Conceptio › Archive › arXiv CS

arXiv CSopen access

Temporary Power Adjusting Withholding Attack

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

cryptography, security, privacy, cybersecurity

Temporary Power Adjusting Withholding Attack Mustafa Doger

Sennur Ulukus

arXiv:2604.14135v1 [cs.CR] 15 Apr 2026

Department of Electrical and Computer Engineering University of Maryland, College Park, MD 20742 [email protected] [email protected]

Abstract—We consider the block withholding attacks on pools, more speciﬁcally the state-of-the-art Power Adjusting Withholding (PAW) attack. We propose a generalization called Temporary PAW (T-PAW) where the adversary withholds a fPoW from pool mining at most T -time even when no other block is mined. We show that PAW attack corresponds to T → ∞ and is not optimal. In fact, the extra reward of T-PAW compared to PAW improves by an unbounded factor as adversarial hash fraction α, pool size β and adversarial network inﬂuence γ decreases. For example, the extra reward of T-PAW is 22 times that of PAW when an adversary targets a pool with (α, β, γ) = (0.05, 0.05, 0). We show that honest mining is sub-optimal to T-PAW even when there is no difﬁculty adjustment and the adversarial revenue increase is nontrivial, e.g., for most (α, β) at least 1% within 2 weeks in Bitcoin even when γ = 0 (for PAW it was at most 0.01%). Hence, T-PAW exposes a signiﬁcant structural weakness in pooled mining—its primary participants, small miners, are not only contributors but can easily turn into potential adversaries with immediate non-trivial beneﬁts.

I. I NTRODUCTION Nakamoto’s Bitcoin (BTC) protocol, or more generally Nakamoto consensus, allows users to reach consensus in distributed permissionless settings [1]. Nakamoto’s protocol incentivizes users by rewarding them for participating in a procedure called mining that is essentially solving a cryptographic puzzle. The (honest) protocol prescribes users to mine on top of the longest chain and share newly mined blocks immediately with their peers. When everyone follows the honest protocol, miners get rewards that is proportional to their fraction of hashpower in the system. A miner working in such a blockchain with y fraction of hashpower where a block is issued every b minutes 2 gets rewarded in yb minutes on average with variance b (1−y) . y2 Hence, small miners join mining pools that regularly share the block rewards between the pool members to get a steady income rather than a ﬂuctuating one with high variance [2]. Eyal and Sirer [3] showed that an entity can increase its share of rewards by adopting a mining strategy called selﬁsh mining. A myriad of works in the following decade delved deeper into this strategy from various points of view such as optimization, revenue changes and proﬁt lags [4]–[12]. Similar to selﬁsh mining, another adversarial mining strategy, called Block Withholding (BWH) attack, targeted at pool mining, increases an attacker’s share of rewards [13]. In a nutshell, with a fraction of its mining power, an adversary joins a pool for mining but withholds the blocks it mines, but still gets rewards from the blocks mined by the other pool members. By carefully allocating its power between honest and targeted pool mining, an adversary can increase its fraction of the rewards [14]. In 2014, Eligius mining pool announced that it was subject to BWH attack and lost 300 BTC at the time [15].

An improved version of BWH is called Fork After Withholding (FAW) attack where the adversary releases the withheld block when an honest miner (outside the target pool) mines a block to cause a fork race [7]. Power Adjusting Withholding (PAW) attack is a further improvement, where the adversary readjusts its power allocation to pool mining after it ﬁnds a block that increases the extra reward (up to 2.5 times the extra reward in FAW) [8]. An in-depth analysis of PAW is given in [9] which derives PAWrelated quantities in an explicit manner without the simplifying assumptions of [8] related to fork races. Authors of [11] show that selﬁsh mining is an attack on the difﬁculty adjustment algorithm (DAA) of BTC and a temporal revenue analysis shows that selﬁsh mining strategy is sub-optimal compared to honest mining absent any DAA. The analysis of [9] discovers that even though BWH and FAW attacks are also suboptimal, PAW strategy dominates the honest mining strategy for some parameters. Further, the authors prove that the honest miners outside the target pool proﬁt from the PAW attack, in cases even more than the adversary mounting the attack. In this paper, we propose Temporary PAW (T-PAW) which is essentially the same strategy as PAW however there is a deadline on block withholding, i.e., the adversary releases the withheld block after at most T -time. Our results are as follows: • We show that the PAW strategies are sub-optimal to T-PAW and there is a large space of improvement available for small miners. In fact, the extra reward of T-PAW compared to PAW increases by an unbounded factor as adversarial hash fraction α, pool size β and adversarial network inﬂuence γ decreases. • We replace an approximation used in previous PAW analysis [8], [9] regarding the reward sharing in pools with an exact analysis using stochastic distributions of mining times. • T-PAW attack results in no short-term proﬁt lag for the adversary in most parameter regimes even when the goal is to maximize its revenue ratio. • T-PAW attack’s proﬁtability does not require a DAA and dominates honest mining. The adversary can get non-trivial revenue increase for all parameters even when γ = 0. • PAW attack is shown to beneﬁt the honest miners outside the target pool, in many cases even more than the adversary launching the attack [9]. In T-PAW, even when γ = 0, the adversary beneﬁts most from the attack. The results above suggest that unlike PAW (and previous BWH attack types), even a small miner can get non-trivial beneﬁts from T-PAW. When one also considers the fact that the pools are formed primarily by small home miners, the attack exposes a structural weakness in pooled mining—its primary participants, small miners, are not only contributors but can easily turn into potential adversaries with non-trivial and immediate gains.

