Creating a decentralised payment network:

A study of Bitcoin
1
Jonathan Levin
2
Department of Economics,
University of Oxford,
Oxford, OX1 3UQ, UK.
May 14, 2014
Abstract
Bitcoin provides the rst case study of a decentralised payment network. With
no central authority, participants have to agree upon a set of rules in order to process
transactions. Delays in the transmission of information between participants create
network partitions, where some participants have dierent information sets. This
paper presents an empirical study of this phenomenon and a model of incentives
facing network participants as a result.
1
This thesis is submitted in partial fullment of the requirements for the degree of Master of Philos-
ophy in Economics. Word Count: 19 095
2
I thank my supervisors Alexandre de Corniere and Mark Armstrong, for many helpful discussions.
I am grateful to the Coinometrics team, in particular, Nadi Sarrar and the Organ of Corti, who helped
collect data and provided a great sounding board throughout this assignment. I also thank many
members of the Bitcoin community for responding to elementary questions. Any errors are my own.
1 Introduction
Bitcoin provides a case study of a new type of payment system. All existing payment
systems have centralised validators that are trusted to process transactions and guard
against fraud and double spending. In order to obtain the ultimate goal of having
a decentralised payment system with no single point of failure, Bitcoin has to solve
these security threats in more averse conditions than in traditional payment systems.
There are no mechanisms to maintain trust between validators on the Bitcoin network
and as a decentralised system, it suers symptomatic delays in sending and receiving
information. With no centralised authority on the network, the Bitcoin protocol sets the
rules of engagement but has no way of enforcing them. Validators need to be provided
with economic incentives so that it is in their own best interest to obey the rules of the
protocol. This thesis combines empirical observations of activity on the Bitcoin network
and the rules of the protocol to derive the optimal behaviours of validators (miners)
on the Bitcoin network.
The nancial crisis has been the focus of both academic and media attention in the past
ve years. Many models of macroeconomics are being reworked to include the role of
banks as nancial intermediaries. Banks in these frameworks are simply parties that
are able to exploit synergies between the provision of liquid deposits and equally illiquid
loans (Diamond & Dybvig 1983, Kashyap et al. 2002). However, banks have always
served as providers of payment services. In this role they transfer liquid claims quickly
and cheaply, with minimal legal uncertainty (Kahn & Roberds 2009). Recent trends in
nancial innovation and deregulation have led to some of the core advantages of banks
as nancial intermediaries being eroded as new entrants and markets have replaced the
need for their services. Banks, with privileged access to wholesale payment systems, still
command great power in payment systems (Lacker 2006). However, this dominance is
also being challenged by the entry of new software as service platforms such as Pay Pal
2
and Transferwise and peer to peer markets. Bitcoin presents a new model of payment
system, where peer to peer transactions are handled on top of a decentralised architecture
with no central authority. The analysis of these new ways of transferring value sit within
the mechanism design approach of payment economics.
In retail payment systems, principal policy debates have raged over issues of competitive
eciency. Payment systems are a relatively expensive component of the nancial infras-
tructure, estimated to generate revenues of 3 per cent of GDP in the US (Humphrey
et al. 2000). The industry is highly concentrated with only a few major players in the
developed markets. In 2003, Wal-Mart settled for $3 billion in an antitrust case against
Visa and MasterCard was settled. In Australia, card fees have been the focus of regu-
latory eorts (Lowe & Macfarlane 2005). The electronic retail payment system has also
come under scrutiny due to large amounts of data theft and privacy leaks resulting in
outright fraud. In 2013, Target, a major retailer in the US, lost up to 110 million cus-
tomer records with their associated credit card details, email addresses, names and other
personal information (Harris & Perlroth 2014). Data leaks lead to further and more long
term implications with phishing ploys and other extortive methods. As other industries
have undergone technological transformation since the invention of the internet, there are
many initiatives to radically transform legacy payments systems. The creator of Bitcoin,
Satoshi Nakamoto (2008), had a decentralised vision of how the transfer of value can
be achieved. In avoiding central authorities, Bitcoin, by design, would serve to alleviate
the issues of market concentration and loss of consumer data as these responsibilities
are placed squarely with participants. In its technical design Bitcoin achieves what it
sets out for, however the challenge remains to incentivise a decentralised payment system
that does not tend to an oligopolistic structure seen in the existing payments space. This
paper looks at both the empirical reality of the Bitcoin network and creates a framework
to understand the long run incentive structures that Bitcoin has created for itself.
3
In this paper, I develop a model to study strategic incentives of bitcoin miners (the
validators), with respect to how many transactions to process. Processing more trans-
actions increases the miner revenues conditional on winning (see next section), but
reduces the probability of winning. The main contributions of this thesis are (i) to de-
rive an explicit formula for the probability of winning as a function of the number of
transactions; (ii) to estimate this probability using data which I collected, (iii) to use
this estimate in order to inform market design and security questions. In particular, I
show that transaction fees should be increased by a factor of four in order to ensure
that the market does not converge to a bad equilibrium in which no transactions are
processed by prot-maximizing miners.
2 Introduction to Bitcoin
2.1 Creating a secure global state verication process
The Bitcoin protocol is designed to create a safe way for a group of anonymous agents to
update a public ledger of all past transactions. The same way that a bank uses a ledger
to keep a record of ows of money, the Bitcoin network has a public ledger visible to
all. In traditional privacy models, trusted third parties control the maintenance of such
a ledger. In Bitcoin, making the ledger transparent allows voluntary members of the
public to be the auditors of the ledger. The technological breakthrough of Bitcoin was
to design a protocol that ensures that it is very costly to manipulate the public ledger
and as a result, participants on the network can come to consensus on the current state
of the ledger and thus the current owners of all the bitcoins in circulation.
3
Due to the public nature of the ledger, bitcoins are associated with unique identiers,
3
Bitcoin with a capital B can refer to the currency as a unit of account, the P2P network or the
protocol, whereas bitcoins are the currency units.
4
known as Bitcoin addresses, rather than the owners name or account number.
4
Owner-
ship of a Bitcoin address is proven by possession of a unique private key for a particular
address. When transacting users have to digitally sign a transaction, using their pri-
vate key, in order to reassign their coins to another user. Coins are never created or
destroyed in transactions the rights to spend them in eyes of the protocol are simply
reassigned.
Bitcoin transactions are formatted according to double entry accounting. There are
inputs to a transaction which must be previously unspent bitcoins and outputs, the
quantities and corresponding addresses to where they are now sent. A valid transactions
is dened by total inputs equaling total outputs.
5
Every participant on the network
can therefore verify transactions. Validation of transactions is done by every node on
the network. The users do not place trust in any given validator but in the collective
validation of many dierent participants, where none can unilaterally alter the rules of
the game or the record of transactions. Since no validators are trusted, Bitcoin needs a
mechanism to obtain a unanimous consensus of the state of the global ledger. As with
other consensus mechanisms, Bitcoin achieves this through a voting mechanism.
Voting on the bitcoin network is the ability to send an update of the global state of the
ledger to other participants. An update of the global state of the ledger would include a
list of transactions that have occurred transferring bitcoins between dierent addresses.
Bitcoin in this way is similar to the stone money of the island of Yap (Gillilland 1975).
On the island, ownership was primarily determined by consensus on the current state
of ownership rather than physically moving objects of value. However, unlike the island
of Yap, where there was trust between the dierent parties and an ability to settle
disputes, Bitcoin operates in a low trust environment and needs to implement a rule for
4
Without cost, users can create new Bitcoin addresses to store their coins oering cheap possibilities
of maintaining privacy.
5
In Bitcoin agents can spend fewer outputs than inputs, where this money is left for a validator to
pick up.
5
how consensus is achieved.
The network faces two main challenges when achieving unanimous consensus. First,
with no centralised arbitrator, Bitcoin needs a method of creating consensus among
pseudo-anonymous participants. Collecting individual votes and applying a majority
voting rule is not feasible as there are no barriers to participation and an attacker may
claim multiple fraudulent identities. In the computer science literature, this is commonly
known as a Sybil attack (Douceur 2002). Second, information cannot be guaranteed to
arrive at the same time and some messages may fail to reach their destination. In a
decentralised network where every node is not connected to every other node, there are
inevitably delays in how information spreads around the network. Each node only has
local knowledge of his neighbours and no view of the global state of the network. The
second challenge is a very well studied problem in the computer science literature known
as the Byzantine Generals problem (Lamport et al. 1982).
In order to minimise the risk of a Sybil attack, Bitcoin introduces a costly voting mecha-
nism to deter malicious attackers. This costly voting mechanism is the a requirement to
solve a computational puzzle and thereby supply a proof of work. In Bitcoin, the criteria
for the solution to the computational puzzle is the form of random outputs generated
from a one way hash function. A one-way hash function cannot be inverted, and pro-
vides a method of mapping known inputs to random outputs. Since the hash function
is a one way function, there is no more ecient way of solving the problem than brute
force check and guess.
6
Every attempt at the puzzle has an independent probability of
being the valid solution to the puzzle. Once found, the solution is publicly veriable by
6
A hash function takes an arbitrary block of data and returns a xed size bit-string which is a specied
number of characters long. Any change in the input data provided to the hash function will change the
resulting bit string. The hash of random data is essentially a random number. If the highest possible
value that it can take on is Y, then the probability that a random hash has a value less than X is just
X
Y
.
Bitcoin borrowed its computational puzzle and proof of work from an earlier invention called Hashcash
(Back 2002). The proof-of-work involves scanning for a value that when hashed with an algorithm such
as SHA-256, used in Bitcoin, the hash begins with a number of zero bits. The average work required is
exponential in the number of zero bits required and can be veried by executing a single hash.
6
a simple computation. Similar approaches have been used in other initially anonymous
environments (Aspnes et al. 2005).
The costly voting system also is designed to lengthen the time between states of the global
ledger. The computational diculty of the problem is adjusted so that the state of the
ledger is only updated on average every 10 minutes. The state of the ledger is updated
by transactions being added to the history of all previous transactions. Taken as a full
serialised history, the network achieves consensus on the current state of ownership of
all the bitcoins in circulation. Since the state of the network is only updated on average
every 10 minutes, individual transactions are put into batches which are processed by
validators. These batches are known as blocks. Validators, usually referred to as miners,
receive transactions, verify the digital signatures and attempt to alter the state of the
network by adding these transactions to the existing history. Miners alter the state of
the global ledger by publishing a block to the network which requires a proof of work.
The publication of a new block is often referred to as nding a block due to the check
and guess methodology of the proof of work.
New blocks are added to all previous blocks forming a linear chain of blocks (gure 1).
Each history is linked to the previous to create a fully serialised log of transactions. If it
were possible to trust an authority on the network to timestamp transactions when they
occurred, there would be no need to have this system of sequential histories. Imagine
a scenario in which Alice is making a transaction with Bob for a coee: could we trust
Alice to report the truthful time of that transaction? Alice could simply lie and say that
she spent the coins used to pay Bob yesterday and Bob would be out of pocket. The
logic follows that if we did not rely on Alice but rather on some timestamp authority, it
would fall prey to manipulation. Indeed removing the reliance on a central timestamp
authority could be seen as one of Bitcoins attributes. Removing the a single point of
failure, Bitcoin does not place trust in a timestamp facility, it creates a serialised list of
7
transactions through an order of blocks. The creation of each new block requires using
information from a specic previous block, usually referred to as a parent in the chain,
in order to achieve this goal.
A
0
Genesis Block
A
1
A
2
A
3 Main Chain
B
2
Orphaned Block
Figure 1: The Blockchain
The linear chain of histories is dened by the current length of the chain, referred to as
the blockchain height. When a block is added, the blockchain height increases by one.
Nodes always consider the longest chain to be the correct one and will work on extending
it. gure 1 shows what happens if there are two conicting blocks published with the
same parent. Block A
1
, with parent A
0
, has two children A
2
and B
2
. This event is
known as a collision as only one block can eventually be included on the main chain.
As we will see collisions can only occur when two miners nd blocks in quick succession.
Some nodes in the network will hear about block A
2
rst and some will hear about block
B
2
. This creates a partition in the network as some miners will be looking for block
A
3
using A
2
as a parent and some will be using B
2
as the parent to nd B
3
. During
this time there is no consensus on which chain is the correct chain. The correct chain
is decided when one of the two branches publishes a block. Once a new block has been
found by the network, in gure 1 it is A
3
, the nodes that we working on nding B
3
will
now switch to mining on top of A
3
since it is now the longest chain. The rate at which
new blocks are found is determined by the amount of computing power attempting the
cryptographic puzzle. So if there is more computing power on branch A then it is more
likely that A
3
will be found before B
3
. The longest chain is often referred to as the main
8
chain.
The rule of the longest chain being considered as the correct history serves as the pro-
vision of security on the network. Once a block has been added to the longest chain,
it cannot be removed or altered without re-doing the proof of work. To see why this
is the case, consider a miner that publishes block A
2
and then tries to rewrite history.
In order to do so, they would have to nd another valid solution to the computational
problem and then supply it to other miners. If the miner managed to nd a Block B
2
after they published A
2
they would need to nd B
3
faster than the rest of the network
nds A
3
. As long as at least 50% of the miners are working on the A branch it will
grow at a faster rate than the B branch and the network will treat the A branch as the
main chain. Through this method, Bitcoin is based on a novel solution to the Byzantine
generals problem, requiring that an adversary needs to capture more than 50% of the
computing power to disrupt the protocol (For a formal proof see Miller & LaViola Jr
(2014), For numerical simulations see Rosenfeld (2012)). An attack where an adversary
captures more than half the network is known as a 51% attack.
The more computing power being contributed to the network, the more expensive it
would be to pull o a 51% attack. In this dimension, the security of the ledger is deter-
mined by the aggregate level of computing power on the network. Providing computer
power to the network is costly, and therefore economic incentives are provided in the
form of a lottery of freshly minted bitcoins. This has ensured that the amount of com-
puting power has grown at a substantial rate making it expensive to acquire a majority
share of computing power on the network.
9
0
5,000,000
10,000,000
15,000,000
20,000,000
25,000,000
2009 2019 2029 2039
N
u
m
b
e
r

