On the Security and Scalability of Proof of Work Blockchains

Transcription

1 On the Security and Scalability of Proof of Work Blockchains Arthur Gervais ETH Zurich Scaling Bitcoin Milan

2 Synchronization Broadcast of transactions/blocks All transactions, blocks need to be broadcast into the whole network Larger blocks slower propagation increased consensus latency Risks of network partition (stale blocks ) 2 / 22

3 Synchronization Broadcast of transactions/blocks All transactions, blocks need to be broadcast into the whole network Larger blocks slower propagation increased consensus latency Risks of network partition (stale blocks ) 2 / 22

4 Synchronization Broadcast of transactions/blocks All transactions, blocks need to be broadcast into the whole network Larger blocks slower propagation increased consensus latency Risks of network partition (stale blocks ) 2 / 22

5 Synchronization Broadcast of transactions/blocks All transactions, blocks need to be broadcast into the whole network Larger blocks slower propagation increased consensus latency Risks of network partition (stale blocks ) 2 / 22

6 Synchronization Broadcast of transactions/blocks All transactions, blocks need to be broadcast into the whole network Larger blocks slower propagation increased consensus latency Risks of network partition (stale blocks ) Selfish Mining Denial of Service Double Spending 2 / 22

7 Decentralised PoW Blockchains Which one is a better Blockchain? 10 minutes 2.5 minutes 1 minute 20 seconds 3 / 22

8 Decentralised PoW Blockchains Which one is a better Blockchain? 10 minutes 2.5 minutes 1 minute 20 seconds Faster block generation Faster payments Bigger block size More payments / slower propagation 3 / 22

9 Decentralised PoW Blockchains Which one is a better Blockchain? 10 minutes 2.5 minutes 1 minute 20 seconds Faster block generation Faster payments Bigger block size More payments / slower propagation Bitcoin Litecoin Dogecoin Ethereum Propagation Time Medium Block size 8.7 s 1.02 s 0.85 s s KB 6.11 KB 8 KB 1.5 KB 3 / 22

10 Understanding Security / Performance of PoW Blockchains Contributions Quantitative Framework Compare security of PoW blockchains Account for double-spending and selfish mining Determine the optimal adversarial strategies Provide # of secure confirmations depending on tx value Increasing throughput without penalizing security Open Source Bitcoin Simulator Realistic simulation of network and blockchain properties Flexible reparametrization Scalable to thousands of nodes Open Source and documented 4 / 22

11 Decentralised PoW Blockchains Blockchain and Forks Block 1 Block 2 Block 3 Block 4 5 / 22

12 Decentralised PoW Blockchains Blockchain and Forks Block 3 Block 4 Block 1 Block 2 Block 3 Block 4 5 / 22

13 Decentralised PoW Blockchains Blockchain and Forks Block 3 Block 4 Stale blocks = lost effort Block 1 Block 2 Block 3 Block 4 5 / 22

14 Decentralised PoW Blockchains Blockchain and Forks Block 3 Block 4 Stale blocks = lost effort Block 1 Block 2 Block 3 Block 4 Block 1 Block 2 Block 3 Block 4 Block 5 5 / 22

15 Decentralised PoW Blockchains Blockchain and Forks Block 3 Block 4 Stale blocks = lost effort Block 1 Block 2 Block 3 Block 4 Block 1 Block 2 Block 3 Block 4 Block 5 Stale Block rates Bitcoin Litecoin Dogecoin Ethereum 0.41% 0.273% 0.619% 6.8% 5 / 22

16 Security of PoW Blockchains Double Spending TXlegitimate - Pays the vendor TXdoublespend - Pays the adversary B0 B1 TXlegitimate 6 / 22

17 Security of PoW Blockchains Double Spending TXlegitimate - Pays the vendor TXdoublespend - Pays the adversary TXdoublespend B 1 B0 B1 TXlegitimate 6 / 22

18 Security of PoW Blockchains Double Spending TXlegitimate - Pays the vendor TXdoublespend - Pays the adversary TXdoublespend B 1 B 2 B0 B1 TXlegitimate 6 / 22

19 Security of PoW Blockchains Double Spending TXlegitimate - Pays the vendor TXdoublespend - Pays the adversary TXdoublespend B 1 B 2 B0 B1 TXlegitimate 6 / 22

20 Security of PoW Blockchains Double Spending TXlegitimate - Pays the vendor TXdoublespend - Pays the adversary TXdoublespend B 1 B 2 B0 B1 B3 TXlegitimate 6 / 22

