arXiv:2606.06860v1 [cs.CR] 5 Jun 2026
On the Incentive Compatibility of Block Propagation in Bitcoin Fumichika Maeda*
Akira Sakurai*
Taishi Nakai
Kazuyuki Shudo
Kyoto University Kyoto, Japan [email protected]
Kyoto University Kyoto, Japan [email protected]
Kyoto University Kyoto, Japan [email protected]
Kyoto University Kyoto, Japan [email protected]
Abstract—Bitcoin is permissionless and does not rely on any central administrator, which gives it strong censorship resistance. At the same time, it is important to incentivize miners to behave in ways that align with the interests of the system as a whole. This paper asks whether miners are individually incentivized to propagate blocks, one of the most fundamental processes in Bitcoin. Miners collectively maintain the blockchain by generating blocks and disseminating them across the network. If miners have an incentive not to propagate some blocks, this would indicate a fundamental flaw in Bitcoin’s incentive design. Although prior work has studied how propagation delays affect forks and mining rewards, it has not fully characterized miners’ incentives to improve block propagation under different tiebreaking rules. To address this gap, we derive analytical reward expressions for each tie-breaking rule based on a blockchain network model that captures the effect of forks on mining fairness. These expressions explicitly characterize how block propagation delays, hashrate distribution, and tie-breaking rules jointly determine mining rewards. We then use them to analyze miners’ incentives to improve block propagation. Our results show, for example, that miners have no mining-reward incentive to relay blocks generated by other miners. By contrast, under the first-seen rule, every non-majority miner is incentivized to receive other miners’ blocks more quickly and to propagate its own blocks more quickly. Finally, we compare tie-breaking rules and identify a trade-off between propagation incentives and mining fairness. In particular, the first-seen rule provides the strongest incentives to reduce propagation delays, but it also worsens mining fairness the most. Index Terms—Bitcoin, incentive design, block propagation, mining fairness, tie-breaking rules
I. I NTRODUCTION Bitcoin [1] is a peer-to-peer monetary system that enables transaction processing without relying on a trusted third party. Its central feature is that anyone can participate in the system, and no specific administrator controls which participants may join or which transactions should be accepted. This permissionlessness and the absence of a trusted authority are the basis of Bitcoin’s censorship resistance. At the same time, these properties make incentive design essential. Because Bitcoin lacks a central administrator and participation is open, the system cannot assume that participants share common objectives or act altruistically for the benefit of the network. Instead, the behavior of participants must be regulated through incentives. In other words, the * The first two authors contributed equally to this work.
protocol must be designed so that actions desirable for the system are also rational for each individual participant. In this paper, we focus on the incentive compatibility of block propagation. Block propagation is one of the most fundamental processes in Bitcoin. When a miner generates a new block, the block must be disseminated through the network so that other miners can build on it. Efficient propagation benefits the system by reducing unintended forks, thereby contributing to security, consistency, and mining fairness [2]– [6]. Conversely, propagation delays increase the fork rate and can therefore undermine these properties. Existing studies on block-propagation incentives rely on simplified models and therefore provide only limited insights [7], [8]. To overcome this problem, we build on the blockchain network model proposed by Sakurai et al. [9]. This model captures the effect of block propagation delay on mining rewards under different tie-breaking rules. However, the model is difficult to use directly for incentive analysis. In particular, the relationships among hashrate distribution, propagation delay, and mining rewards are not analytically transparent. As a result, it is hard to identify from the model alone when a miner benefits from improving or worsening a specific propagation delay. To address this limitation, we derive theoretical reward expressions from the model. These expressions explicitly describe how each miner’s expected reward depends on hashrate distribution, block propagation delays, and tiebreaking rules. We then use the resulting formulas to analyze block-propagation incentives. Our analysis characterizes the conditions under which such incentives arise. Finally, we compare tie-breaking rules from the perspective of blockpropagation incentives. Contributions: • We derive analytical reward expressions that explicitly capture how block propagation delays, hashrate distribution, and tie-breaking rules affect mining rewards. We validate these expressions through simulation-based experiments. The resulting expressions provide a unified analytical framework for studying how network-level factors affect mining rewards. • We analyze block-propagation incentives by classifying delays into relay, outbound, and inbound delays. We show that miners have no mining-reward incentive to
reduce relay delays for blocks generated by other miners. We also derive necessary and sufficient conditions under which miners are incentivized to reduce outbound and inbound delays under each tie-breaking rule. Finally, we formulate feasible delay-manipulation strategies in Bitcoin and analyze their system-level effects. • We compare representative tie-breaking rules from the perspective of block-propagation incentives. The firstseen rule provides the strongest incentives to reduce propagation delays among the analyzed rules. However, stronger propagation incentives can conflict with mining fairness. This reveals a trade-off between propagation incentives and reward fairness in the design of tie-breaking rules.
gation delays and do not consider intentional forks caused by adversarial mining strategies. When multiple competing chains have the same cumulative proof of work, miners need a tie-breaking rule to decide which chain to mine on. In Bitcoin, miners typically mine on the chain containing the competing block they received first. We refer to this policy as the first-seen rule. This rule is simple and requires no additional coordination among miners. However, from the perspective of selfish mining, it has a drawback: the security of the system can become sensitive to the adversary’s block propagation capability [10]. To address this issue, alternative tie-breaking rules have been proposed, such as the random rule [10], which selects a competing chain at random, and the last-generated rule [11]–[13], which selects the chain containing the most recently generated block.
II. B ITCOIN III. R ELATED W ORK In Bitcoin [1], users initiate transactions by broadcasting them over the peer-to-peer network. These transactions are collected into blocks by nodes called miners. Each block references a single parent block, and this referencing structure forms a chain of blocks, called the blockchain. Each miner maintains its own local view of the block tree and selects, as its main chain, the chain with the greatest cumulative proof of work. This rule is often referred to as the longest-chain rule. To generate a block, a miner constructs a block template containing information such as the processed transactions, a timestamp, and the hash of the latest block on its main chain. The miner then repeatedly computes hashes by changing the nonce and other modifiable fields until the hash of the block header falls below a specified target. This process is called mining. A block satisfying this condition is considered valid and is propagated through the network. After verifying the validity of the block, each miner updates its own local view of the blockchain. Only blocks included in the main chain contribute to the accepted transaction history, and the miner who generated such a block receives a block reward. This reward consists of a block subsidy and transaction fees. An adversary can invalidate a processed transaction by constructing a competing chain that excludes the block containing the target transaction. Specifically, the adversary attempts to create a fork and make its competing chain overtake the chain that includes the target transaction. The success probability of such an attack depends on the adversary’s hashrate share and the number of confirmations. As long as the adversary controls less than a majority of the total hashrate, the probability of catching up decreases as confirmations accumulate. In this probabilistic sense, Bitcoin makes transaction reversal increasingly difficult. Even when all miners follow the Bitcoin protocol honestly, forks can still occur during block propagation. A fork occurs when a new block is generated before a previously generated block has fully propagated through the network. The likelihood of such a fork increases with block propagation delay [5]. In this paper, we focus on unintentional forks caused by propa-
The line of work most closely related to our study examines the relationship between propagation delays, forks, and mining rewards. Decker et al. showed that block propagation delays affect mining rewards through unintentional blockchain forks [5]. Mao et al. showed that, in some settings, reducing a miner’s connectivity can increase its block reward [7]. However, their model abstracts away several features of realistic blockchain networks. For example, their analysis treats the block generation interval as a deterministic fixed value. Lu et al. analyzed conditions under which larger delays can increase a miner’s block reward [8]. However, their results are limited in scope, because their model considers only a uniform outbound delay for the miner’s own blocks. Our work extends this line of block-propagation incentive analysis in several directions. First, we use a more detailed blockchain network model, distinguish among relay, inbound, and outbound delays, and analyze their incentives. Second, we compare how different tie-breaking rules affect block propagation incentives. Our work primarily studies incentive compatibility in block propagation. At the same time, incentive compatibility in Bitcoin has also been studied from other perspectives, especially in the context of strategic mining. Prior work has shown that deviations from honest mining, such as selfish mining and block withholding, can be profitable [2], [10], [14]–[18]. By contrast, Kiayias et al. showed that honest mining is rational under certain decentralization conditions [19]. Unlike these studies, which mainly analyze miners’ incentives in block publication or withholding strategies, we focus on whether miners have incentives to improve or manipulate the propagation process itself. IV. M ODEL We describe the Bitcoin network model used in this paper. We first consider the baseline setting in which all miners honestly follow the Bitcoin protocol. Let V denote the set of miners. Each miner i ∈ V has a hashrate share αi , satisfying P i∈V αi = 1. Let T denote the expected block generation interval. We assume that these values remain fixed throughout
the analysis. We also assume that the block reward is constant across all blocks. We analyze mining fairness using the mining profit rate (MPR). The mining profit rate of miner i is defined as MPR(i) =
ri − αi , αi
(1)
where ri denotes the block reward proportion of miner i. To capture the effect of forks on the mining profit rate, we use the notion of a round, following Sakurai et al. [9]. A round is a global time interval defined as the period from the generation of the first block at height h to the generation of the first block at height h + 1. We assume that at most two blocks are generated in a single round. This round-based model enables us to handle forks formally and capture their impact on the mining profit rate. A fork is defined as the event in which two blocks are generated within a single round. Let Fij denote the probability that a fork occurs when miner i initiates a round and miner j is the next block generator. Then Fij is given by Fij = 1 − exp(−Tij /T ), where Tij is the time from the generation of a block by miner i to its reception and validation by miner j. Let Wij denote the probability that, in such a fork, the block generated by miner i is included in the main chain. The value of Wij depends on the adopted tie-breaking rule and is given by X αk pi,j,k (first-seen rule), k∈V 1 − α i − αj (2) Wij = (random rule), αi + 2 αi (last-generated rule).