o
f

b
i
t
c
o
i
n
s

Year
Figure 2: Distribution of bitcoins over time
2.2 Evolution of incentives
Although the process of validation is completely automated, the cost of solving the
cryptographic puzzle is substantial.
7
Miners are incentivised by the issuance of new
bitcoins and transaction fees. The rst Bitcoin block, known as the genesis block, was
mined on 3
rd
January 2009. Each block for the rst 210,000 blocks generated 50 new
bitcoins in a transfer to the miner that found the block. The generation of new bitcoins
halves every 210,000 blocks which is approximately every four years. After 34 reductions
in the reward the number of bitcoins converges to 21 million and no new Bitcoins will
be created (gure 2).
The bootstrapping phase of Bitcoin is dened by the importance of the block reward and
the distribution of the currency between participants. Initially, the Bitcoin network could
not generate enough proof of work to secure the network with transaction fees as there
7
The cost of solving the cryptographic puzzle changes over time as more computing power is being
contributed to the network. The diculty of the problem dynamically adjusts so that a block is found
by the entire network every 10 minutes. Every two weeks the network assesses how many blocks the
network has produced in the last two weeks and sets the diculty level to ensure that approximately
one block will be solved every ten minutes. If the cost of solving the cryptographic puzzle were trivial
then it would not serve its purpose at making it expensive to take over the network
10
were very few transactions.
8
The protocol also used proof of work in order to distribute
the coins with no centralised authority, as it creates a lottery for newly created coins in
the form of block rewards. The users therefore do not directly contribute to the costs
of running the network but pay for it through ination. As the block rewards decrease,
the users are required to pay to compensate the miners for their investment, electricity
and maintenance costs. In this way Bitcoin will have to move from a model where
security is paid for through the issuance of more bitcoins, independent of the number of
transactions, to a system where transactions have to cover the cost of security.
9
The bootstrapping phase was successful in meeting this goal with thousands of partic-
ipants worldwide and creating the largest distributed computing network in existence.
The pace of hardware innovation has also been rapid with Application Specic Integrated
Circuit-boards coming to the market in 2013 (Taylor 2013). These machines are only
capable of doing the necessary calculations to nd a valid solution to the cryptographic
puzzle set by the Bitcoin network and are optimised to do so. As the ecosystem expands
and more peoples money is at stake, it is important that the incentives keeping miners
honest and the security of the network intact are well understood.
There has been some literature covering the incentives of protecting Bitcoin against
adversaries. In particular, Meni Rosenfeld (2012) studied the probabilities that an ad-
versary would manage to overtake the main chain with less than 51% of the computing
power. If an adversary were able to overtake the main chain, this would give them an
ability to double spend coins at a merchant as they can eectively re-write their own
spending history. Kroll et al. (2013) look at the incentives of a 51% attack on the net-
work from an outside perspective, where an adversary may be looking to prot outside
8
At the beginning of the network in 2009, most of the blocks had zero transactions in them but miners
were still rewarded 50 bitcoins for every block they found. In total over the network history there have
been 84469 blocks with no transactions (Blockr 2014).
9
For a model looking at the viability of an equilibrium where transaction fees cover the cost of running
the network see (Houy 2014b).
11
of the Bitcoin network by destroying it rather than by double spending inside it.
The analysis that follows is predicated on the empirical data of information propagation
in the Bitcoin network. As outlined above, one of the distinguishing features of the
Bitcoin network is its decentralised design. Geographic dispersion and network latency
are symptomatic of such a network. This combined with the requirement for each node
to validate every transaction forms the economic incentives which are the focus of this
study.
2.3 Information Propagation
Bitcoin is a peer to peer (P2P) protocol where volunteers collectively implement a set
of procedures and rules achieve unanimous consensus on the state of ownership of all
existing bitcoins. The protocol is implemented in a network where every full node is
homogenous.
10
Each full node independently veries the validity of all the transactions,
as a result of maintaining the assumption of minimal trust between nodes. Nodes spread
information on transactions and blocks in order to update the network consensus. There
are two main types of messages that are relayed in the network: transaction and block
messages. In order to avoid sending transaction and block messages to nodes that have
already received them from other nodes, they are not forwarded directly. A smaller inv
message is broadcast when a transaction or block has been validated. This message is
an invitation to other nodes announcing the presence of new information. It contains
unique identiers of transactions and blocks rather than all the information contained
in the block or transactions. If the node receiving an inv message does not have the
transaction or block in question, then it replies with a getdata message to the sender
of the inv message. The sender then sends the information pertaining to the block or
10
There are now dierent types of lightweight nodes on the Bitcoin network with Simple Payment
Verication (SPV) clients but these are ignored in the analysis, since these follow heuristics and are not
validators of transactions by default.
12
transaction to the peer that requested that information. The reason this occurs is to
reduce the data load on the network.
11
The method used to spread information on the
Bitcoin network resembles a push model of rumour spreading.
12
A node broadcasts transactions by sending inv messages to nodes they are directly
connected to. Nodes that receive information about the transactions, ensure that they
obey the protocol and then relay them to their peers. When information is transmitted
between nodes there is a propagation delay. This is comprised mainly of the time that it
takes to verify that a transaction is valid, but also the time to establish what data needs
to be transferred and the delivery of the data. Given a xed number of participants and
a random network structure, eventually the whole network will become aware of that
transaction occurring.
13
When a new node joins the network, it queries some DNS servers that keep track of the
active nodes on the network.
14
The DNS servers feed back a random list of nodes that the
entering node can link to and receive an update on the state of the network. The result is
that the Bitcoin network is a random graph Decker & Wattenhofer (2013). There is also
no formal way of leaving the network. The addresses of the nodes that were connected to
the network are stored by their neighbours until 90 minutes of inactivity has passed and
subsequently other nodes purge them from the address set. Although there are dierent
ways of connecting to the network, from the empirical analysis, custom implementations
are rare and most nodes run the software supplied by the core development team. The
random graph forms the basis for our assumptions of homogeneity in the model.
11
More detail on the way information is transmitted can be found in Decker & Wattenhofer (2013).
12
There is also an ability for nodes to send information requests without receiving inv messages rst
but this is uncommon.
13
There are proven results to show that random rumour spreading will reach the whole network within
a given amount of time with a probability arbitrarily close to 1. See Nekovee et al. (2007).
14
New nodes join and leave the network constantly as people connect and disconnect to the network.
13
2.4 Discarded information
Network latency causes information to be discarded. Bitcoin nodes do not have a full
view of the current state of information in the network. This is captured by a single state
variable, i.e. the height of the blockchain, h which takes on integer values starting at
number one, usually referred to as the genesis block. When a block is added to the chain,
the blockchain height increases by one. When miner i solves a block, A
1
, the information
about the latest block in the chain is dierent for miner i over any other miner creating
a partition. Partitions on the network are dened as sets of nodes that possess dierent
beliefs about the current state of the network. The miners that nd out A
1
will join
miner is partition of the network. All the other nodes who have not heard about A
1
are
now described as being in the uniformed partition, u. This partition attempts to nd
a block using A
1
as the parent, whereas the partition that thinks that the blockchain
height is still h is trying to create a block B
1
. If the miners in is partition hear about
the creation of a conicting block by uninformed partition, they will automatically reject
it as they already have information about block A
1
and they will not relay block B
1
to
their neighbours.
Conicting blocks cannot coexist in the chain of blocks as only one block at each height
is allowed to join the main chain. Since there is no trusted central player, the choice
between A
1
and B
1
is decided on which partition of the network nds the next block.
If A
2
is the next block to be found on the network then information about its existence
starts to spread. When miners in the uninformed partition nd out about A
2
they
immediately stop working on a conicting problem since the blockchain height has now
increased. This decreases the probability that a block that builds on B
1
will ever be
found since fewer miners are working on that problem. The race is therefore decided
probabilistically. Due to the proof of work required to publish blocks to the network
the probability of a perpetual race quickly falls to 0. This is always the case so long
14
as information propagation for a block is shorter than the expected time of 10 minutes
between blocks.
15
Work done on blocks that are not included in the main chain are not rewarded since
any transactions in that block do not exist in the accepted serialised history of all
transactions. When a valid block loses the race to another valid block, the block that is
discarded is called an orphan block.
3 Empirical section
3.1 The Method
Following a similar methodology employed by Decker & Wattenhofer (2013), I obtained
more recent information propagation data which informed the formal modelling. Bitcoin
as a decentralised network, has no central repository of data. In order to gather infor-
mation about propagation times, one has to run a client that connects to the network.
When connecting to the network, this client should connect to the highest proportion
of the network as possible in order to capture information that extends beyond a local
geography. The default setting for the software client is to connect to 8 nodes. A custom
implementation of the client must be run in order to connect to a large portion of the
network. Nadi Sarrar, a post-doctoral fellow at TU Berlin, built a custom version of the
Satoshi Client to achieve this goal. During the observation, period we were able to con-
15
Miller & LaViola Jr (2014) prove that in the face of an adversary Bitcoin comes to unanimous
consensus as long as at least 50% of the computing power is on the honest chain provides a proof
under much more stringent conditions. In the adversarial case, the partition of the miners is xed. The
adversary will never switch onto mining on the main chain, since its objective is to overtake its length. In
the case of a fork due to a collision of A
1
and A
2
, miners, in the event that a new block, A
2
is published,
switch to taking it as the valid chain. This is due to the rule that the longest chain is the correct chain.
Hence the probability of a fork that is behind the main chain overtaking the main chain continuously
falls. The partition with the greater share of computing power nds more blocks, extending their lead
resulting in more miners from uninformed partition to join the main chain until unanimous consensus is
achieved.
15
nect to over 90% of the nodes that were active on the network.
16
There were on average
7000 nodes connected to the custom client and a total of 9,160 unique peers.
Once connected to the network, the client collects invitations from its neighbours to hear
about new blocks or transactions. Our implementation takes a y on the wall approach.
The custom client does not respond with the usual request to then get the data and
does not relay any invitations to other nodes as it does not actually process blocks or
transactions. The client is implemented as a passive observer to minimise the impact
that the measurement node has on the performance of the network. This also has the
added benet of not storing any history of transactions and increases the performance
of the client. Another consideration when implementing a custom client is complying
with the network rules that can result in getting blacklisted by other nodes. Examples
include: Sending an invalid transaction to a peer, sending transactions with duplicate
inputs, sending a transaction with null output, sending a lterload request of more
than 36000 bytes or 50 functions, or requesting to download more than 5000 blocks.
Most of these behaviours are avoided when not relaying data.
The client keeps a record of all the inv messages from its neighbours. It timestamps
all of these with a local timestamp to ensure consistency.
17
The client keeps the hash
of the transaction or block as its unique identier. This allows us to plot the spread
of information of a particular block or transaction (gure 11). The client also captures
the height of the blockchain and the size of each block to detect any collisions on the
network and to compare propagation times across block sizes.
The amount of data collected per block or transaction is very high since for every given
16
This used a combination of getaddr messages asking neighbours for the addresses of the nodes
they are connected to and simply accepting incoming connection requests.
17
There are timestamps embedded in the blocks on the Bitcoin network but these cannot be trusted
as they can be very inaccurate. Some blocks published have dates set in the future. This could be the
result of strategic behaviour as miners would ideally not like to change the timestamps in their blocks
prior to publishing and there is a set criteria that blocks that are more than 2 hours in the past will be
rejected by the network.
16
transaction the client has approximately 7000 observations, one invitation for each of
the connected nodes. The data requirements and storage limited the scope for a large
observation period. The modied client was tested 19th April 2014 and full observation
period chosen was 9 hours on May 5th 2014.
The data from the modied client was annotated with two other datasets. Using Max-
Minds GeoLite City database for IP geolocation, each node and the inv messages re-
ceived from that node were encoded with the country of origin. Poese et al. (2011)
found that country level data in the dataset is accurate. Using Organ of Cortis (2014)
database, The Block-Spotters guide, blocks were identied by the mining pool which
found them. Mining pools are groups of bitcoin miners who share revenues between them
to smooth out their returns. Many of the pools sign the rst transaction in a block that
they nd to credibly announce that they have found a block. Miners can then calculate
their expected revenues and audit the pool operators.
3.2 The Data
During the observation period 49 blocks were propagated on the Bitcoin network. There
was a wide range of the number of transactions included in each block. The smallest
size block that was propagated contained 20 transactions, the largest, 871 transactions.
The average time to reach 50% of the network was 5.4 seconds and it took on average
24 seconds to reach 95% of nodes. There were signicant outliers and anomalies in
the raw data. Some of the invitations received from nodes were for blocks that were
in the distant past which were removed from the data. As a result of nodes joining
and leaving the network over the observation period, propagation times to the last 1%
of nodes displayed highly non-linear trends and were therefore removed from the data.
Furthermore the data displayed a bi-modal structure with many inv requests coming
in the tail of the distribution. Nodes which had more than one inv message over 200
17
Table 1: Summary Statistics of Block Propogation
No. of
Txs
Mean Size
(Kb)
Mean
Latency Sd 25% 50% 75% 90% 95%
Average 368 229.66 11.61 8.61 4.15 5.44 8.20 14.74 24.33
Min 20 7.48 2.18 0.97 1.20 1.49 1.92 2.87 4.12
Max 871 499.24 25.25 30.70 14.39 16.94 23.79 51.60 122.01
Note: Mean Latency and the other summary statistics are measured in seconds
seconds since the rst propagation were removed from the dataset. This removed the
bimodal structure and left a smoother distribution structure. The propagation of the
49 blocks is charted in gure 11. This gure shows the amount of transactions included
varied between pools but all demonstrate a similar trend of blocks with larger numbers
of transactions propagate slower through the network.
Using a linear model we obtain similar results to Decker & Wattenhofer (2013) who
showed that there is a strong correlation between block size and propagation time. For
any given percentile there is a stable linear relationship between propagation times and
block size as evidence in table 2.
Table 2: Linear models of seconds to reach percentiles of the
network and block size (kb)
P10 P25 P50 P75 P95
Size 0.011*** 0.013*** 0.017*** 0.029*** 0.141***
(0.001) (0.001) (0.001) (0.002) (0.014)
Cons 0.944** 0.034*** 1.567*** 1.663*** -4.557
(0.372) (0.05) (0.04) (0.447) (3.754)
N 49 49 49 49 49
R
2
0.55 0.64 0.74 0.86 0.67
Standard errors in parentheses,
***
p < 0.01,
**
p < 0.05,
*
p < 0.1
18
These stable linear relationships can be used to derive a distribution for the spread
of information on the Bitcoin network. Using distribution tting packages in R a log-
normal distribution is the best in the class of distributions. Other classes of distributions
considered included: Pareto, Gamma, Weibull and Exponential distributions. The pa-
rameterisation of the model is therefore specic to the observed period. If the network
topology changes or another distribution is found to provide a better t this could be
used in its place. gure 3 shows the regression lines estimated in the linear model vs the
parameterised lognormal distribution.
G G
G
G
G
G
G
G
G
G
G
G G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
GG G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
GG
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G G
G
G
G
G
G
G
G
G
G
G
GG
G
G
G
G
G
G
G
G
G
G
G
G
G
G
5
10
15
20
0 250 500 750
Number of transactions in block
L
a
t
e
n
c
y
,

