Post
Topic
Board Development & Technical Discussion
Re: Why doesn't Bitcoin use a tiebreaking rulewhen comparing chains of equal length?
by
QuinnHarris
on 04/12/2013, 17:39:52 UTC
The assumption that the selfish miner could propagate their block faster than the rest of the network is a bit contrived.

But, if a deterministic block choice is used that allows the selfish miner to determine if their block is more likely to be chosen over the yet unknown competing block the situation becomes less contrived.

That said, I think this problem can be fixed or at least mitigated by choosing a block choice algorithm that doesn't allow the selfish miner to predict if their block will win.

I had suggested the following approach taking into account the current difficulty on the dev mailing list.

Assuming
a = hash of block A
b = hash of block B
difficulty = current difficulty such that A < difficulty and b < difficulty

Code:
uint256 choose_block(uint256 a, uint256 b, uint256 difficulty)
{
  bool choice = false; // false for lower hash, true for greater hash
  uint256 am = (a + d/4) % difficulty;
  uint256 bm = (b + d/4) % difficulty
  if (a + d/4 >= d)
    choice = b > a || b < am || bm > a || bm < am;
  else
    choice = (b > a && b < am) || (bm > a && bm < am);
  return choice ? (a > b ? a : b) : (a > b ? b : a);
}

Given any hash a you can't know if any other hash value b is more or less likely to be chosen.  There are many other methods like an exclusive or between 1 bit on the hash of the hash value.


I strongly expect if a deterministic block choice is used, this approach is better than just choosing the block with the lowest POW hash value or the chain with the lower POW sum.

That said, I don't think the selfish miner problem is big enough to warrant significant concern and I am not certain any change won't have other problems like the ability for a powerful adversary to cause the network to imprudently reject good blocks.