A. Assumptions We make two additional assumptions. First, block propagation delays are sufficiently small compared with the block generation interval. Second, block propagation delays satisfy a propagation-based triangle inequality. Cond. A: First-order approximation in the small-delay regime: We assume that the block propagation delay between any pair of miners is sufficiently small compared with the block generation interval. Specifically, εij :=
Tij ≪1 T
for all i, j ∈ V.
(4)
We then apply a first-order approximation with respect to the small parameters εij . That is, we neglect all second- and higher-order terms, including products such as εij εkl . Cond. B: A propagation-based triangle inequality: For any miners i, j, k ∈ V , we assume that Tik ≤ Tij + Tjk .
(5)
This assumption is used only in the theoretical analysis of the first-seen rule. This condition can be interpreted as follows. Suppose miner i generates a block and miner j obtains it before miner k does, i.e., Tij ≤ Tik . Then Tik − Tij represents the remaining time until miner k finishes validating the same block after miner j has already done so. Cond. B states that this remaining time is at most Tjk , the time required for a block generated by miner j to reach miner k. This is natural because, once miner j has validated miner i’s block, the block may already be known by multiple miners and can continue propagating toward miner k from several sources. By contrast, when miner j generates a new block, only miner j knows it initially. Therefore, the Here, pi,j,k denotes the probability that miner k receives miner former time is typically no larger than the latter. i’s block before miner j’s block when miner i starts the round An exception may arise under adversarial network condiand miner j causes a fork. It is given by tions, especially eclipse-style attacks. In a classical eclipse attack, an adversary monopolizes a victim’s incoming and 1 if Tik < Tjk , outgoing connections and can thereby filter or delay the vic if T > T + T , 0 ik ij jk tim’s view of the blockchain [20]. More recent work has also pi,j,k = exp − Tik −Tjk − exp − Tij shown that block propagation to a victim can be significantly T T delayed through eclipse-based manipulation of the victim’s otherwise. T neighbors [21]. In such situations, miner k may first receive 1 − exp − Tij (3) a block advertisement through adversarially controlled neighbors, while the corresponding block delivery is intentionally delayed. Then, even after miner j has already validated miner V. A NALYTICAL E XPRESSIONS FOR M INING FAIRNESS i’s block, miner k may still experience a remaining delay larger In this section, we derive the relationship between MPR than Tjk , and hence Cond. B can fail. For this reason, Cond. B and network parameters such as block propagation delays should be understood as a benign-network assumption used for and hashrate distributions based on the model described in tractable analysis, rather than as a property expected to hold Section IV. We first present the assumptions used in the under active network-layer attacks. analysis. We then define aggregate delay quantities that capture how quickly each miner can propagate and receive blocks, and B. Analytical Expressions we summarize the analytical results. Detailed derivations are provided in the appendix. Finally, we validate the analytical We now present the analytical expressions used for the expressions through simulation experiments. mining-fairness analysis. First, we define the following ag-
gregate inbound and outbound delay quantities: X (m) fin (i) := (αj )m Tji ,
(6)
j∈V (m)
fout (i) :=
X
(αj )m Tij ,
(7)
j∈V
f¯ :=
X
(1)
αi fin (i) =
i∈V
X
(1)
X
αi fout (i) =
i∈V
αi αj Tij .
i∈V, j∈V
(8) Under Cond. A and Cond. B, the analytical expressions for MPR(i) under the first-seen, random, and last-generated rules are as follows: 1 ¯ (1) (1) 2f − fin (i) − fout (i) , (FS) MPR(i) = T 1 ¯ 1 − αi (1) (1) MPR(i) = f− fin (i) + fout (i) T 2 1 (2) (2) − fin (i) + fout (i) , (RD) 2 1 ¯ (1) (2) f − (1 − αi )fout (i) − fin (i) . (LG) MPR(i) = T Here, (FS), (RD), and (LG) correspond to the first-seen, random, and last-generated rules, respectively. Detailed derivations are provided in the appendix for each tie-breaking rule. C. Simulation Validation The analytical expressions above hold under Cond. A and Cond. B. In this subsection, we assess their practical applicability by comparing them with model-based calculations using blockchain-network parameters obtained from simulations. 1) Validation Method: Our validation compares two quantities: MPRref , which is computed directly from the underlying model, and MPRapprox , which is obtained from the analytical expressions derived in this paper. To construct realistic validation settings, we used the blockchain-network simulator SimBlock [22] to obtain block propagation delays in simulated networks together with the corresponding hashrate distributions of miners. Using these values, we computed both MPRref and MPRapprox and compared them. As evaluation metrics, we used Lin’s concordance correlation coefficient (CCC) [23] and the relative error. CCC measures not only correlation but also agreement between the two quantities. The relative error measures the magnitude of the approximation error relative to MPRref and is defined as MPRapprox − MPRref δapprox =
2
MPRref
.