II. S YSTEM M ODEL

Parameters

Values

We consider a blockchain functioning under the Nakamoto longest chain Proof-of-Work (PoW) protocol with n miners where n is large, i.e., each miner controls an inﬁnitesimal fraction of hashpower in the system. We consider α fraction of the miners to be adversarial and colluding, which in turn can be represented as a single entity, called the adversary, controlling α fraction of the hashpower. The remaining miners are assumed to be honest, i.e., they mine on top of the longest chain and immediately share the newly mined blocks with the network. We assume that if everyone including the adversary mines honestly, the block arrival process follows the exponential distribution with Exp(λ1 ). We are interested in BWH against pools, hence we assume a target pool that consists of honest miners and makes up β fraction of the total hashpower in the system. The pool is run by a manager who assigns PoW tasks to its miners, which are analogous to puzzles. The miners working towards their assignments encounter fPoW (full PoW) and pPoW (partial PoW) solutions that they regularly share with the manager. pPoW solutions, which can be seen as easier versions of the puzzle assignment, help the manager determine the contribution of each member towards the mining. On the other hand, fPoW solutions essentially create valid blocks and the manager shares the reward between the miners according to their contribution. We assume that the adversary attacks the target pool of size β under the condition that α + β < 0.5. More speciﬁcally, the adversary allocates some fraction of its hashpower to join the target pool and mounts a sophisticated BWH attack where it shares pPoW regularly but withholds fPoW according to some predetermined strategy to be explained in Section III-A. In this paper, following the convention in the literature [3]– [14], we assume that the adversary becomes aware of any block as soon as it is mined and we ignore the innocent forks, i.e., the forks between the honest blocks (mined by honest miners) caused by network delays. On the other hand, forks caused by adversarial strategies are treated as follows. Assume the adversary withholds a fPoW mined as part of pool mining and later an honest block is created and shared by an honest miner outside the pool. In such a case, the adversary can rush to release the withheld fPoW and γ fraction of the honest miners outside the pool receive the adversarial fPoW ﬁrst and mine on top of it, whereas 1−γ fraction of the honest miners outside the pool receive the honest block ﬁrst and mine on top of it. All the honest miners of the target pool follow the decision of the pool manager. If the pool manager is rational (1PR = 1), it picks the adversarial fPoW, which increases the revenue of the pool compared to the case of 1PR = 0. Further, we assume that the blockchain adopts a DAA similar to that of BTC. Let us call the blocks that become part of the longest chain in the long run as canonical blocks. The blockchain readjusts the mining difﬁculty after every D0 canonical blocks are 0 mined to maintain a steady block production rate of D τ0 where the times between adjustments are called epochs. More speciﬁcally, given the current mining difﬁculty of dc in an epoch and the epoch lasts τc time to produce D0 blocks, the blockchain readjusts the difﬁculty at the beginning of the next epoch as dn = dc ττ0c .1

α β pi (i = 1, 2) λ1 λ2 ai (i = 1, 2)

adversarial hash fraction pool hash fraction fraction of α at pool mining total block generation rate

a′i (i = 1, 2) λ′i (i = 1, 2) T′

αpi ai λi ai

1 For the sake of convenience, we assume that a higher difﬁculty means fewer blocks mined. Further, even though many DAAs such as that of BTC restrict the change to be between dn ∈ [1/4dc , 4dc ], our system model guarantees dn ∈ [1/2dc , 2dc ].

(1 − αp2 )λ1 β + αpi

a2 T

R ∞ e−x

E1 (t)

TABLE I: Frequently used notations.

A. Deﬁnitions Here, we list a series of notations used frequently throughout the paper in Table I and deﬁne the following useful metrics. Deﬁnition 1 Relative Extra Rewards (RER) [8] of an entity x (RERxS1 ,S2 ) is deﬁned as RERxS1 ,S2 =

S2 1 ρS x − ρx

(1)

2 ρS x

where ρS x represents the revenue ratio of an entity x when the adversary adopts the strategy S . The Revenue Ratio of an entity is deﬁned as the fraction of the rewards the entity receives in the long-run out of the total rewards issued in the system. Deﬁnition 2 Revenue Change [9], [10] of an entity x at time t when the adversary adopts the strategy S compared to when the adversary adopts the honest strategy H is ( ∆S,H x (t) =

H S t (ρS x − ρx δ ) δ S τ ,

t ≤ δ S τ0

H S S H t−δ S τ0 , ρS x − ρx δ + (ρx − ρx ) τ0

t > δ S τ0

(2)

where ρH x is the fraction of hashpower of entity x in the system whereas δ S represents the block redundancy ratio when the adversary adopts the strategy S .2 Similarly, Relative Revenue S,H ∆S,H (t) Change is deﬁned as ∆x (t) = xρH . x

Deﬁnition 3 Proﬁt Lag [9], [10] of an entity x when the adversary adopts the strategy S is deﬁned as ∆S,H = inf{τ : ∆S,H x x (t) > 0, ∀t > τ }.

(3)

Remark 1 The revenue change of the adversary A at t1 = δ S τ0 tells us how much its revenue changes at the end of the ﬁrst epoch compared to the case if it adopted the honest strategy H . It should be clear that ∆H,H (t) = 0 for ∀(t, x) since δ H = 1. If x ∆S,H (t ) > 0 , the proﬁt lag of the adversary is zero, i.e., under 1 A strategy S the adversary gets more revenue than honest mining even when there is no difﬁculty adjustments in the system. We refer the reader to [8]–[10] for a more detailed explanation to understand the intuition behind the metrics deﬁned above. 2 Throughout the paper, we consider a reference time t = 0 as the starting 0 time of a new epoch and the adversary mounts a strategy S at t0 , before which everyone including the adversary was following the honest protocol.

1−α−β

III. T EMPORARY P OWER A DJUSTING W ITHHOLDING Before introducing our attack explicitly, we brieﬂy revisit the previous PAW models [8], [9]. The model and analysis of PAW used in [8] assumes some simpliﬁcations in the fork races pertaining to the attack whereas a more rigorous analysis of the attack is provided in [9]. The simpliﬁed model assumes that each attack cycle contributes one block to the longest chain growth and is independent from other cycles whereas the latter model considers the fork races explicitly until the attack cycles fully end. Since we build complicated versions of PAW attack that involve multiple block growth in each attack cycle, in this paper, we use the rigorous modeling of [9]. Further, although [9] builds a more rigorous analysis compared to [8], both models still use an approximation regarding the rewards of the fPoWs shared between pool members and the adversary (see Appendix B). The approximation error grows large especially for T-PAW attacks considered in this paper. Hence, we provide an explicit and rigorous analysis regarding the rewards of the fPoWs, which enables us to derive exact results rather than approximations. A. Attack Description: T-PAW Let us start by explicitly stating the T-PAW attack. Let λ1 denote the total mining rate of the full network, i.e., when everyone mines honestly. At the start of the attack cycle, the adversary mines individually and honestly with (1 − p1 ) fraction of its hashpower, i.e., mines on the tip of the longest chain and releases the block immediately. With remaining p1 fraction, it mines as part of the pool. It regularly submits the pPoWs until it encounters a fPoW. • If another miner ﬁnds a block before the adversary encounters a fPoW, the adversary accepts the new block and starts a new attack cycle on top of the new block. • If the adversary encounters a fPoW, it withholds the fPoW and readjusts p1 to p2 . The ensuing phase of the attack is called the withholding phase, during which: 1) If the adversary ﬁnds another fPoW with p2 fraction, it discards the old one and keeps holding the new one. 2) If an honest pool miner ﬁnds a block, the adversary accepts the block and discards the withheld fPoW. 3) If the adversary mines a block with its individual mining power, it releases this new block and discards the fPoW. 4) If an honest miner outside the pool ﬁnds a new block, the adversary releases the withheld fPoW and a fork race ensues (fork race phase), where the adversary, the pool (if the pool manager is rational, i.e., 1PR = 1) and γ fraction of the miners outside the pool prefer the adversarially released fPoW. During this fork race, the adversary mines honestly and individually on top of the fPoW with all its power. 5) If none of the Cases 2, 3, 4 happens in T time (we do not care about Case 1), the adversary releases the fPoW. After one of the Cases above (except Case 1) happens (and after the fork races resolve if Case 4 happens), the attack cycle ends and the adversary reverts its power allocation to pool as p1 and a new attack cycle starts. In Fig. 1, we display all the paths an attack cycle can take with the respective probabilities. The blue box represents the start of an attack cycle that ends in one of the red boxes (the cyan boxes represent middle steps within a cycle).

