Trang chủ » blog » 8. Mining and Consensus – Mastering Bitcoin [Book]

8. Mining and Consensus – Mastering Bitcoin [Book]

Chapter 8. Mining and Consensus


mine is the process by which raw bitcoin is added to the money supply. Mining besides serves to secure the bitcoin system against deceitful transactions or transactions spending the lapp amount of bitcoin more than once, known as a double-spend. Miners provide processing power to the bitcoin network in substitute for the opportunity to be rewarded bitcoin. Miners validate modern transactions and record them on the global daybook. A raw block, containing transactions that occurred since the last block, is “ mined ” every 10 minutes, thereby adding those transactions to the blockchain. Transactions that become part of a block and added to the blockchain are considered “ confirmed, ” which allows the new owners of bitcoin to spend the bitcoin they received in those transactions.

Miners receive two types of rewards for mine : new coins created with each newly auction block, and transaction fees from all the transactions included in the block. To earn this advantage, the miners compete to solve a difficult mathematical problem based on a cryptanalytic hashish algorithm. The solution to the problem, called the proof of bring, is included in the new pulley and acts as proof that the miner expended significant computing campaign. The contest to solve the proof-of-work algorithm to earn reward and the right to record transactions on the blockchain is the basis for bitcoin ’ s security exemplary. The march of new mint generation is called mine because the reward is designed to simulate diminishing returns, just like mining for cherished metals. Bitcoin ’ s money supply is created through mining, similar to how a central bank issues newly money by printing bank notes. The total of newly created bitcoin a miner can add to a blockage decreases approximately every four years ( or precisely every 210,000 blocks ). It started at 50 bitcoin per block in January of 2009 and halved to 25 bitcoin per block in November of 2012. It will halve again to 12.5 bitcoin per blockage erstwhile in 2016. Based on this recipe, bitcoin mine rewards decrease exponentially until approximately the year 2140, when all bitcoin ( 20.99999998 million ) will have been issued. After 2140, no new bitcoins will be issued. Bitcoin miners besides earn fees from transactions. Every transaction may include a transaction fee, in the class of a excess of bitcoin between the transaction ’ randomness inputs and outputs. The winning bitcoin miner gets to “ keep the change ” on the transactions included in the fetching block. nowadays, the fees represent 0.5 % or less of a bitcoin miner ’ second income, the huge majority coming from the newly minted bitcoins. however, as the reward decreases over time and the total of transactions per parry increases, a greater proportion of bitcoin mine earnings will come from fees. After 2140, all bitcoin miner earnings will be in the form of transaction fees. The word “ mining ” is slightly deceptive. By evoking the extraction of precious metals, it focuses our attention on the advantage for mining, the new bitcoins in each block. Although mine is incentivized by this reward, the basal function of mine is not the advantage or the genesis of new coins. If you view mining only as the march by which coins are created, you are mistaking the means ( incentives ) as a goal of the process. mine is the chief process of the decentralized clearinghouse, by which transactions are validated and cleared. mine secures the bitcoin organization and enables the emergence of network-wide consensus without a central authority. mine is the invention that makes bitcoin special, a decentralize security mechanism that is the footing for peer-to-peer digital cash. The wages of newly minted coins and transaction fees is an bonus scheme that aligns the actions of miners with the security of the network, while simultaneously implementing the monetary supply. In this chapter, we will foremost examine mine as a monetary supply mechanism and then look at the most authoritative function of mine : the decentralized emergent consensus mechanism that underpins bitcoin ’ second security.

Bitcoin Economics and Currency Creation

Bitcoins are “ mint ” during the creation of each jam at a cook and diminishing rate. Each obstruct, generated on average every 10 minutes, contains entirely fresh bitcoins, created from nothing. Every 210,000 blocks, or approximately every four years, the currency issue rate is decreased by 50 %. For the beginning four years of operation of the network, each block contained 50 newly bitcoins. In November 2012, the new bitcoin issue pace was decreased to 25 bitcoins per parry and it will decrease again to 12.5 bitcoins at block 420,000, which will be mined sometime in 2016. The rate of modern coins decreases like this exponentially over 64 “ halvings ” until stuff 13,230,000 ( mined approximately in year 2137 ), when it reaches the minimum currentness unit of 1 satoshi. finally, after 13.44 million blocks, in approximately 2140, all 2,099,999,997,690,000 satoshis, or about 21 million bitcoins, will be issued. Thereafter, blocks will contain no new bitcoins, and miners will be rewarded entirely through the transaction fees. Figure 8-1 shows the sum bitcoin in circulation over time, as the issue of currentness decreases. In the exercise code in Example 8-1, we calculate the entire amount of bitcoin that will be issued. exemplar 8-1. A handwriting for calculating how much full bitcoin will be issued

# Original block reward for miners was 50 BTC
start_block_reward = 50
# 210000 is around every 4 years with a 10 minute block interval
reward_interval = 210000

def max_money():
    # 50 BTC = 50 0000 0000 Satoshis
    current_reward = 50 * 10**8
    total = 0
    while current_reward > 0:
        total += reward_interval * current_reward
        current_reward /= 2
    return total

print "Total BTC to ever be created:", max_money(), "Satoshis"

example 8-2 shows the output produced by running this script. case 8-2. Running the script

$ python
Total BTC to ever be created: 2099999997690000 Satoshis

BitcoinMoneySupply figure 8-1. provision of bitcoin currency over clock based on a geometrically decrease issue rate The finite and diminishing issue creates a repair monetary add that resists ostentation. Unlike a decree currency, which can be printed in infinite numbers by a central depository financial institution, bitcoin can never be inflated by print. Deflationary Money The most important and argue consequence of a situate and diminishing monetary issue is that the currency will tend to be inherently deflationary. deflation is the phenomenon of appreciation of value ascribable to a mismatch in supply and demand that drives up the value ( and switch over rate ) of a currency. The antonym of inflation, price deflation means that the money has more buy office over time. many economists argue that a deflationary economy is a catastrophe that should be avoided at all costs. That is because in a time period of rapid deflation, people tend to hoard money rather of spending it, hoping that prices will fall. Such a phenomenon unfolded during Japan ’ s “ Lost Decade, ” when a complete crumble of demand pushed the currency into a deflationary corkscrew. Bitcoin experts argue that deflation is not bad per southeast. Rather, deflation is associated with a collapse in demand because that is the only case of deflation we have to study. In a decree currency with the possibility of unlimited printing, it is very unmanageable to enter a deflationary coiling unless there is a arrant collapse in demand and an unwillingness to print money. deflation in bitcoin is not caused by a break down in demand, but by a predictably constrained add. In practice, it has become apparent that the billboard instinct caused by a deflationary currency can be overcome by discounting from vendors, until the discount rate overcomes the hoarding instinct of the buyer. Because the seller is besides motivated to hoard, the discount rate becomes the equilibrium price at which the two billboard instincts are matched. With discounts of 30 % on the bitcoin price, most bitcoin retailers are not experiencing trouble overcoming the roll up instinct and generate tax income. It remains to be seen whether the deflationary expression of the currency is truly a problem when it is not driven by rapid economic retraction.

Decentralized Consensus

In the previous chapter we looked at the blockchain, the ball-shaped populace ledger ( list ) of all transactions, which everyone in the bitcoin net accepts as the authoritative record of ownership. But how can everyone in the network agree on a individual universal “ accuracy ” about who owns what, without having to trust anyone ? All traditional requital systems depend on a reliance model that has a central authority providing a clearinghouse service, basically verifying and clearing all transactions. Bitcoin has no central authority, yet somehow every broad node has a complete copy of a public daybook that it can trust as the authoritative record. The blockchain is not created by a cardinal authority, but is assembled independently by every node in the network. Somehow, every lymph node in the network, acting on information transmitted across insecure network connections, can arrive at the lapp ending and assemble a imitate of the same populace daybook as everyone else. This chapter examines the summons by which the bitcoin network achieves ball-shaped consensus without central authority. Satoshi Nakamoto ’ s chief invention is the decentralized mechanism for emergent consensus. emergent, because consensus is not achieved explicitly—there is no election or fixed here and now when consensus occurs. alternatively, consensus is an emergent artifact of the asynchronous interaction of thousands of independent nodes, all following elementary rules. All the properties of bitcoin, including currentness, transactions, payments, and the security model that does not depend on cardinal authority or hope, derive from this invention. Bitcoin ’ s decentralized consensus emerges from the interplay of four processes that occur independently on nodes across the network :

  • Independent verification of each transaction, by every full node, based on a comprehensive list of criteria
  • Independent aggregation of those transactions into new blocks by mining nodes, coupled with demonstrated computation through a proof-of-work algorithm
  • Independent verification of the new blocks by every node and assembly into a chain
  • Independent selection, by every node, of the chain with the most cumulative computation demonstrated through proof of work

In the next few sections we will examine these processes and how they interact to create the emergent property of network-wide consensus that allows any bitcoin node to assemble its own copy of the authoritative, trusted, public, global ledger.

Independent Verification of Transactions

In Chapter 5, we saw how wallet software creates transactions by collecting UTXO, providing the appropriate unlock scripts, and then constructing fresh outputs assigned to a new owner. The leave transaction is then sent to the neighboring nodes in the bitcoin network then that it can be propagated across the integral bitcoin network. however, before forwarding transactions to its neighbors, every bitcoin node that receives a transaction will first verify the transaction. This ensures that only valid transactions are propagated across the network, while invalid transactions are discarded at the first node that encounters them. Each node verifies every transaction against a long checklist of criteria :

  • The transaction’s syntax and data structure must be correct.
  • Neither lists of inputs or outputs are empty.
  • The transaction size in bytes is less than MAX_BLOCK_SIZE.
  • Each output value, as well as the total, must be within the allowed range of values (less than 21m coins, more than 0).
  • None of the inputs have hash=0, N=–1 (coinbase transactions should not be relayed).
  • nLockTime is less than or equal to INT_MAX.
  • The transaction size in bytes is greater than or equal to 100.
  • The number of signature operations contained in the transaction is less than the signature operation limit.
  • The unlocking script (scriptSig) can only push numbers on the stack, and the locking script (scriptPubkey) must match isStandard forms (this rejects “nonstandard” transactions).
  • A matching transaction in the pool, or in a block in the main branch, must exist.
  • For each input, if the referenced output exists in any other transaction in the pool, the transaction must be rejected.
  • For each input, look in the main branch and the transaction pool to find the referenced output transaction. If the output transaction is missing for any input, this will be an orphan transaction. Add to the orphan transactions pool, if a matching transaction is not already in the pool.
  • For each input, if the referenced output transaction is a coinbase output, it must have at least COINBASE_MATURITY (100) confirmations.
  • For each input, the referenced output must exist and cannot already be spent.
  • Using the referenced output transactions to get input values, check that each input value, as well as the sum, are in the allowed range of values (less than 21m coins, more than 0).
  • Reject if the sum of input values is less than sum of output values.
  • Reject if transaction fee would be too low to get into an empty block.
  • The unlocking scripts for each input must validate against the corresponding output locking scripts.

