A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> Our growing reliance on online services accessible on the Internet demands highly available systems that provide correct service without interruptions. Software bugs, operator mistakes, and malicious attacks are a major cause of service interruptions and they can cause arbitrary behavior, that is, Byzantine faults. This article describes a new replication algorithm, BFT, that can be used to build highly available systems that tolerate Byzantine faults. BFT can be used in practice to implement real services: it performs well, it is safe in asynchronous environments such as the Internet, it incorporates mechanisms to defend against Byzantine-faulty clients, and it recovers replicas proactively. The recovery mechanism allows the algorithm to tolerate any number of faults over the lifetime of the system provided fewer than 1/3 of the replicas become faulty within a small window of vulnerability. BFT has been implemented as a generic program library with a simple interface. We used the library to implement the first Byzantine-fault-tolerant NFS file system, BFS. The BFT library and BFS perform well because the library incorporates several important optimizations, the most important of which is the use of symmetric cryptography to authenticate messages. The performance results show that BFS performs 2p faster to 24p slower than production implementations of the NFS protocol that are not replicated. This supports our claim that the BFT library can be used to build practical systems that tolerate Byzantine faults. <s> BIB001 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> In this paper we describe the various scoring systems used to calculate rewards of participants in Bitcoin pooled mining, explain the problems each were designed to solve and analyze their respective advantages and disadvantages. <s> BIB002 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> The Bitcoin protocol requires nodes to quickly distribute newly created blocks. Strong nodes can, however, gain higher payoffs by withholding blocks they create and selectively postponing their publication. The existence of such selfish mining attacks was first reported by Eyal and Sirer, who have demonstrated a specific deviation from the standard protocol (a strategy that we name SM1). <s> BIB003 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> Abstract In the context of the ‘selfish-mine’ strategy proposed by Eyal and Sirer, we study the effect of communication delay on the evolution of the Bitcoin blockchain. First, we use a simplified Markov model that tracks the contrasting states of belief about the blockchain of a small pool of dishonest miners and the ‘rest of the community’ to establish that the use of block-hiding strategies, such as selfish-mine, causes the rate of production of orphan blocks to increase. Then we use a spatial Poisson process model to study values of Eyal and Sirer’s parameter γ , which denotes the proportion of the honest community that mines on a previously-secret block released by the pool in response to the mining of a block by the honest community. Finally, we use discrete-event simulation to study the behaviour of a network of Bitcoin miners, a proportion of which is colluding in using the selfish-mine strategy, under the assumption that there is a delay in the communication of information between miners. The models indicate that both the dishonest and the honest miners were worse off than they would have been if no dishonest mining were present, and that it is possible for the mining community to detect block-hiding behaviour, such as that used in selfish-mine, by monitoring the rate of production of orphan blocks. <s> BIB004 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> Several new services incentivize clients to compete in solving large computation tasks in exchange for financial rewards. This model of competitive distributed computation enables every user connected to the Internet to participate in a game in which he splits his computational power among a set of competing pools -- the game is called a computational power splitting game. We formally model this game and show its utility in analyzing the security of pool protocols that dictate how financial rewards are shared among the members of a pool. As a case study, we analyze the Bitcoin crypto currency which attracts computing power roughly equivalent to billions of desktop machines, over 70% of which is organized into public pools. We show that existing pool reward sharing protocols are insecure in our game-theoretic analysis under an attack strategy called the "block withholding attack". This attack is a topic of debate, initially thought to be ill-incentivized in today's pool protocols: i.e., causing a net loss to the attacker, and later argued to be always profitable. Our analysis shows that the attack is always well-incentivized in the long-run, but may not be so for a short duration. This implies that existing pool protocols are insecure, and if the attack is conducted systematically, Bitcoin pools could lose millions of