Nicolas Houy
email: houy@gate.cnrs.fr

The Bitcoin mining game

Keywords: C72, D62 Bitcoin, mining, crypto-currency, game

When processing transactions in a block, a miner increases his reward but also decreases his probability to earn any reward because the time needed for his block to reach consensus depends on its size. We show that this leads to a game situation between miners. We analytically solve this game for two miners. Then, we show that miners do not play a Nash equilibrium in the current Bitcoin mining environment, instead, they should not process any transaction. Finally, we show that the situation where no transaction is ever processed would stop being a Nash equilibrium if the transaction fee was multiplied or, equivalently, the xed reward divided by a factor of about 12.

Introduction

Bitcoin 1 has been invented in 2008 ( [START_REF] Nakamoto | [END_REF]) but it really became popular and left the circle of strict early adopters in 2013. At the time this article is written, bitcoins can be bought and sold at about $620 apiece on some exchange markets. The monetary base is about $7,700,000,000. Bitcoin is usually described by laymen as an electronic or internet money even though this denition is much criticized by the computer science community that rather talks about a disruptive and revolutionary protocol. As a protocol, Bitcoin is still in its early stages of development and its specications are still often modied. In order to reach the stage of implementation, a proposed modication goes through a whole process of validation. Some questions regarding some specications of the Bitcoin protocol are still more or less open, transitory or left undecided. Among those questions is the value and structure of the rewards earned by the miners. In this paper, we analyze this aspect of the Bitcoin protocol. Notice that the study we lead in this article are inspired by the qualitative intuitions given in [Andresen, 2013].

In order to do that, we need to describe, even supercially, how Bitcoin actually works. When an individual sends some bitcoins to another individual, this information is broadcast to the peer-to-peer Bitcoin network. However, for technical purposes we won't address here, this transaction needs to be included, together with other transactions forming a block, in the blockchain in order to be conrmed and secured. The blockchain is a public ledger that contains the full history of all the transactions in bitcoin ever processed. It is the role of miners to do this work of conrming and securing2 transactions. Practically, this mining process consists in solving a mathematical problem and spreading the result to the Bitcoin network for it to reach consensus. 3 The rst miner to do so sees his block included in the blockchain. As it requires computational resources, the successful miner is rewarded in bitcoins for his useful work. In the current implementation of Bitcoin, this reward comes from both an ex-nihilo creation of some new bitcoins and some fees Bitcoin users can add to their transactions. In order to control the monetary base, mining is made more complex than it could be. And since, in the rst approximation, the probability for each miner to solve a mining problem depends on his computational power, the complexity of mining is made dependent on the total computational power of all miners. Precisely, the complexity is dynamically adjusted so that a block solving and hence a creation of bitcoins occurs every ten minutes in expectation.

In this article, we tackle the question of the incentives the miners face as a function of the reward structure and values. First, let us see the possible gains. As it is today, the xed reward is 25 BTC per block. The xed reward was 50 BTC in the rst days of Bitcoin and this amount is halved every 210,000 blocks. Hence, the number of bitcoins issued is programmed to asymptotically reach a maximum of 21,000,000. At the time this article is written, there are about 12,500,000 bitcoins in circulation. The variable reward is 0.0001 BTC per transaction. 4 Second let us see the cost structure. When mining a block, a miner is free to choose which of the transactions in the network he wishes to include in his block. In a very good rst approximation, computing the mining mathematical problem with more transactions included in it is not more expensive in terms of CPU, disk or bandwidth. However, it should be considered that the larger a block, the longer it takes for it to be spread in the Bitcoin network and reach consensus. Then, including transactions in a block can have the adverse eect of lowering the probability of a miner to earn any reward. When a block is mined but is outraced by another, it becomes orphaned.

As we will show, this trade-o depends on how many transactions other miners include in their blocks themselves. Then, the number of transactions included in blocks is the outcome of a game: the Bitcoin mining game that we propose to study in this article.

In Section 2, we describe the Bitcoin mining game. In Section 3, we analytically study the equilibria of this game in the case with two miners. In Section 4, we study the current situation of the Bitcoin mining environment. We show that Bitcoin miners are not at a Nash equilibrium and a unilateral deviation could increase its author's benet up to 2%. We also show that with the current incentives, miners should simply all play the strategy of including no transaction in their blocks. Finally, we will show that, if the miners' relative computational power distribution remains the same, the equilibrium where no miner includes a transaction in a block will stop being one in about 15 years or today if the transaction fee is increased by a factor 12.