s
e
c
o
n
d
s
Percentage of network informed G G G 25% 50% 75%
Empirical Lognormal model
Fitted log normal model, linear scale
Figure 3: Log Normal t against linear regression and empirical data
19
3.3 Baseline Case
Bitcoin, still in its bootstrapping phase, has an articially imposed limit on the size
of each block that is published on the Bitcoin network. This eectively also limits the
number of transactions that can be processed a second. To run a full Bitcoin node and
verify transactions, each node has to keep a history of all previous transactions to verify
that any new transaction has inputs that have not already been spent. The limit of a
one megabyte block was imposed to prevent the history of all bitcoin transactions from
becoming too big, too quickly. There has been much discussion on whether to lift the
articial limit to allow for more transactions (Bitcointalk 2014).
The current limit of 1 MB is equivalent to allowing 7 transactions a second at an average
size. In the context of world payment systems this is very small. Visa and Mastercard do
approximately 10,000 transactions per second. If Bitcoin is going to full its role as the
payment rails for many small transactions then it has to be tested in larger environments.
The baseline case in the model, will allow miners to include up to 10,000 transactions
in each block or approximately 16 transactions per second. While this is still far from
other mainstream networks, this would be represent a ten fold increase in the number
of Bitcoin transactions currently occurring on the network (Coinometrics 2014).
4 A model of miners incentives arising from network
latency
Miners including more transactions in their blocks raise revenues but also lower the
probability of winning. This section will study the conditions under which there is
a bad Nash equilibrium where no miner includes any transactions in their blocks. For
the bad equilibrium to occur miner i should have no incentive to include transactions
20
given that all other miners include 0 transactions. The incentive to include transactions
is determined by the tradeo between the probability of winning and the transaction fee
revenue. We will call this equilibrium strategy nonce only mining.
18
The transaction fee revenue is xed and therefore the main challenge is to compute the
probability of winning under the conditions where all other miners include no transac-
tions. In order for Bitcoin to function as an incentive compatible payment system, we
require that miners process at least some transactions. Informed by the empirical sec-
tion, the model shows the conditions under which the bad equilibrium of miners having
no incentive to include transactions is avoided.
4.1 Literature Review
Latency introduces a new domain of strategic interaction amongst miners. Including
more transactions in a block means increasing its size and therefore the time that it
takes to propagate.
19
Motivated by the eect of information propagation, Nicolas Houy
(2014a) and Gavin Andresen (2013) estimate the marginal cost of including a transaction
into a block. Andresens estimate is a back of the envelope calculation. He uses the
average time for a block to reach 50% of the network from Decker & Wattenhofer (2013)
times the probability that the network nds a block in a given second, multiplied by
the forgone block reward. Houy (2014a), uses a similar game theoretic approach to
Lee & Wilde (1980) on innovation races. Under current conditions, Houy nds an
equilibrium in which all miners include no transactions in their blocks. Both studies,
while motivated by information propagation do not provide convincing accounts of how
it actually manifests on the Bitcoin network.
18
Nonce only refers to just searching for a valid nonce which is the solution to the cryptographic puzzle
rather than including more transactions.
19
Bitcoin allows for dierent types of transactions which have dierent sizes but in this model we will
assume that all transactions have the same size.
21
In Houys model all miners are mining on competing blocks and all start at time 0.
Miners chose the number of transactions included in their block. The rst miner to
announce their block is not necessarily the winner as it can propagate slowly due to the
number of transactions contained within it and can thus be beaten by a smaller block
to the majority of the network. Houy makes an assumption that runs in contradiction
to the rules of the Bitcoin protocol. Bitcoin stipulates that as a miner you should mine
on the longest chain. Houy assumes that all miners continue to compete with miner i
even though they might have heard about is block. In Andresens back of the envelope
calculation the same assumption is employed (Andresen 2013).
A simple example will be illustrative. If miner i nds a block, A
1
and tells miners 1,2
and 3 at time t, they immediately stop mining a competing block. The uninformed
miners, 4,5 and 6 will continue mining a competing block, B
1
while miners 1,2 and 3
move on to nding A
2
which uses A
1
as a parent. When miners 4 and 5 hear about
the block at time t + dt, they then stop mining at that point, so only miner 6 remains
mining a competing block. Hence the share of competing mining power is changing
over time. This means that both Houys approach and Andresens back of the envelope
calculation both ignore the dynamics of information propagation that lies at the core
of the problem. The analysis that follows will demonstrate that this in fact drives the
equilibrium conditions.
4.1.1 Some preliminaries
Blocks are found by the network according to a poisson process. Every guess at the
cryptographic puzzle could produce an valid solution as required by the protocol. Each
guess has equal probability of being a valid solution and there is no learning taking place
in nding the solution. Hence each guess is i.i.d. and hence the sequence of i.i.d. guesses
is the denition of a poisson process. Assuming there is consensus on the network on
22
what is the current height of the blockchain h. The random variable Y = X
h+1
X
h
,
the time dierence in seconds between a block being found and its predecessor being
found, is i.i.d, which yields the following probability:
P
_
Y < t + 1|Y t

=
1
600
(1)
We will denote the rate at which the network nds a block as . Given that the whole
network agrees on the current height of the blockchain, the expected time between blocks
is given by E
_
Y

=
1

.
In the analysis that follows we need to be able to split the poisson process as there will
be partitions in the network. If N miners are contributing to the network and each has a
share of the computing power
j
, where

jN

j
= 1 . We can think of miners nding
blocks as splitting the network poisson process into subprocesses and randomly labelling
the block found to an individual miner. Since this random selection is independent of
the process, each miner will nd a block at a rate
i
. Using again the fact that every
guess at the cryptographic puzzle is i.i.d., each individual miners process is independent
and we can sum over N independent Poisson processes to give

jN

j
= .
Let G = (V, E) be the Bitcoin network graph with delay diameter D(x
i
). This means
that a block that contains x
i
transactions takes D seconds to fully propagate around
the network. Decker & Wattenhofer (2013) found that the size of a block, measured
in kilobytes, has a strong correlation with the amount of time that it takes for miners
to hear about the block. Following Decker & Wattenhofer (2013) and using their data,
Sompolinsky & Zohar (2013) nd that the relationship between the size of a block has
a linear eect on the median time that it takes to hear about a block. My estimates
using data gathered in May 2014 also conrmed these results (See section 3). For the
analysis that follows we are interested in the eect of including additional transactions
on propagation times. We use the notation D(x
i
) = +x
i
to represent the number of
23
seconds it takes a block to reach full consensus as a function of number of transactions
x
i
where the parameters and estimated using a linear regression on blocks reaching
the 95th percentile. The results from the regression (table 2) found the constant to not
be signicantly dierent from 0 and = 0.141.
20
During the time that a block is propagating around the network, miners switch from
mining competing blocks to mining on top of the block being propagated. Thus a miner
can only mine a competing block to one being propagated if they are unaware of its
existence. The model of information propagation will dene the number of miners that
are aware about miner is block at time t given the number of transactions included in
the block, x
i
. There are n nodes in the network, let t
j,1
be the time in seconds at which
node j learns about the existence of miner is block, A
1
. Let I
j,1
(t) be the indicator
function whether node j knows about block A
1
at time t.
I
j,1
(t) =
_

_
0 t
j,1
> t
1 t
j,1
t
I(t) =

jN
I
j,1
(t)
The ratio of informed nodes is given by:
(x
i
, t) = E[I(t)] n
1
(2)
The ratio of informed nodes will be a function of x
i
since this aects the rate at which
nodes become informed about the block in circulation. For a given x
i
, (x
i
, t) is a
deterministic function of time. Based on tting actual data to dierent distributions will
make a distributional assumption that (x
i
, t) ln N(, ). From the empirical section
20
The 95th percentile was chosen due to the non-linear eects found after the 95th percentile arising
from nodes connecting and disconnecting from the network. It is unlikely that these nodes are miners
since they have an incentive to minimise downtime in order to maximise their chances of nding blocks.
24
we use the following formulas for and is estimated using maximum likelihood.
= ln[Linear model for 50
th
percentile] (3)
= ln[1.57 + 0.017x
i
] (4)
= 0.944 (5)
The relationship is consistent due to the process underlying the increase in delay. The
propagation delay can be decomposed into two eects, rstly a verication process and
a transmission delay (Decker & Wattenhofer 2013). When a node receives information
about a block, it needs to validate the block. This includes checking the proof of work
is valid and verifying all the digital signatures of each transaction. The most expensive
element of the operation is checking the transaction input digital signature (Andresen
2013). However this is still a trivial computation and the time taken is almost the same
regardless of the underlying hardware. On average it takes 2ms to check a single digital
signature (Andresen 2013). The transmission delay on top of this is the same between
nodes. This is dependent on network topology and introduces heterogeneity in delay
times. However there is still a strong linear eect found in the data as the verication
process dominates the transmission delays (Decker & Wattenhofer 2013).
4.1.2 The miners
Miners are assumed to compete in monopolistic competition.
21
No individual miners
actions can have an inuence on the outcomes of the other miners. Miners only care
that the block they nd is included in the main chain. As the previous section outlined,
if a miner nds a valid block but it has been beaten to the main chain by another block
then it is orphaned and the miner loses out on the potential revenue gained. From miner
21
This assumption could be interpreted as analysing the case that Satoshi Nakamoto (2008) laid out
in the original white paper as one CPU one vote
25
i

s viewpoint this can happen in one of two ways. Miner i nds a block, A
1
rst and
another miner, unaware of A
1
nds a block, B
1
which is included on the main chain as
B
2
is found before A
2
. Alternatively, a miner could have found B
1
rst and miner i,
unaware of B
1
nds A
1
but B
2
is again found before A
2
and so B
1
is included on the
main chain. Thus, for A
1
to be included in the main chain, it must either propagate
around the network fully with no collisions with other blocks or win any race between
competing blocks. The probability that miner is block is added to the main chain is
given by P(

x ). It is a function of the number of transactions that all of the other miners
include in their blocks denoted by the vector

x = (x
i
,

x
i
) is a vector of the number
of transactions included in all the miners blocks. As we will see, P(

x ) is a decreasing
function of x
i
.
Miners constantly compete to nd blocks on the Bitcoin network. However, this model is
looking at the expected benet from nding one block. The repeated interaction between
miners is not signicant as there is no change in the probability of winning caused by
what happened in the past. The key strategic choice in the model is the number of
transactions to put included in a block. The prot function for miner i can therefore be
written as:

i
= P
i
(

x )(R +cx
i
) (6)
Where R is the block reward, c is the transaction fee and . The Block reward is an
amount of bitcoin that are newly minted bitcoins given to the miner for contributing a
block to the network. The block reward schedule is predetermined and decreases over
time according to gure 2. Importantly, the block reward is independent of the number of
transactions and hence its magnitude determines the opportunity cost of having a block
orphaned. The transaction fee is currently xed on the Bitcoin network at a minimum
of 0.0001BTC ( $0.05) but there are plans to let the fees oat in a market between
users and miners. For our model we will take this fee as given and xed. The miner will
26
only include transactions if the expected benet from doing so is positive.

