hash power used for mining (excluding those for BWH attack). We use $P_i^{mine}(\mathit{x},\mathbf{\omega },\mathit{a})$ to denote the probability of pool i mining a valid block, which is given by

$$P_i^{mine}(\mathit{x},\mathbf{\omega },\mathit{a})=\frac{N{x}_i{\omega }_i(1-{\sum }_{j=1}^M{a}_{ij})}{{\sum }_{j=1}^{M}N{x}_j{\omega }_j(1-{\sum }_{k=1,k\ne j}^M{a}_{jk})}.$$

(6)

After finding a new block, pool i broadcasts the block to its adjacent mining pools and solo miners, which will verify the block, append it to their local blockchains and further broadcast it inside the network until the block is received by the majority of the network. This is the situation when other pools and solo miners did not find valid blocks. In this situation, pool i is the winner of the competition. However, when some other pool or miner also finds valid a block, the block mined by pool i may be discarded or orphaned by most pools and miners, since the other block may arrive at these pools and miners earlier. In this situation, pool i will lose the competition. The main cause of orphaning blocks is the propagation time of blocks, which is dependent on the average block propagation delay of network links and average verification time of blocks [24]. According to [24], the propagation delay of a block of size s can be modeled as ${\tau }_p\left(s\right)=s/\left(\gamma c\right)$, where $\gamma$ is a parameter related to the scale of the network and c is the average effective channel capacity of each link. The verification time of a block of size s can be modeled as a linear function ${\tau }_v\left(s\right)=bs$, where b is a parameter determined by the scale of the network and average verification time of each node [41,42]. Thus, the average propagation time of a block of size s is given by

$$\tau \left(s\right)={\tau }_p\left(s\right)+{\tau }_v\left(s\right)=\frac{s}{\gamma c}+bs.$$

(7)

Suppose that the average block generation interval is a constant T. The occurrence of block orphaning due to the propagation time of blocks can be modeled as a Poisson process with mean rate $1/T$ [43]. Thus, the probability that the block found by pool i (i.e., of size $s_i$) is not orphaned is

$$P_i^{notorphan}\left(s_i\right)=e^{-\tau \left(s_i\right)/T}=e^{-(\frac{s_i}{\gamma c}+b{s}_i)/T}.$$

(8)

Pool i wins the competition if and only if it finds a valid block and the block is not orphaned. Thus, the probability of wining the competition for pool i is

$$P_i^{win}(\mathit{x},\mathbf{\omega },s_i,\mathit{a})=P_i^{mine}(\mathit{x},\mathbf{\omega },\mathit{a})P_i^{notorphan}\left(s_i\right).$$

(9)

3.3. Game-Theoretic Analysis

In this section, using the results of the previous section, we analyze the game to obtain the ESSs. First, we formulate the replicator dynamics, i.e., the growth rates of the population fractions of all pools. We then find the NEs where the population fractions remain unchanged, i.e, the replicator dynamics are all zeros. Finally, we analyze the stability of the obtained NEs to identify the ESSs.

3.3.1. Replicator Dynamics

The growth rate of the miner population in a pool can be described by the replicator dynamics [44]. Based on the pairwise proportional imitation protocol [45], the replicator dynamics of pool i is given by the following Ordinary Differential Equation (ODE):

$$\begin{array}{cc}\hfill \dot{x_i}\left(t\right)& =\frac{d{x}_i}{dt}=f_i(\mathit{x}\left(t\right),\mathbf{\omega },s_i,\mathit{a})\hfill \\ \hfill & =x_i\left(t\right)(y_i(\mathit{x}\left(t\right),\mathbf{\omega },s_i,\mathit{a})-\overline{y}(\mathit{x}\left(t\right),\mathbf{\omega },\mathbf{s},\mathit{a})),\hfill \end{array}$$

(10)

where $x_i\left(t\right)$ is the population fraction of pool i at time t, $y_i(\mathit{x}\left(t\right),\mathbf{\omega },s_i,\mathit{a})$ is the expected payoff of miners in pool i at time t and $\overline{y}(\mathit{x}\left(t\right),\mathbf{\omega },\mathbf{s},\mathit{a})={\sum }_{i=1}^M{y}_i(\mathit{x},\mathbf{\omega },s_i,\mathit{a})x_i$ is the average expected payoff of all the miners at time t, i.e., network average payoff. We can see that the replicator dynamics ${\dot{x}}_i\left(t\right)$ represents the growth rate of the population of pool i at time t, which is related to the difference between the miner payoff of pool i and the network average payoff. If the payoff of pool i is larger than the network payoff, its population will increase. Otherwise, its population will decrease.