dollars worth in months. The equilibrium state is a mixed strategy -- that is -- in equilibrium all clients are incentivized to probabilistically attack to maximize their payoffs rather than participate honestly. As a result, the Bitcoin network is incentivized to waste a part of its resources simply to compete. <s> BIB005 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> Selfish mining, originally discovered by Eyal et al. [9], is a well-known attack where a selfish miner, under certain conditions, can gain a disproportionate share of reward by deviating from the honest behavior. In this paper, we expand the mining strategy space to include novel "stubborn" strategies that, for a large range of parameters, earn the miner more revenue. Consequently, we show that the selfish mining attack is not (in general) optimal. Further, we show how a miner can further amplify its gain by non-trivially composing mining attacks with network-level eclipse attacks. We show, surprisingly, that given the attacker's best strategy, in some cases victims of an eclipse attack can actually benefit from being eclipsed! <s> BIB006 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> Proof of Work (PoW) powered blockchains currently account for more than 90% of the total market capitalization of existing digital cryptocurrencies. Although the security provisions of Bitcoin have been thoroughly analysed, the security guarantees of variant (forked) PoW blockchains (which were instantiated with different parameters) have not received much attention in the literature. This opens the question whether existing security analysis of Bitcoin's PoW applies to other implementations which have been instantiated with different consensus and/or network parameters. In this paper, we introduce a novel quantitative framework to analyse the security and performance implications of various consensus and network parameters of PoW blockchains. Based on our framework, we devise optimal adversarial strategies for double-spending and selfish mining while taking into account real world constraints such as network propagation, different block sizes, block generation intervals, information propagation mechanism, and the impact of eclipse attacks. Our framework therefore allows us to capture existing PoW-based deployments as well as PoW blockchain variants that are instantiated with different parameters, and to objectively compare the tradeoffs between their performance and security provisions. <s> BIB007 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> In this paper we provide a short quantitative analysis of Bitcoin Block Withholding (BWH) Attack. In this study, we investigate the incentive earned by a miner who either independently or at the diktat of a separate mining pool launches Block Withholding attack on a target mining pool. The victim pool shares its earned revenue with the rogue attacker. We investigate the property revenue function of the attacker and find parameters that could maximize the gain of the attacker. We then propose a new concept that we call “special reward”. This special rewarding scheme is aimed at discouraging the attackers by granting additional incentive to a miner who actually finds a block. A BWH attacker who never submits a valid block to the pool will be deprived from this special reward and her gain will be less than her expectation. Depending upon the actual monetary value of the special reward a pool can significantly reduce the revenue of a BWH attacker and thus can even ward off the threat of an attack. <s> BIB008 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> We consider a game in which Bitcoin miners compete for a reward of each solved puzzle in a sequence of them. We model it as a sequential game with imperfect information, in which miners have to choose whether or not to report their success. We show that the game has a multiplicity of equilibria and we analyze the parameter constellations for each of them. In particular, the minimum requirement to find it optimal not to report is decreasing with the number of miners who are not reporting, and increasing the heterogeneity among players reduces the likelihood that they choose not to report. <s> BIB009 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> The blockchain technology has emerged as an attractive solution to address performance and security issues in distributed systems. Blockchain's public and distributed peer-to-peer ledger capability benefits cloud computing services which require functions such as, assured data provenance, auditing, management of digital assets, and distributed consensus. Blockchain's underlying consensus mechanism allows to build a tamper-proof environment, where transactions on any digital assets are verified by set of authentic participants or miners. With use of strong cryptographic methods, blocks of transactions are chained together to enable immutability on the records. However, achieving consensus demands computational power from the miners in exchange of handsome reward. Therefore, greedy miners always try to exploit the system by augmenting their mining