i
x
i
=
P
i
(

x )
x
i
(R +cx
i
) +cP
i
(

x ) (7)
Which results in the following optimal condition.
x

i
= max
_
P
i
(

x )
| P

i
(

x ) |

R
c
, 0
_
(8)
Hence the nonce only equilibrium occurs where
P
i
(x
i
, 0, 0, ....0)
| P

i
(x
i
, 0, 0, ...0) |

R
c
0 , x
i
0 (9)
4.1.3 The probability function
The probability function represents the probability that, given a miner publishes a block,
it is included on the main chain. When a miner publishes a block, the network is divided
into two partitions. Nodes that are informed about miner is block and nodes that are
uninformed. We will use i to denominate any miner informed by miner is block A
1
and u
to denominate any miner who is in the uninformed partition. The numbers in parenthesis
indicate how many blocks have been found by the informed partition compared to any
blocks found in the uninformed partition. Since the outcome is probabilistic, all possible
cases are considered:
Case 1: No other block is found prior to full propagation of A
1
. (1:0)
Case 2: A miner in is partition nds A
2
prior to full propagation of A
1
(2:0)
Case 3: A miner in us partition nds B
1
after A
1
has been propagated (1:1)
Case 3.1: A miner is is partition nds A
2
and A
1
hence is added to the main
chain (2:1)
27
Case 3.2 A miner is us partition nds B
2
and hence B
1
is added to the main
chain (1:2)
Case 4: A miner j N nds B
1
prior to A
1
being propagated (1:1)
Case 4.1: A miner is is partition nds A
2
and A
1
hence is added to the main
chain (2:1)
Case 4.2: A miner is us partition nds B
2
and hence B
1
is added to the main
chain (1:2)
Cases 3 and 4 are not outcomes of the game since this leaves the network undecided
if A
1
is included in the main chain. Another block needs to be published in order to
arrive at unanimous consensus. The probability that miner is block, A
1
, is included
in the main chain is determined by the probability that the game ends in states 1,2,3.1
or 4.1. Under the assumption of monopolistic competition, the payos in each of the
winning cases are the same. Even though in some cases more than one block is found
by the informed partition, the probability that a small miner nds two blocks in a row
is negligible. Hence we can rewrite miner is payo function as

i
= (P
1
+P
2
+P
3.1
+P
4.1
)(R +cx
i
) (10)
Initially, we will assume that B
1
contains 0 transactions for u N to simplify the
analysis. This presents a worse case scenario as there exist strategic complementarities
in the number of transactions that miners include in their blocks. The proof can be
found in section A. Intuitively, the inclusion of more transactions by other miners
improves the position of miner i in the network since their block A
1
is competing with
slower competition. The ability of miner i to remedy the increased probability of a
block already circulating through including less transactions is limited. This is driven
by the small probability that such a case could occur and the small marginal benet
28
from including fewer transactions. Given that other miners increase the size of their
blocks, miner i has an incentive to increase the size of their blocks.
Assuming B
1
contains 0 transactions implies that we can leave Case 4 out of our analysis
since in this case miner i never nds a block to compete with B
1
since it propagates
instantaneously and hence any block found by i will use B
1
as a parent. This assumption
also pins down the probabilities in the move from Case 3 to cases 3.1 and 3.2. gure 4
0 D(x
i
)
0 D(x
i
) A
2
B
2
0 D(x
i
) B
2
A
2
Case 1
Case 2
Case 3
Figure 4: Timings of events leading to the three dierent cases
shows the timings of the events that lead to the dierent cases considered in the model.
In Case 1, no miner nds a block until A
1
has fully propagated at time D(x
i
). In Case
2, the informed partition nd A
2
before the uninformed partition nd B
2
and before A
1
has fully propagated. In Case 3, the uninformed partition nd B
2
before the informed
partition nd A
2
before A
1
has fully propagated. Case 3.1 follows from Case 3 by
weighting the probability of ending in Case 3 by the share of the network controlled by
the informed nodes at time. Case 3.2 is the same but using the uninformed share of the
network.
22
22
The assumption of instant propagation allows us to specify these probabilities. If the competing
block B
1
did not propagate instantly we would need to specify how the block propagation of both A
1
and B
1
change in each others presence. There is not yet enough data to fully understand how much
block size impacts the propagation delay of the two blocks involved in an orphan race.
29
4.1.4 Case 1
Case 1 occurs when prior to the full propagation of A
1
, no block is found by the network.
We will denote the number of transactions included in A
1
as x
i
. Let t
n
denote the time
of arrival of the rst block found by any miner on the network. Since the whole network
is working on solving a block and it nds blocks according to a poisson process with rate
, we can write down the probability that no miner has found a block at time t as:
P(t
n
> t) = e
t
(11)
Thus the probability that we end in Case 1 is simply:
P(Case 1 | x
i
) = e
D(x
i
)
(12)
Proposition 4.1 P(Case 1 | x
i
) is decreasing in x
i
at an increasing rate.
Recall D(x
i
) = +x
i
.

x
i
_
e
(+x
i
)

= e
(+x
i
)
< 0 ; > 0, > 0

x
i
_
e
(+x
i
)

=
2

2
e
(+x
i
)
> 0
Finding a block is a memoryless process as each guess at the cryptographic puzzle is
independent. As the time that the network spends on nding a block goes to innity
the probability of a block being found converges to 1. Hence the probability that the
network does not nd a block converges to 0. As the number of transactions, x
i
, included
in A
1
increase, there is an increase in the time it takes for A
1
to reach full consensus, and
hence the probability that no blocks are found in the time to full propagation falls.
30
4.1.5 Case 2
Case 2 occurs when, before the full propagation of A
1
, the informed nodes nd a block,
A
2
, and the uninformed nodes do not nd a block. The probability of Case 2 occurring
is determined by the ratio of uninformed to informed miners over time.
Recall that (x
i
, t) is the proportion of nodes that are informed about miner is block
for a given x
i
at time t. Following the empirical section, it is modelled as the CDF of
the log normal distribution with estimated parameters and . At time zero, the time
of propagation, no other nodes are aware of A
1
. As miners verify A
1
and relay it to their
neighbours, more miners join is partition. As time passes and more nodes are informed,
the likelihood of a node being connected to a random node in the network that does not
know about the block decreases. Figure 5 shows the change of (x
i
, t) depending on x
i
.
The eect of the change in the location parameter is more pronounced than the change
in the scale parameter as evidenced by the horizontal shifts in the curves.
The probability of ending in Case 2 is comprised of two concurrent processes. The
informed miners are working on nding A
2
and the uniformed miners are working on
nding B
1
. Note that B
1
competes to be included on the main chain with A
1
. Let t
i
be the random variable that gives the time the rst block, A
2
, is found by the informed
partition. Let t
u
be the random variable that gives the time that the uninformed par-
tition nd their rst block, B
1
. In order to proceed, we need to make a homogeneity
assumption. We require the hashing power is evenly distributed across the network in
order to evaluate the impact of a change in propagation time. This assumption is less
restrictive than it rst appears. Many of the nodes on the network are not actually
miners but are voluntary nodes that are simply relaying transactions and so the number
of nodes actually represented by miners is small. The network is randomly formed, and
thus the probability of connecting to a random node with a large share of hashing power
is equal to any other node. Furthermore, the incentives concerning high connectivity on
31
1 10 100 1000
Latency seconds
0.2
0.4
0.6
0.8
1.0
t
0
100
500
1000
2000
Figure 5: (x
i
, t) for dierent values of x
i
the network have not been well studied and therefore it is unlikely that it is has become a
domain of strategic interaction between miners. Although the split between the processes
is changing over time, the network will still nd as many blocks in a given period of time
in expectation. The evolution of the split according to (x
i
, t) is a deterministic function
of time. Hence, the arrival process of blocks follows non-homogenous poisson processes
with rate parameters
i
(t) and
u
(t) respectively. Non homogenous poisson processes
are characterised by their mean m(t) =
_
t
0
(t) dt. The distribution of the arrival of the
rst event in a non-homogenous poisson process is given by: f(t) = (t)e
m(t)
(Gallager
2011).
In this case, m(t) has the intuitive interpretation of network equivalent time. Take
the informed partition as an example. The rate parameter is the share of the network
that is uninformed at time t times the network rate, (x
i
, t). The integral of which
is
_
t
0
(x
i
, s) ds. Since (x
i
, s) represents the share of the network at time s the
integration is the amount of network equivalent time that the partition has spent on
nding a new block. The area under (x
i
, s) and 1 (x
i
, s) at time t must add up to t.
Figure 6 shows how initially the uninformed nodes have a larger share of the network and
are hence more likely to nd a block. Since we are interested in who nds the rst the
32
100 200 300 400
Seconds
0.2
0.4
0.6
0.8
1.0
t
t
1t
t0.5
Figure 6: (x
i
, t) and 1 (x
i
, t) for dierent values of x
i
block after A
1
was published, greater weight is put on the beginning of the distribution
rather than the end as the network has a higher probability of already nding a block.
Let t
i
be the random variable that indicates the time that the informed miners nd
their rst block and t
u
the random variable that the uninformed miners nd a block. To
simplify notation, m
i
(x
i
, t) =
_
t
0
(x
i
, s) ds and m
u
(x
i
, t) =
_
t
0
1 (x
i
, s) ds.
P(Case 2 | x
i
) = P(t
i
< t
u
)
= P(t
u
t) P(t
i
t)
= P(t
u
> t) P(t
i
t) +P(t
u
= t) P(t
i
t)
Evaluating at D(x
i
), the time that A
1
has been fully propagated, gives:
_
1
_
D(x
i
)
0
(1 (x
i
, t))e
m
u
(x
i
,t)
dt
_

_
D(x
i
)
0

i
(x
i
, s)e
m
i
(x
i
,t)
dt
+
_
D(x
i
)
0
(1 (x
i
, t))e
m
u
(x
i
,t)
__
t
0
(x
i
, s)e
m
i
(x
i
,s)
ds
_
dt
(13)
33
4.1.6 Cases 3, 3.1 and 3.2
Case 3 is the outcome where a miner j in the uninformed partition nds B
1
before
a miner in the informed partition nds A
2
and before A
1
fully propagates. Case 3 is
dened by two competing blocks of the same height both believed to be the longest chain
by partitions of the network. One must be picked to be added to the main chain. In
Bitcoin, this is known as an orphan race. One of the blocks being propagated will not
end up on the main chain. Arriving in Case 3.1 means that the informed partition nds
A
2
before the uninformed partition nds B
2
. This is determined by ratio of informed
to uninformed miners. Under our assumption that B
1
propagates instantaneously, the
number of miners in the uninformed partition at the time B
1
is found is the number of
miners who will work on nding B
2
.
23
Recall that t
i
is the random variable that indicates the time that the informed miners
nd their rst block and t
u
the random variable that the uninformed miners nd a block.
Also note, m
i
(x
i
, t) =
_
t
0
(x
i
, s) ds and m
u
(x
i
, t) =
_
t
0
1 (x
i
, s) ds.
P(Case 3 | x
i
) = P(t
u
< t
i
)
= P(t
i
t) P(t
u
t)
= P(t
i
> t) P(t
u
t) +P(t
i
= t) P(t
u
t)
Evaluating at D(x
i
), the time that A
1
has been fully propagated, gives:
_
1
_
D(x
i
)
0
(x
i
, t)e
m
i
(x
i
,t)
dt
_