β Attack cycle starts

α(1 − p1 ) αp1

Honest miners outside target pool ﬁnd a block Honest miners in target pool ﬁnd a block

(adversary accepts/releases the new block)

Individual adversarial mining ﬁnds a block Adversary ﬁnds a fPoW for target pool and withholds During the withholding phase (αp2 power is ignored)

1 − e−λ2 T

e−λ2 T

The ﬁrst entity that ﬁnds a block is

Nobody ﬁnds a block in T time (adversary releases fPoW)

α(1−p2 ) 1−αp2

β 1−αp2

Individual adversarial mining

Honest miners in target pool

(adversary discards fPoW and releases/accepts the new block)

1−α−β 1−αp2

Honest miners outside target pool During the fork race phase

1−α−β

Adversary mines a block

Honest miners in target pool mine a block

Honest miners outside target pool mine a block

(on top of withheld fPoW)

(on top of withheld fPoW if manager rational)

(w.p. γ on top of withheld fPoW)

(adversary releases/accepts the new block)

Fig. 1: Evolution of a T-PAW attack cycle. B. Relation to Existing Strategies First, note that when T = 0, the T-PAW reduces to honest mining strategy irrespective of p1 , p2 values. On the other hand, when T → ∞, T-PAW reduces to PAW described in [9].3 Our analysis suggests that for many parameters, especially when α, β, γ are small, T → ∞ is not optimal and there is a large room for improvement compared to PAW. Such an argument might be counterintuitive when one takes the memorylessness property of exponential arrivals into account since the ﬁrst arrival time in Cases 2, 3, 4 does not depend on time T , i.e., how long the adversary already withheld the fPoW. However, the reward of the adversary from the fPoW is not memoryless, which effects the ﬁnal revenue ratio. For example, withholding the fPoW and increasing p1 to p2 increases the adversarial fractional reward, but as more time passes the fractional reward saturates and the adversary only risks its share of rewards from the fPoW. It is shown in [9] that for many parameters, the PAW attack can be superior to honest mining even when there is no DAA in the protocol. On the other hand, without DAA, withholding strategies such as selﬁsh mining result in less revenue than honest mining [11]. An inspection of such a situation in [9, Example 1] with T = ∞ suggests that the phenomenon occurs especially when p2 is large and β is small and γ is large. In such a situation, the adversary signiﬁcantly increases p1 to p2 , since if the fork race resolves in its favor, it will get more revenues from fPoW than it would if it were to act honestly and publish immediately. Notice, when an attack cycle starts and the adversary encounters fPoW, it withholds and readjusts its power allocation to the pool until some other entity ﬁnds a block in the regular PAW attack (T = ∞). There are two shortcomings of this strategy even if p2 is large and β is small: 1) If it takes a long while until someone else ﬁnds a block, the total adversarial fractional contribution to the pool in that attack cycle is already saturated. 2) If γ is not large, the adversary is risking all the contributions to fPoW by waiting more since the fork race is less likely to result in its favor. Thus, we propose that the adversary withholds the fPoW at most for a ﬁnite time T that is to be optimized in addition to p1 , p2 , which in turn brings improvements. 3 The (simpliﬁed fork race) PAW modeling of [8] with c = γ(1 − α − β) + α+β 1PR results in approximately the same revenue ratios as (rigorous) PAW modeling of [9]. PAW modeling of [8] reduces to FAW [7] when p1 = p2 . FAW attack in turn reduces to BWH when c is set to 0 (see Appendix C).

cycle. The block redundancy ratio of T-PAW is

IV. A NALYSIS OF T-PAW Q UANTITIES

δ p1 ,p2 ,T =

Here, we provide the relevant quantities related to the T-PAW p1 ,p2 ,T attack. Let us denote the adversarial revenue ratio as ρA (or simply ρA as we drop the superscripts notation for convenience). Let BA denote the reward the adversary gets in an attack cycle whereas BC denote the total reward in an attack cycle from the canonical blocks. Since each attack cycle is independent, due to the law of large numbers, we have, p1 ,p2 ,T ρA = ρA =

E[BA ] , E[BC ]

(4)

E[BC ] = 1 + αp1 1 − e−λ2 T

1 − α − β 1 − αp2

(5)

E[BA ] = α(1 − p1 ) + βr1 + αp1 e−λ2 T rs + 1 − e−λ2 T +

α(1 − p2 ) 1 − αp2

β ru 1 − αp2

1−α−β ru (γ(1 − α − β) + α + β 1PR ) + α 1 − αp2

with r1 = a′1 ,

′

rs = a′1 + (a′2 − a′1 )λ′1 T ′ eλ1 T E1 (λ′1 T ′ ), ru = a′1 + (a′2 − a′1 )

λ′1 λ′2 ′ ′ 1 − e−λ2 T

Z T′

(6)

(7) ′

′

t e(λ1 −λ2 )t E1 (λ′1 t) dt.

(8)

Similarly, it can be shown that the revenue ratio of the rest of the pool members is p1 ,p2 ,T ρpool = ρpool =

E[BP ] , E[BC ]

(9)

where BP denotes the reward the honest pool miners get in an attack cycle from the canonical blocks and its expectation is E[BP ] = β(1 − r1 ) + αp1 e−λ2 T (1 − rs ) + 1 − e−λ2 T

1−α−β β (1 − ru ) + 1 − αp2 1 − αp2

× (1 − ru )(γ(1 − α − β) + α + β 1PR ) + β

E[BO ] =E[BC ] + αp1 e−λ2 T αp2 λ1 T + 1−e

with

E[BR ] , E[BC ]

(10)

(11)

where αp1 E[BR ] =(1 − α − β) 1 + 1 − e−λ2 T 1 − αp2 × (1 − α − β)(2 − γ) + β 1PR

−λ2 T

1 + αp2 λ1 Te

1 T e−λ2 T . − λ2 1 − e−λ2 T

(14)

(15)

