We might walk together, but I run faster: Network Fairness and Scalability in Blockchains
aa r X i v : . [ c s . D C ] F e b We might walk together, but I run faster: Network Fairness andScalability in Blockchains
Anurag JainShoeb SiddiquiSujit Gujar [email protected]@[email protected] Learning Lab,International Institute of Information TechnologyHyderabad, Telangana, India
ABSTRACT
Blockchain-based Distributed Ledgers (DLs) promise to transformthe existing ๏ฌnancial system by making it truly democratic. In thepast decade, blockchain technology has seen many novel applica-tions ranging from the banking industry to real estate. However, inorder to be adopted universally, blockchain systems must be scal-able to support a high volume of transactions. As we increase thethroughput of the DL system, the underlying peer-to-peer networkmight face multiple levels of challenges to keep up with the require-ments. Due to varying network capacities, the slower nodes wouldbe at a relative disadvantage compared to the faster ones, whichcould negatively impact their revenue. In order to quantify theirrelative advantage or disadvantage, we introduce two measures ofnetwork fairness, ๐ ๐ , the probability of frontrunning and ๐ผ ๐ , thepublishing fairness. We show that as we scale the blockchain, boththese measures deteriorate, implying that the slower nodes face adisadvantage at higher throughputs. It results in the faster nodesgetting more than their fair share of the reward while the slowernodes (slow in terms of network quality) get less. Thus, fairnessand scalability in blockchain systems do not go hand in hand.In a setting with rational miners, lack of fairness causes minersto deviate from the โlongest chain ruleโ or undercut , which wouldreduce the blockchainโs resilience against byzantine adversaries.Hence, fairness is not only a desirable property for a blockchainsystem but also essential for the security of the blockchain andany scalable blockchain protocol proposed must ensure fairness. KEYWORDS
Distributed Ledgers, Scalable Blockchains, Fairness, Peer-to-PeerNetworks
Permission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor pro๏ฌt or commercial advantage and that copies bear this notice and the full cita-tion on the ๏ฌrst page. Copyrights for components of this work owned by others thanACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re-publish, to post on servers or to redistribute to lists, requires prior speci๏ฌc permissionand/or a fee. Request permissions from [email protected].
Conferenceโ17, July 2017, Washington, DC, USA ยฉ 2021 Association for Computing Machinery.
ACM Reference Format:
Anurag Jain, Shoeb Siddiqui, and Sujit Gujar. 2021. We might walk together,but I run faster: Network Fairness and Scalability in Blockchains. In
Pro-ceedings of ACM Conference (Conferenceโ17).
ACM, New York, NY, USA,12 pages.
Blockchain-based
Distributed Ledgers (DLs) promise to transformthe existing ๏ฌnancial system. The idea behind such a transforma-tion is to replace centralized institutions that govern the systemby a decentralized peer-to-peer network of nodes. The key idea insuch a DL system is that the system o๏ฌers the right incentives tothe nodes to act honestly according to the blockchain protocolโsrules. Thus, any node can voluntarily choose to participate in thesystem and incur a computational cost in the expectation of beingrewarded. We call such participants in the DL nodes or agents .We believe that such a system can be truly democratic since any-one can choose to participate.If a decentralized system is not fair , i.e., the agents do not re-ceive proportionate incentives, they will prefer not to join the sys-tem. Consequently, the system will not remain democratic and de-centralized if it excludes some agents. In this work, we analyzethe fairness characteristics of blockchain-based DLs for which, weconsider all the agents being honest but with di๏ฌerent network ca-pacity. Although the fairness properties that we describe appear tobe healthy for current blockchain systems, they deteriorate quicklyas we scale the system to higher throughputs. Although cryptocurrencies like Bitcoin and Ethereum are quitepopular today, they still lag behind centralized payment systemslike Visa in terms of transaction rates and time to ๏ฌnality. As ofOctober 2020, Bitcoinโs and Ethereumโs network processes an av-erage of 3-4 and 10 transactions per second (TPS), respectively. Incontrast, Visaโs global payment system handled a reported 1,700TPS and claimed to be capable of handling more than 24,000 TPS[22]. For a cryptocurrency to be adopted universally, it must beable to scale to process transactions at much higher throughput, We use nodes and agents interchangeably. We refer to them as nodes when we con-sider them as a part of a network and agents when we consider them as players in amining game. .e., TPS rate. Hence, blockchain protocols must be scalable to besuitable for widespread adoption.However, there are many challenges on the road to scaling block-chain based DLs. Garay et al. [10] and Kiyayas et al. [11] show thatexisting blockchain protocols su๏ฌer from a loss of security prop-erties as we scale the system. These security properties are fun-damental to the operation of a robust DL. [10] and [11] considera model with two types of agents, honest and adversarial wherethe adversary tries to attack the ledger by strategically forking theblockchain. A successful fork would allow the adversary to per-form a double-spending attack.In this paper, ๏ฌrst, we consider a setting in which all agents arehonest and show that disparities in the connection to the peer-to-peer network can make the system unfair. In such a case, nodeswith a better internet connection will be able to grab a larger shareof the reward while those with slower connections might lose out.We show that this disparity signi๏ฌcantly increases as we increasethe throughput of the system. Notice that improving the qualityof the overlay network may be more complicated than makingprotocol-level changes that may be implemented by merely updat-ing the software clients.In literature, it is typically assumed that all the agents haveequal access to the network, albeit with some ๏ฌnite delay. How-ever, this is seldom the case in practice where some nodes mayhave better internet connections than others. For the ๏ฌrst time, weintroduce asymmetry in modeling network connections by assum-ing di๏ฌerent delays for di๏ฌerent nodes. Hence, faster nodes wouldhave shorter delays, while slower nodes would have longer delayswhich in turn results in asymmetry in the rewards collected bythese agents. We ๏ฌrst analyse consequences of this model in a set-ting with honest agents and then extend our discussion to rationalagents.In order to analyze and quantify network fairness, we introducetwo measures of fairness based on network events associated withbroadcasting a transaction and broadcasting a block. First, we in-troduce frontrunning , an event associated with a node receivinga transaction. Frontrunning (that we deal with in this paper) oc-curs when a node con๏ฌrms a transaction before someone else hearsabout the transaction. We measure ๐ ๐ , the probability of this eventhappening between two fractions of the network. If ๐ ๐ is high, thefaster nodes would consistently be able to grab high-value transac-tions while the slower ones would only be able to pick low-valueones left out by others. Thus, a high ๐ ๐ would negatively impactsome agentsโ revenue. We show that if we try to scale a Bitcoin-like system to the throughput o๏ฌered by the likes of Visa, ๐ ๐ ap-proaches to nearly 1, which implies that the slower nodes in thesystem will rarely be able to mine any high-value transactions thatwould result in these nodes receiving minimal reward in exchangefor their mining e๏ฌorts.We then consider the process of broadcasting a block throughthe network. Publishing fairness quanti๏ฌes the advantage a nodemight have over other nodes in broadcasting a block. If a node isable to propagate its block faster than other nodes, in case of aneventual fork, its fork would have a higher probability of being ac-cepted. Since we know that at higher throughputs forks becomemore common, faster nodes would be able to get more blocks ac-cepted while those of slower nodes would frequently be orphaned. Thus, the slower nodes, would not be able to even gather the ๏ฌxedblock rewards.As both of these measures deteriorate as with increased through-put, small variations in network access may lead to the systembecoming unfair for the slower nodes. This would result in someagents gaining more than their fair share of reward while someagents earn less. This could certainly impact the pro๏ฌtability of theagents that earn less since they still need to pay for the costs associ-ated with mining. Thus, it may lead to drop in the agents maintain-ing the DL since agents that are unable to accumulate enough re-ward to break even the mining costs might shut down their miningoperation or they might adopt strategic behavior to collect morerewards than that obtained by following the protocol honestly, ei-ther of which would reduce the security of the blockchain.We discuss possible behavior that a lack of network fairnesscould elicit from rational agents. Their behavior could potentiallyhurt the stability of the system and reduce the e๏ฌective through-put of the system. We use simulations to show that as the fairnessreduces, the default strategy mining on top of the longest chaindoes not remain the dominant strategy which means that rationalagents gain more reward by intentionally forking the longest chain.This could have adverse e๏ฌect on the resilience of the blockchainagainst byzantine adversaries, making it less secure . Hence, eventhough we scale the system to increase the throughput, we mightnot ๏ฌnd much practical advantage due to these issues.Thus, the potential of blockchain technology is hindered by thecapabilities of the underlying networking infrastructure.Hence, in this work, we:(1) Introduce a notion of network fairness in blockchains andhighlight its importance. (Section 3) In particular, we intro-duce frontrunning (De๏ฌnition 3.2) and publishing fairness (De๏ฌnition 3.3) in the context of network fairness and an-alyze them for existing blockchain systems.(2) Study the e๏ฌect of increasing throughput on network fair-ness. (Section 4) and provide bounds on frontrunning as wellas publishing fairness (Theorems 4.1 and 4.2)(3) Discuss a few consequences of a lack of fairness in terms ofcreating strategic deviations that may be detrimental to thesecurity of the blockchain. (Section 5) A distributed ledger (DL) is a database replicated and shared acrossmultiple nodes in consensus. Blockchain is a type of append-onlyledger. When a node wants to append a transaction to the ledger,it broadcasts it to other nodes. All nodes vote by a consensus al-gorithm to invalidate the existing ledger and replace it with theupdated one. (In case of Bitcoin, once a new block is added to thelongest chain, the original chain is not considered valid in the pres-ence of the longer chain [14])
Nodes in a proof-of-work blockchain system vote on changes tothe DL via their CPU (or GPU in some cases) by trying to mine a A byzantine adversary typically tries to defraud the users of the payment system bytrying to create double-spending transactions. lock. The chain having the most blocks and correspondingly themaximum proof-of-work is selected as the consensus value. In or-der to mine a block, the player must successfully ๏ฌnd a โnonceโvalue that, along with the other contents of a block, hashes to avalue less than a given target. Due to the nature of the hash func-tion, this is a random process, and miners must repeatedly sampledi๏ฌerent nonce values to mine a block successfully.