_
D(x
i
)
0
(1 (x
i
, s)) e
m
u
(x
i
,t)
dt
+
_
D(x
i
)
0
(x
i
, t)e
m
i
(x
i
,t)
__
t
0
(1 (x
i
, s)) e
m
u
(x
i
,s)
ds
_
dt
(14)
23
The number of miners working on B
2
will be strictly lower than this number due to the delay in
other miners hearing about B
1
.
34
Result 4.1 Under monopolistic competition, the probability of ending in Cases 2 and 3
are increasing in x
i
Under monopolistic competition, the probability of ending in Case 2 is increasing in
x
i
. The eect of increasing the time until full propagation dominates the slower rate
at which nodes are informed about the block. Larger blocks lengthen the window of
interest in the game and hence increase the probability that a block will be found by
the network. The increase in the probability that the network nds a block is split cases
2 and 3. There are no closed form solutions and therefore the data form the empirical
section is used to derive the probabilities in gure 7.
Under the assumption of monopolistic competition, the probability of ending in Case 3
is increasing in x
i
. This is due to two complementary eects. The amount of time until
full propagation has increased and the there is a greater share of uninformed miners at
every point in time. Again no closed form solution exists but the result can be seen in
gure 7. When miner i decides to include more transactions this increases the amount
of time uninformed miners spend on a competing problem. Extending the time until
full propagation also increases the probability of arriving at Case 3 as there is a greater
amount of time in which the uninformed miners can nd B
1
.
Given that the network arrives at Case 3, there are still two possible outcomes. Either the
informed miners nd A
2
or the uninformed miners nd B
2
. Under the assumption that
B
1
propagates instantaneously, the network is now divided into two stationary partitions.
Only the arrival of a block from either partition will cause the network to change. The
network at that instant can now be modelled as being governed by a homogenous poisson
process with a stationary split between two partitions. The probability of the arrival of
a new block in any given time horizon is i.i.d. Given that the arrival of B
1
occurred at
time t, the rate parameters of the informed and the uninformed partition are (x
i
, t)
and (1(x
i
, t) respectively. A homogenous poisson process split into two independent
35
2000 4000 6000 8000 10000
x
i
0.2
0.4
0.6
0.8
1.0
Probability
Case 1
Case 2
Case 3
Figure 7: Probabilities of ending in Cases 1, 2 and 3
processes has a convenient result for the arrival of the next event (Gallager 2011).
P[t
i
< t
u
] =
(x
i
, t)
(x
i
, t) +(1 (x
i
, t))
(15)
= (x
i
, t)
The probability of Case 3.1 is then the probability that we arrive at Case 3 at time
t weighted by the share that the informed miners have at time t, (x
i
, t). Rewriting
P[Case 3] with the weighted probabilities gives:
_
1
_
D(x
i
)
0
(x
i
, t)e
m
i
(x
i
,t)
dt
_

_
D(x
i
)
0
(x
i
, t)(1 (x
i
, t))e
m
u
(x
i
,t)
dt
+
_
D(x
i
)
0
(x
i
, t)e
m
i
(x
i
,t)
__
t
0
(x
i
, t)(1 (x
i
, s))e
m
u
(x
i
,s)
ds
_
dt
(16)
36
Similarly the probability that Case 3.2 occurs is
_
1
_
D(x
i
)
0
(x
i
, t)e
m
i
(x
i
,t)
dt
_

_
D(x
i
)
0
(1 (x
i
, t))
2
e
m
u
(x
i
,t)
dt
+
_
D(x
i
)
0
(x
i
, t)e
m
i
(x
i
,t)
__
t
0
(1 (x
i
, s))
2
e
m
u
(x
i
,s)
ds
_
dt
(17)
Result 4.2 As x
i
increases, the probability of Case 3.2 increases faster than the proba-
bility of Case 3.1 occurring.
Result 4.1 showed that an increase in x
i
increases the probability that B
1
is found before
the full propagation of A
1
. Within Case 3 the probability of ending in Case 3.2 increases
at a faster rate than Case 3.1 since at every time period there is now a greater share of
uninformed nodes so there is an increase in the probability that a competing block B
1
will eventually make it onto the main chain. This can be seen in gure 7.
At 2300 transactions, there is a equal probability of ending in Cases 3.1 and 3.2. This
result, stands in contrast to the conventional wisdom about orphan races on the Bitcoin
network. Smaller blocks are able to propagate much faster but our analysis shows that
their size is not decisive in an orphan race. Figure 8 shows that the inclusion of a block
in the main chain is primarily decided by the time which it was found and secondarily by
its size. For blocks with transactions fewer than 2300, the larger block still wins the race
with greater probability than the smaller block. After 2300 transactions the probability
of the block containing zero transactions has a higher probability of being included on
the main chain.
This result shows the importance of understanding the combination of the spread of
information on the network and the rules of the protocol. The uninformed partition can
nd blocks until the last miner is informed about miner is block but after the block has
propagated to over 50% of the network the likelihood of it winning the orphan race is
by denition less than half. The point at which the probability of Case 3.2 occurring
37
2000 4000 6000 8000 10000
x
i
0.05
0.10
0.15
0.20
Probability
Case 3.1
Case 3.2
Figure 8: Probabilities of ending in Cases 3.1 and 3.2
is higher than Case 3.1 therefore shows the point at which the uninformed miners are
more likely to nd a block before half the network has been informed of miner is block.
The intuition behind this result can be seen by referring to gure 6, noting the dierence
between the shift in the tail of 1 (x
i
, t) compared to where it crosses the 0.5 dashed
line.
The increase in the amount of time uninformed time that uninformed miners spend on
creating a competing block is spread throughout the Log Normal distribution and hence
the probability of a collision does not determine the orphan rate. Rather it is the width
of the tail that could lead to a large orphan rate. The condition for 3.1 to be higher to
3.1 is equivalent to saying the majority of the blocks found by the uninformed partition
occur before A
1
has propagated to 50% of the network under the assumption that B
1
propagates instantly.
Bitcoin orphan races are decided probabilistically based on shares of the network working
on competing blocks. The results derived are driven by the respective shares of the
informed and the uninformed partitions. Empirical data informs reasonable estimates
for how this split evolves over time. While the model is parameterised for the specic
38
observation period, the model could be adapted in the future for any changes in network
topology or average size of blocks.
5 Nonce only equilibrium
Since there are no closed form solutions to the model, we proceed with numerical and
graphical analysis to look at the outcomes of the game. We are primarily interested in
how the expected benet of miner i changes as a function of x
i
the number of transactions
included in their block. At the end of the section we will look at the incentives that
larger miners face and consider the incentives towards centralisation. Initially we proceed
under the assumption of monopolistic competition.
The current block reward in Bitcoin is 25 BTC for each block that is found. Houy
(2014a) found that the Block reward would have to fall to 2.03 BTC or transactions
fees to rise to 0.00123BTC in order for the largest mining pool, GHash.io, to include
a positive number of transactions. In Houys specication, GHash.io has 26% of the
network hashing rate. Under monopolistic competition accounting for the dynamics of
information propagation, the equilibrium in which all miners include 0 transactions is
broken when the fee rises to the 0.004 BTC.
Figure 9 shows how the change in transaction fee aects the optimal number of transac-
tions included by a miner. All lines begin at the same intercept as they result in equal
payos. As miner i includes more transactions, it increases the probability that their
block is orphaned but they also receive transaction fee revenue. The bottom line, set at
the current transaction fee level, falls sharply as miner i includes more transactions. The
increase in revenue is not enough to oset the increase in probability that the block is
orphaned. However, if the transaction fee was set at 0.0004 BTC, miners would have an
incentive to include transactions as many transactions as they could. The shaded area
39
0 2000 4000 6000 8000 10000
xi
22.5
23.0
23.5
24.0
24.5
25.0
25.5
EB
0.0001
0.0002
0.0003
0.0004
Figure 9: Expected Benet with R = 25 and varying values of c
in gure 9 shows the dierence in miner revenue between the nonce only equilibrium
strategy and the inclusion of transactions.
The power of transaction fee revenue increases in tandem with the halving of the block
reward, R. In approximately August 2016, the block reward will halve to 12.5 BTC
per block mined. The halving of the block reward the transaction fee required to break
the nonce also halves to just double current levels, 0.0002 BTC. The optimal number
of transactions included remain unchanged following from the equilibrium condition.
Miners would still wish to include as many transactions as possible.
While the block reward halving alleviates some of the incentive problems due to infor-
mation propagation, the equilibrium condition in the model could put an upper bound
on the price of Bitcoin if it is going to be used eectively as a payment system. Miners
trade-o the additional revenue from transaction fees with the increased probability that
the block they nd will be orphaned. Recall the equilibrium condition
x