3.3.2. Nash Equilibria (NE)

The population states $\mathit{x}={[x_1,\dots ,x_M]}^{\top }\in \mathcal{X}$ can be interpreted as mixed strategies that each miner may choose, where each $x_i$ denotes the probability of selecting pool i. An NE is then a mixed strategy ${\mathit{x}}^{\ast }$ that is a best reply to itself. That means under the condition that other miners choose ${\mathit{x}}^{\ast }$, a miner cannot gain more revenue by choosing any other $\mathit{x}\in \mathcal{X}$ rather than ${\mathit{x}}^{\ast }$. Formally, an NE satisfies the following inequality [46]:

$${({\mathit{x}}^{\ast }-\mathit{x})}^{\top }Y\left({\mathit{x}}^{\ast }\right)\ge 0,\forall \mathit{x}\in \mathcal{X},$$

(11)

where $Y\left(\mathit{x}\right)={[y_1\left(\mathit{x}\right),\dots ,y_M\left(\mathit{x}\right)]}^{\top }$ with $y_i\left(\mathit{x}\right)$ given by (1). According to [47], an NE is actually a rest point of the following equation system of the ODEs:

$$\dot{x_i}\left(t\right)=x_i\left(t\right)(y_i(\mathit{x}\left(t\right),\mathbf{\omega },s_i,\mathit{a})-\overline{y}(\mathit{x}\left(t\right),\mathbf{\omega },\mathbf{s},\mathit{a}))=0,$$

(12)

for $i=1,2,\cdots ,M$. This means that, in an NE, the temporal growth rate of the population fraction of each pool i is zero. That is, $\forall i\in \mathcal{M},\dot{x_i}\left(t\right)=0$ holds [48]. By solving the above equation system, we can find the NEs of the game.

3.3.3. Evolutionary Stability of NEs

Generally, ESSs are NEs, while NEs are not necessarily ESSs. Thus, we need to analyze the stability of NEs to identify the ESSs of the game. Again, we interpret the population states as mixed strategies. Suppose the entire population adopts the strategy ${\mathit{x}}^{\ast }$ and there is another mutant strategy ${\mathit{x}}^{\prime }$ that attempts to invade a fraction $ϵ\in (0,\overline{ϵ})$ of the population. If the following inequality holds, then ${\mathit{x}}^{\ast }$ is an ESS:

$$\sum _{i\in \mathcal{M}}{x}_i^{\ast }{y}_i((1-ϵ){\mathit{x}}^{\ast }+ϵ{\mathit{x}}^{\prime })\ge \sum _{i\in \mathcal{M}}{x}_i^{\prime }{y}_i((1-ϵ){\mathit{x}}^{\ast }+ϵ{\mathit{x}}^{\prime }).$$

(13)

More precisely, ${\mathit{x}}^{\ast }$ is an ESS if the following two conditions are met [46]: 

• ${({\mathit{x}}^{\ast }-\mathit{x})}^{\top }Y\left({\mathit{x}}^{\ast }\right)\ge 0,\forall \mathit{x}\in \mathcal{X}$
• If ${({\mathit{x}}^{\ast }-\mathit{x})}^{\top }Y\left({\mathit{x}}^{\ast }\right)=0$, then ${({\mathit{x}}^{\ast }-\mathit{x})}^{\top }Y\left(\mathit{x}\right)>0$ holds.

The first condition means that an ESS must be an NE. The second condition indicates that if a miner choosing strategy $\mathit{x}$ can earn as much revenue as a miner who chooses the NE strategy when other miners choose the NE, then a miner who chooses the NE must earn more revenue than a miner who chooses $\mathit{x}$ when other miners choose $\mathit{x}$.

4. Case Study with Two Mining Pools

In this section, we focus on the special case with two mining pools to show how the game is analyzed.

