RPPLNS: Pay-per-last-N-shares with a Randomised Twist
Philip Lazos, Francisco J. Marmolejo-Cossío, Xinyu Zhou, Jonathan Katz
RRPPLNS: Pay-per-last-N-shares with a Randomised Twist ∗Philip Lazos † Francisco J. Marmolejo-Cossío ‡ Xinyu Zhou § Jonathan Katz § February 22, 2021
Abstract “Pay-per-last- N -shares” (PPLNS) is one of the most common payout strategies used bymining pools in Proof-of-Work (PoW) cryptocurrencies. As with any payment scheme, it isimperative to study issues of incentive compatibility of miners within the pool. For PPLNSthis question has only been partially answered; we know that reasonably-sized miners withina PPLNS pool prefer following the pool protocol over employing specific deviations. In thispaper, we present a novel modification to PPLNS where we randomise the protocol in a naturalway. We call our protocol “Randomised pay-per-last- N -shares” (RPPLNS), and note that therandomised structure of the protocol greatly simplifies the study of its incentive compatibility.We show that RPPLNS maintains the strengths of PPLNS (i.e., fairness, variance reduction,and resistance to pool hopping), while also being robust against a richer class of strategic miningthan what has been shown for PPLNS. In Bitcoin, miners maintain a ledger of transactions and are rewarded for their efforts by theunderlying protocol. Successfully appending a block to the ledger is computationally difficult; itcan take common computing equipment years to find a single block in expectation. In response tothis variability, miners often pool their resources so that rather than rarely earning large rewardsthey earn smaller rewards at a more consistent rate.In more detail, we can think of the Bitcoin ecosystem as consisting of n strategic miners, m ,..., m n , with hash powers α , ..., α n >
0, such that P i α i = 1. Intuitively, α i represents theproportional computational power that a miner has. Assuming that block mining happens indiscrete time-steps, the probability that m i mines the next block is equal to α i . The dilemma ofthe previous section corresponds to a single miner having a small α i value, and hence only mining ablock in 1 /α i time steps in expectation. On the other hand, a set of S miners could combine theircomputational power and have a P m i ∈ S α i chance of mining the next block, sharing the rewards ifthey manage to do so.In order to share rewards, the pool must have a way of identifying the computational contri-bution of each miner. This is done by accepting partial proofs of work, which are “near-misses” to ∗ Philip Lazos is supported by the ERC Advanced Grant 788893 AMDROMA “Algorithmic and Mechanism DesignResearch in Online Markets” and the MIUR PRIN project ALGADIMAR “Algorithms, Games, and Digital Markets.” † Sapienza University of Rome: [email protected] ‡ University of Oxford, IOHK: [email protected] § University of Maryland: [email protected] and [email protected] a r X i v : . [ c s . G T ] F e b itcoin’s desired hash rate and whose number is directly proportional to the computational effortspent on extending the blockchain. The pool operator collects these “near-misses”, called shares,reported by every miner in the pool, and uses them to distribute payments once an actual block isfound. Ideally, participating in a pool should have (at least) the following guarantees:1. Fairness: miners earn the same block reward in expectation as mining alone.2. Variance reduction: for any fixed amount of time, miners have lower variance in block rewardthan when mining alone.3. Robustness against pool hopping: at no point of time is there is a benefit in leaving the poolfor another one or leaving the pool to mine individually.4. Incentive Compatibility: to maximize their reward, each participating miner should alwaysexpend maximum effort and report shares/blocks immediately as they are generated.One of the most popular pool mining protocols which (partially) satisfies these properties is“Pay-per-last- N -shares” (PPLNS). Miners report shares to a pool operator which maintains a queueof the N most recent shares reported to it, and if a block is found and reported by the pool, theowners of these N shares are paid proportionally (1 /N times the value of a block for each suchshare). The structure of PPLNS is such that it satisfies properties 1-3 above [10]. With respect toproperty 4, [14, 12] demonstrate that miners in a PPLNS are incentivised to act honestly if theyare only permitted specific deviations, hence PPLNS only partially satisfies property 4. Our Contributions.
In this paper, we present a novel modification to PPLNS where we ran-domise the protocol in a natural way. We call our protocol “Randomised pay-per-last- N -shares”(RPPLNS), and note that the randomised structure of the protocol greatly simplifies the study ofits incentive compatibility. We show that RPPLNS maintains the strengths of PPLNS (i.e., fair-ness, variance reduction, and resistance to pool hopping), while also being robust against a richerclass of strategic mining than what has been shown for PPLNS. In particular, Schrijvers et al. [12]showed that PPLNS is robust when strategies are limited to either mining honestly or secretlyhoarding all accumulated shares and suddenly releasing them if a block is found. For RPPLNS weprovide experimental evidence that suggests that mining honestly maximizes rewards among anystrategy involving hoarding and releasing shares. The structure of the paper is as follows: in Section 1.2 we present related literature, and in Section2 we define a formal framework for pool mining protocols that encompasses PPLNS and RPPLNSin a language that is amenable to a rigorous mathematical analysis of their properties. Section 3holds the key results of our paper where we describe RPPLNS and prove its desirable properties.In Section 4 we give a theoretical justification for why specific (improbable) initial pool states giverise to strategic mining in both PPLNS and RPPLNS. Finally, in Section 5 we describe possiblefurther areas of research.
