Task of Bitcoin Mining

Module 4
The task of Bitcoin miners, Mining Hardware,
Energy consumption and ecology, Mining
pools, Mining incentives and strategies.
 Task of Bitcoin Miners
• We already know that Bitcoin relies crucially on
mining.
• But who are the miners?
• How did they get into this?
• How do they operate?
• What's the business model like for miners?
• What impact do they have on the environment?
 Task of Bitcoin Miners
• Until now we have seen that Bitcoin depends on
miners to:
– store and broadcast the blockchain
– validate the transactions
– depending on their hash power they will be able to insert
new blocks and earn some reward
 The task of Bitcoin miners
• Steps necessary to become a miner:
1. join the network, listen for Bitcoin transactions and validate the correct ones
2. listen for new blocks, maintain the blockchain. When a new block is
proposed, validate it.
3. start assembling new valid blocks with new transactions.
4. Find a nonce suitable to win the mathematical competition against other
miners. It is necessary to work really hard to find a nonce that will make the
block valid. This is the step which is more difficult from the computational
point of view.
5. Hope that the new block is accepted by the other miners. It is necessary that
the following blocks are attached to the new one in order to be considered
valid.
6. Get profit! If the block is accepted the profit will correspond to the Bitcoin
released during block creation and the transaction fees
• So, miners useful activity is to validate the transactions and blocks. The
race for block creation and the consequent reward are just an incentive
for miners to do this validation.
• After a node is joined into mining network, then
there are six tasks to perform:
– Listen for transactions
• listen for transactions on the network and validate them by
checking that signatures are correct and that the outputs
being spent haven’t been spent before (Verification and
Validation of individual transactions)
– Maintain block chain and listen for new blocks
• Get all of the historical blocks that are already part of the
block chain before you joined the network
• then listen for new blocks that are being broadcast to the
network. You must validate each block that you receive — by
validating each transaction in the block and checking that
the block contains a valid nonce
• Assemble a candidate block
– After getting up‐to‐date copy of the block chain, begin to build your
own blocks. Then started to group the validated transactions that you
heard about into a new block that extends the latest block you know
about
• Find a nonce that makes your block valid
– Find the golden nonce that makes the newly proposed block’s hash
under the difficulty target
• Hope your block is accepted
– Either your block may be accepted or rejected
– Even it is accepted, it may not be included in the blockchain, if other
miners not started to build their new block on top of the block
proposed by you.
• Profit
– If the block proposed by you is accepted and included in the
blockchain then you will get a profit of 12.5 BTC as reward together
with transaction fees all the transactions in the block
 Process to find a valid block
• Now let's see what's necessary to find a new valid
block.
• In order to do so, we have to recall that there are
two hash-based data structures:
– Blockchain: each block header points to the previous block
header.
– Merkle tree: inside every block there are transactions
organized within this binary hash tree
 Bitcoin Block Construction
• Add high priority transactions:
– Every transaction that is transmitted in the Bitcoin network is sent to
as many nodes as possible.
– The nodes validate each transaction and add it to a transaction pool.
– Each transaction is then prioritized depending on the size of the
transaction(in kb), its age (the amount of time a transaction has not
been picked up by any block) and the value of the input (in simple
terms it is the amount of bitcoins as input).
– The first 50 kb (out of a total 1 MB) are reserved for high priority
transactions.
– This ensures that eventually every transaction is picked up by the
network and is part of a block.
– Transactions do not have a time-out and hence eventually the
transaction is ‘old-enough’ that it becomes part of a valid block.
 An Example for Proof of Work
• Need to find out the hash value such that it starts with one ‘0’ and our
data is the string ‘Make America Great Again’.
• Apply an incremental approach of adding nonce by the value 1.
• We start by initializing the nonce to 1.
• The SHA-256 ( nonce + input string) = SHA-256(1Make America Great
Again) does not start with zero.
• So increment the nonce by 1. Finally, 20th attempt we find the hash value
such that it starts with zero.
• The SHA-256 input is ‘20Make America Great Again’.
• The number of zeroes that the output has to start with is known as the
‘Difficulty’.
• Now the goal is readjusted such that it is to find hash starting with 2
leading zeros.
 An Example for Proof of Work
• It is achieved when nonce is 120.
• By adding one unit of difficulty (i.e one additional zero) the
time taken is increased exponentially.
• If the goal is to have 4 leading zeros then the first such
occurrence is only when nonce = 69817.
• This is called as the Proof of Work.
• Once the solution is found out then the node immediately
sends the information (data + nonce) to all nodes and each
can immediately verify and in a distributed consensus agree
that it was the winning node and hence award it with the
newly created Bitcoins.
An Example for Proof of Work
An Example for Proof of Work
 Proof of Work — Steps
• Collect transactions from the transaction pool and build a complete block
such that its size does not exceed 1 MB.
• Calculate the hash by applying SHA-256 twice to the Block header
(Version + Previous Block Hash + Merkle Root + Timestamp + Difficulty
Bits + Nonce)
• Compare the result of Step # 2 with the expected number of zeros. If not
matched then increment the nonce by 1 and go back to Step # 1.
• Technically speaking the hash value is compared with a target.
• The target is a very large number and known to every bitcoin client. For
the block to be accepted, the hash value has to be less than the target.
• Keep comparing the result such that the hash is less than target i.e the
hash has the expected number of leading zeros.
 Proof of Work — Steps
• Once miner finds a winning block then send it to all participating nodes and they
can calculate the result for themselves.
