FruitChains: A Fair Bloc ockchain Authors: Rafael Pass, Elaine Shi - - PowerPoint PPT Presentation

FruitChains: A Fair Bloc

• ckchain

Authors: Rafael Pass, Elaine Shi

presented by Han Zhang

Nakamoto’s Blockchain

• A sequence of (mined) blocks 𝑐 =

(ℎ%&, η, 𝑛, ℎ)

• 𝑛: record
• ℎ%&: pointer to the (record in) previous block
• ℎ: pointer to the current record
• η: nonce
• proof-of-work, derived from the pair= ℎ%&, 𝑛
• Assumption: Majority of the

computing power is controlled by honest players

• Strong assumption
• lots of work for solve the computational

puzzles

• Players are incentivized by
• mining rewards and transaction fees for

every block

Selfish Mining and Fairness

• Minority fraction ρ < & -

⁄ of computational power in the network can contribute a significantly larger fraction of blocks than it “fair share” ρ

• Assuming the adversary controls the delivery of messages on the network
• (1 − ρ)𝑈 by hones players, ρ𝑈 blocks are replaced by adversarial blocks
• The expected fraction of adversarial blocks becomes N

&%N

• ρ = 1/2,

N &%N =1, twice its fair share of the rewards

• Chain quality
• The chain contains a sufficient fraction of blocks contributed by honest players
• Ideally, we can have a fair blockchain protocol with a 1 − ρ chain quality
• Honest players contributing a 𝜚 ≤ 1 − ρ fraction of the computational sources get a 𝜚

fraction of the blocks and thus rewards in any sufficiently long window

FruitChain

• FruitChain protocol satisfies “close-to-optimal” fairness
• An adversary controls up to a ρ fraction of the computing power, and as a

consequence the adversary coalition cannot get more than 1 + δ ρ

• δ < 0.3
• δ-approximately fair: honest players are guaranteed to get at least a 1 − δ (1 − ρ)

fraction of the blocks in every sufficiently long window

FruitChain

Nakamoto

• Nakamoto: 𝑐 = ℎ%&, η, 𝑛, ℎ
• Nakamoto
• Pr 𝐼(ℎ%&, η, 𝑐) < 𝐸[ = 𝑞
• Blocks by blocks

FruitChain

• Fruit mining and Block mining:
• Fruits: 𝑔 = ℎ%&; ℎ_; η; 𝑒𝑗𝑕𝑓𝑡𝑢(𝐺); 𝑛; ℎ
• The records are put inside “fruits” and these fruits themselves

requires solving some proof of work

• Blocks look like fruits: 𝑐 =

ℎ%&; ℎ_; η; 𝑒𝑗𝑕𝑓𝑡𝑢(𝐺); 𝑛; , 𝐺

• Digest of some fruit-set F to be included in the block later;
• ℎ_ pointer that points to the block the fruit is hanging from
• Hardness parameter 𝑞g
• Fruit mining and block mining are piggybacked by

each other

• A fruit is required to “hang” from a block which isn’t too

far from the block which records the fruit

• Recency Parameter
• how far back a fruit is allowed to hang

Step1: Block 1 Step 3: Fruit 1 hang from Block 1 Step 2: Block 2

FruitChain

• In each round, , check 𝓵 steps back
• honest players simultaneously mine for a

fruit and a block

• 𝐼 ℎ%&; ℎ_; η; 𝑒𝑗𝑕𝑓𝑡𝑢(𝐺); 𝑛; ℎ = ℎ
• [ℎ]%𝓵 denotes the last 𝓵 bits of ℎ
• [ℎ]𝓵 denotes the first 𝓵 bits of ℎ
• 𝓵 = 2, 𝑑ℎ𝑏𝑗𝑜 = 10)

Block 10: block Block 11: fruit is pointed in 𝑑ℎ𝑏𝑗𝑜 − 𝓵=10-2=8th block Block 12: block with 𝐺 Block 13: block Block 8

Selfish Mining

• Selfish mining fails in FruitChain
• Even if an adversary tries to “erase” some block mined by an honest

player (which contains some honest fruits)

• An honest player will mine a new block which is stable and this

honest player will include the fruit in it

• The time before such an “honest block” arrives is short enough for

the fruit to still be “recent” at the time of the honest block arriving

FruitChain

• Why we require fruits to be recent
• Without it, an attacker could withhold fruits, and suddenly release

lots of them at the same time, thereby creating an very high fraction

• f adversarial fruit in some segment of the FruitChain.
• By requiring the fruits to be recent, we prevent the adversary from

squirreling away (too many of) it’s fruits.

Questions…