These conditions can be seen in detail in the functions AcceptToMemoryPool, CheckTransaction, and CheckInputs in the bitcoin reference client. note that the conditions change over clock time, to address new types of denial-of-service attacks or sometimes to relax the rules so as to include more types of transactions. By independently verifying each transaction as it is received and before propagating it, every node builds a pond of valid new transactions ( the transaction pool ), roughly in the same order.

Mining Nodes

Some of the nodes on the bitcoin net are specialized nodes called miners. In chapter 1 we introduced Jing, a computer engineering student in Shanghai, China, who is a bitcoin miner. Jing earns bitcoin by running a “ mining swindle, ” which is a specify computer-hardware system designed to mine bitcoins. Jing ’ s specialized mine hardware is connected to a server running a full bitcoin node. Unlike Jing, some miners mine without a full node, as we will see in Mining Pools. Like every other full node, Jing ’ mho node receives and propagates unconfirmed transactions on the bitcoin network. Jing ’ south node, however, besides aggregates these transactions into newfangled blocks. Jing ’ sulfur node is listening for new blocks, propagated on the bitcoin network, as do all nodes. however, the arrival of a new blocking has special significance for a mining node. The rival among miners effectively ends with the propagation of a newly auction block that acts as an announcement of a achiever. To miners, receiving a modern block means person else won the rival and they lost. however, the end of one round of a rival is besides the begin of the adjacent round. The new block is not good a check flag, marking the end of the race ; it is besides the starting pistol in the rush for the next jam.

Aggregating Transactions into Blocks

After validating transactions, a bitcoin node will add them to the memory consortium, or transaction pool, where transactions await until they can be included ( mined ) into a obstruct. Jing ’ randomness node collects, validates, and relays new transactions equitable like any other node. Unlike other nodes, however, Jing ’ second node will then aggregate these transactions into a campaigner jam. Let ’ s follow the blocks that were created during the time Alice bought a cup of coffee from Bob ’ sulfur Cafe ( see Buying a Cup of Coffee ). Alice ’ s transaction was included in block 277,316. For the function of demonstrating the concepts in this chapter, let ’ s assume that stuff was mined by Jing ’ randomness mining system and follow Alice ’ mho transaction as it becomes part of this new block. Jing ’ randomness mine node maintains a local copy of the blockchain, the list of all blocks created since the begin of the bitcoin arrangement in 2009. By the time Alice buys the cup of coffee, Jing ’ s node has assembled a chain up to block 277,314. Jing ’ mho node is listening for transactions, trying to mine a new block and besides listening for blocks discovered by other nodes. As Jing ’ second node is mining, it receives block 277,315 through the bitcoin network. The arrival of this block signifies the end of the competition for block 277,315 and the begin of the contest to create obstruct 277,316. During the former 10 minutes, while Jing ’ s lymph node was searching for a solution to block 277,315, it was besides collecting transactions in preparation for the following block. By now it has collected a few hundred transactions in the memory pool. Upon receiving block 277,315 and validating it, Jing ’ mho node will besides check all the transactions in the memory pool and remove any that were included in obstruct 277,315. Whatever transactions remain in the memory pond are unconfirmed and are waiting to be recorded in a newly barricade. Jing ’ randomness node immediately constructs a new empty auction block, a candidate for block 277,316. This engine block is called a candidate pulley because it is not yet a valid block, as it does not contain a valid proof of study. The obstruct becomes valid lone if the miner succeeds in finding a solution to the proof-of-work algorithm.

Transaction Age, Fees, and Priority

To construct the candidate jam, Jing ’ randomness bitcoin node selects transactions from the memory pool by applying a priority metric function to each transaction and adding the highest priority transactions first. Transactions are prioritized based on the “ age ” of the UTXO that is being spent in their inputs, allowing for old and high-value inputs to be prioritized over newer and smaller inputs. prioritize transactions can be sent without any fees, if there is enough space in the jam. The precedence of a transaction is calculated as the summarize of the respect and senesce of the inputs divided by the entire size of the transaction :

Priority = Sum (Value of input * Input Age) / Transaction Size

In this equation, the value of an input is measured in the base unit, satoshis ( 1/100m of a bitcoin ). The historic period of a UTXO is the number of blocks that have elapsed since the UTXO was recorded on the blockchain, measuring how many blocks “ deep ” into the blockchain it is. The size of the transaction is measured in bytes. For a transaction to be considered “ high precedence, ” its priority must be greater than 57,600,000, which corresponds to one bitcoin ( 100m satoshis ), aged one day ( 144 blocks ), in a transaction of 250 bytes total size :

High Priority > 100,000,000 satoshis * 144 blocks / 250 bytes = 57,600,000

The inaugural 50 kilobytes of transaction space in a block are set aside for high-priority transactions. Jing ’ mho node will fill the first 50 kilobytes, prioritizing the highest priority transactions foremost, careless of fee. This allows high-priority transactions to be processed even if they carry zero fees. Jing ’ second mining node then fills the rest of the barricade up to the maximum barricade size ( MAX_BLOCK_SIZE in the code ), with transactions that carry at least the minimal tip, prioritizing those with the highest fee per kilobyte of transaction. If there is any space remaining in the auction block, Jing ’ s mine node might choose to fill it with no-fee transactions. Some miners choose to mine transactions without fees on a best-effort basis. other miners may choose to ignore transactions without fees. Any transactions left in the memory consortium, after the parry is filled, will remain in the pool for inclusion in the next block. As transactions remain in the memory pool, their inputs “ long time, ” as the UTXO they spend get deeper into the blockchain with newly blocks added on circus tent. Because a transaction ’ sulfur priority depends on the age of its inputs, transactions remaining in the pool will old age and consequently increase in priority. finally a transaction without fees might reach a high enough precedence to be included in the block for release. Bitcoin transactions do not have an passing time-out. A transaction that is valid immediately will be valid in perpetuity. however, if a transaction is only propagated across the network once, it will persist only adenine long as it is held in a mining node memory consortium. When a mine node is restarted, its memory pool is wiped unclutter, because it is a transeunt non-persistent shape of storage. Although a valid transaction might have been propagated across the network, if it is not executed it may finally not reside in the memory consortium of any miner. Wallet software is expected to retransmit such transactions or reconstruct them with higher fees if they are not successfully executed within a fair total of time. When Jing ’ south node aggregates all the transactions from the memory pool, the raw candidate blockage has 418 transactions with full transaction fees of 0.09094928 bitcoin. You can see this obstruct in the blockchain using the Bitcoin Core customer command-line interface, as shown in Example 8-3 .

$ bitcoin-cli getblockhash 2773160000000000000001b6b9a13b095e96db41c4a928b97ef2d944a9b31b2cc7bdc4

$ bitcoin-cli getblock 0000000000000001b6b9a13b095e96db41c4a928b97ef2d944a9b31b2cc7bdc4

exercise 8-3. Block 277,316

    "hash" : "0000000000000001b6b9a13b095e96db41c4a928b97ef2d944a9b31b2cc7bdc4",
    "confirmations" : 35561,
    "size" : 218629,
    "height" : 277316,
    "version" : 2,
    "merkleroot" : "c91c008c26e50763e9f548bb8b2fc323735f73577effbc55502c51eb4cc7cf2e",
    "tx" : [

        ... 417 more transactions ...

    "time" : 1388185914,
    "nonce" : 924591752,
    "bits" : "1903a30c",
    "difficulty" : 1180923195.25802612,
    "chainwork" : "000000000000000000000000000000000000000000000934695e92aaf53afa1a",
    "previousblockhash" : "0000000000000002a7bbd25a417c0374cc55261021e8a9ca74442b01284f0569",
    "nextblockhash" : "000000000000000010236c269dd6ed714dd5db39d36b33959079d78dfd431ba7"

The Generation Transaction

The foremost transaction added to the block is a special transaction, called a genesis transaction or coinbase transaction. This transaction is constructed by Jing ’ sulfur node and is his reward for the mining campaign. Jing ’ mho lymph node creates the genesis transaction as a requital to his own wallet : “ Pay Jing ’ s address 25.09094928 bitcoin. ” The full total of honor that Jing collects for mining a obstruct is the sum of the coinbase advantage ( 25 modern bitcoins ) and the transaction fees ( 0.09094928 ) from all the transactions included in the stuff as shown in exemplar 8-4 :

$ bitcoin-cli getrawtransaction d5ada064c6417ca25c4308bd158c34b77e1c0eca2a73cda16c737e7424afba2f 1

case 8-4. Generation transaction

    "hex" : "01000000010000000000000000000000000000000000000000000000000000000000000000ffffffff0f03443b0403858402062f503253482fffffffff0110c08d9500000000232102aa970c592640d19de03ff6f329d6fd2eecb023263b9ba5d1b81c29b523da8b21ac00000000",
    "txid" : "d5ada064c6417ca25c4308bd158c34b77e1c0eca2a73cda16c737e7424afba2f",
    "version" : 1,
    "locktime" : 0,
    "vin" : [
            "coinbase" : "03443b0403858402062f503253482f",
            "sequence" : 4294967295
    "vout" : [
            "value" : 25.09094928,
            "n" : 0,
            "scriptPubKey" : {
                "asm" : "02aa970c592640d19de03ff6f329d6fd2eecb023263b9ba5d1b81c29b523da8b21OP_CHECKSIG",
                "hex" : "2102aa970c592640d19de03ff6f329d6fd2eecb023263b9ba5d1b81c29b523da8b21ac",
                "reqSigs" : 1,
                "type" : "pubkey",
                "addresses" : [
    "blockhash" : "0000000000000001b6b9a13b095e96db41c4a928b97ef2d944a9b31b2cc7bdc4",
    "confirmations" : 35566,
    "time" : 1388185914,
    "blocktime" : 1388185914

Unlike regular transactions, the genesis transaction does not consume ( spend ) UTXO as inputs. alternatively, it has merely one input signal, called the coinbase, which creates bitcoin from nothing. The generation transaction has one output, collectible to the miner ’ s own bitcoin address. The end product of the generation transaction sends the value of 25.09094928 bitcoins to the miner ’ s bitcoin address, in this subject 1MxTkeEP2PmHSMze5tUZ1hAV3YTKu2Gh1N.

