If the pool has a private branch of length 1 and the others mine one block, the pool publishes its branch immediately, which results in two public branches of length 1.
Miners in the selfish pool all mine on the pool’s branch,
because a subsequent block discovery on this branch will
yield a reward for the pool. The honest miners, following
the standard Bitcoin protocol implementation, mine on
the branch they heard of first. We denote by γ the ratio of
honest miners that choose to mine on the pool’s block,
and the other ( 1−γ) of the non-pool miners mine on the
For state s = 0, 1, 2, . . ., with frequency α, the pool mines
a block and the lead increases by one to s + 1. In states
s = 3, 4, ..., with frequency ( 1 − α), the honest miners
mine a block and the lead decreases by one to s − 1. If
the others mine a block when the lead is two, the pool
publishes its private branch, and the system drops to a
lead of 0. If the others mine a block with the lead is 1,
we arrive at the aforementioned state 0’. From 0’, there
are three possible transitions, all leading to state 0 with
total frequency 1: ( 1) the pool mines a block on its previously private branch (frequency α), ( 2) the others mine a
block on the previously private branch (frequency γ( 1 − α) ),
and ( 3) the others mine a block on the public branch (
frequency ( 1 − γ)( 1 − α) ).
4. 1. Revenue
We analyze the state machine and calculate the probabilities
of the states p0′, p0, p1, . . .; the details are in our full report. 9
The probability distribution over the state space provides the
foundation for analyzing the revenue obtained by the selfish pool and by the honest miners. The revenue for finding
a block belongs to its miner only if this block ends up in the
main chain. We detail the revenues on each event below.
(a) Any state but two branches of length 1, pool finds a block.
The pool appends one block to its private branch,
increasing its lead on the public branch by one. The
revenue from this block will be determined later.
(b) Was two branches of length 1, pool finds a block. The
pool publishes its secret branch of length two, thus
obtaining a revenue of two.
(c) Was two branches of length 1, others find a block after
pool head. The pool and the others obtain a revenue of
one each—the others for the new head, the pool for
miners will choose to mine on either branch, depending on
the propagation of the notifications. If the selfish pool manages to mine a subsequent block ahead of the honest miners
that did not adopt the pool’s recently revealed block, it publishes immediately to enjoy the revenue of both the first and
the second blocks of its branch. If the honest miners mine a
block after the pool’s revealed block, the pool enjoys the revenue of its block, while the others get the revenue from their
block. Finally, if the honest miners mine a block after their
own block, they enjoy the revenue of their two blocks while
the pool gets nothing.
In the second scenario, where the selfish pool succeeds in
finding a second block, it develops a comfortable lead of two
blocks that provide it with some cushion against discoveries
by the honest miners. Once the pool reaches this point, it continues to mine at the head of its private branch. It publishes
one block from its private branch for every block the others
find. Since the selfish pool is a minority, its lead will, with
high probability, eventually reduce to a single block. At this
point, the pool publishes its private branch. Since the private
branch is longer than the public branch by one block, it is
adopted by all miners as the main branch, and the pool enjoys
the revenue of all its blocks. This brings the system back to a
state where there is just a single branch until the pool bifurcates it again.
We can now analyze the expected rewards for a system
where the selfish pool has mining power of α and the others
of ( 1 − α).
Figure 1 illustrates the progress of the system as a state
machine. The states of the system represent the lead of the
selfish pool; that is, the difference between the number of
unpublished blocks in the pool’s private branch and the
length of the public branch. Zero lead is separated to states
0 and 0’. State 0 is the state where there are no branches;
that is, there is only a single, global, public longest chain.
State 0’ is the state where there are two public branches
of length one: the main branch, and the branch that was
private to the selfish miners, and published to match the
main branch. The transitions in the figure correspond to
mining events, either by the selfish pool or by the others.
Recall that these events occur at exponential intervals with
an average frequency of α and ( 1 − α), respectively.
We can analyze the expected rewards from selfish mining by taking into account the frequencies associated with
each state transition of the state machine, and calculating
the corresponding rewards. Let us go through the various
cases and describe the associated events that trigger state
1 – α
( 1 – γ) ( 1 – α)
γ( 1 – α)
1–α 1–α 1–α 1–α α
1 – α
Figure 1. State machine with transition frequencies.
2′ 3′ 4′
2′ 3′ 4′ 5′