• Once all agree then the node which calculated the winning block is rewarded with
newly created Bitcoins.
• The winning block is first checked by each node individually for a long checklist of
items.
• If a miner is adding, 10000 bitcoins in coinbase transaction, immediately rejected
by all.
• As time progresses, more high computational nodes join (or may even drop out of)
the network.
• Hence, the puzzle can be solved much faster and block creation time is reduced.
• Block creation time is set to 10 minutes and this can never change.
• So after a fixed time of approximately 2 weeks or exactly 2016 blocks the difficulty
is re-adjusted.
• Increase in difficulty means target decreases. If nodes receive 2 blocks at the
same time then the one for which more computation power was used (i.e had
higher difficulty) is selected.
 Proof of Work — Steps
• Ever since the difficulty has been increasing The current
difficulty of the Bitcoin network can be found here. The hash
of the genesis block (Block height = 0) has 10 leading zeros,
the block with height = 32000 has 9 and it further reduces to
8 leading zeros for block with height = 32256. However these
were the initial days with very few users. Since last 3 years,
the difficulty has been increasing constantly and dip in
difficulty is very minor. The current difficulty is between 17 to
19 zeros. It takes a huge computing power to calculate the
nonce.
• If nodes receive 2 blocks at the same time then the one for
which more computation power was used (i.e had higher
difficulty) is selected.
 Genesis Block
Number Of Transactions 1
Output Total 50 BTC
Estimated Transaction Volume 0 BTC
Transaction Fees 0 BTC
Height 0 (Main Chain)

The very first Timestamp 2009-01-03 18:15:05

block is called as Received Time 2009-01-03 18:15:05

genesis block and Relayed By Unknown

its contents are Difficulty 1

always hardcoded. Bits 486604799

Size 0.285 kB
Weight 0.896 kWU
Version 1
Nonce 2083236893
Block Reward 50 BTC
 Process to find a valid block
• Now let's see what's necessary to find a new valid
block.
• In order to do so, we have to recall that there are
two hash-based data structures:
– Blockchain: each block header points to the previous block
header.
– Merkle tree: inside every block there are transactions
organized within this binary hash tree
 Process to find a valid block
(Miners need to…)
• Assemble some new transactions heard from the network in a Merkle
Tree
• Create a block with the right header pointing to the last valid block
inserted
• Start searching over the nonce field and try to find a block header with a
hash that starts with the required number of zeros. The miners try to
change this 32-bit nonce every time to obtain hashes that don't satisfy the
desired condition. If a miner tries every possible 32-bit nonce doesn't
obtain an hash with the required format, he can try to modify the extra-
nonce. This corresponds to the output index of the coinbase transaction.
Since this transaction creates new coins, doesn't refer to an output of a
previous transaction. When this parameter is changed, the hash of the
entire Merkle Tree changes, too. So, changing the extra-nonce is more
computationally expensive than changing the nonce itself.
• Eventually, the miner is able to find the correct nonce before the others
competitors, and can broadcast the block on the network.
Process to find a valid block
Process to find a valid block
• Is everyone solving the same puzzle?
– if every miner just increments the nonces as we
described, aren’t all miners solving the exact same
puzzle? Won’t the fastest miner always win?
• The answer is no!
• Firstly, it’s unlikely that miners will be working on the exact
same block as each miner will likely include a somewhat
different set of transactions and in a different order.
• Even if two different miners were working on a block with
identical transactions, the blocks would still differ because of
the address for coinbase transactions
– This would only happen if the two miners are part of the same
mining pool in that case This would only happen if the two miners
are part of the same mining pool
 Difficulty
• Difficulty depends on the number of zeros that the hash must begin with
to be considered valid.
• E.g., the 256-hash must begin with at least 64bits of zeros.
• Corresponding difficulty is equal to 266.2, which is an incredibly higher
number.

• Difficulty is changed every two weeks based on how efficient the miners
were over the previous two weeks.
• To compute the new difficulty simply compute the ratio between two
weeks and the amount of time that it took the miners to find the previous
2016 blocks.
 Difficulty
• Then the ratio is multiplied by the previous difficulty.
• This is a scaling to keep valid a constant property. The constant property is
the amount of time needed to find a new block, which is 10 minutes.
• next_difficulty = (previous_difficulty * 2016 * 10 minutes) / (time to
mine last 2016 blocks)

• Over time the mining difficulty keeps increasing. It's not a steady linear
increase or an exponential increase.
• It depends on activity in the market. How many new miners are getting
into the game, which may be affected by the current exchange rate of
Bitcoin.
• But generally more and more hash power comes online.
• More people are hashing, blocks are found faster, and the difficulty is
adjusted up, so that it again takes ten minutes to find blocks.
 Difficulty

Mining difficulty over time (mid‐2014). Note that the y‐axis begins at 80,000 TH/s
Time to find a block (early 2014). Note that the y‐axis begins at 460 seconds. Due to
continued rapid growth in mining power during this time, the time to find a block
decreased steadily within each two‐week window. Source: bitcoinwisdom.com
Time to find a block (early 2015). Note that the y‐axis begins at 540 seconds. As the
growth of the network has slowed, the time to find each block is much closer to 10 minutes
and is occasionally over during periods where the network’s hash power actually shrinks.
Source: bitcoinwisdom.com
 Mining hardware
• Hash function details: Hash function used for Bitcoin
is SHA-256:
– it's a general purpose cryptographic hash function, part of
a bigger family of functions that was standardized in 2001
– it was designed by the NSA
– it's a fairly strong hash function.
