X On Bitcoin and Red Balloons

Transcription

1 X On Bitcoin an Re Balloons Moshe Babaioff, Microsoft Research, Silicon Valley. Shahar Dobzinski, Department of Computer Science, Cornell University. Sigal Oren, Department of Computer Science, Cornell University. Aviv Zohar, Microsoft Research, Silicon Valley. Many large ecentralize systems rely on information propagation to ensure their proper function. However, it is common that only participants that are aware of the information can compete for some rewar, an thus informe participants have an incentive not to propagate information to others. One recent scenario in which such tension arises is the 2009 DARPA Network Challenge fining re balloons. We focus on another prominent scenario: Bitcoin, a ecentralize electronic currency system. Bitcoin represents a raical new approach to monetary systems. It has been getting a large amount of public attention over the last year, both in policy iscussions an in the popular press [Davis 2011; Surowiecki 2011]. Its cryptographic funamentals have largely hel up even as its usage has become increasingly wiesprea. We fin, however, that it exhibits a funamental problem of a ifferent nature, base on how its incentives are structure. We propose a moification to the protocol that can eliminate this problem. Bitcoin relies on a peer-to-peer network to track transactions that are performe with the currency. For this purpose, every transaction a noe learns about shoul be transmitte to its neighbors in the network. As the protocol is currently efine an implemente, it oes not provie an incentive for noes to broacast transactions they are aware of. In fact, it provies a strong incentive not to o so. Our solution is to augment the protocol with a scheme that rewars information propagation. Since clones are easy to create in the Bitcoin system, an important feature of our scheme is Sybil-proofness. We show that our propose scheme succees in setting the correct incentives, that it is Sybil-proof, an that it requires only a small payment overhea, all this is achieve with iterate elimination of ominate strategies. We complement this result by showing that there are no rewar schemes in which information propagation an no self-cloning is a ominant strategy. 1. INTRODUCTION In 2009 DARPA announce the DARPA Network Challenge, in which participants compete to fin ten re weather balloons that were isperse across the Unite States [DARPA 2009]. Face with the aunting task of locating balloons sprea across a wie geographical area, participating teams attempte to recruit iniviuals from across the country to help. The winning team from MIT [Pickar et al. 2011], incentivize balloon hunters to seek balloons by offering them rewars of $2000 per balloon. Furthermore, after recognizing that notifying iniviuals from all over the US about these rewars is itself a ifficult unertaking, the MIT team cleverly offere aitional rewars of $1000 to the person who irectly recruite a balloon finer, a rewar of $500 to his recruiter, an so on. These aitional payments create the incentive for participants to sprea the wor about MIT s offer of rewars an were instrumental in the team s success. In fact, some aitional rewars are necessary: each aitional balloon hunter competes with the participants in his vicinity, an reuces their chances of getting the prize. The MIT scheme as escribe above is susceptible to the following attack. A participant can create a fake ientity, invite the fake ientity to participate, an use that ientity to recruit others. Thus, when participants can create a fake ientities the rewar scheme shoul be carefully esigne so it oes not create an incentive for such

2 X:2 attacks. Our goal is to esign rewar schemes that incentivize information propagation an counter the is-incentive that arises from the competition with other noes, an are Sybil proof robust against creating clones, or Sybil attacks while having a low overhea a total rewar that is not too high. A relate setting is a raffle, in which people purchase numbere tickets in hopes of winning some luxurious prize. Each ticket has the same probability of winning, an the prize is always allocate. As more tickets are sol, the probability that a certain ticket will win ecreases. In this case again, there is a clear tension between the organizer of the raffle, who wants as many people to fin out about the raffle, an the participants who have alreay purchase tickets an want to increase their iniviual chances of winning. The lesson here is simple, to make raffles more successful participants shoul be incentivize to sprea the wor. One example of a raffle which is alreay implemente in this way is Expeia s FrienTrips, in which the more friens you recruit the bigger your probability of winning. As apparent from the previous examples, the tension between information propagation an an increase competition is a general problem. We ientify an instantiation of this tension in the Bitcoin protocol, our main example for the rest of the paper. Bitcoin is a ecentralize electronic currency system propose by Satoshi Nakamoto in 2008 as an alternative to current government-backe currencies. 1 Bitcoin has been actively running since Its appeal lies in the ability to quickly transfer money over the internet, an in its relatively low transaction fees. 2 As of February 2012, it has 8.2 million coins in circulation calle Bitcoins which are trae at a value of approximately 6 USD per bitcoin. Below, we give a brief explanation of the Bitcoin protocol an then explain where the incentives problem appears. A more comprehensive escription of the protocol is given in Appenix A. Bitcoin relies on a peer-to-peer network to verify an authorize all transactions that are performe with the currency. Suppose that Alice wants to reserve a hotel room for 30 bitcoins. Alice cryptographically signs a transaction to transfer 30 bitcoins from her to the hotel, an sens the signe transaction to a small number of noes in the network. Each noe in the network propagates the transaction to its neighbors. A noe that receives the transaction verifies that Alice has signe it an that she oes inee own the bitcoins she is attempting to transfer. The noe then tries to authorize the transaction by attempting to solve a computationally har problem basically inverting a hash function. Once a noe successfully authorizes a transaction, it sens the proof the inverte hash to all of its neighbors. They in turn, sen the information to all of their neighbors an so on. Finally, all noes in the network agree that Alice s bitcoins have been transferre to the hotel. To motivate them to authorize transactions, noes are offere a payment in bitcoins for successful authorizations. The system is currently in its initial stages, in which noes are pai a preetermine amount of bitcoins that are create out of thin air. This also slowly buils up the bitcoins supply. But Bitcoin s protocol specifies an exponentially ecreasing rate of money creation that effectively sets a cap on the total number of bitcoins that will be in circulation. As this payment to noes is slowly phase out, bitcoin owners that want their transactions approve are suppose to pay fees to the authorizing noes. 1 The real ientity of Satoshi Nakamoto remains a mystery. A recent New Yorker article [Davis 2011] attempts to ientify him. 2 There are aitional properties that some consier as benefits: Bitcoins are not controlle by any government, an its supply will eventually be fixe. Aitionally, it offers some egree of anonymity although this fact has been conteste [Rei an Harrigan 2011].

