The Economics of Cryptocurrency Mining with Aviv Zohar | a16z crypto research talks

Transcript

very pleased to introduce the view Zohar from Hebrew University where he's a professor he's uh he's been in the space longer than almost anybody uh for example he could already as early as 2012. he had a kind of an official peer-reviewed kind of paper about Bitcoin and so on so he's been doing this for a long time very excited to hear about what's on his mind these days um I believe Hollywood thank you and thanks for the opportunity to be here so uh people here also feel free to interrupt me I'm used to Israeli crowds that are not staying silent during a talk um so what I want to do today is is give a talk about topics from different papers

that are recent some newer than others uh so I'm gonna talk about basically proof of work based cryptocurrency Mining and I want to kind of give a rant about how after all this time you know I've been in the spaces from 2012 as Tim said we still don't understand a lot of the economic aspects of cryptocurrency mining we have a lot of paper and results but we still don't have like a clear framework where we can say you know we figured it out we know what's what we're doing um so I'm going to give a lot of open questions and and some of the recent results that that I had uh in my research group had on on this and so for

the first part I'm going to look at some of the basics of of Mining and and here I'm going to talk about proof of work mining as option pricing specifically so I understand there are some Finance people in the audience Tim warned me in advance this is going to be very very simple Finance stuff which is uh almost trivial to people from Finance but I find it very surprising for Cs and econ people we'll get to that when I show you the stuff the second part I'm going to talk about manipulating the protocol so sort of selfish mining style attacks and I want to talk about

a timestamp manipulation attack that we found that you can actually see is being done in in practice in ethereum right most selfish many you know selfish mining attacks we have not observed in the wild so I think this is the first case of you know of an instance where miners are manipulating the protocol for personal gain so we can no longer ignore these things and say okay maybe nobody does them so we're safe uh and the third part I want to talk about is a little bit about uh recent work on stretching squeezing attacks where you can delay the time between blocks or make it shorter and that's uh that produces this form of minor extractable

value that you know reaches in from the consensus layer again into the economic layer and has implications so I'm gonna try and do all three parts if we don't have time for another time maybe just the first two so let's start with Asic pricing this is Joint work with Aviation um and I don't know if any of you have seen these things this is a mining calculator that you can find online basically if you are a person who buys one of these miners for yourself you can try to figure out what's your return going to be on on operating this machine so you can you know type in the numbers hashing power or power consumption

electricity cost and so on and this gives you some expectation of what you're going to earn and and how fast so don't take these numbers specifically I think they're correct for you know a few years back when I when I took the screenshot but basically this thing works on expected utility like you can expect that given the current hash rate given current conditions given the current price and so on your minor will mine so it's so many Bitcoins and you will earn so and so many dollars in return and we in general can think of the expected utility model for mining you know is something that usually is

captured by a formula like this so I'm uh I'm I'm writing here what is the value of a mining opportunity I'm thinking of a you know a short period of time maybe at time T when I'm evaluating it at time T and the exchange rate of of the of you know of Bitcoin or whatever cryptocurrency we're mining over is given as CT so what what is the thing I would expect I have my reward which is uh you know proportional to my share of the hash rate right H is my hash rate over the entire Network's hash rate plus me all right so I've my part of the reward and I get some block reward in Bitcoins

uh and there's an exchange rate you know Bitcoin to dollars and then I have to pay for something like electricity or you know other costs uh so maybe you know kilowatt I'm spending over 10 minutes of Mining and I have an electricity cost and this there's a Max between this and zero because I can always turn off my mining machine and decide not to mine right I can you know spare the costs of electricity and but not get any of the rewards right and I'm assuming everything is smooth here because mining pools make it almost as as smooth as you'd want you don't actually have to wait you know the 10 20 years in expectation until one of these machines gets you Bitcoin but you can really get

rewards um quickly Okay so um right in in this model when you think about it is already interesting why would people mine right so in regular competitive settings right we'd expect um when there's competition and you're uh you have several miners competing for something right you'd expect naively for the profits to go to zero right everybody's competing until you know the most efficient miners remain in the market and the other ones go away that's like our standard economic way of thinking so surprisingly this already we know already that this isn't true

people are obviously mining but even based on this expected utility model there's a nice result coming from EC I think 2019 by Amos Fiat Anna Carlin Christos Papa dimitria you know talking about energy equilibria in proof of work mining saying that the market equilibrium of something like this is already that you would have at least two miners in any market and that they can both make money out of mining in equilibrium and nobody and it's not like a second price scenario where the least efficient Miner is kind of left with zero rewards so this is quite quite a

surprising result and it comes from this proportional aspect of mining so this is what we were looking at when we were thinking of mining you know why would people mine is this reasonable thing to do and you can always ask yourself this question of should I just maybe buy the Bitcoins that the miner is going to give me instead of investing in all this hardware and running it and doing all this song and dance if I'm I'm an investor going into mining should I just be holding Bitcoin instead right so I want to show you a different perspective on mining different from the expected utility one and this is where we go to finance where people think about risk right and