Our work follows a line of research in the game theoretic aspects of cryptocurrencies. Strategicmining has been studied from the inception of Bitcoin when Nakamoto suggested the robustness2f Bitcoin to double-spend attacks [7]. Subsequently, this area of research has taken multipledirections. In [3], the authors demonstrate that honest mining is not robust to strategic miningin terms of block reward, even when a miner has less than a majority computational stake in theBitcoin ecosystem, by exhibiting a specific mining strategy, selfish mining. This work is refined in[11], [8] and [4] by generalising selfish mining, pairing selfish mining with network-level attacks andproving limited incentive compatibility of honest mining if miners have low enough hash power.Further incentives at the individual miner level have also been studied in [1] where transactionrewards alone are demonstrated to be unstable for incentive compatibility of mining. At the poollevel, the author of [2] demonstrates an infiltration attack pools can wage against each other thatleads to an iterated prisoner’s dilemma between pool operators (dubbed the miner’s dilemma).This has been further refined in [5] where a judicious refinement of an infiltration attack can avoidthe miner’s dilemma, so that larger pools benefit from attacking at a cost to smaller pools.This aforementioned direction of research is mainly involved with strategic mining with respectto block rewards, but our work is dedicated to strategic mining within pools with specified paymentprotocols (see [10] for an extensive survey of pool protocols). In [12], the authors study incentivecompatibility in pool protocols that decide how to make payments on the basis of the quantity ofshares each miner reported, irrespective of the order in which they are received. In this setting,they give necessary conditions for when behaving honestly dominates strategic hoarding of sharesand blocks for pool miners. Not only do they show that certain popular strategies are not incentivecompatible or budget-balanced (proportional payment, fixed payment per share), but they alsoprovide an incentive-compatible pool protocol that is budget-balanced in this setting where theorder of shares are irrelevant to the pool operator. A PPLNS pool fundamentally needs the orderin which shares are submitted to decide how much to pay miners, hence the previous results donot hold for PPLNS. For this reason, the authors in [12] also partially answer the question ofwhether PPLNS is an incentive compatible mining pool scheme, by showing that at small enoughhash powers and large enough share difficulty levels, honest mining is robust against the specificstrategic deviation in which miners keep a single share private with the hopes of finding a subsequentblock to ensure said private share is paid, by publishing it immediately before revealing a block.Subsequently, the authors of [14] study a different class of strategic deviations in PPLNS where aminer hoards a certain number x ∈ N of shares. Subsequent shares are published immediately, andwhenever a block is found, those x shares are published immediately before publishing the block.Their analysis makes the assumption that each strategic miner reaches their threshold x , and showwhen being honest outperforms being strategic in this setting. Finally, the authors of [9] exhibitspecific reporting strategies that can be beneficial to strategic miners at high enough hash rates. In this section we give a framework for studying miner incentives in PPLNS and RPPLNS miningpools. To do so, we begin with a high-level overview with key aspects of pool protocols.
In general, the pool operator prepares the ‘template’ of the next block in advance to send to itspool miners: this contains all the information about where the next block should be added andwhat it should contain. Then, pool miners try to fill in different nonce values at an attempt to3btain a valid block (i.e., one with a low enough hash value) whose rewards will be claimed by thepool and redistributed to its miners. When mining solo (rather than as a part of a pool), minersobtain an expected reward proportional to their hash power. In order to fairly redistribute rewards,a pool needs a proxy to measure the computational resources a miner is contributing to the pool’soperations. This is done by allowing pool miners to send the pool operator near-misses (also called shares in this context) to the Bitcoin difficulty threshold. In our full exposition of mining poolrules, we assume the following: that there is a mining pool composed of k miners, which will callpool miners, and that all miners outside the pool (non-pool miners) are honest, and hence can bemodelled as a single honest miner. The reason we model the other miners as a single honest entityis due to the fact that we focus on strategic mining deviations within the pool protocol only. Poolminers are denoted by m , ..., m k , and the non-pool miner by m . As before, the i -th miner hashash power α i . Valid Share / Block Generation.
The first relevant parameter that the pool must set is the relative difficulty of blocks to shares, which can be parametrised by a non-negative number D ≥ m i with probability α i . Furthermore, each share has a 1 /D probability ofbeing a block. A block can be thought of as a share that gives the pool a reward to be distributedamongst its miners. Messages to the Pool.
At any given time-step, the pool receives messages from miners whichcan be of the form share i or block i if m i reports a share or block respectively to the pool . Wedenote the set of messages the pool operator can receive by M . Honest and Strategic Pool Mining.
For all pool mining schemes, we say that a pool mineris honest if they mine upon the block given by the pool operator and if they report shares/blocksimmediately. For independent miners, we say they are honest if they publish blocks they findimmediately (The concept of a share is irrelevant outside the pool). Consequently, strategic minershave the possibility of arbitrarily hoarding shares and blocks (valid messages of the form share i or block i ) to be published at a time after they are found. It is crucial to note that the mechanics ofpool mining are such that these deviations do not come without a potential cost. Pool miners areall given a block template to work on, and shares are near-misses to the hash of a block within thistemplate. If a miner is hoarding shares/blocks and another honest pool miner publishes a block tothe pool, these shares/blocks are no longer valid and the pool will not pay the owner of them. Thesame scenario happens if an honest miner outside the pool mines a block. Strategic miners musttherefore balance this risk while hoarding. Furthermore, if hoarding is beneficial for some miners,the pool’s overall quality degrades in two ways: for them to increase their payoff some other minerswill have to earn less and there is potential for decreased computational efficiency as some workmight be performed twice. Payments.