De๏ฌnition 2.1 (Fail Function).
We de๏ฌne fail ( ๐, ๐ก ) as the proba-bility of ๐ fraction of the network failing to mine a block in ๐ก unitsof time.fail ( ๐, ๐ก ) = ( โ ๐ ) ๐ ร ๐ป๐ก where ๐ is the probability of a querybeing successful and ๐ป is the cummulative hash rate of the entirenetwork. A more detailed explanation for this is provided in Sec-tion A of the supplementary material.For convenience, we sometimes use fail ( ๐ ) = fail ( ๐, ) , the proba-bility of ๐ fraction of the network failing to mine a block in a unitof time. The throughput of the blockchain-based DL system depends ontwo parameters: (i) the Block Creation Rate ๐ and (ii) the BlockSize ๐ with the throughput being proportional to ๐ ร ๐ .Although we can increase any of the two parameters to increasethe throughput, we su๏ฌer consequences due to the limitations ofthe underlying peer-to-peer network. E๏ฌect of increasing the block creation rate.
By increasing the blockcreation rate, we risk a node mining a block before it receives thelatest block mined by the network.
E๏ฌect of increasing the block size.
According to observations byDecker and Wattenhofer [9], there exists a linear relationship be-tween the block size b and the time taken by the block to be propa-gated throughout the network. Hence, if we increase the block size,the time taken by it to propagate increases.Increasing the block size or increasing the block creation ratelead to the deterioration of security properties in Bitcoin-like linearblockchain protocols, as shown by Sompolinsky and Zohar [20].Our contribution is parallel to them since we show that they alsocause a loss of fairness. In this paper, we consider settings withhonest players and settings with rational players independently,we also de๏ฌne adversarial players here to show that they can posethreat to security of the blockchain.
De๏ฌnition 2.2 (Honest Agent).
An agent is said to be an honestplayer if and only if it does not deviate from the protocol rules.
De๏ฌnition 2.3 (Rational Agent).
An agent is said to be a rationalplayer if it may strategically deviate from the protocol rules if thedeviation is expected to yield a higher reward.
De๏ฌnition 2.4 (Adversarial Agent).
An agent is said to be an ad-versarial player (and sometimes also known as โByzantineโ in theliterature) may also strategically deviate from the protocol. How-ever, the adversaryโs goal is to disrupt the operation of the protocol,and it does not try to maximize its reward.
There are two principal ways of rewarding the nodes in a blockchainsystem:(1)
Block Reward - The reward miners can assign to themselvesfor mining a block. This reward mints new currency, addingto the total amount of currency in circulation.(2)
Transaction Fees - This is the fee o๏ฌered by the users for min-ersโ services by providing incentives to include their trans-actions in the blocks. Typically, the users are allowed to de-cide the transaction fees they wish to o๏ฌer while creating atransaction.
Although we consider only blockrewards and transaction fees to be the contributors of reward tothe miners, miners might earn additional revenue from implicitsources as well. For instance, Daian et al. [8] show that there isconsiderable miner value in
Order Optimization in DecentralizedExchanges , where the miners can rearrange transactions and po-tentially insert their own in a block to yield a higher reward. Inthis case, the miners that frontrun can gain additional revenue bygrabbing revenue from order optimization . Typically, the nodes participating in the blockchain communicatewith each other using the internet. They form a peer-to-peer net-work where each node is connected to a few other nodes (whichwe refer to as neighbors). We assume that the communication be-tween two nodes has a ๏ฌnite delay. This communication delay mayvary signi๏ฌcantly depending upon numerous factors such as net-work congestion, network outages, and ISP bottlenecks, but for thesake of analysis, we abstract out these factors.In this paper, we are concerned with the following two actions overthe network:(1) Broadcasting a Transaction: when a user wishes to make atransaction on the ledger, he/she cryptographically signs atransaction and sends it to a small number of nodes. Eachnode in the network propagates the transaction to its neigh-bors. Therefore, a transaction reaches all the nodes in thenetwork after some time.(2) Broadcasting a Block: Similarly, when a node mines a newblock, it sends it to its neighbors, who then propagate it fur-ther. Therefore, a block reaches all the nodes in the networkafter some time.There are some delays associated with both processes. We assumethe delay of receiving a transaction and broadcasting a block tobe dependent upon both the quality of a nodeโs connection andthe quality of the overall peer-to-peer network. We quantify thisdelay as ๐ฟ refers to the total time taken for any broadcast by a nodeto reach all nodes in the network. ๐ -approximate fairness Pass and Shi [16] de๏ฌned ๐ -approximate fairness as follows : In their original paper, Pass et al. used the term ๐ฟ -approximate fairness however weuse a di๏ฌerent symbol to distinguish it from the ๐ฟ delay we use throughout the paper e๏ฌnition 3.1 ( ๐ -approximate fairness). [16] A blockchain proto-col has ๐ -approximate fairness if, with overwhelming probability,any honest subset controlling ๐ fraction of the compute power isguaranteed to get at least a ( โ ๐ ) ๐ fraction of the blocks in asu๏ฌciently long window.The intuition behind this is that in a fair protocol, a agent thatcontrols a ๐ fraction of the computational resources should receivea ๐ fraction of the rewards. Though ๐ -approximate fairness has itsown merit and importance, the de๏ฌnition manages to capture theintuition only if the reward for each block is similar. In DLs thatoperate at a slower speed, this variation may not be signi๏ฌcant.However, at higher throughputs, the block reward may vary sig-ni๏ฌcantly among the blocks. In which case, we should also factorin the reward that the agents get for their blocks. Secondly, this def-inition does not capture the disparity among di๏ฌerent nodes, i.e.,which nodes gain more than their fair share and which nodes getless. The measures that we de๏ฌne compare di๏ฌerent nodes or setsof nodes to highlight which ones are at a relative advantage andwhich ones are at a disadvantage.Here, we wish to analyze network fairness and establish mea-sures independent of the computational power of the nodes weare comparing. Hence, we base our de๏ฌnitions on network eventsinstead. ๐ ๐ ) In some cases, it might be easier to analyze and quantify โunfair-nessโ rather than fairness. Since only the