On the Security and Scalability of
Proof of Work Blockchains
Arthur Gervais
ETH Zurich

Scaling Bitcoin 2016 - MilanSynchronization

Broadcast of transactions/blocks• All transactions, blocks
need to be broadcast
into the whole network• Larger blocks
slower propagation
increased consensus
latency• Risks of network
partition (stale blocks…)

2 / 22

Synchronization

Broadcast of transactions/blocks• All transactions, blocks
need to be broadcast
into the whole network• Larger blocks
slower propagation
increased consensus
latency• Risks of network
partition (stale blocks…)

2 / 22

SynchronizationBroadcast of transactions/blocks• All transactions, blocks
need to be broadcast
into the whole network• Larger blocks
slower propagation
increased consensus
latency• Risks of network
partition (stale blocks…)

2 / 22

Synchronization

Broadcast of transactions/blocks• All transactions, blocks
need to be broadcast
into the whole network• Larger blocks
slower propagation
increased consensus
latency• Risks of network
partition (stale blocks…)

2 / 22

Synchronization

Broadcast of transactions/blocks• All transactions, blocks
need to be broadcast
into the whole network• Larger blocks
slower propagation
increased consensus
latency• Risks of network
partition (stale blocks…)
Selfish Mining
Denial of Service
Double Spending
2 / 22

Decentralised PoW Blockchains

Which one is a better Blockchain?

10 minutes

2.5 minutes

1 minute

20 seconds

3 / 22

Decentralised PoW Blockchains

Which one is a better Blockchain?

10 minutes

2.5 minutes

1 minute

20 seconds

Faster block generation

Faster payments

Bigger block size

More payments /slower propagation

3 / 22

Decentralised PoW Blockchains

Which one is a better Blockchain?

10 minutes

2.5 minutes

1 minute

20 seconds

Faster block generation

Faster payments

Bigger block size

More payments /slower propagation

Propagation
TimeMedium
Block size

BitcoinLitecoin

Dogecoin

Ethereum

8.7 s

1.02 s

0.85 s

0.5 - 0.75 s

534.8 KB

6.11 KB

8 KB

1.5 KB3 / 22

Understanding Security / Performance of PoW Blockchains

Contributions
Quantitative Framework
Compare security of PoW blockchains
Account for double-spending and selfish mining
Determine the optimal adversarial strategies
Provide # of secure confirmations depending on tx value
Increasing throughput without penalizing security
Open Source Bitcoin Simulator
Realistic simulation of network and blockchain properties
Flexible reparametrization
Scalable to thousands of nodes
Open Source and documented
4 / 22

Decentralised PoW Blockchains

Blockchain and Forks

Block 1

Block 2Block 3Block 45 / 22

Decentralised PoW Blockchains

Blockchain and Forks

Block 1

Block 2Block 3’Block 4’Block 3Block 45 / 22

Decentralised PoW Blockchains

Blockchain and Forks

Block 3’Block 4’

Staleblocks=lost effort

Block 1

Block 2Block 3Block 45 / 22

Decentralised PoW Blockchains

Blockchain and Forks

Block 3’Block 4’

Staleblocks=
lost effort

Block 1

Block 2Block 3Block 4Block 1’’

Block 2’’Block 3’’Block 4’’Block 5’’5 / 22

Decentralised PoW Blockchains

Blockchain and Forks

Block 3’Block 4’

Staleblocks=
lost effort

Block 1

Block 2Block 3Block 4Block 1’’

Block 2’’Block 3’’Block 4’’

Stale Block rates

Block 5’’

BitcoinLitecoin

Dogecoin Ethereum

0.41%

0.273%

0.619%

6.8%
5 / 22

Security of PoW Blockchains

Double Spending

TXlegitimate- Pays the vendorTXdoublespend - Pays the adversary

B0

B1
TXlegitimate
6 / 22

Security of PoW Blockchains

Double Spending

TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversary
TXdoublespend

B’1

B0

B1
TXlegitimate
6 / 22

Security of PoW Blockchains

Double Spending

TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversary
TXdoublespend

B’1

B0

B’2

B1
TXlegitimate
6 / 22

Security of PoW Blockchains

Double Spending

TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversary
TXdoublespend

B’1

B0

B’2

B1
TXlegitimate
6 / 22Security of PoW Blockchains

Double Spending

TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversary
TXdoublespend

B’1

B0

B1

B’2

B3

TXlegitimate
6 / 22

Security of PoW Blockchains

What is Selfish Mining? [Eyal and Sirer]•

Instead of publishing, keep a block private•

Release block to compete

Other miners will perform wasteful computations
Adversary looses block rewards

7 / 22

Selected findings

Selfish Mining vs. Double Spending
Selfish Mining

Double Spending

Increases relative reward
Not necessarily rational

Increase absolute reward
Economically rational
adversaryConsider them independently

8 / 22

Decentralised PoW Blockchains

Towards a better Blockchain
Blockgeneration

Slowerpayments

SlowerFasterFasterpayments

bettersecuritylesssecurity

Fasterpropagation

Slowerpropagation

BiggerSmaller
Block size

9 / 22

Understanding Security / Performance of PoW Blockchains

Consensus &Network
parameters

Framework

Security
parameters

PoW Blockchain

stale blockrate

Security Model

Block propagation times
Throughput

Optimal adversarial strategy
Security characteristics
10 / 22

Decentralised Blockchain
Consensus &Network
parameters

PoW Blockchain
Blockchain instance can beA real blockchain (e.g. Bitcoin, Ethereum)
Simulated blockchain
Simulator captures (Open Source)
Consensus parameter

Network-Layer
Parameters

Block interval distribution

Block size distribution

Mining power dist.