Pool operators maintain a history of messages received and as a function of thishistory decide how to redistribute block rewards to pool miners. Notice that since the pool sets the m only sends block messages to the pool due to the fact that the concept of a share only makes sense for poolminers. On the other hand, a block message from m corresponds to the pool becoming aware of said block on theglobal blockchain itself. budget balanced . At a high level, PPLNS pools are simple to understand. A pool operator sets a relative block toshare difficulty, D , and a queue size parameter, N ∈ N . Pool miners report shares and blocks to thepool operator, which in turn maintains a queue of length N consisting of the the most recent sharesreported. If ever a block is found, the pool operator pays the shares in the queue proportionally.This process can be visualised in Figure 1.Since we are studying strategic mining deviations, we have to precisely define the pool protocol,as this will govern whether miners are incentivised to be honest in the first place. We do thisby modelling PPLNS as a deterministic state machine . At any given moment, the pool operatormaintains a state s ∈ S = ( {∗} ∪ [ n ]) N . S represents the state space of the PPLNS queue (allpossible queue compositions), where “ ∗ ” represents an empty value while the queue is filled in thefirst N messages the pool operator receives. Furthermore, we let s = ( ∗ ) Ni =1 be a distinguishedinitial state of the pool protocol that corresponds to an empty queue.As with any state machine, we need to define a transition function between states. We recall that M denotes the set of messages that a pool operator can receive, hence we can specify a transitionfunction T : S × M → S . For a given message from the i -th pool miner (meaning i = 0), x = share i or x = block i , T ( s, x ) = i : s Suppose that m is honest with hash power α , then their expected per-turn blockreward is αD in an RPPLNS mining pool. In addition, the variance of their per-turn block rewardis D ( α − α ) + αND Proof. Suppose that m finds a share and sends it to the pool manager. Let X be the randomvariable that specifies how much revenue that share makes over its lifetime in the bag, Z . SinceRPPLNS is a push-pay protocol, this means that Z − N − 1, since the first turn a share is sent to the protocol it is automatically added to the bag and7hus elligible for payment, whereas once the share is kicked out of the bag it is not elligible for thesubsequent turn’s payment. At each turn over the lifetime of the the share in the bag, let Y i be theindicator random variable for whether any miner in the pool (i.e. m or m ) finds a full solution atthe i -th turn (including the initial turn when the share is found, as a share can be a full solutionas well). This means that the revenue of the share at the i -th turn is Y i /N . X = Z X i =1 ( Y i /N )Clearly each of the Y i is iid, hence we can use Wald’s equation to get E ( X ) = E ( Z ) E ( Y i ) = ( N )(1 /N D ) = 1 /D With this in hand, we know that the expected revenue of an honest miner in any given turn is theprevious expression multiplied by the probability of getting a share (including a share that is a fullsolution). Thus the expected revenue of the m is E ( R ) = α/D As for the second part of the theorem, we wish to compute the variance of X . To do so, wecompute E ( X ): E ( X | Z ) = 1 N E Z X i =1 Y i | Z ! The inner sum can be expressed as X i Finally, this means that the second moment of the revenue is E ( R ) = αD + αN D which in turn tells us the variance is var ( R ) = E ( R ) − E ( R ) = 1 D ( α − α ) + αN D 8n deterministic PPLNS, block reward variance can be computed in an identical fashion, andit is α D + αND − α D − α ND . Typically, pools have N = 2 D , in which case the PPLNS variancebecomes D ( α − α ) − α D . For this difficulty setting, RPPLNS block reward variance becomes D ( α − α ) + α D . Though this is more than with standard PPLNS, this still vanishes at the sameasymptotic rate of O (1 /N ) when N = Θ( D ). In this section, we prove that RPPLNS generally results in an exponential reduction in the statespace M needs to implement the protocol. Theorem 2. Suppose that M is a mining pool with m miners. In order to implement PPLNS withparameter N , M needs at least m N states, whereas M can implement RPPLNS with parameter N using at most N ( N + m − m − ( m − states.Proof. The first part of the theorem is clear from the definition of PPLNS. We focus on the statethat PPLNS needs once the queue is full after the initial N turns. Essentially M needs to keeptrack of a sliding window of the ownership of the shares sent to it. Since the messages sent to M can only come from [ m ], there are thus m N many such sequences.As for the second part of the claim, we begin by focusing on the states used once the bagis full after N turns. We notice that the set of all possible partitions of N bag shares into m owners is in one-to-one correspondence with non-negative integral points of the m − N : N ∆ m − = { x ∈ R m − | ∀ i x i ≥ , and k x k ≤ N } . In [13], thisis shown to be upper bounded by ( N + m − m − ( m − . For the first N transitions of the protocol, wenotice that the set of all possible partitions of k < N bag shares into m owners is in one-to-onecorrespondence with non-negative integral points of k ∆ m − (cid:40) N ∆ m − , hence by a union boundwe get | S Nk =1 k ∆ m − | ≤ N | N ∆ m − | ≤ N ( N + m − m − ( m − as desired.To put Theorem 2 into perspective, it is often the case that m << N , so if we let m = O (1)and consider the cardinality of the state space as a function of N , we get that for PPLNS this isexponential in N : O ( m N ) and for RPPLNS this is only polynomial in N : O ( N m ). Similarly, noticein addition to this, how in PPLNS, if M wishes to communicate to a specific miner the state of hisshares, this requires N bits, as the miner needs to know the position of all his shares in the queue.On the other hand, RPPLNS only needs to communicate log N bits, due to the fact that it sufficesto tell miners how many shares they have in the bag, as there is no sequentiality in the bag. In this section we show that if a miner is given the choice between mining with two differentRPPLNS pools, then in expectation he will always earn the same block reward, irrespective of theinitial state of his shares in each pool and how he may choose to partition his mining between saidpools. In order to prove this, suppose that there is a single miner m of hash power α , and twoRPPLNS pools, M i for i ∈ { , } . Furthermore, suppose that each M i has bag size N i , hash power β i and difficulty D i , so that on average, M