The goal of the adversary is to optimize an objective function, p1 ,p2 ,T such as the revenue ratio ρA with respect to p1 , p2 , T . Here, an objective function such as ρpA1 ,p2 ,T is not concave or convex in general. In Appendix A, we provide proofs for all the quantities stated here and in Appendix B, for the sake of completeness, we take T → ∞ in order to recover the quantities of PAW modeling of [9]. Similarly, we derive the PAW modeling of [8] using the simpliﬁed c parameter in Appendix C. For the remainder of the paper, we simply assume that the pool manager is rational, i.e., 1PR = 1. In fact, if the pool manager is not rational, the improvements of T-PAW over PAW are even more stronger than what is presented in the rest of the paper. Remark 2 It is trivial to show that the speciﬁc values of λ1 and T do not matter since expectations of the quantities BA , BP , BR , BC , BO depend on the product λ1 T . Intuitively, this observation makes sense since the optimal withholding time T should scale with the block production rate. Note that at t0 , 0 λ1 = D τ0 and the DAA changes the difﬁculty later at t1 which in 0 p1 ,p2 ,T turn results in λ1 = D (and λ2 scaled similarly). But τ0 δ we do not care about the change as we simply scale T whenever λ1 is scaled to keep λ1 T at the same level which in turn allows us to avoid re-solving the same problem of ﬁnding optimal T . V. N UMERICAL R ESULTS

For the honest miners outside the pool, the revenue ratio is 1 ,p2 ,T ρrest = ρprest =

(13)

where

Te =

where

E[BO ] , E[BC ]

We let † denote the PAW strategy (p†1 , p†2 ), and ‡ denote the T-PAW strategy (p‡1 , p‡2 , T ‡ ) under the adversarial revenue ratio maximization, whereas H denotes that the adversary uses the honest strategy (T = 0). Similar to [9], we also consider the maximization of ∆⋆,H A (t1 ) where the adversary adopts the T-PAW strategy ⋆ with p⋆1 , p⋆2 , T ⋆ that maximizes the revenue change at the end of the ﬁrst epoch (similarly PAW strategy ∗ denotes the maximization of revenue change at t1 in PAW). For a given set of α, β, γ values, if ∃(p1 , p2 , T ) s.t. ∆⋆,H A (t1 ) > 0, this implies that the honest strategy is suboptimal compared to T-PAW.

(12)

and 1PR = 1 − 1PR . Note that, ρrest ≥ 1 − α − β independent of the values p1 , p2 , T since E[BR ] ≥ (1 − α − β)E[BC ] as we have 0 ≤ γ ≤ 1. It is also trivial to verify that ρA + ρpool + ρrest = 1. Let BO denote the total number of blocks found in an attack

Remark 3 Since objective functions are not convex in general, we use optimization tools on MATLAB to ﬁrst ﬁnd local maximums of the objective function for a given set of α, β, γ values and take the maximum across local maxima obtained by fmincon starting from at least 100 different initial values of p1 , p2 , T .

0.12

0.5

0.06

0.36

0.42

0.48

0.06

0.12

0.18

0.24

α †,H (a) (PAW) RERA

0.36

0.42

0.18

1.5

0.12 0.06

2.5

0.3

0.24

0.18

1.5

0.12

0.5

0.06

0.18

0.24

0.3

0.36

0.42

0.06

0.48

0.12

0.18

0.24

0.3

0.36

0.42

0.18 0.12

0.12

0.5

0.06

0.36

0.42

0.12

0.18

0.24

(e) (PAW) ∆†,H A

0.18

0.48 0.42

0.24

0.18

0.5

0.06

0.42

0.5

0.48

0.06

0.12

0.18

0.24

0.3

0.36

0.42

0.3

0.36

0.42

0.48

α ‡,H (d) (T-PAW) RERrest 2.5

0.48

0.3

1.5

0.24 1

1.5

0.24 1

0.18

0.12

No Proﬁt Lag

0.5

0.48

0.06

0.12

0.18

0.24

0.3

0.36

0.42

0.06

0.48

0.12

0.18

0.24

(e) (PAW) ∆†,H A

0.48

1.9

0.36

Red: λT ‡ < 1, p‡2 = 1

1.8

0.42

1.7

0.36

0.3

1.6

0.24

1.5 1.4

0.18

0.36

0.42

0.48

(f) (T-PAW) ∆‡,H A

Light Blue: λT ‡ ≈ ∞, 0 < p‡2 < 1

0.42

0.3

0.24

0.5

0.06

No Proﬁt Lag

Dark Blue: λT ‡ ≈ ∞, p‡2 ≈ 0

0.36

0.24

Ratio of Extra Reward

0.12

0.36

Light Blue: λT ‡ ≈ ∞, 0 < p‡2 < 1

0.42

0.3

0.36

0.48

0.36

1.5

0.42

(f) (T-PAW) ∆‡,H A

10+

0.36

0.12

2.5

0.18

0.06

0.24

2.5+

0.48

0.3

3.5

0.5

0.48

0.3

0.42

No Proﬁt Lag

0.3

0.42

0.36

†,H (c) (PAW) RERrest

0.06

0.24

0.36

0.06

0.48

2.5

1.5

0.3

0.42

2.5

0.5

0.06

0.24

0.48

3.5

0.18

0.12

0.18

‡,H (b) (T-PAW) RERA

0.24

0.18

0.12

0.24

Profit Lag (τ0)

0.3

0.06

0.3

0.36

0.3

0.5

0.48

0.36

0.42

0.36

0.42

1.5

0.36

0.42

0.48

0.42

0.24

0.3

0.48

‡,H (d) (T-PAW) RERrest 2.5

0.18

0.24

†,H (c) (PAW) RERrest

0.12

0.18

0.48

0.06

0.12

†,H (a) (PAW) RERA

0.36

Relative Extra Reward (/%)

2.5

0.3

0.12

0.06

3.5

0.42

0.36

0.06

0.48

3.5

0.5

0.48

‡,H (b) (T-PAW) RERA

0.42

0.3

0.48

0.06

0.3

0.12

0.24

1.5

Dark Blue: λT ‡ ≈ ∞, p‡2 ≈ 0 Red: λT ‡ < 1, p‡2 = 1

0.3

0.18

0.5

0.12

Relative Extra Reward (/%)

0.06

Relative Extra Reward (/%)

0.18

Relative Extra Reward (/%)

0.06

1.5

0.12

0.18

Relative Extra Reward (/%)

1.5

Profit Lag (τ0)

0.18

2.5

0.24

Profit Lag (τ )

1.5

Ratio of Extra Reward

0.18

0.24

0.3

0.36

Relative Extra Reward (/%)

0.24

2.5

0.3

2.5

0.3

0.24

Relative Extra Reward (/%)

2.5

0.3

3.5

0.42

0.36

0.48

3.5

0.42

0.36

0.48

3.5

0.42

0.36

0.48

3.5

0.42

Relative Extra Reward (/%)

0.48

0.24 0.18

1.3

0.12 0.06

0.12

0.06

1.2 1.1

0.06

0.12

0.18

0.24

0.3

0.36

0.42

0.48

(g)

‡,H RERA †,H RERA

0.12 0.06

0.06

0.12

0.18

0.24

0.3

0.36

0.42

0.48

0.06

0.12

0.18

(h) (T-PAW) Optimized Values

Fig. 2: Revenue ratio (ρA ) maximization, γ = 0.