Geographical distributionof nodes/miners

PoW Blockchain

Stale block rate
Block propagation times
Throughput

Number of connections ofnodes/miners
Propagation Protocol
11 / 22

Decentralised Blockchain
Consensus &Networkparameters

PoW Blockchain
Blockchain instance can be
A real blockchain (e.g. Bitcoin, Ethereum)
Simulated blockchain
Simulator captures (Open Source)
Consensus parameter

Network-Layer
Parameters

Block interval distributionBlock size distribution

Mining power dist.

Geographical distributionof nodes/miners

PoW Blockchain

Stale block rate
Block propagation times
Throughput
Europe, 5.40%

NorthAmerica,23.70%

Asia
Paciﬁc,70.90%

Number of connections ofnodes/miners
Propagation Protocol
11 / 22

Decentralised Blockchain
Consensus &Networkparameters

PoW Blockchain
Blockchain instance can beA real blockchain (e.g. Bitcoin, Ethereum)
Simulated blockchain
Simulator captures (Open Source)
Consensus parameter

Network-Layer
Parameters

Block interval distribution

Block size distribution

Mining power dist.

Geographical distributionof nodes/minersNumber of connections ofnodes/miners
Propagation Protocol

PoW Blockchain

Stale block rate
Block propagation times
Throughput
Europe, 5.40%

NorthAmerica,
23.70%

Australia, 1.66%
Asia Paciﬁc,5.74%

NorthAmerica,
38.69%

Asia
Paciﬁc,70.90%

Japan,
1.19%

SouthAmerica,
1.13%

Europe,51.59%

11 / 22

Decentralised Blockchain

Security Model
Captures optimal adversarial strategies
stale blockfor Selfish Mining
rate
for Double Spending
based on Markov Decision Processes
Security Parameters
Adversarial mining power
Stale block rate
Connectivity of the adversary
Impact of eclipse attacks
Mining costs
Number of required confirmations

Securityparameters

Security Model

Optimal adversarial strategy
Security provisions

12 / 22

Security Model

Markov Decision Process
Extension of Markov Chains
Adds actions and rewards
State space and action space

B’1

B0

B’2

B’3

B1

State: (3, 1)

13 / 22

Security Model

Markov Decision Process
Extension of Markov Chains
Adds actions and rewards
State space and action space

B’1

B0

B’2

B’3

B1

State: (3, 1)
Attacker chain
13 / 22

Security Model

Markov Decision Process
Extension of Markov Chains
Adds actions and rewards
State space and action space

B’1

B0

B’2

B’3

B1

State: (3, 1)
Attacker chain

Honest chain
13 / 22

Security Model

Markov Decision Process
Extension of Markov Chains
Adds actions and rewards
State space and action space

B’1

B0

B’2

B’3

B1

State: (3, 1)
Attacker chain

Honest chain
13 / 22

Security Model

Markov Decision Process
Extension of Markov Chains
Adds actions and rewards
State space and action space

B’1

B0

B’3

B1

State: (3, 1)
Attacker chain

B’2

Reward for adversary: 2
Honest chain
13 / 22

Security Model

Markov Decision Process
Extension of Markov ChainsAdds actions and rewards
State space and action space

B’1

B0
State: (3, 1)
Attacker chain

B1(1, 1)

B’2

B’3

B3
Reward for adversary: 2

Honest chain
13 / 22

Selected findings

How many confirmations required to match security?

vs.

Stale
block rate

6.8 %

0.41 %

14 / 22

Selected findings

How many confirmations required to match security?

vs.
smaller block rewards
higher stale block rate
Staleblock rate

6.8 %

0.41 %

14 / 22

Selected findings

How many confirmations required to match security?

vs.
smaller block rewards
higher stale block rate
Staleblock rate

6.8 %

0.41 %

Matching Blockconfirmations,30% adversary

37

612.4 minutes

60 minutes

Litecoin would require 28, and Dogecoin 47 block confirmations
respectively to match the security of 6 Bitcoin confirmations.
14 / 22

Selected findings

Increasing throughput?
Based on Simulator results
1 MB blocks
1 Minute Block interval

15 / 22

Selected findings

Increasing throughput?
Based on Simulator results
1 MB blocks
1 Minute Block interval

Stale block rate does notincrease substantially

15 / 22

Selected findings

Increasing throughput?
Based on Simulator results
1 MB blocks
1 Minute Block interval

Stale block rate does notincrease substantially

From 7 tps to 60 tps,
without sacrifising security

15 / 22

Selected findings

Selfish Mining under constant difficulty
Mining 1000 blocks
30 % selfish miner mines 209 blocks, instead of 300!
(under optimal strategy)
Eyal and Sirer’s strategy yields on average 205.8 blocks

Selfish Mining yield fewer
block rewards than honest mining.