um the maybe the basic Insight that we had is that mining Hardware is economically equivalent to a bundle of options okay so I want to give you the equivalence exactly right so let's talk about the European option what is a European option it's it's a contract basically that's that allows you to buy a certain asset at you know the exercise date it's on future date for a predetermined strike price you're gonna you're gonna be paying something to get it and the option holder can decide of course not to buy the asset at the date you can decide not to exercise the

option okay and this contract itself is worth something because if I can tell you you know you can buy a you know one Apple stock in in a year's time from now for 50 cents maybe that would be worth a lot if you expect the price of the Apple stock to be more than 50 cents that would be worth something so how is how does that equate to mining Hardware so right what is Bitcoin mining Hardware it's a machine it's instead of a contract right but it allows you to obtain Bitcoins at future dates right so I'm gonna say it's a bundle of options not not a single option but at certain times in the future what you need to get these Bitcoins is

to pay a fixed amount of electricity into the machine you basically inject electricity you get Bitcoins and you can decide not to exercise the option in the sense that you turn off your mining machine and you don't get the Bitcoins right so that's your decision so this is right we know how to price options then we should know how to price Bitcoin miners yeah right so there's also a bit of uh so so I need some model of how things would change right here there's an underlying model of how the stock price changes here you have an underlying model how of how the exchange rate

changes and we also have to reason about the hash rate so I what I'll actually claim is we can actually somehow endogenize the hash rate changes into the model but we'll start with a model that assumes a predetermined growth of hash rates so the mining calculator is actually also do something like that do you assume some some certain growth right you have to make assumptions but once we have some model we can start to think about it so this is where I get really trivial for finance people um so uh but but I think the results end up being surprising for for for me at least when I first saw this so there is a model called the binomial

model which is a very simplified discrete way of talking about what you might know as Black Shoals Black Shoals is a way of pricing options the binomial model is something that computer scientists like to think in discrete terms can can handle more easily in instead of differential equations and so on so in the binomial model we have time that proceeds in rounds okay so we have a state that we're in at time T we have the exchange rate or the price of the asset that that we're building the option over and there is a simple random walk that we do which is you know with probability P the price goes up with probability one minus P the price goes down

and this this random walk is multiplicative okay so either we grow by Delta time you know Delta times the price or to lowercase Delta times the the price okay this is the traditional model and Black Shoals has similar underlying assumptions using using gaussians instead of the discrete model um right so we continue this again after you know moving from t plus 1 to t plus two the price might change stochastically with some random walk okay so that's the underlying model and at the limit if you take these time

periods to be really short you get the same gaussian noise and and random walk as as Black Shoals okay so now what do you do uh we're going to look at a single time step and I'm going to try to price the mining opportunity of a minor at a certain time right the time t plus two okay so this is the mining opportunity it's going to happen here I don't know the future price of Bitcoin but I'm going to try to sell it to someone today so think of a mining contract somebody says I'll give you the proceeds of mining tomorrow if you pay the electricity cost for the money okay so now

we already looked at this way of you know evaluating the cost of mining if I'm going to make enough money compared to the cost of electricity then this is going to be my reward otherwise zero right I choose not to exercise the option I just turn off my machine so now we want to know what is the value of this mining opportunity not at time step T but at time step T minus one if I sell it ahead of time what is it going to be worth and um at least for me the first answer to this would have been right the Temptation is to say let's take the expected value of you know tomorrow right the expectation

between these two events and that's going to be the value today right assuming like there's no interest rates or over time or something like that um and that would be wrong okay and a hint as to why it's wrong is because if you look at the value of the currency today it is not the expected value of the currency tomorrow right the exchange rate is not what it is in expectation so something is already off in the model and what we capture here is that people are saying you know the reason I'm valuing this currency less than its expectation tomorrow is because of this volatility and I don't like

volatility I need I maybe I have a business to run I need returns that I can predict and so I value something a little bit less if it's very volatile right so the price might change and so my evaluation of Bitcoin for example today versus one year is not an expected value okay so what I'm going to show you to convince you that the expected value here is wrong is what you basically build when you solve for the pricing of of an option I'm going to give an numeric example just to convince everybody who doesn't know this already um and in my numeric example I'm going

to show you a way that I can make money if I sell this mining opportunity for the expected price I can make money regardless of the future event that happens it's risk-free return okay so this is very basic stuff for finance people so I'm going to be selling a single mining opportunity at time T I'm assuming I'm just plugged in you know bogus numbers this is not obviously the the value of Bitcoin but let's assume we're starting with a price of 400 dollars per Bitcoin with probability one half the price doubles tomorrow and with probability one half its halves tomorrow okay so either 200 or 800 and and now I have a mining machine that's given 250

dollars worth of electricity would give me a single Bitcoin okay if I use it you know here and I'm going to be selling a single mining opportunity at time t which will avoid us this uh one Bitcoin if we pay for the electricity and I'm gonna assume the the interest rate is zero percent just to not have that factor in the equations and now we can figure out what the value of this mining opportunity is in each one of these cases right so if the price goes to 800 I'm going to be getting eight hundred dollars for the for my one Bitcoin but I'm paying 250 dollars for electricity right so that's