Coinbase Reward and Fees

To construct the generation transaction, Jing ’ second node beginning calculates the total total of transaction fees by adding all the inputs and outputs of the 418 transactions that were added to the parry. The fees are calculated as :

Total Fees = Sum(Inputs) - Sum(Outputs)

In blockage 277,316, the entire transaction fees are 0.09094928 bitcoins. next, Jing ’ s node calculates the correct reward for the newly block. The honor is calculated based on the pulley acme, starting at 50 bitcoins per block and reduced by half every 210,000 blocks. Because this block is at acme 277,316, the right reward is 25 bitcoins. The calculation can be seen in function GetBlockValue in the Bitcoin Core customer, as shown in Example 8-5. model 8-5. Calculating the freeze reward—Function GetBlockValue, Bitcoin Core Client, main.cpp, line 1305

int64_t GetBlockValue(int nHeight, int64_t nFees)
    int64_t nSubsidy = 50 * COIN;
    int halvings = nHeight / Params().SubsidyHalvingInterval();

    // Force block reward to zero when right shift is undefined.
    if (halvings >= 64)
        return nFees;

    // Subsidy is cut in half every 210,000 blocks which will occur approximately every 4 years.
    nSubsidy >>= halvings;

    return nSubsidy + nFees;

The initial subsidy is calculated in satoshis by multiplying 50 with the COIN constant ( 100,000,000 satoshis ). This sets the initial reward ( nSubsidy ) at 5 billion satoshis. following, the officiate calculates the number of halvings that have occurred by dividing the stream block altitude by the halve interval ( SubsidyHalvingInterval ). In the case of block 277,316, with a halve interval every 210,000 blocks, the solution is 1 halve. The maximum number of halvings allowed is 64, so the code imposes a zero advantage ( return only the fees ) if the 64 halvings is exceeded. following, the function uses the binary-right-shift hustler to divide the advantage ( nSubsidy ) by two for each round of halving. In the encase of jam 277,316, this would binary-right-shift the reward of 5 billion satoshis once ( one halve ) and solution in 2.5 billion satoshis, or 25 bitcoins. The binary-right-shift operator is used because it is more efficient for division by two than integer or floating-point class. finally, the coinbase reward ( nSubsidy ) is added to the transaction fees ( nFees ), and the summarize is returned.

Structure of the Generation Transaction

With these calculations, Jing ’ mho node then constructs the generation transaction to pay himself 25.09094928 bitcoin. As you can see in Example 8-4, the generation transaction has a particular format. alternatively of a transaction input specifying a previous UTXO to spend, it has a “ coinbase ” input. We examined transaction inputs in table 5-3. Let ’ s compare a regular transaction remark with a generation transaction input signal. board 8-1 shows the social organization of a regular transaction, while board 8-2 shows the structure of the generation transaction ’ mho input signal. table 8-1. The structure of a “ normal ” transaction remark

Size Field Description
32 bytes transaction Hash cursor to the transaction containing the UTXO to be spent
4 bytes Output Index The index number of the UTXO to be spent, first base one is 0
1-9 bytes ( VarInt ) Unlocking-Script size Unlocking-Script distance in bytes, to follow
variable Unlocking-Script A handwriting that fulfills the conditions of the UTXO locking script .
4 bytes sequence Number presently disabled Tx-replacement sport, set to 0xFFFFFFFF

table 8-2. The structure of a coevals transaction input

Size Field Description
32 bytes transaction Hash All bits are zero : not a transaction hash reference
4 bytes Output Index All bits are ones : 0xFFFFFFFF
1-9 bytes ( VarInt ) Coinbase Data Size length of the coinbase data, from 2 to 100 bytes
variable Coinbase Data Arbitrary data used for extra time being and mine tags in v2 blocks, must begin with block height
4 bytes sequence Number Set to 0xFFFFFFFF

In a genesis transaction, the first two fields are set to values that do not represent a UTXO reference. rather of a “ Transaction Hash, ” the beginning field is filled with 32 bytes all set to zero. The “ Output Index ” is filled with 4 bytes all set to 0xFF ( 255 decimal ). The “ Unlocking Script ” is replaced by coinbase data, an arbitrary data field used by the miners.

Coinbase Data

Generation transactions do not have an unlock script ( alias, scriptSig ) field. rather, this discipline is replaced by coinbase data, which must be between 2 and 100 bytes. Except for the first few bytes, the pillow of the coinbase data can be used by miners in any way they want ; it is arbitrary data. In the genesis block, for model, Satoshi Nakamoto added the text “ The Times 03/Jan/2009 Chancellor on verge of second gear bailout for banks ” in the coinbase data, using it as a proof of the date and to convey a message. Currently, miners use the coinbase data to include supernumerary time being values and strings identifying the mining pool, as we will see in the following sections. The first few bytes of the coinbase used to be arbitrary, but that is nobelium long the casing. As per Bitcoin Improvement Proposal 34 ( BIP0034 ), version-2 blocks ( blocks with the translation playing field set to 2 ) must contain the barricade height index as a script “ advertise ” operation in the beginning of the coinbase field. In block 277,316 we see that the coinbase ( see Example 8-4 ), which is in the “ Unlocking Script ” or scriptSig plain of the transaction input, contains the hexadecimal value 03443b0403858402062f503253482f. Let ’ s decode this value. The beginning byte, 03, instructs the script execution engine to push the next three bytes onto the script stack ( see Table A-1 ). The next three bytes, 0x443b04, are the block stature encoded in little-endian format ( backward, least significant byte beginning ). Reverse the club of the bytes and the leave is 0x043b44, which is 277,316 in decimal. The adjacent few hexadecimal digits ( 03858402062 ) are used to encode an excess time being ( see The Extra Nonce Solution ), or random value, used to find a suitable proof of solve solution. The final separate of the coinbase data ( 2f503253482f ) is the ASCII-encoded string /P2SH/, which indicates that the mine node that mined this obstruct supports the pay-to-script-hash ( P2SH ) improvement defined in BIP0016. The introduction of the P2SH capability required a “ vote ” by miners to endorse either BIP0016 or BIP0017. Those endorsing the BIP0016 execution were to include /P2SH/ in their coinbase data. Those endorsing the BIP0017 execution of P2SH were to include the string p2sh/CHV in their coinbase data. The BIP0016 was elected as the achiever, and many miners continued including the drawstring /P2SH/ in their coinbase to indicate hold for this feature of speech. example 8-6 uses the libbitcoin library introduced in option Clients, Libraries, and Toolkits to extract the coinbase data from the genesis obstruct, displaying Satoshi ’ s message. note that the libbitcoin library contains a static copy of the genesis block, so the exemplar code can retrieve the genesis block directly from the library. exercise 8-6. Extract the coinbase data from the genesis block

  Display the genesis block message by Satoshi.

int main()
    // Create genesis block.
    bc::block_type block = bc::genesis_block();
    // Genesis block contains a single coinbase transaction.
    assert(block.transactions.size() == 1);
    // Get first transaction in block (coinbase).
    const bc::transaction_type& coinbase_tx = block.transactions[0];
    // Coinbase tx has a single input.
    assert(coinbase_tx.inputs.size() == 1);
    const bc::transaction_input_type& coinbase_input = coinbase_tx.inputs[0];
    // Convert the input script to its raw format.
    const bc::data_chunk& raw_message = save_script(coinbase_input.script);
    // Convert this to an std::string.
    std::string message;
    std::copy(raw_message.begin(), raw_message.end(), message.begin());
    // Display the genesis block message.
    std::cout << message << std::endl;
    return 0;

We compile the code with the GNU C++ compiler and run the resulting feasible, as shown in Example 8-7. model 8-7. Compiling and running the satoshi-words case code

$ # Compile the code
$  g++ -o satoshi-words satoshi-words.cpp $(pkg-config --cflags --libs libbitcoin)
$ # Run the executable
$ ./satoshi-words
^D��^A^DEThe Times 03/Jan/2009 Chancellor on brink of second bailout for banks

Constructing the Block Header

To construct the obstruct header, the mine node needs to fill in six fields, as listed in table 8-3. table 8-3. The structure of the block header

Size Field Description
4 bytes version A translation total to track software/protocol upgrades
32 bytes previous Block Hash A reference to the hash of the previous ( parent ) block in the chain
32 bytes Merkle Root A hash of the root of the merkle tree of this blocking ’ second transactions
4 bytes Timestamp The estimate creation clock time of this block ( seconds from Unix Epoch )
4 bytes difficulty aim The proof-of-work algorithm difficulty prey for this block

4 bytes time being A antagonistic used for the proof-of-work algorithm

At the time that block 277,316 was mined, the interpretation number describing the blocking structure is version 2, which is encoded in little-endian format in 4 bytes as 0x02000000. next, the mine node needs to add the “ Previous Block Hash. ” That is the hashish of the blocking header of block 277,315, the former stop received from the network, which Jing ’ s node has accepted and selected as the rear of the candidate block 277,316. The block heading hashish for pulley 277,315 is :


The adjacent tone is to summarize all the transactions with a merkle tree, in order to add the merkle root to the block heading. The generation transaction is listed as the foremost transaction in the block. then, 418 more transactions are added after it, for a total of 419 transactions in the obstruct. As we saw in the Merkle Trees, there must be an even number of “ leaf ” nodes in the tree, so the last transaction is duplicated, creating 420 nodes, each containing the hash of one transaction. The transaction hashes are then combined, in pairs, creating each level of the tree, until all the transactions are summarized into one node at the “ root ” of the tree. The root of the merkle corner summarizes all the transactions into a one 32-byte value, which you can see listed as “ merkle root ” in Example 8-3, and here :


The mining node will then add a 4-byte timestamp, encoded as a Unix “ Epoch ” timestamp, which is based on the number of seconds elapsed from January 1, 1970, midnight UTC/GMT. The time 1388185914 is equal to Friday, 27 Dec 2013, 23:11:54 UTC/GMT. The node then fills in the difficulty target, which defines the command proof-of-work trouble to make this a valid block. The difficulty is stored in the block as a “ trouble bits ” measured, which is a mantissa-exponent encoding of the target. The encoding has a 1-byte exponent, followed by a 3-byte mantissa ( coefficient ). In pulley 277,316, for case, the difficulty bits rate is 0x1903a30c. The first base part 0x19 is a hexadecimal exponent, while the following part, 0x03a30c, is the coefficient. The concept of a difficulty target is explained in Difficulty Target and Retargeting and the “ trouble bits ” representation is explained in Difficulty Representation. The concluding battlefield is the time being, which is initialized to zero. With all the other fields filled, the block header is now complete and the process of mining can begin. The goal is nowadays to find a measure for the time being that results in a block header hashish that is less than the difficulty target. The mine node will need to test billions or trillions of time being values before a time being is found that satisfies the necessity.

