There are two miners, Alice and Bob. Bob is an honest miner and always mines on the public chain. Alice is a potentially honest, potentially selfish miner who can decide to mine on the public chain, or to secretly work on a private chain, only to publicly broadcast her private chain later.
Let hash rate units be such that if the total hash rate = 1, then the expected time to the next block is 10 minutes.
Assume Alice has a hash rate of and Bob has a hash rate of .
Let be the block reward.
For now, ignore difficulty adjustments and ignore block subsidy halvings.
- Suppose Alice currently has no private chain. Let C be the public chain. Thus, both are mining on top of the public chain.
a. What is the probability that Alice finds the next block? Bob?
b. What is the expected time to the next block?
c. What is the expected value of Alice's reward at the time the next block is found? What about Bob?
This will be a series of increasingly difficult Bitcoin math puzzles, designed to walk through the game theory of various bitcoin scenarios in a formal way.
Bounty: 500 sats (payable by zap) to the best answer after 24 hours. This means you have to not only give a correct answer, but also document your reasoning. Suspected AI use will be ignored.
If I make a mistake in my puzzles, please do let me know. We're working this through together!
I'm looking forward to where this ends up going.
Block discovery odds are equal to share of total hash on the network
P(Alice) = x
P(Bob) = 1-x
E[time to next block] = 10 min (given)
E[Alice reward] = P(Alice) * R = xR
E[Bob reward] = P(Bob) * R = (1-x)R
Congrats, this is the correct answer.
yippee
I was gonna write my own answer, but @Undisciplined’s answer matches my thinking.
I'll need to crib off your sheet in the near future, I'm sure.
Should be fun to walk through it step by step
The way 1.c. is posed sounds a bit odd. Are you asking what the expected reward for either party is or do you mean to convey an additional constraint by mentioning the time?
I meant expected value of their each player's reward when the next block is found (whenever that is, and regardless of who found it)
The expected rewards over T minutes I think is a bit of a harder question and probably requires modeling a poisson distribution, and is additionally complicated by the fact that players can change strategies dynamically. My hope is to build up to a fuller specification of a model iteratively through multiple of these small problems.
a. What is the probability that Alice finds the next block?
Answer: Less than 50% (x < .5)
Bob?
Answer: Greater than 50% (1 - x)
b. What is the expected time to the next block?
Answer: 10 minutes - how long since the last block
c. What is the expected value of Alice's reward at the time the next block is found?
Answer: With Alice’s chance of getting the next block reward being less than 50%, the expected reward for Alice is zero.
What about Bob?
Answer: With Bob’s chance of winning the next block being greater than 50%, Bob’s expected reward at the time of the next block is found is R.
Bitcoin mining is a progress-free process, therefore the expected time to the next block is always ten minutes, regardless of how much time has passed (assuming that the difficulty matches the deployed hashrate).
I also think that you are either interpreting the question 1.c. very differently from me.
small nuance, the first-step EV is just the honest hash share. the real edge from selfish mining shows up in the continuation game, once you condition on fork resolution and orphan risk. so i’d separate the immediate lottery from the strategy value.
Love this format. Walking through selfish mining step by step is exactly how it should be taught.
One thing that surprised me when I first dug into the original Eyal & Sirer paper from 2014: the profitability threshold for selfish mining isn't at 50% hashrate like most people assume. They proved it's actually around 33% (1/3 of total hashrate). Below that, the selfish miner wastes more blocks than they steal. Above it, they start earning disproportionately to their hashrate share because they can strategically orphan honest blocks.
The intuition is wild when you think about it. At exactly 1/3 hashrate, a selfish miner earns the same as honest mining. But at say 40%, they're earning more than their "fair share" of 40% of rewards. The honest miners are subsidizing the selfish miner's orphaning strategy without realizing it.
What made it even more interesting was the follow-up work by Nayak et al. in 2015 on "stubborn mining" variants. They showed that if the selfish miner also controls some fraction of the network's connections (so they can sometimes win block races even without finding the next block first), the threshold drops below 1/3. That's the part that actually worried people, because network topology advantages are a lot easier to get than raw hashrate.
Looking forward to Pt. 2 where I'm guessing you'll formalize the private chain strategy. The Markov chain model for this is elegant once you set it up.