550 left for me on the other hand if our price drops to 200 dollars it's going to cost 250 to run the machine so I choose not to do this if the price drops and I get zero okay so the expected value right half times 550 and half times zero is just 275 dollars okay so let's so that's what would have happened if we follow the expected value okay now I'm going to put that up there just so we remember it and I'm going to show you how to make risk-free profit I'm going to sell this mining opportunity to someone for 275

dollars and I'm gonna make returns regardless of what happens okay so this is exactly what you do when your pricing options so I'm going to start with zero dollars right I have a kind of a portfolio that I'm holding in my hands at the start of the first day right here and here are the actions that I take first of all I sell the smiling opportunity to somebody for 275 dollars so now I owe a mining opportunity and I have some cash I borrow some more money 183 and one-third okay and I buy 11 out of 12 Bitcoins right 11

12 of a Bitcoin at 400 per Bitcoin okay so now I have a little bit less cash but I have an asset okay I still owe stuff right the mining opportunity for tomorrow um so now we are we have to look at the scenario that we get to on day two I have this portfolio that I started with and let's assume that the price dropped to two hundred dollars okay what do I do now this mining opportunity that I owed is worth zero right it doesn't give anybody you know nobody's gonna use it and nobody's gonna get the Bitcoins so I I no longer owe it it's at zero now I can basically sell the Bitcoins

that I have here for this 200 almost 200 dollars and I can repay my debt and I'm left with ninety one dollars and two-thirds you can you can check the math for me but if you if you want but I had almost a Bitcoin that that you know basically uh covers my debt and uh leaves me with a little bit of money so so that's nice if the price drops we just made a profit okay what happens if the price goes up to eight hundred dollars so I now owe a mining opportunity so first I'm gonna have to give somebody a Bitcoin in exchange for the

electricity to run the machine so I buy the remaining Bitcoins that I need 1 12 of a Bitcoin so I have a little less cash it's very expensive it's eight hundred dollars um I collect the electricity costs from this person and basically I give them the one Bitcoin and now I no longer owe them the mining opportunity and if we look at my debt again I'm left with 91 dollars and two-thirds okay so I made risk-free return basically by just trading Bitcoins in exchange for a mining opportunity

okay so for finance people this would be trivial but I I find it surprising that you can do something and do better than expected value right yeah I guess uh maybe an intuition that one intuition for what's going on here is that there already is an unfair bid in the economy which is Bitcoin because Bitcoin is making profits on average right so that's like my intuition for this would be if you have an unfair bet then any other vet which is correlated with your author of it has to be exactly as unfair that's true because two of the things that are perfectly correlated having different expected returns allows you to arbit drive so I guess the Intuition or the in finance languages would be sort of Bitcoin you program your race premium

in anything which is Carlo Bitcoin invested that's true right so Bitcoin has a risk premium in it then mining has a risk premium involved in it and then the no Arbitrage rule basically says unless you sell it for the right price you can make money right um that's true okay so so this has implications right so the basic implications about stock options now hold about hold for Bitcoin right so so right we we made out with money anyway so right the real value the the correct value of the option is not this 275 dollars it's you have to subtract the money that I've I've just made from it it's actually 183 dollars and this is the risk premium uh you know the reason uh it is valued less is

because of the risk um so now we just did one time step but you could actually do more right you could you can derive um the price of the mining opportunity in the future going back as far as you want um and and then you can you can basically write it down either as a formula or an algorithm to compute it backwards on this on this tree of States okay so this is this is the trivial Finance aspect the reason we're doing the algorithm is because when we go off the protocol for something else we can still compute the values right and we're not going to keep the protocol necessarily the same for example we might change the hash rate that's out

there from step to step based on the price itself the price itself if the price goes up many people rush to buy mining hardware and the conditions change and we might even have path dependence on how we get to a certain state if we went up in price and down people bought a lot of mining hardware and then turned it off versus if we go down and then up maybe there's less mining Hardware out there to compete with me and so I would expect things to be different and this is where we deviate from the Black Shoals classical model and we get interesting things that are kind of different um I won't go into all these results though but I will show you that we actually went to Amazon we looked at

Hardware costs so this is the antminer S9 I think this is the platform that was for sale for the longest period of time um and so we it was interesting for us to look at it the expected value if you you know you make some assumptions about price of electricity and so on you know you see is much higher than how we expect um A6 to actually be priced which is the Reds and green line basically the green line is if you price the A6 itself and the red line is if you hold this portfolio that you're mimicking options with and you're actually paying for for fees to actually do the all the all the

shifting of the portfolio that you need to do over time so what we get is that in some sense mining calculators overprice this Hardware all right yeah the question here I guess the mining calculator is making two mistakes I guess and one mistake is that they fail to account for the optionality and then there actually the hardware is more valuable than they think it is but the second thing is they fail to account for the risk premium given the optionality which I think bias is down yes right so I think yes it's actually ambiguous which way that goes and it may it seems to suggest like they're ignoring the risk premium it's kind of the the bigger effect I guess yeah um they're not ignoring the risk premium

