J1 RF 03 Patrick McCorry Mining Pools and miner attacks

hey guys Syrus is about to begin so everyone just take a seat I guess I feel like I'm at the university now with the lecture theatre okay so my name is Patrick McCrory and I'm a postdoc at UCL and today I'm going to present some work that we published at the Bitcoin workshop called smart contracts for bribery minors and I did this in collaboration Maya with Alexander Hicks who's a PhD student at UCL and Sarah Michael John so before I talk about bribery I liked I want to make sure that everyone in the room has the same mental model of a smart contract I know everyone here to the theorem developer and has huge experience with smart contracts but I want to make sure we're all very consistent so I like to think of smart contracts as sort of like a trusted third party Republic state and I've got this little robot that illustrate what a smart contract is so pretty much a smart contract gives us some guarantees that the code is immutable and can never be modified that the robot will honestly execute our protocol in our behalf all execution is atomic so either the function works or it doesn't work and finally that elects the gossip it can't keep any secrets so if I put my dear to birth with the smart contract he's gonna tell everybody when I was born so now we all have a rough idea what a smart contract is is this trusted third party so what's a bribery attack so if I'm a wealthy adversary and I want to take over the blockchain maybe I want to censor a transaction I want to reverse a transaction or I'm just malice and I want to kill the cryptocurrency altogether there's two ways where I can do this my goal is that I need to get over 51% of the network's hashr yet I can either buy hardware or I can rent hardware from existing miners so buying hardware is actually really expensive and there's a really good paper by Dubai now about that so in this approach we're gonna rent existing hardware for miners and there's two ways we can do this we can either pay the miners in bond ie I create a transaction with a very large transaction fee and I give out to the miner and every time the miners do what I want I'll send a new transaction with a very large fee other ways I can pay them out of bond I mean if the miners do what I want I can give payment on a different cryptocurrency or I can give them a bank transfer and once the briber has control of over 51% of the network's house writ he can then perform these attacks now I'm sure people in the room were wondering bribery I mean why would miners ever do this is this really a realistic attack so hopefully I get mood of it not a little bit so mining is action an example of the tragedy of the Commons if you consider the entire set of miners they all have a long term interest or sorry they have an interest in the long-term health of the system but in the short term miners may deviate from their might their mining strategy and order the booster short-term profits so that could be some type of southeast mining and really I'll be seeing this in practice today so I'm going to go a bit Bitcoin centric for the next few slides there's been a lot of drama this year so as most people are aware I mean we're Bitcoin cash that emerged I'm Bitcoin cash modified their mining algorithm a little bit so sometimes it became really easy the mined Bitcoin or Bitcoin cost blocks and what actually happened was that sometimes it was more profitable than mine Bitcoin cash than it was Bitcoin on what we seen was miners jumping back and forth depending on which team was more profitable than mine so it gives you a really good illustration that miners are after short-term profit but now as we can see they are mining Bitcoin in the long term so that tragedy of the Commons has actually played out in real life on another question is has bribery already happened have miners been bribed in the past and there's no concrete evidence but this was a coin desk article by Jimmy song who's a core developer and he alluded to the fact that Bitcoin cash miners may be accepting a bribe out of bond and order the mining Bitcoin cash so we have some allegations that bribery is happening already but it's not detectable and of course if we're going to actually have any bribery attacks we need to have some wealthy adversary who's going to fund the attack and this was roughly I think a February a February 2017 when Bitcoin and limited or Bitcoin XT was you know gaining some momentum on this minor he owned bait EC top and when I did the work in October he had 15 and of the network's competition of power and he pretty much said the following if there's a fork and bet quite a limited you know goes his way and tries to become the new Bitcoin he's willing to invest 100 billion dollars to kill core coin they kill Bitcoin f is a smaller fork so I mean that's a lot of parking and of course it's didn't happen in real life but he did say it and I'm pretty sure he does have a hundred million dollars reserved so we do have wealthy adversary's out there who's willing the attack cryptocurrencies and finally we have a very good Twitter poll by Fatah liqu when I was making these slides in January and I mean has 15,000 votes I never take of a pinch of salt because I mean its Twitter it's probably a bunch of bots voting for it or trying to give make me send them eath but anyway so what we can take away from this is that 35% of people in this poll said that they're willing to tolerate a 51% attack ever it happens around once every 10 years or less than 10 years and that's actually quite surprising so 51% attacks and this community or somewhat expected and could be socially acceptable okay so bribery again so what about the state of the art I'm obviously not the first person to think of very bribery attacks so there's three different papers that have all proposed different ways to do this the first one is called a wheel transaction and there's fairly straightforward I mean they create a transaction with a very large fee and this works better in Bitcoin than it does in a theorem actually I guess it works in a theorem smart contract as well but basically I told the miners I want them to do something maybe I want them to censor some transaction and if they keep censoring the transaction I'll say the transaction with a large fee I'm broadcast to the network and I'll keep doing this do you ensure that transaction never gets in now it's not trustless so either have the trusted briber they keep signing transactions or we have to chose to bribe minor to keep censoring transactions it also doesn't divert any haa straight away so miners are still mining real blocks and finally as an inbound bribery attack the next one is called a script puzzle and I really like this one this one's really cute