3 This is where the incentive problem manifests itself. A noe in the network has an incentive to keep the knowlege of any transaction that offers a fee to itself, as any other noe that becomes aware of the transaction will compete to authorize first an claim the associate fee. For example, if only a single noe is aware of a transaction, it can eliminate competition altogether by not istributing information further. With no competition, the informe noe will eventually succee in authorizing an collect the fee. The consequences of such behavior may be evastating: as only a single noe in the network works to authorize each transaction, authorization is expecte to take a very long time. 3 We stress that every change in the Bitcoin protocol has to take into account Sybil attacks, as false ientities are a prominent concern. Given this concern the Bitcoin protocol is esigne to ensure that if a majority of processing power, rather than majority of eclare ientities, follow the protocol, it will not be possible to manipulate the history of authorize transactions. Notice that simply using a majority of eclare ientities is vulnerable to Sybil attacks, as ientities are easy to spoof. Therefore any rewar scheme for transaction propagation must also iscourage Sybil attacks. A Simplifie Moel. We now present our moel, using Bitcoin as our running example. For simplicity assume that only one transaction is awaiting authorization. We moel the authorization process as ivie into two phases: the first phase is a istribution phase. The secon one is a computation phase, in which every noe that has receive the transaction is attempting to authorize it. We start with escribing the istribution network. We assume that the network consists of a forest of -ary irecte trees, each of them of height H. The istribution phase starts when the buyer sens the etails of the transaction to the t roots of the trees which we shall term sees. We think of the trees as irecte, since the information about the transaction flows from the root towars the leaves. The epth of a noe is the number of noes on the path from the root of the noe s tree the see to the noe. Let n = t H 1 1 be the total number of noes. In the istribution phase, each noe v can sen the transaction to any of its neighbors after aing any number of fake ientities of itself before sening to that neighbor. Noe v can only relay the transaction to its original chilren aing fake ientities oes not change the neighbors of v. Naturally, a noe can conition its behavior only on the information available to it: the length of the chain above it which can possibly inclue false ientities that were prouce by its ancestors. In the computation phase each noe that is aware of the transaction tries to authorize it 4. If there are k such noes, each of them has the same probability of 1 k to be the first to authorize the transaction. Note that k is the number of real noes, fake ientities o not increase the probability of winning the rewar. A noe v that authorizes the transaction can eclare that it i so with any ientity p h it create. This etermines a chain of ientities p 1,..., p h which we call the authorizing chain. The chain ens with p h, the eclare ientity of the authorizer, an starts with p 1, an ientity of the see that roots the tree v is in. This chain is a superset of the real path in the X:3 3 Bitcoin s ifficulty level is ajusting automatically to account for the total amount of computation in the network. The expecte time of a single machine to authorize a transaction is currently on the orer of 60 ays, instea of the 10 minutes it is expecte to take if the entire network competes to authorize. 4 In the Bitcoin protocol multiple transactions are place at the same block an the cost of authorizing the entire block is fixe, essentially inepenent of the content of the block. Focusing on the issue of incentives to propagate information, in this paper we have assume that every noe tries to authorize any transaction it is aware of since the cost of aing it the block it is attempting to authorize anyways is negligible. In future work one might consier stuying the issue of sharing the cost of computation between transactions in a block in a way that motivates the noes to compute.

4 X:4 tree, potentially incluing clones of some noes noes are not able to remove preecessor ientities from the chain ue to the use of cryptographic signatures. Rewars are allocate to ientities on the authorizing chain in reverse orer, rewar r 1 is allocate to the authorizing ientity an r h to the see. Each noe s rewar is the sum of the rewars of all its ientities true an fake in the authorizing chain. Currently the bitcoin protocol requires to attach a minimal rewar c > 0 to every transaction. This rewar is given to the noe that authorizes the transaction. This is the prize that the noes are competing on. We normalize c to be 1. We assume that all players are expectation maximizers, so the utility of a player in a given profile is its expecte utility, where expectation is taken over the ranom selection of the authorizer w. Our Results. A successful rewar scheme has to posses several properties. First, it has to incentivize information propagation an no uplication. That is, it will be in a noe s best interest to istribute the transaction to all its chilren without uplicating itself, as well as never uplicating when it authorizes. Secon, at the en of the istribution phase most of the noes have to be aware of the transaction. Lastly, we woul like to achieve this with small rewars, while minimizing the number of sees, to ease the buren of initial istribution. Designing a scheme that simultaneously has all these properties is obviously not a trivial task, an in particular specific care has to be given to the Sybil proofness requirement. The current literature on the Sybil proof mechanisms contains mostly negative results, an in the few cases in which a positive result is obtaine, the setting is usually very specific. The reason is previous works insiste that creating Sybils will never be profitable. In contrast, we use our game theoretic moel to take an alternative path: we will guarantee these properties, Sybil proofness in particular, in equilibrium. Using this concept, we introuce a new family of schemes: almost uniform schemes. Each member in the family is parameterize by a height parameter H an a rewar parameter β. Let v be the noe that authorize the transaction an suppose that v is the l th noe in the chain. If l > H no noe is reware so noes far from the see will not attempt to authorize the transaction. Otherwise, each noe in the chain except v gets a rewar of β, an v gets a rewar of 1 + H l + 1β. We show that if there are Ωβ 1 sees, only strategy profiles that exhibit information propagation an no uplication survive every orer of iterate removal of ominate strategies. Furthermore, there exists an orer in which no other strategy profiles survive. Iterate removal of ominate strategies is the following common technique for solving games: first the set of surviving strategies of each player is initiate to all its strategies. Then at each step, a strategy of one of the players is eliminate from the set. The strategy that is eliminate is one that is ominate by some other strategy of the same player with respect to the strategies in the surviving sets of all other players. This process continues until there is no strategy that can be remove. The solution concept prescribes that each player will only play some strategy from his surviving set. In general the surviving sets can epen on the orer in which strategies are eliminate. Yet, we show that in our case, regarless of the orer of elimination, profiles of strategies in which every noe propagates information an never uplicates, survive. Moreover, for a specific orer of elimination they are the only strategies that survive. Although the escription of our schemes is simple, the analysis itself is quite elicate, but let us give a bir-eye view of it now. The intuition behin the elimination process is that ecreasing competition by your own escenants might be unprofitable ue to possibly losing rewars for relaying, in case one of these escenants authorizes. Consier one particular noe. It faces the following ilemma: by uplicating itself one more time it increases its rewar in case one of its escenants authorizes the transac-