transaction that comes๏ฌrst is said to be the valid one, any subsequent blocks that in-clude a copy of the transaction lose out on the transaction feesand waste their space, which could have accommodated an uncon-๏ฌrmed transaction. For every transaction, we can imagine a raceamong the nodes to grab its transaction fees by mining a blockthat includes it. We can say that the node that manages to win therace by mining a block containing the transaction before everyoneelse wins the race and has successfully frontrun everyone else .The system will be fair if every node has an equal probability ofwinning the race.We de๏ฌne the event frontrun_1 for a node ๐ฟ ( ๐ฟ here, standsfor Loser) as the event in which he loses the race described earlier.In this case, the node does not gain any reward since he failed tomine the block before everyone else.We de๏ฌne the event frontrun_2 for ๐ฟ as the event in which someother node manages to win the race even before ๐ฟ starts the race.That is, some other node mined a block containing the transactionbefore ๐ฟ receives the transaction. Clearly, frontrun_2 โ frontrun_1 .To capture it more formally, De๏ฌnition 3.2 ( ๐ ๐ ). We call { ๐ ๐ } ๐๐ the probability of the event frontrun_2 between the top ๐ percentile of the nodes and the As we discuss in later sections, this may not be the only way to win the race. Insome cases agent can change the results of the race by strategically deviating fromthe protocol. We borrow the term from Wall Street jargon where the term originates from the erawhen stock market trades were executed via paper carried by hand between tradingdesks. The routine business of hand-carrying client orders between desks would nor-mally proceed at a walking pace. However, a broker could run in front of the walkingtra๏ฌc to reach the desk and execute his order ๏ฌrst. [23] bottom 1 โ ๐ percentile of the nodes in terms of network delays.That is the probability that some node in the top ๐ percentile (interms of network speed) manages to frontrun_2 all nodes in thebottom 1 โ ๐ percentile.Ideally, ๐ ( frontrun_2 ) = ๐ผ ๐ ) Faster internet speed can not only provide an advantage in receiv-ing new transactions but also yield an upper hand in broadcastingblocks. Consider two nodes A and B that mine a block simultane-ously. We de๏ฌne ๐ผ ๐ as the ratio of the probability that the majorityaccepts Aโs block to the probability that the majority accepts Bโsblock. Thus, it quanti๏ฌes the advantage of A in terms of publishinga block and claiming the associated reward. A lack of publishingfairness implies that not only slower nodes are less likely to re-ceive reward transaction fees in the mined block but the are alsoless likely to receive the ๏ฌxed block reward associated with min-ing a new block. The intuition behind this de๏ฌnition is that overmultiple rounds, this would be the ratio of their con๏ฌicting blocksgetting accepted. ๐ผ ๐ ( ๐ด, ๐ต ) = ๐ ( Aโs block getting acceptedA and B mine a block simultaneously ) ๐ ( Bโs block getting acceptedA and B mine a block simultaneously ) Remark 1
Like ๐ ๐ , ๐ผ ๐ is also a measure of โunfairnessโ rather thanfairness, i.e., higher ๐ผ ๐ implies lesser fairness in the system. Theideal value of ๐ผ ๐ is 1, when the blocks mined simultaneously byboth the nodes are equally likely to get accepted. Remark 2 ๐ผ ๐ only accounts for the events in which both A and Bmine their blocks simultaneously since both the probabilities areconditioned on the blocks being mined simultaneously. Remark 3
Ideally ๐ผ ๐ should be close to 1. The high value of ๐ผ ๐ indicates that the faster agent can collect more block rewards thanthe slower agent even though they both do exert the same amountof computation. A node that can hear new transactions and propagate blocks fasterthan other nodes gains an unfair advantage over its peers. In thissection, we analyze and quantify the advantage. We believe thatthe results presented in 4.1.1 and 4.2.2 to be a signi๏ฌcant insighto๏ฌered by our paper.
Consider a node with a poor network connection that receives atransaction with a signi๏ฌcant delay as compared to others that donot. We now analyze the probability of the event frontrun_2 hap-pening for the node. For the Bitcoin Network, according to [1] ittakes less than 4 seconds for a transaction to reach the 50 th per-centile but more than 15 seconds to reach the 90 th percentile. It islikely that the slower nodes only hear about a transaction once afaster node has already con๏ฌrmed it. Let us consider the probabil-ity of 50% nodes in the top percentile in terms of network speed โถ(cid:0)(cid:0) โท(cid:0)(cid:0) โธ(cid:0)(cid:0) โน(cid:0)(cid:0) โบ(cid:0)(cid:0) โป(cid:0)(cid:0)(cid:0)(cid:0)โฟโท(cid:0)โฟโน(cid:0)โฟโป(cid:0)โฟโฝโถโโโโโ โโโโ โกโโโ โโ โกโ โ โโโโโ โกโโโ โกโ โโโกโโโโโโขโฃ โโฃโตโโ โตโโพโโโ โ(cid:0)โฟโบ(cid:0)โฟโ โโ โโขโฃโคโฅโฆโขโงโฅโ โฉโคโฃ โ โ โชโช โโซโฌโคโญโฎโ โฏโ โขโฐโ โคโฉ โฑโฒโ โฌโคโฒโญโณโดโผโโโโโ โโโ Figure 1: Variation of { ๐ ๐ } . . as we scale the blockchain being able to con๏ฌrm the transaction before the bottom 10% of thenodes receive it. Let ๐ be the advantage o๏ฌered to the top ๐ fraction of the nodesin terms of time (in our example, this amounts to 11 seconds), ๐ isthe probability of query being successful, and ๐ป be the hash rateof the network. Theorem 4.1 (Lower bound of { ๐ ๐ } ๐๐ ). { ๐ ๐ } ๐๐ > ๐๐๐ โ (cid:0) ๐๐๐ (cid:1) Proof.
We show that the probability of the event that ๐ frac-tion of the network manages to mine a block in time ๐ increaseswith the block creation rate ๐ . A formal proof is provided in SectionB of the supplementary material. (cid:3) Theorem 4.1 shows that { ๐ ๐ } ๐๐ increases monotonically with in-creasing the block creation rate ๐ since its lower bound increasesmonotonically. One can observe that in order to keep the proba-bility of this event su๏ฌciently low, ๐ must be reduced while in-creasing ๐ to scale the blockchain. Although, it may seem that thelower bound is independent of the bottom ๐ percentile selectedbut this would have been incorporated in ๐ since ๐ increases as ๐ decreases. As of October 2020, { ๐ ๐ } . . approximates to 0 .
01 for the Bitcoin Network. However,if we were to scale the Bitcoin Network to a throughput similar too๏ฌered by the likes of Visa Network by increasing the block cre-ation rate to 566 blocks every 10 minutes (by reducing the di๏ฌcultyand keeping the block size same) { ๐ ๐ } . . goes up to 0 . . Un-fortunately, since at the time of writing, statistics on transactionpropagation times in Ethereum were not published, we estimate { ๐ ๐ } . . for Ethereum by using the same delays as Bitcoin. We ๏ฌndthat the estimated value of { ๐ ๐ } . . (as of October 2020) is around0 .
