Can Bitcoin Days Destroyed be a better resolution mechanism for competing blocks?

Question

I've been looking at selfish mining and empty blocks. In all cases, the selfish miner profits by keeping block solutions private until their value to his own pool is maximized, rather than releasing them ASAP which is the honest way to do it.

If the protocol were changed to make holding back a block far riskier than it is currently, I think this would go a long way to solving the problem presented by selfish mining. A selfish pool holds a solved block until someone else solves a block at the same height. The selfish pool then releases its pre-solved block (having had time to privately seed the global network so that as many honest miners as possible will see the selfish block first) to orphan the honest miner's block. Currently, the risk is that enough honest miners might choose the honest block with the result that the selfish miner loses both the reward for having solved it first and the advantage of being one block ahead. The papers on selfish mining show that this risk is not great enough to prevent selfish mining.

The protocol currently expects a miner to use the first block that adds to the chain. If this rule (actually a suggestion) were changed to expect a miner to use the block that destroys the most bitcoin days, selfish miners would risk far more by holding back their solutions. It would still be relatively easy for a selfish miner who has gotten ahead to exploit his position by saving the solution until it can be used (if it destroys more bitcoin days) to orphan someone else's solution, but the risk that the other solution might destroy more bitcoin days would be significant. Even if the selfish miner seeded his solution with his own very old UTXOs, he would be wasting some of his ammunition (bitcoin days).

Additionally, the rule that a miner use the first seen block or any other rule to resolve conflicts when two blocks show up as possible extensions to the current chain is not enforceable. So perhaps what is needed is not for the protocol to change, but for miners (who would like to prevent the selfish mining attack) trying to decide between two new block heads to use bitcoin days destroyed to decide. Publishing this idea, however, is not warranted until it has been criticized for flaws.

So have at it!

Answer 1

Thanks to Murch, I'm answering my own question; Yes!

Murch made the point that using BTCDD enables a selfish miner to mine a non-broadcast transaction that spends old coins rather than having to rely on a network propagation advantage. I understand this objection. That advantage is easily removed by excluding from your BTCDD calculation transactions that you didn't see until you got this new block. Now the selfish miner has to broadcast his old-coin transaction.

(edit due to comment:) While it is true that some BTCDD-heavy transactions will have gotten to one miner and not another, making the tie-breaking strategy arbitrary, because neither will have the BTCDD-heavy transaction privately mined by the selfish miner, it is still more effective at discouraging selfish mining than letting the network choose randomly, if and when you can assume that most miners will have seen both blocks around the same time. BTCDD is arbitrary because of incomplete propagation of transactions, but because of fully propagated transactions, it is less arbitrary than first-seen.

Also, you can't spend just a part of an input. I submit that it's harder to have (enough) old coins than it is to set up a global network of tightly connected nodes for cheating. I suppose I could be wrong, but old coins is always a dwindling resource and global nodes willing to help cheat is probably a growing one.

The only purpose for orphaning a block is that you've already been mining on top of your replacement for it. This point was made soon after Sirer and Eyal described their selfish mining vulnerability, though quite indirectly. Using a "later block" to do that would severely diminish the advantage. The point is to discourage sitting on solutions by making the later block more likely to be accepted. Would you consider throwing away any seconds of your own mining when you see an alternate solution? To discourage selfish mining, I'd do a few seconds, I guess.

I also very much like discouraging empty blocks, but who mines empty blocks just to do a selfish mining attack? Oh wait, that's probably the best way to do it! Hmm...