A. Numerical Maximization of ρA We pick γ = {0, 0.5} and present the RERs for the adversary and the honest non-pool miners for all values of α + β < 0.5 (with ǫ = 0.003 increments in α and β ) for both PAW and TPAW in Fig. 2 and Fig. 3 under the adversarial revenue ratio maximization. Comparing Fig. 2a with Fig. 2b (similarly Fig. 3a vs Fig. 3b), we clearly see the improvement of T-PAW over PAW. Notice, the RER of non-pool miners drop signiﬁcantly from PAW (Fig. 2c) to T-PAW (Fig. 2d) when γ = 0, which veriﬁes our intuition that withholding too long in PAW risks the adversarial fPoW contributions (especially when γ is small) as the fork race results more likely in the favor of non-pool miners. To directly compare the adversarial improvements of T-PAW over PAW, ratio of RERs are shown in Fig. 2g and Fig. 3g. Note that T-PAW improvements are especially strong when α, β, γ values are low as we proposed in Section III-B. In fact, even

0.24

0.3

0.36

(g)

‡,H RERA †,H RERA

0.42

0.48

0.06

0.12

0.18

0.24

0.3

0.36

0.42

0.48

(h) (T-PAW) Optimized Values

Fig. 3: Revenue ratio (ρA ) maximization, γ = 0.5.

though we only display the ratio values up to 10 in Fig. 2g (up to 2 in Fig. 3g), the extra reward of T-PAW grows further as α and β values drop (e.g., when γ = 0, the relative extra reward of T-PAW is 15 times the relative extra reward of PAW when an adversary of size α = 0.06 attacks a pool of size β = 0.06). In our analysis, we proved ρrest ≥ 1 − α − β , i.e., non-pool miners beneﬁt from the T-PAW attack. [9] shows that non-pool miners beneﬁt from the PAW attack even more than the adversary that mounts the attack when γ is low as seen when one compares Fig. 2a with Fig. 2c. On the other hand, with our improvements, in T-PAW, non-pool miners beneﬁt less than the adversary that mounts the attack even when γ = 0 as seen when one compares Fig. 2b with Fig. 2d. Moreover, Fig. 2e vs Fig. 2f (and Fig. 3e vs Fig. 3f) also display the adversarial proﬁt lags in terms of τ0 for PAW vs T-PAW strategies, which hints that maximizing the adversarial revenue ratio in T-PAW results in no proﬁt lag for a wide range of parameters. In other words, maximizing ρA

10 0

0.48

-2

0.24

-4

0.18 10 -6

0.12

0.06

0.36

-2

0.24

-4

0.18 10 -6

0.12 0.06

0.06

0.3

Relative Revenue Change (/%)

0.42

0.36

10 0

0.48

0.42

Relative Revenue Change (/%)

0.12

0.18

0.24

0.3

0.36

0.42

0.48

0.06

0.12

0.18

0.24

0.3

0.36

0.42

0.48

(a) PAW, no proﬁt lag below magenta, but less than 0.01% gain

(b) T-PAW, always no proﬁt lag, more than 1% gain inside red

Fig. 5: Revenue change maximization at t1 , γ = 0.

maximized relative values in Fig. 5 for γ = 0. Magenta line in Fig. 5a is the boundary below which the maximization results in a (albeit small) positive revenue change, i.e., no proﬁt lag, whereas above the boundary no p1 , p2 values result in a positive revenue change before the difﬁculty adjustment. On the other hand, with T-PAW even when γ = 0, the adversary always ﬁnds p⋆1 , p⋆2 , T ⋆ values that result in positive revenue change before the difﬁculty adjustment and the gain is nontrivial, i.e., more than 0.1%. Further, inside the red marked region in Fig. 5b, the gain is above 1%.

0 0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

Fig. 4: RER for PAW and T-PAW for 5 cases.

with the T-PAW strategy is superior to honest strategy for those parameters even when there is no DAA. The RERs and proﬁt lag curves suggest that for high β values the optimal values of PAW and T-PAW overlap. In fact, when we investigate the optimal p†1 , p†2 values obtained from PAW and p‡1 , p‡2 , T ‡ from T-PAW, we notice that there is a diagonal boundary line as shown in Fig. 2h and Fig. 3h above which λ1 T ‡ ≈ ∞ and p†1 = p‡1 , p†2 = p‡2 . In other words, in these (nonred) regions, optimal T-PAW reduces to PAW. On the other hand, below the boundary (red region), we observe that λ1 T ‡ < 1 and p‡2 = 1, i.e., the adversary decides for a temporary withholding and fully invests in increasing its shares for the fPoW since it knows that the fPoW will be shared soon. Further, the value of λ1 T ‡ inside the red region is monotonically increasing as β increases, which veriﬁes our initial intuition that the withholding saturates at some point (since, as pool size increases, the adversary needs more time until the fractional reward saturates). For the sake of completeness, in Fig. 4, for 5 cases of (α, β) values, we display RER of the adversary under PAW and TPAW maximization when γ is varying between [0, 1]. Notice, the green curves, where (α, β) are small and when γ is low, TPAW strategy brings more than 20-fold improvement in RER. In fact, as we drop (α, β) RER of PAW diminishes completely whereas T-PAW always brings extra revenues. We note that, ∀γ optimization results in p‡2 = 1 in all 5 cases, whereas p†2 = 1 only for high values of γ , i.e., when the risk of losing the fork race is low. On the other hand, λ1 T ‡ is monotonically increasing with γ , i.e., the adversary withholds more when the risk of losing the fork race is low and with γ → 1, T-PAW reduces to PAW. All these observations conﬁrm our initial intuition about potential improvements of temporary withholding instead of T → ∞. Another interesting observation in these 5 cases is that, when γ → 1, the ﬁnal maximized RER depends on α β. B. Revenue Change Maximization at t1 Next, we consider the maximization of the revenue change at ∗,H