i mines one block every D i shares.Previously we studied fairness of a single mining pool, and hence we could model share/blockmining as a turn-based process, where each turn a share is found, and ownership is dictated by9gent hash rates. Having a turn-based approach with multiple pools is more fickle however, sincepools may have different share difficulties, and hence the expected duration of such a turn in thecontinuous-time mining process may be different. For this reason, in this section we instead considera continuous-time mining process.As is standard, we assume that share/block mining follows a Poisson process. We furtherassume that time units are normalised so that the expected time it takes for a block to be mined bythe entire mining ecosystem is one time unit. Given this assumption, it follows that if a η ∈ [0 , M i for T time units, then in expectation ηD i T shares are found in M i for i ∈ { , } . Given these observations, we are in a position to provethat RPPLNS is pool-hop-proof. Theorem 3. Suppose that m has A i shares in M i for i ∈ { , } at time t = 0 . Furthermore,suppose that { I , ..., I k } is an arbitrary finite disjoint collection of closed intervals of [0 , T ] , suchthat I ‘ = [ x ‘ , y ‘ ] , where T is arbitrary as well. Let T = ∪ ki =1 I i and T = [0 , T ] \ T and supposethat m mines for M i for each T i , i ∈ { , } , respectively. Then the expected lifetime block rewardof m for residual shares A , A and shares/blocks mined in [0 , T ] is A D + A D + αT .Proof. We first derive the expected payoff m obtains from A i residual shares in M i . Since the poolmanager will remove one share out of queue randomly whenever a new share arrives, the expectednumber of these A i residual shares will shrink exponentially as new shares come in. After n newshares, the expected number of residual shares will be A i (cid:16) N i − N i (cid:17) n − . Furthermore, every time ashare is found, it has a D i chance of being a full solution, in which case every share m has in thebag pays N i block reward. This means that the total expected lifetime payoff from these A i sharescan be written as, 1 D i A i N i N i − N i + (cid:18) N i − N i (cid:19) + . . . ! = 1 D i A i N i − N i − N i = A i D i . It only remains to compute the expected lifetime block reward m obtains from shares/blocksmined during [0 , T ]. In what follows we let | T | = P ki =1 | y i − x i | and | T | = T − | T | denote theamount of time m mines in M i during [0 , T ]. We note that during T , a total of α + β hash poweris being contributed to M . This means that M mines D | T | ( α + β ) shares in expectation duringduring this time. Furthermore, every share has a αα + β probability of belonging to m , therefore m finds D α | T | shares for M in T . Furthermore, as we saw in Theorem 1, each of these sharesearns D block reward over its lifetime in expectation, therefore the total lifetime block rewardsfrom shares found for M in [0 , T ] is α | T | in expectation. In an identical fashion we can showthat the lifetime rewards for shares found for M in [0 , T ] is α | T | . Putting everything together,this means that the total expected lifetime reward for the residual shares A , A and newly foundshares in [0 , T ] is A D + A D + αT as desired.The fact that the expected lifetime reward is an expression that is independent of the partition, T , precisely implies that RPPLNS is robust to pool-hopping. Furthermore, it is straightforwardto generalise Theorem 3 to encompass a choice of hopping between an arbitrary number of pools,yielding the same robustness to pool-hopping in this setting.10 .4 Steady State of Honest Pool for RPPLNS In this section we show that the number of shares m has in the bag of size N can be modelled asan ergodic Markov chain. We explicitly derive the steady state distribution and use it to computethe expected number of shares the miner has in the bag in the honest steady state. Let us suppose that miner m currently has i ∈ { , ..., N } shares in the bag and is honest. Withprobability α , m finds a block/share and publishes it to the pool operator. Conditional to this,with probability iN , the number of shares stays the same, i → i , and with probability N − iN , thenumber of shares increases by one, i → i + 1. On the other hand, m finds a block/share andpublishes it with probability β . Conditional to this, with probability iN , the number of shares goesdown by one, i → i − 1, and with probability N − iN , the number of shares stays the same. Clearly,this induces an ergodic Markov chain on the state space S = { , ..., N } . Suppose that π = ( π i ) Ni =1 ,is the unique honest steady state distribution over S . Theorem 4. For the steady state distribution π of miner shares in the RPPLNS bag: π k = (cid:0) Nk (cid:1) (cid:16) αβ (cid:17) k (cid:16) αβ (cid:17) N , for k = 0 , ..., N. Furthermore, the expected number of shares in the bag under π is N (cid:18) αα + β (cid:19) . Proof. From the topology of the chain, we can make a cut-set between S i = { , ..., i } and S ci = { i + 1 , ..., N } for i = 0 , ..., N − 1. From steady state conditions it follows that π must satisfy π i P i → i +1 = π i +1 P i +1 → i for all such cut-sets. It follows that P i → i +1 = α N − iN , and P i +1 → i = β i +1 N .As a consequence, we obtain π i +1 π i = αβ (cid:16) N − ii +1 (cid:17) = f ( i ). Using this expression we know that π i +1 = f ( i ) π i for all i = 0 , ..., N − 1, consequently π k = (cid:16)Q k − j =0 f ( j ) (cid:17) π = π (cid:0) Nk (cid:1) ( αβ ) k for all k . Thefinal step in obtaining the steady state is normalising the sum of all terms, which corresponds to P Nk =0 π k = π P Nk =0 (cid:0) Nk (cid:1) ( αβ ) k . Using the well-known expansion for (1 + x ) n , we get that this is π (cid:16) αβ (cid:17) N . As a consequence, it follows that for π to be a steady state, we need π = (cid:16) αβ (cid:17) − N and consequently: π k = (cid:0) Nk (cid:1) (cid:16) αβ (cid:17) k (cid:16) αβ (cid:17) N , k = 0 , ..., N Now we wish to compute the expected number of shares in the bag in the steady state by usingour expression π . To do so, let us first define f ( x ) = (1 + x ) n for n ∈ N and x ∈ R . We know that f ( x ) = P nk =0 (cid:0) nk (cid:1) x k . Therefore, nx (1 + x ) n − = x ddx f ( x ) = P nk =0 (cid:0) nk (cid:1) kx k . We use this formula tocompute the expectation over π , E π = P Nk =0 kπ k .11 π = N X k =0 kπ k = (cid:18) αβ (cid:19) − N N X k =0 Nk ! k (cid:18) αβ (cid:19) k = (cid:18) αβ (cid:19) − N N (cid:18) αβ (cid:19) (cid:18) αβ (cid:19) N − = N (cid:18) αα + β (cid:19) As a first consequence, note that this also constitutes a proof that RPPLNS is fair if everyone ishonest. The