– It's not broken cryptographically, although there are some
theoretical weaknesses that are starting to show up.
– As a result, the SHA-3 family it's the new standard, but was
not available when Bitcoin was designed.
 SHA-256
• A high level overview of SHA-256 to understand the problem that needs to
be solved by the miners.
– 256-bit state is split up in eight 32-bit words
– In each round some of these words are taken.
– There are four different tweaks applied on them at bit-level that
correspond to logic operations (bit shift, permutation, addition, ...).
– Then a number of words in the state are taken and added together
mod 32.
– The result of all these additions is wired over to the first word of the
state and the entire state shifts over
• The design is loosely inspired by simpler bitwise Linear Feedback Shift Registers
(LFSRs)
– The steps 1-4 correspond to one round of SHA-256, the operation is
repeated for 64 iterations.
– In each iteration slightly different constants are applied, so that every
reiteration isn't exactly the same as the previous ones.
SHA-256
 Mining hardware in the early days
• Task of miners is to compute specific SHA-256 function as fast
as possible.
• To do this, they need to be able to deal with 32-bits words, do
32-bit addition and some bitwise logic.
• Hardware used for mining has changed over the years:
– First generation of mining - CPU
– Second generation of mining - GPU
 Mining hardware - CPU
• CPU:
– When Bitcoin was proposed, general purpose computers where
used.
– With a high-end desktop PC, it is possible to compute around
224 hashes per second (139,461 years), which correspond to
around 20 Million Hashes per second(20MH/s).
– With the actual difficulty it would take over a hundred
thousand years on an average at the early‐2015 difficulty level
(267 ) to find a valid block .
– Miners simply searched over nonces in a linear fashion,
computed SHA 256 in software and checked if the result was a
valid block.
Mining hardware - CPU
• How fast will this run on a general purpose computer?
– On a high‐end desktop PC you might expect to compute about 20
million hashes per second (MH/s).
– At that speed, it would take you several hundred thousand years on
average at the early‐2015 difficulty level (267 ) to find a valid block.
– If you're mining on a general purpose PC today, CPU mining is no
longer profitable with the current difficulty.
– For the last few years, anyone trying to mine on a CPU probably
doesn’t understand how Bitcoin works and was probably pretty
disappointed that they never made any money doing it.
 Mining hardware (GPU)
• Every modern PC has a GPU built‐in to support high performance graphics.
• Designed to have high throughput and also high parallelism.
• Bitcoin mining can be parallelized by computing multiple hashes at the same
time with different nonces.
• In 2010, a language called Open Computing Language(OpenCL) was released.
• OpenCL (2010) is a general purpose language, paved the way for mining on
GPUs.
• It's a high level‐language and over time people have used it to run many types
of computation more quickly on graphics cards.
• Mining with graphics cards had several attractive properties at the time.
• Most accessible high‐end hardware available to the general public.
• They have some properties that make them specifically good for Bitcoin
mining.
• Designed for parallelism so they have many Arithmetic Logic Units (ALUs) that
can be used for simultaneous SHA‐256 computations.
• Some GPUs also have specific instructions to do bitwise operations that are
quite useful for SHA‐256.
 Mining hardware (GPU)
• Most graphics cards can also be overclocked – can run them faster than they're
actually designed for if one might want to take on the risk that they might
overheat or malfunction, a property gamers have demanded for years.
• With Bitcoin mining, it might be profitable to run the chip much faster than it was
designed for even if you induce a few errors by doing so.
• E.g., one can run a graphics card 50 percent faster but doing so will cause errors in
the SHA‐256 computation to 30 percent of the time.
• If an invalid solution is erroneously declared valid by the graphics card —
something that would happen rarely — always double‐check it on your CPU.
• Speed increase from overclocking can overcome the decrease in output due to
errors.
• In the above example, the throughput is 1.5x compared to not overclocking,
whereas the success rate is 0.7x.
• The product is 1.05, which means overclocking increases your expected profits by
5%.
• People have spent considerable time optimizing exactly how much they should
overclock a given chip to maximize profits.
• Some people drive many graphics cards from one motherboard and CPU
• Disadvantages of GPU mining
– GPUs have a lot of hardware built into them for doing video
processing that can’t be utilized for mining
• large number of floating point units that aren’t used at all in SHA‐256
– Don't have the greatest cooling characteristics when you put a
lot of them next to one another
– GPUs can also draw a fairly large amount of power, so a lot of
electricity is used relative to a computer
– Need to design or buy to accommodate multiple GPU in single
CPU
– high‐end graphics card with aggressive tuning you might get as
high as 200 MH/s , or 200 million hashes per second, an order
of magnitude better than you would be doing with a CPU
• Takes over 300 years on average to find a block at the early‐2015
difficulty level
 Advanced mining hardware - FPGA
• After 2011, miners started to use more specific and advanced hardware:
FPGA (Field Programmable Gate Arrays)
– FPGA have hardware like performances, but let the owner of the card
customize it.
• reconfigurable interconnects and program in the field
• BUT, the custom hardware chips are designed in a factory and do the same thing
forever
– So they are faster than GPU and it's easier to set up FPGA racks since
less cooling is necessary.
– But Bitcoin mining requires to make FPGAs work harder than what
they were designed for.
– So there was a lot of malfunctioning and they were less accessible for
common people.
– Best solutions using FPGA let the miners reach 1 GigaHashes per
second.
– With 2015 difficulty, it would still take around 50 years to find a new
block.