Mining the Block

now that a candidate stuff has been constructed by Jing ’ sulfur node, it is time for Jing ’ second hardware mining outfit to “ mine ” the block, to find a solution to the proof-of-work algorithm that makes the jam valid. Throughout this ledger we have studied cryptanalytic hash functions as used in versatile aspects of the bitcoin system. The hash function SHA256 is the affair used in bitcoin ’ mho mining process. In the simple terms, mine is the summons of hashing the block header repeatedly, changing one argument, until the resulting hash matches a specific aim. The hash function ’ s result can not be determined in advance, nor can a form be created that will produce a specific hashish value. This feature of hash functions means that the only means to produce a hashish solution matching a specific target is to try again and again, randomly modifying the input until the desire hash result appears by gamble.

Proof-Of-Work Algorithm

A hash algorithm takes an arbitrary-length datum input and produces a fixed-length deterministic result, a digital fingerprint of the remark. For any particular stimulation, the resulting hash will always be the lapp and can be easily calculated and verified by anyone implementing the lapp hashish algorithm. The key characteristic of a cryptanalytic hashish algorithm is that it is virtually impossible to find two different inputs that produce the lapp fingerprint. As a corollary, it is besides virtually impossible to select an input signal in such a way as to produce a desire fingerprint, other than trying random inputs. With SHA256, the output signal is always 256 bits long, careless of the size of the input. In example 8-8, we will use the Python interpreter to calculate the SHA256 hash of the phrase, “ I am Satoshi Nakamoto. ” exercise 8-8. SHA256 exemplar

$ python
Python 2.7.1
>>> import hashlib
>>> print hashlib.sha256("I am Satoshi Nakamoto").hexdigest()

example 8-8 shows the consequence of calculating the hash of "I am Satoshi Nakamoto" : 5d7c7ba21cbbcd75d14800b100252d5b428e5b1213d27c385bc141ca6b47989e. This 256-bit number is the hashish or digest of the phrase and depends on every part of the phrase. Adding a single letter, punctuation grade, or any other quality will produce a unlike hash. nowadays, if we change the give voice, we should expect to see wholly different hashes. Let ’ s test that by adding a act to the end of our phrase, using the simple Python script in Example 8-9. exemplar 8-9. SHA256 A script for generating many hashes by iterating on a time being

# example of iterating a nonce in a hashing algorithm's input

import hashlib

text = "I am Satoshi Nakamoto"

# iterate nonce from 0 to 19
for nonce in xrange(20):

    # add the nonce to the end of the text
    input = text + str(nonce)

    # calculate the SHA-256 hash of the input (text+nonce)
    hash = hashlib.sha256(input).hexdigest()

    # show the input and hash result
    print input, '=>',  hash

Running this will produce the hashes of respective phrases, made different by adding a total at the end of the text. By incrementing the number, we can get different hashes, as shown in Example 8-10. example 8-10. SHA256 output signal of a script for generating many hashes by iterating on a time being

$ python
I am Satoshi Nakamoto0 => a80a81401765c8eddee25df36728d732...
I am Satoshi Nakamoto1 => f7bc9a6304a4647bb41241a677b5345f...
I am Satoshi Nakamoto2 => ea758a8134b115298a1583ffb80ae629...
I am Satoshi Nakamoto3 => bfa9779618ff072c903d773de30c99bd...
I am Satoshi Nakamoto4 => bce8564de9a83c18c31944a66bde992f...
I am Satoshi Nakamoto5 => eb362c3cf3479be0a97a20163589038e...
I am Satoshi Nakamoto6 => 4a2fd48e3be420d0d28e202360cfbaba...
I am Satoshi Nakamoto7 => 790b5a1349a5f2b909bf74d0d166b17a...
I am Satoshi Nakamoto8 => 702c45e5b15aa54b625d68dd947f1597...
I am Satoshi Nakamoto9 => 7007cf7dd40f5e933cd89fff5b791ff0...
I am Satoshi Nakamoto10 => c2f38c81992f4614206a21537bd634a...
I am Satoshi Nakamoto11 => 7045da6ed8a914690f087690e1e8d66...
I am Satoshi Nakamoto12 => 60f01db30c1a0d4cbce2b4b22e88b9b...
I am Satoshi Nakamoto13 => 0ebc56d59a34f5082aaef3d66b37a66...
I am Satoshi Nakamoto14 => 27ead1ca85da66981fd9da01a8c6816...
I am Satoshi Nakamoto15 => 394809fb809c5f83ce97ab554a2812c...
I am Satoshi Nakamoto16 => 8fa4992219df33f50834465d3047429...
I am Satoshi Nakamoto17 => dca9b8b4f8d8e1521fa4eaa46f4f0cd...
I am Satoshi Nakamoto18 => 9989a401b2a3a318b01e9ca9a22b0f3...
I am Satoshi Nakamoto19 => cda56022ecb5b67b2bc93a2d764e75f...

Each phrase produces a wholly different hashish leave. They seem wholly random, but you can reproduce the exact results in this exemplar on any computer with Python and see the same claim hashes. The phone number used as a variable in such a scenario is called a time being. The time being is used to vary the output of a cryptanalytic serve, in this font to vary the SHA256 fingerprint of the phrase. To make a challenge out of this algorithm, let ’ s set an arbitrary prey : find a phrase that produces a hexadecimal hash that starts with a zero. fortunately, this international relations and security network ’ thyroxine difficult ! model 8-10 shows that the phrase “ I am Satoshi Nakamoto13 ” produces the hash 0ebc56d59a34f5082aaef3d66b37a661696c2b618e62432727216ba9531041a5, which fits our criteria. It took 13 attempts to find it. In terms of probabilities, if the output of the hash officiate is evenly distributed we would expect to find a result with a 0 as the hexadecimal prefix once every 16 hashes ( one out of 16 hexadecimal digits 0 through F ). In numeric terms, that means finding a hash value that is less than 0x1000000000000000000000000000000000000000000000000000000000000000. We call this threshold the aim and the goal is to find a hashish that is numerically less than the target. If we decrease the target, the tax of finding a hashish that is less than the target becomes more and more unmanageable. To give a elementary doctrine of analogy, imagine a game where players throw a copulate of dice repeatedly, trying to throw less than a stipulate aim. In the first round, the aim is 12. Unless you throw double-six, you win. In the following round off the target is 11. Players must throw 10 or less to win, again an easily job. Let ’ s say a few rounds later the target is down to 5. nowadays, more than half the die throws will add up to more than 5 and therefore be invalid. It takes exponentially more dice throws to win, the lower the target gets. finally, when the target is 2 ( the minimum potential ), entirely one throw out of every 36, or 2 % of them, will produce a winning resultant role. In Example 8-10, the winning “ time being ” is 13 and this result can be confirmed by anyone independently. Anyone can add the numeral 13 as a suffix to the phrase “ I am Satoshi Nakamoto ” and compute the hash, verifying that it is less than the prey. The successful result is besides proof of work, because it proves we did the work to find that time being. While it only takes one hash calculation to verify, it took us 13 hash computations to find a time being that worked. If we had a lower aim ( higher trouble ) it would take many more hash computations to find a desirable time being, but only one hashish calculation for anyone to verify. Furthermore, by knowing the target, anyone can estimate the difficulty using statistics and therefore know how much work was needed to find such a time being. Bitcoin ’ s proofread of solve is very similar to the challenge shown in Example 8-10. The miner constructs a campaigner auction block filled with transactions. Next, the miner calculates the hash of this block ’ s header and sees if it is smaller than the current target. If the hashish is not less than the aim, the miner will modify the time being ( normally equitable incrementing it by one ) and try again. At the current difficulty in the bitcoin net, miners have to try quadrillions of times before finding a time being that results in a low enough block header hashish. A identical simplify proof-of-work algorithm is implemented in Python in Example 8-11. case 8-11. Simplified proof-of-work execution

#!/usr/bin/env python
# example of proof-of-work algorithm

import hashlib
import time

max_nonce = 2 ** 32 # 4 billion

def proof_of_work(header, difficulty_bits):

    # calculate the difficulty target
    target = 2 ** (256-difficulty_bits)

    for nonce in xrange(max_nonce):
        hash_result = hashlib.sha256(str(header)+str(nonce)).hexdigest()

        # check if this is a valid result, below the target
        if long(hash_result, 16) < target:
            print "Success with nonce %d" % nonce
            print "Hash is %s" % hash_result
            return (hash_result,nonce)

    print "Failed after %d (max_nonce) tries" % nonce
    return nonce

if __name__ == '__main__':

    nonce = 0
    hash_result = ''

    # difficulty from 0 to 31 bits
    for difficulty_bits in xrange(32):

        difficulty = 2 ** difficulty_bits
        print "Difficulty: %ld (%d bits)" % (difficulty, difficulty_bits)

        print "Starting search..."