(9)
2
We do not directly estimate MPR from SimBlock by counting mining rewards over long simulation runs, because such a validation becomes computationally impractical at the network scale considered in this paper. Sakurai et al. [9] validated their model using a relatively small network of only 10 nodes, precisely because larger networks make such direct validation unrealistic. They reported that, for each validation target, 50
simulation runs were performed in parallel, and that each combination of block propagation delay and block generation interval required approximately four days of computation, whereas the corresponding mining-fairness computation based on the model was completed within several tens of milliseconds [9]. This computational gap makes direct simulationbased estimation of MPR unsuitable for large-scale validation. This limitation does not undermine the purpose of our validation. Our goal is not to estimate realized mining rewards directly from long-run simulations, but to evaluate how accurately the analytical expressions reproduce the model-based MPR values under realistic network parameters. 2) Simulation Setting: We used SimBlock [22] to generate the propagation-delay matrix [Tij ] used in the validation. For each setting, we first constructed a network topology, assigned node roles and hashrates, and then measured the time required for a block generated by miner i to reach miner j. The resulting matrix [Tij ] was then used to compute both MPRref and MPRapprox . The simulated network was divided into six geographic regions. Each node was assigned to one region, and the delay of each communication link was determined by the regional latency, the transmission time implied by the link bandwidth, and the receiver-side verification delay. We used the 2024 latency and bandwidth parameters implemented in SimBlock. As the block-propagation protocol, we employed compact block relay (CBR) [24]. Since SimBlock natively implements only the low-bandwidth mode of CBR, we additionally implemented the high-bandwidth mode. For CBR nodes, the probability of successful block reconstruction was controlled by the reconstruction-success parameter provided by SimBlock [25]. We considered the following two settings. Realistic setting: The first setting was designed to approximate a Bitcoin-like network. The network consisted of 24,000 nodes [26]: 20 pool miners, 980 solo miners, 11,000 reachable non-miners, and 12,000 unreachable non-miners. Only pool miners and solo miners performed mining; all nonminers were assigned zero hashrate. The hashrate distribution of the 20 pool miners was set according to an empirical Bitcoin-like distribution [27]. The remaining mining power was assigned to the 980 solo miners using an empirical solo-mining distribution constructed from public pool statistics, so that every solo miner had positive hashrate while remaining substantially smaller than major pools. The public-layer degree distribution was specified primarily according to the empirical measurements of Grundmann et al. [28]. Each pool miner was assigned total degree 125. Based on prior measurement results, we did not give pool miners any additional advantage in terms of connection degree [29]. For solo miners and reachable non-miners, total degrees were sampled from an empirically inspired reachablenode distribution that had a strong mass near 125, a broad lower tail, and a thin high-degree tail. Each unreachable nonminer was assigned degree 10, corresponding to an outbound-
only client. Subject to these degree constraints, public-layer neighbors were selected uniformly at random. To model the practical relay infrastructure used primarily by large pools, we added a relay network on top of the public P2P layer. The relay-network implementation was based on the design proposed by Otsuki et al. [30]. One relay server was placed in each geographic region, and each pool miner was connected to the relay server in its own region. The bandwidth of both pool-miner–relay links and inter-relay links was set to ten times that of an ordinary public P2P link. When a pool miner generated a block, the block was first sent to its regional relay server, then disseminated among the relay servers, and finally forwarded from each relay server to the pool miners in the corresponding region. Uniform-random setting: The second setting served as a homogeneous baseline. It consisted of 1,000 miners with identical hashrate. No relay network was provided in this setting. Each miner was assigned a total degree of 10, and neighbors were selected uniformly at random. Compared with the realistic setting, this baseline removed both hashrate concentration and pool-specific relay advantage. 3) Validation Results: Table I shows the validation results for block generation intervals of 600 s and 60 s. For each setting, the table reports the CCC and the relative error between MPRref and MPRapprox under the three tie-breaking rules, together with the corresponding fork rate. Overall, MPRapprox agreed closely with MPRref in all cases. When the block generation interval was 600 s, the CCC was at least 0.998034 for every tie-breaking rule and every network setting, indicating almost perfect agreement. When the interval was shortened to 60 s, the fork rate increased by approximately one order of magnitude. Nevertheless, the CCC remained at least 0.997432 even in this shorter-block regime. Thus, the analytical approximation remained close to the model-based calculation even under substantially higher fork rates. The relative error also remained moderate in all cases. For the 600 s interval, the maximum relative error was 0.0352576. For the 60 s interval, the maximum relative error was 0.0404288. Although the errors increased when the block interval was shortened, the largest relative error over all experiments was still only about 4.1%. To quantify the overall error scale, we combine our approximation error with the simulation–model error reported in previous work on model-based MPR estimation [9]. The previous work reported relative errors between MPRsim and MPRref for each tie-breaking rule. In the setting corresponding to a fork rate of approximately 0.01, the reported errors were 0.0108707 for the first-seen rule, 0.0164265 for the random rule, and 0.0210495 for the last-generated rule. Combining these errors with our relative errors between MPRref and MPRapprox gives rule-specific upper bounds on the relative error between MPRsim and MPRapprox . For the 60 s interval, the resulting bounds are 0.051739, 0.029998, and 0.042856 in the realistic setting for the first-seen, random, and last-generated rules, respectively. In the uniform setting, the
corresponding bounds are 0.038885, 0.033538, and 0.045717. Thus, in the fork-rate range closest to the previous reference setting, the overall relative error is bounded by at most 0.051739, or about 5.2%. As a more conservative worst-case estimate, we also combine the largest previously reported simulation–model error for each tie-breaking rule with the largest approximation error observed for the same rule in our experiments. This gives worst-case bounds of 0.094610 for the first-seen rule, 0.120369 for the random rule, and 0.187714 for the lastgenerated rule. Therefore, even under this conservative rulewise worst-case combination, the overall relative error between MPRsim and MPRapprox is bounded by approximately 18.8%. Because these worst-case bounds combine errors from different experimental settings, they should be interpreted as conservative estimates rather than observed errors. These results show that the analytical expressions derived in this paper can accurately estimate MPR both in homogeneous random networks and in more realistic blockchain network settings. Furthermore, the fork rates observed in our experiments were higher than the reference fork rates reported for realworld systems [31]. Specifically, for the 600 s block interval, the observed fork rates were 0.000375431 and 0.000737312, both exceeding the Bitcoin reference fork rate of 0.00015. For the 60 s block interval, the observed fork rates were 0.00375334 and 0.00736887, both exceeding the Dogecoin reference fork rate of 0.00127. This suggests that the analytical approximation remains applicable even in regimes with higher fork rates than those observed in representative realworld systems, including systems with short block generation intervals such as Dogecoin. Thus, the validation supports the use of the analytical expressions in a broad range of practical blockchain-network settings.
VI. I NCENTIVES FOR B LOCK P ROPAGATION
We now analyze block propagation from an incentivecompatibility perspective. As discussed in the introduction, fast block propagation is desirable at the system level because it reduces unintended forks and contributes to security, consistency, and mining fairness. However, this does not imply that each miner has an individual incentive to reduce propagation delays. The purpose of this section is to characterize when reducing a given propagation delay is rational for an individual miner. Our analysis is based on the total differentials of MPR(i). Specifically, by taking the total differentials of the reward expressions in (FS)–(LG), we obtain the following expressions.
TABLE I VALIDATION RESULTS FOR BLOCK GENERATION INTERVALS OF 600 S AND 60 S . T HE TABLE REPORTS THE CCC BETWEEN MPRref AND MPRapprox , THE RELATIVE ERROR δapprox = ∥MPRapprox − MPRref ∥2 /∥MPRref ∥2 , AND THE CORRESPONDING FORK RATE . Block interval Setting Realistic 600 s Uniform
Realistic 60 s Uniform
Rule First-seen Random Last-generated First-seen Random Last-generated First-seen Random Last-generated First-seen Random Last-generated
CCC 0.998034 0.999997 0.999996 0.999803 0.999999 0.999997 0.997432 0.999665 0.999619 0.999626 0.999861 0.999715
Let V−i := V \ {i}. 1 dMPR(i) = T +
are
X
2αj αk dTjk +
X
αj (2αi − 1) dTji
j∈V−i
j,k∈V−i
X
αk (2αi − 1) dTik ,
(dFS)
k∈V−i
dMPR(i) =
1 T +
δapprox Fork rate Ref. fork rate 0.0352576 0.00133235 0.000375431 0.00015 0.00212041 (Bitcoin) 0.0200159 0.00167713 0.000737312 0.00239832 0.0404288 0.0133518 0.00375334 0.00127 0.0213573 (Dogecoin) 0.0277126 0.0168351 0.00736887 0.0241587
X
αj αk dTjk
j,k∈V−i
1 X αj (3αi − 1 − αj ) dTji 2 j∈V−i
1 X αk (3αi − 1 − αk ) dTik , + (dRD) 2 k∈V−i X X 1 dMPR(i) = αj αk dTjk + αj (αi − αj ) dTji T j∈V−i j,k∈V−i X + αk (2αi − 1) dTik . (dLG) k∈V−i
Here, (dFS), (dRD), and (dLG) correspond to the first-seen, random, and last-generated rules, respectively. For miner i, we classify propagation delays into three types. First, a relay delay is a delay Tjk for a block generated by another miner j to reach another miner k, where j ̸= i and k ̸= i. This delay captures the propagation of blocks generated by other miners, which miner i may help reduce by relaying those blocks. Second, an inbound delay is a delay Tji for a block generated by another miner j to reach miner i. This delay determines how quickly miner i receives blocks generated by other miners. Third, an outbound delay is a delay Tik for a block generated by miner i to reach another miner k. This delay determines how quickly blocks generated by miner i are delivered to other miners. Relay delay: We first consider miner i’s incentive to reduce relay delays for blocks generated by other miners. The coefficients of dTjk in (dFS)–(dLG), where j ̸= i and k ̸= i,
2αj αk
under the first-seen rule,
αj αk
under the random rule,
αj αk
under the last-generated rule.
Since αj > 0 and αk > 0 for active miners, all these coefficients are positive. Thus, the marginal gain from reducing Tjk is negative under all three tie-breaking rules. Therefore, miner i has no mining-reward incentive to reduce such relay delays; indeed, increasing them increases MPR(i). This gives a basic negative result for the incentive compatibility of block propagation. Although relaying blocks generated by other miners is beneficial for the system because it improves propagation, it is not individually rational from the viewpoint of mining rewards. Inbound delay: Next, we consider miner i’s incentive to reduce inbound delays for blocks generated by other miners. The coefficients of dTji in (dFS)–(dLG), for j ̸= i, are αj (2αi −1) under the first-seen rule, 12 αj (3αi −1 −αj ) under the random rule, and αj (αi −αj ) under the last-generated rule. Hence, reducing Tji increases MPR(i) if and only if 1 2 1 + αj αi < 3 αi < αj αi <
under the first-seen rule, under the random rule, under the last-generated rule.