power. In this paper, we first discuss blockchain's capability in providing assured data provenance in cloud and present vulnerabilities in blockchain cloud. We model the block withholding (BWH) attack in a blockchain cloud considering distinct pool reward mechanisms. BWH attack provides rogue miner ample resources in the blockchain cloud for disrupting honest miners' mining efforts, which was verified through simulations. <s> BIB010 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> We address two problems: first, we study a variant of block withholding (BWH) attack in Bitcoins and second, we propose solutions to prevent all existing types of BWH attacks in Bitcoins. We analyze the strategies of a selfish Bitcoin miner who in connivance with one pool attacks another pool and receives reward from the former mining pool for attacking the latter. We name this attack as “sponsored block withholding attack.” We present detailed quantitative analysis of the monetary incentive that a selfish miner can earn by adopting this strategy under different scenarios. We prove that under certain conditions, the attacker can maximize her revenue by adopting some strategies and by utilizing her computing power wisely. We also show that an attacker may use this strategy for attacking both the pools for earning higher amount of incentives. More importantly, we present a strategy that can effectively counter block withholding attack in any mining pool. First, we propose a generic scheme that uses cryptographic commitment schemes to counter BWH attack. Then, we suggest an alternative implementation of the same scheme using hash function. Our scheme protects a pool from rogue miners as well as rogue pool administrators. The scheme and its variant defend against BWH attack by making it impossible for the miners to distinguish between a partial proof of work and a complete proof of work. The scheme is so designed that the administrator cannot cheat on the entire pool. The scheme can be implemented by making minor changes to existing Bitcoin protocol. We also analyze the security of the scheme. <s> BIB011 </s> A Survey on Consensus Mechanisms and Mining Strategy Management in Blockchain Networks <s> 1) Selfish Mining Strategy: <s> The core technical component of blockchains is consensus: how to reach agreement among a distributed network of nodes. A plethora of blockchain consensus protocols have been proposed---ranging from new designs, to novel modifications and extensions of consensus protocols from the classical distributed systems literature. The inherent complexity of consensus protocols and their rapid and dramatic evolution makes it hard to contextualize the design landscape. We address this challenge by conducting a systematization of knowledge of blockchain consensus protocols. After first discussing key themes in classical consensus protocols, we describe: (i) protocols based on proof-of-work; (ii) proof-of-X protocols that replace proof-of-work with more energy-efficient alternatives; and (iii) hybrid protocols that are compositions or variations of classical consensus protocols. This survey is guided by a systematization framework we develop, to highlight the various building blocks of blockchain consensus design, along with a discussion on their security and performance properties. We identify research gaps and insights for the community to consider in future research endeavours. <s> BIB012
The study in  shows that selfish miners may get higher payoffs by violating the information propagation protocols and postponing their mined blocks. Specifically, a selfish miner may hold its newly discovered block and continue mining on this block secretly. Thereby, the selfish miner exploits the inherent block forking phenomenon of Nakamoto protocols. In this case, honest miners in the network continue their mining based on the publicly known view of the blockchain, while the selfish miners mine on their private branches. If a selfish miner discovers more blocks in the same time interval, it will develop a private longer branch of the blockchain. When the length of the public chain known by honest miners approaches that of the selfish miner's private chain, the selfish miner will reveal its private chain to the network. According to the longest-chain rule, the honest nodes will discard the public chain immediately when they learn the longer view of the chain from the selfish miner. Such a strategy 0' Figure 13 . Blockchain state transition in the presence of a selfish pool (adapted from  ). of intentionally forking results in the situation of wasted computation by the honest miners, while the revenue of the selfish miner can be significantly higher than strictly following the block revealing protocol. More seriously, if selfish miners collude and form a selfish mining pool with a sufficiently large amount of computational power, other rational miners will be forced to join the selfish mining pool, which can devastate the blockchain network  . In  , the authors introduce an approach based on the Markov chain model to analyze the behavior as well as performance of a