so basically I create a contract or a transaction where if you solve a proof-of-work puzzle you get to claim the reward on the whole point here is that if the rewards high enough miners will solve the puzzle in your transaction instead of the blocks so you're basically diverting their ha straight away if you get the network's hofstra to be smaller then I need less house ready to take over the network and it's also trustless because you have to trust the transaction or the contract they give out their reward on it could be inbound or out of bond so basically I set up a smart contract with the proof-of-work algorithm for Bitcoin then Bitcoin miners combine my smart contract and finally there's proof of Steel block and this one's basically an attack on a mining pool and it works as follows I'm a miner and I am working as part of the big pool and I'm centered in my proof of work you know trying to make some money then I'm eventually very lucky and I create a block I have two choices either give my block to the pool master and he brought causes out to the network and then it gets in the blockchain or I can just keep a secret and not tell anyone about it and then I win an hour - and after an hour I'm guaranteed that my steel block will never get into the blockchain and then what I do is I simply publish it to an aetherium smart contract and then I get rewarded for doing that but the point here is that as an attack on a mining pool and it's not fully trust less because it's really difficult to prove or verify a Bitcoin block and aetherium basically because of the wall megabyte says it also diverts ha straight away because I might need steel blocks my blocks never contribute to the overall weight of the block chin honors out of bond was actually makes its attack quite viable okay so what I'm gonna propose is three different contracts and our idea is that we want to remove all trust between the briber and the Bribie and I'm going to go through each contract one by one they're first ones called censorship cone where the briber wants have full control over the blockchain and order the sensor transactions I'm one nifty trick in this attack is that we also use the uncle block reward policy the subsidize the attack so we have Alice and Alice is are very cute driver this is really malice underneath I'm basically she says to the miners I want to take over the ethereum blockchain will he help me and then she basically tells them - if you want to help me please pursue an uncle bloc mining strategy but what is an OCO bloc choosing keas people in the room aren't familiar effectively Anoka bloc is the following we have block a a mere block B and they're both competing they get in the blockchain then somebody extends block a so block a and maybe Block C they become the longest chin well but normally hopping in Bitcoin is our block B would be a steel block it'll be discarded they would never get in the blockchain Underminer would never get any reward but in etherium we have Uncle blocks so we have a steel block that doesn't get in the blockchain you can leader include that as an uncle block so as you can see here that little blue thingy is b1 it got included as an OCO block in the longest chin and the miner got 3.6 eath for that now the point is that the sooner your uncle block gets in the blockchain the higher reward you get so if you have to we have two blocks you get 2.2 eath maybe a three blocks you get over in one point a teeth okay and there's also another consensus rule where every me and block in the blockchain can only include up the two Janka blocks so now that everyone is aware what Anoka block is all this basically tells the miners to do the following only my uncle blocks and only extend my blocks this way the network will help fund her attack and I don't have enough time to go into the details of the full attack I'm happy to talk about it afterwards if anyone's really interested but the outcome is that the briber is going to create all the Miam blocks and these blocks are walking teeth are part of the transactions and all the bribers will only create uncle blocks and they'll be able to prove to your contract that they mined a knocko block and they'll get a reward for that as well now what's the point of this well each oka block will pay up to 2.6 east to the bribe minor and the briber only has to pay the remaining block reward which is something like no point for eath plus the bribe itself so it's actually a really cheap bribery attack in a sense and there's some caveats with this attack so if you want to maximize your subsidy so you pay as little as possible for this attack the briber needs to have at least 25% of the Haas react and that's because of that consensus rule where you're going to have two yoga blocks per block and there's more than two blocks per me and block being created then we have too many ANCA blocks and we can't include every uncle block in the block chin I've see it blocks a lot I'm sorry there's a lot of blocks here so effectively not every minor could accept the bribe but enough minors can accept the bribe where Alice can take full control over the block shin but if she has over 33% of the network's Hasrat then we get the perfect number of uncle blocks and then every minor can accept the bribe and everyone's better off doing this and that's a thing that's from Breaking Bad the bribers and the miners okay so the whole point of this attack is that it's trustless the briber and the bribe ii only trust a smart contract what's really cool is that we don't divert any harsh read away so because of the besan tame hard fork all uncle blocks nine contribute to the overall weight of the block chin so actually the wit of the block chin doesn't change at all but every but everyone's better off because alice is paying the bribers and actually if you play with the numbers well enough the briber can make a profit doing this but it is an N bond bribery with misted a little bit less realistic because I mean if you're attacking the cryptocurrency and being rewarded in it there might not be any incentive to do that unless is socially acceptable okay history revision con so the briber wants to reverse or remove transactions from the blockchain and the only way you can do this is really by doing by mining an alternative work that's longer so basically Allah says to the miners I want a reverse a transaction in aetherium will you help me do this and this is the way the attack works so Alice has three different accounts she has a one that creates the bribery contract and will also fund the bribery contract she has a two that will span some coins to the victim R then G has a three that will later receive the double spent coins so the begin Oh Alice spans coins from a two as he sands out to the victim