Model

Let us consider a set N = {1, ..., N } of miners on the Bitcoin network with N ≥ 2.5 Each miner i ∈ N has a relative hash power α i > 0 such that j∈N α j = 1. Miners struggle against each other in a race to nd the solution of a mathematical problem. This mathematical problem is solved by a try and guess strategy such that the occurrence of solving the problem can be modeled as a random variable following a Poisson process. The complexity of nding a block is dynamically adjusted so that this operation takes 600 seconds in expectation. Then, the mining Poisson process of the mining process has a parameter λ = 1/600 > 0 for the whole network.

The number of transactions included in a block to be solved is chosen by each miner. This number has no eect on the complexity of the mathematical problem or on the cost to solve it. However, once a miner has found a block with a given number of transactions in it, he needs to broadcast his solution to the Bitcoin network and his solution must reach consensus. Now, the time needed for a block to reach consensus is depending on the number of transactions included in this block. Let k(x) be the time needed for a block including x transactions to reach consensus. We will make the assumption that this time function is linear, k(x) = k.x with k > 0. The rst miner to have found a block that reaches consensus earns (in bitcoins) a xed reward R ≥ 0 and a variable one c.x with c ≥ 0.

We assume that all miners start trying to nd a new block at the same time. Each miner i ∈ N includes x i > 0 transactions in the block he tries to nd. Let - → x = (x 1 , ..., x n ) be the sequence of the numbers of transactions included in the new block to be found, one for each miner. Obviously, the probability for i to nd a block between t and t + dt and that this block will be the rst to reach consensus is

  j∈N,t+k(x i )-k(x j )≥0 exp(-λα j (t + k(x i ) -k(x j )))   λα i dt.
(1) After simple calculation, for any miner i ∈ N , the probability P i ( - → x ) to nd a block and that this block will be the rst to reach consensus is

P i ( - → x ) = α i λ ∞ t=0 exp -λ (1 -Q i ( - → x , t))(t + k(x i )) + A i ( - → x , t) -k dt, (2)
where

k = j∈N α j k(x j ),
and ∀i ∈ N, ∀t > 0, 6 Q i ( - → x , t) = j∈N α j 1 (k(x j )>t+k(x i )) , A i ( - → x , t) = j∈N α j k(x j )1 (k(x j )>t+k(x i )) .
The expected reward Π i ( - → x ) is equal to the probability to nd the rst block to reach consensus times the reward if this is the case.

Π i ( - → x ) = (R + c.x i )P i ( - → x ).
(

) 3
The following is straightforward from Equations 1 and 3.

Proposition

1 Let i ∈ N . 1. ∀j ∈ N \ {i}, ∂Π i ( - → x ) ∂x j ≥ 0, 2. ∀j ∈ N \ {i}, ∂Π i ( - → x ) ∂x j > 0 whenever (R + c.x i ) > 0, 3. ∂Π i ( - → x ) ∂x i < 0 whenever c = 0 and R > 0, 4. ∂Π i ( - → x ) ∂x i = 0 whenever c = 0 and R = 0.
Proposition 1 shows that introducing transactions in blocks by a miner has positive externalities on other miners (and hence that our game theoretical approach is justied). Indeed, when a miner i ∈ N introduces more transactions in his block, he makes longer the time needed to spread his block, in turn allowing more time for other miners to nd the next block, spread it to the network and reach consensus with it. However, this does not imply that the expected reward decreases for i. Indeed, it is true that introducing more transactions in the block he is looking for decreases i's probability to nd and spread it rst. But it also increases the reward he earns in case he is actually the rst one to nd and spread the next block. Of course, for this reasoning to be valid, we need to have c > 0 or else the marginal benet to include transactions in blocks vanishes. In the trivial case where c = 0 and R = 0, the benets of mining is obviously 0 anyway: there is nothing to earn whatever the sequence - → x . Generally, in order to decide the optimal number of transactions to include in a block, each miner i ∈ N solves the following maximization program.

max x i ∈R + Π i ( - → x ).
(4)

We will need the following Lemma in the remainder. Assume that all miners include the same number of transactions in their blocks, formally, ∀i ∈ N, x i = x. Then, for each miner i ∈ N , the probability to earn the reward associated with a block solving is just the probability to solve the mining mathematical problem rst and hence is directly proportional to the hash rate α i . Formally, in this case, ∀i ∈ N, ∀t ≥ 0,

A i ( - → x , t) = Q i ( - → x , t) = 0 and Lemma 1 is proved with simple calculation. Lemma 1 If ∀i ∈ N, x i = x, then P i ( - → x ) = α i and Π i ( - → x ) = (R + cx)α i .
For the sake of simplicity, we will now concentrate on the case with N = 2 even though most of our results can be generalized to the N > 2 case with no logical diculty but at the price of cumbersome calculation.