36, which is considerably higher than that of Bitcoin. In Figure 1,we plot the variation of { ๐ ๐ } . . with increase in the throughput. Our analysis in Section 4.1 showsthat as we scale the blockchain to higher throughputs, some agentswould be able to grab high-value transactions before others con-sistently. This means that some agents would be producing blocks We make an additional assumption here that all nodes should have equal computingpower. This is ideal from the expectation that the system should be decentralized.Hence, computational power should be ideally distributed equally among the nodes. We assume there are no signi๏ฌcant improvements in the peer-to-peer overlaynetwork โต โโ โโโตโถ โโโโโฐโโ โโโโโฐโโ(cid:0)โโโโโโโโโ โกโโโโโโโโโโโโ โ โโโกโโโโโโโโ โ โฃโโฃโ
Figure 2: Fraction of nodes accepting a block vs rounds with higher rewards, while others would produce blocks with lowerrewards. Hence, a lack of network fairness may be able to induce agreater variation in block rewards. We discuss further implicationsof this variation in Section 5.
Lack of incentive for information propagation.
The inability ofthe peer-to-peer network to keep up with the ledgerโs desired through-put is further exacerbated by the fact that the nodes do not haveany incentive to participate in broadcasting information. In fact,they have an incentive to keep the knowledge of transactions tothemselves, as shown by Babaio๏ฌ et al. [3]. By broadcasting a trans-action to other nodes, a agent is potentially increasing the num-ber of nodes competing to include the transaction in their blocksand collect the corresponding transaction fees. Thus, o๏ฌering addi-tional incentive to agents for propagating transactions may speedup the the broadcast of a transaction.
Let us assume that the execution happens in โroundsโ in whichthe nodes make ๐ queries each to the Hash Function. At the bound-aries of rounds, the nodes can communicate with their neighboringnodes. In our example here, we assume the duration of a round tobe 1 second. If a node succeeds in mining a block in a round, it willbegin broadcasting it to its neighbors when the round ends. Simi-larly, if a node receives a block at the beginning of a round, it willbroadcast it to its neighbors at the end of that round.We assume that there are ๐ nodes, and all nodes are honest.Hence, they follow the Bitcoin protocolโs strategy of picking theoldest block in case of a tie and publishing a block as soon as it ismined.Consider the event in which exactly two nodes, A and B mine ablock simultaneously in the same round. Let ๐ฟ ๐ด and ๐ฟ ๐ต ( ๐ฟ ๐ด โค ๐ฟ ๐ต ,without loss of generality) be the delay associated with broadcast-ing the blocks to the entire network. At a time ๐ก > ๐ฟ ๐ต , the networkwill be split into two fractions: ๐ ๐ด : The fraction of nodes in the network which claim tohave received the block mined by A before the block minedby B. โข ๐ ๐ต : The other fraction of nodes in the network which claimto have received the block mined by B before the block minedby A.Since by ๐ฟ ๐ต , all nodes in the network would have received theblocks mined by A and B, ๐ ๐ด + ๐ ๐ต = ๐ ๐๐ด and ๐ ๐๐ต be the fraction of network accepting A and B atthe ๐ th round. Then, ๐ผ ๐ can be approximated by Theorem 4.2. Theorem 4.2 (Approximation of ๐ผ ๐ ). ๐ผ ๐ = ๐ โ ๐ (1) where ๐ = ร โ ๐ = (cid:20) ร ๐ โ ๐ = [( โ fail ( ๐ ๐๐ด ))( โ fail ( ๐ ๐๐ต )) + fail ( ๐ ๐๐ด ) fail ( ๐ ๐๐ต )] ร ( โ fail ( ๐ ๐๐ด )) fail ( ๐ ๐๐ต ) (cid:21) Proof.
The proof of follows from ๏ฌrst ๏ฌnding the probabilityof A being successful to getting its block accepted in ๐ th round con-ditioned on the probability that neither of the blocks gain majoritytill the ( ๐ โ ) th round. We then use Bayeโs Theorem to ๏ฌnd out thetotal probability. A formal proof is presented in Section C of thesupplementary material. (cid:3) ๐ผ ๐ . If we assume the propagation of the blockin the network to be linear , then by the end of ๐ฟ ๐ต , ๐ ๐ด = ๐ฟ ๐ต ๐ฟ ๐ด + ๐ฟ ๐ต and ๐ ๐ต = ๐ฟ ๐ด ๐ฟ ๐ด + ๐ฟ ๐ต . Accordingly, the plot of ๐ ๐ด and ๐ ๐ต will be as shownin Figure 2. We then calculate ๐ผ ๐ according to Theorem 4.2 andplot for varying network delays as well as varying throughputs. ๐ผ ๐ . In Figures ?? and ?? , we plot the variation of ๐ผ ๐ with the increase in ๐ฟ ๐ต for di๏ฌerent values of ๐ฟ ๐ด . We ๏ฌnd that ๐ผ ๐ grows exponentially with an increase in ๐ฟ ๐ต or a decrease in ๐ฟ ๐ด ,which implies that even small di๏ฌerences in network delays canmake the system unfair.In Figure ?? , we plot the variation of ๐ผ ๐ as we increase through-put for a ๏ฌxed ๐ฟ ๐ด and ๐ฟ ๐ต . We ๏ฌnd that ๐ผ ๐ grows with an increasein the block creation rate ๐ , which implies that as we scale the sys-tem, it becomes more unfair (from Remark 3.3). However, the ๐ผ ๐ increases slowly after a certain ๐ . We must note that the probabilityof simultaneously mining a block still keeps increasing exponen-tially, which is not factored in ๐ผ ๐ (from Remark 3.3). Hence, theoverall ratio of blocks that A is able to include in the blockchain ascompared to B still keeps increasing. Improving the delays associated with broadcasting transactionsand blocks for a node may not be as simple as improving the qual-ity of a nodeโs internet connection. A signi๏ฌcant factor of the delayalso depends upon the structure of the peer-to-peer network, thenumber of neighbors, and their delays. Decker and Wattenhofer[9] suggest pipelining of information propagation to reduce the la-tency. However, we are more concerned with the changes a single Although, we expect it to be exponential in practice due to the GOSSIP algorithm, alinear assumption is rather optimistic and our results would be more pronounced inthe exponential case. node can implement to reduce its delay. Stathakopoulou et al. [21]suggest implementing a Content Distribution Network that con-nects to nodes based on their geographic proximity. There havealso been a few high-speed alternative โrelayโ networks developedto broadcast information quickly among a subset of nodes part ofthe network ([7], [4] and [12]). However, there are many concernsraised about the centralized nature of these networks. A node thatis a part of such a network could undoubtedly gain an advantageover others. However, doing so may lead to further centralization,defeating the purpose of having a distributed ledger.
A lack of fairness causes some agents to gain more than their fairshare of rewards, whereas some agents gain less than their fairshare of rewards. Since all agents have similar underlying costsrelated to mining, it would make mining less pro๏ฌtable or evenloss-making for some agents. We believe that this might open upthe pandoraโs box of strategic deviations that might be not onlyunfair to the honest players but also detrimental to the health ofthe blockchain. Until now, we had considered that all players werehonest and will not deviate from the protocol. However, the playersmay choose to deviate from the protocol if the deviation cannot bedetected or penalized. When mining is not fair to some agents, theymay have an incentive not to accept the consensus and depart fromthe honest strategy. This disagreement could possibly be re๏ฌectedby forks that cause the agents in the system to split their votes.These deviations might be harmful to the health of a blockchainand make it less secure against adversaries. We now brie๏ฌy discussa few possibilities if they act rationally to maximize their expectedreward.Carlsten et al. [5] had shown that when there is a large variancein the reward earned from blocks, it might be pro๏ฌtable to inten-tionally fork blocks with high rewards.
Petty mining [5] is a strat-egy in which, given a fork, the petty miner picks the fork, whichhas collected lesser transaction fees and, hence, o๏ฌers the agent anopportunity to include transactions from the other fork and col-lect more transaction fee.