These conditions show that inbound block-propagation incentives depend on both the hashrate distribution and the tiebreaking rule. Under the first-seen rule, every miner with less than half of the total hashrate has an incentive to reduce inbound delays for blocks generated by other miners. Under the random rule, this incentive is weaker and depends on the hashrate share αj of the miner that generated the block. In particular, a miner with αi ≤ 1/3 has an incentive to reduce Tji for every other active miner j, whereas a larger miner may lack this incentive for some j. Under the last-generated rule, miner i has an incentive to reduce Tji only when the block is generated by a miner with a larger hashrate share than miner i.
Outbound delay: Finally, we consider miner i’s incentive to reduce outbound delays for its own blocks. The coefficient of dTik in (dFS)–(dLG) is αk (2αi − 1) under both the firstseen and last-generated rules, and 12 αk (3αi − 1 − αk ) under the random rule. Therefore, reducing Tik increases MPR(i) if and only if 1 2 1 + αk αi < 3 1 αi < 2
αi <
under the first-seen rule, under the random rule, under the last-generated rule.
Thus, outbound block-propagation incentives also depend on the hashrate distribution and the tie-breaking rule. Under the first-seen and last-generated rules, every miner with less than half of the total hashrate has an incentive to reduce outbound delays for its own blocks. Under the random rule, this incentive depends on the hashrate share αk of the miner to which the block is delivered. In particular, a miner with αi ≤ 1/3 has an incentive to reduce Tik for every other active miner k, whereas a larger miner may lack this incentive for some k. Implications: The above analysis yields three implications. First, none of the three tie-breaking rules gives miners a mining-reward incentive to reduce relay delays for blocks generated by other miners. This result shows a basic incentivecompatibility problem in block propagation: although reducing such delays is beneficial for the system as a whole, it is not individually rational for miners from the viewpoint of mining rewards. Second, the incentives to reduce inbound and outbound delays are not uniform. They depend on hashrate shares and on the adopted tie-breaking rule. In general, larger miners have systematically weaker block-propagation incentives. In particular, a miner with at least half of the total hashrate has no strict mining-reward incentive to reduce either inbound or outbound delays under any of the three tie-breaking rules. Third, the first-seen rule provides the strongest blockpropagation incentives among the three rules. For both inbound and outbound delays, every non-majority miner has an incentive to reduce delays under the first-seen rule. The random rule weakens both inbound and outbound incentives, while the lastgenerated rule preserves the same outbound condition as the first-seen rule but weakens the inbound condition. Incentive incompatibility in real-world mining: The above analysis is stated in terms of the mining profit rate, but the incentive-incompatibility result carries over to realworld mining profitability. Recall that MPR(i) = (ri −αi )/αi , where ri is the block reward proportion of miner i. Equivalently, ri = αi (1 + MPR(i)). Therefore, when the hashrate share αi is fixed, the sign of the marginal effect of a propagation delay on ri is the same as the sign of its marginal effect on MPR(i). Let Πi denote the real-world profit of miner i. For a propagation delay Tab , where Tab denotes a relay, inbound,
or outbound delay for miner i, we decompose Πi locally as Πi = N blk Ri ri − Cibase − Cidelay (Tab ),
(10)
where N blk > 0 is the total number of rewarded blocks generated in the network during the period under consideration, and Ri > 0 is the monetary reward obtained by miner i per rewarded block. Thus, N blk Ri ri represents miner i’s monetary mining revenue over this period. In the local marginal analysis below, we treat N blk and Ri as fixed with respect to the marginal change in Tab . The term Cibase denotes cost components that are independent of the marginal change in Tab . It includes factors such as ASIC efficiency, electricity price, hardware cost, pool fees, and the baseline scale of mining operation when αi is fixed. These factors affect the level of real-world profit, but they vanish when we take the partial derivative with respect to Tab . By contrast, Cidelay (Tab ) includes factors that may depend on propagation-delay improvement, such as bandwidth cost, relay-node operation, validation capacity, peering arrangements, and other network investments. We assume that ∂Cidelay /∂Tab ≤ 0. This assumption means that reducing a propagation delay is not costless: achieving a smaller Tab requires additional network, validation, or operational resources. Equivalently, not improving the delay weakly reduces these non-reward costs. Using ri = αi (1 + MPR(i)), we obtain ∂MPR(i) ∂Cidelay ∂Πi = N blk Ri αi − . ∂Tab ∂Tab ∂Tab
(11)
Now consider any propagation delay Tab for which miner i is incentive-incompatible in the mining-reward analysis, namely ∂MPR(i)/∂Tab > 0. This case includes relay delays under all three tie-breaking rules, and inbound or outbound delays whenever the corresponding coefficient in (dFS)–(dLG) is positive. Since N blk > 0, Ri > 0, αi > 0, and ∂Cidelay /∂Tab ≤ 0, we have ∂Πi ∂MPR(i) ∂Cidelay = N blk Ri αi − > 0. ∂Tab ∂Tab ∂Tab
(12)
Thus, increasing Tab locally increases miner i’s real-world profit, whereas decreasing Tab locally decreases it. Consequently, whenever the mining-reward analysis shows that increasing Tab is strictly profitable, namely ∂MPR(i)/∂Tab > 0, adding real-world profitability factors does not restore incentive compatibility. Most real-world factors vanish under the partial derivative with respect to the propagation delay, and the remaining delay-dependent costs work in the same direction as the incentive-incompatibility result. Therefore, the incentive incompatibility identified above is not an artifact of analyzing MPR(i) alone; it persists in real-world mining profitability. VII. S TRATEGIC B LOCK P ROPAGATION The previous section analyzed block-propagation incentives by examining the total differentials of MPR(i). This analysis gives a theoretical characterization of incentive compatibility:
it identifies when reducing a propagation delay increases or decreases a miner’s own MPR. This section translates those theoretical results into concrete block-propagation strategies. We formulate feasible strategies that miners can implement in real-world systems such as Bitcoin and analyze the consequences of rational miner behavior. We first consider relay-delay strategies, in which a miner does not forward blocks generated by other miners to any other miner. We then analyze inbound-delay and outbound-delay strategies jointly, in which a miner temporarily behaves as if it had not yet received a block generated by another miner or had not yet generated its own block. A. Relay-Delay Strategy We consider a non-relay strategy for miner i, denoted by Snr (i). Under this strategy, miner i behaves in the same way as in the baseline system until it receives a block generated by another miner. After receiving such a block, miner i updates its own local view and mines according to the protocol, but does not relay that block to other miners. In other words, this strategy only removes miner i’s contribution to the propagation of blocks generated by other miners. R(i) For j ̸= i and k ̸= i, let Tjk denote the delay for a block generated by miner j to reach miner k when miner i NR(i) relays blocks generated by other miners. Let Tjk denote the corresponding delay when miner i adopts Snr (i). We define NR(i) R(i) ∆nr −Tjk , and assume that ∆nr i;jk := Tjk i;jk is nonnegative for all j ̸= i and k ̸= i. This assumption means that miner i’s relaying does not make blocks generated by other miners reach other miners more slowly. Equivalently, not relaying such blocks can only prevent propagation delays from being improved. If miner i’s relay would actually help miner k receive a block generated by miner j earlier, then ∆nr i;jk > 0. ∗ Let cjk denote the coefficient of dTjk inside the braces in (dFS)–(dLG) under a tie-breaking rule ∗ ∈ {FS, RD, LG}. As shown in the relay-delay analysis in the previous section, c∗jk > 0 for all active miners j and k under all three tiebreaking rules. Therefore, the change in miner i’s mining profit rate caused by Snr (i) is ∆MPR∗ (i; Snr (i)) =
1 T
X
c∗jk ∆nr i;jk ≥ 0.
