Is selfish mining still an option with compact blocks and FIBRE?

The selfish mining strategy relies on withholding a block to build on it in private. When the honest chain publishes a block, the attacker immediately broadcasts its own withheld block in order to try to replace it.

Today, most miners are connected via FIBRE and the general network has compact blocks to exchange compressed blocks. The delay until a block is known to the complete miner community is thus much smaller than in 2013. It seems that under the "first seen paradigm" selfish mining becomes a losing strategy for blocks with such short relay times.

Is it correct to conclude that selfish mining is a theoretical attack now?

Murch

Posted 2016-11-07T09:19:51.603

Reputation: 41 609

Answers

While FIBRE has done an incredible job in reducing relay times for blocks which are new, many miners additionally have systems by which they relay their own blocks in a single packet and have them queued up to relay on when they start mining the template, not when they find the block. Ultimately, FIBRE's few milliseconds of delay will lose to a single UDP packet that just relays the winning nonce around. Further, selfish mining attacks are very non-linear in the advantage you gain from a relay advantage - if you're 1ms faster to most hashpower, you have an advantage to that hashpower, period.

Matt Corallo

Posted 2016-11-07T09:19:51.603

Reputation: 324

Even if all miners are connected to the same relay network, implying that they all will choose to mine on an earlier block, selfish mining is possible if the pool size is 1/3rd of the network size or greater. Pools have reached sizes greater than 33% in the past. The threshold might be a bit lower if we assume all miners are not connected to the same relay network. It also seems unwise to rely on relay networks completely for security.

A scenario where relay networks would not help is if the private blockchain has a lead of two or more on the public blockchain. When honest miners find a block to reduce the lead to one block, the selfish pool can publish two of its blocks. This would render the honest miners' work on their block to waste, and give the selfish miner an unfair lead on mining on the latest block.

kanu

Posted 2016-11-07T09:19:51.603

Reputation: 31

1When has selfish mining happened in the past? I thought it only was ever described theoretically. Could you please link a source? –– The only way for a selfish miner to gain a two block lead is by having a one block lead first. This would mean that a miner would need to choose to withhold a block with only a single block lead. – Murch – 2016-11-07T14:51:53.913

Edited- I meant pools have reached sizes greater than 33%. Yes, the selfish pool would need to withhold the first block. I'm not sure how exactly this attack would be consistently profitable in that case. It's maybe possible to define heuristics- eg. withhold the block for 30 seconds and start mining on it, if you fail to extend the lead, publish the first block. – kanu – 2016-11-07T14:58:29.850

2Selfish mining can be hard to identify - practically it can appear to outside observers to simply be a higher orphan rate or delayed block propagation - something we have seem many times (deepbit had this for a while when they had high hashpower, but occasionally orphaned themselves, so unclear if they were incompetent or what, but also antpool had a bad case of delayed block propagation up until a few months ago when it was pointed out that they were effectively 51% attacking the network with other spy-mining pools). Sadly I'm not aware of anyone who actually attempted further analysis. – Matt Corallo – 2016-11-07T15:02:38.673