3 The two miners case

Let N = {1, 2}. For any miner i ∈ N , if x i ≥ x 3-i , 7 then ∀t > 0, Q i ((x 1 , x 2 ), t) = 0 and A i ((x 1 , x 2 ), t) = 0.
Then, the expected reward earned by miner i is

Π i (x 1 , x 2 ) = Π + (x i , x 3-i ) = (R + c.x i )α i exp (-(1 -α i )λ(k(x i ) -k(x 3-i ))) .
Following, assume x i < x -i , the expected reward earned by miner i is

Π i (x 1 , x 2 ) = Π -(x i , x 3-i ) = (R + c.x i ) (1 -(1 -α i ) exp (-α i λ(k(x 3-i ) -k(x i )))) . v.0.1
Let N E ⊆ 2 (R + ) 2 be the set of Nash equilibria of the mining game. Formally,

∀(x * 1 , x * 2 ) ∈ (R + ) 2 , (x * 1 , x * 2 ) ∈ N E if and only if x * 1 ∈ arg max x 1 ∈R + Π 1 (x 1 , x * 2 ) and x * 2 ∈ arg max x 2 ∈R + Π 2 (x * 1 , x 2 ).
Our rst result is rather trivial and follows directly from Proposition 1(3). When c = 0 and R > 0,8 including a transaction in a block has the only consequence to make longer the period needed for a miner's block to reach consensus. The marginal reward associated with this inclusion is null. Hence, there are only negative incentives for miners to include transactions in blocks.

Proposition 2

Let c = 0 and R > 0. The Bitcoin mining game has a unique Nash equilibrium

(x * 1 , x * 2 ) ∈ (R + ) 2 with x * 1 = x * 2 = 0. Moreover, Π 1 (x * 1 , x * 2 ) = α 1 R and Π 1 (x * 1 , x * 2 ) = α 2 R.
For non trivial cases with c > 0, let us rst concentrate on the symmetric games, i.e. on the cases with equal hash power, α 1 = α 2 = 1/2. For each of these games, there exists a unique Nash Equilibrium and it is symmetric.

Proposition 3

Let c > 0. Assume α 1 = α 2 = 1/2. The Bitcoin mining game has a unique Nash equilibrium

(x * 1 , x * 2 ) ∈ (R + ) 2 with x * 1 = x * 2 = max 0, 2 λk - R c . Moreover, Π 1 (x * 1 , x * 2 ) = Π 2 (x * 1 , x * 2 ) = max R/2, c λk .
Then, in the symmetric case, Nash equilibria are symmetric. This is in line with the idea that when including transactions in blocks, a miner has a positive externality on other miners. Indeed, if there was a dierence between two identical miners, say x 1 < x 2 , 1 would marginally benet more from 2's action than 2 would benet from 1's action. Hence there exist a force for 1 to increase the number of transactions to include in his block and a force for 2 to decrease the number of transactions to include in his block. Then, a trend toward equalization of actions. Notice also that the fact that including transactions in blocks has positive externalities implies a globally low level of transactions included in blocks. Indeed, if the two miners were cooperating and maximizing the sum of the prots, they would choose x 1 and x 2 as large as possible.

Now, let us study the asymmetric case. With no loss of generality, let us assume

α 1 > α 2 .

Proposition 4

Let c > 0. Assume with no loss of generality, α 1 > α 2 . The Bitcoin mining game has a unique Nash equilibrium

(x * 1 , x * 2 ) ∈ (R + ) 2 with • if 1 λk(1 -α 1 ) - R c ≤ 0, x * 1 = x * 2 = 0. • if 1 λk(1 -α 1 ) - R c > 0, x * 1 = 1 λk(1 -α 1 ) - R c > x * 2 ≥ 0.
In the asymmetric case, there is still a large set of parameters for which not including any transaction in a block for both miners is the only Nash equilibrium of the Bitcoin mining game. We can also notice that the number of transactions included by the miner with the greatest hash power is larger than the number of transactions included by the miner with the lowest hash power.

