Cryptocurrency

Protocol Details

Bonded Mining enhances existing PoW mining schemes by adding a collateral

requirement to ensure hash rate commitments are honored. Figure 1 illustrates

many aspects of the protocol, and a List of Symbols appears in the Appendix.

To bootstrap, miner m must post bond to the blockchain by paying b coins into

a bond pool account via a validated deposit transaction. The bond is posted prior

to mining the first block and is locked until the miner produces his first n blocks,

where n is a tunable security parameter depending on the miner’s hash rate. As

part of the deposit transaction, miner m also stipulates his commitment c

m

1

for

the hash rate he will apply to mining his first block, k

m

1

.

Mining. Now consider the next n − 1 blocks mined by m: k

m

2

, . . . , km

n

. Define

t(k

m

i

) as the time that k

m

i

is mined. Let t(k

m

0

) be defined as the time of the

block containing the deposit transaction. When mining block k

m

i

, miner m adds

a new deposit transaction to the set of transactions being mined, which deposits

an additional b coins to the bond pool. In assembling the block, he uses the

typical block header, and includes two new pieces of information: report r

m

i

and commitment c

m

i+1. Report r

m

i

is an attestation from miner m of his actual

average hash rate during the time period between t(k

m

i−1

) and t(k

m

i

). And c

m

i+1

is m’s commitment for the next block k

m

i+1. If m wishes to stop after n blocks,

then he can issue a divestment transaction (see Bond state section below) and

c

m

n+1 is unnecessary; otherwise c

m

n+1 should contain the commitment for the next

block. When block k

m

i

is eventually mined by m, the coinbase is immediately

transferred to the miner’s wallet, but bond is released only upon reconciliation.

To be clear: the miner can adjust commitments each block starting from block

k

m

2

; but reconciliation begins from block k

m

n onward and evaluates a window of

the previous n blocks.

Reconciliation. If i blocks, i > n, have been mined by m, then his block k

m

i

includes a reconciliation transaction that pays himself a reconciliation payment

f

m

i ≤ b from the bond pool. f

m

i

is the refunded portion of the bond deposited by

m while mining block k

m

i−n

, which is now eligible to be reconciled. (Miners never

forfeit coinbase rewards.) Miner m signs and confirms his own reconciliation

transaction, but if he repays an inappropriate amount, then the transaction is

considered to be invalid by other miners and the entire block is ignored. The

value of f

m

i

is determined in two stages. The first tests m’s reporting accuracy via

binary hypothesis test Valid(r

m), which deterministically rejects or accepts the

null hypothesis that the inter-block times from t(k

m

i−n

), . . . , t(k

m

i

) are samples

that came from the distribution implied by reports r

m = r

m

i−n

, . . . , rm

i

. If the null

hypothesis is rejected, then f

m

i = 0; i.e., m loses all his bond deposited in block

k

m

i−n

. However, if the null hypothesis is not rejected, then in the second stage we

evaluate m’s commitment fulfillment by setting

f

m

i = b − b · min 

1,









r

m

i − c

m

i

cm

i











. (1)

We tune the hypothesis test so that if m honestly reports his hash rate for each

block k

m

j

, then he is very likely to pass, and then m will be repaid his bond as

the absolute difference between his committed and actual hash rates.

Bond State. We define four distinct states for bonded miners: Bootstrapping,

Fully Bonded, Divested, and Abandoned. A new miner who has not yet deposited

nb total bond is bootstrapping. Once she has contributed n mined blocks to the

main chain, her total bond reaches nb and the miner is considered fully bonded.

Note that the number of blocks required to reach the Fully Bonded state depends

on the miner’s committed hash rate as a fraction of the total. Accordingly, miners

may fluctuate between Bootstrapping and Fully Bonded states if the total hash

rate changes. A fully bonded miner is eligible to divest her bond in order to

reduce her hash rate on the blockchain to zero. The miner signals this intent by

submitting a divestment transaction, which can appear in any block, not just one

that she mines. The transaction contains reconciliation payments (see above) for

each of her n bond deposits that remain in the bond pool. Once the divestment

transaction is confirmed, the miner is fully divested: she is committed to zero

hash rate and has no remaining bond. In order to begin mining again, a divested

miner must proceed through the Bootstrap state. Finally, a miner can reach the

Abandoned state from either the Bootstrapping or Fully Bonded states if she fails

to generate a block in a reasonable amount of time given her last commitment

(see below). If the miner reaches the Abandoned state, all of her bond is lost,

and she transitions to the Divested state. (The bond is burned, but could be

redistributed as future coinbase.)

Abandonment Detection. The test for abandonment is distinct from the test

Valid. It is conducted every block (as opposed to only those generated by the

miner). For each miner m in either the Bootstrapping or Fully Bonded state,

we have c

m

i

, the latest commitment from m. We argue in Section 4 that if m

honors her commitment, then the inter-arrival time of her ith block, T

m

i

, is

exponential. Specifically, T

m

i ∼ Expon(T /cm

i

) where T is the target inter-block