(13)
j∈V, k∈V j̸=i, k̸=i
Moreover, if there exists at least one pair (j, k) such that ∆nr i;jk > 0, then ∆MPR∗ (i; Snr (i)) > 0. Thus, miner i weakly benefits from not relaying blocks generated by other miners, and strictly benefits whenever its relay would otherwise reduce at least one relay delay. Consequently, in a system of reward-maximizing miners, such relaying is not incentive-compatible. In the restricted relay game considered here, a profile in which miners do not relay blocks generated by other miners is a Nash equilibrium. If each miner’s relay would reduce at least one relay delay, then no miner has a profitable unilateral deviation to relaying.
B. Inbound- and Outbound-Delay Strategies We next analyze inbound-delay and outbound-delay strategies. Unlike the relay-delay strategy, these strategies manipulate propagation delays involving miner i itself. We formulate them as a non-cooperative game in which each miner chooses whether to adopt delay-manipulation actions. The utility of each miner is its mining profit rate. For each miner i, we consider two delay-manipulation actions. The first is an outbound-delay strategy, denoted by Sout (i). Under this strategy, miner i delays the propagation of its own newly generated blocks by a fixed additional amount dout > 0. Thus, for every k ̸= i, this strategy increases Tik i by dout i . This can be implemented by behaving toward the network, for an additional interval dout i , as if the block had not yet been generated. The second is an inbound-delay strategy, denoted by Sin (i). Under this strategy, after miner i receives a block generated by another miner, miner i behaves for an additional interval din i > 0 as if that block had not yet reached it. Thus, for every j ̸= i, this strategy increases Tji by din i . We assume that the hashrate vector (αi )i∈V is common knowledge. Each miner chooses only whether to adopt Sout (i) and Sin (i). To avoid degenerate indifference cases, we assume that the parameters are in generic position, meaning that no miner is exactly indifferent between adopting and not adopting any delay-manipulation action. Let σ 0 denote the strategy profile in which no miner adopts any inbound- or outbound-delay manipulation action. Let σ NASH denote a Nash equilibrium profile. For a strategy profile σ, let MPR(i; σ) denote the mining profit rate of miner i under σ. We define MPR0 (i) := MPR(i; σ 0 ), MPRNASH (i) := MPR(i; σ
NASH
(14) ),
∆MPRNASH (i) := MPRNASH (i) − MPR0 (i).
(15) (16)
Since the MPR expressions in (FS)–(LG) are linear in the propagation delays Tij , the marginal effect of each delaymanipulation strategy is independent of whether the other strategies are adopted. Thus, each strategy can be evaluated independently. Therefore, excluding knife-edge indifference cases, a miner adopts a strategy if and only if the strategy’s own marginal gain is positive. First-seen rule: Under the first-seen rule, if miner i adopts Sout (i), the resulting changes in MPR are dout i (1 − αi )(2αi − 1), T out d ∆MPRSout (i) (j) = i αi (1 − 2αi ), j ̸= i. T ∆MPRSout (i) (i) =
(17) (18)
Similarly, if miner i adopts Sin (i), then din i (1 − αi )(2αi − 1), T in d ∆MPRSin (i) (j) = i αi (1 − 2αi ), j ̸= i. T ∆MPRSin (i) (i) =
(19) (20)
Therefore, both Sout (i) and Sin (i) are profitable for miner i if and only if αi > 1/2. The Nash equilibrium is characterized as follows. If no miner has a strict majority of the total hashrate, then no miner adopts either inbound- or outbound-delay manipulation: σ NASH = σ 0 . Hence, ∆MPRNASH (i) = 0 for all i ∈ V . If a miner m exists with αm > 1/2, then m is unique. Miner m adopts both Sout (m) and Sin (m), while all other miners adopt neither action: σ NASH = σ 0 + {Sout (m), Sin (m)}.
(21)
FS in Let Dm := dout m + dm . Then the equilibrium MPR changes are FS Dm (1 − αm )(2αm − 1), (22) T DFS ∆MPRNASH (i) = m αm (1 − 2αm ), i ̸= m. (23) T
∆MPRNASH (m) =
Random rule: Under the random rule, if miner i adopts Sout (i), the resulting changes in MPR are X dout ∆MPRSout (i) (i) = i 4αi − 1 − 2αi2 − αk2 , (24) 2T k∈V
∆MPRSout (i) (j) =
dout i αi (1 + αj − 3αi ), 2T
j ̸= i. (25)
Similarly, if miner i adopts Sin (i), then X din i 2 ∆MPRSin (i) (i) = 4αi − 1 − 2αi − αk2 , 2T
(26)
k∈V
din ∆MPRSin (i) (j) = i αi (1 + αj − 3αi ), 2T
X
αk2 .
j ̸= i.
(27)
(28)
k∈V
Then both Sout (i) and Sin (i) are profitable for miner i if and only if gi > 0. At most one miner can satisfy gi > 0. Indeed, suppose two distinct miners i and j satisfy gi > 0 and Pgj > 0. Without loss of generality, assume αi ≤ αj . Since k∈V αk2 ≥ αi2 + αj2 , we have X gi = 4αi − 1 − 2αi2 − αk2 k∈V ≤ 4αi − 1 − 3αi2 − αj2 ≤ −(2αi − 1)2 ≤ 0,
If gm < 0, no miner adopts inbound- or outbound-delay manipulation, and hence ∆MPRNASH (i) = 0 for all i ∈ V . If RD in gm > 0, let Dm := dout m + dm . Then the equilibrium MPR changes are X DRD 2 ∆MPRNASH (m) = m 4αm − 1 − 2αm − αk2 , 2T k∈V
(31) DRD ∆MPRNASH (i) = m αm (1 + αi − 3αm ), 2T
i ̸= m. (32)
Last-generated rule: Under the last-generated rule, outbound-delay and inbound-delay strategies have different profitability conditions. If miner i adopts Sout (i), the resulting changes in MPR are dout i (1 − αi )(2αi − 1), T out d ∆MPRSout (i) (j) = i αi (1 − 2αi ), j ̸= i. T ∆MPRSout (i) (i) =
(33) (34)
Thus, Sout (i) is profitable if and only if αi > 1/2. If miner i adopts Sin (i), the resulting changes in MPR are X din i αi − αk2 , ∆MPRSin (i) (i) = (35) T k∈V
Define gi := 4αi − 1 − 2αi2 −
property above, if gm > 0, this miner is unique. Excluding knife-edge cases, the Nash equilibrium is ( σ0 , if gm < 0, NASH (30) σ = σ 0 + {Sout (m), Sin (m)}, if gm > 0.
(29)
which contradicts gi > 0. Therefore, there is at most one miner with profitable inbound- and outbound-delay manipulation under the random rule. Let m be a miner with the largest hashrate share. Since gi is strictly increasing in αi for αi < 1, the only possible miner satisfying gi > 0 is the largest miner. By the at-most-one
din ∆MPRSin (i) (j) = i αi (αj − αi ), T
j ̸= i.
(36)
P Thus, Sin (i) is profitable if and only if αi > k∈V αk2 . Define the set of miners that adopt outbound-delay manipulation as 1 X := i ∈ V : αi > , (37) 2 and the set of miners that adopt inbound-delay manipulation as ( ) X Y := i ∈ V : αi > αk2 . (38) k∈V
The set X contains at most one miner. The set Y is an upper set with respect to hashrate: if i ∈ Y and αj > αi , then j ∈ Y . Moreover, under the generic-position assumption, Y is nonempty. Indeed, if m is the largest miner, then X X αk2 ≤ αm αk = αm . (39) k∈V
k∈V
Equality would make miner m exactly indifferent between adopting and not adopting Sin (m), which by the P is excluded 2 generic-position assumption. Hence k∈V αk < αm , and therefore m ∈ Y . Thus, unlike the first-seen and random rules,
the last-generated rule may allow multiple miners to adopt inbound-delay manipulation. Excluding knife-edge cases, the Nash equilibrium is σ NASH = σ 0 + {Sout (i) : i ∈ X} + {Sin (i) : i ∈ Y }. (40) Equivalently, outbound-delay manipulation is adopted only by a majority miner, if such a miner exists, whereas inbounddelay manipulation is P adopted exactly by miners whose hashrate share exceeds k∈V αk2 . We now summarize the equilibrium MPR changes. For inbound-delay manipulation, define X PYin := din (41) h αh , h∈Y
Qin Y :=
X
2 din h αh .