Obviously, as one of the main interests of Bitcoin is to serve as a payment system, it is of great importance to check for the plausibility of the set of parameters for which miners do not include transactions for processing in their blocks. If it were the case, Bitcoin could denitely not be used as a payment system. This is the motivation to study the mining environment as it is today.

The current case

In this Section, we study the current behavior of the actual miners in the Bitcoin network. Concretely, miners are rather mining pools but we will make no dierence as we consider that the best strategy for a mining pool is the same whether it is a pool or a single miner, benets being redistributed among the participants of the pool. All the data we need for this study is made public in the Bitcoin blockchain and protocol9 or relies on the assumption based on personal expertise and experience that, today, all miners include all the transactions in the network when trying to nd a block. Unless otherwise stated, the values for our computations are displayed in Table 1. We will also consider that the Bitcoin network hash power is distributed as shown in Table 2 (row B). We inferred these relative hash powers of miners from an analysis of the blocks found. Indeed, if we make, as already noted, the assumption that all miners include all the transactions in the network in their blocks, then, by Lemma 1, the probability to solve a block for any miner is exactly equal to his relative hash power. Further, we make the assumption that the frequency of blocks found by a miner10 , that we can observe, is the probability that he solves a block and, hence, his relative hash power.

Let us start our analysis of the current situation displayed in Table 2. We make the assumption that there are 320 transactions in the network. This is the average number of transactions in the blocks inserted in the blockchain in the year preceding our study (and this number is rather stable). As we said above, it is today's practice that when mining a block, all miners introduce all 320 transactions in the block they are mining. Formally, ∀i ∈ N, x i = 320. In this case, by Lemma 1, the probability to nd a block rst (and equivalently to be the rst to see his block reach consensus), is equal to its share of the total hash power (row B). We can now consider each miner and compute his best response to the other miners' current strategy. This optimal number of transactions to include in the current computed block is 0 for all miners (row D). This shows that the current situation is not a Nash Equilibrium. Stronger, all miners have a protable deviation. If unilaterally mining blocks with no transaction, a miner would increase his probability to earn the xed 25 BTC reward (row E) at the cost of the 320 × 0.0001 = 0.32 BTC variable reward in case of successful mining. In the current case, this deviation would lead to a higher expected benet (rows F,G). We can also check that all miners including no transaction in the block they are mining (∀i ∈ N, x i = 0) is a Nash Equilibrium with the current parameters given in Table 1. The expected reward for miner i, in this case where ∀j ∈ N, x j = 0 is α i .R by Lemma 1. The actual values are given in Table 3. Now, we study the conditions under which the situation where all miners include no transaction in their blocks is a Nash equilibrium. Said dierently, when no miner should include any transaction in their blocks, Bitcoin fails at being an ecient payment system. Hence, we look at the set of parameters for which a minimum requirement for Bitcoin to be a usable payment system is met. From Equation 3, it is straightforward to see that

Π i ( - → x ) = (R + cx i )α i exp (-λ(1 -α i )k(x i )) whenever - → x is such that ∀j ∈ N \ {i}, x j = 0.
Then, since c > 0, the best response number of transactions to include in a block by i ∈ N is11 arg max

x i >0 Π i ( - → x ) = {max{0, 1 λ(1 -α i )k - R c }}.
Then, the situation where all miners include no transaction in their blocks stops being a Nash equilibrium when ∃i ∈

N, c λ(1 -α i )k > R.
The highest value of R for which this occurs is R ≈ 2.03 BTC below which GHash.IO will have an incentive to include some transactions in the block it tries to mine. Since R halves about every 4 years, this situation will occur in about 15 years with 2: A: miner's name, B: relative hash power, C: expected reward when ∀i ∈ N, x i = 320, D: optimal number of transaction included by miner i in the current block when ∀j ∈ N \ {i}, x j = 320, E: probability to be the rst miner to nd a block reaching consensus when ∀j ∈ N \ {i}, x j = 320 and x i given in D, F: expected reward when ∀j ∈ N \ {i}, x j = 320 and x i given in D, G: (F-C) in %. R = 1.5625.12 In this case, the best response of GHash.IO will be to include 4,648 (or any smaller upper limit if it exists) transactions in a block. The other miners' best responses for R = 1.5625 are given in Table 4.