⋆,H

t1 for PAW (∆A (t1 )) and T-PAW (∆A (t1 )) and display the

VI. D ISCUSSION A. Related Works and Future Directions Block withholding attacks have been initially investigated by Rosenfeld in [2], where the author speciﬁcally focuses on two versions, lie-in-wait and sabotage attacks. Sabotage attack is the case where the adversary withholds the fPoW to harm the pool revenues as in the case of the attack against Eligius mining pool [15]. Later Courtois and Bahack show that the adversary can not only harm the pool revenues but also increase its own share of revenues in the system [13] with this attack (now known as BWH). FAW [7] and PAW [8] attacks are sophistications of BWH as we explained earlier. On the other hand, lie-in-wait attack where the adversary temporarily withholds the fPoW and focuses on increasing its share (which can be seen as increasing p1 to p2 ) is dismissed by Courtois and Bahack as being not very realistic [13]. Contrary to the arguments of [13], our analysis and generalization enables to bring all these attacks (BWH, FAW, PAW and lie-in-wait) together within the same framework and show that there is a tremendous improvement in doing so. Note that, a related study [16] investigates an attack with a deadline on fPoW submission time which roughly corresponds to p1 = p2 case in T-PAW, i.e., no power adjusting, which makes it suboptimal compared to T-PAW (even suboptimal to honest mining absent any DAA). There are various countermeasures against PAW attacks as mentioned in [8], [17], [18], which are either not or less effective against T-PAW. For example, the time-stamp ﬁeld proposal of [8] is less effective against T-PAW since the adversary can increase its shares even within limited T -time. On the other hand, silent timestamping of [18] can be completely circumvented as the adversary knows how long it is going to withhold and can pick the increase in nonce steps (e.g., the adversary tries xi = NT xi−1 in each nonce trial before withholding phase but xi = xi−1 + 1 during the withholding) or uses sybil identities. Anti-withholding reward

system [17] proposes to increase rewards for fPoW compared to pPoW which is effective against BWH, FAW and PAW when γ is low but not against T-PAW since the adversary eventually releases fPoW before anyone else does in most cases. A more detailed analysis against the countermeasures is left to future works. Various follow-up works on FAW/PAW delve deeper into the subject for improvements or more sophisticated analysis. For example, [19] combines the attack with eclipse attacks for improvements, [8], [20], [21] suggest combining it with bribery, whereas [22] shows that the attacks give even more revenues when one models the system with high propagation delays. Although distinct from our primary focus, these works address related aspects of the problem and could be jointly considered to extend the scope and applicability of our work. Eyal [23] investigates BWH between competing pools to show that pools face a dilemma similar to that of prisoner’s dilemma. Similarly both [7], [8] investigate the situation further and show that the improvements of FAW/PAW limits the parameter regimes where the dilemma holds and where the larger pool can avoid it. They also study the FAW/PAW attack against multiple pool cases. We believe that investigating the above phenomenon in our rigorous and exact modeling T-PAW is the most natural and promising future direction. A PPENDIX A D ERIVATIONS OF T-PAW Q UANTITIES In this section, whenever we refer to quantities such as rewards, we mean their expected values. We start by considering how an attack cycle ends from the start of an attack cycle: 1) with probability (w.p.) 1 − α − β , an honest miner outside the target pool creates a block. 2) w.p. α(1 − p1 ), individual adversarial mining power creates a block (the adversary gets 1 full block reward). 3) w.p. β , a target pool member creates a block (the adversary gets r1 fraction of the reward). 4) w.p. αp1 , the adversary ﬁnds a fPoW from pool mining and withholds it. During the withholding phase, where the adversary allocates p2 fraction of its power to pool mining, a) w.p. e−λ2 T , either no block is created, or all blocks created are created by adversarial pool mining and withheld, which can be ignored. The adversary releases the withheld fPoW after T time (it gets rs fraction of the block reward). b) w.p. 1 − e−λ2 T , at least one block is created by an entity other than the adversarial pool mining. Under this condition, ignoring the blocks created by adversarial pool mining, the ﬁrst block was created, 2) i) w.p. α(1−p 1−αp2 , by the individual mining power of the adversary (the adversary gets 1 block reward). β ii) w.p. 1−αp , a target pool member (the adversary gets 2 ru fraction of the block reward). iii) w.p. 1−α−β 1−αp2 , by an honest miner outside the target pool. The adversary releases the withheld fPoW and a fork race starts. During the fork race phase, A) w.p. α, the adversary mines a new block on top of the recently released fPoW (the adversary gets 1 block reward and ru fraction of the fPoW reward). B) w.p. β , target pool mines a new block on top of the recently released fPoW (no adversarial

contribution for this new block but the adversary gets ru fraction of the recently released fPoW).4 C) w.p. 1 − α − β , honest miners outside the pool mine a new block (w.p. γ , this new block is mined on top of the recently released fPoW and the adversary gets ru fraction of the fPoW reward). The above cases fully cover an attack cycle and each cycle is independent. Thus, summing the product of the probabilities and the corresponding rewards of each entity, it is trivial to verify the quantities E[BA ] in (6), E[BP ] in (10), E[BR ] in (12) and E[BC ] in (5). Next, we derive the quantities r1 , rs and ru . At the start of an attack cycle, let λ(1,0) = αp1 λ1 , λ(1,2) = α(1 − p1 )λ1 , λ(1,3) = βλ1 , λ(1,4) = (1 − α − β)λ1 denote the block arrival rates for the adversarial pool mining, adversarial individual mining, honest-pool mining and the honestoutside-pool mining and let T(1,1) , T(1,2) , T(1,3) , T(1,4) be the arrival time of the ﬁrst block of the respective type with T1 = min(T(1,1) , T(1,2) , T(1,3) , T(1,4) ) ∼ Exp(λ1 ). If the target pool miners are the ﬁrst to ﬁnd a block in an attack cycle, the fraction of the reward the adversary gets from the fPoW is trivial: αp1 T(1,3) r1 = E T(1,3) = T1 = a′1 . (16) a1 T(1,3)

On the other hand, with probability P(T1 = T(1,1) ) = αp1 ,

(17)

the attack cycle enters a withholding phase. During the withholding phase (assume the withholding phase starts at time zero for the sake of simplicity), let λ(2,1) = αp2 λ1 , λ(2,2) = α(1 − p2 )λ1 , λ(2,3) = βλ1 and λ(2,4) = (1 − α − β)λ1 denote the block arrival rates for the adversarial pool mining, adversarial individual mining, honest-pool mining and the honest-outside-pool mining, respectively. Similarly, let T(2,1) , T(2,2) , T(2,3) , T(2,4) be the arrival time of the ﬁrst block of the respective type starting from the withholding phase and T2 = min(T(2,2) , T(2,3) , T(2,4) ). It is clear that T(1,·) are independent of T(2,·) and T2 ∼ Exp(λ2 ), i.e., P(T2 > T ) = e−(1−αp2 )λ1 T = e−λ2 T .