Undercutting [5] is a strategy in which aagent intentionally forks a block with a high reward in order to col-lect some of the rewards while o๏ฌering the rest of the reward to thepetty agents that choose to mine on top of it. A slow node that doesnot have enough high-value transactions in its mempool mighthave an incentive to either fork the block mined by a frontrunner(undercutting) or given a fork pick the fork that o๏ฌers an opportu-nity to collect a higher transaction fee (petty mining). If we assumethat all agents are rational and hence petty miners since this strat-egy strictly dominates honest mining. Undercutting would allow aslower node to overcome both frontrunning and lack of publishingfairness. A slower node could fork a block mined by a faster nodecontaining many high-value transactions due to frontrunning andinclude those transactions in its own block while leaving some ofthe transactions for others to include. Secondly, even if a node re-ceives the block mined by a slower node later, it would drop theprevious block and mine on top of this instead since it o๏ฌers ahigher reward. In this case, it might not be in the best interest In fact, undercutting might even occur in case of an unintentional fork between afaster node and a slower node (since the block mined by a faster node will contain (cid:0) โถโ โท(cid:0) โทโ โธ(cid:0)โถโทโนโปโฝโถ(cid:0)โถโท โโโโข โโ โโ โโ โโโ โ โกโโโโโโ โโโโ โ โบโโโ โ โโโโโ โ โโบโ โถ(cid:0) โถโ โท(cid:0) โทโโถโทโธโนโโปโผ โโโโข โโ โโ โโ โโโ โ โกโโโโโโ โโโโ โ โบโโโ โ โโโโโ โ โโบโ โถ โถ(cid:0)(cid:0) โท(cid:0)(cid:0) โธ(cid:0)(cid:0) โน(cid:0)(cid:0) โบ(cid:0)(cid:0) โป(cid:0)(cid:0)โถโทโนโปโฝโถ(cid:0)โถโท โโโโโ โโโโ โกโโโ โโ โกโ โ โโโโโ โกโโโ โกโ โโโกโโโโโโโข โโ โโ โโโโโโโโโโกโโ โ โโขโฃโค โโ โ โฅโขโฃโโ โ โโขโฃโค โโ โ โฆโขโฃ of the frontrunner to always pick the transactions o๏ฌering higherrewards.
We divide the network into two portions: slow and fast . The fastnodes can receive messages broadcasted by any node in the pre-vious round, but the slow nodes have higher communication de-lays with certain nodes. Each node can choose from the followingstrategies:(1) petty : The petty mining strategy described in [5], it is sameas the default strategy in case of no forks. It weakly domi-nates the default compliant strategy prescribed by Bitcoinbut it is not harmful to the security of the blockchain on itsown.(2) minor_undercutting : A node will undercut if the longestchainโs reward is below a certain threshold. However, it wouldleave out a small constant reward as an incentive for the sub-sequent agents that pick the block.(3) major_undercutting ( ๐ ) : A node will undercut if the longestchainโs reward is below a certain threshold. However, it wouldleave out a signi๏ฌcant portion of the reward ( ๐ ) as an incen-tive for the subsequent agents that pick the block.The resulting game could be analyzed as a two-player bi-matrixgame. In order to study undercutting based strate-gic deviations in blockchains at high throughputs, we developed alightweight simulator (described in Algorithm 1). We tested thefollowing strategies:(a) major_undercutting ( . ) ( ๐ ), (b) major_undercutting ( ) ( ๐ ),(c) minor_undercutting ( ๐ ), and (d) petty ( ๐ ). We assigned dif-ferent strategies to slow and fast nodes to produce the payo๏ฌ ma-trix in Table 1 . more high-value transactions). The probability of such forks increases along with ๐ ๐ and ๐ Due to computational constraints, we produced results for ๐ = times that ofBitcoin which would yield a throughput 60% that of the Visa Network but we expectthe results to be even more pronounced as we scale the blockchain further. De๏ฌnition 5.1 (Weakly Dominated Strategy). [15] A strategy ๐ ๐ โ ๐ ๐ is said to be weakly dominated if โ ๐ โฒ ๐ โ ๐ ๐ for an agent ๐ if ๐ข ๐ ( ๐ โฒ ๐ ,๐ โ ๐ ) โฅ ๐ข ๐ ( ๐ ๐ ,๐ โ ๐ ) โ ๐ โ ๐ โ ๐ โ ๐ and ๐ข ๐ ( ๐ โฒ ๐ , ๐ โ ๐ ) > ๐ข ๐ ( ๐ ๐ ,๐ โ ๐ ) for some ๐ โ ๐ โ ๐ โ ๐ where ๐ข ๐ ( ๐ ๐ , ๐ โ ๐ ) is the payo๏ฌ for agent ๐ if he/she chooses the strat-egy ๐ ๐ and the other agentsโ vector of strategies is ๐ โ ๐ De๏ฌnition 5.2 (Mixed Strategy Nash Equilibrium (MSNE)). [15]A strategy pro๏ฌle ( ๐ โ , ๐ โ , . . . , ๐ โ ๐ ) is called a Mixed Strategy NashEquilibrium (MSNE) for ๐ agents, if for each agent ๐ , ๐ โ ๐ is the bestresponse to ๐ โโ ๐ . That is, โ ๐ โ ๐ , ๐ข ๐ ( ๐ โ ๐ , ๐ โโ ๐ ) โฅ ๐ข ๐ ( ๐ ๐ , ๐ โโ ๐ ) , โ ๐ ๐ โ ฮ ( ๐ ๐ ) where ๐ ๐ = ( ๐ ๐ , ๐ ๐ , . . . , ๐ ๐๐ ) is the mixed strategy played by theplayer ๐ in which he/she chooses strategy ๐ ๐ with probability ๐ ๐๐ .By applying Iterated Removal of Dominated Strategies on the Pay-o๏ฌ Matrix, we discard strategies ๐ and ๐ from the solution set offast agents and discard ๐ from the solution set of slow agents. Wethen ๏ฌnd the following two mixed strategy nash equilibria amongthe remaining set of strategies:(1) Fast agents choose ๐ with probability of 0 .
74 and ๐ restof the time, while slow agents choose ๐ with probability of0 .
32 and ๐ rest of the time.(2) Fast agents choose ๐ with probability of 0 .
