Lecture 5: Bitcoin Mining

Bitcoin Mining

Recap: Bitcoin Miners

Bitcoin depends on miners to:
- Store and broadcast the blockchain.
- Validate new transactions.
- Vote (by hash power) on consensus.
Who are the miners?
How did they get into this?
How do they operate?
What is their business model?

The Task of Bitcoin Miners

So You Want to Be a Miner?

Some gold miners of the Klondike gold rush struck it rich, others lost everything.
Bitcoin mining has similar challenges as the gold rush and other get-rich-quick schemes.
Klondike gold rush of 1898 - Gold miners ascending the Chilkoot pass.

Mining Bitcoins in 6 Easy Steps

Join the network, listen for transactions
- Validate all proposed transactions
Listen for new blocks, maintain blockchain
- When a new block is proposed, validate it.
Assemble a new valid block.
Find the nonce to make your block valid.
Hope everybody accepts your new block.
Profit!
- Useful to the Bitcoin network.
- Incentivize miners to do the above.

Mining Bitcoins in 6 Easy Steps (Detailed)

Listen for transactions:
- Validate them by checking that signatures are correct.
- Outputs being spent haven’t been spent before.
Maintain blockchain and listen for new blocks:
- Start by asking other nodes to give you all of the historical blocks that are already part of the blockchain before you joined the network.
- Listen for new blocks that are being broadcast to the network.
- Must validate each block that you receive — by validating each transaction in the block and checking that the block contains a valid nonce.
Assemble a candidate block:
- Once you have an up‐to‐date copy of the blockchain, you can begin building your own blocks.
- Group transactions that you heard about into a new block that extends the latest block you know about.
- Must make sure that each transaction included in your block is valid.
Find a nonce that makes your block valid:
- This step requires the most work, and it’s where all the real difficulty happens for miners.
Hope your block is accepted:
- Even if you find a block, there’s no guarantee that your block will become part of the consensus chain.
- You have to hope that other miners accept your block and start mining on top of it, instead of some competitor’s block.
Profit:
- If all other miners do accept your block, then you profit!
- In early 2015, the block reward is 25 bitcoins.
- If any of the transactions in the block contained transaction fees (about 1% of block rewards), the miner collects those too.

Finding a Valid Block

Finding a nonce that makes your block valid.
Two main hash‐based structures:
- The blockchain where each block header points to the previous block header in the chain.
- Within each block there's a Merkle tree of all of the transactions included in that block.
The first thing that you do as a miner is to compile a set of valid transactions that you have from your pending transaction pool into a Merkle tree.
In the block header, there’s a 32 bit nonce field, and you keep trying different nonces looking for one that causes the block’s hash to be under the target — roughly, to begin with the required number of zeros.
Changing the extra nonce in the coinbase transaction is a much more expensive operation than changing the nonce in the block header.
For this reason, miners spend most of their time changing the nonce in the block header and only change the coinbase nonce when they have exhausted all of the 232 possible nonces in the block header without finding a valid block.

Mining Difficulty

Difficulty: Exactly how difficult is it to find a valid block?
As of March 2015, the mining difficulty target (in hexadecimal) is:
- 0000000000000000172EC0000000000000000000000000000000000000000000
So the hash of any valid block has to be below this value.
In other words only one in about 2^{67} nonces that you try will work, which is a really huge number.
One approximation is that it's greater than the human population of Earth squared.
So, if every person on Earth was themselves their own planet Earth with seven billion people on it, the total number of people would be close to 2^{67}.

Is Everyone Solving the Same Puzzle?

The answer is no!
Firstly, it’s unlikely that miners will be working on the exact same block as each miner will likely include a somewhat different set of transactions and in a different order.
But more importantly, even if two different miners were working on a block with identical transactions, the blocks would still differ.
Recall that in the coinbase transaction, miners specify their own address as the owner of the newly minted coins.
This address by itself will cause changes which propagate up to the root of the Merkle tree, ensuring that no two miners are working on exactly the same puzzle unless they share a public key.
This would only happen if the two miners are part of the same mining pool, in which case they’ll communicate to ensure they include a distinct nonce in the coinbase transaction to avoid duplicating work.
Unlikely miners are working on the same set of transactions (and thus the same block).
Even if some miners have the same transactions in the block, there is one which is not the same: Coinbase!
Miners will specify their own address in the output (hopefully each miner will use a different address!).