 Advanced mining hardware - FPGA
• Advantages of FPGA over GPU
– Offer better performance than graphics cards,
particularly on “bit fiddling” operations which are
trivial to specify on an FPGA
– Unlike GPUs, theoretically use nearly all of the
transistors on the card for mining
– many FPGAs together and drive them from one
central unit
• Disadvantages
– Consumer grade FPGAs introduces lot of errors and
malfunctions
– Bitocoin mining with FPGA is a short-live phenomenon
 Advanced mining hardware - ASIC
• ASIC (Application Specific Integrated Circuits): Chips designed and build
from scratch to do nothing except mining Bitcoins.
• In the last few years many companies started to produce ASICs and there
are a lot of choices when a miner decides to buy one.
• There are models with different cost, computing power, energy
consumption and shipping times.
• An ASIC has the capability to compute 2 TeraHash per second.
• So it's 1000 times faster than an hypothetical array of 100 really good
FPGA. It now costs around 3000$.
• Even with this incredible performances are still necessary 14 months to
find a new block.
• Due to the cost and the dynamics to buy them, it is very difficult for a
small miner to go online in a profitable way.
• Disadvantages
– Designing ASICs requires considerable expertise and
their lead‐time is also quite long
– lifetime of ASICs was quite short due to the rapidly
increasing network hash rate
• most boards in the early ASIC era growing obsolete in about
six months
 Today : Professional mining
• Today mining has mostly moved away from individuals and
toward professional mining centers.
• Exact details about how these centers operate are not very
well known because companies want to protect their setups
to maintain a competitive advantage.
• Presumably, these operations maintain profitability by buying
slightly newer and more efficient ASICs than are available for
general sale at a bulk discount.
• Next slide, we see a picture of a professional mining center in
the Republic of Georgia.
 Similarities to gold mining
• Lot of interesting parallels between Bitcoin mining and gold mining.
• For starters, both saw a similar gold rush mentality with many young,
amateur individuals eager to get into the business as soon as possible.
• Whereas with Bitcoin mining we've seen a slow evolution from CPUs to
GPUs to FPGAs, to now ASICs,
– Gold mining saw an evolution from individuals with gold pans to small
groups of people with sluice boxes, to placer mining — consisting of
large mining groups blasting away hillsides with water — to modern
gold mining which often utilizes gigantic open pit mines to extract
tons of raw material from the earth.
• Both in Bitcoin and gold mining, the friendliness and accessibility to
individuals has gone down over time and large companies have eventually
consolidated most of the operations (and profits). Another pattern that has
emerged in both places is that most of the profits have been earned by
those selling equipment, whether gold pans or mining ASICs, at the
expense of individuals hoping to strike it rich.
 Profits
• Based on what we have seen above, it could seem not worthy to mine
Bitcoins. But it is still profitable for miners that own many ASICs, since
the price of Bitcoins has been rising for most of its history and is
becoming particularly height lately. So the miners were able to earn
money only because they bought the equipment relying on the fact that
Bitcoin value would rise. And many miners probably would have earn
more money if they just took the funds invested in mining equipment and
used them to buy Bitcoins.
• Now we are in the era of professional mining. It is known that there are
many professional centers popping up around the world, especially in
China. To open a professional center it is necessary to have cheap energy,
good network connectivity, a cool climate so that it is not necessary to
spend too much on cooling systems. Some popular destinations for this
purpose are for example Georgia and Iceland.
 Future???
• So a couple of questions for the future are:
– Are small miners out of BitCoin mining forever?
– Is there any way to start as a small miner in this game?
– Does the existence of these ASICs and these large mining
centers go against the original vision of Satoshi Nakamoto,
which was to have every individual in the network being a
miner running on their own computer?
Energy consumption and ecology
 Critics on bitcoin mining
• Pit mines have been a major source of concern over the years
due to the damage they cause to the environment.
• Though bitcoin mining is not quite at that level yet, but it is
starting to use a significant amount of energy which has
become a topic of discussion.
• How much energy Bitcoin mining is using ?
• What the implications are for both the currency and for our
planet?
 Thermodynamic limits
• Landauer’s principle:
– Any non‐reversible computation must use a minimum amount of energy.
– Logically irreversible computations can be thought of as those which lose
information.
– Specifically, the principle states that erasing any bit must consume a
minimum of ( kT ln 2) joules,
• where k is the Boltzmann constant (approximately 1.38×10 −23 J/K),
• T is the temperature of the circuit in kelvins, and
• ln 2 is the natural logarithm of 2, roughly 0.69.
• High‐level idea:
– Every time you flip one bit in a non‐reversible way there's a minimum
number of joules that you have to use.
– Energy is never destroyed; it's converted from one form into another.
– During computation the energy is mostly transformed from electricity to
heat into the environment
• since non‐reversible computation has to use some energy and SHA‐256 — the basis of
Bitcoin mining — is not reversible, energy consumption is an inevitable result of Bitcoin
mining
• How does Bitcoin mining use energy?
– In 3 stages the energy consumption happens
– Embodied energy:
• Energy required to mine the raw materials for the creation of
mining equipment, shipping; over time the embodied energy will
go down as less and less new capacity comes online and fewer
people are going to buy it
– embodied energy will be amortized over years and years of mining.
– Electricity
• When your ASIC is powered on and mining, it consumes electricity
– As mining rigs get more efficient, the electrical energy cost will go down
– Cooling
• Cooling off your equipment to make sure that it doesn't
malfunction
– operating at a small scale in a very cold climate your cooling cost might be
trivial
 Mining at scale
• Both embodied energy and electricity decrease (per unit of mining
work completed) when operating at a large scale.