(42)
h∈Y
Then the inbound-delay contribution to miner i’s equilibrium MPR change is 1 αi PYin − Qin ∆MPRin (i) = Y NASH T X in + 1{i∈Y } di αi − αk2 . (43) k∈V
For outbound-delay manipulation, since X contains at most one miner, there are two cases. If X = ∅, then ∆MPRout NASH (i) = 0 for all i ∈ V . If X = {m}, then dout m (1 − αm )(2αm − 1), T dout m ∆MPRout αm (1 − 2αm ), i ̸= m. NASH (i) = T Therefore, for every miner i, ∆MPRout NASH (m) =
(44) (45)
out ∆MPRNASH (i) = ∆MPRin NASH (i) + ∆MPRNASH (i). (46)
VIII. D ESIGN I MPLICATIONS OF T IE -B REAKING RULES We now compare tie-breaking rules from the perspective of protocol design. Previous studies have often emphasized tiebreaking rules as mechanisms for mitigating strategic mining. For example, the last-generated rule can reduce honest miners’ contribution to an attacker’s chain by exploiting the fact that a withheld block becomes older while it is kept private. In contrast, our results show that tie-breaking rules also play an important role in regulating block-propagation incentives. Specifically, among the tie-breaking rules analyzed in this paper, the first-seen rule induces the strongest block-propagation incentives. However, stronger propagation incentives can also imply greater competitive pressure around propagation performance. In a realistic network, miners with better propagation capability may obtain higher mining profit rates, and this can worsen mining fairness. We therefore examine the tie-breaking rules from the viewpoint of mining fairness. Based on this comparison, we discuss which tie-breaking rule is preferable under different design objectives.
A. The Rich-Get-Richer Effect in a Symmetric Network We first consider a symmetric network, where Tij = 0 if i = j and Tij = d if i ̸= j for all i, j ∈ V . Substituting this symmetric-delay setting into the analytical expressions in (FS)–(LG) yields the following common expression: X d αi − αj2 . (47) MPR(i) = 2 T j∈V
Equation (47) shows that the rich-get-richer (RGR) effect arises even in a symmetric network: a miner with a larger hashrate share obtains a larger mining profit rate. Importantly, this expression is common to the first-seen, random, and lastgenerated rules. Thus, in a symmetric network, the RGR effect is caused by hashrate heterogeneity and does not depend on the tie-breaking rule. To compare tie-breaking rules from the viewpoint of mining fairness, we must therefore consider asymmetric propagation delays. B. The Rich-Get-Richer Effect under Realistic Network Asymmetry We next compare tie-breaking rules under realistic network asymmetry. Empirical measurements show a noticeable discrepancy between the block propagation delay inferred from the observed fork rate and the block propagation delay measured directly. In fact, the propagation delay inferred from the observed fork rate is approximately 0.09 s, whereas the directly measured block propagation delay is approximately 3.5 s in Bitcoin [31]. Because a fork-rate-based estimate is implicitly weighted by hashrate share, it is more strongly influenced by the propagation performance of large miners. This suggests that, in practice, large miners enjoy a network advantage over small miners. Consider a small miner i and a larger miner j, where αi < αj . We evaluate whether an additional propagation disadvantage of miner i increases the MPR gap between miner j and miner i. Specifically, we consider an Sout (i)-type disadvantage of magnitude dout and an Sin (i)-type disadvantage of i magnitude din i . This does not mean that miner i intentionally worsens its own propagation. Rather, the same expressions derived for delay-manipulation strategies can be used to evaluate the effect of realistic propagation disadvantages. We define Gout ∗ (i, j) := ∆MPRSout (i) (j) − ∆MPRSout (i) (i),
(48)
Gin ∗ (i, j) := ∆MPRSin (i) (j) − ∆MPRSin (i) (i),
(49)
where ∗ ∈ {FS, RD, LG} denotes the tie-breaking rule. These quantities measure how much an outbound- or inbound-delay disadvantage of miner i enlarges the MPR gap between the larger miner j and the smaller miner i. Under the first-seen rule, using (17), (18), (19), and (20), we obtain dout i (1 − 2αi ), (50) Gout FS (i, j) = T in di Gin (1 − 2αi ). (51) FS (i, j) = T
Thus, if αi < 1/2, both outbound and inbound disadvantages of miner i increase the MPR gap between miner i and every larger miner j. Under the random rule, using (24), (25), (26), and (27), we obtain X dout i 2 Gout (i, j) = 1 − 3α − α + α α + αk2 , (52) i i j RD i 2T k∈V in X d i 1 − 3αi − αi2 + αi αj + Gin αk2 . (53) RD (i, j) = 2T k∈V
In particular, if αi ≤ 1/3, both quantities are positive. Hence, the random rule also allows network disadvantages of small miners to amplify the RGR gap. Under the last-generated rule, using (33), (34), (35), and (36), we obtain dout i (1 − 2αi ), (54) Gout LG (i, j) = T in X di αk2 − αi − αi2 + αi αj . (55) Gin LG (i, j) = T k∈V
The outbound effect Pis the same as under the first-seen rule. Moreover, if αi < k∈V αk2 and αj > αi , then Gin LG (i, j) > 0. Thus, an Sin (i)-type disadvantage of a sufficiently small miner strictly enlarges its MPR gap against larger miners. The three rules can be compared directly for each type of disadvantage. For outbound disadvantages, (50), (52), and (54) imply out out Gout FS (i, j) = GLG (i, j) > GRD (i, j),
(56)
except for degenerate two-miner cases. For inbound disadvantages, (51), (53), and (55) imply in in Gin FS (i, j) > GRD (i, j) > GLG (i, j),
(57)
except for degenerate two-miner cases. Therefore, for an outbound disadvantage, the ordering of RGR-gap amplification is first-seen = last-generated > random. For an inbound disadvantage, the ordering is first-seen > random > last-generated. To compare the random and last-generated rules in aggregate, define Ai := 1 − 2αi , X Bij := αk2 − αi − αi2 + αi αj .
(58) (59)
k∈V
Then, out out in GRD (i, j) + Gin RD (i, j) − GLG (i, j) + GLG (i, j) din − dout i = i Ai − Bij . (60) 2T Since Ai > Bij except for degenerate two-miner cases, the aggregate ordering between the random and last-generated out rules depends on the relative sizes of dout and din = i i . If di in di , then the random and last-generated rules have the same out aggregate effect. If din i > di , the random rule yields larger aggregate RGR-gap amplification than the last-generated rule. If dout > din i i , the last-generated rule yields larger aggregate RGR-gap amplification than the random rule.
C. Design Implications The comparison above reveals a fundamental trade-off. A tie-breaking rule that gives miners stronger incentives to reduce propagation delays also tends to make propagation advantages more valuable. As a result, the same mechanism that encourages miners to improve propagation can strengthen the RGR effect when propagation capabilities are uneven across miners. The first-seen rule provides the strongest block-propagation incentives among the three rules: every non-majority miner has an incentive to reduce both inbound and outbound delays. However, in a realistic asymmetric network, it also gives the strongest amplification of reward gaps caused by propagation disadvantages. Thus, the first-seen rule improves propagation incentives at the cost of making mining fairness more sensitive to propagation-performance differences. The random rule occupies an intermediate position. It weakens inbound and outbound propagation incentives compared with the first-seen rule, and it also weakens RGR amplification caused by realistic network asymmetry. Moreover, the random rule is more favorable than the first-seen rule from the perspective of mitigating strategic mining, because it reduces the advantage that a miner can obtain from being received first in a fork. The last-generated rule is attractive from a strategic-mining perspective, but our analysis shows that it is not desirable from the viewpoint of block propagation incentives. It preserves the first-seen rule’s outbound-delay condition, but weakens the inbound-delay condition. At the same time, it weakens the RGR amplification caused by inbound disadvantages. Thus, the last-generated rule improves fairness relative to the firstseen rule in some asymmetric settings, but it does so by weakening miners’ incentives to receive other miners’ blocks quickly. Consequently, no tie-breaking rule is uniformly best across all design objectives. If the objective is to maximize blockpropagation incentives, the first-seen rule is preferable. If the objective is to suppress RGR amplification caused by realistic network asymmetry, the random and last-generated rules are preferable to the first-seen rule. If robustness against strategic mining is the primary concern, the last-generated rule is preferable, but this comes at the cost of weaker incentives for miners to receive other miners’ blocks quickly. IX. L IMITATIONS Our study has several limitations. First, we treat each mining pool as a single miner, although real mining pools consist of geographically distributed participants coordinated by pool servers. This abstraction ignores pool-internal delays and pool-internal stale shares and blocks. We expect these effects to be secondary, because pool participants typically exchange only the minimal mining information needed for mining, which is much smaller than full block propagation over the public Bitcoin network. Still, explicitly modeling the distributed structure of mining pools is left for future work.