Setting the Mining Difficulty

next_difficulty = previous_difficulty * (2 \text{ weeks}) / (\text{time to mine last 2016 blocks})
Every two weeks (or approx. 2,016 blocks), compute:
Expected number of blocks in 2 weeks at 10 minutes/block.
If the period were much shorter, the difficulty might fluctuate due to random variations in the number of blocks found in each period.
If the period were much higher, the network’s hash power might get too far out of balance with the difficulty.
Each Bitcoin miner independently computes the difficulty and will only accept blocks that meet the difficulty that they computed.
Miners who are on different branches might not compute the same difficulty value, but any two miners mining on top of the same block will agree on what the difficulty should be. This allows consensus to be reached.
Mining difficulty is affected by factors like how many new miners are joining, which in turn may be affected by the current exchange rate of Bitcoin.
Generally, as more miners come online and mining hardware gets more efficient, blocks are found faster and the difficulty is increased so that it always takes about ten minutes to find a block.

Mining Difficulty Over Time

Factors affecting mining difficulty:
- How many new miners join the network  current exchange rate of Bitcoins
- Efficiency of mining hardware
As more miners join and mining hardware becomes efficient → blocks are found faster → difficulty is increased!
Goal: keep the difficulty at approx. 10 min per block.

Mining Hardware

SHA-256

General-purpose hash function.
Part of SHA-2 family: SHA-224, SHA-384, SHA-512.
Published in 2001.
Designed by the NSA.
Remains unbroken cryptographically.
Weaknesses known.
SHA-3 (replacement) under standardization.

SHA-256 in More Depth

256-bit state
Bitwise tweaks
- Maj(a, b, c)
- Σ1
- Ch(e, f, g)
x64 iterations
round constants
Addition mod 32
(Wt = Kt)

CPU Mining

TARGET = (65535 << 208)/DIFFICULTY;
coinbase_nonce = 0;
while (1){
    header = makeBlockHeader(transactions, coinbase_nonce);
    for (header_nonce=0;header_nonce < (1<<32);header_nonce++){
        if (SHA256(SHA256(makeBlock(header,header_nonce))) <  TARGET)
            break; //block found!
    }
    coinbase_nonce++;
}

Throughput on a high-end PC ≈ 20 million hashes/sec
two hashes ≈ 139,461 years to find a block today!

GPU Mining

GPUs designed for high-performance graphics.
High parallelism.
High throughput.
First used for Bitcoin mining in October 2010.
Implemented in OpenCL.
OpenCL: General purpose high level language for implementing non-graphic applications on GPUs.

GPU Mining Advantages

Easily available, easy to set up.
Parallel ALUs.
Simultaneous SHA-256 computations.
Some GPUs support instructions for bit-wise operations.
Useful for SHA-256 computations.
Can drive many from 1 CPU.
Can overclock!
- Run them faster than they are actually designed for.
Only downside is that overclocking might introduce errors (but errors can be quickly verified) or overheat.
Introduction of some errors to gain a speed-up in hash computation is a good trade-off.

"Goodput"

Observation: some errors are okay (may miss a valid block).
Goodput: throughput × success rate.
Worth over-clocking by 50% with 30% errors!

GPU Mining Disadvantages

Poor utilization of hardware.
- Contains FPUs which are not used for SHA-256 at all.
Poor cooling.
Cannot be stacked.
Large power draw.
Few boards to hold multiple GPUs.
May need customized boards.
Throughput on a good card = 20-200 MHz ≈ 200 million hashes/sec ≈173 years to find a block w/100 cards (at 2015 difficulty level)!
GPU mining is basically dead for Bitcoins 

FPGA Mining

Field Programmable Gate Area
First used for Bitcoin mining approx. June 2011
Implemented in Verilog

FPGA Mining Advantages

Higher performance than GPUs
Excellent performance on bitwise operations
Better cooling
Extensive customisation, optimisation

FPGA Mining Disadvantages

Higher power draw than GPUs designed for.
Frequent malfunctions, errors.
Poor optimization of 32-bit adds.
Critical for SHA-256 operations.
Less accessible.
Cannot buy them at regular stores.
Fewer hobbyists with sufficient expertise to program them.
More expensive than GPUs.
Marginal performance/cost advantage over GPUs
Throughput on a good card = 100-1000 MHz ≈ 1 billion hashes / sec
25 years to find a block w/100 boards (at 2015 difficulty level)!
FPGA mining is also dead for Bitcoins – was even more short-lived that GPUs 

Bitcoin Application-Specific Integrated Circuits (ASICs)

Bitcoin ASICs

Special purpose.
Approaching known limits on feature sizes.
Less than 10x performance improvement expected.
Designed to be run constantly for life.
Require significant expertise, long lead-times.
Perhaps the fastest chip development ever!