• It's cheaper to build chips (Embodied energy) that are designed to
run in a large data center, and you can deliver the power more
efficiently(Eletricity) as you don't need as many power supplies.
• When it comes to cooling, however, the opposite is usually true:
– cooling costs tend to increase the larger your scale is.
• If you want to run a very large operation and have a lot of Bitcoin
mining equipment all in one place, there’s less air for the heat to
dissipate into in the area surrounding your equipment.
• Your cooling budget will therefore increase at scale (per unit of
mining work completed) unless you scale your physical area along
with the number of chips you have in use.
• Conclusion: Embodied energy and Electricity is less BUT cooling is
high
 Estimating energy usage
• How much energy is the entire Bitcoin system using?
• Can't be computed more precisely
– because it's a decentralized network with miners operating all over the
place without documenting exactly what they're doing.
• But there are two basics approaches to estimating how much
energy Bitcoin miners are using collectively.
– Top-down approach
– Bottom-up approach
• At best they should be treated as order‐of‐magnitude
estimates.
 Top‐down approach
• SIMPLE FACT:
– Every time a block is found today 25 bitcoins, worth about 6,500 US
dollars, are given to the miners. Approximately 11 dollars every second
– If the miners are turning all of those 11 dollar per second into electricity,
how much energy can they buy?
• Of course miners aren’t actually spending all of the revenue on electricity, but
this will provide an upper bound on the electricity being used.
– Assume that the electricity costs around
• 10 cents per kilowatt‐hour (kWh) at an industrial rate in the US, or Equivalently 3
cents per Megajoule (MJ)
• 10cents for 1000*3600 Joules =>10 cents for 3.6 MegaJoules = 10/3.6=2.77 = 3
cents/MJ
• 11 dollar = 1100 cents = 1100/3 = 367 Mega Joules per second = 367 Mega Watts
• 1 Watt = 1 Joule / second => 1 joule = 1 watt-second
– provide an upper bound on the electricity being used
 Bottom‐up approach
• SIMPLE FACT:
– Assumption: The miners are using the most efficient RIGs
for mining
– Observe the number of hashes the miners are actually
computing, which we know by observing the difficulty of
each block to derive a lower bound on the electricity
consumption.
– The best claimed efficiency mining rigs is about 3 GH/s/W.
• Meaning that to perform three billion hashes per
second while consuming 1 watt of power.
– The total network hashrate is about 350,000,000 GH/s, or
equivalently 350 petahashes per second (PH/s).
– 350 PH/s / 3 GH/s = 11700000 watts = 117 MegaWatts
 Ballpark estimate of the amount
of power being used for Bitcoin miners
• BALLPARK ESTIMATE
– Gives the amount of power being used for Bitcoin miners by combining top-
down and bottom-up approaches which is probably on the order of a few
hundred MW.
• To visualize,
– One of the largest power plants in the world, the Three Gorges Dam in China is
a 10,000 MW power plant.
– A typical large hydroelectric power plant produces around 1,000 MW.
– The largest nuclear power plant in the world, Kashiwazaki‐Kariwa in Japan, is a
7,000 MW plant, whereas the average nuclear power plant is about 4,000 MW.
– A major coal‐fired plant produces about 2,000 MW.
– According to our estimates then, the whole Bitcoin network is consuming
perhaps 10% of a large power plant’s worth of electricity.
– Although this is a significant amount of power, it's still small compared to all
the other things that people are using electricity for on the planet.
 Is Bitcoin mining wasteful?
• It’s often said Bitcoin “wastes” energy because the energy expended on
SHA‐256 computations which don’t serve any other useful purpose.
• It’s important to recognize, however that any payment system requires
energy and electricity.
• Traditional Money Energy consumptions:
– With traditional currency, considerable energy is consumed printing
currency and running ATM machines, coin sorting machines, cash
registers, and payment processing services, as well as transporting
money and gold bullion in armored cars.
• You could equally argue that all of this energy is “wasted” in that it
doesn't serve any purpose besides maintaining the currency system.
• So, if we value Bitcoin as a useful currency system, then the energy
required to support it is not really being wasted.
• Still, if we could replace Bitcoin mining with a less energy‐intensive
puzzle and still have a secure currency, this would be a positive change.
 Repurposing energy
• Another idea to make Bitcoin more eco‐friendly is to capture the heat generated
from Bitcoin mining do something useful with it instead of just heating up the
atmosphere.
• Data Furnace Approach:
– This model of capturing waste heat from computation is called the approach is called the data
furnace approach.
• The concept is that instead of buying a traditional electric heater to heat your
home, or to heat water in your home, you could buy a heater which doubled as a
Bitcoin mining rig, mining bitcoins and heating up your home as a byproduct of
that computation.
• It turns out that the efficiency of doing this isn't much worse than buying an
electric heater, and perhaps this would be no more complicated for a home
consumer than plugging their heater into their Internet connection as well as their
electricity outlet.
• There are a few drawbacks to this approach.
• Although it’s about as efficient as using an electric heater, electric heaters are
themselves much less efficient than gas heaters.
 Turning electricity in cash
• Another long‐term question posed by Bitcoin is that it might provide the
most efficient means of turning electricity into cash.
• Imagine a world in which Bitcoin mining ASICs are a readily‐available
commodity and the dominant cost of mining is electricity.
• In effect, this would mean providing free or low‐cost electricity is open to
new forms of abuse.