because they're using the current price of Bitcoin which already includes some of the risks right so maybe they're accounting for that but the Gap is huge right sometimes you know when we were looking at prices you see we were pricing something in four thousand dollars and it's you know the expected value would have been double right that's that's a huge change yeah and minor game do they choose the Ashley or you take it for teammate each of them so each each Miner chooses the hash rate so what I showed you up until now is just an assumption that we have on the hash rate continuing to grow as it has grown before but we have a second model in the paper

where you are actually endogenizing the hash rate you're saying okay as long as in you know a mining machine is profitable I will buy it until the moment where it's not right so we go back to this zero returns sort of thing like the merge I add mining machines until the marginal uh profit is goes to zero a or to some level that you know costs to to manufacture these and then you can actually have an an endogenous mining rate by the rest of the world and if you have an increasing price you can figure out what all the miners are are going to do in terms of buying hash rates right and it doesn't matter which minor buys

the hash rate it's still competing the miners can sell machines to each other they're still in the market they're still mining so it doesn't really matter do you have to actually take a stance on what the risk premium is or not because the classic black girls but um you actually don't there's a trick where sort of the P actually falls out right same here okay we do we do this no Arbitrage rule Justice in classic flag shots and and it vanishes out right I don't see the risk premium that's the way of accounting for it I guess this is why they got the Nobel Prize um um so so I want to talk about the implications right let's think about what we know about option pricing right

so first of all bitcoin's volatility increases the A6 value in some sense right if you think of options they are worth more when the underlying asset is more volatile right because um your gains could grow if bitcoin price explodes suddenly you are making a lot more money on the other hand from below you are bounded by zero you cannot you can just lose the you know your investment but right so you have bounded losses and potentially unbounded rewards if you increase volatility um so this is something that's interesting because you know the uh the the value of A6 provides security

to bitcoin so so this is something about Bitcoin security if Bitcoins if the price if bitcoin's volatility goes to zero you know we are losing something from from from the value of uh of these Asics another thing is that imitating portfolios right holding this these assets that mimic a mining opportunity that allowed me to fulfill a mining opportunity without actually having a minor that's a competition that's an alternative investment strategy to becoming a minor and the thing that makes this slightly less efficient than actual mining is that I have to pay fees to readjust my portfolio as the price changes so as we have a lower volatility and lower exchange fees right if if the

market becomes better at doing these then the the Gap is going to narrow and it's going to be easy to just hold imitating portfolios instead of mining which means we are losing security for Bitcoin again right as well as so so not just the volatility of the of the currency but also the exchange fees yeah I have a couple questions but I mean does this this assumes everybody has to pay the same price for electricity right so so the naive model does of course but you could of course think of situations where that's not the case right so some some mining machines will be turned on and some off right if you

have a certain mix let's say you have an efficient and an inefficient minor present at the market at the same time then some of them get turned off at different prices right the price as the price Falls you could definitely do that right so so the so so this way of thinking and working with the discrete model is something that you can actually do the computations for for a mixture of mining types as well it doesn't matter that a lot of minors in practice buy their electricity on a long-term contract I mean does that just stretch the time Horizon out here I don't I don't think it does because you can buy our electricity on a long-term Market you can also resell it on the short-term market so one thing that we've seen right I think in Texas there's a heat wave or something miners promise to

release electricity back into the grid for you know air conditioners of people um and they get the spot price right so the fact that they purchase in advance is just um you know a position that they took on the price of of electricity irrespective of what Bitcoin mining does right and they can decide to forego it um so so that's that's that um I'm gonna skip this in the interest of time uh so so the model covers a bunch more stuff there's actually uh innovation in mining Hardware where you can lower the activity level of your Miner to make it more efficient in terms of the you know hash rate per jowl of it of energy that you put in and this can

also go into the model um uh definitely an alternative to turning off the miner so you could have different levels of activity um and you can think of going deeper into the rabbit hole in terms of strategy for the Asic manufacturers think of the Asic manufacturer building and Asic if the price of Bitcoin goes up he's going to get sold sold out but if the price tanks he's going to be left holding a lot of Hardware so sometimes they decide how much uh Asics they have have to to manufacture in advance without knowing the future there's also a kind of a a real option this these decisions are called real options um uh where they have to account for risk in the market themselves so kind of

the second level of of pricing um okay so now I'm gonna switch over to another topic so I hope I got you interested in this probably not going to have time for all three uh so this is a recent discovery that we've made about mining manipulations uh we call it Uncle maker okay time stamping out the competition this is going to be a time stamping attack in ethereum and this is Joint work with avivation in gilad Stern uh okay so mining right uh we think of miners as being uh kind of you know usually honest but uh because we haven't seen a manipulation in practice but I'm going

to show you I think what is clear evidence of manipulation Aviv likes uh likes to have to have memes in everything he does so this is his meme um so when we're talking about selfish mining right we have this seminal work by ay Allen Sierra that shows a profitable deviation from honest mining in Bitcoin right we just have a deviation what we don't really have is is is right um a new equilibrium that miners would go to because that thing is not even clearly defined but we've had other manipulations since then I think the same EC 19 conference that I mentioned before had a paper by Gordon spiegelman also on the economics of mining where

