Block withholding: the attack no single share reveals

What is a block withholding attack?

It is a miner that sends every ordinary share but hides the one that would have been a block. The pool pays for the shares. The block never arrives.

Every share you send a pool is a real solution that missed the block target. The block target is the harder bar a hash must pass to make a block. Once in a while a solution passes it too, and that share is a whole block.

Such a share looks like every other share until the pool checks it.

An attacker does the work honestly and sends every ordinary share. It quietly throws away the one that would have been a block. The pool counts the shares and pays for them. The block it should have received never arrives.

Why can one share not give it away?

Nothing about the attacker looks wrong on any single share. The hardware is real and so is the hashrate. The shares are valid and arrive at the right rate. The pool can examine one share and see nothing at all.

What is missing is an absence, and an absence only shows over time. A miner with a given share of the pool's hashrate should find roughly that share of its blocks.

Over an hour, that says nothing. Block finding is random, and quiet stretches are ordinary. Over a long enough window, it says a great deal.

What does it cost, and who pays?

The pool loses the block reward it should have had. But the loss does not really land on the pool. This is the part worth understanding on any pool.

• Under a proportional scheme, the round carries on until someone else finds a block. Everyone in the round worked on a round that took longer than it should have. So everyone earns slightly less per unit of work. The cost is spread across the honest miners.
• Under a pay per share scheme, it is worse for the operator. The pool has already paid for every share from its own pocket, and relies on the blocks to arrive. A sustained attack is a direct drain on the operator. Historically, this is the case people worried about most.

Why would anyone do this?

The attacker throws away the block reward too. At first glance that is pure self harm. It only makes sense if the attacker gains somewhere the pool cannot see.

The usual motive is competition. Someone running their own pool can rent or point hashrate at a rival and suppress its results. Their own pool then looks luckier by comparison. The shares the attacker still collects pay for the sabotage.

In a subtler variant, the attacker holds the block instead of discarding it. It keeps mining on top of it privately, then submits later at a moment that suits it. This is harder to pull off. It needs a large share of the hashrate to be worth trying.

How is it detected?

Detection is statistical, because there is no other signal. Compare the blocks a contributor has found with the blocks its share count says it should have found. Do it over a window long enough for luck to average out.

The window is the hard part.

• Make it short, and ordinary bad luck looks like an attack. Honest miners would be accused constantly.
• Make it long, and a real attacker operates for a while before the numbers speak.

There is no clever way around this trade-off. It comes from the randomness, not from the software.

So a serious detector raises the question for a human instead of acting alone. An automatic ban driven by a statistic will one day ban someone who was merely unlucky. Taking a legitimate miner offline is worse than the attack itself.

What does it mean for an honest miner?

Almost nothing, and that is worth saying plainly.

Your shares are counted and paid the same either way. Being unlucky is not an offence and cannot be. Over any short window, most miners are unlucky.

A run of rounds where you contributed a lot and the pool found nothing is normal variance. The luck figure on the pool statistics shows you how normal it is.

This attack is one reason pools care who points hashrate at them. It is also why a pool that publishes its blocks and its luck honestly is easier to trust. Everything you need to check the pool is on the blocks page.