reason for this is that in each turn, we suppose that one of either m , m or m find ashare with probability α, β, γ respectively, and each share has a further probability of D of being afull solution. Thus the probability that a single turn ends up paying agents from the pool is precisely α + βD . As a consequence, the expected payment to m in the steady state is ( E π ) (cid:16) α + βND (cid:17) = αD , whichis precisely the expected per-turn payment of m mining solo. We recall that we are in the setting of a single pool miner being strategic. In other words we have m , m and m of hash powers α , β and γ respectively. We wish to find conditions such that m is honest (i.e. publishes shares and blocks to M R immediately). Given this setting, at any givenmoment, we describe the state of m within the system with a tuple ( ‘, s, b ) ∈ [ N ] × { , } . ‘ represents the shares m has in the bag of the pool, s represents the private shares of m , and b represents whether m has a private block or not. Note that b ≤ s ≤ N is notwithout loss of generality, since technically a selfish miner could hoard an infinite amount of shares.However, it is reasonable to assume that α < . s will reach values higher than N , given a typical difficulty such as D = N/ 2. Furthermore, as we will soon see, any time anagent other then m finds a block, private shares are invalidated, hence further making it difficultto hoard a large amount of private shares. The benefit of upper bounding s and b is significant, asthe state space becomes finite. Let g k ( ‘, s, b ) be the maximum revenue a strategic miner can obtain when acting optimally startingat g ( ‘, s, b ), after exactly k shares in total have been mined by his pool. The parameter k isnecessary for the recursion to prevent it from being open ended. g k ( ‘, s, b ) = max A ( m waits and s < N )B ( m waits and s = N )C ( m publishes a share)D ( m publishes a block) (1)We present the expressions for A, B, C and D in the following sections.12 .5.2 m Waits and s < N When m waits and s < N , there are 6 immediate outcomes:• m gets a block. Call this event “ a ” which happens with probability α (cid:16) D (cid:17) . The resultingstate is ( ‘, s, m gets a share. Call this event “ b ” which happens with probability α (cid:16) D − D (cid:17) . The resultingstate is ( ‘, s + 1 , b ).• m gets a block. Call this event “ c ” which happens with probability β (cid:16) D (cid:17) . Since m ishonest, he publishes this block and the private shares and blocks of m are rendered obsolete.This means that with probability ‘N a share of m is kicked out of the bag resulting in state( ‘ − , , 0) and m getting paid ‘ − N . With probability N − ‘N a share of m is kicked out of thebag resulting in state ( ‘, , 0) and m getting paid ‘N .• m gets a share. Call this event “ d ” which happens with probability β (cid:16) D − D (cid:17) . Since m ishonest, he publishes this share. This means that with probability ‘N a share of m is kickedout of the bag and the resulting state is ( ‘ − , s, b ), and with probability N − ‘N a share of m is kicked out of the bag and the resulting state is ( ‘, s, b ).• m gets a block. Call this event “ e ” which happens with probability γ (cid:16) D (cid:17) . Since m ishonest, he publishes this block and the private shares and blocks of m are rendered obsolete.This means that the resulting state is ( ‘, , m gets a share. Call this event “ f ” which happens with probability γ (cid:16) D − D (cid:17) . In this casethe state remains at ( ‘, s, b )We can now get an expression for A in the recursion for g k : A = α (cid:18) D (cid:19) g k − ( ‘, s, 1) + α (cid:18) D − D (cid:19) g k − ( ‘, s + 1 , b )+ β (cid:18) D (cid:19) (cid:18) ‘N g k − ( ‘ − , , 0) + N − ‘N g k − ( ‘, , 0) + ‘N (cid:19) + β (cid:18) D − D (cid:19) (cid:18) ‘N g k − ( ‘ − , s, b ) + N − ‘N g k − ( ‘, s, b ) (cid:19) + γ (cid:18) D (cid:19) g k − ( ‘, , 0) + γ (cid:18) D − D (cid:19) g k − ( ‘, s, b ) m Waits and s = N This case is almost identical to the above. The only difference is in event b : when m gets a share.Since we don’t want to consider an infinite state space, we will assume that upon obtaining N private shares, m will always publish subsequent mined shares. Since N is usually quite large, theprobability of even obtaining this state is small.• m gets a share. Call this event “ b ” which happens with probability α (cid:16) D − D (cid:17) . m will publishthis share. Hence the resulting state is ( ‘, s, b ) = ( ‘, N, b ).13ith identical reasoning to the above, we get the following expression for B : A = α (cid:18) D (cid:19) g k − ( ‘, N, 1) + α (cid:18) D − D (cid:19) g k − ( ‘, N, b )+ β (cid:18) D (cid:19) (cid:18) ‘N g k − ( ‘ − , , 0) + N − ‘N g k − ( ‘, , 0) + ‘N (cid:19) + β (cid:18) D − D (cid:19) (cid:18) ‘N g k − ( ‘ − , N, b ) + N − ‘N g k − ( ‘, N, b ) (cid:19) + γ (cid:18) D (cid:19) g k − ( ‘, , 0) + γ (cid:18) D − D (cid:19) g k − ( ‘, N, b ) m Publishes a Share If the current state of the system is ( ‘, s, b ), then by publishing a share, there is a ‘N probabilitythat a share belonging to m is kicked out of the bag, resulting in the state ( ‘, s − , b ). Thereis a N − ‘N probability that a share belonging to m is kicked out of the bag, resulting in the state( ‘ + 1 , s − , b ). Note that a share is not actually mined, therefore the recurrence does not involve g k − . Putting this together, we get the following value of C : C = ‘N g k ( ‘, s − , b ) + N − ‘N g k ( ‘ + 1 , s, b ) m Publishes a Block If the current state of the system is ( ‘, s, b ), then by publishing a block, there is a ‘N probabilitythat a share belonging to m is kicked out of the bag, resulting in the state ( ‘, s − , b ) and m earning ‘N . There is a N − ‘N probability that a share belonging to m is kicked out of the bag,resulting in the state ( ‘ + 1 , s − , b ) and m earning min( N,‘ +1) N . Putting this together, we get thefollowing value of D : D = ‘N (cid:18) ‘N + g k ( ‘, , (cid:19) + N − ‘N (cid:18) min( N, ‘ + 1) N + g k ( ‘ + 1 , , (cid:19) Observe that since the state space is finite the value obtained per ‘step’ k is at most 1, the followinglimit is well defined for all ( l, s, b ): φ ( l, s, b ) = lim k →∞ g k ( l, s, b ) k . This φ ( l, s, b ) can be thought of as the potential of state ( l, s, b ). Comparing φ values of differentstates, we can deduce where the miner obtains higher payoffs.To tell for which α, β, N , and D honest mining is a dominant strategy, we need to check the following conditions: φ ( ‘ + 1 , , ≥ φ ( ‘, , 0) when ( ‘ ) ∈ [ N ] . (2) N − ‘N · φ ( ‘ + 1 , , 0) + ‘N · φ ( ‘, , ≥ φ ( ‘, , 1) when ( ‘ ) ∈ [ N ] , (3)where Eq. (2) and Eq. (3) show that releasing shares and