Second, the derivation of the first-seen reward expression relies on Cond. B. Although this condition is natural for propagation processes, real networks may violate it. Removing this condition or quantifying the effect of its violations is an important direction for future work. Third, our simulation validation does not directly estimate MPR by counting realized mining rewards over long simulation runs. Instead, we use SimBlock to obtain propagationdelay matrices and hashrate distributions. Using these network parameters, we compute MPRref from the underlying reward model and MPRapprox from the analytical expressions derived in this paper, and then compare the two. Thus, the validation shows that the analytical approximation accurately reproduces the MPR values computed from the underlying model under realistic network parameters. It should not be interpreted as a direct measurement of realized mining rewards in a large-scale blockchain simulation. Conducting such long-run simulations at the network scale considered in this paper would be computationally expensive and remains future work. Fourth, we treat propagation delays Tij and hashrate shares αi as fixed parameters. A natural extension is to model them as random variables or stochastic processes, which would enable the analysis of dynamic networks where propagation delays and hashrate shares vary over time. X. C ONCLUSION This paper studied the incentive compatibility of block propagation in Bitcoin. We derived analytical reward expressions that characterize how propagation delays, hashrate distribution, and tie-breaking rules jointly determine mining rewards, and validated their accuracy through simulation experiments. Using these expressions, we showed that miners have no mining-reward incentive to reduce relay delays for blocks generated by other miners. We also showed that incentives to reduce inbound and outbound delays become weaker as a miner’s hashrate share increases, and that a majority miner can even benefit from delaying both sending and receiving blocks. We further translated these incentive results into feasible block-propagation strategies and showed that rational miners can benefit from not relaying blocks generated by other miners and, in some cases, from strategically delaying their own sending or receiving of blocks. We also compared representative tie-breaking rules and revealed a trade-off: the first-seen rule provides the strongest incentives to reduce inbound and outbound delays, but it also makes propagation advantages more consequential for mining rewards. By contrast, the random and last-generated rules can mitigate such reward unfairness at the cost of weaker propagation-improvement incentives. Overall, our results show that Bitcoin’s block propagation is not fully incentive-compatible and that tie-breaking rules mediate the trade-off between propagation incentives and reward distribution. R EFERENCES [1] S. Nakamoto, “Bitcoin: A peer-to-peer electronic cash system,” 2008.
[2] A. Gervais, G. O. Karame, K. Wüst, V. Glykantzis, H. Ritzdorf, and S. Capkun, “On the security and performance of proof of work blockchains,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 3–16. [Online]. Available: https://doi.org/10.1145/2976749.2978341 [3] A. Dembo, S. Kannan, E. N. Tas, D. Tse, P. Viswanath, X. Wang, and O. Zeitouni, “Everything is a race and nakamoto always wins,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’20. New York, NY, USA: Association for Computing Machinery, 2020, p. 859–878. [Online]. Available: https://doi.org/10.1145/3372297.3417290 [4] P. Gaži, A. Kiayias, and A. Russell, “Tight consistency bounds for bitcoin,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’20. New York, NY, USA: Association for Computing Machinery, 2020, p. 819–838. [Online]. Available: https://doi.org/10.1145/3372297.3423365 [5] C. Decker and R. Wattenhofer, “Information propagation in the bitcoin network,” in IEEE P2P 2013 Proceedings, 2013, pp. 1–10. [6] K. Croman, C. Decker, I. Eyal, A. E. Gencer, A. Juels, A. Kosba, A. Miller, P. Saxena, E. Shi, E. Gün Sirer, D. Song, and R. Wattenhofer, “On scaling decentralized blockchains,” in Financial Cryptography and Data Security, J. Clark, S. Meiklejohn, P. Y. Ryan, D. Wallach, M. Brenner, and K. Rohloff, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2016, pp. 106–125. [7] Y. Mao and S. B. Venkatakrishnan, “Less is more: Understanding network bias in proof-of-work blockchains,” Mathematics, vol. 11, no. 23, 2023. [Online]. Available: https://www.mdpi.com/22277390/11/23/4741 [8] Z. Lu and R. Zhang, “When is slower block propagation more profitable for large miners?” in Computer Security – ESORICS 2023, G. Tsudik, M. Conti, K. Liang, and G. Smaragdakis, Eds. Cham: Springer Nature Switzerland, 2024, pp. 285–305. [9] A. Sakurai and K. Shudo, “Model-based calculation method of mining fairness in blockchain,” IEEE Open Journal of the Computer Society, vol. 7, pp. 129–141, 2026. [10] I. Eyal and E. G. Sirer, “Majority is not enough: Bitcoin mining is vulnerable,” in Financial Cryptography and Data Security, N. Christin and R. Safavi-Naini, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2014, pp. 436–454. [11] A. Sakurai and K. Shudo, “A fully local last-generated rule in a blockchain,” 2024, arXiv: 2411.08439. [Online]. Available: https://arxiv.org/abs/2411.08439 [12] A. Sakurai and K. Shudo, “Tie-breaking rule based on partial proof of work in a blockchain,” IEEE Access, vol. 12, pp. 197 999–198 014, 2024. [13] E. Heilman, “One weird trick to stop selfish miners: Fresh bitcoins, a solution for the honest miner (poster abstract),” in Financial Cryptography and Data Security, R. Böhme, M. Brenner, T. Moore, and M. Smith, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2014, pp. 161– 162. [14] M. Rosenfeld, “Analysis of bitcoin pooled mining reward systems,” 2011. [15] N. T. Courtois and L. Bahack, “On subversive miner strategies and block withholding attack in bitcoin digital currency,” 2014. [Online]. Available: https://arxiv.org/abs/1402.1718 [16] Y. Kwon, D. Kim, Y. Son, E. Vasserman, and Y. Kim, “Be selfish and avoid dilemmas: Fork after withholding (faw) attacks on bitcoin,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’17. New York, NY, USA: Association for Computing Machinery, 2017, p. 195–209. [Online]. Available: https://doi.org/10.1145/3133956.3134019 [17] A. Sapirshtein, Y. Sompolinsky, and A. Zohar, “Optimal selfish mining strategies in bitcoin,” in Financial Cryptography and Data Security, J. Grossklags and B. Preneel, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2017, pp. 515–532. [18] M. Carlsten, H. Kalodner, S. M. Weinberg, and A. Narayanan, “On the instability of bitcoin without the block reward,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 154–167. [Online]. Available: https://doi.org/10.1145/2976749.2978408 [19] A. Kiayias, E. Koutsoupias, M. Kyropoulou, and Y. Tselekounis, “Blockchain mining games,” in Proceedings of the 2016 ACM Conference on Economics and Computation, ser. EC ’16. New York,
NY, USA: Association for Computing Machinery, 2016, p. 365–382. [Online]. Available: https://doi.org/10.1145/2940716.2940773 [20] E. Heilman, A. Kendler, A. Zohar, and S. Goldberg, “Eclipse attacks on Bitcoin’s Peer-to-Peer network,” in Proc. 24th USENIX Security Symposium (USENIX Security ’15). Washington, D.C.: USENIX Association, Aug. 2015, pp. 129–144. [Online]. Available: https://www.usenix.org/conference/usenixsecurity15/technicalsessions/presentation/heilman [21] M. Walck, K. Wang, and H. S. Kim, “Tendrilstaller: Block delay attack in bitcoin,” in 3rd IEEE International Conference on Blockchain, 2019, pp. 1–9. [22] Y. Aoki, K. Otsuki, T. Kaneko, R. Banno, and K. Shudo, “Simblock: A blockchain network simulator,” in Proc. IEEE INFOCOM 2019 - IEEE Conference on Computer Communications Workshops (INFOCOM 2019 Workshops), 2019, pp. 325–329. [23] L. I.-K. Lin, “A concordance correlation coefficient to evaluate reproducibility,” Biometrics, vol. 45, no. 1, pp. 255–268, 1989. [Online]. Available: http://www.jstor.org/stable/2532051 [24] M. Corallo, “Compact block relay,” https://github.com/bitcoin/bips/blob/master/bip-0152.mediawiki, 2016, accessed: 2025-09-13. [25] R. Nagayama, R. Banno, and K. Shudo, “Identifying impacts of protocol and internet development on the bitcoin network,” in Proc. 25th IEEE Symposium on Computers and Communications (IEEE ISCC 2020), 2020, pp. 1–6. [26] “Bitnodes,” https://bitnodes.io/nodes/, accessed: 2026-04-26. [27] “Mining pool stats,” Online, 2026, accessed: 2026-04-19. [Online]. Available: https://miningpoolstats.stream/ [28] M. Grundmann, M. Baumstark, and H. Hartenstein, “On the peer degree distribution of the bitcoin p2p network,” in 2022 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), 2022, pp. 1–5. [29] A. Miller, J. Litton, A. Pachulski, N. Gupta, D. Levin, N. Spring, and B. Bhattacharjee, “Discovering bitcoin’s public topology and influential nodes,” https://www.cs.umd.edu/projects/coinscope/coinscope.pdf, 2015, university of Maryland, Accessed: 2026-04-26. [30] K. Otsuki, Y. Aoki, R. Banno, and K. Shudo, “Effects of a simple relay network on the bitcoin network,” in Proceedings of the Asian Internet Engineering Conference, ser. AINTEC ’19. New York, NY, USA: Association for Computing Machinery, 2019, pp. 41–46. [Online]. Available: https://doi.org/10.1145/3340422.3343640 [31] J. Fechner, B. Chandrasekaran, and M. X. Makkes, “Calibrating the performance and security of blockchains via information propagation delays: revisiting an old approach with a new perspective,” in Proceedings of the 37th ACM/SIGAPP Symposium on Applied Computing, ser. SAC ’22. New York, NY, USA: Association for Computing Machinery, 2022, pp. 282–289. [Online]. Available: https://doi.org/10.1145/3477314.3507003
A PPENDIX This appendix derives the analytical reward expressions used in Section V. We start from the round-based model described in Section IV. Throughout this appendix, we use Cond. A and omit all second- and higher-order terms in εij := Tij /T . Let
We also recall the definitions X (m) fin (i) := αjm Tji ,
(63)
j∈V (m)
fout (i) :=
X
αjm Tij ,
(64)
j∈V
f¯ :=
XX
αi αj Tij .
