by Rod Garratt and Rosa Hayes – Liberty Street Economics, Federal Reserve Bank of New York
In June 2014, the mining pool Ghash.IO briefly controlled more than half of all mining power in the Bitcoin network, awakening fears that it might attempt to manipulate the blockchain, the public record of all Bitcoin transactions. Alarming headlines splattered the blogosphere. But should members of the Bitcoin community be worried?
Miners are members of the Bitcoin community who engage in a process that validates new additions to the blockchain in exchange for a reward that comes in the form of newly issued bitcoins. The process is essentially a tournament, where the likelihood that a miner receives a reward is proportional to the amount of computing power he or she employs. Mining pools are groups of miners that pool their computational resources together and split the rewards. An individual or group of miners that provides more than 50 percent of computational power to the validation process can manipulate the blockchain, but this power is limited by the fact that blockchain is, as mentioned above, a public record; no one can add false transactions to the blockchain.
There are only two manipulations a controlling pool could attempt: refusing to validate specific transactions (which prevents people from sending bitcoins between addresses) or reversing transactions the pool sends during the time it is in control. Such actions would likely lead to a huge decline in the value of bitcoin, if not a complete collapse of the entire system. So would it be worth it for a pool of miners to manipulate the blockchain?
Think of the situation as an infinitely (or indefinitely) repeated game. Is there a one-shot manipulation that will earn the controlling mining pool more than its expected future earnings? If not, then the pool has little incentive to manipulate the blockchain, as doing so would destroy its source of future income. We argue that the incentives for a 51 percent attack are low given the current conditions of the bitcoin market, but that the incentive for such an attack may increase in the future.
The Current Situation
In order to evaluate the costs and benefits of a manipulation one needs to perform a few calculations. The current market price of bitcoin is approximately $400, and twenty-five bitcoins are made available approximately every ten minutes to the miner or pool that solves therequired hash problem. Thus, a group that controls 51 percent of all Bitcoin mining revenue would earn .51*25*6*24*$400 or $734,400 per day.
In calculating mining profit, we assume that all miners want to buy the best mining chips currently available. However, there are a number of reasons why miners may not retire old chips immediately when new, more efficient chips become available, for example, if they believe the difference in efficiency between new and old chips is negligible or if there are delays in shipping new chips. Thus, it is likely miners use an array of chips with different efficiencies, as long as the average efficiency of the mining rig is good enough to be profitable.
The website Tradeblock lists fifty-two mining chips in current or recent use. In calculating the total electricity use of the Bitcoin network, we use the average wattage of the top twenty chips listed on Tradeblock, 0.73 Joules/gigahash (J/GH), to estimate the average wattage of the bitcoin network. The current hash rate of the Bitcoin network is about 250 million gigahashes per second (GH/s), according to Blockchain.info. If all mining is done via an average-wattage 0.73 J/GH chip, then the bitcoin network would draw 182,500 kilowatts, using 4.38 million kWh/day at the current hash rate.
According to a 2012 report from the International Energy Agency, the average price of electricity in the OECD was $0.1109/kWh for industrial energy use and $0.158/kWh for household use. It is unclear what proportion of bitcoin miners are industrial versus individual; however, many bitcoin startups presumably receive industrial energy pricing. Using the simple assumption that half of all electricity used by the Bitcoin network is used by industrial users and half is used by household users, the total electricity cost of the entire Bitcoin network is equal to .5*($0.158/kWh+$0.1109/kWh)*4.38 million kWh/day or $588,891.
The electricity cost for a group controlling 51 percent of all mining power is thus $300,334 per day, so the group’s mining profit is $434,066 a day. If the group discounts its future earnings with discount factor d, the cost of a one-shot manipulation is $434,066*d + $434,066*d2 + $434,066*d3 + … =$434,066*d/(1-d). Therefore, the group’s incentive for throwing away a profit of $434,066 a day will be low unless either the profit from the one-shot manipulation or the group’s discount rate is very high. Low market interest rates and very high profits suggest that a group’s incentive to defect should be low given present market conditions.