4.1. One-Side Attack Case

We first consider the one-side attack case, where one pool attacks the other. Suppose that pool 1 attacks pool 2, i.e., $a_{12}>0$ and $a_{21}=0$. According to (2), the revenue densities of the two pools are given by

$$r_1=\frac{\alpha (1-a_{12})+N{a}_{12}{r}_2(x_1{\omega }_1(1-a_{12})+x_2{\omega }_2)}{N(x_1{\omega }_1(1-a_{12})+x_2{\omega }_2)},$$

(14)

$$r_2=\frac{\beta {\omega }_2{x}_2}{N(x_1{\omega }_1{a}_{12}+x_2{\omega }_2)(x_1{\omega }_1(1-a_{12})+x_2{\omega }_2)}.$$

(15)

Substituting (15) into (14), we have

$$r_1=\frac{\alpha (1-a_{12})(a_{12}{\omega }_1{x}_1+{\omega }_2{x}_2)+a_{12}\beta {\omega }_2{x}_2}{N((1-a_{12}){\omega }_1{x}_1+{\omega }_2{x}_2)(a_{12}{\omega }_1{x}_1+{\omega }_2{x}_2)}.$$

(16)

Substituting (16) and (15) into (1), we can obtain the following expected payoffs of miners in both pools:

$$y_1={\omega }_1\left(\frac{\alpha (1-a_{12})(a_{12}{\omega }_1{x}_1+{\omega }_2{x}_2)+a_{12}\beta {\omega }_2{x}_2}{N((1-a_{12}){\omega }_1{x}_1+{\omega }_2{x}_2)(a_{12}{\omega }_1{x}_1+{\omega }_2{x}_2)}-p\right),$$

(17)

$$y_2={\omega }_2\left(\frac{\beta {\omega }_2{x}_2}{N((1-a_{12}){\omega }_1{x}_1+{\omega }_2{x}_2)(a_{12}{\omega }_1{x}_1+{\omega }_2{x}_2)}-p\right).$$

(18)

When pool 2 attacks pool 1, similar to (14) and (15), the revenue densities are expressed as follows:

$$r_1=\frac{\alpha {\omega }_1{x}_1}{N(x_1{\omega }_1+x_2{\omega }_2{a}_{21})(x_1{\omega }_1+x_2{\omega }_2(1-a_{21}))},$$

(19)

$$r_2=\frac{\beta (1-a_{21})+N{a}_{21}{r}_1(x_1{\omega }_1+x_2{\omega }_2(1-a_{21}))}{N(x_1{\omega }_1+x_2{\omega }_2(1-a_{21}))}.$$

(20)

The expected payoffs are given by

$$y_1={\omega }_1\left(\frac{\alpha {\omega }_1{x}_1}{N(x_1{\omega }_1+x_2{\omega }_2)(x_1{\omega }_1+(1-a_{21})x_2{\omega }_2)}-p\right),$$

(21)

$$y_2={\omega }_2\left(\frac{\beta (1-a_{21})(x_1{\omega }_1+x_2{\omega }_2{a}_{21})+a_{21}\alpha {\omega }_1{x}_1}{N({\omega }_1{x}_1+(1-a_{21}){\omega }_2{x}_2)({\omega }_1{x}_1+a_{21}{\omega }_2{x}_2)}-p\right).$$

(22)

According to (10), the equation system of the ODEs for the replicator dynamics can be expressed as follows:

$$\begin{array}{cc}\hfill \dot{x_1}& =x_1(y_1-\overline{y})=0,\hfill \end{array}$$

(23)

$$\begin{array}{cc}\hfill \dot{x_2}& =x_2(y_2-\overline{y})=0,\hfill \end{array}$$

(24)

where $\overline{y}$ is

$$\overline{y}=x_1{y}_1+x_2{y}_2.$$

(25)

Since $x_2=1-x_1$, letting $x_1=x$ and $x_2=1-x$, we can simplify the system of ODEs to the following equation:

$$\dot{x_1}=x(1-x)(y_1-y_2)=0.$$

(26)

Thus, the population state can be expressed as $(x,1-x)$.

For the case where pool 1 attacks pool 2, substituting (17) and (18) into (26) and solving the equation yields rest points in the form of $(x_1^{\ast },x_2^{\ast })=(x^{\ast },1-x^{\ast })$, where $x^{\ast }$ is given by

$$x^{\ast }\in \left\{0,1,\frac{-B\pm \sqrt{B^2-4AC}}{2A}\right\},$$

(27)