5 tion, but it potentially ecreases the number of escenants aware of the transaction, an thus may ecrease its expecte rewar. To see this, consier, for simplicity, a see. Suppose, for the sake of explanation, that all of its escenants always propagate information an never uplicate. If the see oes not clone itself then each one of its chilren spans a -array tree of height H 1. If it clones itself once, then each one of its chilren spans a -array tree of smaller height of H 2, an the number of escenants of the noe that receive the information ecreases by almost factor. This simple observation stans at the heart of the analysis, but the reaer shoul note that it is over simplifie: it is far from being clear that the escenants will propagate information with no uplication in this scheme. As explaine, if the amount of external competition from non-escenent noes is small, a noe prefers not to istribute the transaction, an thus increase the probability that it receives the rewar for authorization. However, if sufficiently many nonescenent noes are aware of the transaction, the noe prefers to uplicate itself one less time, an thus istribute the transaction to its chilren an increase its potential istribution rewar. Once all noes increase istribution, the arms race begins: the competition each noe faces is greater, an again it prefers to uplicate itself one less time an istribute all the way to its gran-chilren. As this process continues, all noes eventually prefer to istribute fully an never to uplicate. Two values of β give us schemes that are of particular interest. The first is when β = 1. In this case the 1, H-almost-uniform scheme requires only a constant number of sees an the total payment is always OH. The secon scheme is the 1 H, H-almostuniform scheme. This scheme works if the number of sees is ΩH. Its total payment is 2. We combine both schemes to create a rewar scheme that has both a constant number of sees an a constant overhea. The Hybri Scheme first istributes the transaction to a constant number of sees using the 1, 1 + log H-almost-uniform scheme. Then we can argue that at least H noes are aware of the transaction. This fact enables us to further argue that the 1 H, H-almost uniform scheme guarantees that the transaction is istribute to trees of height H. At the en of the istribution phase, most of the noes that are aware of the transaction receive a rewar of 1 H if they are in the successful chain, so the expecte overhea is low. We have the following imprecisely state theorem: X:5 Theorem: In the hybri rewaring scheme, if the number of sees t 14, the only strategies that always survive iterate elimination of ominate strategies exhibit information propagation an no uplication. In aition, there exists an elimination orer in which the only strategies that survive exhibit information propagation an no uplication. Furthermore, the expecte total sum of payments is at most 3. Notice that this scheme exhibits in equilibrium low overhea, Sybil proofness, an provies the noes with an incentive to propagate information. Iterate removal of ominate strategies is a strong solution concept, but ieally we woul like our rewaring scheme to achieve all esire properties in the stronger notion of ominant strategies equilibrium. However, we show that this is impossible to achieve: Theorem: Suppose that H 3. There is no Sybil-proof rewar scheme in which information propagation an no uplication are ominant strategy for all noes at epth 3 or less. Relate Work. The paper escribing Bitcoin s principles was originally publishe as a white paper by Satoshi Nakamoto [2008]. The protocol was since evelope in an