(18)

After withholding the fPoW for a time T where no block was created, or all blocks that were created were created by adversarial pool mining, the adversary releases the fPoW. Since the adversary contributes with αp1 power to pool mining from the start of an attack cycle until the start of the withholding phase (lasts T(1,1) time), and contributes with αp2 power to pool mining in the withholding phase (lasts T time), the fraction of the reward the adversary gets from the fPoW in Case 4a is αp1 T(1,1) + αp2 T rs = E T(1,1) = T1 , T < T2 (19) a1 T(1,1) + a2 T αp1 T1 + αp2 T =E (20) a 1 T1 + a 2 T a2 T a 1 T1 + a′2 E (21) = a′1 E a 1 T1 + a 2 T a 1 T1 + a 2 T a2 T . (22) = a′1 + (a′2 − a′1 )E a 1 T1 + a 2 T

4 Here, we assume a rational pool manager. If not, the pool and the honest miners outside the pool get 1 block reward each (no adversarial reward).

Note that T ′ = a2 T is a deterministic scalar, Q1 = a1 T1 ∼ Exp(λ′1 ) and T′ a2 T (23) =E E a 1 T1 + a 2 T Q1 + T ′ Z ∞ T′ ′ −λ′1 x dx (24) = ′ λ1 e x+T 0 ′ ′ λ′1 T ′ = λ1 T e E1 (λ′1 T ′ ).

to the other fPoWs created by the adversarial pool mining that are discarded in the withholding phase. Note that the discarding happens for T2′ duration time, i.e., until the arrival time of the ﬁrst block during the withholding phase. Hence, w.p. 1 − e−λ2 T , N4b additional fPoWs do not become a canonical blocks in this case where N4b ∼ Poi(λ(2,1) T2′ ). Thus,

(25)

E[BO ] =E[BC ] + αp1 e−λ2 T E[N4a ]

On the other hand, during the withholding phase, with probability P(T2 < T ) = 1 − e−λ2 T

at least one block is created by an entity other than the adversarial pool mining. Let T2′ ∼ (T2 |T2 < T ), in other words, T2′ ∼ Exp(λ2 ) truncated to [0, T ]. As a result, in the subcases of Case 4b, the fraction of the reward the adversary (if it ever) gets from the fPoW is αp1 T(1,1) + αp2 T2 ru = E T(1,1) = T1 , T2 < T (27) a1 T(1,1) + a2 T2 αp1 T1 + αp2 T2′ =E (28) a1 T1 + a2 T2′ a2 T2′ a 1 T1 ′ + a E (29) = a′1 E 2 a1 T1 + a2 T2′ a1 T1 + a2 T2′ a2 T2′ (30) = a′1 + (a′2 − a′1 )E ′ . a 1 T1 + a 2 T2

∼ Exp(λ′1 ) and Q2 = a2 T2′ ′ Exp(λ2 ) truncated to [0, T ′ ], i.e., the density of Q2 is

Let Q1

a 1 T1

−λ′2 y

λ′2 e fQ2 (y) = ′ ′ , 1 − e−λ2 T

Then, E

a2 T2′ a1 T1 + a2 T2′

Q2 =E Q1 + Q2

′

0≤y≤T .

λ1 λ2 ′ ′ 1 − e−λ2 T

′

T e−λ2 T 1 . − λ2 1 − e−λ2 T

(37)

A PPENDIX B R EDUCTION TO PAW W HEN T → ∞ Notice, when T → ∞, Case 4a never happens. Thus, we are only interested in subcases of Case 4b where T → ∞ which implies T2′ − → T2 ∼ Exp(λ2 ). Let us denote the average fraction of the reward the adversary gets from the fPoW as r∞ , i.e., lim ru = r∞ ,

(38)

T →∞

which we will derive later explicitly. Note, p1 ,p2 ,T ρpA1 ,p2 = lim ρA

(39)

T →∞

limT →∞ E[BA ] limT →∞ E[BC ] E[limT →∞ BA ] , = E[limT →∞ BC ]

(31)

(33) (34)

(40) (41)

where (40) follows from the law of large numbers and (41) follows from the dominated convergence theorem since |BA | < |BC | ≤ 2. Hence, α(1 − p ) β 2 + r∞ E[ lim BA ] = α(1 − p1 ) + βr1 + αp1 1 − αp2 1 − αp2 T →∞ 1−α−β + r∞ (γ(1 − α − β) + α + β 1PR ) + α , (42) 1 − αp2

′

(35)

Finally, we derive the expected quantity of the orphan blocks in an attack cycle, BO − BC , i.e., blocks that are mined in an attack cycle but do not become a canonical block. Let Te = E[T2′ ], i.e., Te = E[T2′ ] =

1 + E[N4b ]

t e(λ1 −λ2 )t E1 (λ′1 t)dt.

which completes the proof since E[N4a ] = αp2 λ1 T and E[N4b ] = αp2 λ1 Te .

∼

(32)

t Q2 = t =E E Q1 + t i h ′ ′ = E λ1 Q2 eλ1 Q2 E1 (λ′1 Q2 ) Z T′ ′ ′

+ 1−e

(26)

−λ2 T

(36)

Note that block withholding only happens in subcases of Case 4 (w.p. αp1 ), which in turn results in orphan blocks. In Case 4a, the adversary will release one fPoW which becomes a canonical block however the other fPoWs created by the adversarial pool mining will be discarded. Hence, w.p. e−λ2 T , N4a blocks do not become a canonical blocks in this case, where N4a ∼ Poi(λ(2,1) T ). On the other hand, in Case 4b, a fPoW mined by the adversary is forked by another entity’s block (or by adversarial individual mining), hence, at least one block becomes orphan in addition

E[ lim BC ] = 1 + αp1 T →∞

1−α−β . 1 − αp2

(43)

Similar arguments hold for other quantities with β E[ lim BP ] = β(1 − r1 ) + αp1 (1 − r∞ )+

1 − αp2 T →∞ 1−α−β (1 − r∞ )(γ(1 − α − β) + α + β 1PR ) + β , (44) 1 − αp2 E[ lim BR ] = (1 − α − β) T →∞

αp1 (1 − α − β)(2 − γ) + β 1PR ) , × 1+ 1 − αp2 αp1 . E[ lim BO ] = E[ lim BC ] + 1 − αp2 T →∞ T →∞

(45) (46)

We recovered the quantities of PAW given in [9] by taking T → ∞ for the quantities given in Section III-A except that we have not given an explicit formula for r∞ , which is done next as r∞ = lim E T →∞

αp1 T(1,1) + αp2 T2 a1 T(1,1) + a2 T2

T(1,1) = T1 , T2 < T

(47)