        # checkpoint the current time
        start_time = time.time()

        # make a new block which includes the hash from the previous block
        # we fake a block of transactions - just a string
        new_block = 'test block with transactions' + hash_result

        # find a valid nonce for the new block
        (hash_result, nonce) = proof_of_work(new_block, difficulty_bits)

        # checkpoint how long it took to find a result
        end_time = time.time()

        elapsed_time = end_time - start_time
        print "Elapsed Time: %.4f seconds" % elapsed_time

        if elapsed_time > 0:

            # estimate the hashes per second
            hash_power = float(long(nonce)/elapsed_time)
            print "Hashing Power: %ld hashes per second" % hash_power

Running this code, you can set the desire trouble ( in bits, how many of the leading bits must be zero ) and see how retentive it takes for your computer to find a solution. In example 8-12, you can see how it works on an average laptop. exemplar 8-12. Running the proof of work case for assorted difficulties

$ python*
Difficulty: 1 (0 bits)


Difficulty: 8 (3 bits)
Starting search...
Success with nonce 9
Hash is 1c1c105e65b47142f028a8f93ddf3dabb9260491bc64474738133ce5256cb3c1
Elapsed Time: 0.0004 seconds
Hashing Power: 25065 hashes per second
Difficulty: 16 (4 bits)
Starting search...
Success with nonce 25
Hash is 0f7becfd3bcd1a82e06663c97176add89e7cae0268de46f94e7e11bc3863e148
Elapsed Time: 0.0005 seconds
Hashing Power: 52507 hashes per second
Difficulty: 32 (5 bits)
Starting search...
Success with nonce 36
Hash is 029ae6e5004302a120630adcbb808452346ab1cf0b94c5189ba8bac1d47e7903
Elapsed Time: 0.0006 seconds
Hashing Power: 58164 hashes per second


Difficulty: 4194304 (22 bits)
Starting search...
Success with nonce 1759164
Hash is 0000008bb8f0e731f0496b8e530da984e85fb3cd2bd81882fe8ba3610b6cefc3
Elapsed Time: 13.3201 seconds
Hashing Power: 132068 hashes per second
Difficulty: 8388608 (23 bits)
Starting search...
Success with nonce 14214729
Hash is 000001408cf12dbd20fcba6372a223e098d58786c6ff93488a9f74f5df4df0a3
Elapsed Time: 110.1507 seconds
Hashing Power: 129048 hashes per second
Difficulty: 16777216 (24 bits)
Starting search...
Success with nonce 24586379
Hash is 0000002c3d6b370fccd699708d1b7cb4a94388595171366b944d68b2acce8b95
Elapsed Time: 195.2991 seconds
Hashing Power: 125890 hashes per second


Difficulty: 67108864 (26 bits)
Starting search...
Success with nonce 84561291
Hash is 0000001f0ea21e676b6dde5ad429b9d131a9f2b000802ab2f169cbca22b1e21a
Elapsed Time: 665.0949 seconds
Hashing Power: 127141 hashes per second

As you can see, increasing the difficulty by 1 act causes an exponential increase in the clock it takes to find a solution. If you think of the stallion 256-bit count space, each time you constrain one more moment to zero, you decrease the search space by half. In model 8-12, it takes 84 million hashish attempts to find a time being that produces a hash with 26 leading bits as zero. evening at a speed of more than 120,000 hashes per second, it silent requires 10 minutes on a consumer laptop to find this solution. At the clock of write, the net is attempting to find a block whose heading hash is less than 000000000000004c296e6376db3a241271f43fd3f5de7ba18986e517a243baa7. As you can see, there are a bunch of zero at the begin of that hashish, meaning that the acceptable image of hashes is much smaller, therefore it ’ s more unmanageable to find a valid hash. It will take on median more than 150 quadrillion hash calculations per second for the network to discover the adjacent block. That seems like an impossible tax, but fortunately the network is bringing 100 petahashes per second ( PH/sec ) of processing power to bear, which will be able to find a block in about 10 minutes on average.

Difficulty Representation

In Example 8-3, we saw that the obstruct contains the trouble target, in a notation called “ difficulty bits ” or barely “ bits, ” which in block 277,316 has the value of 0x1903a30c. This note expresses the trouble aim as a coefficient/exponent format, with the first two hexadecimal digits for the advocate and the following six hex digits as the coefficient. In this obstruct, therefore, the advocate is 0x19 and the coefficient is 0x03a30c. The formula to calculate the difficulty target from this representation is :

target = coefficient * 2^(8 * (exponent – 3))

Using that rule, and the difficulty bits value 0x1903a30c, we get :

target = 0x03a30c * 2^(0x08 * (0x19 - 0x03))^

=> target = 0x03a30c * 2^(0x08 * 0x16)^

=> target = 0x03a30c * 2^0xB0^

which in decimal is :

=> target = 238,348 * 2^176^

=> target = 22,829,202,948,393,929,850,749,706,076,701,368,331,072,452,018,388,575,715,328

switching rear to hexadecimal :

=> target = 0x0000000000000003A30C00000000000000000000000000000000000000000000

This means that a valid block for acme 277,316 is one that has a stop header hash that is less than the aim. In binary that number would have more than the first 60 bits set to zero. With this horizontal surface of difficulty, a unmarried miner processing 1 trillion hashes per second ( 1 tera-hash per irregular or 1 TH/sec ) would entirely find a solution once every 8,496 blocks or once every 59 days, on average.

Difficulty Target and Retargeting

As we saw, the target determines the difficulty and therefore affects how long it takes to find a solution to the proof-of-work algorithm. This leads to the obvious questions : Why is the difficulty adjustable, who adjusts it, and how ? Bitcoin ’ mho blocks are generated every 10 minutes, on average. This is bitcoin ’ randomness blink of an eye and underpins the frequency of currency issue and the speed of transaction village. It has to remain ceaseless not barely over the short term, but over a period of many decades. Over this time, it is expected that computer power will continue to increase at a rapid tempo. furthermore, the number of participants in mine and the computers they use will besides constantly deepen. To keep the block generation prison term at 10 minutes, the difficulty of mining must be adjusted to account for these changes. In fact, difficulty is a moral force parameter that will be sporadically adjusted to meet a 10-minute stuff target. In dim-witted terms, the difficulty target is set to whatever mining baron will result in a 10-minute block interval. How, then, is such an adaptation made in a wholly decentralized network ? difficulty retargeting occurs automatically and on every full lymph node independently. Every 2,016 blocks, all nodes retarget the proof-of-work trouble. The equation for retargeting difficulty measures the time it took to find the last 2,016 blocks and compares that to the expect time of 20,160 minutes ( two weeks based upon a coveted 10-minute block time ). The proportion between the actual timespan and desire timespan is calculated and a match adaptation ( up or down ) is made to the trouble. In simple terms : If the network is finding blocks faster than every 10 minutes, the trouble increases. If parry discovery is slower than expected, the difficulty decreases. The equality can be summarized as :

New Difficulty = Old Difficulty * (Actual Time of Last 2016 Blocks / 20160 minutes)

example 8-13 shows the code used in the Bitcoin Core customer. exemplar 8-13. Retargeting the proof-of-work difficulty—GetNextWorkRequired ( ) in pow.cpp, line 43

// Go back by what we want to be 14 days worth of blocks
const CBlockIndex* pindexFirst = pindexLast;
for (int i = 0; pindexFirst && i < Params().Interval()-1; i++)
    pindexFirst = pindexFirst->pprev;

// Limit adjustment step
int64_t nActualTimespan = pindexLast->GetBlockTime() - pindexFirst->GetBlockTime();
LogPrintf("  nActualTimespan = %d  before bounds\n", nActualTimespan);
if (nActualTimespan < Params().TargetTimespan()/4)
    nActualTimespan = Params().TargetTimespan()/4;
if (nActualTimespan > Params().TargetTimespan()*4)
    nActualTimespan = Params().TargetTimespan()*4;

// Retarget
uint256 bnNew;
uint256 bnOld;
bnOld = bnNew;
bnNew *= nActualTimespan;
bnNew /= Params().TargetTimespan();

if (bnNew > Params().ProofOfWorkLimit())
    bnNew = Params().ProofOfWorkLimit();

The parameters Interval ( 2,016 blocks ) and TargetTimespan ( two weeks as 1,209,600 seconds ) are defined in chainparams.cpp. To avoid extreme volatility in the trouble, the retargeting adaptation must be less than a agent of four ( 4 ) per bicycle. If the command difficulty adjustment is greater than a factor of four, it will be adjusted by the utmost and not more. Any promote adaptation will be accomplished in the next retargeting period because the asymmetry will persist through the next 2,016 blocks. consequently, large discrepancies between hashing might and difficulty might take several 2,016 block cycles to balance out .


The difficulty of finding a bitcoin stuff is approximately 10 minutes of serve for the entire network, based on the time it took to find the previous 2,016 blocks, adjusted every 2,016 blocks. note that the target trouble is independent of the number of transactions or the rate of transactions. This means that the sum of hashing power and consequently electricity expended to secure bitcoin is besides wholly independent of the numeral of transactions. Bitcoin can scale up, achieve broader adoption, and remain guarantee without any increase in hashing exponent from today ’ s flush. The increase in hashing office represents grocery store forces as newfangled miners enter the grocery store to compete for the reward. american samoa hanker as enough hash power is under the control of miners acting honestly in avocation of the wages, it is adequate to prevent “ coup d'etat ” attacks and, consequently, it is enough to secure bitcoin. The target difficulty is closely related to the cost of electricity and the exchange rate of bitcoin love seat the currentness used to pay for electricity. high-performance mining systems are about arsenic efficient as possible with the stream generation of silicon fabrication, converting electricity into hashing calculation at the highest rate possible. The chief influence on the mine grocery store is the price of one kilowatt-hour in bitcoin, because that determines the profitableness of mining and therefore the incentives to enter or exit the mining market.

Successfully Mining the Block

As we saw earlier, Jing ’ mho node has constructed a candidate block and prepared it for mining. Jing has several hardware mining rigs with application-specific desegregate circuits, where hundreds of thousands of integrate circuits run the SHA256 algorithm in parallel at incredible speeds. These specify machines are connected to his mine node over USB. Next, the mine node running on Jing ’ s desktop transmits the obstruct header to his mining hardware, which starts testing trillions of nonces per second. about 11 minutes after starting to mine blockage 277,316, one of the hardware mining machines finds a solution and sends it back to the mine node. When inserted into the block header, the time being 4,215,469,401 produces a obstruct hash of :


which is less than the target :


immediately, Jing ’ randomness mining node transmits the freeze to all its peers. They receive, validate, and then propagate the new obstruct. As the block ripples out across the network, each node adds it to its own copy of the blockchain, extending it to a new acme of 277,316 blocks. As mine nodes receive and validate the block, they abandon their efforts to find a block at the same stature and immediately start computing the next block in the range. In the future section, we ’ ll look at the process each node uses to validate a blocking and select the longest chain, creating the consensus that forms the decentralize blockchain.