6 X:6 open-source project. To ate, no formal ocument escribes the protocol in its entirety, although the open source community maintains wiki pages evote to that purpose. Some research has been conucte with regars to its privacy [Rei an Harrigan 2011]. Krugman [2011] iscusses some relate economic concerns. Chitnis et al. [2012] iscuss other game theoretic aspects of the DARPA Network Challenge such as fining the best strategy for a group to fin the balloons. The subject of incentives for information issemination, especially in the context of social an peer-to-peer networks has receive some attention in recent years. Kleinberg an Raghavan [2005] consier incentivizing noes to search for information in a social network. A noe that possesses the information is reware for relaying it back, as are noes along the path to it. A key ifference between their moel an ours, is that unlike in our moel, in their moel noes either posses the sought-after information or o not. If they o, then there is no nee for further propagation, an if they o not, they cannot themselves generate the information, an so o not compete with noes they transmit to they o however compete for the propagation rewars with other unrelate noes. Douceur an Moscibroa [2007] esign recruitment mechanisms similar in spirit to our own to ai incremental eployment in networke systems. They formalize various properties schemes shoul ieally uphol an present mechanisms as well as impossibility results. Unlike our work, their moel an properties are not game theoretic, an the strategies of ifferent participants are not consiere or analyze with respect to any solution concept. Emek et. al. [2011] consier rewar schemes for social avertising scenarios. In their moel, the goal of the scheme is to avertise to as many noes as possible, while rewaring noes for forwaring the avertisement. Unlike their scenario, in our case the scheme is eventually only aware of a chain that results in a successful authorization, an only awars noes on the path to the successful authorizer. Other works consier propagation in social networks without the aspect of incentives. For example [Dyagilev et al. 2010], which consiers ways to etect propagation events an examines ata from cellular call ata. Future Research. In this work we propose a novel low cost rewar scheme that incentivizes information propagation an is Sybil proof. Currently we assume that the istributing network is moele as a forest of t complete -ary trees. A challenging open question is to consier other types of networks, for example ranom -regular graphs, which may capture better peer-to-peer networks 5. Another interesting extension to consier is one in which noes have ifferent processing power. That is, each noe v has a processing power CP U v, then the probability of a noe v that is aware of CP U the transaction to authorize it is v Σ ucp U u. We leave the analysis of these moels, as well as the implementation an empirical experimentation, to future research. 2. NEW REWARD SCHEMES Our main result is the Hybri scheme, a rewar scheme that requires only a constant number of sees an a constant overhea. We will show that the only strategies that always survive iterate removal of ominate strategies are ones that exhibit information propagation an no uplication. The basic builing blocks for this construction 5 Notice that when is small e.g. constant an the number of noes n is large, transaction propagation in a ranom graph till about 1/ fraction of the graph receives the information resembles a tree. In some sense, builing incentives for information propagation in trees is harer than general graphs as each noe monopolizes the flow of information to its escenants.

7 is a family of schemes, almost-uniform schemes, with less attractive properties. However, we will show that combining together two almost-uniform schemes enables us to obtain the improve properties of the Hybri scheme The Basic Builing Blocks: Almost-Uniform Schemes The β, H-almost-uniform scheme pays the authorizing noe in a chain of length h a rewar of 1 + β H h + 1. The rest of the noes in the chain get a rewar of β. If the chain length is greater than H no noe receives a rewar. The iea behin giving the authorizing noe a rewar of 1 + β H h + 1 is to mimic the rewar that the noe woul have gotten if it uplicate itself H h times. Therefore, we can assume that no noe uplicates itself before trying to authorize the transaction, an focus only on uplication before sening to its chilren. Figure 1 illustrates the rewar scheme. X:7 Fig. 1. An example of the transaction relay chain from the see v 1 to the authorizing noe v 5 in the β, H- almost-uniform scheme. In the example, noe v 3 ae 2 fake ientities v 3 an v 3 before relaying the transaction to v 4, all other noes relay with no uplications. The payment to each ientity appears below the chain, note that noe v 3 receives 3β in total ue to its clones. Each true ientity is associate with a level, representing the maximal number of ientities true an fake it coul have ae to the prefix of the chain when receiving it, to get to a chain of length H. THEOREM 2.1. Let 3. Suppose that the number of sees is t 7 an in aition there are initially at least 2β noes except the t sees that are aware of the transaction. In the β, H-almost-uniform scheme only profiles of strategies in which every noe of epth at most H never uplicates an always propagates information survive in every iterate removal of weakly ominate strategies. Furthermore, there is an elimination orer in which only these profiles of strategies survive. The total payment is 1 + H β. While the 2β aitional noes that are aware the transaction are not necessarily sees, for now, one can think about them as aitional sees. The Hybri scheme will exploit this extra flexibility to simultaneously obtain low overhea an small number of sees. Before proving the theorem, let us mention two of its applications: COROLLARY 2.2. Let 3. 1 Consier the 1 H, H-almost uniform scheme β = 1 H, with at least 2H + 13 sees. Only profiles of strategies in which every noe of epth at most H never uplicates an always propagates information survive in every iterate removal of weakly ominate strategies. Furthermore, there is an elimination orer in which only these profiles of strategies survive. The total payment is 2. 2 Consier the 1, H-almost uniform scheme β = 1 with at least 15 sees. Only profiles of strategies in which every noe of epth at most H never uplicates an

8 X:8 always propagates information survive in every iterate removal of weakly ominate strategies. Furthermore, there is an elimination orer in which only these profiles of strategies survive. The total payment is H + 1. Both parts of the corollary are irect applications of the theorem, by making sure that the number of initial sees is at least 2β The next subsection introuces the Hybri scheme that combines between two almost uniform schemes, one with β = 1 an one with β = 1 H, an obtain a scheme that uses both a constant number of sees an its total expecte payment is a small constant that oes not epen on H. The rest of the section is organize as follows. In Subsection 2.3 we prove our Theorem 2.1. The next subsection presents the Hybri scheme. Appenix A.4 iscusses how to implement the Hybri scheme within the framework of the Bitcoin protocol The Final Construction: The Hybri Scheme We now present our main construction, the Hybri scheme. The scheme works as follows: we run the 1 H, H-almost uniform scheme with a set of A sees A = a an simultaneously run the 1, 1 + log H-almost uniform scheme 6 with a set of B sees B = b. THEOREM 2.3. Assume that 3, t 15 an consier the Hybri scheme with set A of size a = t 7 an set B of size b = 7. Let Z be the set of noes of epth at most H in trees roote by sees in A, an 1 + log H for noes roote by sees in B. In the Hybri scheme only profiles of strategies in which every noe in Z never uplicates an always propagates information survive in every iterate removal of weakly ominate strategies. Furthermore, there is an elimination orer in which only these profiles of strategies survive. The total payment is in expectation at most 3, an 2+log H in the worst case. At least t 7 t -fraction of the network is aware of the transaction after the istribution phase. PROOF. The theorem is a consequence of Theorem 2.1: all noes up to epth log H in trees roote by noes in B will propagate information an will not uplicate themselves. Thus, when consiering the noes in A, there are at least 7 log H 1 1 7H 2H + 6 noes that are aware of the transaction, which are not part of the trees roote by noes in A. Thus we can apply again Theorem 2.1 to claim each see in A roots a full tree of height H. Notice that the worst case payment is 1+log H because of the use of the 1, 1+log H- almost uniform scheme. The expecte payment is a H b H log H a H b H As for the number of noes that are aware of the transaction at the en of the istribution phase: all trees roote by noes in A are fully aware of the transaction. a These noes are at least a+b-fraction of the network notice that we conservatively ignore noes roote by sees in B that are aware of the transaction Proof of Theorem 2.1 Given specific values of β an H, the β, H-almost uniform scheme efines the utilities of the noes. We next consier the β, H-game which is the game the noes are playing given these utilities an their strategies Notation an Formalities for the β, H-game. In orer to present the proof we nee to establish some notations regaring the β, H-game. 6 All logarithms in this paper have base, so we write log H to enote log H.