16 / 22

Selected Findings

Influence of Stale Block rate on Selfish Mining

Relative revenue

1.00.8α = 0.1
α = 0.30.60.4
0.2
0.00.0

Bitcoin

0.1

0.20.3

Stale rate rs

0.40.5

Ethereum

The higher the stale block rate the higher the relative revenue
17 / 22

Selected findings

Double-Spending
Profitability depends on transaction value
Quantifying resilience using minimum vd,
s.t. double-spending is profitable104
α = 0.1
α = 0.3

vd

103
102
101
1000.0

Bitcoin

0.1

0.2

0.3

Stale rate rs
Ethereum

0.40.518 / 22

Selected findings

Double-Spending
Profitability depends on transaction value
Quantifying resilience using minimum vd,
s.t. double-spending is profitable
104103vd

Threshold at
which doublespending is more
profitable thanhonest mining

α = 0.1
α = 0.3

102
101

The higher the vd,
the better

1000.0Bitcoin

0.1

0.2

0.3

Stale rate rsEthereum

0.4

0.5

18 / 22

Selected findings

Necessary confirmations k

Number of required confirmations (Bitcoin)

45
40
3530
25
20
15
105
00.0

vd = $100000
vd = $10000
vd = $1000

0.1

0.2

0.3

0.4

Adversarial mining power α0.519 / 22

Selected findings

108107106105104103102101
100
10−10.0108
Bitcoin, k = 6, $710Ethereum, k = 12, $Ethereum, k = 6, $
106
105
104
103
102
1
10Bitcoin, k = 6, block rew.
Ethereum, k = 12, block rew.
100Ethereum, k = 6, block rew.
10−1
0.1
0.2
0.3
0.4
0.5

vd in $

vd in block rewards

Double Spending Bitcoin vs. Ethereum

Adversarial mining power α

Double-spending resistance ofEthereum (k in {6,12}) vs. Bitcoin (k=6)
20 / 22

Selected findings

Block reward impact
For a fixed transaction value
We show that the higher the block reward (e.g., in USD),
the more resilient it is against double-spending

Merchant can vary the # of confirmations
depending on the transaction value

21 / 22

Summary
Quantitative Framework
Compare PoW blockchains objectively
Selfish Mining not always rational
Double Spending is rational

Blockchain Simulator
http://arthurgervais.github.io/Bitcoin-Simulation/index.html

22 / 22

Summary
Quantitative Framework
Compare PoW blockchains objectively
Selfish Mining not always rational
Double Spending is rational

Blockchain Simulator
http://arthurgervais.github.io/Bitcoin-Simulation/index.html

Block confirmation equivalence6 Bitcoin = 37 Ethereum (20 sec)
= 28 Litecoin (2.5 min)= 47 Dogecoin (1 min)
The higher the block reward in
USD, the more resilient against
double spending
22 / 22

Summary
Quantitative Framework
Compare PoW blockchains objectively
Selfish Mining not always rational
Double Spending is rational

Blockchain Simulator
http://arthurgervais.github.io/Bitcoin-Simulation/index.html

Block confirmation equivalence
6 Bitcoin = 37 Ethereum (20 sec)
= 28 Litecoin (2.5 min)= 47 Dogecoin (1 min)
The higher the block reward in
USD, the more resilient against
double spending

Good block size/interval
1 MB block and
1 Minute block interval+60 transactions/s
without scarifying security(instead of Bitcoin 7 tps)
22 / 22

Summary
Quantitative Framework
Compare PoW blockchains objectively
Selfish Mining not always rational
Double Spending is rational

Blockchain Simulator
http://arthurgervais.github.io/Bitcoin-Simulation/index.html

Block confirmation equivalence
6 Bitcoin = 37 Ethereum (20 sec)
= 28 Litecoin (2.5 min)= 47 Dogecoin (1 min)
The higher the block reward in
USD, the more resilient against
double spending

Thank you!

Good block size/interval
1 MB block and
1 Minute block interval+60 transactions/s
without scarifying security(instead of Bitcoin 7 tps)
22 / 2223 / 22

24 / 22

25 / 22

Decentralised PoW Blockchains

Proof of Work Blockchains

B0

B2

B3

H(B2)

txs

26 / 22

Decentralised PoW Blockchains

Proof of Work Blockchains

B0

B2

B3

H(B2)

txs

Mining• Find Nonce N, s.t. H(H(B3)|txs|N) < target

26 / 22