21 Security of PoW Blockchains What is Selfish Mining? [Eyal and Sirer] Instead of publishing, keep a block private Release block to compete Other miners will perform wasteful computations Adversary looses block rewards 7 / 22

22 Selected findings Selfish Mining vs. Double Spending Selfish Mining Increases relative reward Not necessarily rational Double Spending Increase absolute reward Economically rational adversary Consider them independently 8 / 22

23 Decentralised PoW Blockchains Towards a better Blockchain Block generation Slower payments Slower Faster Faster payments better security less security Faster propagation Smaller Bigger Slower propagation Block size 9 / 22

24 Understanding Security / Performance of PoW Blockchains Consensus & Network parameters Framework Security parameters PoW Blockchain stale block rate Security Model Block propagation times Throughput Optimal adversarial strategy Security characteristics 10 / 22

25 Decentralised Blockchain PoW Blockchain Blockchain instance can be A real blockchain (e.g. Bitcoin, Ethereum) Simulated blockchain Simulator captures (Open Source) Consensus parameter Network-Layer Parameters Consensus & Network parameters PoW Blockchain Stale block rate Block propagation times Throughput Block interval distribution Mining power dist. Block size distribution Geographical distribution of nodes/miners Number of connections of nodes/miners Propagation Protocol 11 / 22

26 Decentralised Blockchain PoW Blockchain Blockchain instance can be A real blockchain (e.g. Bitcoin, Ethereum) Simulated blockchain Simulator captures (Open Source) Consensus parameter Network-Layer Parameters Consensus & Network parameters PoW Blockchain Stale block rate Block propagation times Throughput Europe, 5.40% Block interval distribution Mining power dist. Block size distribution Geographical distribution of nodes/miners North America, 23.70% Asia Pacific, 70.90% Number of connections of nodes/miners Propagation Protocol 11 / 22

27 Decentralised Blockchain PoW Blockchain Blockchain instance can be A real blockchain (e.g. Bitcoin, Ethereum) Simulated blockchain Simulator captures (Open Source) Consensus parameter Network-Layer Parameters Consensus & Network parameters PoW Blockchain Stale block rate Block propagation times Throughput Europe, 5.40% Block interval distribution Mining power dist. Block size distribution Geographical distribution of nodes/miners Number of connections of nodes/miners North America, 23.70% Australia, 1.66% Asia Pacific, 5.74% Asia Pacific, 70.90% Japan, 1.19% South America, 1.13% Propagation Protocol North America, 38.69% Europe, 51.59% 11 / 22

28 Decentralised Blockchain Security Model Security parameters Captures optimal adversarial strategies for Selfish Mining for Double Spending based on Markov Decision Processes Security Parameters Adversarial mining power Stale block rate Connectivity of the adversary Impact of eclipse attacks Mining costs Number of required confirmations stale block rate Security Model Optimal adversarial strategy Security provisions 12 / 22

29 Security Model Markov Decision Process Extension of Markov Chains Adds actions and rewards State space and action space B 1 B 2 B 3 B0 B1 State: (3, 1) 13 / 22

30 Security Model Markov Decision Process Extension of Markov Chains Adds actions and rewards State space and action space B 1 B 2 B 3 B0 B1 State: (3, 1) Attacker chain 13 / 22

31 Security Model Markov Decision Process Extension of Markov Chains Adds actions and rewards State space and action space B 1 B 2 B 3 B0 B1 State: (3, 1) Attacker chain Honest chain 13 / 22

32 Security Model Markov Decision Process Extension of Markov Chains Adds actions and rewards State space and action space B 1 B 2 B 3 B0 B1 State: (3, 1) Attacker chain Honest chain 13 / 22

33 Security Model Markov Decision Process Extension of Markov Chains Adds actions and rewards State space and action space B 1 B 2 B 3 B0 B1 State: (3, 1) Reward for adversary: 2 Attacker chain Honest chain 13 / 22

34 Security Model Markov Decision Process Extension of Markov Chains Adds actions and rewards State space and action space B 1 B 2 B 3 B0 B1 B3 State: (3, 1) Attacker chain (1, 1) Honest chain Reward for adversary: 2 13 / 22

35 Selected findings How many confirmations required to match security? vs. Stale block rate 6.8 % 0.41 % 14 / 22

36 Selected findings How many confirmations required to match security? vs. smaller block rewards higher stale block rate Stale block rate 6.8 % 0.41 % 14 / 22