with

$$\begin{array}{cc}\hfill A& =a_{12}^{2}Np{\omega }_1^3-a_{12}Np{\omega }_1^3-a_{12}^{2}Np{\omega }_2{\omega }_1^2+a_{12}Np{\omega }_2{\omega }_1^2+Np{\omega }_2{\omega }_1^2-2Np{\omega }_2^2{\omega }_1+Np{\omega }_2^3,\hfill \\ \hfill B& =\alpha a_{12}{\omega }_1{\omega }_2-\alpha a_{12}^2{\omega }_1^2+\alpha a_{12}{\omega }_1^2-a_{12}\beta {\omega }_1{\omega }_2-\alpha {\omega }_1{\omega }_2+\beta {\omega }_2^2-2Np{\omega }_2^3+3Np{\omega }_1{\omega }_2^2-Np{\omega }_1^2{\omega }_2,\hfill \\ \hfill C& =-\alpha a_{12}{\omega }_1{\omega }_2+a_{12}\beta {\omega }_1{\omega }_2+\alpha {\omega }_1{\omega }_2-\beta {\omega }_2^2+Np{\omega }_2^3-Np{\omega }_1{\omega }_2^2.\hfill \end{array}$$

When pool 2 attacks pool 1, $x^{\ast }$ is also expressed as

$$x^{\ast }\in \left\{0,1,\frac{-B\pm \sqrt{B^2-4AC}}{2A}\right\},$$

(28)

but with

$$\begin{array}{cc}\hfill A& =a_{21}^{2}Np{\omega }_2^2{\omega }_1-a_{21}Np{\omega }_2^2{\omega }_1-a_{21}^{2}Np{\omega }_2^3+a_{21}Np{\omega }_2^3-Np{\omega }_1^3+2Np{\omega }_2{\omega }_1^2-Np{\omega }_2^2{\omega }_1,\hfill \\ \hfill B& =-\alpha a_{21}{\omega }_1{\omega }_2-a_{21}^2\beta {\omega }_2^2+a_{21}\beta {\omega }_2^2+a_{21}\beta {\omega }_1{\omega }_2+2a_{21}^{2}Np{\omega }_2^3-2a_{21}Np{\omega }_2^3-2a_{21}^{2}Np{\omega }_1{\omega }_2^2\hfill \\ \hfill & +2a_{21}Np{\omega }_1{\omega }_2^2+\alpha {\omega }_1^2-\beta {\omega }_1{\omega }_2+Np{\omega }_1{\omega }_2^2-Np{\omega }_1^2{\omega }_2,\hfill \\ \hfill C& =a_{21}^2\beta {\omega }_2^2-a_{21}\beta {\omega }_2^2+a_{21}^2(-N)p{\omega }_2^3+a_{21}Np{\omega }_2^3+a_{21}^{2}Np{\omega }_1{\omega }_2^2-a_{21}Np{\omega }_1{\omega }_2^2.\hfill \end{array}$$

Next, we proceed to analyze the evolutionary stability of the above rest points to find the ESSs. However, this is very difficult in our game model. We therefore discuss the evolutionary stability of the rest points based on the phase portrait of the replicator dynamics, which is a geometric representation of the trajectories of the population states, as shown in Figure 2. The condition for rest points to be stable is that for a rest point, any path starting from the neighborhood (red circle in Figure 2) of that point will finally converge to that point.

4.2. Both-Side Attack Case

Next, we consider the both-side attack case, where the two pools attack each other. According to (2), the revenue densities of both pools can be expressed as follows:

$$r_1=\frac{\frac{N{x}_1{\omega }_1(1-a_{12})\alpha }{N{x}_1{\omega }_1(1-a_{12})+N{x}_2{\omega }_2(1-a_{21})}+N{x}_1{\omega }_1{a}_{12}{r}_2}{N{x}_1{\omega }_1+N{x}_2{\omega }_2{a}_{21}},$$

(29)

$$r_2=\frac{\frac{N{x}_2{\omega }_2(1-a_{21})\beta }{N{x}_1{\omega }_1(1-a_{12})+N{x}_2{\omega }_2(1-a_{21})}+N{x}_2{\omega }_2{a}_{21}{r}_1}{N{x}_2{\omega }_2+N{x}_1{\omega }_1{a}_{12}}.$$

(30)

Note that (29) and (30) form an equation system in terms of $r_1$ and $r_2$. Solving this equation system, we obtain the expressions of $r_1$ and $r_2$, which are given by (31) and (32).