Bitcoin Mining in the Future
The monetary rule of the Bitcoin protocol stipulates that the block reward halves every 210,000 blocks, or roughly every four years. The most recent reward halving occurred in 2012, putting the estimated time of the next halving in 2016. When this occurs, mining revenue will decrease by 50 percent per block. All else equal, a group controlling 51 percent of mining power could continue to profit with a reduced block reward. At 12.5 bitcoin per block, the pool’s share of daily revenue will be equal to .51*12.5*6*24*$400 or $367,200. This exceeds the estimated electricity cost per day of $300,334, so the group will continue to have a positive profit ($66,866 per day). Although the cost of a one-shot manipulation will have decreased by nearly 85 percent, it is unlikely that there exists a manipulation that would make defection profitable in the near term. Of course, this conclusion might change at future dates when the reward is halved yet again.
As the block reward decreases, some Bitcoin users argue thattransaction fees will make up for the revenue miners currently earn as the block reward. Transaction fees are optional bitcoin-denominated fees that users can attach to their transactions in order to speed processing time; the miner that wins the block reward also receives the transaction fees included in the block. According to Blockchain.info, transaction fees currently make up about 0.34 percent of miner’s revenue. However, even if users begin to attach larger transaction fees to their bitcoin purchases once block-reward revenue drops below electricity costs, the majority of users will have little incentive to pay transaction fees in excess of the electricity cost of processing their transaction. In this case, the cost of a defection will be fairly low and possibly profitable for a group that controls 51 percent of mining power.
Another issue to consider is free entry. Given the positive profits of existing miners, there is belief that more miners will enter the market. An increase in the number of miners will cause the hash rate of the bitcoin network to increase, as more mining rigs are simultaneously employed to solve hashes. As long as the value of the block reward remains constant, the entry of new miners should cause per-person profits to fall to zero, or at least below the value of a one-shot deviation. If this occurs, a mining group controlling 51 percent of computing power will have a larger economic incentive to manipulate the blockchain.
What about improvements in mining technology? Might this improve the profitability of mining and mitigate the threat of a 51 percent attack? No. The protocol adjusts so that coins are released at the same rate regardless of the aggregate hash rate. In other words, the size of the pie miners compete over stays the same when a new technology emerges. The only thing that might change, temporarily, is the way it is sliced. There can be a shift in how profits are distributed towards early adopters. But ultimately all miners will be forced to adopt the new technology and no one will have an advantage. The situation is a standard prisoner’s dilemma.
Suppose there are two miners, Alice and Bob, who both currently use the same type of chip. Each miner controls the same proportion of total mining power, and thus has an equal chance of winning the block-reward, R. Now imagine that a new chip becomes available, with the same wattage as preexisting chips, but a hash rate that is 50 percent faster and costs C. If either Alice or Bob uses the fast processor and the other uses the slow processor, then the person with the fast processor will have a 60 percent chance of winning the reward and the person who uses the slow processor will have a 40 percent chance of winning the reward. The situation can be summarized by the following normal form game.
In each box, the payoffs shown are for Alice and Bob, respectively, if the action pair is as shown in the row/column headings. If the increase in revenue from switching from a slow chip to a fast chip is greater than the increased cost of the fast chip (that is, if 0.1R>C), then Fast is a dominant strategy for each player. The result is that both players buy the fast chip and earn the same revenue as before the new chip was introduced. So the introduction of the new chip makes both players worse off. The point is that because of the way the protocol works, faster chips do not increase aggregate profits, and because of strategic incentives, miners are forced to adopt costly, but nonbeneficial technologies. Innovations in mining technology are something that miners as a whole would prefer to do without.
Disclaimer
The views expressed in this post are those of the authors and do not necessarily reflect the position of the Federal Reserve Bank of New York or the Federal Reserve System. Any errors or omissions are the responsibility of the authors.
Source: http://libertystreeteconomics.newyorkfed.org/2014/11/bitcoin-how-likely-is-a-51-percent-attack.html#.VHMlM4vF9K4
About the Authors
Rod Garratt is a vice president in the Federal Reserve Bank of New York’s Research and Statistics Group.
Rosa Hayes is a senior research analyst in the Group.