Validating a New Block

The third dance step in bitcoin ’ s consensus mechanism is autonomous establishment of each newly block by every node on the network. As the newly solved block moves across the network, each node performs a series of tests to validate it before propagating it to its peers. This ensures that only valid blocks are propagated on the network. The mugwump validation besides ensures that miners who act honestly get their blocks incorporated in the blockchain, thus earning the reward. Those miners who act dishonestly have their blocks rejected and not only lose the reward, but besides waste the campaign expended to find a proof-of-work solution, frankincense incurring the cost of electricity without compensation. When a node receives a new forget, it will validate the block by checking it against a farseeing list of criteria that must all be met ; differently, the block is rejected. These criteria can be seen in the Bitcoin Core node in the functions CheckBlock and CheckBlockHeader and include :

  • The block data structure is syntactically valid
  • The block header hash is less than the target difficulty (enforces the proof of work)
  • The block timestamp is less than two hours in the future (allowing for time errors)
  • The block size is within acceptable limits
  • The first transaction (and only the first) is a coinbase generation transaction
  • All transactions within the block are valid using the transaction checklist discussed in Independent Verification of Transactions

The freelancer establishment of each new block by every node on the network ensures that the miners can ’ thymine chess. In previous sections we saw how the miners get to write a transaction that awards them the newly bitcoins created within the block and claim the transaction fees. Why don ’ metric ton miners write themselves a transaction for a thousand bitcoin rather of the correct advantage ? Because every node validates blocks according to the same rules. An invalid coinbase transaction would make the integral block invalid, which would result in the pulley being rejected and, therefore, that transaction would never become part of the ledger. The miners have to construct a arrant blocking, based on the shared rules that all nodes follow, and mine it with a correct solution to the proof of work. To do so, they expend a distribute of electricity in mine, and if they cheat, all the electricity and attempt is wasted. This is why freelancer validation is a key component of decentralize consensus.

Assembling and Selecting Chains of Blocks

The final step in bitcoin ’ s decentralized consensus mechanism is the fabrication of blocks into chains and the choice of the chain with the most validation of oeuvre. once a node has validated a new blockage, it will then attempt to assemble a chain by connecting the forget to the existing blockchain. Nodes maintain three sets of blocks : those connected to the chief blockchain, those that form branches off the main blockchain ( secondary chains ), and finally, blocks that do not have a known rear in the acknowledge chains ( orphans ). disable blocks are rejected vitamin a soon as any one of the validation criteria fails and are therefore not included in any chain. The “ independent chain ” at any time is whichever range of blocks has the most accumulative trouble associated with it. Under most circumstances this is besides the chain with the most blocks in it, unless there are two equal-length chains and one has more validation of work. The independent chain will besides have branches with blocks that are “ siblings ” to the blocks on the main chain. These blocks are valid but not part of the main chain. They are kept for future reference book, in case one of those chains is extended to exceed the chief chain in difficulty. In the following section ( Blockchain Forks ), we will see how secondary coil chains occur as a consequence of an about coincident mine of blocks at the lapp acme. When a newfangled block is received, a node will try to slot it into the existing blockchain. The node will look at the barricade ’ south “ former block hashish ” field, which is the reference book to the newfangled obstruct ’ south parent. then, the lymph node will attempt to find that rear in the existing blockchain. Most of the time, the parent will be the “ tip ” of the chief chain, meaning this new stop extends the main chain. For exercise, the raw engine block 277,316 has a reference to the hash of its parent parry 277,315. Most nodes that receive 277,316 will already have obstruct 277,315 as the tip of their main chain and will therefore link the new stuff and exsert that range. sometimes, as we will see in Blockchain Forks, the raw freeze extends a chain that is not the independent chain. In that case, the node will attach the new block to the junior-grade chain it extends and then compare the trouble of the secondary chain to the main chain. If the secondary chain has more accumulative difficulty than the independent chain, the node will reconverge on the secondary chain, meaning it will select the secondary chain as its new main chain, making the old independent range a secondary chain. If the lymph node is a miner, it will now construct a block extending this raw, longer, chain. If a valid barricade is received and no parent is found in the existing chains, that stop is considered an “ orphan. ” Orphan blocks are saved in the orphan block pool where they will stay until their parent is received. Once the parent is received and linked into the existing chains, the orphan can be pulled out of the orphan pool and linked to the parent, making it character of a chain. Orphan blocks normally occur when two blocks that were mined within a short clock time of each early are received in reverse rate ( child before parent ). By selecting the greatest-difficulty chain, all nodes finally achieve network-wide consensus. temp discrepancies between chains are resolved finally as more proof of work is added, extending one of the possible chains. Mining nodes “ right to vote ” with their mining power by choosing which chain to extend by mining the adjacent obstruct. When they mine a newly block and extend the chain, the new block itself represents their vote. In the adjacent section we will look at how discrepancies between competing chains ( forks ) are resolved by the independent excerpt of the longest difficulty chain.

Blockchain Forks

Because the blockchain is a decentralized data structure, unlike copies of it are not always consistent. Blocks might arrive at unlike nodes at different times, causing the nodes to have different perspectives of the blockchain. To resolve this, each node constantly selects and attempts to extend the chain of blocks that represents the most proof of bring, besides known as the longest chain or greatest accumulative trouble chain. By summing the trouble recorded in each block in a chain, a node can calculate the entire amount of proof of workplace that has been expended to create that chain. arsenic long as all nodes select the longest accumulative difficulty chain, the global bitcoin network finally converges to a reproducible department of state. Forks occur as irregular inconsistencies between versions of the blockchain, which are resolved by eventual reconvergence as more blocks are added to one of the forks. In the future few diagrams, we follow the progress of a “ pitchfork ” event across the network. The diagram is a simplified representation of bitcoin as a ball-shaped network. In reality, the bitcoin network ’ south topology is not organized geographically. quite, it forms a net network of interconnected nodes, which might be located very far from each other geographically. The representation of a geographic regional anatomy is a reduction used for the purposes of illustrating a pitchfork. In the real bitcoin network, the “ distance ” between nodes is measured in “ hops ” from node to node, not on their forcible localization. For exemplification purposes, different blocks are shown as different colors, spreading across the network and coloring the connections they traverse. In the first diagram ( Figure 8-2 ), the network has a unite position of the blockchain, with the blue block as the tip of the independent chain .globalfork1 design 8-2. visual image of a blockchain fork event—before the fork A “ branch ” occurs whenever there are two campaigner blocks competing to form the longest blockchain. This occurs under normal conditions whenever two miners solve the proof-of-work algorithm within a shortstop period of fourth dimension from each early. As both miners discover a solution for their respective candidate blocks, they immediately broadcast their own “ winning ” block to their contiguous neighbors who begin propagating the stop across the network. Each node that receives a valid block will incorporate it into its blockchain, extending the blockchain by one obstruct. If that node belated sees another candidate forget extending the lapp rear, it connects the second base candidate on a secondary chain. As a resultant role, some nodes will “ see ” one campaigner block first, while other nodes will see the other candidate block and two competing versions of the blockchain will emerge. In Figure 8-3, we see two miners who mine two different blocks about simultaneously. Both of these blocks are children of the blue block, mean to extend the chain by building on top of the bluing parry. To help us track it, one is visualized as a bolshevik stuff originating from Canada, and the early is marked as a green block originating from Australia .globalfork2 figure 8-3. visual image of a blockchain fork consequence : two blocks found simultaneously Let ’ s assume, for exercise, that a miner in Canada finds a proof-of-work solution for a block “ red ” that extends the blockchain, building on crown of the parent obstruct “ blue. ” Almost simultaneously, an australian miner who was besides extending block “ blue ” finds a solution for block “ green, ” his candidate barricade. now, there are two possible blocks, one we call “ crimson, ” originating in Canada, and one we call “ green, ” originating in Australia. Both blocks are valid, both blocks contain a valid solution to the proof of ferment, and both blocks extend the lapp parent. Both blocks likely contain most of the lapp transactions, with only possibly a few differences in the order of transactions. As the two blocks propagate, some nodes receive block “ red ” first gear and some get block “ park ” first gear. As shown in Figure 8-4, the network splits into two different perspectives of the blockchain, one side topped with a red barricade, the other with a k blockage .globalfork3 figure 8-4. visual image of a blockchain fork consequence : two blocks propagate, splitting the network From that moment, the bitcoin network nodes closest ( topologically, not geographically ) to the canadian node will hear about pulley “ red ” beginning and will create a modern greatest-cumulative-difficulty blockchain with “ red ” as the final block in the chain ( for example, blue-red ), ignoring the candidate barricade “ green ” that arrives a moment late. meanwhile, nodes closer to the australian lymph node will take that block as the winner and extend the blockchain with “ fleeceable ” as the last freeze ( for example, bluish green ), ignoring “ bolshevik ” when it arrives a few seconds by and by. Any miners that saw “ crimson ” beginning will immediately build campaigner blocks that reference “ loss ” as the rear and start trying to solve the proof of bring for these candidate blocks. The miners that accepted “ greens ” alternatively will start build up on top of “ green ” and extending that range. Forks are about always resolved within one block. As separate of the network ’ mho hashing power is dedicated to building on top of “ red ” as the parent, another part of the hashing power is focused on building on peak of “ green. ” even if the hashing might is about evenly split, it is likely that one determine of miners will find a solution and propagate it before the other hardened of miners have found any solutions. Let ’ s say, for case, that the miners building on peak of “ green ” find a newly stop “ pink ” that extends the chain ( for example, blue-green-pink ). They immediately propagate this raw block and the entire network sees it as a valid solution as shown in Figure 8-5 .globalfork4 visualize 8-5. visual image of a blockchain branch consequence : a new block extends one crotch All nodes that had chosen “ park ” as the winner in the former round will merely extend the chain one more freeze. The nodes that chose “ red ” as the achiever, however, will nowadays see two chains : blue-green-pink and blue-red. The chain blue-green-pink is now longer ( more accumulative difficulty ) than the chain blue-red. As a leave, those nodes will set the chain blue-green-pink as main chain and change the blue-red chain to being a secondary chain, as shown in Figure 8-6. This is a chain reconvergence, because those nodes are forced to revise their horizon of the blockchain to incorporate the new evidence of a longer range. Any miners working on extending the chain blue-red will now stop that influence because their candidate stuff is an “ orphan, ” as its rear “ crimson ” is no longer on the longest chain. The transactions within “ loss ” are queued up again for process in the future blockage, because that stuff is no longer in the main chain. The entire network re-converges on a unmarried blockchain blue-green-pink, with “ pink ” as the last block in the chain. All miners immediately start working on candidate blocks that reference “ pink ” as their rear to extend the blue-green-pink chain .globalfork5 name 8-6. visual image of a blockchain fork event : the net reconverges on a newfangled farseeing chain It is theoretically possible for a crotch to extend to two blocks, if two blocks are found about simultaneously by miners on antonym “ sides ” of a previous fork. however, the prospect of that happening is very humble. Whereas a one-block branch might occur every week, a two-block fork is extremely rare. Bitcoin ’ randomness block interval of 10 minutes is a design compromise between debauched confirmation times ( village of transactions ) and the probability of a fork. A faster stuff time would make transactions clear faster but lead to more frequent blockchain forks, whereas a slower block time would decrease the number of forks but make colonization slower.