they show that even turning on and off your minor uh on regular intervals is is better than mining honestly in terms of rewards so this is something that's going to be very hard to fight there have been suggestions on how to stop selfish mining in the sense of the Allen Sierra but I don't know how you do that with uh what Gordon and spiegelman suggested um and the question we you know everybody keeps asking is why you don't see these in the wild and the answer people usually give is that long-term incentives are hypothesized to win over these you know short-term gains you know you're going

to get bad reputation as a minor and that's going to hurt you and the protocol might get changed after you do your manipulation so now I want to talk about the manipulation but to show you where it happens I have to kind of explain ethereum's difficulty adjustment algorithm and this came out when we started to look at it and we try to understand this interesting formula that's kind of looked like it was pulled out of the hat right so the difficulty of a block block I plus one is in ethereum is the difficulty of block I right and we have to change it if something happens right plus some term okay what is this term usually we add

one here okay we do this in increments of the difficulty over 2048. so we're going to make a a 1 over 2048 increment in difficulty or or you know a few steps more so this term here is going to determine how many steps of increment are we going to make or decrement um so we're going to add one plus one if this block has an uncle minus t over 9 rounded down T is the time between the current block that we are mining and the previous one so if you know one second has transpired we're not going to deduct anything but if many seconds have

passed the time between blocks is really long we want to decrease the difficulty a little bit okay so this goes T over 99 and the maximum decrement that we will have is minus 99 okay we can't we don't want to lower the difficulty too much in one go okay so this is a little bit of a weird formula and when we were looking at this we were wondering about this T where does it come from as I am mining does is T the time between the last block and the block that I'm currently mining or is it the time between the two previous blocks this would have been reasonable because this is something that's set and easy to decide but ethereum have this decided

somehow to make the current block time t Okay so t as I am mining I'm you know incrementing the clock I'm not succeeding in mining and the mining actually gets easier and easier and easier as I go okay so this is a strange choice but this is what they did um and now I want to show you the attack okay so let's suppose we have a blockchain and somebody just mined a block with 10 seconds interval here okay and I as an attacker decide to put eight seconds on my timestamp I can change my timestamp to be whatever I want right so

maybe naively you know what I'll go back for a second you would think that if I push the time on my clock forward in time it actually makes my mining easier so maybe that's what I want to do I want to mine with a higher probability of success but kind of counter-intuitively I'm going to change in the other direction I'm going to lower the timestamp on my block so the interblock time is actually eight seconds so what does that do the next block that's created by by an honest Miner has to choose one of these two blocks one of them is going to be the main chain block and the other one is going to be an uncle okay and how do we choose between two

chains of the same length we choose based on difficulty the higher difficulty chain is the one that wins so how do I make my difficulty higher I lower the time T right if I go over nine seconds this decrements the difficulty by one more step okay so my incentive is to actually fudge the timestamps in the other direction okay right so protocols choosing the highest difficulty chain have to prefer the attacker's block and the thing that you need to remember is that uncles do get rewards in ethereum but they get smaller rewards than the actual block reward they don't get fees on transactions and they get

and they create less ethereum okay this deviation is only relevant when someone else finds a block basically at the same time yeah so it's relatively rare it's the impact is not high right this is I'm going to make a little bit of money just you know converting from an uncle block to a main chain block so and and it doesn't happen often because usually most of the blocks are found even faster I think um maybe not most but a good number is it also the case that if I type A red block that creating my block is actually lower difficulty because there's greater time between

whatever time stamp I choose and the previous two plus eight and whatever I choose versus a previous two plus ten so I'm sorry I'm not sure I so the next block ah so you're saying you have an incentive to pick uh the the block with the older times the earlier time stamp because it'll make your difficulty easier yeah yeah I think you were right but it also means that your block is easier for the attacker to attack right if I've just attacked a block I fudged the timestamp you're mining honestly again you have a higher difference than than ordinarily right so the attack kind of helps itself in some sense

um so right so here's the attack mine all blocks with the minimal interblock time of T equals one you could you have to put in a value of at least one second higher than the previous block that's a consensus rule in ethereum and then you can have fewer uncles right and you can just override the chain but if you think about this attack also makes double spending easier you don't have to have a longer chain if there is a single block in the chain that you're overriding that took longer than nine seconds to create then you can win in case of ties this also makes selfish mining more effective this is even better than gamma equals one you can catch up to the chains from behind if you know what selfish mining means if you don't then I won't go into

it and in practice what we see is a softer attack so so now I want to show you the graphs that we actually went looking for um so this is so this is a histogram of all blocks created in ethereum um uh you guys can't see exactly what's written here on the x-axis but this is basically the the timestamp difference from from your parent block okay so you have the histogram and you might see these bumps at eight seconds and it's 17 seconds which are slightly suspicious we looked at that and we said wait something is going on here this is uh for blocks over uh height 12 million in ethereum which was 500 and something days ago okay so we have over 3 million

blocks here in this histogram um so when we went to look at individual miners these are aggregated over all minors we found this this is f to pool okay it's one of them mining pools over ethereum and you will notice that in the last three million blocks F2 pool created zero blocks that had nine seconds interval to their parents zero blocks that had 18 seconds zero blocks that had 27 seconds to their you know from their predecessor and so on so what we assume that F2 pool is doing is basically every block that was supposed to be created nine seconds after its predecessor they just shifted