9 We start by iscussing the strategy space of a noe. Only noes that are aware of the transaction can relay it an get any rewar, so we focus on these noes an ignore all other noes. A noe v that receives information from his parent observes a chain of ientities p 1, p 2,..., p h, ening with its own ientity p h = v which follows its parent ientity p h 1 is v s parent if v is not a see. If v is a see the chain has only one element p 1 = v. This chain is the result of the strategies of v s ancestors, which we iscuss below. The chain p 1, p 2,..., p h = v which v observes efines v s level lv, which is the maximal number of ientities true an fake it can have in any completion of the observe chain to a chain of length H. Thus, for i H the level of v is lv = H i+1 note that the level of each see is efine to be H. For i > H we efine lv = 0. A strategy of a noe can only epens on the length of the chain it observes. Note that for any chain of length at most H there is a one to one mapping between the length of the chain v observes an the level of v, so we think of v s strategy as a function of it level lv. When a noe v receives the transaction, it ecies, for each of its chilren, whether he wants to sen the transaction an the number of times it uplicates itself before sening. One aitional ecision is whether the noe wants to uplicate itself when authorizing the transaction. As iscusse above, both ecisions are base on the level of v an nothing else. For each noe v an level l, c l,v 1 enotes the number of times v clones itself before sening the transaction to its i th chil. Aitionally, p l,v enotes the number of times a noe uplicates itself before it tries to authorize the transaction note that if it succees it will use its last ientity to report its success. With these notations we can finally represent the strategies of the noes. The strategy S v of a noe v is represente as follows: for every 1 l H, there is a tuple S v l = c l,v 1,..., cl,v where 0 c l,v l 1 an a number 0 p l,v l 1. Observe that once we fix the i strategies of all noes, the chain each noe v observes if at all is fixe. If noe v of level l ecies not to sen the transaction to its i s chil it can implement this by setting c l,v i = l 1. Now we can say that a noe v propagates information an oes not uplicate at level l if S v l = 0,..., 0 an p l,v = 0. We also say that a noe v never uplicates an always propagates information, if for every level l noe v propagates information an oes not uplicate at level l. Given a strategy profile S an a rewar scheme the utility of each noe is efine as follows. An authorizer w is chosen uniformly at ranom among the players that are aware of the transaction an try to authorize it. Let p 1, p 2,..., p h be the authorizing chain, it ens with the last ientity of w an starts with p 1 = s where s is the see that roots the tree of w. Denote l = H h + 1. Then, we allocate rewars to all ientities in the chain: w gets a rewar of r1,l s, its preecessor gets rs 2,l an so on. The total rewar a noe receives is the sum of rewars of its true an fake ientities in the successful chain The Proof Framework. We start with the following efinition. The intuition is that in a ϕ-subgame a noe that has H l ancestors incluing clones, oes not clone itself an propagates information if l ϕ + 1. Otherwise for every chil it uplicates itself at most l ϕ 1 times. Definition 2.4. The ϕ-subgame is the β, H-game with restricte strategy spaces: the strategy space of noe v inclues only strategies such that for every remaining strategy profile of the rest of the players, every i an lv: c lv,v i max{lv ϕ 1, 0}. The technical core of the proof is the following lemma: X:9