blocks respectively is at least as good ashoarding them. 14 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.05 Honest MiningHoard SharesHoard Blocks 0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.10 Honest MiningHoard SharesHoard Blocks 0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.15 Honest MiningHoard SharesHoard Blocks0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.20 Honest MiningHoard SharesHoard Blocks 0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.25 Honest MiningHoard SharesHoard Blocks 0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.30 Honest MiningHoard SharesHoard Blocks Unfortunately we cannot solve exactly for φ , but we can approximate it well enough given highenough k to observe if strategic mining is an option. We will use g k as defined in Eq. (1) with onedifference: if state ( l, N, b ) is reached the miner is rewarded 1 and jumps to state ( N, , g k for large enough k , we can then check Equation (2) as it is. For Equation (3)we need the following small adjustment: N − ‘N (cid:18) ‘ + 1 N + g k ( ‘ + 1 , , (cid:19) + ‘N (cid:18) ‘N + g k ( ‘, , (cid:19) > g k ( ‘, , 1) when ( ‘ ) ∈ [ N ] . This is because as k goes to infinity, the immediate rewards ( ‘ + 1) /N and ‘/N vanish comparedto the potential of the three states involved (as φ is defined by diving with k ). Since we are workingwith finite k , we need to plug them back in. To understand the behaviour of the miners, we explicitly compute the truncated recursion in Section3.5 for N = 1000 , D = 500 and k = 150. Each of the following graphs shows the best action for m given an initial fraction of shares in the bag, which we call F . For F ≤ . 35, we have:In this regime of F values, the strategic miner begins by controlling but a few shares of thebag, and his best option is often to hoard a block. This is because they expect to be able to add acouple more shares to the bag before someone else manages to mine another block and invalidatetheir private block. In Section 4 we formally demonstrate that for common difficulty settings of D = Θ( N ) (typically D = N/ α = Ω(1 /N ), and a pool miner has no shares in the bag, then15 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.75 Honest MiningHoard SharesHoard Blocks 0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.80 Honest MiningHoard SharesHoard Blocks 0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.85 Honest MiningHoard SharesHoard Blocks0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.90 Honest MiningHoard SharesHoard Blocks 0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 0.95 Honest MiningHoard SharesHoard Blocks 0 . . . . . . m . . . . . . m Fraction of Shares Owned by m : 1.00 Honest MiningHoard SharesHoard Blocks hoarding a block for a single turn dominates behaving honestly. This behaviour is not unique toRPPLNS though, as we also demonstrate in the same section that for similar hash rates, if a poolminer is facing an empty queue in PPLNS, they will hoard a private block with hopes of finding ashare in subsequent turns.What is most interesting though, is that if we recall our derivations of the steady state of bagshares from Section 3.4, strategic block hoarding only occurs at hash rates and F values such that F is in fact much less than the expected number of bag shares in the steady state. This suggeststhat if all miners behave honestly, a single pool miner is more likely to find himself at a state wheremining honestly is a dominant strategy.On the other hand, for initial share distributions, 0 . ≤ F ≤ . 70, our recursions suggest thathonest mining is the best option throughout. We have omitted graphs of these cases since theysimply paint the simplex red entirely. Finally, when F ≥ . 70, as in the low initial share regime,we see that strategic behaviour arises once more, though this time in the form of hoarding sharesrather than blocks. For example, it is not difficult to see that if F = 1, then in both PPLNS andRPPLNS hoarding a share dominates publishing it immediately, as doing so has no effect on thestate of the pool.Once again, share hoarding becomes a better strategy at initial share distributions that are farfrom the expected share distribution of the steady state of bag shares from Section 3.4. This onceagain suggests that states where miners act strategically are more rare than those where a mineris honest. As seen in our empirical results, there are parameter settings in which we see strategic pool miningin RPPLNS. In this section we theoretically justify why this is the case for block hoarding inparticular. 16 .1 PPLNS We assume that there is a single strategic pool miner, m with hash power α . This miner operateswithin a PPLNS mining pool with hash power α + β , where the honest miners in the pool can beconsidered as a single honest pool miner m . Finally, we let m represent all other honest minersin a system with collective hash power γ = 1 − α − β .Let us suppose that m has no shares in the pool queue and that he currently holds a validblock he could send to the pool operator. We compare two mining strategies over a two-elementdecision window. If m is honest, he will immediately publish this block, wait one more turn to seewho receives a share/block, and subsequently act honestly (publish a new share/block immediatelyif found). On the other hand, we consider a one-time strategic deviation by m as follows: m hoards the current block he has, and waits one more turn to see what occurs. If he receives a share,he publishes the share before his held block. In all other scenarios he acts honestly. We call thehonest strategy H and the strategic deviation S . Theorem 5. If α > N + D − D − , then S is a strictly dominates H .Proof. How H and S perform depends on precisely one of 6 cases:• m finds a block in the next turn. This case occurs with probability α D .• m finds a share in the next turn. This case occurs with probability α D − D .• m finds a block in the next turn. This case occurs with probability β D .• m finds a share in the next turn. This case occurs with probability β D − D .• m finds a block in the next turn. This case occurs with probability γ D .• m finds a share in the next turn. This case occurs with probability γ D − D .First we focus on the expected payoffs H receives in each of these cases:• Here m publishes two blocks back to back. This results in an immediate reward of N . Theolder block is still eligible for payment for N − N − N − ND + N − ND . Overall we denote this expected revenue by H = N + N − ND + N − ND .• Here m publishes a block and then a share. This results in an immediate reward of N .As before, the older share is alive for N − N − 1, hencetheir expected future payment is N − ND + N − ND . Overall we denote this expected revenue by H = N + N − ND + N − ND .