to eight seconds so this column is twice as almost twice as high as it should be and that's exactly the missing piece right so this is a softer form of attack snaps yes so the nine rounded down right when you go to eight rounded down you're basically One Step lower okay so this is kind of odd they could have spread it out a bit more evenly or they could have just subtracted the second from their timestamp at all times I suppose there were other ways of doing this but they chose a particular way and uh we went looking for other miners so what you see F2 pool is here in red actually that's uh you know this Gap but

there's there are other miners which we don't know how to identify we call the first one Sneezy actually because Sneezy is doing something that looks a bit more aggressive than F2 pool so if you look at f2 pool's height here right this bar is double roughly double the size of what it should be for the green one it's much more than double right so they're doing something more aggressive in terms of time stamp manipulation or so we suspect and again all of these miners create zero blocks with nine seconds after the predecessor okay and uh one last graph to show you about this you know this is not a victimless crime if we're looking at uncles that are created

by miners but by other miners okay so ethermine is the largest mining pool in ethereum you can see that when they create a block after nine seconds they have a higher block Uncle rate so these are the number of this histogram shows the number of uncles these miners are creating so ethermine is a victim here and you see the bar is higher here and Hive on which is another mining pool also has a higher bar of you know a higher rate of uncles here uh and you have F to pool for comparison um in in in green they have zero uncles with nine seconds because they don't create any of these blocks at all okay

um so basically what this strategy does it's a very simple thing right you change the the timestamp in a block you get fewer miners this translates to a certain small percentage of increase in your rewards which for mining pools is very very big actually once they're a decrease in Grant to this graph so basically if if we knew nothing about this this was supposed to be an exponential uh distribution right the inter-arrival time of blocks is exponentially distributed right if it's a memoryless process mining right if I didn't succeed in the first second my my expectation is you know for this distribution to be the

same it's the exponential distribution but usually our inter-arrival time that should Decay exponential there is a slight correction here about a fraction of blocks that were on code and that you would expect to do flat right a fraction of blocks that were Uncle would have been would have been flat so this this is just this is how many uncles had one second from their parent how many had two you know after two seconds maybe a block was found and I'm already mining on on top of new chain so uh one thing that I I I should also talk about is why there's a difference um oh sorry why there's a difference uh at the

beginning right why is this not uh the one second why is it not higher than two seconds I think that accounts for propagation time of the block so usually when you get a block you don't start to mine at Time Zero because it took a while to reach you so even under honest Behavior so so there is some effect of propagation but I think this is you know quite the Smoking Gun um in terms of showing manipulation Okay so so here we have our open questions like you know what what is the equilibrium um in mining in general right we don't know if you look at selfish mining we have a a game where you have hidden blocks people withhold blocks so we have

hidden state right it's not a a a normal form game that we can just solve and find the equilibrium um we don't know if there's an incentive compatible mechanism we keep seeing things and and and researching this is a moving Target right ethereum made up these rules the ethereum 2 is going to have different rules um we're going to look for new manipulations Once the protocol is decided on uh it keeps changing all the time um different aspects when you go to look at the code look different than what you thought they would be in the white papers or yellow papers and so on yeah you have a question sure yeah is there like some kind of uh

almost like prisoners dilemma here where the honest fools could notice that F2 cooler whoever is playing this game and just never include them as an uncle as punishment that could be done but I think I think the the first thing that I would do is I would also change my timestamps right the the if we're adjusting the domain of timestamp manipulation everybody should always mine a block that's one second in the future after the previous one and the ethereum's timestamp clock stops for progressing correctly from from now on and and by by the way that has a lot of consequences for things built over ethereum because some platforms actually look at the clock when they give you

interest rates uh on on on on deposits and and collect interest rates for loans so if if the clock isn't moving correctly you're in trouble if if we're thinking of behavior like that like like what you were suggesting we're gonna get to very dangerous domains right it's really wise it seems like it's an equilibrium of all the big miners sort of agree like nobody's going to manipulate time stamps and if you do everybody else will punish you so so if I took off a half a second for my time stamp at all times how would you know that I'm manipulating maybe I'm just receiving all the blocks faster than you there's no way to clearly determine that you're doing this I mean this manipulation that we see from F2 pool is very crude

but you could do this much more subtly so are you sure the purposeful thing I mean the fact that it's been these multiples of nine come out from the formula so what we know is that um the second Miner that was on the list here um that I called Sneezy the green one started two days after F2 pool you know so maybe you know it could be an accident but I don't think so um they're doing it purposely why would they concentrate on these multiples of night like because they've just appear in the formula right so you should have gone to one second but maybe people would have complained that the clock wasn't progressing

correctly so they wanted to do the minimal change I think whenever you're at nine go to eight that lowers your blood your uncle rate and and it does not perturb the protocol too much I don't know why you could do it another way where it's kind of less obvious that you're the multiples of nine sort of come out naturally something else I I I I highly doubt that I highly doubt it I mean a minor would you ordinarily not touch the you know the mining code if they wanted to be honest you know I don't think you would change it right there's there's a certain place where where you have to do uh changes to to