$$r_1=\frac{x_1{\omega }_1\left(x_2{\omega }_2\left(a_{12}\left(a_{21}\beta +\alpha -\beta \right)-\alpha \right)+\alpha \left(a_{12}-1\right)a_{12}{x}_1{\omega }_1\right)}{N\left(\left(a_{12}-1\right)x_1{\omega }_1+\left(a_{21}-1\right)x_2{\omega }_2\right)\left(a_{12}{x}_1^2{\omega }_1^2+x_2{\omega }_2\left(a_{21}{x}_2{\omega }_2+x_1{\omega }_1\right)\right)},$$

(31)

$$r_2=\frac{x_2{\omega }_2\left(x_1{\omega }_1\left(a_{21}\left(a_{12}\alpha -\alpha +\beta \right)-\beta \right)+\left(a_{21}-1\right)a_{21}\beta x_2{\omega }_2\right)}{N\left(\left(a_{12}-1\right)x_1{\omega }_1+\left(a_{21}-1\right)x_2{\omega }_2\right)\left(a_{12}{x}_1^2{\omega }_1^2+x_2{\omega }_2\left(a_{21}{x}_2{\omega }_2+x_1{\omega }_1\right)\right)}.$$

(32)

According to (1), (29) and (30), the expected payoffs of miners in both pools can be given by

$$y_1={\omega }_1\left(r_1-p\right),$$

(33)

$$y_2={\omega }_2\left(r_2-p\right).$$

(34)

However, in the both-side attack case, the expressions of the rest points are difficult to obtain due to the complexity of the replicator dynamics. Thus, we resort to numerical calculations to obtain the values of the rest points.

5. Numerical Results

In this section, we conduct simulations to show the evolution of population states in the two-pool case. The simulation results can be used to verify the correctness of our analysis in Section 3 and Section 4. We also plot the phase portraits of the replicator dynamics to show the stability of the obtained NEs. We consider three cases, i.e., the case without BWH attack (no-attack case), the one-side attack case and the both-attack case. Based on these results, we investigate the impacts of the BWH attack size on the stable population states.

5.1. Simulation Algorithm

We simulate the pool selection process based on Algorithm 1. This algorithm shows how each miner selects the pool to join based on the pairwise proportional imitation protocol. At the beginning of the simulation, each miner joins a pool randomly. After the initialization, each miner i randomly chooses a pool j ($j\in \mathcal{M}$) for payoff comparison and decides to move to pool j from its current pool k ($k\in \mathcal{M}$) with a certain probability ${\rho }_{k,j}$, if the expected payoff of pool j is larger than the expected payoff of pool k. Otherwise, the miner will stay in its current pool k. These steps will be repeated until the population states $\mathit{x}$ converges.

Algorithm 1 Mining Pool Selection Algorithm
1:	Initialize:$t\leftarrow 1$
2:	while$\mathit{x}$ is not converged and $t<\mathrm{MAX}\_\mathrm{COUNTER}$ do
3:	for all $i\in \mathcal{N}$ do
4:	$k\leftarrow \mathrm{The}\mathrm{current}\mathrm{pool}\mathrm{of}\mathrm{miner}i$
5:	$j\leftarrow \mathsf{rand}(1,M)$	▹ Choose a pool j for payoff comparison at random
6:	Move from pool k to j with probability
7:	${\rho }_{k,j}=x_{j}max(y_j(\mathit{x},\mathbf{\omega },s_j,\mathit{a})-y_k(\mathit{x},\mathbf{\omega },s_k,\mathit{a}),0)$
8:	end for
9:	$t\leftarrow t+1$
10:	end while

5.2. Results and Discussions

In this section, we verify the correctness of the analysis by simulations and also show the impacts of BWH attack on the population states of the mining pools. In the simulations, we execute Algorithm 1 to obtain the population states after convergence. The parameter settings used in the simulations are shown in

Table 2. Parameter settings.

Parameter	Description	Value
N	Number of miners	5000
M	Number of mining pools	2
C	Fixed revenue from the coinbase	1000
$\rho$	Transaction fee per unit block	2
T	Average block generation interval	600
p	Power charge required for unit hash power	0.001
$\frac{1}{\gamma c}+b$	Propagation delay parameter	0.005

.