Case Study: TerraMiner IV

First shipped Jan 2014
2 TH/s
Cost: US$6,000
Still, 14 months to find a block!

Market Dynamics (2013/2014)

Most boards obsolete within 3-6 months.
Half of profits made in first 6 weeks.
Shipping delays are devastating to customers.
Most companies require pre-orders.
Most individual customers should have lost… But… rising prices have saved them!

Professional Mining Centers

Needs:
- Cheap power
- Good network
- Cool climate
(Georgia and Iceland are popular destinations for bitcoin mining)

Evolution of Mining

CPU → GPU → FPGA → ASIC
Gold pan → Sluice box → Placer mining → Pit mining

The Future

Can small miners stay in the game?
Do ASICs violate the original Bitcoin vision?
Would we be better off without ASICs?
Stay tuned for our lecture on alt-mining!

Energy Consumption & Ecology

Thermodynamic Limits

SHA-256 is not reversible
Landauer’s principle: Any non-reversible computation must consume a minimum amount of energy.
Specifically, each bit changed requires (kT \ln 2) joules
Energy consumption is inevitable

Energy Aspects of Bitcoin Mining

Embodied energy: used to manufacture mining chips & other equipment
- Should decrease over time
- Returns to scale
Electricity: used to perform computation
- Should increase over time
- Returns to scale
Cooling: required to protect equipment
- Costs more with increased scale!

Estimating Energy Usage: Top-Down

Each block worth approximately US$6,500
Approximately $11/s generated
Industrial electricity (US): $0.03/MJ
- Equivalently, $0.10/kWh
If Bitcoin miners were spending all $11 per second of earnings on buying electricity
Upper bound on electricity consumed: 367 MJ/s = 367 MW

Estimating Energy Usage: Bottom-Up

Best claimed efficiency:
- Most cutting edge ASIC - 3 gigahashes/sec per watt (or 3 billion hashes per second for 1 watt of power consumed)
Network hash rate: 350,000,000 gigahashes/sec
Excludes cooling and embodied energy
Lower bound on electricity consumed (to produce that many hashes per second at that efficiency): 150 MW

How Much is a MW?

Three Gorges Dam = 10,000 MW
typical hydro plant ≈ 1,000 MW
Kashiwazaki-Kariwa nuclear power plant = 7,000 MW
typical nuclear plant ≈ 4,000 MW
major coal-fired plant ≈ 2,000 MW

In Summary – Bitcoin Energy Usage

The entire Bitcoin network consumes roughly 10% of a large power plant’s output
Significant but still small compared to other usages of electricity

Is Bitcoin Mining Wasteful?

All payment systems require energy!
Although, it may be nice to have a currency with a less energy-intensive puzzle, but the same level of security!

Data Furnaces

Observation: in the limit, computing devices produce heat almost as well as electric heaters!
Why not install mining rigs as home heaters?
Challenges:
- Ownership/maintenance model
- Gas heaters still at least 10x more efficient
- What happens in summer?

Open Questions

Will Bitcoin drive out electricity subsidies?
Will Bitcoin require guarding power outlets?
Can we make a currency with no proof-of-work?
Stay tuned for our lecture on alt-mining!

Mining Pools

Economics of Being a Small Miner

Cost of a mining rig: ≈US$6,000
Expected time to find a block: ≈14 months
In 2015, a block was worth ≈$10,000
Amortized expected revenue: ≈$400/month (after factoring in electricity and other operating costs)
Given the above numbers, it may make sense to buy the mining rig, but remember mining is a random process → possible miner may never be able to mine a block → make any money TerraMiner IV

Mining Uncertainty

Assuming that the global hash rate is constant and the mean time to find a block is 14 months, the variance for a small miner is quite high.

Idea: Could Small Miners Pool Risk?