• In many countries around the world, governments subsidize electricity,
particularly industrial electricity.
• Among other reasons, they often do so to encourage industry to be
located in their country.
• But Bitcoin provides a good way to turn electricity into cash, which might
cause governments to rethink that model if their subsidized electricity is
converted en masse to bitcoins.
 Turning electricity in cash
• Electricity subsidies are intended to attract businesses that will contribute
to the country’s economy and labor market and subsidizing Bitcoin mining
may not have the intended effect.
• An even bigger problem is the billions of freely available electrical outlets
around the world in people’s homes, universities, hotels, airports, office
buildings and so on.
• People might try to plug in mining equipment so that they can profit while
someone else is paying the electricity bill.
• In fact, they might use outdated hardware and not bother to upgrade,
considering that they will not be paying the electricity bill.
• It is quite daunting to consider the possibility of monitoring every power
outlet in the world of for potential unauthorized used a source of
electricity for Bitcoin mining.
Mining Pools
 Economics of small miners
• Let’s say you're an individual who spent $6,000 of your hard-
earned money to buy a new Bitcoin mining rig.
• Now, you expect that you'll find a block in about 14 months
with this fancy new rig. And remember that a block is worth
about $6,500 at today's prices.
• So, you could say that the expected revenue of this box is
about $400 per month not considering the electricity.
• But mining is a random process, so you don’t know when
you're going to find the next block.
• Looking at the probability distribution of finding a new block
during the first year, the variance is pretty high because the
expected number of blocks you're going to find is low.
Economics of small miners
 Economics of small miners
• We can see in the graph that the probability distribution is a Poisson
distribution. So there's over a 40% chance that you won't find any blocks
in the first year.
• You might really be in trouble if you haven't earned any revenue in an
entire year of running that $6,000 box that requires a lot of electricity.
• There's about a 36% chance that you'll find one block in the first year.
• And then there's a slightly smaller chance that you'll find two or more
blocks, in which case you'll really be making profit.
• So again, on expectation, you might be just doing okay enough to make a
return on your money.
• But there's a big chance that you'll make nothing at all. For a small
miner, mining is essentially based on chance.
 Mining pools
• Now historically, when small business people faced a lot of risk and they
wanted to lower it, they got together and formed mutual insurance
companies.
• A mining pool is exactly this kind of organization for mining Bitcoins.
• Suppose that a group of miner get together and form a pool.
• They will attempt to mine a block for the same recipient, called pool
manager. The pool manager will receive the minted Bitcoin no matter
what miner found them.
• He will take that revenue and distribute it to all of the participants in the
pool based on how much work each participant actually does.
• Of course, the pool manager will also probably take some kind of reward
for his management service.
• The miners are encouraged to join a pool to lower their variance.
Computing the work of each miner
• How does the pool manager know how much work each of the members is actually
performing?
• He can’t just take everybody's word for it, since many won’t declare the truth. So, the idea
is that miners can prove probabilistically how much work they're doing by outputting
shares.
• Shares are almost valid blocks.
• It's pretty rare to find an actually valid block, that starts with all the required zeros at the
beginning of the output hash.
• But, there will be a lot more almost blocks that start with a lot of zeros but not all the ones
necessary to make it a valid block.
• So, supposing that a valid block starts with 60 zeros, a almost valid one could start with 40
or 50 bits of zeros.
• So the miners participating in the pool send to the manager a bunch of these near-valid
blocks.
• The rate at which every miner is sending them, should give a very good statistical idea of
who's doing how much work.
• In addition, there's no way to fake it. In fact, thanks to hash properties, there's no way to find
almost valid blocks without also finding actual blocks at the expected rate.
Mining Shares. Miners continually try to find blocks with a hash below
the target. In the process, they’ll find other blocks whose hashes
contain fewer zeros — but are still rare enough to prove that they have
been working hard. In this figure, the dull green hashes are shares,
while the bright green hash is from a valid block (which is also a valid
share).
 Computing the revenue for each miner
• How can miners work together to find a new valid block? As
soon as a new block is discovered by the network a new
round starts:
– the pool manager chooses the new transactions that are going to be
inserted, assemble the Merkle tree including the coinbase transaction
that creates new coins towards himself.
– the block header will be sent to all of the participants in the pool. The
miners have to prove that they've been working on it by sending in
shares showing that they've been hashing this block. Finally one of
the miners, hopefully in the pool, finds a valid block that will be
published.
– After this happens, all the miners will send the pool manager all the
shares found. He will verify them and distribute the revenue
proportionally to how much work they actually did.
 Computing the revenue for each miner
• Now, in the image below, even if the block was found by the miner on the
right, the miner on the left will receive a higher revenue, since he has
found more valid shares.
• There's no bonus for the miner who has actually found the block.
• So it would have been better if he had just mined alone.
• While, the miner on the left would be glad since he will receive a higher
reward.
 Alternative reward methods
• There are a lot of variations on the model explained above to compute the
miners' reward. A couple of common ones are:
– pay-per-share: the pool manager pays a flat fee for every share above a
certain difficulty that the miners find. In some ways it's the best for
miners because the reward is guaranteed. The pool manager is taking
all the risk in this scheme, since he will have to pay even if no valid
block was found for the current round. In this case the miners don't
have any real motivation to send valid blocks, since they will get the
same reward as if they have only found shares.

– proportional model: instead of a flat share, the amount of share

depends on whether or not the pool actually found a valid block. In this
case the miners still have some risk, while it will be lower for the pool
manager. In this case, the miners have a higher motivation to send valid
blocks.