5.2.1. No-Attack Case

First, we consider the case without BWH attack (i.e., $a_{12}=0,a_{21}=0$). In this case, we set the minimum required hash powers of the two pools as ${\omega }_1=30$ and ${\omega }_2=20$ and the block sizes of both pools as $s_1=s_2=100$. Under this parameter setting, we obtain an NE $(0.4,0.6)$ by calculating (27) with $a_{12}=0$. Figure 3a shows the corresponding phase portraits. The figure shows that all paths converge to the point $(0.4,0.6)$, indicating the stability of the NE obtained from theoretical analysis. This result is consistent with the simulation results in Figure 3b and the results in [24], indicating the correctness of the theoretical analysis. In addition, the ratio of the population of pool 1 to that of pool 2 in the stable population state is the inverse ratio of the hash powers of pool 1 to that of pool 2. This means that the revenue of a miner depends only on the required hash power of the pool to which he or she belongs in this case.

5.2.2. One-Side Attack Case

Next, we consider the one-side attack case, where pool 1 attacks pool 2 with attack size $a_{12}=0.015$. Other parameters are set to the same as those in Figure 3. Under this setting, we obtain four NEs: $(0,1)$, $(0.55,0.45)$, $(0.77,0.23)$ and $(1,0)$ by calculating (27). Figure 4a shows the phase portrait of the replicator dynamics. We can see from Figure 4a that the population states converge to $(0.55,0.45)$ from the initial state with $0\le x_1<0.77$ and converge to $(1,0)$ from $0.77<x_1\le 1$. This means that only $(1,0)$ and $(0.55,0.45)$ are stable, i.e., they are ESSs. We consider three initial population states for simulations, i.e., $(x_1,x_2)=(0.20,0.80)$, $(x_1,x_2)=(0.75,0.25)$ and $(x_1,x_2)=(0.85,0.15)$. Figure 4b shows the simulation results of the evolution of population states over time. We can see from Figure 4b that the population state converges to different points from different initial states, indicating the existence of two stable population states, which are $(x_1,x_2)=(1,0)$ and $(x_1,x_2)=(0.55,0.45)$. The simulation results are consistent with the theoretical ones, verifying the correctness of our analysis. Comparing the stable population states with those in the no-attack case, we can see that the population fraction of pool 1 increases from $0.4$ (no-attack case) to $0.55$ or to $1.0$ (one-side attack). This indicates that pools can attracts miners to join by launching the BWH attack.

We proceed to investigate the impacts of attack size on the stable population states, for which we fix the initial population state at $(0.5,0.5)$. Figure 5a,b show the simulation results for small attack size (i.e., in the region $[0,0.1]$) and large attack size (i.e., in the region $[0.9,1.0]$), respectively. From Figure 5a, we can see that as the attack size increases, the population of the attacking pool (i.e., pool 1) increases, while that of the attacked pool (i.e., pool 2) decreases. The results show that using more hash power for BWH attack attracts more miners to join, when the attack size is small. However, this is not the case when the attack size is sufficiently large, as shown in Figure 5b. We can see from Figure 5b that, for the case of the large attack size, the population of the attacking pool decreases as the attack size increases, while that of the attacked pool increases. The reason is that the larger the attack size is, the less hash power is used for mining, leading to decreased mining revenue, which dominates the trend of the total revenue of the pool. This indicates that devoting too much hash power for BWH attack may discourage miners to join the attacking pool. Similar observations have also been reported in [25].

We now examine the importance of the attacking revenue (i.e., revenue from the attacked pool) in the pool selection, for which we show in Figure 6 how the attack size of pool 1 affects the stable population states for both the case with attacking revenue (this paper) and without attacking revenue ([25]). We fix the initial population state as $(0.5,0.5)$ and also consider two regions, i.e., small attack size (i.e., $0.0$ to $0.1$) and large attack size (i.e., $0.9$ to $1.0$). We can see from Figure 6a that, for the case without considering the attacking revenue, miners prefer to join the attacked pool (i.e., pool 2) as the attack size increases. This is unreasonable, since intuitively joining the attacked pool will earn less revenues than joining the attacking pool, due to the advantage brought by BWH attack. We can see from Figure 6a that increasing the attack size to a sufficiently large (or even to 1) has no impact on the mining selection of miners in the case without considering the attacking revenue. This is also unreasonable, because the advantage of the attacking pool decreases due to the reduction of mining revenue in this situation, making the attacking pool less attractive for miners. The results in both figures show that ignoring the attacking revenue as in [25] may provide us with less accurate and convincing insights into the pool selection problem.