10 X:10 LEMMA 2.5. In the ϕ-subgame, suppose that there are at least 7 sees, an at least 2β aitional noes are aware of the transaction. Then, any strategy c lv,v 1,..., c lv,v of noe v such that some c lv,v i = lv ϕ 1 is ominate by the strategy c lv 1,..., c lv,v i 1, clv,v i 1, c lv,v i+1,..., clv,v. The proof of the lemma is in Subsection Let us show how to use the lemma in orer to prove the theorem. First, we observe that the 0-subgame is simply the β, H-game. If the conitions of the lemma hol, we can apply the lemma to eliminate all strategies c lv,v 1,..., c lv,v such that some c lv,v i = lv 1. Notice that now we have a 1-subgame. Applying the lemma again we get a 2-subgame. Similarly, we repeately apply the lemma until we get a H 1-subgame. Notice that the only surviving strategy of each noe is 0,..., 0 for every lv: that is each noe propagates information an oes not uplicate. This shows that there exists an elimination orer in which every noe propagates information an oes not uplicate. Next, we prove that the strategy profile in which all noes propagate information an o not uplicate survives every orer of iterate elimination of ominate strategies process. LEMMA 2.6. Let T be a sub-game that is reache via iterate elimination of ominate strategies in the β, H-game, an suppose that there are at least 7 sees, an at least 2β aitional noes are aware of the transaction. Then there exists a strategy profile s T in which every noe at epth at most H fully propagates an o not uplicate. PROOF. Let us assume that some elimination orer ens with a sub-game that oes not contain any profile with full propagation an no uplication. Let T be the last subgame in the elimination orer for which there is still a profile with full propagation an no uplication for every noe at epth at most H. It must be that for some player i in T, the strategy s i of full propagation an no uplication is ominate by another strategy s i in which this player either uplicates or oes not fully istribute. In particular, let us fix the behavior of the other players to be the profile s i in which they fully istribute an o not uplicate such a profile exists in T by assumption. For s i to ominate s i, it must be that u i s i, s i u i s i, s i. We will show however that the opposite hols, an thereby reach a contraiction. We efine a series of strategies s 1 i, s2 i, s3 i,..., sm i such that s 1 i = s i, an sm i = s i for which we shall show: u i s i, s i = u i s 1 i, s i < u i s 2 i, s i <... < u i s m i, s i = u i s i, s i. Note, that the strategies s 2 i, s3 i,..., sm 1 i may or may not be in T, an that we are merely using them to establish the utility for s i, s i. The strategy s j+1 i is simply the strategy s j i, with one change: player i replicates itself one less time to one of its chilren. Specifically, if player i replicates itself c 1,..., c times corresponingly for each of its chilren, let ν = arg max j c j it will instea replicate itself c 1,..., c ν 1,..., c times in the new strategy. We establish the fact that u i s j i, s i < u i s j+1 i, s i by a irect application of Claim 2.7. The claim shows that replicating one less time is better given sufficient external computation power, an given that the noe s escenants fully istribute with no replication. Both of these are guarantee in the profile s Proof of Lemma 2.5. Now, let us observe a noe v an fix l = lv. The non-trivial case is when l ϕ + 1. For convenience, we rop the superscript lv, v an enote a strategy by c 1,..., c. Without loss of generality we assume c 1 c 2... c. It will also be useful to efine y i = l c i 1. Note that our previous assumption implies that y 1 y 2... y.

11 X:11 Let s v be a strategy profile of all other noes except v, an enote by A s v y i the size of the subtree roote at the i th chil of v that is aware of the transaction. The utility of v is then: 1 + β l Uv s v y 1,..., y = k + A s v y i } {{ } v authorizes + βl y i A s v y i k + A s v y i } {{ } a eceent of v authorizes where k is the number of noes which are aware of the transaction an are not escenants of v this number inclues v itself. We show that c 1,..., c, where c = lv ϕ 1 is ominate by c 1,..., c 1. For this purpose, it is sufficient to show the following claim: CLAIM 2.7. Let T v be the set of strategy profiles of all noes other than v in which: 1 The subtree roote at v s th chil spans a complete -ary tree of height y when v uplicates itself c times, or of a height y + 1 when v uplicates itself c 1 times. 2 There are at least k 2β y noes that are not escenants of v that are aware of the transaction. Then: s v T v Uv s v c 1,..., c 1 > Uv s v c 1,..., c Fig. 2. Noe v istributes the transaction to it s i th chil using c i ientities. It consiers istributing the transaction to the th chil with one less ientity, which enables the istribution tree below that chil to exten y + 1 levels assuming all noes below use only one ientity. The two scenarios are epicte in Figure 2. Notice, that in any ϕ-subgame, both of the conitions for the lemma hol in every profile: in a ϕ-subgame we have that if noe v clones itself at most lv ϕ 2 times then his chil will span a tree that contains a full -ary tree of height ϕ, an we are guarantee k noes that are aware of the transaction. We therefore turn to prove the claim.

12 X:12 PROOF. The new strategy c 1,..., c 1 in effect istributes the transaction to one aitional layer of the subtree roote at the th chil of v. That extra layers contains y noes. The utility of this strategy is therefore: Uv s v y 1,..., y 1, y +1 = 1 + β l + 1 βl y i A s v y i + βl y 1A s v y + y k + A s v y i + y So we have to show that: s v Uv s v y 1,..., y 1, y + 1 > Uv s v y 1,..., y For convenience, we will rop the inex s v, but remember that we must check for every possible strategy profile of the other noes that: 1 + β l + 1 βl y i Ay i + βl y 1Ay + y k + Ay > 1 + β l + βl y i Ay i i + y k + Ay i multiplying by the enominator an iviing both sies by β: k + Ay i l y 1Ay + y > k + Ay i l y Ay + y β 1 + l + l y i Ay i k + Ay i l y 1 y k + k + Ay i Ay i Ay > y β 1 + l + l y 1 Ay y > β 1 + l + l y i Ay i l y i Ay i Note that l y 1 Ay > 0 since l y y 2 an Ay < 1. Therefore we can ivie y by l y 1 Ay, after some rearranging we get that: y k > β 1 + l + l y i Ay i l y 1 Ay y Ay i k > β 1 + l + l y i l + y Ay y Ay i l y 1 Ay y k l y 1 Ay y > β 1 + l + y i + y Ay y Ay i = Recall that that the s chil spans a full tree of height y : Ay = y 1 1. We boun the right han sie of Equation as follows: β 1 + l + + i:y i=y i:y i>y Ay y Ay i Ay y Ay i i:y i=y +1 Ay y Ay i