• Pool hopping. Even with just these two types of pools, we can see
that miners might be incentivized to switch between the pools at
different times. To see this, consider that a purely proportional
pool will effectively pay out a larger amount per share if a block is
found quickly, as it always pays one block reward no matter how
long it has been since the last block was found.
• A clever miner might try mining in a proportional pool early in
the cycle (just after the previous block was found) while the
rewards per share are relatively high, only to switch (“hop”) to a
pay‐per‐share pool later in the cycle, when the expected rewards
from mining in the proportional pool are relatively low.
• As a result of this, proportional pools aren’t really practical. More
complicated schemes, such as “pay per last N shares submitted”
are more common, but even these are subject to subtle pool
hopping behavior. It remains open how to design a mining pool
reward scheme that is not vulnerable to this kind of
manipulation.
 History and standardization with Bitcoin
protocol
• The first mining pools have arisen in 2010 and they immediately became
very popular.
• So by 2014 most of miners have already joined a pool.
• Now it is really simple to buy a mining hardware, plug it into the wall,
connect to the network an join a mining pool.
• That's because these mining pools protocols have been almost integrated
with the specific mining hardware.
• In June 2014 happened that the mining pool GHash.io got so big that
controlled over 50% of the entire capacity of the Bitcoin network.
• This because its conditions were better than other groups.
• That's something that people had feared for a long time.
• So GHash started to change the rewards to become a little less attractive.
It finally stopped the activity when the Bitcoin price fell again below 300$.
Integration with mining protocol
• How to assess the computing power of a mining
pool?
– it is worth noting that mining pools might be hiding
actual concentration of mining power in the hands
of a few large mining organizations which can
participate in multiple mining pools simultaneously
to hide their true size.
• This practice is called laundering hashes.
• It remains unknown how concentrated physical control of
mining hardware actually is and mining pools make this
quite difficult to determine from the outside.
 Mining pools pros and cons
• Basically nowadays around 4 mining pools control about half of the power
in the network (i.e. AntPool, BTCC Pool, Bixin, BTC.com).
• Advantages:
– they make mining more predictable for the participants. So it is much easier
for smaller miners to get involved in the game.
– there's one pool manager who's sitting on the network and assembling blocks.
So it's easier to upgrade the network. In fact, by upgrading the software of
the mining pool manager, that effectively updates the software of all the pool
members.
• Disadvantages:
– this leads to centralization. The miners are free to switch between one pool
and another. But now there is no pool that's offering really better conditions
than others. So for the miners it's easier to stick to the first joined pool.
– mining pools existence lowers the population of people actually running a fully
validated Bitcoin node. Before mining pools, all small miners had to store the
whole blockchain and validate transactions. Now, most miners offload that
task to their pool manager.
Mining Incentives and Strategies
 Mining Incentives and Strategies
• Important to have some good hardware, get some cheap electricity.
• Some interesting strategic considerations every miner makes:
1. Which transactions to include. Miners get to choose which transactions they
include in a block. The default strategy is to include any transaction which
includes a transaction fee higher than some minimum.
2. Which block to mine on. Miners also get to decide on top of which block they
want to mine. The default behavior for this decision is to extend the longest
known valid chain.
3. Choosing between blocks at the same height. If two different blocks are
mined and announced at around the same time, it results in a 1‐block fork,
with either block admissible under the longest valid chain policy. Miners then
have to decide which block to extend. The default behavior is to build on top
of the block that they heard about first.
4. When to announce new blocks. When they find a block, miners have to
decide when to announce this to the Bitcoin network. The default behavior is
to announce it immediately, but they can choose to wait some time before
announcing it.
 Mining Incentives and Strategies
• For each decision a default strategy, followed by most miners
(around 90%) since they run the default Bitcoin client.
• Is it possible to make more money in changing the default
strategy?
– Potentially profitable deviation from default behavior
– Depends on mining power.
– To express the proportion of mining capacity with an 0 < α
< 1, it turns out that for some α, it is possible to make
more money changing the strategy.
 The 51% attack
• In principle, the blockchain mechanism only ensures consensus with overwhelming
probability.
• A transaction that appears in the longest, current blockchain can be omitted in a
future blockchain which is longer — however, creating such a “forked”
blockchain that omits a transaction requires an adversary with computation
power larger than half the computation power of the entire network.
• The backtracking mechanism which permits this kind of double-spending is known
as a 51% attack.
• Satoshi Nakamoto was aware of this attack when he introduced Bitcoin in 2009.
• His proof-of-work mechanism ensures correct blockchain consensus under the
assumption that the majority of miners are honest.
• If, for example, the powerful miner spent some money in another fork of the
blockchain at the time when that fork appeared to be longest, he would not
necessarily have to carry that transaction over to his own fork and could thereby
double-spend the money.
 Forking attacks
• A simplest attack is a forking attack, Idea is to perform a double spend.
• Suppose that some money has been transferred to Bob and that the
transaction is in the longest chain.
• A miner could try to insert another transaction towards himself
connecting to a previous block that the one containing the other
transaction.
• Perhaps he follows the common heuristic and even waits for six
confirmations to be sure.
• At the moment of insertion the transaction is not part of the longest
chain.
• But, if the miners has greater than 50% of hashing power, he can make the
new chain become the longest one and rewrite history.
• So the valid transaction would now be the one towards himself and not
Bob.