06 and ๐ rest ofthe time, while slow agents always pick ๐ .We make the following additional remarks based on the payo๏ฌ ma-trix:(1) The blockchain system would have been secure against anystrategic deviations if ( petty , petty ) had been an equilib-rium strategy. However, we observe that it is dominated bynearly all undercutting strategies for slower nodes. Hence,it would always be more pro๏ฌtable for the slower nodes toundercut. A lack of publishing fairness could explain this.(2) If the slow nodes choose minor_undercutting , it would bemore pro๏ฌtable for the faster nodes to choose major_undercutting .(3) If all the nodes choose major_undercutting the total rev-enue gathered by the network reduces to roughly 94.3% from97.8% indicating that fewer transactions are being added to lgorithm 1: Simulator
Input:
Distance matrix ๐ท ๐ ร ๐ , Number of rounds ๐ , Strategy ๐ ๐ โ ๐ โ ๐ โ [ ๐ ] Result:
Expected reward of each player ๐ ๐ โ ๐ โ [ ๐ ] /* Set of mined blocks */ Initialize ๐ต = genesis_blockInitialize longest_chain = for ๐ = to ๐ dofor ๐ = to ๐ doif ๐ ๐ wins a lottery in round ๐ then ๐ต โฒ = โ max_reward = for ๐ โ ๐ต doif ๐ satis๏ฌes strategy ๐ ๐ and ๐ โ ๐. round โฅ ๐ท [ ๐. miner ] [ ๐ ] then ๐ต โฒ = ๐ต โฒ โช ๐ max_reward = max ( ๐ โ ๐. round + ๐. leftover , max_reward ) endendfor ๐ โ ๐ต โฒ doif ๐ โ ๐. round + ๐. leftover โฅ max_reward then ห ๐. parent = ๐ ห ๐. miner = ๐ ห ๐. height = ๐. height + ๐. reward = min ( ๐ โ ๐. round + ๐. leftover , max_block_size ) if ๐ ๐ โ major_undercut then ห ๐. leftover = ๐ ห ๐. reward = ห ๐. reward โ ๐ else if ๐ ๐ โ minor_undercut then /* A small quantity ๐ */ ห ๐. leftover = ๐ ห ๐. reward = ห ๐. reward โ ๐ else ห ๐. leftover = end ๐ต = ๐ต โช ห ๐ longest_chain = max ( ห ๐. height , longest_chain ) endendendendendReturn: Expected reward of each player averaged over all chainswith length = longest_chain ๐ ๐ ๐ ๐ ๐ (75.22, 19.13) (71.72, 23.12) (74.29, 21.54) (73.75, 22.17) ๐ (75.22, 19.86) (76.05, 19.56) (72.17, 24.24) (74.99, 21.74) ๐ (63.30, 33.17) (63.35, 33.84) (66.90, 30.68) (74.02, 23.6) ๐ (63.41, 33.06) (64.04, 33.29) (56.66, 40.78) (67.54, 30.26) Table 1: Payo๏ฌ Matrix averaged over 100 simulations
The utilities shown here are the percentage of total rewardgrabbed by the fast and slow sets collectively. (They do not addup to 100% since some blocks may be underutilized)The strategies which would be removed by iterated removal ofdominant strategies (with tolerance of ยฑ ) are shown in blue. the longest chain. This means that the throughput is beingunder-utilized.(4) The equilibria strategies are even worse for the slower nodesin terms of fairness since they grab an even smaller share ofreward as compared to the strategy where all players acthonestly.Thus, if agents act rationally not only would security of theblockchain be adversely a๏ฌected, the lack of fairness among therewards received by the slower miners would be exacerbated. Garay et al.[10] and Kiyayas et al. [11] show that existing blockchainprotocols su๏ฌer from a loss of security properties as we scale thesystem. These security properties are fundamental to the operationof a robust DL. [10] and [11] consider a model with two types ofplayers, honest and adversarial. They consider that the adversarytries to attack the ledger by forking the blockchain. A successfulfork would allow the adversary to perform a double-spending at-tack. We, on the other hand, analyze the issues that may arise evenif all players are honest. We show that as we scale the system, notonly do the security properties su๏ฌer, but fairness also su๏ฌers, andhence, our work is parallel to theirs.Further, there have been many novel blockchain protocols pro-posed to scale blockchain without losing the security properties,e.g., OHIE [24], IOTA [17], GHOST [20], GhostDAG/Phantom [19],and many more coming up every day. We believe that our fair-ness measures are generalized enough also to be applied to them.However, the analysis may vary according to the design of the pro-tocol. Even though many of the DAG-based blockchain protocolsmanage to solve the issue of publishing fairness by allowing โo๏ฌ-chainโ blocks to be considered as a part of the blockchain, the fron-trunning issue persists. Due to unfairness in frontrunning, we ๏ฌndthat they su๏ฌer from a di๏ฌerent style of undercutting attacks. Wedemonstrate an example of such attack in a blockchain protocolknown as OHIE in Section D of the supplementary material.Researchers have been analyzing blockchain systems from a lensof game theory, Chen et al. [6] use game-theory to establish thetradeo๏ฌ between full veri๏ฌcation, scalability, and ๏ฌnality-duration.However, they do not consider network delays in their model, andhence, their bounds are quite optimistic. [2] study the consensusin a setting with rational as well as honest agents. [13] analyzeBitcoinโs transaction fees using auctions. [18] study fairness in thetransaction fees collected by the nodes in a transaction fee onlymodel and propose a fair transaction processing protocol.[16] de๏ฌne ๐ -approximate fairness and propose a blockchainprotocol that satis๏ฌes ๐ -approximate fairness in the case whereplayers have symmetric network access, whereas we study the casewhere players have asymmetric network access. In this paper, we introduced a notion of network fairness , inves-tigated the factors that in๏ฌuence network fairness, and studiedits impact on the agentโ revenue. We assumed a model in whichplayers have asymmetric network connections, i.e., some playersmay have a faster connection while others may have a slower con-nection and described two mechanisms via which this asymmetryould result in a loss of fairness in the system. We considered twoevents associated with the mining process, frontrunning and blockpublishing, and measured fairness for these events. We showedthat fairness can be quanti๏ฌed via ๐ ๐ and ๐ผ ๐ . ๐ ๐ is a measure of frontrunning due to network delays in broadcasting a transaction. ๐ผ ๐ or publishing fairness is the ratio of blocks of one node that getaccepted due to network delays over blocks of another node. Wefound that both of them deteriorate as we increase the throughputof existing protocols. Hence, even though it might look like theagents walk together (or the system is fair) while the throughputis low, at higher speeds, some agents may run faster (or gain morethan their fair share of rewards).We also discussed that not only does a lack of fairness impactsthe revenue of some agents, it might also create an incentive forthem to deviate from the honest mining strategy, which might im-pact the security of the blockchain system and further exacerbatelack of fairness in rewards.Thus, we conclude that even though blockchain is an ambitioustechnology, its potential is hindered by the underlying networkinfrastructure. REFERENCES [1] 2017 (accessed June 4, 2020).
BitcoinStats .http://bitcoinstats.com/network/propagation/.[2] Yackolley Amoussou-Guenou, Bruno Biais, Maria Potop-Butucaru, and SaraTucci-Piergiovanni. 2020. Rational vs Byzantine Players in Consensus-BasedBlockchains. In
Proceedings of the 19th International Conference on AutonomousAgents and MultiAgent Systems (Auckland, New Zealand) (AAMAS โ20) . Interna-tional Foundation for Autonomous Agents and Multiagent Systems, Richland,SC, 43โ51.[3] Moshe Babaio๏ฌ, Shahar Dobzinski, Sigal Oren, and Aviv Zohar. 2012. On bit-coin and red balloons. In
Proceedings of the 13th ACM conference on electroniccommerce (ACM ECโ12)
Proceedings of the2016 ACM SIGSAC Conference on Computer and Communications Security . 154โ167.[6] Lin Chen, Lei Xu, Zhimin Gao, Keshav Kasichainula, and Weidong Shi. 2020.Nonlinear Blockchain Scalability: a Game-Theoretic Perspective. arXiv preprintarXiv:2001.08231 (2020).[7] Matt Corallo. [n.d.]. FIBRE - Fast Internet Bitcoin Relay Engine.https://bitcoin๏ฌbre.org/[8] P. Daian, S. Goldfeder, T. Kell, Y. Li, X. Zhao, I. Bentov, L. Breidenbach, and A.Juels. 2020. Flash Boys 2.0: Frontrunning in Decentralized Exchanges, MinerExtractable Value, and Consensus Instability. In . IEEE Computer Society, Los Alamitos, CA, USA, 585โ602.https://doi.org/10.1109/SP40000.2020.00040[9] Christian Decker and Roger Wattenhofer. 2013. Information propagation in thebitcoin network. In
IEEE P2P 2013 Proceedings . IEEE, 1โ10.[10] Juan Garay, Aggelos Kiayias, and Nikos Leonardos. 2014. The Bitcoin Back-bone Protocol: Analysis and Applications. Cryptology ePrint Archive, Report2014/765. https://eprint.iacr.org/2014/765.[11] Aggelos Kiayias and Giorgos Panagiotakos. 2015. Speed-Security Trade-o๏ฌs in Blockchain Protocols. Cryptology ePrint Archive, Report 2015/1019.https://eprint.iacr.org/2015/1019.[12] Uri Klarman, Soumya Basu, Aleksandar Kuzmanovic, and Emin Gรผn Sirer. 2018.bloxroute: A scalable trustless blockchain distribution network whitepaper.