i
= max
_
P
i
(

x )
| P

i
(

x ) |

R
c
, 0
_
(18)
40
Assume an interior solution. If the price of Bitcoin in USD goes up, this increases
both R and c in equal proportions since both the reward and the transaction fee are
denominated in Bitcoin. Note that in order for us to remain at the equilibrium number
of transactions processed, the cost of an individual transaction in Bitcoin terms has to
remain constant and hence increase in USD terms. An increase in transaction fees in
USD terms may result in fewer transactions being processed on the network. Earlier
this year the minimum transaction fee set by the core development team was debased
to account for the price of Bitcoin rising (Hearn 2014). In the future, a debasement
in the minimum transaction fee might result in fewer transactions being processed as a
result.
The current transaction fee is around four fold lower than the value needed to escape
the bad equilibrium where no miners have an incentive to include transactions in their
blocks. However even with fees at their current levels, miners include transactions in
their blocks. Over the observation period, the average number of transactions in a block
was 368. The model provides a method of estimating how much deviating from a nonce
only strategy costs the miner in expectation. Figure 10 shows the expected benet
for nding a block under a nonce only strategy which is independent of the number
of transactions and the payo for including x
i
transactions in a block. The shaded
area in gure 10 shows the revenue forgone from deviating from a nonce only strategy.
Including 500 transactions in a block causes miners to lose in expectation 0.14 BTC for
every block they nd, approximately $100 in current value terms or 0.5% of operating
revenue. Recall that blocks are found approximately every ten minutes and this eect
is compounded over the number of blocks that a miner nds.
Miners could be competing strategically to raise the benets of block rewards and trans-
action fees indirectly. Miners may sacrice changes in expected gains from following a
nonce only mining strategy with these other strategies. The model could be extended
41
0 2000 4000 6000 8000 10000
xi
22.5
23.0
23.5
24.0
24.5
25.0
25.5
EB
Nonce Only
Deviation
Figure 10: Loss in revenue from deviating from a nonce only strategy
to include a consideration of the participation of miners in pools. Mining pools oer a
revenue smoothing service at a fee. They are visible actors on the network since they
have to prove to their members when they nd a block. Including more transactions
may attract more miners to the pool who wish to support the Bitcoin network. In the
internet forums, miners are often praised for including a large number of transactions.
Furthermore, some pools are criticised for their bad behaviour causing miners to switch
pools. With costless switching, mining pools may be very sensitive to bad press.
6 Discussion
The previous sections outlined the diculties from information propagation that Bitcoin
must overcome to become an incentive compatible decentralised payment network. In
this section, we discuss the implications of partitions on the network more broadly. In
light of the adverse incentives that face miners and the costs to the Bitcoin network
more generally, we then consider a proposal to remove some of the costs associated with
network latency. Although there are technically feasible amendments to the Bitcoin
42
protocol that would speed up block propagation, network latency actually provides a
layer of protection against malicious strategies between miners.
The probability function outlined in section 4.1.3 not only describes the incentives facing
the individual miner i but also denes the amount of time that the network spends away
from global consensus. Recall that a partition in the network is dened by some miners
holding a dierent set of beliefs on the current state of the ledger. The Bitcoin protocol
has been shown to come to unanimous consensus in a nite time horizon as long as
over half the computing power remain honest (Miller & LaViola Jr 2014).
24
However,
little attention has been devoted to understanding the dynamics that unfold while the
network is not at unanimous consensus. This may be in part due to the small number
of transactions facilitated on the Bitcoin network at present and also a lack of modelling
of how these partitions occur.
In the model presented, Cases 2 through 4 represent the probabilities that the network
moves into a state with multiple partitions. Result 4.1 showed how the probability of
the network ending in one of these cases is increasing in the number of transactions
being processed on the network. Hence increasing the transaction volume on the Bitcoin
network will cause more and longer partitions to occur. Recall that the probabilities
of moving into a Case were driven by network equivalent time spent by miners on a
competing problem. We found that this to be strictly increasing in the number of
transactions processed. Hence miners spend longer in partitions as a result of more
transactions being processed.
Partitions on the Bitcoin network open attack vectors. One example is the Finney
attack. The attack was suggested by Hal Finney, a cryptographer who was one of the
rst people to run the Bitcoin software in 2009 and was the recipient of the rst Bitcoin
transaction. The attack proceeds as follows. A miner works on a block that contains
24
Honest dened here as not colluding with an adversary.
43
a transaction between two addresses that the miner owns and does not announce that
transaction to the network. As soon as the miner nds the solution to the cryptographic
puzzle that enables them to publish the block, they run to the merchant to pay with the
already spent outputs.
25
The window for the attack is the propagation time of the block.
If blocks were propagated almost instantly then Finney attacks would be impossible to
pull o. However, if the merchant is in a partition of the network that does not hear about
the block for a considerable portion of time this increases the eectiveness of the attack.
Combatting such an attack may require waiting for more blocks to be found in order
to be sure that the transaction is valid and will not be double spent. In that scenario,
Bitcoin ceases to be compatible with making every day purchases in stores.
Other implications of partitions on the Bitcoin network are yet to be explored. Geo-
graphic partitions in the network might result in increased orphan rates. In our model,
we assume that the entire Bitcoin network is structured as a random graph. However it
is possible that there is some preferential attachment by geographic region. The empiri-
cal data shows that the the country with the second largest number of nodes was China
(gure 13), however the number of inv messages received from Chinese nodes was eighth
largest by country location (gure 12). Our measurement node was located in the US
and hence this might indicate a geographic partition in the spread of information on the
network. Furthermore, one of the major Chinese mining pools, Discus Fish, had anoma-
lous information propagation trends for their blocks (gure 11). Their smaller blocks
propagated slower than their bigger blocks. Although this could have been due to the
small sample size, it could also be due to the lack of transactions in those blocks seen by
the network ahead of the block being published. When miners hear about transactions,
they automatically check their signatures to expedite validation when blocks containing
them are propagated. If information about transactions is not spreading fully around
25
Recently, a business, Bitundo, has started oering Finney Attacks as a service. They allow you to
send double spends to their mining pool and they will notify you when they nd a block so that the
customer can double spend their coins at a merchant.
44
the network, this will create longer propagation times and therefore more time wasted
by miners in general.
Addressing the costs associated with network partitions arising from slow information
propagation will be required to ensure that Bitcoin can serve as scalable decentralised
payment system. Mark Friendenbach (2014) has suggested a new protocol for the way
that nodes will receive and relay blocks to the network . Currently the network fully
validate blocks before forwarding them to peers. The information transmitted is also
the entire contents of blocks. The primacy of blocks is determined by which block
message is received rst, which is subject to the transmission and validation delays.
The new proposal, suggests broadcasting the unique block headers separately from the
block message, which will allow miners to discern which block came rst. Block headers,
however, gives miners the option of basing primacy on the time the block header is
received, which is almost instantaneous. Although it is not 100% safe to start mining
on top of a block header, a miner, after the regular delay and validation could treat
the rst block that they heard of as the longest chain and put it as the parent of their
block.
To see how this works, take an example: two blocks with a common parent A
0
are found
in quick succession; A
1
and B
1
. A
1
is found rst but is a large block. B
1
is found a
few seconds later and is an empty block. Case 3.2 showed the likelihood that B
1
, the
later but smaller block, could propagate faster, orphaning the larger A
1
. Under headers-
rst, the cost of associated with slow propagation of block information is the same for
any block and is virtually zero. In this case A
1
would win the contest almost every
time and make it onto the main chain. Miners will continue working on the old, known
valid parent A
0
until the contents of A
1
are received and validated. Hence miners still
work on producing a conicting block, B
1
, in the time that it takes for them to receive
the information on A
1
. Given that a block B
1
is found by a miner in the time they
45
were waiting for information about A
1
. The miner that found B
1
and the miners who
validate it before validating A
1
will spend time mining on top of B
1
. However, once the
information on A
1
is received, they switch to putting it on the main chain since they
heard about it rst and treat it as a the longest chain.
With headers-rst A
1
will only become an orphan if the partition of the network that
has not validated it nds two blocks in the time that it takes for A
1
to fully propagate
around the network. Once A
1
has fully propagated, miners stop working on a conicting
block or chain and treat it as the parent. Even under a worst case scenario where
B
1
propagates instantaneously, the probability that A
1
will become an orphan is the
probability of ending in Case 3 squared. Miners in the uninformed partition have to nd
two blocks before A
1
is full propagated or A
2
is found.
The risk of being orphaned due to including more transactions is therefore very close to