the timestamp it takes effort to change the timestamp yeah yeah are you accumulating this queue in time like like if if say all the blocks are doing by F2 Pro they keep kind of pushing the time backwards so if every Miner was doing this you would be accumulating but once there's a single honest Miner they they they they use the correct time there is by the way a limit you cannot publish a block that's 15 more than 15 seconds in the future according to the local clock of the machine um so you're not going to run forward too too much but but you will catch up if there is a an honest minor

okay as long as there is one so I think this is this is fairly interesting I think the most interesting part is not that the attack is very sophisticated it's it relies on various uh something that you could describe as a glitch I think the more interesting part is that somebody chose to to exploit it uh which is which is the new thing um it's almost like an argument against episode or something like that people with so I I had a lot of conversations with minors and that they were telling me things that they're trying to shave off hundreds of milliseconds or tens of milliseconds on how fast their block

gets sent out to the network and the and the reason there was they were telling me this is you know if you're a mining pool um your profits are not the entire block you're paying it out to uh right to to the miners themselves you make a you know a one percent two percent return on on the actual block and if you think about this you know 100 100 milliseconds in sending out the block translates to a small percentage of of the block reward being way you know saved potentially due to uncles and things like that but having to pay out the rewards to minors like if you pay per share or something like that without thinking of the risk you suffer the losses they are eating up

a lot of your one to two percent so for the minor every small Improvement gives them a lot of Revenue um I think I think this this uh is why you see mining pools doing things that look even ridiculously small and they're putting a lot of effort into infrastructure because it translates into their own bottom line you know quite quite well yeah is the current difficulty update rule as you stated in the slide this is the current difficulty for ethereum one yeah so I'm just going to show a different result from a different paper where we actually visit revisit the same difficulty adjustment procedure and in this paper what we were trying to do

again is manipulation for uh time between blocks but this time we actually want to manipulate the actual time between blocks not the timestamps um so I think of this my thinking of this is like this we like to have our um you know protocols arranged in layers right there's a we think of a networking layer and a consensus layer that works you know assuming the networking layer works well and then there's data on the blockchain that assumes consensus is okay and we interpret this data as smart contracts and maybe the native currency to the blockchain and all these things but really when we have a minor extractable value

you know the the layer model breaks the economics break it right we have implications from the consensus layer affecting other layers right and it's in some sense our fault because we pay rewards in the native currency for cons for you know to the consensus layer uh actors and we have sequencing that you know they they decide on the order of things so this is minor extractable value right um this is how we're used to think about to thinking about it so now I want to show you that the consensus layer can also change maybe manipulate the time between blocks which affects smart contracts in different ways

okay so that's another way of thinking of minor extractable value not just through sequencing um so the results are basically that you can manipulate the time between blocks you can stretch them or squeeze them and I'll skip to the maybe the most interesting part of the result and the that's actually happening in ethereum let me try to show this okay so we have another term that we briefly mentioned before there's a one here that you increase the difficulty if your block that you're building has an uncle right so an uncle block you're pointing to

something right so this this actually makes sense from a design perspective of the system if you have a lot of uncles that means blocks are are getting sent slowly relative to the mining speed and you might want to slow down the system so it makes sense to have a term here that slows down if you have too many uncles but you could manipulate right and what we found is that the 25 minor for example can decide to just mine uncles how do you just decide to mine uncles you mine blocks and you release them only once the competing block has been found so you do this strategically right on purpose and you keep bumping up the difficulty level and what you get is uh

like a 50 something percent slow down in the rate of blocks in ethereum compared to what it's supposed to be and it's one that the difficulty adjustment algorithm does not correct for it it creates right and then what do you do with this right so you could do a 60 almost a 60 slowdown in ethereum over a long period of time um so what you do is you go to D5 platforms like Ave right and that accrues interest over time using the time stamps that we just talked about and you can go to compounds where you know deposits and withdrawals accrue interest per block not over time because they don't trust the timestamps because you can

manipulate the timestamps and then you can write take a loan in one deposit in the other and fudge the block rate right so this is minor extractable value again somebody from the consensus layer is messing with the way we measure time in higher level protocols and can make money right so if you look at RV and compound you have to get over a certain hurdle and that's the that the deposit rate and borrow rate have a gap right usually you have to pay higher interest for borrows than you get for deposits this is the profit that the platform makes and the way it accounts for risk um but because you can slow down

ethereum by so much you can make it worth your while and you can take you know larger and larger loans in theory and and and screw up these protocols right make money um so I I will grant you that this is slightly more theoretical you need very large loans to make a large amount of money but but this is something that we have to think about when we're measuring time we're talking about higher level protocols that measure time there could be other interests to slow down the blockchain maybe you want to increase congestion as part of a different attack right if you slow down the number the rate of blocks transaction fees will go right maybe you can make money off of that in some way so this question is in

the last column everybody's doing the same thing and there's no opportunity right here what do you mean I suppose everyone's doing for time so I I think there will still be an opportunity right because suppose depending on the platform right so so if you're paying um maybe you took a loan in fixed interest rate right you could change the rate after you took the loan right that's assumed a certain rate of blocks right the interest rate was calculated for you in advance and set in stone for the next year for example so that's already an economic mechanism that you make invalid by this you could also take external loans I mean a regular Bank uses time and not blocks right so you