Equivalently, the lowest value of c for which the situation where all miners include no transaction in their blocks is not a Nash equilibrium is c ≈ 0.00123 BTC. Above this value, GHash.IO will have an incentive to include some transactions in the block it tries to mine. This corresponds to an increase from the current value of the transaction fee of a factor approx. 12.3. At the time this article is written, 0.00123 BTC can be bought for about $0.76.

Conclusion

In this article, we have introduced and studied the Bitcoin mining game. When miners make a decision regarding how many transactions they should include in the block they are mining, they must study the trade-o between, on the one side, including more transactions and hence earn more transaction fees if they nd the current block rst and, on the other side, including less transactions in order to minimize the time they need to spread their block solution and reach consensus with it, hence maximizing their probability to include their block in the blockchain rst. We have studied the two miners case analytically. We have also showed that in the current Bitcoin mining environment, miners are not at a Nash equilibrium of the Bitcoin mining game. Instead, they should all stop including any transaction in their blocks. Finally, we showed that this situation where all miners do not include any transaction in their blocks would stop being a Nash Equilibrium if the transaction fee was multiplied or, equivalently, the xed reward divided by a factor of about 12.

We can see two limitations to our study. The rst one is about the security of the Bitcoin system. As we said, for Bitcoin to be used as an ecient payment system, it is a minimal requirement that transactions be processed. However, this is not sucient. Indeed, Bitcoin is vulnerable to what is called 51% attacks (see [START_REF] Eyal | Majority is not enough: Bitcoin mining is vulnerable[END_REF], Kroll et al., 2013, Houy, 2014]). Such an attack can occur when a miner can solve too many blocks in a row in expectation. It is usually said that this is the case when a miner owns strictly more than 50% of the hash power. 13 In order to make such an attack costly, the total hash rate of the Bitcoin network should be as large as possible. Since we did not consider the hash rate 4: With R = 1.5625 BTC, A: miner's name, B: relative hash power, C: expected reward when ∀i ∈ N, x i = 0, D: optimal number of transaction included by miner i in the current block when ∀j ∈ N \ {i}, x j = 0, E: probability to be the rst miner to nd a block reaching consensus when ∀j ∈ N \ {i}, x j = 0 and x i given in D, F: expected reward when ∀j ∈ N \ {i}, x j = 0 and x i given in D, G: (F-C) in %.

as an endogenous variable, what matters in our study when an agent makes his decision regarding the number of transactions to be included in his block is the ratio between the xed and the variable rewards (R/c). However, the miners' benets that will drive the hash rate purchase and hence eventually decide on the security of Bitcoin will depend on R and c in absolute values. This aspect has already been studied, though in a dierent context in [Houy, 2014b].

The second limitation is about the value of the Bitcoin network. Miners are rewarded in bitcoins. Hence, they have a vested interest in it to function well. And miners know that not processing transactions in their blocks means that Bitcoin loses some of its value as a mean of exchange. Hence, any reward they may earn from their mining activity has no value in this case. This suggests that the Bitcoin mining game should include a supplementary public good game.

Today, there is a debate in the Bitcoin developers community about the variable cost c. Should it be encoded and imposed in the protocol as it is partially today or should it be left to the market to decide its value? In the market case, if Bitcoin users want their transactions to be processed, then, they should attach to them a high enough fee. We believe that this paper gives a rst result in the study of such a market: if a market was to be organized, with today's parameter, the transaction processing oer would be non null for transactions fees at least 0.0012BTC. We are rather uncertain about the relevance of such a market because of the large externalities induced by the mining activity, some that we showed in this article, some that we showed in [Houy, 2014b].

Most of our analytical results are proved using the following lemmas. Lemma 2 states that ∀i ∈ N = {1, 2}, Π i (x 1 , x 2 ) is continuous and has a continuous derivative with respect to x i at x i = x 3-i > 0.

Lemma 2

Π + (x i , x 3-i ) = Π -(x i , x 3-i ) at x i = x 3-i . Proof. With simple calculation, it is straightforward to show that Π + (x i , x 3-i ) = (R + cx i )α i = Π -(x i , x 3-i ) in x i = x 3-i . Lemma 3 ∂Π + (x i , x 3-i ) ∂x i = ∂Π -(x i , x 3-i ) ∂x i at x i = x 3-i . Proof. It is easy to get ∂ ln(Π + (x i , x 3-i )) ∂x i = c R + cx i -α 3-i λk,
and

∂ ln(Π -(x i , x 3-i )) ∂x i = c R + cx i - α 3-i α i kλ exp (-α i λ(k(x 3-i ) -k(x i ))) (1 -α 3-i exp (-α i λ(k(x 3-i ) -k(x i )))) ,
and it is straightforward to check that both are equal when x -i = x i .