37 Selected findings How many confirmations required to match security? vs. smaller block rewards higher stale block rate Stale block rate Matching Block confirmations, 30% adversary 6.8 % 0.41 % minutes 60 minutes Litecoin would require 28, and Dogecoin 47 block confirmations respectively to match the security of 6 Bitcoin confirmations. 14 / 22

38 Selected findings Increasing throughput? Based on Simulator results 1 MB blocks 1 Minute Block interval 15 / 22

39 Selected findings Increasing throughput? Based on Simulator results 1 MB blocks 1 Minute Block interval Stale block rate does not increase substantially 15 / 22

40 Selected findings Increasing throughput? Based on Simulator results 1 MB blocks 1 Minute Block interval Stale block rate does not increase substantially From 7 tps to 60 tps, without sacrifising security 15 / 22

41 Selected findings Selfish Mining under constant difficulty Mining 1000 blocks 30 % selfish miner mines 209 blocks, instead of 300! (under optimal strategy) Eyal and Sirer s strategy yields on average blocks Selfish Mining yield fewer block rewards than honest mining. 16 / 22

42 Selected Findings Influence of Stale Block rate on Selfish Mining Relative revenue α =0.1 α = Stale rate r s Bitcoin Ethereum The higher the stale block rate the higher the relative revenue 17 / 22

43 Selected findings Double-Spending Profitability depends on transaction value Quantifying resilience using minimum vd, s.t. double-spending is profitable α =0.1 α =0.3 vd Bitcoin Stale rate r s Ethereum 18 / 22

44 Selected findings Double-Spending Profitability depends on transaction value Quantifying resilience using minimum vd, s.t. double-spending is profitable Threshold at which doublespending is more profitable than honest mining vd α =0.1 α =0.3 The higher the vd, the better 10 1 Bitcoin Stale rate r s Ethereum 18 / 22

45 Selected findings Number of required confirmations (Bitcoin) Necessary confirmations k v d =$ v d =$10000 v d =$ Adversarial mining power α 19 / 22

46 Selected findings Double Spending Bitcoin vs. Ethereum vd in block rewards Bitcoin, k =6,blockrew. Ethereum, k =12,blockrew. Ethereum, k =6,blockrew. Bitcoin, k =6,$ Ethereum, k =12,$ Ethereum, k =6,$ Adversarial mining power α vd in $ Double-spending resistance of Ethereum (k in {6,12}) vs. Bitcoin (k=6) 20 / 22

47 Selected findings Block reward impact For a fixed transaction value We show that the higher the block reward (e.g., in USD), the more resilient it is against double-spending Merchant can vary the # of confirmations depending on the transaction value 21 / 22

48 Summary Quantitative Framework Compare PoW blockchains objectively Selfish Mining not always rational Double Spending is rational Blockchain Simulator 22 / 22

49 Summary Quantitative Framework Compare PoW blockchains objectively Selfish Mining not always rational Double Spending is rational Blockchain Simulator Block confirmation equivalence 6 Bitcoin = 37 Ethereum (20 sec) = 28 Litecoin (2.5 min) = 47 Dogecoin (1 min) The higher the block reward in USD, the more resilient against double spending 22 / 22

50 Summary Quantitative Framework Compare PoW blockchains objectively Selfish Mining not always rational Double Spending is rational Blockchain Simulator Block confirmation equivalence 6 Bitcoin = 37 Ethereum (20 sec) = 28 Litecoin (2.5 min) = 47 Dogecoin (1 min) The higher the block reward in USD, the more resilient against double spending Good block size/interval 1 MB block and 1 Minute block interval +60 transactions/s without scarifying security (instead of Bitcoin 7 tps) 22 / 22

51 Summary Quantitative Framework Compare PoW blockchains objectively Selfish Mining not always rational Double Spending is rational Blockchain Simulator Thank you! Block confirmation equivalence 6 Bitcoin = 37 Ethereum (20 sec) = 28 Litecoin (2.5 min) = 47 Dogecoin (1 min) The higher the block reward in USD, the more resilient against double spending Good block size/interval 1 MB block and 1 Minute block interval +60 transactions/s without scarifying security (instead of Bitcoin 7 tps) 22 / 22

52 23 / 22

53 24 / 22

54 25 / 22

55 Decentralised PoW Blockchains Proof of Work Blockchains B0 B2 B3 H(B2) txs 26 / 22

56 Decentralised PoW Blockchains Proof of Work Blockchains B0 B2 B3 H(B2) txs Mining Find Nonce N, s.t. H(H(B3) txs N) < target 26 / 22