HackerPapers

arXiv:1311.0243cs.CR

Majority is not Enough: Bitcoin Mining is Vulnerable

Ittay Eyal, Emin Gun Sirer

Abstract

The Bitcoin cryptocurrency records its transactions in a public log called the blockchain. Its security rests critically on the distributed protocol that maintains the blockchain, run by participants called miners. Conventional wisdom asserts that the protocol is incentive-compatible and secure against colluding minority groups, i.e., it incentivizes miners to follow the protocol as prescribed. We show that the Bitcoin protocol is not incentive-compatible. We present an attack with which colluding miners obtain a revenue larger than their fair share. This attack can have significant consequences for Bitcoin: Rational miners will prefer to join the selfish miners, and the colluding group will increase in size until it becomes a majority. At this point, the Bitcoin system ceases to be a decentralized currency. Selfish mining is feasible for any group size of colluding miners. We propose a practical modification to the Bitcoin protocol that protects against selfish mining pools that command less than 1/4 of the resources. This threshold is lower than the wrongly assumed 1/2 bound, but better than the current reality where a group of any size can compromise the system.

arXiv comments
Journal reference
DOI
Subjects
cs.CRCryptography and Security

On Hacker News

Linked by 14 identifiable commenters in 15 comments across 14 threads, from Nov 2013 to Jul 2018. Found in 2 HN submissions from Nov 2013 to Nov 2013. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments14 threads

  1. Majority is not Enough: Bitcoin Mining is Vulnerable∗ [pdf] 1 comment
  2. A blockchain is a specific set of choices suitable for a narrow set of use-cases 1 comment

    • The PoW blockchain is slow to propagate updates but design. If you don't know how proof of work blockchains work, I advice you to Google around for a nice technical breakdown. Suffice to say, it is fundamental and a property people specifically code in to make blocks take a…

      KirinDaveView on HNParent context

  3. Proof-Of-Work is a Decentralized Clock 1 comment

    • While the analysis contained in this article is rather arbitrary, blustery and imprecise, there is a mechanism by which blockchains can serve as 'partially synchronized clocks.' One interesting facet about Bitcoin is that the model under which you analyze the effect of network…

      tchitraView on HNParent context

  4. Why Is It Taking 20 Minutes to Mine This Bitcoin Block? 1 comment
  5. Cryptographic vulnerabilities in IOTA 1 comment

    • I even think that the issues with new cryptocurrencies is underestimated in the article. The problem goes beyond the cryptographic aspect to game theoretical challenges: the cryptographic protocols could be perfect and yet the cryptocurrency be insecure or offer a low security…

      wslhView on HNParent context

  6. Bitcoin Is Having a Civil War as It Enters a Critical Month 1 comment

    • I see a lot of mention of 51% attack; the selfish miner attack could be done with closer to 33%(!): https://arxiv.org/pdf/1311.0243v4.pdf https://bitcoin.stackexchange.com/questions/38273/have-bitco...

      hellbannerView on HNParent context

  7. Bitcoin-NG: A Secure, Faster, Better Blockchain 1 comment

    • Miner consolidation is a long-standing problem with Bitcoin itself. When Ittay and I discovered selfish mining [1], we were quite worried about the size of mining pools at the time. Even though we also came up for a fix against selfish mining, the fix only prohibits selfish…

      emin-gun-sirerView on HNParent context

  8. Banks Forgot Who Was Supposed to Own Dell Shares 1 comment

    • Doesn't a technique like selfish mining (http://arxiv.org/abs/1311.0243) mean that you can undo past transactions faster than 2% of the time, though?

      bennofsView on HNParent context

  9. Now Accepting Bitcoin on Dell.com 1 comment

    • 51% attack is not the only kind of attack. A "selfish mining" attack can break the system too. http://hackingdistributed.com/2013/11/04/bitcoin-is-broken/ Here's the paper http://arxiv.org/abs/1311.0243

      sp332View on HNParent context

  10. It's Time For a Hard Bitcoin Fork 1 comment

    • It's nice to hear that in your final paper you acknowledge the earlier discussions. You should link that final version from your author homepages. (The latest versions linked from you and your coauthors' pages, at arXiv [1] and Cornell [2], still have no mention of the earlier…

      gojomoView on HNParent context

  11. Why Bitcoin Matters 2 comments

    • Bitcoin is the first practical solution to a longstanding problem in computer science called the Byzantine Generals Problem. Wait, isn't Paxos arguably the first practical solution to BGP? [0] [1] It's been in production use at Google since at least 2006. [2] Furthermore, Paxos…

      sigilView on HNParent context

    • The selfish miner(s) build a blockchain in private and choose the right moment to reveal it. This paper describes it in more detail: http://arxiv.org/pdf/1311.0243v2.pdf

      sigilView on HNParent context

  12. OkTurtles + DNSNMC: Surveillance-free communication on your favorite websites 1 comment

    • Thanks for taking the time to research and respond! So: 1) Dan's comments on Bitcoin in that BI article are a bit subtler than that. The very last section suggests (to me) that despite what value the BTC protocol has, it doesn't "square the triangle." 2) Dan is mainly talking…

      dvanduzerView on HNParent context

  13. How the Bitcoin protocol actually works 1 comment

    • From the article: "I don’t understand why double spending can’t be prevented in a simpler manner using two-phase commit. What drawbacks and advantages does it have compared to the full Bitcoin protocol? uppose Alice tries to double spend an infocoin with both Bob and Charlie.…

      hendzenView on HNParent context

  14. Majority is not Enough: Bitcoin Mining is Vulnerable 1 comment

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.