seaweed since some type of confirmations eventually the victims happy and they pay the service or whatever etc etc and then she says okay and I want to reverse this transaction so she creates two different transactions is the double span transaction that will send coins from a2 to a3 the second transaction sets up the bribery contract unfunded from a1 and he gives us to the miners and then the miner orders the code and he verifies himself that heavy you know pursues maybe mines in the alternative fork he will be rewarded by the contract and then he once he's convinced he'll create the first bribe block he'll include both transactions and finally Hilton to the third transaction where each as accepts the bribe and this gets broadcast to the network okay so now the contract will check the following was the contract created a block - yes it was under dollars perform the double spend did the coins get sent to a3 yes it did and finally did the Brahe minor request his bribe payment yes he did so everything's happy he got his bribe the contract satisfied that rely on the new alternative fork and then every type of minor creates a block they can claim their bribe from the contract and then advance he becomes the longest fork and of course we can also do that trick of the Anka blocks so let's just say I mean ever there's several miners mining this alternative fork then you have like you know a different fork we can actually include OCO blocks I'm reward those as well so I'll go blocks your subsidies in this attack now as I mentioned there's two modes of payment every block and every uncle block now this attack is all or nothing either we get the longest fork and the bribe miners get the reward or it feels and the briber is refunded their coins so again there's no trust and we're gonna be more than just double spending I mean double spending is a really corny example it's basically the traditional Akash problem we're gonna be a bit more than that so people have been fast enough they could have saved the priority wallet I mean you create a contract that all kills the library and says the owner to the rightful owners but we could also go a bit further if they still want to see of the contract you could set up a bravery hard fork smart contract where if you mind on a hard fork you could get maybe 20% of the locked-up eath and that is very doable today and of course the miners won't have to trust the briber for doing this I just thought I'd throw that out there again it's trustless it doesn't divert any harsh read away because we're store mining blocks and we can still do the subsidy on again as an inbound bribery although I don't think it has to be an inbound bribery I think you do that out of bound as well finally gold finger corn and this is what I'm most excited about I got really excited about this when I thought of it so basically kind of theory and be used to reduce the utility of Bitcoin so before I go into the details what is a gold finger attack so this was proposed at why is 2013 and the idea is for at least three or four died mean I'm really wealthy I want to kill a cryptocurrency I make profit so maybe I'll short Bitcoin then I'll do some nasty attack that crosses the volume then I get the reward by some the surety and I did via the exchange but back in 2013 I mean if you guys remember we wouldn't really have liked litecoin maybe dogs coin yeah Bitcoin I don't think das was around so there wasn't really that much competition amongst cryptocurrencies there was no real incentive to do this but today you know going up to 2018 we have Bitcoin we have Bitcoin cash Daphney competition there we have a theorem aetherium a classic even of Z cost Manero etc etc couldn't have so many competing cryptocurrencies at some point we may want to try to kill some cryptocurrencies and as we've seen at the very start of this talk there was the wealthy adversary' of a hundred million dollars pulling the kill core coin and it could have used this technique to do that so basically how do you reduce the utility of Bitcoin and it's pretty straightforward I mean if you mine empty blocks then no transactions ever get confirmed the transaction fee will go up well I guess it'd be new transaction fee because new transactions get in and then you reduce the utility of it but how do you verify an empty block so a blink Bitcoin block header has four different components it has the previous block house it has the timestamp it has a Merkle tree root and it has denounced so if this is an empty block the Merkle tree root is simply replaced with the goid coins transaction that's the very first transaction in a block so given the coin BS transaction and given the Bitcoin block header you can verify that this was indeed an empty block so I got really exactly what you do is you give up to the contract and the contract can verify it is an empty block and pay a reward and I got really excited and build the proof of concept I mean there's only a corny little proof of concept they built in a few days but it gives you a rough idea that it's run like 56 cents in order to submit a block header submitting bs transaction and accept your bribe from the contract so this is really cost effective to do I'm very goth efficient as well I'm not actually also maintained Forks so my love permutation committee in different Forks and etc etc so there are the three contracts go finger corners trustless it doesn't divert any harsh read away it's out of bond and there's no subsidy unfortunately that was a bit disappointing but otherwise is a really cool contract now for future work typically for all these contracts I've assumed the briber has already monies to convince enough miners to join the attack it would be really cool to work at strategies in order to ramp up the attack serve I start with 0% bright miners hercule and sent a phase in the joint early and how could i incentivizing there to join the attack altogether I'd also like to look at stuffy's mining this year southeast mining can be used both the improve the bribery attacks or defend against the bribery attacks you know rational miners vs. bride miners who's gonna win this war and finally can these bribery contracts be used in a proof of setting and I think it's a bit of a dangerous combo as someone I'm working on now where and if you think about it the I mean Bitcoin for example with proof of work I have the by Hardware separately and then use different coins the bright miners but in proof of stick i buy the voting rights so i buy some stick and there's a cm stick can then be used to bribe the miners so I don't need one peel of coins to do that and that's a bit of a quirk so thank you very much for listening I hope you like my meme as aetherium killing Bitcoin and thank you for listening [Applause]