 Forking attacks

Forking attack. A malicious miner sends a transaction to Bob and receives some
good or service in exchange for it. The miner then forks the block chain to create a
longer branch containing a conflicting transaction. The payment to Bob will be
invalid in this new consensus chain.
 Forking attacks
• If Bob had given the miner something in exchange for those
bitcoins, for example real currency or goods, he has swindled
him and the network.
• Attack is possible if α > 0.5, if the miner has the majority of
the mining power.
• So the 51% attack threshold is not a certainty, but a gradient
where the attack gets easier.
• This attack is detectable, so the community could refuse to
accept a the new chain even if it's the longest one.
• A successful forking attack could make the Bitcoin price fall
down due to a dramatic loss of confidence.
 Goldfinger attack
• This attack is named after the James Bond movie.
• Goal in the movie was to irradiate all of the gold that the U.S. government
held at Fort Knox to make it valueless.
• If the goal is to destroy Bitcoin, attacker might be willing to do this forking
attack in order to specifically tank the market.
• Really expensive to buy enough mining capacity to have more than 50%
power.
• Possible to bribe the people who control that capacity to work for you in
exchange for some reward. The reward could be an amount of FIAT
currency.
• May run a new mining pool with not sustainable rewards, but enough to
get miners join it.
• All of the miners have incentive in keeping the bitcoin currency solvent,
but individual miners would have the incentive to defect and accept a
bribe if they thought they could make more money in the short-term.
 Checkpointing defence
• One defense that exists in BitCoin against forking attacks is Checkpointing.
• Idea is instead of actually acquiring all the mining capacity directly, the
attacker just pays those who already have it to help their fork overcome
the longest chain.
– “Out of band” — perhaps locate some large miners and hand them an
envelope of cash for working on your fork.
– Create a new mining pool and run it at a loss, offering greater
incentives than other pools. Even though the incentives might not be
sustainable, an attacker could keep them going forlong enough to
successfully launch a forking attack and perhaps profit.
– Big “tips” in blocks on the forking chain— big enough to cause miners
to leave the longest chain and work on the forking chain in hopes that
it will become the longest chain and they can collect the tips.
 Block-withholding attack
• Not to announce a block as soon as one has found it.
• Miner tries to go ahead to find another block before the rest
of the network finds one.
• Why would it be possible to gain in maintaining some block
secret?
• While you have two blocks in your backpocket, the rest of the
network is trying to extend what they think is the current
longest chain.
• All of the effort is going to be a waste for them.
• As soon as the rest of the network finds a new block, you can
drop your two and yours would instantly be the longest chain.
• This technique has been called selfish mining.
Block-withholding attack
 Block-withholding attack
• What this will do is the following:
– Double the reward that you could have collected.
– Be the block dictators in two blocks instead of one
and hence double the amount you can earn via
transaction fees.
• The reason why it is called “selfish”, is because
you are going against the very idea of “equal
opportunity for all” that mining stands for.
Everyone must have a fair shake at mining and
discovering their own blocks. Plus, this can also
lead to network monopolization
 Blacklist an address
• Called as Punitive forking
• To blacklist transactions from address X to need freeze its
individual money forever.
• An extreme strategy would be to refuse every transaction
coming from this address, so also every block containing one
of its transactions.
• It's an extreme strategy since it need a hard forking and it
won't work with less than 50% power.
• Disadvantage: Consumes/waste all the power and energy.
So, we have seen above how anyone with a 51%
majority can backlist anyone using punitive forking.
Now, what can you do if you want to blacklist
someone but you don’t own a 51% majority?
 Feather Forking
• A better way to do punitive forking, is called feather forking.
• Idea is to announce publicly that you're going to fork and you
will try to mine an alternative longest chain.
• But won't fork forever, and you'll give up after one or two
blocks that confirm block X, thereby return to the longest
chain.
• Typically stop after one confirmation, since need to find two
consecutive block to fight against it.
• Chance of pruning the block containing transaction from X is
α2 .
• It’s not since if your power is 0.2, α2 would be very low.
 Feather Forking
• Since its announced publicly the fork, other miners know that
there's an α2 possibility that their block will be orphaned if
they don't follow your block.
• If they don't have a strong motivation to include that
transaction(i.e. high fees), they would probably mine on top
of yours.
• Risk of losing the reward could be much worse than loosing
the fee of a single transaction.
• It's usually an interest to follow feather forking.
• It would be possible to enforce a blacklist with less that 50%
power.
• Profit in blacklisting could be to obtain some kind of
extortion, or for legal reasons.
• For example to frozen some specific assets.
 Transaction fees
• If the miners start to enforce this for a minimum transaction
fee.
• E.g. They try to blacklist every transaction with a fee below a
specific threshold.
• Transactions are assigned a priority which is the sum of input
values times input ages divided by the size of the transaction
in bytes:
• priority = sum(input_value * input_age)/size_in_bytes
• Basically, the transactions with higher values, that are
spending older coins that haven't been moved in a while and
with smaller dimensions have higher priority.
 Transaction fees
• So, if you want to move money more quickly, with lower amounts
and complicated scripts, you will have to pay higher fees.
• Currently, by default, the miners accept transactions without fees
if the priority is higher than 0.576.
• It's a very arbitrary choice, but it's the default of Bitcoin core client.
• Currently transaction fees doesn't matter so much, since block
minting is providing 99% of miners' reward.
• However the transaction fees importance is growing with the
increasing of transactions number and with the decreasing of
blocks reward every four years.
• So, in the near future they could become vital.
• So, maybe miners will become more and more aggressive trying to
enforce a minimum transaction fees.