13 X:13 The last summation is negative because Ay < 1, an once we substitute Ay y into the expression we have that: β 1 + l + Now notice that: i:y i=y 1 + Ay y Ay + i:y i=y +1 Ay y Ay Ay y Ay = Ay + y y Ay = Ay + 1 Ay y an so we can write: β 1 + l + i:y i=y y i=y Ay Ay β 1 + l + y Therefore, we are looking for k such that: We now ivie into two cases. k > β 1 + l + 2 Ay l y 1 Ay y i:y i=y y i=y +1 2 Ay 1 β 1 + l + 2 Ay 2 = Case I:. l 2y + 4. In this case By using the fact Ay < 1 an continuing from y Equation 2 we can write: < β 1 + l + 2 Ay l y 2 β 1 + l + 2 Ay l 2 where the last transition relies on the fact that l 4. 2 β Ay 1 l l 2 β Ay Case II:. l 2y + 3. Notice that by efinition l is always at least y + 2. Therefore, by continuing from Equation 2 we have: β 1 + l + 2 Ay 2 1 Ay y where for the secon transition we use: β 1 + l + 2 Ay Ay y = y 1 1 y < 1 1 = 1 β 1 + l + 2 Ay 2 Notice that Ay y, hence, l 2Ay + 3. Recall that 3 we can continue to boun : 1 β Ay β Ay From Case I, an case II combine, we have that:

14 X:14 2β Ay + 6 Thus, if k 2β 1 +6 Ay +6, for any noe v the strategy of choosing c i = lv ϕ 1 for some chil i is ominate by the strategy c 1,..., c i 1, c i 1, c i+1,..., c. Since k is the number of noes outsie the tree roote by v then for the lemma to hol it is sufficient to have 7 sees each with chilren that span trees at height y, an 2β aitional noes. 3. IMPOSSIBILITY RESULT FOR DOMINANT STRATEGY MECHANISMS In the previous sections, we presente several rewar schemes an analyze their behavior in equilibrium. The solution concept we analyze was iterate removal of ominate strategies. Although iterate removal of ominate strategies is a strong solution concept, a natural goal is to seek rewar schemes that use even stronger solution concepts. We now show that there are no ominant-strategy rewar schemes. THEOREM 3.1. Suppose that H 3. There is no Sybil-proof rewar scheme in which information propagation an no uplication are ominant strategy for all noes at epth 3 or less. PROOF. Consier a scenario in which all noes except one see s o not propagate information. Suppose that all the irect chilren of the see s play the following strategy: If they have one preecessor then they o not propagate information. In case they authorize the transaction they preten that they are a level 3 noe, by uplicating themselves once so if they authorize the transaction the resulting chain has a length of 3. If they have more than one preecessor then they still o not propagate information. However, if they authorize the transaction they o not uplicate themselves so again if they authorize the transaction the resulting chain has a length of 3. All other noes, incluing the chilren of the chilren of s, o not propagate information an o not uplicate themselves. Denote by the number of irect chilren of s, an consier the possible strategies of s. The see s can propagate information to all its chilren. In this case his chilren will not propagate information an one of them authorizes the transaction it pretens that it is a level 3 noes. Using the fact that there are t sees that are aware of the transaction, the utility of s in this case is: r 1,1 + r 3,3 t + However, suppose that s uplicate itself once an propagate information to its chilren. In this case again its chilren will be aware of the transaction. But now the utility of s in this case is: r 1,1 + r 2,3 + r 3,3 t +

15 X:15 Since information propagation an no uplication shoul be a ominant strategy for s, we must have: r 1,1 + r 3,3 r 1,1 + r 2,3 + r 3,3 t + t + r 1,1 + r 3,3 r 1,1 + r 2,3 + r 3,3 0 r 2,3 The contraiction will be reache by proving the following lemma: LEMMA 3.2. Suppose that H 3. In every Sybil-proof rewar scheme in which information propagation an no uplication are ominant strategy for all noes at epth 3 or less, we have that r 2,3 > 0. PROOF. Fix some noe u that receives the transaction with exactly one preecessor. Denote by k the number of noes that are aware of the transaction an are not escenants of u this number inclues u. Since u s ominant strategy is to propagate information to its chilren without uplication, the utility of this strategy is no worse than the utility of not propagating information at all. Suppose that the chilren never propagate information an never uplicate themselves: r 1,2 k r 1,2 + r 2,3 k + Since we assume that the rewar for the authorizer is strictly positive, we have that r 1,2 > 0 an therefore: Which gives us that r 2,3 > 0, as neee. r 1,2 k + < r 1,2 + r 2,3 k + Acknowlegements. We thank Jon Kleinberg an Ilya Mironov for helpful iscussions an valuable comments. REFERENCES BITCOIN. The Bitcoin wiki. Available online at CHITNIS, R., HAJIAGHAYI, M., KATZ, J., AND MUKHERJEE, K A gametheoretic moel for the arpa network challenge. Manuscript. DARPA The DARPA network challenge. Available online at DAVIS, J The crypto-currency: Bitcoin an its mysterious inventor. The New Yorker, October 10. DOUCEUR, J. R. AND MOSCIBRODA, T Lottery trees: motivational eployment of networke systems. SIGCOMM Comput. Commun. Rev. 37, DYAGILEV, K., MANNOR, S., AND YOM-TOV, E Generative moels for rapi information propagation. In Proceeings of the First Workshop on Social Meia Analytics. SOMA 10. ACM, New York, NY, USA, EMEK, Y., KARIDI, R., TENNENHOLTZ, M., AND ZOHAR, A Mechanisms for multi-level marketing. In Proceeings of the 12th ACM conference on Electronic commerce. EC 11. ACM, New York, NY, USA, KLEINBERG, J. AND RAGHAVAN, P Query incentive networks. In FOCS 05: Proceeings of the 46th IEEE Symposium on Founations of Computer Science

