Colluding miners attack: Is the Bitcoin protocol compromised?

Question

A very interesting academic paper has been recently published by two researches from the Cornell University (abstract, full PDF):

Abstract

The Bitcoin cryptocurrency records its transactions in a public log called the blockchain. Its security rests critically on the distributed protocol that maintains the blockchain, run by participants called miners. Conventional wisdom asserts that the protocol is incentive-compatible and secure against colluding minority groups, i.e., it incentivizes miners to follow the protocol as prescribed.

We show that the Bitcoin protocol is not incentive-compatible. We present an attack with which colluding miners obtain a revenue larger than their fair share. This attack can have significant consequences for Bitcoin: Rational miners will prefer to join the selfish miners, and the colluding group will increase in size until it becomes a majority. At this point, the Bitcoin system ceases to be a decentralized currency.

Selfish mining is feasible for any group size of colluding miners. We propose a practical modification to the Bitcoin protocol that protects against selfish mining pools that command less than 1/4 of the resources. This threshold is lower than the wrongly assumed 1/2 bound, but better than the current reality where a group of any size can compromise the system.

The article suggests that miners who group together can earn more than their fair share, which means rational miners will eventually group together into a pool whose size is larger than half the network's computation power and control the currency. The method was termed "selfish mining" by the media.

This seems to be the first serious cryptographic exploit of the Bitcoin protocol.

Do you think this poses a real threat to the stability of the currency?

Answer 1

The report is not heavily disputed.

In the hours following the paper's release, several developers are discussing solutions:

• http://www.mail-archive.com/[email protected]/msg03128.html

and

• http://bitcointalk.org/index.php?topic=324413.0

There has not been any evidence that such an attack is imminent or likely even. And remember, even an attacker with 51% cannot do much. One risk is that a transaction could be canceled after it has confirmations, if the selfish pool is that much further ahead.

Answer 2

The interesting thing about that paper is that, if I understood correctly, it doesn't require pools to collude in order to attempt the "selfish miner" strategy - any pool with more than 25% of the total hash power could do it solo - right now there are pools which could do it.

And with just slightly more than 33% of total hash power, they could make their attack unstoppable, earning much more coins than their fair share - thus providing a strong incentive for people to abandon their pools to join the fest. And even without reaching the magical 51% number, just with more than 33% they could eventually run the network, deciding which transactions they like or not.

Their logic seems pretty compelling though I admit I wasn't able to understand everything - which means the real threshold for Bitcoin's network security, as-is right now, is actually 33% rather than 51%. Which in turn means there ought to be a big emigration of people out of the biggest pools to the small ones, for the benefit of the whole network.

Will be interesting to see what the main devs do to address this...