zero and hence the private cost for introducing more transactions is very close to zero.
It has also reduced the amount of miner eorts that would be wasted on redundant
problems. To see this, consider the above example. If a miner hears about A
1
, nds B
1
and then receives the data on A
1
, they will immediately stop mining on top of B
1
and
switch onto A
1
. Compare this to the current case, following the same course of events
a miner nds B
1
and a second later receives the data on A
1
, the node automatically
rejects A
1
and carries on mining on B
1
strictly increasing the amount of wasted time by
miners due to information propagation. Essentially we have limited the size of partitions
by introducing a clear rule of thumb where the information to obey it spreads around
the network very quickly.
However, headers-rst opens up the network to a new form of sabotage attack. Since the
private cost of including an extra transaction is almost zero then miners have an incentive
to include transactions never seen before on the network, slowing block propagation and
hence reducing the expected returns of their rivals. The amount of time that miners
46
spend on redundant problems reduces their expected returns. A useful extension of our
model would be to predict the higher returns per unit of computing power contributed
in order to break even for prot maximising miners. This either raises the cost of using
the network for the users in the form of higher fees or reduces the amount of security on
the network as some miners are forced to exit.
Network latency can be eectively resolved if there are fewer participants on the net-
work. Fewer nodes, or high speed connections between nodes that have concentrations
of computing power would ensure that the delays in receiving and sending information
are limited. With increasing costs of bandwidth and storage on Bitcoin, there are sug-
gestions for moving towards a model where only select number of wealthy nodes do the
validation and then miners are safe to mine on top of block headers. This suggestion
converts Bitcoin from a decentralised system into a distributed system. Trust is no
longer distributed among all participants and is instead focussed on these validation
nodes. However, this marks a signicant departure from the premise that Bitcoin was
created upon.
The key objective of the system is establishing decentralised trust between anonymous
parties. Cost eectiveness, remains a secondary concern. Indeed, a miner providing a
cost eective service, obeying the rules of the protocol, may detract from achieving the
goal of decentralised trust. In the extreme case where 51% of the computing power on the
network is controlled by a single miner at a much lower cost than the rest of the miners,
they are not the most ecient operator of the Bitcoin network as there is now trust in
a central authority. In economic terms, it is tempting to say that a costly decentralised
service provided by small users is inecient but this would ignore the premise of the
system. Peter Todd (2013) provided a denition of eciency as providing this service:
When you say these small miners are inecient, youre completely ignoring what we
actually want miners to do, and that is to provide independent hashing power. The
47
small miners are the most ecient at providing this service, not the least.
7 Concluding remarks
This study identied network partitions as one of the key drivers of miner incentives
on the Bitcoin network. Through modelling the way that partitions of informed and
uninformed miners create conicting blocks, the equilibrium conditions for the inclusion
of transactions by prot maximising miners were identied. Contrary to previous studies,
modelling the dynamics of information propagation led to an unlikely conclusion that
the issue today is less pronounced than previously thought. However fees would have to
increase to make it incentive compatible for small miners to include transactions. Further
study of the way in which partitions on the Bitcoin network are created and persist will
be critical in designing incentive compatible mechanisms to scale the Bitcoin network
to handle more transactions. The methodology employed in this thesis could provide
a basis upon which to develop more advanced models of the spread of information on
Bitcoin and other decentralised architectures.
Bitcoin as a payment network is created on a basis of highly restrictive security as-
sumptions to create a robust decentralised payment network. If we could alter the
preconditions that it was created upon then many of the problems that Bitcoin faces
would instantly vanish. Reducing the amount of nodes would help remedy the costs as-
sociated with network latency. Introducing trust between parties on the network would
reduce the need to have global unanimous consensus across all nodes. However, such
changes compromise Bitcoins fundamental security assumptions. Although some of the
trade-os lie beyond the scope of economics, this study combined the data rich environ-
ment and well dened set of rules to study this fascinating case of market design and
technological innovation.
48
References
Andresen, G. (2013), Marginal transaction cost, goo.gl/a50Jo3.
Aspnes, J., Jackson, C. & Krishnamurthy, A. (2005), Exposing computationally-
challenged byzantine impostors, Department of Computer Science, Yale University,
New Haven, CT, Tech. Rep.
Back, A. (2002), Hashcash-a denial of service counter-measure,
http://hashcash.org/hashcash.pdf.
Bitcointalk (2014), How a oating blocksize limit inevitably leads towards centralization,
https://bitcointalk.org/index.php?topic=144895.40.
Blockr (2014), Block explorer, http://blockr.io/.
Coinometrics (2014), Coinometrics website, http://www.coinometrics.com/.
Decker, C. & Wattenhofer, R. (2013), Information propagation in the bitcoin network,
in Peer-to-Peer Computing (P2P), 2013 IEEE Thirteenth International Conference
on, IEEE, pp. 110.
Diamond, D. W. & Dybvig, P. H. (1983), Bank runs, deposit insurance, and liquidity,
The journal of political economy pp. 401419.
Douceur, J. R. (2002), The sybil attack, in Peer-to-peer Systems, Springer, pp. 251260.
Friendenbach, M. (2014), Headers-First, goo.gl/xuxFSi.
Gallager, R. (2011), Discrete stochastic processes,
http://www.rle.mit.edu/rgallager/documents/6.262lateweb2.pdf.
Gillilland, C. L. C. (1975), The stone money of yap: a numismatic survey, Smithsonian
Studies in History and Technology.
49
Harris, E. & Perlroth, N. (2014), For Target, the Breach Numbers Grow, New York
Times.
Hearn, M. (2014), GitHub Repository, https://github.com/bitcoin/bitcoin/pull/3305.
Houy, N. (2014a), The bitcoin mining games, Working paper v0.1, GATE, Ecully, France.
Houy, N. (2014b), The economics of bitcoin transaction fees, GATE, Ecully, France.
Humphrey, D. B., Pulley, L. B. & Vesala, J. M. (2000), The checks in the mail: why
the united states lags in the adoption of cost-saving electronic payments, Journal of
Financial Services Research 17(1), 1739.
Kahn, C. M. & Roberds, W. (2009), Why pay? an introduction to payments economics,
Journal of Financial Intermediation 18(1), 123.
Kashyap, A. K., Rajan, R. & Stein, J. C. (2002), Banks as liquidity providers: An
explanation for the coexistence of lending and deposit-taking, The Journal of Finance
57(1), 3373.
Kroll, J. A., Davey, I. C. & Felten, E. W. (2013), The economics of bitcoin mining, or
bitcoin in the presence of adversaries, in Proceedings of WEIS, Vol. 2013.
Lacker, J. M. (2006), Central bank credit in the theory of money and payments, in
Remarks presented at The Economics of Payments II Conference, Federal Reserve
Bank of New York, March, Vol. 29.
Lamport, L., Shostak, R. & Pease, M. (1982), The Byzantine generals problem, ACM
Transactions on Programming Languages and Systems (TOPLAS 4(3), 38240.
Lee, T. & Wilde, L. L. (1980), Market structure and innovation: a reformulation, The
Quarterly Journal of Economics pp. 429436.
50
Lowe, P. & Macfarlane, I. (2005), Payments system reform: the australian experience,
Interchange Fees in Credit and Debit Card Industry: What Role for Public Authorities.
Miller, A. & LaViola Jr, J. J. (2014), Anonymous byzantine consensus from moderately-
hard puzzles: A model for bitcoin, Technical report, University of Central Florida.
Nakamoto, S. (2008), Bitcoin: A peer-to-peer electronic cash system, Technical report,
https://bitcoin.org/bitcoin.pdf.
Nekovee, M., Moreno, Y., Bianconi, G. & Marsili, M. (2007), Theory of rumour spread-
ing in complex social networks, Physica A: Statistical Mechanics and its Applications
374(1), 457470.
Organ of Corti (2014), the block-spotters guide, Database of Bitcoin mining pools.
Poese, I., Uhlig, S., Donnet, B., Kaafar, M. A. & Gueye, B. (2011), Ip geolocation
databases: Unreliable?.
Rosenfeld, M. (2012), Analysis of hashrate-based double spending.
https://bitcoil.co.il/Doublespend.pdf.
Sompolinsky, Y. & Zohar, A. (2013), Accelerating Bitcoins Transaction Processing. Fast
Money Grows on Trees, Not Chains, IACR Cryptology ePrint Archive 2013, 881.
Taylor, M. B. (2013), Bitcoin and the age of bespoke silicon, in Proceedings of the 2013
International Conference on Compilers, Architectures and Synthesis for Embedded
Systems, IEEE Press, p. 16.
Todd, P. (2013), Bitcointalk, https://bitcointalk.org/index.php?topic=144895.10.
Vives, X. (1990), Nash equilibrium with strategic complementarities, Journal of Math-
ematical Economics 19(3), 305321.
51
A Strategic complementarities between miners
A game has strategic complementarities; if, given an order on players strategies, an
increase in one players strategy makes the other players want to increase their strategies
(Vives 1990). In the context of Bitcoin, this would be that the inclusion of more blocks
by one miner incentivises the other miner to increase the amount of transactions that
they include in their block.
Claim Given an increase in x
i
, the number of transactions in other miners blocks,
miner i has an incentive to include more transactions in their block.
The act of another miner including more transactions in their block has two eects on
miner i.
1. Increases the probability that there is already a block in circulation when miner i
publishes their block.
2. Conditional on miner i nding a block, it increases the probability that miner is
block A
1
is included in the main chain given there is a collision with B
1
.
The probability that the there is already a block in circulation is strictly increasing in
x
j
. Let B
1
denote the block that is found by miner j containing x
j
transactions. Let A
1
be a block that is found by miner i at the same height. The probability that there is a
collision between B
1
and A
1
is strictly increasing in the number of transactions included.
Let N(t) be the random variable that counts the number of blocks that the uninformed
nodes nd on the network after miner j has propagated their block and (x
j
, t) be the
proportion of nodes that are informed about B
0
at time t. The probability of a collision
52
is given by:
P(N(t) 1) =1 (1 )

