On RSK’s Block Reward Smoothing

By Sergio Demian Lerner, RSK Chief Scientist

On RSK’s Block Reward Smoothing

The security of Bitcoin relies on the economic incentives that exist for miners to extend the chain with most accumulated difficulty (usually the longest). Currently those incentives are provided by the block reward, which consists of the block subsidy and transaction fees. But the subsidy (12.5 BTC) is substantially higher than the average transaction fees per block (0.4 BTC).  Bitcoin subsidy halves every 4 years, and without an inverse BTC price appreciation, the incentive would rely only on transaction fees. To sustain the current security level, transaction cost would need to increase 30-fold. Will this be a problem for Bitcoin? Can Bitcoin security rely only on transaction fees? Will Bitcoin need to soft-fork or hard-fork to adapt to this new era? I showed how Bitcoin could become unstable in 2014 when I presented the FRONT Attack. Carlsten et al. (2016) analyzed this problem in depth but they could not find a satisfactory solution. This is not only Bitcoin’s problem but one every cryptocurrency whose money issuance diminishes over time will need to face. 

But Bitcoin need not worry for now. The problem will present itself in 10 or 20 years, or even later. Recently it has been examined again, in analyses both highlighting and minimizing the problem. 

RSK Block Rewards

RSK had to face the challenge of living only on transaction fees since its inception, therefore it had to be prepared for abnormally high fees. RSK was the first production-ready sidechain, and it uses merge-mining for consensus. RSK miners expect an economic compensation for running an RSK full node and for reviewing changes when they need to update their nodes. 

While some other distributed ledgers, such as Ripple, don’t issue coins to pay block producers, the organizations behind them have pre-mined enough coins to become block producers themselves or provide compensation for third party producers by alternate channels. RSK, on the other hand, faces the toughest conditions: no coin issuance and no coin premine. RSK represents a testbed for new technologies that will be used in the future on other blockchains and aims to become an example of how a blockchain without subsidy can be sustainable. One of these new technologies is block reward smoothing (also called fee smoothing), implemented by RSK since its first release in 2016.

Blockstream CEO Adam Back recently mentioned smoothing when discussing Bitcoin’s long term security budget: “Other longer term low subsidy era ideas include fee averaging across block intervals to smooth fee revenue.”

https://twitter.com/adam3us/status/1097031151921713152

Let’s dig into the subject of fee smoothing to understand why it’s necessary. Fee smoothing is a consensus rule that distributes mining fees between miners in a more egalitarian way, by paying each miner a function of the past block rewards. The function can be linear or nonlinear, generally being some kind of low-pass filter on the accumulated fees. RSK uses a smoothing function that is very simple IIR with α=0.1. If a miner solves a block at height N, the miner will be compensated with 10% of the block transaction fees and 10% of all unpaid miner fees previously accumulated. In other words, there exists a “shared” account, where every miner puts in the transaction fees and takes 10% for himself.

There are several reasons why RSK design incorporates reward smoothing. First, it gives miners more flexibility on setting personal block gas limits, preventing delays in block production without being highly penalized on block rewards. Second, fee smoothing is needed because the incentive to extend the blockchain must be greater than the incentive to re-mine a past block to grab its paid fees. Suppose that a transaction T in a block at height N pays 100 coins in fees, but the average block reward is just 10 coins. Then the best strategy for any miner is grab the transaction T and try to mine a block at the same height N (100 coins reward vs 10 coins), and then keep mining child blocks of his/her selfish chain until it becomes long enough that the remaining miners (which will also choose to do the same) give up. The high fee transaction atomizes mining for the benefit of the larger transaction pool, which has higher chances of mining T plus enough confirmation blocks. Curiously, the more decentralized the mining network is, the worse the disruption caused by such transactions. For instance, for a blockchain having a 10 minute average block interval, if there were 100 miners each having 1% of the total hashrate, the network would suffer a 100x slowdown for several blocks until it finally converges. The network would be unusable for 2 days! And during this period the blockchain is also unstable: a merchant waiting for a single block confirmation for a payment has a high chance to see the payment reverted. 

The Miner Atomization Attack

The broadcast of a transaction with very high fees can be considered an attempt to perform a denial of service attack. Such transactions can be seen as a bribe to revert the blockchain by a naive miner, but it’s actually a bait to atomize mining. Although there are other complementary protective measures, reward smoothing is the main protection of a cryptocurrency network against this type of attack. Let’s return to the previous example: a 100-coins bribe while the average block reward is 10 coins. In RSK, the block at height N would pay a reward of 19 coins, while the following block would pay 18.1 coins. The selfish miner now needs 10 times more hashing power than any other miner for the attack to be profitable.

There are two complementary protective measures that can be implemented. RSK implements the first:a reward-sharing consensus protocol called DECOR. DECOR splits block rewards evenly between sibling blocks (if there are more than one). This diminishes the incentive for an atomization attack, because miners know they can be paid as low as 1/11th of the block reward if all miners mine the same block, because the blockchain can reference up to 10 block siblings. This means that, to disrupt the RSK network, the bribe must be 110 times higher than the average block reward. 

The second complementary protective measure, which RSK does not currently implement is to limit transaction gas price to a multiple of the minimum gas price (i.e. 10x spread). I proposed a comparable measure for Bitcoin in 2013. RSK could implement this easily, as each block advertises the minimum transaction gas price accepted. However, setting a maximum gas price does not completely solve the problem if the network is in a state where blocks do not consume all the block gas. The high fee in T can be the result of a higher amount of gas consumed instead of a higher gas price.

Bribing Miners

Reward smoothing is not the ultimate solution, as attackers can use a smart-contract platform to bribe miners into doing just about anything. I presented a theoretical “Eternal Choice for the Dark Side Attack” (ECDSA) in 2014, as a way to show how miners could be bribed to deviate from honest behavior.  McCorry el at. (2018) presented a wide gamut of theoretical bribing attacks. However, the level of understanding and preparation required to take smart-contract based bribes is considerable, as it requires programming the monitoring of and response to the bribes. This makes smart-contract based bribing attacks much more difficult to perpetrate, as a miner must be aware of the bribing contract and understand how to interact with it. However, it is unavoidable: if the platform can pay a miner, then it can also execute a smart-contract that pays the same miner. This is because the programming language the consensus is programmed in and the one used by smart-contracts are both “Turing-complete”. You cannot prevent a payment from somebody willing to pay another party willing to be paid.  It does not suffice to limit the language capabilities on a certain platform since any Turing-complete smart-contract platform can be used to pay bribes to miners of another blockchain! For example, RSK and Ethereum can be used to pay bribes to Bitcoin miners Of course, in this case coordination is even more difficult. 

The long term solution is to discourage atomization attacks by making sure every miner knows the game theory behind them: if everyone re-mines the block and tries to grab the bait, then everyone loses. If a few miners go for the bait, but the majority remain honest, then the few malicious will lose. To reduce the chances there is a flip from honest majority to minority, we can deploy a reward-smoothing contract in RSK that mimics the same IIR we use for the RBTC, but for any token;  and teach the miners how to put back any bribe received into that contract, so that sharing the bribe becomes the Schelling point.

Summary

There is a known potential network instability problem for certain blockchains that is caused by a transaction paying out abnormally high fees. This problem is especially relevant in Bitcoin sidechains, such as RSK. RSK implements block reward smoothing as a protective measure against this problem. Block reward smoothing also provides additional benefits, such as incentivizing cooperation over competition in mining. While this protection works for explicit fees, the general case of bribes paid using smart-contracts needs active network monitoring and further analysis.