can take an external loan off the blockchain borrow money for some interest rate put it into the blockchain and then then manipulate block rates and do all sorts of weird things so basically any application that's implicitly relying on a rate of block creation could be subject to failure right so I will say that once you take out this um um this aspect of of the uncles from ethereum it becomes significantly better and it even outperforms Bitcoin in Bitcoin what you could do the attack would be very simple right if you look at Gordon and spiegelman's result turning off and on the miners right if you turn off half the mining power for example right what happens to the

blocked to the right to the uh to the block time it just doubles right if half the miners are gone so a two-week mining period becomes a four week mining period right and then you put back the the that half that you took off then the mining you know the block rate doubles instead of a two week period you have a one week period so we did basically two epochs instead of doing them in four weeks we do them in five weeks so we actually slowed down the protocol by by 25 with a 50 minor okay so instead of taking off the the mining power what you really could you don't want to do that because you're losing money on this you could switch from selfish mining to not if you're

selfish mining for a while you're actually overriding the chain of occasionally but a lot of mining power is actually off now and then you switch it on and off or you switch your mining from cryptocurrency to cryptocurrency you switch over so you're still making a rate of return but you're manipulating time right so something here is is broken but in Bitcoin it takes you two weeks to adjust the rate ethereum responds much faster if you take off this penalty for uncles so maybe this is solvable at the protocol level but definitely the current protocols don't handle it that well okay so I'll I'll stop here I I think I

gave you a bunch of examples there's more stuff I didn't talk about I know you know Tim's worked on this on the you know TX fee mechanism there's a lot of stuff going on on there you know that's somewhat arbitrary there's a lot of interesting works you can look at Futures on on block space that value was working on there's you know how do you do the gas cost manipulation I think there's like a menu of costs which is arbitrary for computational actions uh proof of stake is going to be a whole new ball game I don't know what's gonna go on there every protocol is very different um and and I think my rant is that we know less than we should right at this point

in time this is basic thing that incentivizes all of cryptocurrencies and and we see it break or our misunderstanding of it in in many different forms that I tried to show you today um right uh uh so I I was talking about proof of work that's uh CPU based but you could think of you know space memory or bus axis so on they would have different characteristics and and different manipulations would work on them I think all right so I'll stop here and thank you for participating so Clement was asking any sense of how much this is worth in terms of excess

payment the dishonest miners earn so I'm guessing this means the manipulation uh for after pool so we have numbers I I don't think it's a lot of money I think uncles make maybe 80 85 percent of what a block makes in terms of printed money and you lose the fees I don't have exact figures for for right now that I can pull out um I probably have them in the paper so this it's not a huge percentage of rewards because it only operates right now they're only gaining on blocks that are created exactly 9 18 27 seconds they're not even

attacking blocks that are created 10 seconds after which they could have attacked right they could have had fewer uh uncles there so the attack that they did make is relatively limited you could have done better um even if you would have done the full scale attack I don't think it would have been a huge percentage um but as I said these are these minor improvements for them mean a lot to their bottom line okay so I I'm surprised that right as you said that Epsilon equilibrium has to be rethought I'm not sure it's an Epsilon for them though but it's very easy to to rewrite the code for the attack you just have to change the

timestamp it could be even external to the mining code you could do what what a vvh did when he when he was coding this he actually did a container that changed the time selectively uh I think for first for for this um foreign Neil asks any thoughts on how these pools figured this out trial and error so we have no idea uh I think Aviva saw anecdotally on some minor forms that they were discussing this that they wanted to do something with the time stamps I think if you go and you read the yellow paper you see this nine rounded down kind of stick out and

maybe they that's what they did so somebody probably paid to look at these things at these mining pools but it's all speculation um Matt asked just to confirm for the timestamp manipulation attack they actually have a one over 2048 lower probability of finding a block by doing this attack but the uncle probability is much higher than this yeah exactly so Matt is saying what when you're manipulating the time the time stamp you're making it harder for you to mine but you have a certain Uncle rate that naturally occurs for this to be worth your while

right that's correct okay is the solution to the hardware Theory problem automatically a solution to the easier one in the sense that sort of like you might accidentally when trying to solve the easier problem have a solution that's a solution no you have to decide in advance what you're trying to solve for and then basically you're tossing a coin and there's a probability of success that's how you use it but you have to commit it into that to solve the harder right you commit to solving the harder problem and then you you toss your points are gone but like you actually put the difficulty parameter into the block editor which is then what you're hashing yeah the timestamp itself is in the

header and then when you when you're hashing that you're basically you've committed to to this approach okay and in Bitcoin is it possible to do the same kind of manipulation or so I think there's there are many time many time stamp attacks on bitcoin I think they work more at the end of the two-week epoch so you can slightly change the difficulty and I I don't think that they're very drastic you could also have a slight drift of net what's called Network time uh the time that uh you know blocks are you know which window of time they're accepted into into Bitcoin so so their manipulations are much smaller um they're not as a

interesting I guess here there's this question of uncles which doesn't exist in Bitcoin at all right thank you [Applause]