selfish mining pool. Figure 13 illustrates the progress of the blockchain as a state machine. The states of the system, i.e., the numbers in the circles represent the lead of the selfish pool in terms of the difference in block number between the private branch and the public branch. In Figure 13 , state 0 is the original state when the selfish pool has the same view as the public chain. State 0 ′ indicates that two branches of the same length are published in the network by the selfish pool and the honest miners, respectively. The transitions in Figure 13 correspond to the mining event, i.e., a new block is mined either by the selfish pool or the honest miners. α in Figure 13 represents the computational power of the selfish mining pool. Note that the transition from state 0 to state 0 ′ depends on not only the computational power of the selfish pool, but also the fraction, i.e., µ of honest miners that mine on the selfish pool's branch. In  , the analysis on the steady state probability of the Markov chain leads to the following two important observations: • For a given µ, a selfish pool of size α obtains a revenue larger than its relative size in the range of 1−µ 3−2µ < α < 1 2 . • A threshold on the selfish-pool size exists such that each pool member's revenue increases with the pool size. Extended from  , the study in BIB006 introduces a new mining strategy known as the stubborn mining strategy, which is supposed to outperform the typical selfish mining strategy. The key idea behind the stubborn mining strategy is that the selfish miner is stubborn and may only publish part of the private blocks even when it loses the lead to the honest nodes. As shown in Figure 14 , the major difference between the two selfish strategies lies in how the selfish miner publishes the private blocks. For example, at state 2, the typical selfish miner will immediately publish all the private blocks once the lead to the honest miners decreases by one block (see Figure 13 ). Then, the system transits to state 0. In contrast, every time when the honest miners mine a new block, the stubborn miner will stubbornly reveal one block of the private chain, even by doing so it will lose the lead. Simulations in  show that stubborn mining achieves up to 13.94% higher gains than selfish mining strategy. Lead stubborn mining Selfish mining Figure 14 . Lead-stubborn mining. The black and purple transitions together define the selfish mining state machine. The black and green transitions define the stage machine of lead-stubborn mining (adapted from BIB006 ). Lead stubborn mining Selfish mining Trial stubborn mining Equal-Fork stubborn mining ✂ Figure 15 . Lead, Equal-Fork, and Trail Stubborn mining. Black and purple transitions denote selfish mining. Black and green transitions denote leadstubborn mining. Black and blue transitions denote Equal-Fork stubborn mining. Black and brown transitions denote Trail-stubborn mining (adapted from BIB006 ). Furthermore, the study in BIB006 also introduces another two extensions of the stubborn mining strategy, namely, the Equal-Fork Stubborn (EFS) and the Trail Stubborn (TS) mining strategies (see Figure 15 ). In Figure 15 , state -1 indicates that the public chain is one block longer than the private chain. As indicated by the transitions from other states to state -1, the TS miner is more stubborn and keeps mining on the secret branch even when it is one block behind the public chain. From state -1, when the TS miner finds one new block ahead of the honest miners, the system will transit to state 0 ′′ . Namely, the private chain catches up with the public chain and the block numbers on both chains are equal. In contrast, if the honest miners find a new block ahead of the ST miner, the system transits to state 0. Namely, the ST miner starts to mine new blocks based on the public chain. Here, the difference between state 0 ′′ and state 0 ′ lies in that only the ST miner knows the existence of the private chain in state 0 ′′ , while in state 0 ′ the honest miners can freely choose to mine on one of the two chains. The comparisons between the three stubborn mining strategies are given in Figure 15 . Simulations in BIB006 show that stubborn mining strategies can improve the profit by up to 25% than the original selfish mining strategy proposed in  . The author in  studies the impact of transaction fees on selfish mining strategies in the Bitcoin network. Note that due to the inherent design of the token issuing scheme in Bitcoin, the constant mining reward of each block halves every time when a fixed interval of blocks, i.e., every 210,000 blocks, is generated. Then, it is natural to increase the transaction fee to compensate for the mining cost of the consensus nodes. The arbitrary levels of transaction fees lead to a situation where some hidden blocks may have very high values. As 0' Figure 16 . Improved Markov model for selfish mining with transaction fees (adapted from  ). a result, selfish miners want to publish it immediately due to the risk of orphaning. Hence, in the revised Markov chain model for selfish mining in Figure 16 , the author