Lemma 4

∂ 2 Π -(x i , x -i ) ∂x 2 i ≥ 0. Moreover, if R > 0 or c > 0, ∂ 2 Π -(x i , x -i ) ∂x 2 i < 0.
Proof. Let P (x i , x -i ) = α 3-i exp (-α i λ(k(x 3-i ) -k(x i ))).

Π -(x i , x 3-i ) = (R + cx i )(1 -P (x i , x 3-i )).

∂Π -(x i , x 3-i )

∂x i = c(1 -P (x i , x 3-i )) -(R + cx i )α i kλP (x i , x 3-i ) ∂ 2 Π -(x i , x 3-i ) ∂x 2 i = -cα i λkP (x i , x 3-i ) -cα i λkP (x i , x 3-i ) -(R + cx i )(α i λk) 2 P (x i , x 3-i ) ≤ 0.
Moreover,

∂ 2 Π -(x i , x 3-i ) ∂x 2 i < 0 if R > 0 or c > 0.
Lemma 5

Assume c > 0.

∂ 2 Π + (x i , x -i ) ∂x 2 i < 0 whenever x i < 2 α 3-i λk - R c . When x i ≥ 2 α 3-i λk - R c , ∂Π + (x i , x -i ) ∂x i < 0.
Assume c = 0 and R > 0.

∂Π + (x i , x -i ) ∂x i < 0.

v.0.1

Proof. Let P (x i , x 3-i ) = α i exp (-α 3-i λ(k(x i ) -k(x 3-i ))).

Π + (x i , x 3-i ) = (R + cx i )P (x i , x 3-i ).

I. Assume c > 0.

∂Π + (x i , x 3-i ) ∂x i = cP (x i , x 3-i ) -(R + cx i )α 3-i λkP (x i , x 3-i ),

∂Π + (x i , x 3-i ) ∂x i = cP (x i , x 3-i ) -(R + cx i )α 3-i λkP (x i , x 3-i ),

∂ 2 Π + (x i , x -i ) ∂x 2 i = α -i λkP (x i , x -i )((R + cx i )α -i λk -2c).
Then, obviously,

∂ 2 Π + (x i , x -i ) ∂x 2 i < 0 whenever x i < 2 α 3-i λk - R c
. Then, obviously,

∂ 2 Π + (x i , x -i ) ∂x 2 i ≥ 0 whenever x i ≥ 2 α 3-i λk - R c . ∂Π + (x i , x 3-i ) ∂x i = -cP (x i , x 3-i ) < 0 at x i = 2 α 3-i λk - R c
. Moreover, it is straightforward to check that ∂Π + (x i , x 3-i ) ∂x i is negative when x i is arbitrarily large. Then, necessarily,

∂Π + (x i , x 3-i ) ∂x i < 0 whenever x i ≥ 2 α 3-i λk - R c
. II. Assume c = 0.

∂Π + (x i , x 3-i ) ∂x i = -Rα 3-i λkP (x i , x 3-i ) < 0.

A Proof of Proposition 2

It is straightforward to check that ∂Π + (x i , x * 3-i ) ∂x i < 0 and ∂Π -(x i , x * 3-i ) ∂x 1 < 0 for on R + . Hence, by Lemma 2, N E = {(0, 0)}.

B Proof of Proposition 3

Assume N E = ∅. With no loss of generality, let us assume x * 1 ≥ x * 2 . Then, Π 1 (x * 1 , x * 2 ) = Π + (x * 1 , x * 2 ) = (R+c.x * 1 )α 1 exp (-α 2 λ(k(x * 1 ) -k(x * 2 ))).

∂Π 1 (x 1 , x * 2 ) ∂x 1

= α 1 exp (-α 2 λ(k(x 1 ) -k(x * 2 ))) (c-

Table 1 :

 1 Data values.

	Data Value Dimension Description and Source
	λ	1/600 second -1	Bitcoin protocol parameter.
	s	0.5	kB	Average transaction size,
				statistics from the blockchain.
	k b	0.08 second.kB -1 Marginal time needed to reach consensus
				per kB, [Decker and Wattenhofer, 2013].
	k	0.04 second.tx -1 Marginal time needed to reach
				consensus per transaction (tx), k b .s.
	c	10 -4	BTC	Bitcoin protocol current
				implementation parameter.
	R	25	BTC	Bitcoin protocol current
				implementation parameter.