αp1 T1 + αp2 T2 =E a 1 T1 + a 2 T2 = a′1 E

(48)

a 1 T1 a 2 T2 + a′2 E a 1 T1 + a 2 T2 a 1 T1 + a 2 T2

= a′1 + (a′2 − a′1 )E

a 2 T2 , a 1 T1 + a 2 T2

(49) (50)

where a1 T1 ∼ Exp(λ′1 ), a2 T2 ∼ Exp(λ′2 ) and we leave as an exercise to verify (using T ′ = ∞ in (35)), when λ′1 6= λ′2 , a 2 T2 λ′ λ′ E = ′ 1 ′ 2 λ′2 ln ′2 − λ′2 + λ′1 , (51) a 1 T1 + a 2 T2

(λ1 − λ2 )

λ1

and 1/2 by symmetry when λ′1 = λ′2 . Notice, with T → ∞, the authors of [8] and [9] make an approximation as follows αp1 T1 + αp2 T2 αp1 E[T1 ] + αp2 E[T2 ] E ≈ (52) a 1 T1 + a 2 T2 a1 E[T1 ] + a2 E[T2 ] αp1 /λ1 + αp2 /λ2 a1 /λ1 + a2 /λ2 αp = , β + αp

(53) (54)

2 −αp1 p2 where p = p1 +p when deriving r∞ which is only an 2−αp2 approximation and the error grows large especially if T 6= ∞.

A PPENDIX C S IMPLIFIED T-PAW A NALYSIS Assume each fork race ends in the favor of the adversary with probability c and each attack cycle is independent as in [8]. Then, for the adversarial revenue ratio, we get p1 ,p2 ,T −λ2 T −λ2 T ρA

=α(1 − p1 ) + βr1 + αp1 e ×

rs + 1 − e

β + c(1 − α − β) α(1 − p2 ) + ru 1 − αp2 1 − αp2

(55)

for the honest pool members revenue ratio, we get

ρpool =β(1 − r1 ) + αp1 e−λ2 T (1 − rs ) + 1 − e−λ2 T ×

(1 − ru )

β + c(1 − α − β) 1 − αp2

and for the rest of the honest miners, we get −λ2 T ρrest = (1 − α − β) 1 + 1 − e

αp1 (1 − c) 1 − αp2

(56)

. (57)

It is trivial to show that the results above reduce to those obtained in [8] when T → ∞ (with a more rigorous derivation of r∞ ). R EFERENCES [1] S. Nakamoto, “Bitcoin: A peer-to-peer electronic cash system,” https://bitcoin.org/bitcoin.pdf, March 2008. [2] M. Rosenfeld, “Analysis of bitcoin pooled mining reward systems,” 2011. [Online]. Available: https://arxiv.org/abs/1112.4980 [3] I. Eyal and E. G. Sirer, “Majority is not enough: Bitcoin mining is vulnerable,” Communications of the ACM, vol. 61, no. 7, p. 95–102, July 2018. [4] A. Sapirshtein, Y. Sompolinsky, and A. Zohar, “Optimal selﬁsh mining strategies in bitcoin,” in Springer FC, 2017. [5] K. Nayak, S. Kumar, A. Miller, and E. Shi, “Stubborn mining: Generalizing selﬁsh mining and combining with an eclipse attack,” in IEEE EuroS&P, March 2016.

[6] K. A. Negy, P. R. Rizun, and E. G. Sirer, “Selﬁsh mining re-examined,” in Springer FC, 2020, pp. 61–78. [7] Y. Kwon, D. Kim, Y. Son, E. Vasserman, and Y. Kim, “Be selﬁsh and avoid dilemmas: Fork after withholding (faw) attacks on bitcoin,” in ACM SIGSAC CCS, October 2017. [8] S. Gao, Z. Li, Z. Peng, and B. Xiao, “Power adjusting and bribery racing: Novel mining attacks in the bitcoin system,” in ACM SIGSAC CCS, November 2019. [9] M. Doger and S. Ulukus, “Incentive attacks in btc: Short-term revenue changes and long-term efﬁciencies,” 2025. [Online]. Available: https://arxiv.org/abs/2511.11538 [10] C. Grunspan and R. Pérez-Marco, “Proﬁt lag and alternate network mining,” in Springer MARBLE, 2023, pp. 115–132. [11] C. Grunspan and R. Pérez-Marco, “Block withholding resilience,” Digital Finance, vol. 7, no. 1, pp. 43–60, 2025. [12] ——, “On proﬁtability of selﬁsh mining,” 2019. [Online]. Available: https://arxiv.org/abs/1805.08281 [13] N. T. Courtois and L. Bahack, “On subversive miner strategies and block withholding attack in bitcoin digital currency,” 2014. [Online]. Available: https://arxiv.org/abs/1402.1718 [14] L. Luu, R. Saha, I. Parameshwaran, P. Saxena, and A. Hobor, “On power splitting games in distributed computation: The case of bitcoin pooled mining,” in IEEE CSF, July 2015. [15] wizkid057, “Block withholding attack against the eligius mining pool,” https://bitcointalk.org/index.php?topic=441465.msg7282674# msg7282674, 2014, bitcointalk forum post reporting an estimated 300 BTC loss due to a block withholding attack. [16] L. Liu, W. Chen, L. Zhang, J. Liu, and J. Qin, “A type of block withholding delay attack and the countermeasure based on type-2 fuzzy inference,” Mathematical Biosciences and Engineering, vol. 17, no. 1, pp. 309–327, 2020. [17] A. Sarker, S. Wuthier, and S.-Y. Chang, “Anti-withholding reward system to secure blockchain mining pools,” in IEEE CVCBT, 2019, pp. 43–46. [18] S.-Y. Chang and Y. Park, “Silent timestamping for blockchain mining pool security,” in ICNC, Feb 2019, pp. 1–5. [19] J. Wang and Z. Wang, “Efaw: a new mining attack model combining faw attacks with the eclipse attack,” Journal of Surveillance, Security and Safety, vol. 4, no. 4, pp. 180–195, 2023. [20] Z. Yang, C. Yin, J. Ke, T. T. A. Dinh, and J. Zhou, “If you can’t beat them, pay them: Bitcoin protection racket is proﬁtable,” in ACM ACSAC, December 2022, p. 727–741. [21] J. Hu and N. Ruan, “Bm-paw: A proﬁtable mining attack in the powbased blockchain system,” in Blockchain and Trustworthy Systems, 2026, pp. 3–17. [22] H. Zhu, X. Chang, J. Mišić, V. B. Mišić, and R. Yang, “Revisiting faw attack in an imperfect pow blockchain system,” Peer-to-Peer Networking and Applications, vol. 15, no. 5, pp. 2430–2443, Sep 2022. [23] I. Eyal, “The miner’s dilemma,” in IEEE S&P, May 2015.

Record · ID 13965 · SHA-256 55edfc056e4b4b67
Conceptio Open Knowledge Archive — every document is proof-bundled with source, license, and retrieval metadata.