introduces a new state 0 ′′ . State 0 ′′ is almost identical to state 0, except that, if the selfish miner mines on the next block in state 0 ′′ , it will immediately publish that block instead of holding it. Compared with the original selfish mining model in Figure 13 , state 0 transits to state 1 with probability α(1 − e −β ) and to state 0 ′′ with probability αe −β , where β is the size of the mining block. The new factor β is introduced to model the impact of transaction fees on the miner's decisions. With the revised transition probability, if the selfish miner finds a block of high value in state 0, it may publish the block (i.e., transiting to state 0 ′′ ) instead of holding it (i.e., transiting to state 1). The analysis in  shows that this improved selfish mining strategy leads to positive profit for all miners regardless of their hashrates. From the aforementioned Markov models, we note that the selfish miner may adopt various policies by choosing to release an arbitrary number of block in each state. In BIB003 - BIB007 , a Markov Decision Process (MDP) model is proposed to generalize such a process of policy derivation. As an example, the study in BIB003 considers the honest miners as non-adaptive players following the Nakamoto protocol. Then, the problem of searching optimal selfish-mining strategy can be modeled as a single-player MDP. Four actions are considered to control the state transitions in the MDP: • Adopt: the selfish miner accepts the honest network's chain and all private blocks are discarded; • Override: when taking the lead, the selfish miner publishes its private blocks such that the honest network discards its current view; • Match: the selfish miner publishes a conflicting branch of the same height. A fraction of the honest network will fork on this branch; • Wait: the selfish miner does not publish new blocks and keeps working on its private branch. The state the MDP is defined by the difference in block lengths between the selfish miner and the honest network as well as the situation of computation forking among the honest miners. By controlling the maximum difference in block lengths, it is possible to obtain a finite-state MDP. Using standard MDP solution techniques, an ǫ-optimal policy for selfish mining can be obtained based on such a truncated-state MDP. In BIB004 , the authors consider a similar mining competition between a selfish mining pool and the honest nodes. The study in BIB004 extends the model of selfish mining by considering the propagation delay between the selfish mining pool and the honest community. The delay is assumed to be exponentially distributed with rate µ. The block-mining Markov model in BIB004 adopts a 2-dimensional state of (k, l), which denotes the length of blocks built by the pool and the community upon the common prefix blocks, respectively. Let λ 1 and λ 2 denote the block-arrival rate for the pool and the community. The authors then derive the following transition rates of the block mining system: Based on this transition map, the authors in BIB004 propose to detect selfish mining behaviors by monitoring the proportion of orphaned blocks. Specifically, if there is a significant increase in the fraction of orphaned blocks, it is highly possible that selfish mining exists in the network. In BIB009 , the authors adopt a more general assumption of multiple selfish miners in a Bayesian game-based formulation BIB012 . In the considered game, miners decide on whether to report a new block (R), i.e., to mine honestly, or not (NR), i.e., to mine selfishly. When a miner makes a decision, it does not know whether it is the real leader of the mining competition, or whether some other miners have secretly started mining on their private blocks. To ease the analysis of this mining game with incomplete information, the authors assume that a miner always reports when it finds two successive blocks. With this extra assumption, a decision tree can be constructed (see Figure 17 ), and the backward induction approach is adopted to find the miners' equilibrium strategies. Figure 17 presents the decision tree in a case of three miners. In the presented subgame, miner 1 believes that it is the real leader of the mining competition. Here, let h i denote the normalized computational power of miner i, and µ i (h i ) denote miner i's belief of being the leader of the puzzle solution competition. From the decision tree and following the Bayesian rule, we can obtain the information about the states, transition probabilities, and expected payoffs after miner 1 takes the action of NR. The authors provide the condition on the fraction of computational power for action NR to become the optimal mining strategy. 