IEEEInternet Things J. (2018).[13] Ron Lavi, Or Sattath, and Aviv Zohar. 2019. Redesigning Bitcoinโs Fee Mar-ket. In
The World Wide Web Conference (San Francisco, CA, USA) (WWWโ19) . Association for Computing Machinery, New York, NY, USA, 2950โ2956.https://doi.org/10.1145/3308558.3313454[14] Satoshi Nakomoto. [n.d.]. Bitcoin: A Peer-to-Peer Electronic Cash System.https://bitcoin.org/bitcoin.pdf.[15] Martin J Osborne and Ariel Rubinstein. 1994.
A course in game theory . MITpress. [16] Rafael Pass and Elaine Shi. 2017. Fruitchains: A fair blockchain. In
Proceedingsof the ACM Symposium on Principles of Distributed Computing . 315โ324.[17] Serguei Popov. [n.d.]. The tangle. ([n. d.]).[18] Shoeb Siddiqui, Ganesh Vanahalli, and Sujit Gujar. 2020. BitcoinF: AchievingFairness For Bitcoin In Transaction Fee Only Model. In
Proceedings of the 19th In-ternational Conference on Autonomous Agents and MultiAgent Systems (Auckland,New Zealand) (AAMAS โ20) . International Foundation for Autonomous Agentsand Multiagent Systems, Richland, SC, 2008โ2010.[19] Yonatan Sompolinsky, Shai Wyborski, and Aviv Zohar. 2018. PHANTOM andGHOSTDAG: A Scalable Generalization of Nakamoto Consensus. CryptologyePrint Archive, Report 2018/104. https://eprint.iacr.org/2018/104.[20] Yonatan Sompolinsky and Aviv Zohar. 2013. Accelerating Bitcoinโs TransactionProcessing. Fast Money Grows on Trees, Not Chains. Cryptology ePrint Archive,Report 2013/881. https://eprint.iacr.org/2013/881.[21] Chrysoula Stathakopoulou. 2015. A faster Bitcoin network. (2015).[22] Visa Inc. [n.d.]. VisaNetBooklet. https://usa.visa.com/dam/VCOM/download/corporate/media/visanet-technology/visa-net-booklet.pdf.[23] Wikipedia contributors. 2020. Front run-ning โ Wikipedia, The Free Encyclopedia.https://en.wikipedia.org/w/index.php?title=Front_running&oldid=944160433.[Online; accessed 12-June-2020].[24] H. Yu, I. Nikolic, R. Hou, and P. Saxena. 2020. OHIE: Blockchain Scaling MadeSimple. In . IEEE ComputerSociety, Los Alamitos, CA, USA, 112โ127. https://doi.org/10.1109/SP.2020.00008
FAIL FUNCTION
Let us denote ๐ to be the probability of a nonce being successfuland ๐ to be the rate of queries to the hash function. In time ๐ก , theminer will be able to make ๐ ร ๐ก such queries.The probability of a query being unsuccessful will be ( โ ๐ ) . = โ the probability of ๐ ร ๐ก such queries being unsuccessful willbe ( โ ๐ ) ๐ ร ๐ก .For ๐ players (the total number of players in the system), the num-ber of queries in the same duration will be ๐ ร ๐ ร ๐ก = โ the probability of these nodes failing to mine a block willbe ( โ ๐ ) ๐ ร ๐ ร ๐ก .The value ๐ ร ๐ is known as the hash rate of the system, denotedby ๐ป .Let us denote the probability of ๐ fraction of the network failing tomine a block by the function fail ( ๐, ๐ก ) = ( โ ๐ ) ๐ ร ๐๐๐ก = ( โ ๐ ) ๐ ร ๐ป๐ก .For convenience, we sometimes use fail ( ๐ ) = fail ( ๐, ) , the proba-bility of ๐ fraction of the network failing to mine a block in a unitof time. B PROOF OF THEOREM 4.1
Theorem (Lower bound of { ๐ ๐ } ๐๐ ). { ๐ ๐ } ๐๐ > ๐๐๐ โ (cid:18) ๐๐๐ (cid:19) Proof.
Let frontrun_2 ( ๐, ๐ ) denote the event that top ๐ frac-tion of nodes succeed in mining the block before the transactionreaches the bottom 1 โ ๐ fraction. ๐ ( frontrun_2 ( ๐, ๐ )) = โ ๐ ( ๐ fraction of nodes fail to mine a block in time ๐ ) = โ fail ( ๐, ๐ ) = โ ( โ ๐ ) ๐ ร ๐ป๐ > ๐๐๐ป๐ โ (cid:18) ๐๐๐ป๐ (cid:19) = ๐๐๐ โ (cid:18) ๐๐๐ (cid:19) (cid:3) C PROOF OF THEOREM 4.2
Theorem. ๐ผ ๐ = ๐ โ ๐ (2) where ๐ = โ ร ๐ = (cid:20) ๐ โ ร ๐ = [( โ fail ( ๐ ๐๐ด ))( โ fail ( ๐ ๐๐ต )) + fail ( ๐ ๐๐ด ) fail ( ๐ ๐๐ต )]ร ( โ fail ( ๐ ๐๐ด )) fail ( ๐ ๐๐ต ) (cid:21) (3) Proof.
The proof follows from ๏ฌrst ๏ฌnding the probability ofA being successful in getting its block accepted in ๐ th round condi-tioned on the probability that neither of the blocks gain majoritytill the ( ๐ โ ) th round. We then use Bayesโ Theorem to ๏ฌnd out thetotal probability.The block mined by A will get accepted if the chain that includesAโs block becomes longer than the one that includes B. As soon asthe longer chain is received by a node that had previously acceptedB, the node must reject B and accept A instead. We assume thatas soon as the chain mined by either fraction becomes longer thanthat of their counterpart, their counterpart will switch to the longerchain. Let ๐ ๐๐ด and ๐ ๐๐ต be the fraction of network accepting A andB at the ๐ th round. We slightly abuse notation here to use A and Bto refer to the blocks mined by A and B, respectively. ๐ (cid:16) A gets accepted in ๐ th roundThe network is undecided in ( ๐ โ ) th round (cid:17) = ( โ fail ( ๐ ๐๐ด )) ร fail ( ๐ ๐๐ต ) (4)The network fails to decide in the ๐ th round if the length of thechains remain equal, i.e., either both fractions mine a block (whichis highly unlikely), or both fractions fail to mine a block. ๐ (cid:16) The network fails to decide in ๐ th roundThe network is undecided in ( ๐ โ ) th round (cid:17) = ( โ fail ( ๐ ๐๐ด )) ร ( โ fail ( ๐ ๐๐ต )) + fail ( ๐ ๐๐ด ) ร fail ( ๐ ๐๐ต ) (5) ( The network is undecided in ๐ th round ) = [( โ fail ( ๐ ๐๐ด ))( โ fail ( ๐ ๐๐ต )) + fail ( ๐ ๐๐ด ) fail ( ๐ ๐๐ต )]ร ๐ ( The network is undecided in ( ๐ โ ) th round ) = ๐ ร ๐ = ( โ fail ( ๐ ๐๐ด ))( โ fail ( ๐ ๐๐ต )) + fail ( ๐ ๐๐ด ) fail ( ๐ ๐๐ต ) ๐ ( A eventually gets accepted ) = ๐ = โ ร ๐ = ๐ ( The network is undecided in ( ๐ โ ) th round โฉ A gets accepted in ๐ th round ) = โ ร ๐ = (cid:20) ๐ ( The network is undecided in ( ๐ โ ) th round )ร ๐ (cid:16) A gets accepted in ๐ th roundThe network is undecided in ( ๐ โ ) th round (cid:17)(cid:21) = โ ร ๐ = (cid:20) ๐ โ ร ๐ = [( โ fail ( ๐ ๐๐ด ))( โ fail ( ๐ ๐๐ต )) + fail ( ๐ ๐๐ด ) fail ( ๐ ๐๐ต )]ร ( โ fail ( ๐ ๐๐ด )) fail ( ๐ ๐๐ต ) (cid:21) ๐ผ ๐ = ๐ ( A eventually gets accepted ) ๐ ( B eventually gets accepted ) ๐ผ ๐ = ๐ ( A eventually gets accepted ) โ ๐ ( A eventually gets accepted ) โด ๐ผ ๐ = ๐ โ ๐ (cid:3) D FRONTRUNNING IN OHIE