(65)
i∈V j∈V
A. Round-Start Probability Let Xr denote the miner that starts round r, and let qr (i) := Pr[Xr = i]. From the round transition rule, we have X X qr+1 (i) = αi (1 − Fji ) + αk Fjk αi qr (j) j∈V
k∈V
= αi 1 −
X
qr (j)Fji +
j∈V
XX
qr (j)αk Fjk .
j∈V k∈V
(66) Since Fij = O(ε), the deviation qr (j) − αj affects the righthand side only through terms of order O(ε2 ). Therefore, to obtain the round-start probability up to first order, it is sufficient to apply the update in (66) once with qr (j) = αj . This gives X Tji X X Tjk qr+1 (i) = αi 1 − + αj αk + O(ε2 ) αj T T j∈V k∈V j∈V (1) ¯ f (i) f = αi 1 + − in + O(ε2 ). (67) T T Hence, the stationary round-start probability satisfies (1) f¯ fin (i) π(i) = αi 1 + − + O(ε2 ). T T
(68)
B. Reward Rate before Substituting the Tie-Breaking Rule Next, we compute the reward rate of miner i. If miner i starts a round, miner i’s block receives a reward either when no fork occurs or when a fork occurs and miner i’s block wins the fork. If another miner j starts a round and miner i causes a fork, miner i’s block receives a reward when miner j’s block loses the fork. Therefore, X X X ri = π(i) 1 − αj Fij + αj Fij Wij + π(j)αi Fji (1 − Wji ) j∈V
= π(i) − π(i)
X j∈V
j∈V
αj Fij (1 − Wij ) +
j∈V
X
π(j)αi Fji (1 − Wji ).
j∈V
(69) ε := max εij . i,j∈V
(61)
Thus, for every i, j ∈ V , Tij Fij = 1 − exp − T Tij = + O(ε2 ). T
(62)
In the last two terms, Fij = O(ε), so replacing π(i) and π(j) by αi and αj introduces only O(ε2 ) error. Substituting (68) into (69), we obtain ¯ (1) X f f (i) ri = αi + αi − in − αi αj Fij (1 − Wij ) T T j∈V X + αi αj Fji (1 − Wji ) + O(ε2 ). (70) j∈V
Subtracting (76) from (77) and using (x)+ − (−x)+ = x, we get X X αj Tji (1 − Wji ) − αj Tij (1 − Wij )
Thus, ri − αi αi (1) f¯ − fin (i) X − αj Fij (1 − Wij ) = T j∈V X + αj Fji (1 − Wji ) + O(ε2 )
MPR(i) =
j∈V
j∈V
=
XX
αj αk (Tjk − Tik )+ − (Tik − Tjk )+ + O(T ε2 )
j∈V k∈V
=
j∈V
X 1 ¯ (1) = f − fin (i) − αj Tij (1 − Wij ) T j∈V X + αj Tji (1 − Wji ) + O(ε2 ). (71) j∈V
Equation (71) is the common first-order expression before substituting the tie-breaking rule. C. First-Seen Rule We first derive the expression under the first-seen rule. Under this rule, X Wij = αk pi,j,k , (72)
XX
αj αk (Tjk − Tik ) + O(T ε2 )
j∈V k∈V (1)
= f¯ − fout (i) + O(T ε2 ).
(78)
Substituting this into (71) yields 1 ¯ (1) (1) ¯ MPR(i) = f − fin (i) + f − fout (i) + O(ε2 ) T 1 (1) (1) 2f¯ − fin (i) − fout (i) + O(ε2 ). = (79) T Omitting O(ε2 ) terms gives (FS). D. Random Rule Under the random rule,
k∈V
where pi,j,k is the probability that miner k receives miner i’s block before miner j’s block when miner i starts the round and miner j causes the fork. We use Cond. B in this step. Cond. B implies Tik ≤ Tij + Tjk
T
(74)
Therefore, for all i, j, k ∈ V , Tij (1 − pi,j,k ) = (Tik − Tjk )+ + O(T ε2 ),
1 − α i − αj . 2
(80)
1 − Wij =
1 − α i + αj . 2
(81)
Hence,
(73)
for every i, j, k ∈ V , so the case Tik > Tij + Tjk in the definition of pi,j,k does not occur. If Tik < Tjk , then pi,j,k = 1. Otherwise, Tjk ≤ Tik ≤ Tij + Tjk , and by Cond. A, T −T T exp − ik T jk − exp − Tij pi,j,k = T 1 − exp − Tij T −T T 1 − ik T jk − 1 − Tij = + O(ε) Tij Tij + Tjk − Tik = + O(ε). Tij
Wij = αi +
(75)
Therefore, X 1 (2) 1 − αi (1) fout (i) + fout (i), αj Tij (1 − Wij ) = 2 2 j∈V X 1 + αi (1) 1 (2) αj Tji (1 − Wji ) = fin (i) − fin (i). 2 2
(82) (83)
j∈V
Substituting these into (71), we obtain 1 (2) 1 − αi (1) 1 ¯ (1) MPR(i) = fout (i) − fout (i) f − fin (i) − T 2 2 1 (2) 1 + αi (1) fin (i) − fin (i) + O(ε2 ) + 2 2 1 ¯ 1 − αi (1) = f− fin (i) T 2 1 (2) (1) (2) + fout (i) − fin (i) + fout (i) + O(ε2 ). 2 (84)
where (x)+ := max{x, 0}. Using (75), we obtain X XX Omitting O(ε2 ) terms gives (RD). αj Tij (1 − Wij ) = αj αk (Tik − Tjk )+ + O(T ε2 ), j∈V
j∈V k∈V
X
XX
(76) j∈V
αj Tji (1 − Wji ) =
αj αk (Tjk − Tik )+ + O(T ε2 ).
j∈V k∈V
(77)
E. Last-Generated Rule Under the last-generated rule, Wij = αi .
(85)
Thus, X
(1)
αj Tij (1 − Wij ) = (1 − αi )fout (i),
(86)
j∈V
X j∈V
αj Tji (1 − Wji ) =
X
αj Tji (1 − αj )
j∈V (1)
(2)
= fin (i) − fin (i).
(87)
Substituting these into (71), we obtain 1 ¯ (1) (1) (1) (2) f − fin (i) − (1 − αi )fout (i) + fin (i) − fin (i) + O(ε2 ) MPR(i) = T 1 ¯ (1) (2) f − (1 − αi )fout (i) − fin (i) + O(ε2 ). = T (88) Omitting O(ε2 ) terms gives (LG).