Mining Pools

Historically, when small business people faced a lot of risk, they formed mutual insurance companies to lower that risk.
Farmers, for example, would get together and agree that if any individual farmer’s barn burned down the others would share their profits with that farmer.
Could we have a mutual insurance model that works for small Bitcoin miners?
A mining pool is exactly that — mutual insurance for Bitcoin miners.
A group of miners will form a pool and all attempt to mine a block with a designated coinbase recipient. That recipient is called the pool manager.
So, no matter who actually finds the block, the pool manager will receive the rewards.
The pool manager will take that revenue and distribute it to all the participants in the pool based on how much work each participant actually performed.
Of course, the pool manager will also probably take some kind of cut for their service of managing the pool.

Mining Pools - Goal

Pool participants all attempt to mine a block with the same coinbase recipient (aka pool manager)
Send money to key owned by pool manager
Distribute revenues to members based on how much work they have performed
Minus a cut for pool manager
How do we know how much work members perform?

Mining Pools - Trust

Assuming everybody trusts the pool manager, this works great for lowering miners’ variance.
But how does a pool manager know how much work each member of the pool is actually performing?
How can the pool manager divide the revenue commensurate with the amount of work each miner is doing?
Obviously the pool manager doesn't want to just take everyone's word for it because people might claim that they’ve done more than they actually did.

Mining Shares

There's an elegant solution to this problem. Miners can prove probabilistically how much work they're doing by outputting shares, or near‐valid blocks.
Say the target is a number beginning with 67 zeros.
A block’s hash must be lower than the target for the block to be valid.
In the process of searching for such a block, miners will find some blocks with hashes beginning with a lot of zeros, but not quite 67.
Miners can show these nearly valid blocks to prove that they are indeed working.
A share might require say 40 or 50 zeros, depending on the type of miners the pool is geared for.
The pool manager will also run a Bitcoin node on behalf of participants, collecting transactions and assemble them into a block.
The manager will include their own address in the coinbase transaction and send the block to all of the participants in the pool.
All pool participants work on this block, and they prove that they've been working on it by sending in shares.
When a member of the pool finds a valid block, they sends it to the pool manager who distributes the reward in proportion to the amount of work done.
The miner who actually finds the block is not awarded a special bonus, so if another miner did more work than, that other miner will be paid more even though they weren’t the one who ended up finding a valid block.

Mining Pools - Rewards

There are a few options for exactly how exactly the pool manager calculates how much to pay each miner based on the shares they submit.
We’ll look at two of the common, simpler ones.
There are many other schemes that are also used, but these will illustrate the trade‐offs between reward schemes.

Mining Pool Variations

Pay per share: flat reward per share
- Typically minus a significant fee
- What if miners never send in valid blocks?
Proportional: typically since the last block
- Lower risk for pool manager
- More work to verify
"Luke-jr" approach: no management fee

Pool Hopping

Miners may be incentivized to switch pools (of different types) at different times.
Consider that a purely proportional pool will effectively pay out a larger amount per share if a block is found quickly, as it always pays one block reward no matter how long it has been since the last block was found.
For instance, a clever miner might try mining in a proportional pool early in the cycle (while rewards per share are relatively high), only to “hop” to a pay-per-share pool later (while rewards per share are relatively low in the proportional pool).
As a result of this, proportional pools aren’t really practical.
More complicated schemes, such as “pay per last N shares submitted” are more common, but even these are subject to subtle pool hopping behavior.
Open problem: How to design mining pool reward that is not vulnerable to manipulation!

Mining Pool Protocols

Mining pools first started around 2010 in the GPU era of Bitcoin mining.
They instantly became very popular for the obvious reason that they lowered the variance for the participating miners.
They’ve become quite advanced now. There are many protocols for how to run mining pools and it has even been suggested that these mining pool protocols should be standardized as part of Bitcoin itself.
Just like there's a Bitcoin protocol for running the peer‐to‐peer network, mining pool protocols provide a communication API for the pool manager to send all of the members the details of the block to work on and for the miners to send back to the pool manager the shares that they're finding.
getblocktemplate (GBT) is officially standardised as a Bitcoin Improvement Proposal (BIP).
A competing protocol, Stratum, is currently more popular in practice and is a proposed BIP.
Unlike the Bitcoin protocol itself, it is only a minor inconvenience to have multiple incompatible mining pool protocols.
Each pool can simply pick whichever protocol they like and the market can decide.
Some mining hardware even supports these protocols at the hardware level, which will ultimately limit their development flexibility somewhat.
However, this makes it very simple to buy a piece of mining hardware and join a pool.
You just plug it into the wall — both the electricity and your network connection — choose a pool, and then it will start immediately getting instructions from the pool, mining and converting your electricity into money.
API for fetching blocks, submitting shares
- Stratum
- Getwork
- Getblockshare
Proposed for standardization with a BIP (Bitcoin Improvement Proposal)
Increasingly important; some hardware support

