The key idea behind this strategy, called Selfish Mining, is for a pool to keep its discovered blocks private, thereby intentionally forking the chain. The honest nodes continue to mine on the public chain, while the pool mines on its own private branch. If the pool discovers more blocks, it develops a longer lead on the public chain, and continues to keep these new blocks private. When the public branch approaches the pool’s private branch in length, the selfish miners reveal blocks from their private chain to the public
This strategy leads honest miners that follow the Bitcoin protocol to waste resources on mining cryptopuzzles that end up serving no purpose. Our analysis demonstrates that, while both honest and selfish parties waste some resources, the honest miners waste proportionally more, and the selfish pool’s rewards exceed its share of the network’s mining power, conferring it a competitive advantage and incentivizing rational miners to join the selfish mining pool.
This is very confusing to me. How exactly is the selfish pool supposed to maintain a lead on the public chain without 51% of the hash rate?
They don't reveal their blocks when they've mined them, effectively withholding their hashrate, so they need less than 51% because the public network is only hashing with 2/3rds the hashrate.
... that's my intuitive explanation at least. If it's the same paper I've read, they have a model in there that demonstrates it.
I was trying to do some simple math but couldn't figure it out.
Even if the selfish miner had a 1 block head start by getting a lucky block, I couldn't figure out how starting to mine in private would be beneficial.
Just as an example. Suppose the selfish miner has 33% of hash rate and got a lucky block. Then it proceeds to mine in private.
Hash rate of selfish miner = 1/3 blocks per 10 minutes (but with 1 block head start)
Hash rate of honest miner = 2/3 blocks per 10 minutes
Expected length of selfish chain after t 10 minute intervals: 1 + \frac{1}{3}t
Expected length of public chain after t 10 minute intervals: \frac{2}{3}t
Expected duration of advantage: 30 minutes
But in that duration of advantage, the selfish miner only expects to mine an additional block (1/3*30)... which would be the same as if it had just published the lucky block and continued to mine honestly.
You can repeat this exercise with any fractional hash rate below 50%, like 40%, or 25%, and I think the result is the same: there's no advantage over just broadcasting the initial lucky block and mining honestly.
I wonder if the argument rests on how this would cause the honest miners to waste more resources, incentivizing them to join your selfish pool? I need to read the paper I guess.
I suppose it could also have to do with difficulty adjustments? But to wait for the difficulty to adjust, you'd have to maintain your lead on the public chain for a long time.
It could have to do with when the selfish miner releases their chaintip because most miners will mine on the tip with the most work and will discard tips with less work.
IIRC the claim isn't about double spending below 51%. It's about disrupting the chain's progress indefinitely with 33%.
t10 minute intervals:1 + \frac{1}{3}tt10 minute intervals:\frac{2}{3}t