JULY 2018 | VOL. 61 | NO. 7 | COMMUNICATIONS OF THE ACM 99
4. 2. Simulation
is the revenue rate ratio; that is, the ratio of its blocks out of
the blocks in the main chain. We substitute the probabilities
from Reference9 in the revenue expressions of ( 1)-( 2) to cal-
culate the pool’s revenue for
To validate our theoretical analysis, we compare its result with a
Bitcoin protocol simulator. The simulator is constructed to capture all the salient Bitcoin mining protocol details described
in previous sections, except for the cryptopuzzle module that
has been replaced by a Monte Carlo simulator that simulates
block discovery without actually computing a cryptopuzzle. In
this experiment, we use the simulator to simulate 1000 miners mining at identical rates. A subset of 1000α miners form a
pool running the Selfish-Mine algorithm. The other miners follow the Bitcoin protocol. We assume block propagation time
is negligible compared to mining time, as is the case in reality. In the case of two branches of the same length, we artificially
divide the non-pool miners such that a ratio of γ of them mine on
the pool’s branch and the rest mine on the other branch. Figure 2
shows that the simulation results match the theoretical analysis.
4. 3. The effect of α and γ
When the pool’s revenue given in Equation 3 is larger than
α, the pool will earn more than its relative size by using the
Selfish-Mine strategy. Its miners will therefore earn more
than their relative mining power. Recall that the expression
is valid only for We solve this inequality and phrase
the result in the following observation:
Observation 1. For a given γ, a pool of size α obtains a rev-
enue larger than its relative size for α in the range
We illustrate this in Figure 2, where we see the pool’s rev-
enue for different γ values with pool size ranging from 0 (very
small pool) to 0.5 (half of the miners). Note that the pool is only
at risk when it holds exactly one block secret, and the honest
miners might publish a block that would compete with it. For
γ = 1, the pool can quickly propagate its one-block branch if
the others find their own branch, so all honest miners would
(d) Was two branches of length 1, others find a block after
others’ head. The others obtain a revenue of two.
(e) No private branch, others find a block. The others
obtain a revenue of one, and both the pool and the
others start mining on the new head.
(f) Lead was 1, others find a block. Now there are two
branches of length one, and the pool publishes its
single secret block. The pool tries to mine on its
previously private head, and the others split between
the two heads.
The revenues from both heads cannot be determined
yet, because they depend on which branch will win.
It will be counted later.
(g) Lead was 2, others find a block. The others almost close
the gap as the lead drops to 1. The pool publishes its
secret blocks, causing everybody to start mining at the
head of the previously private branch, since it is longer. The pool obtains a revenue of two.
(h) Lead was more than 2, others find a block. The others
decrease the lead, which remains at least two. The new
block (say with number i) will end outside the chain once
the pool publishes its entire branch, therefore the others
obtain nothing. However, the pool now reveals its i’th
block, and obtains a revenue of one for its i’th block.
We calculate the revenue of the pool and of the others
from the state probabilities and transition frequencies:
As expected, the intentional branching brought on by
selfish mining leads the honest miners to work on blocks
that end up outside the blockchain. This, in turn, leads to
a drop in the total block generation rate with rpool + rothers < 1.
The protocol will adapt the mining difficulty such that the
mining rate at the main chain becomes one block per 10min
on average. Therefore, the actual revenue rate of each agent
0 0.1 0.2 0.3
γ = 0
γ = 0 (sim)
γ = 1/2 (sim)
γ = 1 (sim)
γ = 1
γ = 1/2
Figure 2. Revenue using the Selfish-Mine strategy for different
propagation factors γ, compared to honest mining.
2′ 3′ 4′
2′ 3′ 4′
2′ 3′ 4′
2′ 3′ 4′
2′ 3′ 4′