16 X:16 KRUGMAN, P Golen cyberfetters. Available online at NAKAMOTO, S Bitcoin: A peer-to-peer electronic cash system. Available online at PICKARD, G., PAN, W., RAHWAN, I., CEBRIAN, M., CRANE, R., MADAN, A., AND PENTLAND, A Time-critical social mobilization. Science 334, 6055, REID, F. AND HARRIGAN, M An analysis of anonymity in the Bitcoin system. CoRR arxiv/ SUROWIECKI, J Cryptocurrency. Technology Review, MIT. September/October. Available online: A. A BRIEF OVERVIEW OF BITCOIN In this section we give a brief overview of the Bitcoin protocol. This is by no means a complete escription. The main purpose of this section is to help unerstaning our moeling choices, an why our propose rewar schemes can be implemente within the context of the existing protocol. The reaer is referre to [Nakamoto 2008] an to the Bitcoin wiki for a complete escription. A.1. Signing Transactions an Public Key Cryptography The basic setup of electronic transactions relies on public key cryptography. When Alice wants to transfer 50 coins to Bob, she signs a transaction using her private key. Hence, everyone can verify that Alice herself initiate this transaction an not someone else. Bob, in turn, is ientifie as the target of the transfer using his public key. For the money to be actually transferre from Alice s account to Bob s account, some entity has to keep track of the last owner of the coins, an to mark Bob as the new owner. Otherwise, Alice coul ouble spen her money first transfer the coins to Bob, then transfer the same coins again to Charlie. Traitionally, this role was fulfille by banks. In return, banks tene to charge high fees, for example in international transfers. A.2. Agreeing on the History by Majority of CPU power Bitcoin suggests a ifferent solution to this problem. A peer to peer network is use to valiate all transactions. Noes in the network agree on a common history using a majority of CPU power mechanism. A mechanism can not rely on a numerical majority of the noes, as it is relatively easy to create aitional ientities in a network, for example by spoofing IP aresses. We first escribe the protocol that the network implements an then explain why the history is accepte only if it is agree upon by noes that together control a majority of the CPU power. Let us assume again that Alice wants to transfer 50 coins to Bob. Alice will sen her signe transaction to some of the noes in the network. Next, these noes will forwar the transaction to all of their neighbors in the network an so on. A noe that receives the transaction first verifies that this is a vali transaction e.g. that the money being transferre inee belongs to Alice. If successful, the noe as this transaction to the block of transactions it attempts to authorize a block is simply a set of transactions; the specific etails on the structure of this block are omitte. To authorize a block, a noe has to solve an inverse Hash problem. More specifically, its goal is to a some bits nonce to the block such that the Hash value of the new block begins with some preefine number of zeroes. The number of zeroes is ajuste such that the average time it takes the network to sign a block is fixe. The protocol uses a clever metho to aggregate transactions a Merkle tree which assures that the size of the block to be hashe is also fixe. Aitional information that is inclue in the block is the hash of the previously authorize

17 X:17 block. So, in fact, the authorize blocks form a chain in which each block ientifies the one the precee it. When a noe authorizes a block it broacasts to the network the new block an the proof of work the string which is ae to the block to get the esire hash. If a noe receives two ifferent authorize blocks it aopts the one which is part of the longer chain. Let us argue briefly an informally why the history is etermine by the majority of the CPU power [Nakamoto 2008]. That is, the probability that a group of malicious noes manages to change the history ecreases as the fraction of CPU they control ecreases. Assume that a group of malicious noes, that oes not have the majority of the CPU power, wants to change the chain that has currently been aopte by the other noes. Since the malicious noes own less CPU power, their authorization rate is slower than the authorization rate of the majority of the network, which is honest. Therefore, the longer chains will be signe by the majority of the network with high probability an these are the ones that will be aopte by the honest noes in the network. In fact, once a block has been accepte into the chain, the probability that a longer chain that isplaces it will appear ecreases exponentially with time as the chain that follows it grows longer it is harer to manufacture a longer alternative one. See [Nakamoto 2008] for a more formal argument. A.3. Transaction Fees To incentivize noes to participate in the peer to peer network an invest effort in authorizing transactions, rewars have to be allocate. Currently, in the initial stages of the protocol this is one by giving the authorizer of a block a fixe amount of bitcoins this also the only metho for printing new bitcoins. This fixe amount will be reuce every few years at a rate etermine by the protocol. As the money creation is slowly phase out, there will be a nee to rewar the noes ifferently. The protocol has been esigne with this in min. It alreay requires the transaction initiator to specify a fee for authorizing her transaction. As we explaine in the introuction this introuces an incentive problem since noes prefer to keep the transaction to themselves instea of broacasting it. A.4. On Implementing the Hybri Scheme We start with a rough escription of how fees for authorizing transactions in Bitcoin are currently implemente. Alice prouces a transaction recor in which she transfers some of her coins to Bob. She specifies the fee if any for authorizing this transaction in a fiel in the transaction recor, an then cryptographically signs this recor. When Victor authorizes a transaction, the implication is that Alice transferre some amount of money to Bob, an some amount of money specifie in the fee fiel to Victor. Any β, H-almost uniform scheme can be implemente similarly an thus, the Hybri scheme can be implemente similarly. Alice prouces a ifferent transaction recor for every see, in which she specifies β, H, an some amount of coins f we normalize f = 1 in the previous sections the total fee if a noe in tree roote by the see authorizes the transaction will be 1 + β H f. We moify the protocol so that every noe that transfers the transaction to its chilren cryptographically signs the transaction, an specifically ientifies the chil to whom the information is being sent using that chil s public key. The transaction information, therefore inclues a chain of custoy for the transaction which will be ifferent for every noe that tries to authorize the transaction. The implication of Victor authorizing a transaction is that Alice transferre some amount of money to Bob, a fee of f β to every noe in the path as it appears in the authorize transaction, an a fee of f + β H h + 1 f to Victor

18 X:18 if the path was of length h H. Payments will not be aware if the chain of custoy is not a vali chain that leas from Alice to Victor.