We also investigate the case where pool 2 attacks pool 1 with attack size $a_{21}=0.015$. Other parameters are the same as those in Figure 3. Under this setting, we obtain two NEs $(0,1)$ and $(1,0)$ by calculating (28). Figure 7a plots the phase portrait of the replicator dynamics. We can see from Figure 7a that the population states converge to $(0,1)$ from any initial state, implying that the NE $(0,1)$ (i.e., the state where all miners join pool 2) is stable and thus the only ESS. We also show in Figure 7b the simulation results for three initial population states $(x_1,x_2)=(0.20,0.80),(0.50,0.50),(0.75,0.25)$. The results show that all the population states finally converge to the state $(0,1)$, which agree with the theoretical results. Note that the minimum hash powers required to join pool 1 and pool 2 are ${\omega }_1=30$ and ${\omega }_2=20$ in Figure 4 and Figure 7. Comparing the results in these two figures, we can see that a pool with lower hash power requirement is more likely to attract miners when launching the BWH attack.

5.3. Both-Side Attack Case

Finally, we focus on the both-side attack case with attack sizes of $a_{12}=0.015$ and $a_{21}=0.015$. Other parameters are set as those in Figure 3. Under this parameter setting, we obtain five NEs: $(0,1),(0.2,0.8),(0.4,0.6),(0.8,0.2)$ and $(1,0)$ based on numerical calculations. We show in Figure 8a the phase portrait of the replicator dynamics. We can see from Figure 8a that the population states converge to $(0,1)$ for initial states with $x_1\le 0.2$, converge to $(1,0)$ for initial states with $x_1\ge 0.8$ and converges to $(0.4,0.6)$ for initial states with $0.2<x_1<0.8$. This implies that the ESSs in this case are $(0,1)$, $(1,0)$ and $(0.4,0.6)$. To verify the correctness of the analysis, we conducted simulations with three initial states $(x_1,x_2)=(0.20,0.80),(0.75,0.25),(0.85,0.15)$ and summarize the results in Figure 8b. The results show that all the population states finally converge to the state $(0,1)$ from initial state $(0.2,0.8)$, converge to $(0.4,0.6)$ from initial state $(0.75,0.15)$ and converge to $(1,0)$ from initial state $(0.85,0.15)$, which agree with the theoretical results. Comparing the results with those of the no-attack case, we can see that the pool with sufficiently large initial population fraction (e.g., more than $0.8$) will attract more miners to join. In addition, when the initial population fraction of either pool is not sufficiently large, attack has no impacts if the two pools attack with the same size, which can also be observed from Figure 5a.

Next, we investigate the impacts of attack sizes $a_{12}$ and $a_{21}$ on the converged population states. Figure 9 shows how the stable population state changes when the attack size of pool 1 ($a_{12}$) increases from 0 to $0.03$ under various values of the attack size of pool 2 ($a_{21}$). In Figure 9a, the initial state is fixed as $(0.50,0.50)$ and the attack size of pool 2 is set as $0.010,0.015,0.020$. This figure shows that, as the attack size of pool 1 (resp. pool 2) increases, the stable population fraction of pool 1 (resp. pool 2) increases. This means that using more hash powers for attack will attract more miners to join the pool after convergence. Furthermore, we can see that when the two pools use the same attack size, the populations converge to nearly the stable state without attack $(0.4,0.6)$, which means that attack has no impacts in this case. The results with initial states $(0.1,0.9)$ and $(0.9,0.1)$ are also shown in Figure 9b,c. We can see the same phenomenon from these two figures that mining pools can attract more miners to join after convergence by increasing their attack sizes, implying that attack can give mining pools advantages.

6. Conclusions

In this paper, we have investigated the mining pool selection problem in the presence of a Block WithHolding (BWH) attack and obtained the stable population states from the perspective of evolutionary game theory. In particular, we have focused on the scenario with two mining pools and provided simulation and theoretical results to show the correctness of the analysis. The results in this paper have shown that pools can attract miners to join by launching the BWH attack, and devoting more hash power (computation power) for attack attracts more miners, when the attack power is small. However, too large of an attack power will discourage miners to join. These observations indicate the significant impacts of BWH attack on the mining pool selection of miners. Note that this paper considered the two-pool scenario as the case study, which is good enough for us to obtain fundamental findings but may provide less insights to the general case with more mining pools. Therefore, we will focus on the general scenario in the future work. In addition, we will also consider conducting experiments with more practical parameter settings or in real-world blockchain networks like Bitcoin to help us understand the problem more deeply.