51% Mining Pools

As of early 2015, the vast majority of all miners are mining through pools with very few miners mining “solo” anymore.
In June 2014, GHash.io, the largest mining pool, got so big that it actually had over 50% of the entire capacity over the Bitcoin network.
Essentially GHash offered such a good deal to participating miners that the majority wanted to join.
This is something that people had feared for a long time and this led to a backlash against GHash.
By August 2014, GHash’s market share had gone down by design as they stopped accepting new participants.
Still, two mining pools controlled about half of the power in the network
It is worth noting that mining pools might be hiding actual concentration of mining power in the hands of a few large mining organizations which can participate in multiple mining pools simultaneously to hide their true size. This practice is called laundering hashes.
It remains unknown how concentrated physical control of mining hardware actually is and mining pools make this quite difficult to determine from the outside.

Are Mining Pools a Good Thing?

Pros
- Make mining more predictable
- Allow small miners to participate
- More miners using updated validation software
Cons
- Lead to centralization (It's an open question how much power the operators of a large mining pool actually have.)
- Discourage miners from running full nodes
Can we prevent pools?

Mining Incentives and Strategies

Game-Theoretic Analysis of Mining

Several strategic decisions
- Which transactions to include in a block
  - Default: any above minimum transaction fee
- Which block to mine on top of
  - Default: longest valid chain
- How to choose between colliding blocks
  - Default: first block heard
- When to announce new blocks
  - Default: immediately after finding them

Game-Theoretic Analysis of Mining - α

Assume you control 0 < α < 1 of mining power
Can you profit from a non-default strategy?
For some α, YES, though analysis is ongoing!

Forking Attacks

Certainly possible if α >0.5
may be possible with less
avoid block collisions
Attack is detectable
Might be reversed
Might crash exchange rate

Forking Attacks via Bribery

Idea: building α > 0.5 is expensive. Why not rent it instead?
Payment techniques:
- Out-of-band bribery
- Run a mining pool at a loss
- Insert large “tips” in the blockchain
Will miners accept bribes?
- It is possible → Tragedy of Commons
- This is an open problem!

Block-Withholding Attacks

Strategy: don’t announce blocks right away. Try to get ahead!

Block-Withholding Attacks - Race

What happens if a block is announced when you’re ahead by 1?
The race is on!
Improved strategy for any α if you can win every race
* Ideal network position
* Bribery?
With a 50% chance of winning races, improved strategy for α > 0.25
Not yet observed in practice!
Surprising departure from previous assumptions

Punitive Forking

Suppose you want to blacklist transactions from address X
Freeze an individual’s money forever
Extreme strategy: announce that you will refuse to mine on any chain with a transaction from X
With α < 0.5, you’ll soon fall behind the network

Feather-Forking Strategy

To blacklist transactions from X, announce that you will refuse to mine directly on any block with a transaction from X
But you’ll concede after n confirming blocks
Chance of pruning an offending block is α^2

Response to Feather Forking

For other miners, including a transaction from X induces an α^2 chance of losing a block
Might be safer to join in on the blacklist
Can enforce a blacklist with α < 0.5!
Success depends on convincing other miners you’ll fork

Feather-Forking: What is it Good For?

Freezing individual bitcoin owners
- ransom/extortion
- law enforcement?
Enforcing a minimum transaction fee…

A Second Look at Transaction Fees

Priority = sum(inputvalue * inputage)/sizeinbytes
Default policy: priority > 0.576
Accept without fees if: ?

Transaction Fees

Currently, block rewards are > 99% of miner revenue.
Eventually, transaction fees will dominate

Will Miners Cooperate to Enforce Fees?

Summary

Miners are free to implement any strategy
Very little non-default behavior in the wild
No complete game-theoretic model exists
Things might be about to get interesting…

In the Next Lecture…

How much anonymity does Bitcoin provide?