• Here m publishes a block and m subsequently publishes a block. This results in an imme-diate reward of N . The first block is alive for another N − N − ND . Overall we denote this expected revenue by H = N + N − ND .• Here m publishes a block and m subsequently publishes a share. This results in an imme-diate reward of N . The first block is alive for another N − N − ND . Overall we denote this expected revenue by H = N + N − ND .17 Here m publishes a block and m subsequently finds a block. The latter event has no bearingson the pool, hence this is equivalent to m publishing a single block, which gives an immediatereward of N and since this block is alive for another N − N − ND . Overall we denote this expected revenue by H = N + N − ND .• Here m publishes a block and m subsequently finds a share. The latter event has no bearingson the pool, hence this is equivalent to m publishing a single block, which gives an immediatereward of N and since this block is alive for another N − N − ND . Overall we denote this expected revenue by H = N + N − ND .Given our previous expressions, we can write the expected revenue m obtains from using H by R H = H (cid:18) αD (cid:19) + H (cid:18) α ( D − D (cid:19) + H (cid:18) βD (cid:19) + H (cid:18) β ( D − D (cid:19) + H (cid:18) γD (cid:19) + H (cid:18) γ ( D − D (cid:19) We proceed to compute revenues for the strategic deviation S :• Here m hoards a block and then receives a new block. This forcibly invalidates a singleblock hence, hence m only gets an immediate reward of N and subsequently this block livesanother N − N − ND . Overall we denote thisexpected revenue by S = N + N − ND .• Here m hoards a block and then recieves a share, publishing the share first and then theblock. This results in an immediate reward of N . Subsequently the latter share is alive for N − N − 1, hence the expected future payoff of these is N − ND + N − ND .Overall we denote this expected revenue by S = N + N − ND + N − ND .• Here m hoards a block and m publishes a block. This invalidates the secret block and m gets no revenue. We denote this by S = 0.• Here m hoards a block and m publishes a share. m only gets an immediate reward of N and subsequently this block lives another N − N − ND . Overall we denote this expected revenue by S = N + N − ND .• Here m hoards a block and m publishes a block. This invalidates the secret block and m gets no revenue. We denote this by S = 0.• Here m hoards a block and m publishes a share. m only gets an immediate reward of N and subsequently this block lives another N − N − ND . Overall we denote this expected revenue by S = N + N − ND .Given our previous expressions, we can write the expected revenue m obtains from using S by R S = S (cid:18) αD (cid:19) + S (cid:18) α ( D − D (cid:19) + S (cid:18) βD (cid:19) + S (cid:18) β ( D − D (cid:19) + S (cid:18) γD (cid:19) + S (cid:18) γ ( D − D (cid:19) R S > R H . R S − R H = − αD (cid:18) N + N − DN (cid:19) + α ( D − DN − βD (cid:18) N + N − N D (cid:19) + β ( D − D (cid:18) N D (cid:19) − γD (cid:18) N + N − N D (cid:19) We wish to show when this latter expression is strictly greater than 0. The final term is − γD (cid:18) N + N − N D (cid:19) = − γD (cid:18) N + N − N D (cid:19) + γD (cid:18) N − N D (cid:19) . This means that we can join all terms that have N + N − ND and take advantage of the fact that α + β + γ = 1. This gives us the following expression: R S − R H = α ( D − N D + β ( D − N D + γD (cid:18) N − N D (cid:19) − D (cid:18) N + N − N D (cid:19) > NDD − to isolate α and get α + βD + γD − − γD ( D − − D − − N − D ( D − > α > D + N − γ − β ( D − − DγD ( D − D + N − − ( D − β + γ ) D ( D − D + N − − ( D − − α ) D ( D − N + D − D ( D − 1) + αD Subtracting αD from both sides we obtain α (cid:18) D − D (cid:19) > N + D − D ( D − α > N + D − D − In most cases N = 2 D , which gives a lower bound of α > D − D − . D is also usually quite large,hence this shows that in almost all cases miners will hoard blocks in the case they get lucky andfind a block with an empty queue! 19 .2 RPPLNS Since RPPLNS is memoryless, we can extend the above analysis to the case where m miner has k shares in the bag and holds a private block. We want to study the expected revenue from beinghonest for a single turn vs. waiting for the next turn in hopes of finding another share to publishbefore the withheld block. In RPPLNS, if a specific share surives being pushed, it will be eligible for payment another N − D probability of actuallypaying a N amount, hence shares that survive being pushed give m an expected revenue of N − ND .To simplify the expressions, we let f Bi ( k, N ) and f Si ( k, N ) represent the expected utility m makes when miner i ∈ { , } pushes a block or a share into the bag respectively: f B ( k, N ) = kN (cid:18) kN + k (cid:18) N − N D (cid:19)(cid:19) + N − kN (cid:18) k + 1 N + ( k + 1) (cid:18) N − N D (cid:19)(cid:19) f S ( k, N ) = kN (cid:18) k (cid:18) N − N D (cid:19)(cid:19) + N − kN (cid:18) ( k + 1) (cid:18) N − N D (cid:19)(cid:19) f B ( k, N ) = kN (cid:18) k − N + ( k − (cid:18) N − N D (cid:19)(cid:19) + N − kN (cid:18) kN + k (cid:18) N − N D (cid:19)(cid:19) f S ( k, N ) = kN (cid:18) ( k − (cid:18) N − N D (cid:19)(cid:19) + N − kN (cid:18) k (cid:18) N − N D (cid:19)(cid:19) With this in hand, we consider a two-turn scenario as with PPLNS. In one m has a blockin hand, and is honest with this current block and with what happens the following term. Thisstrategy is H for honest. In the second case, m hoards this block in hand with hopes of mininga share the following turn and publishing the share before the block. After this minor strategicdeviation for a turn though, m returns to being honest. This strategy is referred to by S . Firstwe write the expected utility for each action for HH = kN (cid:18) kN + f B ( k, N ) (cid:19) + N − kN (cid:18) k + 1 N + f B ( k + 1 , N ) (cid:19) H = kN (cid:18) kN + f S ( k, N ) (cid:19) + N − kN (cid:18) k + 1 N + f S ( k + 1 , N ) (cid:19) H = kN (cid:18) kN + f B ( k, N ) (cid:19) + N − kN (cid:18) k + 1 N + f B ( k + 1 , N ) (cid:19) H = kN (cid:18) kN + f S ( k, N ) (cid:19) + N − kN (cid:18) k + 1 N + f S ( k + 1 , N ) (cid:19) H = f B ( k, N ) H = f B ( k, N )Next we write the expected utility for each action for SS = f B ( k, N ) 20 = kN (cid:16) f B ( k, N ) (cid:17) + N − kN (cid:16) f B ( k + 1 , N ) (cid:17) S = 0 S = kN (cid:16) f B ( k − , N ) (cid:17) + N − kN (cid:16) f B ( k, N ) (cid:17) S = 0 S = f B ( k, N )We remember the probability of each state p = αD p = α ( D − Dp = βD p = β ( D − Dp = γD p = γ ( D − D With this in hand, we know that the following condition implies that S dominates H when m has a block in hand: R S = X i =1 ( S i ) p i > X i =1 ( H i ) p i = R H The Case where k = 0 Just as in PPLNS, we focus on the scenario where the bag is empty and strategic pool miners finda block. In terms of the equations above, this amounts to the case where k = 0. Theorem 6. If k = 0 , and α, β are such that α > D − (cid:18) N DN − N − β ( N − (cid:19) = Θ (cid:18) N + DD (cid:19) then S strictly dominates H .Proof. We begin by computing the per-state surplus that S gives to H , ∆ i = S i − H i , which givesus the following: ∆ = − N + N − N + ( N − N D ! ∆ = N − N ∆ = − (cid:18) N + N − N + N − N D (cid:19) ∆ = N − N D ∆ = − (cid:18) N + N − N D (cid:19) = 0Given these expressions, we are interested in the scenarios where P i =1 p i ∆ i > 0. Given the factthat N, D ≥ 0, this is equivalent to N D P i =1 p i ∆ i > 0. This leads to the following condition on α for hoarding to dominate revealing a block. α > D − (cid:18) N DN − N − β ( N − (cid:19) = Θ (cid:18) N + DD (cid:19) In summary, we have shown that as in PPLNS, if α = Ω (cid:16) N + DD (cid:17) , then hoarding a block whenup against an empty bag is strictly better than publishing it immediately. As in with PPLNS, it isoften the case that D = Θ( N ), hence this tells us that in this scenario, if α = Ω (cid:16) N (cid:17) , then minersare strategic by hoarding blocks. This is indeed what our empirical recursion results show. In this paper we presented RPPLNS, a novel twist on the already popular “Pay-per-last- N -shares”(PPLNS) mining pool scheme used by the majority of the Bitcoin network. By suitably randomisingPPLNS, we are able to maintain its strengths (fairness, variance reduction, pool-hop-proof-ness)while proving robustness guarantees for honest mining and reducing the underlying memory con-straints of the protocol. There are several possible directions for future research on RPPLNS. Inthe following paragraphs, we touch upon the ones we consider the most fruitful. At its core, PPLNS and RPPLNS are quite similar. It is not difficult to see that for a given valueof N , one can interpolate between PPLNS and RPPLNS by considering a pool protocol M Q,N that maintains a queue of length Q ∈ [ N ], and when a share is kicked out of the queue, it is putin a bag of size N − Q . Clearly M ,N is RPPLNS and M N,N is PPLNS. One can show thatsuch family of queue-bag protocols share similar fairness, variance reduction and pool-hop-proofproperties of PPLNS and RPPLNS. For such protocols, it would be interesting to study theirincentive compatibility and see whether there is an optimal choice of Q to be made in terms ofvariance reduction, incentive compatibility and memory usage minimisation. We have already mentioned the fact that the reduced cardinality of the state space of RPPLNSvs. PPLNS can give rise to space usage gains for an implementation of the pool protocol. Aninteresting consequence of this fact is that since the state space of RPPLNS is smaller, it is alsosuccinctly describable, and hence easy to communicate to all pool miners. It would be interestingto know that if a pool is operating a PPLNS mining protocol and there are two strategic agents m and m within the pool, where m has full knowledge of the state of the queue s ∈ S at any givenmoment of time and m only has partial information, say some statistic, s over s (this could bethe queue considered as a bag for example, with order of elements in the queue forgotten), whetherthis gives m any undue advantage over m . If this were the case, there would be a strong furtherjustification for RPPLNS, as a way of putting all agents on an equal informational playing ground.22 .3 Stronger Incentive Guarantees It would be great to rigorously understand the recurrence relation governing the gain of an op-timal strategic pool miner in RPPLNS. This would give us stronger results regarding incentivecompatibility of pool miners and could glean insights into unforeseen strategic considerations. References [1] M. Carlsten, H. Kalodner, S. M. Weinberg, and A. Narayanan. On the instability of bitcoinwithout the block reward. In Proceedings of the 2016 ACM SIGSAC Conference on Computerand Communications Security , pages 154–167. ACM, 2016.[2] I. Eyal. The miner’s dilemma. In Security and Privacy (SP), 2015 IEEE Symposium on , pages89–103. IEEE, 2015.[3] I. Eyal and E. G. Sirer. Majority is not enough: Bitcoin mining is vulnerable. In Internationalconference on financial cryptography and data security , pages 436–454. Springer, 2014.[4] A. Kiayias, E. Koutsoupias, M. Kyropoulou, and Y. Tselekounis. Blockchain mining games.In Proceedings of the 2016 ACM Conference on Economics and Computation , pages 365–382.ACM, 2016.[5] Y. Kwon, D. Kim, Y. Son, E. Y. Vasserman, and Y. Kim. Be selfish and avoid dilemmas: Forkafter withholding (FAW) attacks on bitcoin. In B. M. Thuraisingham, D. Evans, T. Malkin,and D. Xu, editors, Proceedings of the 2017 ACM SIGSAC Conference on Computer andCommunications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017 ,pages 195–209. ACM, 2017. ISBN 978-1-4503-4946-8. doi:10.1145/3133956.3134019. URL http://doi.acm.org/10.1145/3133956.3134019 .[6] F. J. Marmolejo Cossío. Equilibrium computation in games and strategic aspects of bitcoinmining . PhD thesis, University of Oxford, 2019.[7] S. Nakamoto. Bitcoin: A peer-to-peer electronic cash system, 2008.[8] K. Nayak, S. Kumar, A. Miller, and E. Shi. Stubborn mining: Generalizing selfish mining andcombining with an eclipse attack. In Security and Privacy (EuroS&P), 2016 IEEE EuropeanSymposium on , pages 305–320. IEEE, 2016.[9] R. Qin, Y. Yuan, and F.-Y. Wang. A novel hybrid share reporting strategy for blockchainminers in pplns pools. Decision Support Systems , 118:91–101, 2019.[10] M. Rosenfeld. Analysis of bitcoin pooled mining reward systems. arXiv preprintarXiv:1112.4980 , 2011.[11] A. Sapirshtein, Y. Sompolinsky, and A. Zohar. Optimal selfish mining strategies in bitcoin.In International Conference on Financial Cryptography and Data Security , pages 515–532.Springer, 2016. 2312] O. Schrijvers, J. Bonneau, D. Boneh, and T. Roughgarden. Incentive compatibility of bitcoinmining pool reward functions. In International Conference on Financial Cryptography andData Security , pages 477–498. Springer, 2016.[13] S. T. Yau and L. Zhang. An upper estimate of integral points in real simplices with anapplication to singularity theory. Mathematical Research Letters , 13(6):911–921, 2006.[14] Y. Zolotavkin, J. García, and C. Rudolph. Incentive compatibility of pay per last n shares inbitcoin mining pools. In