2) Block Withholding in Pool-Based Mining: Block withholding (BWH) is a mining strategy used by selfish miners to increase their revenues through diminishing the winning probability of honest miners in mining pools BIB010 , BIB005 . In BIB005 , the authors study the impact of BWH on the Bitcoin network. It is assumed that a selfish miner is able to split the computational power into different mining pools. It may spend most of its computational power to honestly mine on one pool, and use the rest computational power to perform BWH on the other pools. The mining pools are supposed to adopt Figure 17 . An illustration of the Bayesian mining game (adapted from BIB009 ). Miner 1 believes that its is the real leader of the puzzle solving competition and decides to take action NR. Here α is the probability for miners to mine on the first block when they receive two blocks in a short time. the pay-per-share protocol [67, Section 2.2]. In the victim mining pools, the selfish miner submits all shares BIB001 to the pool operators except the valid puzzle solutions. Although this mining strategy reduces the attacker's revenue in the attacked pools, it will increase the attacker's revenue in the pool that it chooses to mine honestly. A computational power splitting game with multiple players is formulated in BIB005 . In the game, one selfish miner adopts BWH and all the other miners mine honestly. The selfish miner chooses which pools to attack and how much computational power to allocate in the targeted pools. It is shown that the attacker always gains positive reward by mining dishonestly regardless of its mining power. This finding implies a risk for big mining pools to dominate the network through BWH attacks on smaller mining pools. The study in  considers a more complicated case where mining pools attack each other with BWH. The author of  considers a scenario of two mining pools which attempt to send their miners to each other to diminish their opponents. As illustrated in Figure 18 , pool P 1 uses x 12 out of the m 1 computational power to attack pool P 2 . Meanwhile, pool P 2 uses x 21 out of the m 2 computational power to attack pool P 1 . Then, the revenue of each pool can be derived as follows: where m is the total mining power in the blockchain network. By  , the revenues of the pools can be expressed as the functions of x 12 and x 21 : Thus, by observing the attack rate of its opponent, a mining pool can adjust its attack rate in the next round to maximize its BIB001 A share is a preimage solution for a block that meets the relaxed (i.e., approximated) difficulty requirement set by the pool. A miner receives its reward in proportion to the number of shares that it submits to the pool. long-term revenue through repeated plays. The analysis of this repeated game reveals that the game admits a unique equilibrium, and the pool size will be the main factor that determines the attacking rates of each pool. A similar conclusion about the impact of the pool size on BWH attacks between two pools can also be found in  . Extended from the studies in BIB005 ,  , it is found out in BIB011 that when a mining pool performs a BWH attack to a victim mining pool, the other mining pools will benefit from this attack even if they do not adopt BWH. Thus, the other pools are interested in sponsoring the attacker to launch the BWH attack to the victim pool. Consequently, the expected gain of the attacker will be greater than the case in BIB005 . This implies that miners have more incentives to perform BWH attacks with the Nakamoto consensus protocols. To alleviate the impact of BWH attacks, modifications to the Nakamoto protocol and the pool-mining protocols are suggested in the literature. The author in BIB002 proposes that the pool operator should insert mining tasks for which the solutions are known in advance, and tag the miners that do not submit the results. Since it is difficult to find puzzles with expected solutions, the author suggests that some new data fields should be added to the conventional block data structure (see Figure 2 ). These fields enable the pool operator to allocate mining tasks to its miners, but the miners are unable to know the exact puzzle solutions. Alternatively, in BIB008 , the authors propose to give an extra reward to the miners that find the valid blocks, hence reducing the revenue of selfish miners and discouraging BWH attacks. 3) Lie-in-Wait Mining in Pools: Lie-in-wait (LIW) is a strategic attack where a selfish miner postpones submitting the block that it finds to a mining pool, and uses all of its computational power resources to mine on that pool BIB002 . In this case, an attacker is assumed to first split its computational power to mine in different pools. Then, if it finds a block in a pool, instead of submitting the block to get the reward from the pool, the attacker holds the block, and concentrates all of its computational power in other pools to mine on the pool where it finds the block. However, the attacker may take a risk by not releasing the block immediately and concentrating all the computational resources on the target pool. The reason is that if one of other pools finds a new block before this block is published, the selfish miner will lose its reward as well as suffer from the cost of mining in the target pool. It is shown in BIB002 that the success of attacks follows an exponential distribution, and the maximum expected gain of the LIW attacker is solely determined by the pool numbers and block interval in the network. 