Mining and the Hashing Race

Bitcoin mine is an highly competitive industry. The hashing baron has increased exponentially every class of bitcoin ’ s universe. Some years the growth has reflected a complete change of technology, such as in 2010 and 2011 when many miners switched from using CPU mining to GPU mining and field programmable gate range ( FPGA ) mine. In 2013 the introduction of ASIC mining lead to another giant star jump in mining power, by placing the SHA256 function immediately on silicon chips specialized for the purpose of mining. The first such chips could deliver more mine power in a single box than the entire bitcoin network in 2010. The be tilt shows the entire hashing ability of the bitcoin network, over the first five years of operation :

0.5 MH/sec–8 MH/sec (16× growth)
8 MH/sec–116 GH/sec (14,500× growth)
16 GH/sec–9 TH/sec (562× growth)
9 TH/sec–23 TH/sec (2.5× growth)
23 TH/sec–10 PH/sec (450× growth)
10 PH/sec–150 PH/sec in August (15× growth)

In the chart in Figure 8-7, we see the bitcoin network ’ s hashing power addition over the past two years. As you can see, the contest between miners and the growth of bitcoin has resulted in an exponential addition in the hashing ability ( sum hashes per second across the network ) .NetworkHashingRate figure 8-7. full hashing power, gigahashes per second, over two years As the amount of hashing might applied to mining bitcoin has exploded, the difficulty has risen to match it. The difficulty system of measurement in the graph shown in Figure 8-8 is measured as a ratio of current trouble over minimum difficulty ( the trouble of the first block ) .BitcoinDifficulty figure 8-8. Bitcoin ’ s mining difficulty metric, over two years In the final two years, the ASIC mine chips have become increasingly denser, approaching the cutting edge of silicon lying with a feature size ( resolving power ) of 22 nanometers ( new mexico ). presently, ASIC manufacturers are aiming to overtake general-purpose CPU check manufacturers, designing chips with a feature size of 16nm, because the profitableness of mining is driving this diligence even faster than cosmopolitan computing. There are no more elephantine jump left in bitcoin mining, because the industry has reached the forefront of Moore ’ second Law, which stipulates that computing concentration will double approximately every 18 months. still, the mining baron of the network continues to advance at an exponential pace as the race for higher concentration chips is matched with a raceway for higher concentration data centers where thousands of these chips can be deployed. It ’ south no longer about how much mining can be done with one chip, but how many chips can be squeezed into a build, while even dissipating the heat and providing adequate power.

The Extra Nonce Solution

Since 2012, bitcoin mine has evolved to resolve a fundamental limitation in the structure of the engine block header. In the early days of bitcoin, a miner could find a blockage by iterating through the time being until the resulting hash was below the prey. As trouble increased, miners much cycled through all 4 billion values of the time being without finding a obstruct. however, this was easily resolved by updating the block timestamp to account for the elapse clock. Because the timestamp is contribution of the heading, the transfer would allow miners to iterate through the values of the time being again with different results. once mining hardware exceeded 4 GH/sec, however, this border on became increasingly difficult because the time being values were exhausted in less than a moment. As ASIC mining equipment started pushing and then exceeding the TH/sec hash rate, the mining software needed more space for time being values in ordering to find valid blocks. The timestamp could be stretched a bit, but moving it excessively far into the future would cause the block to become invalid. A new reference of “ change ” was needed in the pulley header. The solution was to use the coinbase transaction as a generator of supernumerary time being values. Because the coinbase script can store between 2 and 100 bytes of data, miners started using that space as extra time being distance, allowing them to explore a much larger range of freeze header values to find valid blocks. The coinbase transaction is included in the merkle tree, which means that any switch in the coinbase script causes the merkle solution to change. Eight bytes of extra time being, plus the 4 bytes of “ standard ” time being allow miners to explore a total 296 ( 8 followed by 28 zeros ) possibilities per second without having to modify the timestamp. If, in the future, miners could run through all these possibilities, they could then modify the timestamp. There is besides more space in the coinbase script for future expansion of the supernumerary time being distance.

Mining Pools

In this highly competitive environment, individual miners working alone ( besides known as solo miners ) don ’ thymine stand a probability. The likelihood of them finding a block to offset their electricity and hardware costs is thus gloomy that it represents a gamble, like playing the lottery. even the fastest consumer ASIC mine system can not keep up with commercial systems that stack tens of thousands of these chips in elephantine warehouses near hydro-electric power stations. Miners nowadays collaborate to form mining pools, pooling their hash might and sharing the reward among thousands of participants. By participating in a pool, miners get a smaller share of the overall wages, but typically get reward every day, reducing doubt. Let ’ s front at a specific case. Assume a miner has purchased mining hardware with a compound hash rate of 6,000 gigahashes per second ( GH/s ), or 6 TH/s. In August of 2014 this equipment costs approximately $ 10,000. The hardware consumes 3 kilowatt ( kilowatt ) of electricity when run, 72 kW-hours a day, at a monetary value of $ 7 or $ 8 per day on average. At current bitcoin difficulty, the miner will be able to solo mine a stop approximately once every 155 days, or every 5 months. If the miner does find a single auction block in that timeframe, the payout of 25 bitcoins, at approximately $ 600 per bitcoin, will result in a single payout of $ 15,000, which will cover the entire monetary value of the hardware and the electricity consumed over the time time period, leaving a net profit of approximately $ 3,000. however, the probability of finding a forget in a five-month menstruation depends on the miner ’ s luck. He might find two blocks in five months and make a very big profit. Or he might not find a engine block for 10 months and suffer a fiscal personnel casualty. even worse, the difficulty of the bitcoin proof-of-work algorithm is likely to go up importantly over that period, at the stream rate of increase of hashing might, meaning the miner has, at most, six months to break even before the hardware is efficaciously disused and must be replaced by more herculean mine hardware. If this miner participates in a mine pool, alternatively of waiting for a once-in-five-months $ 15,000 windfall, he will be able to earn approximately $ 500 to $ 750 per workweek. The regular payouts from a mining pool will help him amortize the cost of hardware and electricity over clock without taking an enormous hazard. The hardware will still be disused in six to nine months and the risk is still high, but the gross is at least regular and dependable over that time period. mine pools coordinate many hundreds or thousands of miners, over specialize pool-mining protocols. The individual miners configure their mine equipment to connect to a pond server, after creating an report with the pool. Their mining hardware remains connected to the pool server while mine, synchronizing their efforts with the other miners. therefore, the pool miners plowshare the campaign to mine a block and then share in the rewards. successful blocks pay the reward to a consortium bitcoin address, rather than individual miners. The pool server will sporadically make payments to the miners ’ bitcoin addresses, once their parcel of the rewards has reached a certain doorway. typically, the pool server charges a percentage tip of the rewards for providing the pool-mining overhaul. Miners participating in a pool split the oeuvre of searching for a solution to a candidate block, earning “ shares ” for their mine contribution. The mining pool sets a lower difficulty target for earning a share, typically more than 1,000 times easier than the bitcoin network ’ s difficulty. When person in the pool successfully mines a barricade, the wages is earned by the pool and then shared with all miners in proportion to the count of shares they contributed to the effort. Pools are open to any miner, adult or little, professional or amateur. A pool will therefore have some participants with a unmarried humble mine machine, and others with a garage full of high-end mine hardware. Some will be mining with a few tens of a kilowatt of electricity, others will be running a datum center field consuming a megawatt of power. How does a mining pool bill the person contributions, sol as to fairly distribute the rewards, without the possibility of cheating ? The suffice is to use bitcoin ’ s proof-of-work algorithm to measure each pond miner ’ sulfur contribution, but set at a lower difficulty so that even the smallest pond miners win a share frequently adequate to make it worthwhile to contribute to the pool. By setting a lower difficulty for earning shares, the pool measures the total of workplace done by each miner. Each clock a pool miner finds a block header hash that is less than the pool difficulty, she proves she has done the hash oeuvre to find that consequence. More importantly, the make to find shares contributes, in a statistically measurable way, to the overall effort to find a hash lower than the bitcoin network ’ second target. Thousands of miners trying to find low-value hashes will finally find one low enough to satisfy the bitcoin network target. Let ’ s revert to the analogy of a die bet on. If the cube players are throwing die with a finish of throwing less than four ( the overall net trouble ), a pool would set an easier target, counting how many times the pond players managed to throw less than eight. When pool players throw less than eight ( the pool share aim ), they earn shares, but they don ’ metric ton win the game because they don ’ t achieve the game prey ( less than four ). The pool players will achieve the easier pool target much more much, earning them shares identical regularly, evening when they don ’ metric ton achieve the harder prey of winning the game. Every now and then, one of the pool players will throw a combined cube project of less than four and the consortium wins. then, the earnings can be distributed to the pool players based on the shares they earned. even though the prey of eight-or-less wasn ’ t winning, it was a fair way to measure dice throws for the players, and it occasionally produces a less-than-four throw. similarly, a mine pool will set a pool difficulty that will ensure that an individual pool miner can find stuff header hashes that are less than the pool trouble quite much, earning shares. Every now and then, one of these attempts will produce a jam header hash that is less than the bitcoin network target, making it a valid block and the whole pool wins.

Managed pools

Most mine pools are “ managed, ” meaning that there is a company or individual running a pool server. The owner of the pool server is called the pool operator, and he charges pool miners a percentage fee of the earnings. The pool server runs specialized software and a pool-mining protocol that coordinates the activities of the pool miners. The pool server is besides connected to one or more entire bitcoin nodes and has address access to a wax copy of the blockchain database. This allows the pool server to validate blocks and transactions on behalf of the pool miners, relieving them of the effect of running a full node. For pool miners, this is an significant circumstance, because a full lymph node requires a dedicate calculator with at least 15 to 20 GB of persistent storage ( magnetic disk ) and at least 2 GB of memory ( RAM ). Furthermore, the bitcoin software running on the full node needs to be monitored, maintained, and upgraded frequently. Any downtime caused by a lack of alimony or miss of resources will hurt the miner ’ sulfur profitableness. For many miners, the ability to mine without running a full node is another adult profit of joining a oversee pool. consortium miners connect to the pool server using a mining protocol such as Stratum ( STM ) or GetBlockTemplate ( GBT ). An older standard called GetWork ( GWK ) has been by and large disused since deep 2012, because it does not well support mine at hash rates above 4 GH/s. Both the STM and GBT protocols create stop templates that contain a template of a campaigner freeze header. The pool server constructs a candidate block by aggregating transactions, adding a coinbase transaction ( with excess time being quad ), calculating the merkle root, and linking to the previous block hashish. The header of the candidate stop is then sent to each of the pool miners as a template. Each pool miner then mines using the block template, at a lower difficulty than the bitcoin network trouble, and sends any successful results back to the pool server to earn shares.


