<p>Generally, the higher the variance for the miners of a reward method, the higher the cost of sabotage attacks (and I think also the potential profit of lie-in-wait).</p>

<p>In PPS there is no variance; and the cost for sabotage is negligible, it is merely the reward of 1 share.</p>

<p>In a typical method with no risk absorption and moderate variance, withholding a block means you lose your portion of its reward, which is h/H, your portion of the pool hashrate.</p>

<p>If you take an extremely high-variance reward method such as "pay per last 10 shares", withholding blocks means losing 10% of the reward, since if you submit a block then by definition you have a share in the last 10 shares, no matter your hashrate.</p>

<p>And of course, when solo mining, block withholding means losing all of your mining reward.</p>

<p>A block finder bonus is added multiplicatively to the other costs. For example in PPL10S with 20% finder bonus, when withholding you lose both the 20% bonus and 10% of the distributed 80%, for a total cost of 28%. However, finder bonus is a poor way to combat block withholding because it creates a lot of variance.</p>

CC BY-SA 3.0
2012-10-03T20:43:53.487Z
I think that specifically the distribution of risk between miner and operator doesn't play a big role, but I'll need to think about this.
Meni Rosenfeld
CC BY-SA 3.0
2012-10-03T20:41:37.820Z
2012-10-03T20:49:41.253Z
2012-10-03T20:49:41.253Z
Meni Rosenfeld
<p>I'm wondering how each payout method (PPS, DGM, PPLNS, Proportional, etc) influences the cost of executing a block withholding attack.</p>

<p>Does it matter how the payout method places variance between pool and miners? With DGM this is a setting that can be adjusted by the pool operator. With other payout methods it is inherent to the system.</p>

<p>Does a block finder's bonus influence the cost of an attack? By that I mean part of the block income being reserved for the miner who created it, before the rest is distributed according to the pool's chosen payout method.</p>

<p>Are other factors important?</p>

<p>Which systems would be expensive to attack, and which would be cheapest?</p>

CC BY-SA 3.0
2012-10-03T10:05:43.573Z
Do you mean "block SOLUTION withholding attack"?
ThePiachu
CC BY-SA 3.0
2012-10-03T18:10:06.027Z
Yes, that's what I mean. Since every bit in a block is part of what makes it valid I don't see a big difference between a block and its solution.
Dr.Haribo
CC BY-SA 3.0
2012-10-03T18:23:35.533Z
@Dr.Haribo As you asked here - http://bitcoin.stackexchange.com/q/4943/323 - there is a difference between withholding a block and withholding a block solution. Generally the latter is relevant to miners in a pool, whereas the former - to the whole network.
ThePiachu
CC BY-SA 3.0
2012-10-03T18:27:10.817Z
@ThePiachu - good point, I'm talking about the scenario when mining in a pool.
Dr.Haribo
CC BY-SA 3.0
2012-10-03T18:28:11.970Z
@StephenGornick, P2Pool and Eligius are also vulnerable.
Dr.Haribo
CC BY-SA 3.0
2012-10-03T20:07:23.420Z
Related: http://bitcoin.stackexchange.com/q/1338/516
Highly Irregular
<security><mining-pools><attack><pool-payout-methods><block-withholding>
How do mining pool payout methods affect the cost of executing a block withholding attack?
Dr.Haribo
# How do mining pool payout methods affect the cost of executing a block withholding attack?

(Asked by: username_0 on 2012-10-03)

I'm wondering how each payout method (PPS, DGM, PPLNS, Proportional, etc) influences the cost of executing a block withholding attack.

Does it matter how the payout method places variance between pool and miners? With DGM this is a setting that can be adjusted by the pool operator. With other payout methods it is inherent to the system.

Does a block finder's bonus influence the cost of an attack? By that I mean part of the block income being reserved for the miner who created it, before the rest is distributed according to the pool's chosen payout method.

Are other factors important?

Which systems would be expensive to attack, and which would be cheapest?

**Tags:** security, mining-pools, attack, pool-payout-methods, block-withholding

> **Comments:**
> **username_1**: Do you mean "block SOLUTION withholding attack"?  
> **username_0**: Yes, that's what I mean. Since every bit in a block is part of what makes it valid I don't see a big difference between a block and its solution.  
> **username_1**: @username_0 As you asked here - http://bitcoin.stackexchange.com/q/4943/323 - there is a difference between withholding a block and withholding a block solution. Generally the latter is relevant to miners in a pool, whereas the former - to the whole network.  
> **username_0**: @username_1 - good point, I'm talking about the scenario when mining in a pool.  
> **username_0**: @StephenGornick, P2Pool and Eligius are also vulnerable.  
> **username_2**: Related: http://bitcoin.stackexchange.com/q/1338/516  

---

## 1 answers

### Answer by username_3 on 2012-10-03. Score: 4 | Accepted answer

Generally, the higher the variance for the miners of a reward method, the higher the cost of sabotage attacks (and I think also the potential profit of lie-in-wait).

In PPS there is no variance; and the cost for sabotage is negligible, it is merely the reward of 1 share.

In a typical method with no risk absorption and moderate variance, withholding a block means you lose your portion of its reward, which is h/H, your portion of the pool hashrate.

If you take an extremely high-variance reward method such as "pay per last 10 shares", withholding blocks means losing 10% of the reward, since if you submit a block then by definition you have a share in the last 10 shares, no matter your hashrate.

And of course, when solo mining, block withholding means losing all of your mining reward.

A block finder bonus is added multiplicatively to the other costs. For example in PPL10S with 20% finder bonus, when withholding you lose both the 20% bonus and 10% of the distributed 80%, for a total cost of 28%. However, finder bonus is a poor way to combat block withholding because it creates a lot of variance.

> **Comments:**
> **username_3**: I think that specifically the distribution of risk between miner and operator doesn't play a big role, but I'll need to think about this.  

---