In this section, we describe a strategic deviation for the OHIE Pro-tocol based on frontrunning. OHIE is a permissionless blockchainprotocol that aims to achieve high throughput while tolerating upto 50% of the computational power being controlled by the adver-sary.OHIE composes ๐ (e.g., ๐ = ๐ โ ๐ chains concurrently. They are forced to split their computa-tional power across all chains evenly.The total block ordering in OHIE is generated according to theincreasing order of ranks and breaking ties by picking one witha lower chain id earlier. The miner of a block picks the rank ofthe block that follows it in a chain, i.e., the ๐๐๐ฅ๐ก _ ๐๐๐๐ . Notice thatthe chains may not be equal in length and might have di๏ฌerent ๐๐๐ฅ๐ก _ ๐๐๐๐ s at their last positions. This implies that if a block ismined in a chain having lower ๐๐๐ฅ๐ก _ ๐๐๐๐ than another chain, theblock might end up earlier in the Total Block Ordering than a blockthat has already been mined. According to the speci๏ฌcations of the protocol, a miner shouldpick the highest possible ๐๐๐ฅ๐ก _ ๐๐๐๐ in order to ensure that thechain the block becomes a part of, catches up to the longest chain.A miner can also choose which blocks to mine on top of. If a ra-tional agent wishes to insert his block earlier in the total ordering,he can choose a block that has picked a lower ๐๐๐ฅ๐ก _ ๐๐๐๐ over onewith a higher ๐๐๐ฅ๐ก _ ๐๐๐๐ . We describe a rational deviation basedon this fact.This deviation is similar to undercutting in Bitcoin, describedby Carlsten et al. [5] We assume that at least some agents are ratio-nal and follow a petty compliant strategy. The agents still chooseto mine on top of the longest chains, but in case of a tie or fork,they pick the block o๏ฌering lower ๐๐๐ฅ๐ก _ ๐๐๐๐ . Doing so providesan opportunity for strategic frontrunning by possibly achieving alower rank (and hence include the high-value transactions of al-ready published blocks of higher rank). D.1 Expected Reward of IncludingTransactions
In our case, the frontrunning is not guaranteed to be successful.The block could end up on the chain from which the transactionwas included. In which case, it will end up losing the transactionfees since it will not precede the original block from which thetransaction was included. The block is equally likely to become apart of the ๐ chains. Therefore we de๏ฌne the expected reward ofincluding a transaction as follows: E [ ๐ ] = ๐ ( Successful frontrunning ) ร ๐ The probability of the succeeding to frontrun a block ๐ will be: ๐ ( Frontrun ๐ ) = ๐ โ ร ๐ = ๐ ( Block mining on the ๐ th chain โฉ Block preceding block ๐ in TBO ) (6)We can expect a rational agent to include the transactions from themempool as well as transactions from other blocks that o๏ฌer thehighest expected reward.Similar to [5] we ๏ฌnd that for a petty compliant miner frontrun-ning is a better strategy since it guarantees as much reward as thehonest nodeโs strategy. As we try to scale the system to higherthrouputs by increasing the number of chains, the number of pos-sible blocks to frontrun will also increase (due to a higher probabil-ity of some chains being longer in length). Thus, the probability of strategic frontrunning also increases as we try to scale the system. D.2 Undercutting Agents
Now consider if a more aggressive agent does not mind forking achain. In the following example (modi๏ฌed version from the originalpaper [24]):In the example initial state, the chains are of unequal length.(Such an event is possible since the blocks extend chains at random,some chains can receive more blocks than others)Let us say that an honest node mines the next block on Chain 0.Since the node follows the default strategy of setting the ๐๐๐ฅ๐ก _ ๐๐๐๐ to be the maximum ๐๐๐ฅ๐ก _ ๐๐๐๐ among all chains, it sets the ๐๐๐ฅ๐ก _ ๐๐๐๐ to be 5. The mechanism by which the ๐๐๐ฅ๐ก _ ๐๐๐๐ is speci๏ฌed is byincluding a trailing pointer to the last block on Chain 1. Hence, hain 0Chain 1Chain 2
0, 10, 10, 1 1, 2 2, 3 3, 4 4, 5
Figure 3: Example initial state of an OHIE execution with ๐ = . Each block is marked with a tuple ( ๐๐๐๐, ๐๐๐ฅ๐ก _ ๐๐๐๐ ) . Chain 0Chain 1Chain 2
0, 10, 10, 1 1, 2 2, 3 3, 4 4, 5
Figure 4: The state after the honest node extends Chain 0. Adotted arrow denotes the trailing pointer. the ๐๐๐ฅ๐ก _ ๐๐๐๐ of this block is implicitly set to the ๐๐๐ฅ๐ก _ ๐๐๐๐ ofthe block that the trailing pointer points to. Chain 0Chain 1Chain 2
0, 10, 10, 1 1, 2 2, 3 3, 4 4, 5 ?, 2
Figure 5: The block formulated by an aggressive miner forundercutting. The dotted arrow denotes the trailing pointer.The three solid arrows point to the Merkle tree of pointersto preceding blocks.
Consider a agent that tries to undercut aggressively. It picks theblocks it wants to drop (in this case ( , ) on Chain 0 and ( , ) , ( , ) , and ( , ) on Chain 1) and then picks the trailing pointer to ( , ) . However, it could have picked ( , ) on any chain as the trail-ing pointer, in which case it would have been assigned a ๐๐๐ฅ๐ก _ ๐๐๐๐ of ๐๐๐๐ +
1. This deviation would have easily been detected sinceits trailing pointer would have lesser ๐๐๐ฅ๐ก _ ๐๐๐๐ than the block itprecedes, indicating the deviation. In our case, the agent tries to de-viate in a manner that is not distinguishable from a fork. In orderto do so, it selects a ๐๐๐ฅ๐ก _ ๐๐๐๐ that is greatest among the blocks inits Merkle tree. Chain 0Chain 1Chain 2
0, 10, 10, 1 1, 2 2, 3 3, 4 4, 5
1, 2
Figure 6: The three possible cases that could arise if the un-dercutterโs mining is successful
If the undercutter is able to mine the block successfully, it mayend up on one of the three chains depending upon the last log ๐ bits of the hash. We consider these three cases separately: โข If the block ends up on Chain 0, the new block forks thechain. Since the two forks are equal it is upto the nodes inthe network to choose the fork they wish to extend. Choos-ing the undercutterโs block in this case would be a betteroption for the petty compliant agents since it o๏ฌers a lower ๐๐๐ฅ๐ก _ ๐๐๐๐ . If the majority of the agents are petty compliant ,then the undercutter is successful. โข If the block ends up on Chain 1, the new block forks thechain. Since the undercutterโs fork is shorter than the orig-inal chain, it would be orphaned by all agents. In this case,the undercutter is unsuccessful. โข If the block ends up on Chain 2, the new block extends theoriginal chain. All agents will prefer to mine on top of un-dercutterโs block. In this case, the undercutter is successful.Hence, in 2 out of 3 cases, i.e., with a probability of 2 /
3, theundercutter is successful. Therefore, the agent may undercut if thereward obtained by picking transactions from the blocks it drops is3 / E [ Reward obtained by undercutting ] >>