Protocol Details
Bonded Mining enhances existing PoW mining schemes by adding a collateral
requirement to ensure hash rate commitments are honored. Figure 1 illustrates
many aspects of the protocol, and a List of Symbols appears in the Appendix.
To bootstrap, miner m must post bond to the blockchain by paying b coins into
a bond pool account via a validated deposit transaction. The bond is posted prior
to mining the first block and is locked until the miner produces his first n blocks,
where n is a tunable security parameter depending on the miner’s hash rate. As
part of the deposit transaction, miner m also stipulates his commitment c
m
1
for
the hash rate he will apply to mining his first block, k
m
1
.
Mining. Now consider the next n − 1 blocks mined by m: k
m
2
, . . . , km
n
. Define
t(k
m
i
) as the time that k
m
i
is mined. Let t(k
m
0
) be defined as the time of the
block containing the deposit transaction. When mining block k
m
i
, miner m adds
a new deposit transaction to the set of transactions being mined, which deposits
an additional b coins to the bond pool. In assembling the block, he uses the
typical block header, and includes two new pieces of information: report r
m
i
and commitment c
m
i+1. Report r
m
i
is an attestation from miner m of his actual
average hash rate during the time period between t(k
m
i−1
) and t(k
m
i
). And c
m
i+1
is m’s commitment for the next block k
m
i+1. If m wishes to stop after n blocks,
then he can issue a divestment transaction (see Bond state section below) and
c
m
n+1 is unnecessary; otherwise c
m
n+1 should contain the commitment for the next
block. When block k
m
i
is eventually mined by m, the coinbase is immediately
transferred to the miner’s wallet, but bond is released only upon reconciliation.
To be clear: the miner can adjust commitments each block starting from block
k
m
2
; but reconciliation begins from block k
m
n onward and evaluates a window of
the previous n blocks.
Reconciliation. If i blocks, i > n, have been mined by m, then his block k
m
i
includes a reconciliation transaction that pays himself a reconciliation payment
f
m
i ≤ b from the bond pool. f
m
i
is the refunded portion of the bond deposited by
m while mining block k
m
i−n
, which is now eligible to be reconciled. (Miners never
forfeit coinbase rewards.) Miner m signs and confirms his own reconciliation
transaction, but if he repays an inappropriate amount, then the transaction is
considered to be invalid by other miners and the entire block is ignored. The
value of f
m
i
is determined in two stages. The first tests m’s reporting accuracy via
binary hypothesis test Valid(r
m), which deterministically rejects or accepts the
null hypothesis that the inter-block times from t(k
m
i−n
), . . . , t(k
m
i
) are samples
that came from the distribution implied by reports r
m = r
m
i−n
, . . . , rm
i
. If the null
hypothesis is rejected, then f
m
i = 0; i.e., m loses all his bond deposited in block
k
m
i−n
. However, if the null hypothesis is not rejected, then in the second stage we
evaluate m’s commitment fulfillment by setting
f
m
i = b − b · min
1,
r
m
i − c
m
i
cm
i
. (1)
We tune the hypothesis test so that if m honestly reports his hash rate for each
block k
m
j
, then he is very likely to pass, and then m will be repaid his bond as
the absolute difference between his committed and actual hash rates.
Bond State. We define four distinct states for bonded miners: Bootstrapping,
Fully Bonded, Divested, and Abandoned. A new miner who has not yet deposited
nb total bond is bootstrapping. Once she has contributed n mined blocks to the
main chain, her total bond reaches nb and the miner is considered fully bonded.
Note that the number of blocks required to reach the Fully Bonded state depends
on the miner’s committed hash rate as a fraction of the total. Accordingly, miners
may fluctuate between Bootstrapping and Fully Bonded states if the total hash
rate changes. A fully bonded miner is eligible to divest her bond in order to
reduce her hash rate on the blockchain to zero. The miner signals this intent by
submitting a divestment transaction, which can appear in any block, not just one
that she mines. The transaction contains reconciliation payments (see above) for
each of her n bond deposits that remain in the bond pool. Once the divestment
transaction is confirmed, the miner is fully divested: she is committed to zero
hash rate and has no remaining bond. In order to begin mining again, a divested
miner must proceed through the Bootstrap state. Finally, a miner can reach the
Abandoned state from either the Bootstrapping or Fully Bonded states if she fails
to generate a block in a reasonable amount of time given her last commitment
(see below). If the miner reaches the Abandoned state, all of her bond is lost,
and she transitions to the Divested state. (The bond is burned, but could be
redistributed as future coinbase.)
Abandonment Detection. The test for abandonment is distinct from the test
Valid. It is conducted every block (as opposed to only those generated by the
miner). For each miner m in either the Bootstrapping or Fully Bonded state,
we have c
m
i
, the latest commitment from m. We argue in Section 4 that if m
honors her commitment, then the inter-arrival time of her ith block, T
m
i
, is
exponential. Specifically, T
m
i ∼ Expon(T /cm
i
) where T is the target inter-block