Managed pools create the possibility of cheating by the pool operator, who might direct the pool feat to double-spend transactions or invalidate blocks ( see Consensus Attacks ). Furthermore, centralized pond servers represent a single-point-of-failure. If the pool server is depressed or is slowed by a denial-of-service attack, the pool miners can not mine. In 2011, to resolve these issues of centralization, a new pool mine method acting was proposed and implemented : P2Pool is a peer-to-peer mine pool, without a cardinal operator. P2Pool works by decentralizing the functions of the pond server, implementing a twin blockchain-like system called a share range. A share chain is a blockchain running at a lower difficulty than the bitcoin blockchain. The partake chain allows pool miners to collaborate in a decentralize pool, by mining shares on the share chain at a rate of one partake block every 30 seconds. Each of the blocks on the share chain records a harmonious parcel reward for the pool miners who contribute work, carrying the shares advancing from the previous share block. When one of the share blocks besides achieves the difficulty aim of the bitcoin network, it is propagated and included on the bitcoin blockchain, rewarding all the pool miners who contributed to all the shares that preceded the winning share block. basically, alternatively of a pool server keeping track of pool miner shares and rewards, the parcel chain allows all pool miners to keep traverse of all shares using a decentralized consensus mechanism like bitcoin ’ sulfur blockchain consensus mechanism. P2Pool mining is more complex than pool mining because it requires that the pond miners run a give calculator with adequate harrow space, memory, and Internet bandwidth to support a full bitcoin node and the P2Pool node software. P2Pool miners connect their mine hardware to their local P2Pool node, which simulates the functions of a pool waiter by sending block templates to the mine hardware. On P2Pool, individual pool miners construct their own candidate blocks, aggregating transactions a lot like solo miners, but then mine collaboratively on the contribution chain. P2Pool is a hybrid set about that has the advantage of much more chondritic payouts than solo mining, but without giving excessively much control to a pool operator like managed pools. recently, participation in P2Pool has increased importantly as mining assiduity in mining pools has approached levels that create concerns of a 51 % attack ( see Consensus Attacks ). Further growth of the P2Pool protocol continues with the expectation of removing the motivation for running a wax node and therefore making decentralized mining even easier to use.

Consensus Attacks

Bitcoin ’ s consensus mechanism is, at least theoretically, vulnerable to attack by miners ( or pools ) that attempt to use their hashing power to dishonest or destructive ends. As we saw, the consensus mechanism depends on having a majority of the miners acting honestly out of egoism. however, if a miner or group of miners can achieve a meaning contribution of the mining world power, they can attack the consensus mechanism sol as to disrupt the security system and handiness of the bitcoin network. It is important to note that consensus attacks can lone affect future consensus, or at best the most holocene by ( tens of blocks ). Bitcoin ’ south ledger becomes more and more immutable as time passes. While in theory, a fork can be achieved at any depth, in practice, the computing exponent needed to force a identical deep crotch is huge, making old blocks practically immutable. consensus attacks besides do not affect the security of the secret keys and signing algorithm ( ECDSA ). A consensus attack can not steal bitcoins, spend bitcoins without signatures, redirect bitcoins, or otherwise change past transactions or ownership records. consensus attacks can entirely affect the most holocene blocks and cause denial-of-service disruptions on the initiation of future blocks. One attack scenario against the consensus mechanism is called the “ 51 % attack. ” In this scenario a group of miners, controlling a majority ( 51 % ) of the total network ’ south hashing exponent, conspire to attack bitcoin. With the ability to mine the majority of the blocks, the attacking miners can cause consider “ forks ” in the blockchain and double-spend transactions or execute denial-of-service attacks against specific transactions or addresses. A fork/double-spend attack is one where the attacker causes previously confirmed blocks to be invalidated by forking below them and re-converging on an alternate chain. With sufficient power, an attacker can invalidate six or more blocks in a row, causing transactions that were considered immutable ( six confirmations ) to be invalidated. note that a double-spend can only be done on the attacker ’ s own transactions, for which the attacker can produce a valid signature. Double-spending one ’ s own transactions is profitable if by invalidating a transaction the attacker can get a nonreversible exchange requital or product without paying for it. Let ’ s examine a practical example of a 51 % attack. In the first chapter, we looked at a transaction between Alice and Bob for a cup of chocolate. Bob, the cafe owner, is will to accept payment for cups of chocolate without waiting for confirmation ( mining in a block ), because the risk of a double-spend on a cup of coffee is depleted in comparison to the convenience of rapid customer service. This is like to the practice of coffee bean shops that accept credit card payments without a signature for amounts below $ 25, because the gamble of a credit-card chargeback is depleted while the monetary value of delaying the transaction to obtain a touch is relatively larger. In contrast, selling a more expensive item for bitcoin runs the risk of a double-spend attack, where the buyer broadcasts a competing transaction that spends the same inputs ( UTXO ) and cancels the payment to the merchant. A double-spend attack can happen in two ways : either before a transaction is confirmed, or if the attacker takes advantage of a blockchain fork to undo several blocks. A 51 % attack allows attackers to double-spend their own transactions in the modern chain, thus undoing the equate transaction in the old chain. In our example, malicious attacker Mallory goes to Carol ’ randomness gallery and purchases a beautiful triptych painting depicting Satoshi Nakamoto as Prometheus. Carol sells “ The Great Fire ” paintings for $ 250,000 in bitcoin, to Mallory. alternatively of waiting for six or more confirmations on the transaction, Carol wraps and hands the paintings to Mallory after only one confirmation. Mallory works with an accomplice, Paul, who operates a large mine pool, and the accomplice launches a 51 % attack ampere soon as Mallory ’ mho transaction is included in a block. Paul directs the mine pond to re-mine the same block height as the block containing Mallory ’ mho transaction, replacing Mallory ’ second requital to Carol with a transaction that double-spends the lapp stimulation as Mallory ’ sulfur requital. The double-spend transaction consumes the same UTXO and pays it back to Mallory ’ sulfur wallet, alternatively of paying it to Carol, basically allowing Mallory to keep the bitcoin. Paul then directs the mining pool to mine an extra block, so as to make the chain containing the double-spend transaction longer than the original chain ( causing a fork below the pulley containing Mallory ’ south transaction ). When the blockchain fork resolves in favor of the newfangled ( longer ) chain, the double-spent transaction replaces the master requital to Carol. Carol is now missing the three paintings and besides has no bitcoin requital. Throughout all this bodily process, Paul ’ mho mining pond participants might remain blissfully unaware of the double-spend attack, because they mine with automated miners and can not monitor every transaction or block. To protect against this kind of attack, a merchant selling large-value items must wait at least six confirmations before giving the product to the buyer. alternatively, the merchant should use an escrow multi-signature explanation, again waiting for several confirmations after the escrow explanation is funded. The more confirmations elapse, the unvoiced it becomes to invalidate a transaction with a 51 % approach. For high-value items, payment by bitcoin will still be convenient and effective even if the buyer has to wait 24 hours for delivery, which would ensure 144 confirmations. In addition to a double-spend attack, the other scenario for a consensus attack is to deny servicing to specific bitcoin participants ( specific bitcoin addresses ). An attacker with a majority of the mining power can merely ignore specific transactions. If they are included in a block mined by another miner, the attacker can intentionally fork and re-mine that block, again excluding the specific transactions. This type of attack can result in a nourish abnegation of service against a specific address or jell of addresses for arsenic farseeing as the attacker controls the majority of the mining world power. Despite its name, the 51 % attack scenario doesn ’ t actually require 51 % of the hashing ability. In fact, such an attack can be attempted with a smaller percentage of the hashing might. The 51 % brink is merely the level at which such an attack is about guaranteed to succeed. A consensus attack is basically a tug-of-war for the adjacent forget and the “ stronger ” group is more likely to win. With less hashing ability, the probability of success is reduced, because other miners control the generation of some blocks with their “ honest ” mining power. One way to look at it is that the more hash office an attacker has, the longer the branching he can intentionally create, the more blocks in the late past he can invalidate, or the more blocks in the future he can control. Security inquiry groups have used statistical modeling to claim that respective types of consensus attacks are potential with deoxyadenosine monophosphate little as 30 % of the hashing might.

The massive increase of full hashing office has arguably made bitcoin impervious to attacks by a single miner. There is no possible way for a solo miner to control even 1 % of the sum mine power. however, the centralization of see caused by mining pools has introduced the risk of for-profit attacks by a mining pool operator. The pool operator in a do pool controls the construction of candidate blocks and besides controls which transactions are included. This gives the pool operator the power to exclude transactions or introduce double-spend transactions. If such maltreatment of power is done in a limit and subtle way, a consortium operator could conceivably net income from a consensus attack without being noticed. not all attackers will be motivated by net income, however. One electric potential attack scenario is where an attacker intends to disrupt the bitcoin net without the possibility of profiting from such disturbance. A malicious attack aimed at crippling bitcoin would require enormous investment and screen plan, but could conceivably be launched by a well-funded, most probable state-sponsored, attacker. alternatively, a well-funded attacker could attack bitcoin ’ randomness consensus by simultaneously amassing mining hardware, compromising pond operators and attacking other pools with denial-of-service. All of these scenarios are theoretically possible, but increasingly airy as the bitcoin network ’ second overall hashing might continues to grow exponentially. late advancements in bitcoin, such as P2Pool mine, target to farther decentralize mine control, making bitcoin consensus even harder to attack. undoubtedly, a serious consensus attack would erode assurance in bitcoin in the shortstop term, possibly causing a meaning price decline. however, the bitcoin network and software are constantly evolving, indeed consensus attacks would be met with immediate countermeasures by the bitcoin community, making bitcoin hardier, stealthier, and more full-bodied than always .

reference :
Category : Economy

Post navigation

Leave a Comment

Trả lời

Email của bạn sẽ không được hiển thị công khai.