0
1(x
j
,t) dt
(19)
[P(N(t) 1)]
x
j
=log(1 )
. .
>0
(1 )

0
(1(x
j
,t)) dt
. .
>0
_

0

(1,0)
(x
j
, t) dt
. .
>0
(20)
This is dierent from the main model since we are not interested in which block arrives
rst only in the probability that there is at least one arrival. This probability is increasing
in x
j
simply because the amount of time spent by uninformed miners increases. Assume
an interior solution to the number of transactions included by miners, i.e. miners have
an incentive to include a positive amount of transactions. Recall that miner i nds
blocks according to a homogenous poisson process at a rate
i
. From the poisson
process memoryless property, during a given time horizon, it is equally likely for any
given t that a miner i will nd a block. A miner therefore gives equal weight to every
incremental time period. GHash.io, with 27% of the computing power, the probability
that they nd a block in a given second is
9
20000
, assuming the network nds a block
on average every 600 seconds. Any change resulting from the change in the number
of transactions included by another miner would have to be scaled by this amount.
Furthermore, miner i has little way of improving their chances of success given they nd
a block after one has already been propagated as evidence by the small probability of
Case 3.2. The increase in the probability that miner i is mining on a redundant problem
increases their marginal costs but will therefore not have an inuence on the strategic
decision of how many transactions miner i includes.
Conditional on miner i nding block A
1
, the probability of not being included on the main
chain due to a collision with B
1
is reduced. The increase in the number of transactions
included in a block has no inuence on the probability of it being found. It only aects
the rate of propagation. Given that a collision with B
1
occurs, the increased number of
53
transactions in B
1
mean that it will propagate slower around the network, leaving more
time for more nodes to nd out about A
1
and join the informed partition. If we assume
an equilibrium where miner i includes a positive number of transactions x

i
. The increase
in probability that miner is block is included on the main chain, provides an incentive
to raise the number of transactions they process. This can be shown graphically as we
do not have closed form solutions for the probability of winning given a collision.
The second eect dominates the rst. Intuitively, the rst eect is a general eect on the
network and the second eect is focused on miner i. The increased probability that they
are mining a redundant block is scaled by the probability that a miner nds a block in
the delay caused by the increase in x
j
. Furthermore, the marginal impact from altering
the number of transactions in miner is block to oset the rst eect is less powerful than
the increase in incentives to include more transactions due to the second eect. To see
this, The second eect is conditional on miner i nding a block and therefore dominates
the rst eect.
Strategic complementarities require observability to have a role in determining the out-
come of a game. Although, individual participants in the Bitcoin system are relatively
anonymous, there is almost perfect observability on which pool found a particular block.
The Organ of Corti (a pseudonym) can identify the pool that found approximately 90%
of all blocks (Organ of Corti 2014). Figure 11, using his dataset, shows that the large
mining pools include many transactions on the Bitcoin blockchain. As each block can be
identied as being mined by one of the pools, the pool operators can rely on other pool
operators to follow suit and include more transactions in their blocks. Although there
has been no explicit proof that has been a consideration of pool operators, strategic
complementarities may have played a role in maintaining this equilibrium.
Our baseline case of other miners blocks containing zero transactions, under strategic
complementarities can be considered a worst case scenario. Any equilibrium found rep-
54
resents a lower bound on the number of transactions that it is rational for a miner to
include in their blocks. Any increase in x
j
, the number of transactions included by other
miners would make miner i want to include more transactions in their block.
55
BitMinter BTC Guild CloudHashing Discus Fish
EclipseMC Eligius GHash.IO KNC Miner
Megabigpower Slush Triplemining Unknown
0%
25%
50%
75%
100%
0%
25%
50%
75%
100%
0%
25%
50%
75%
100%
1 100 1 100 1 100 1 100
Latency (seconds)
P
e
r
c
e
n
t
a
g
e

o
f

n
e
t
w
o
r
k

i
n
f
o
r
m
e
d
100
Number of
transactions
Block propagation CDFs
Figure 11: Latency as a function of the number of transactions included in a block
56
US DE CA GB NL FR RU CN AU SE
Country of nodes emitting invs (top10)
F
r
a
c
t
i
o
n

o
f

i
n
v
s
0
.
0
0
.
1
0
.
2
0
.
3
0
.
4
Figure 12: Number of inv messages by country
US CN GB DE CA RU FR NL AU SE
Country (top10)
N
u
m
b
e
r

o
f

n
o
d
e
s
0
5
0
0
1
0
0
0
1
5
0
0
2
0
0
0
2
5
0
0
3
0
0
0
Figure 13: Number of nodes by country
57