Table 3 :

 3 Expected reward of miners in BTC when ∀i ∈ N, x i = 0.

	Mining	Expected
	pool	reward
	GHash.IO	6.50289
	BTCGuild	5.68401
	Eligius	4.76879
	DiscusFish	2.98651
	Deepbit	2.26397
	BitMinter	0.81888
	Slush	0.77071
	Bitparking	0.24085
	BTCMine	0.24085
	50BTC	0.24085
	OzCoin	0.19268
	Polmine	0.09634
	P2Pool	0.09634
	EclipseMC	0.04817
	ASICMiner	0.04817

This security aspect of the mining activity is often forgotten or not know by the Bitcoin critics, see[Krugman, 2013] for instance. Even though their name can lead to confusion, Bitcoin miners have very little in common with gold miners and their role is very dierent in the Bitcoin protocol.

We will say with no dierence "solving" a mathematical problem" and "solving" or "nding a block".

In reality, transactions can have dierent sizes in bytes and require dierent levels of fees to be computed. The size of a transaction depends on many parameters (number of inputs and outputs mainly) but not directly on the amount paid in the transaction. Throughout this article, we will make the simplifying assumption that all transactions have same size. At the time this article is written, the transaction fees represent about 0.4% of the miners' rewards. The remaining 99.6% are newly created bitcoins.

With a slight of rigor but with no risk of confusion, N denotes both the set of miners and the cardinality of this set.

For any proposition p, the indicator function 1 p is equal to 1 if p is true, 0 otherwise.

Obviously, if i = 1, 3 -i = 2 and if i = 2, 3 -i = 1.

Obviously, when both c = 0 and R = 0, the result is even more trivial since all miners' payo are 0 whatever their and others miners' actions (Proposition 1(4)).

The data we use from the blockchain are based on last-year averages as recorded on March 5 th , 2013. Data from the protocol can be found in the Bitcoin open-source code.

The data we use from the blockchain for the block solving frequency are based on 3 last days averages as recorded on March 5 th , 2013.

The proof is similar to the proof of Lemma 5 given in Appendix and is therefore omitted.

Obviously, this 15 years projection should be seen as an illustration rather than a prediction. Indeed, it would certainly be unsound to state that in 15 years the mining environment will be unchanged, especially regarding the hash rate distribution among miners and k that highly depends on bandwidth (see the Nielsen's Law of Internet Bandwidth).

Actually, as we showed, at the outcome of the Bitcoin mining game, the probability to solve a block is not necessarily equal to the relative hash power.

α 2 λk(R + c.x 1 )) in x 1 = x * 1 which has the sign of (c -α 2 λk(R + c.x * 1 )). Then, by continuity of Π + and Lemmas 2, 3 and 5, we necessarily have x *

and it is straightforward to check that

. Now, it is straightforward to check that

1 . By Lemmas 2, 3 and 4, arg max

and then, N E = {(

Similarly to what has been shown above, it is straightforward to check that

C Proof of Proposition 4

computing the mining mathematical problem with more transactions included in it is not more expensive in terms of CPU, disk or bandwidth. However, it should be considered that the larger a block, the longer it takes for it to be spread in the Bitcoin network and reach consensus. Then, including transactions in a block can have the adverse eect of lowering the probability of a miner to earn any reward. As we will show, this trade-o depends on how many transactions other miners include in their blocks themselves. Then, the number of transactions included in blocks is the outcome of a game: the Bitcoin mining game that we propose to study in this article.

Let α 1 > α 2 and assume that N E = ∅.

) which has the sign of (cα 2 λk(R+c.x 1 )). Then, by Lemmas 2, 3 and 4, we necessarily have

) and then is, since α 1 > α 2 , strictly negative. By Lemmas 2, 3 and 4, this implies that the best response of miner 2 is unique and strictly below

< 0 and α 1 > α 2 imply c -α 1 λkR < 0.Then, x * 1 = 0 and x * 2 = 0 is the only Nash Equilibrium by Lemmas 2, 3 and 4.

II. Assume

which has the sign of (c -

Then, by Lemmas 2, 3 and 4, we necessarily have

After simple computation, it has the sign of c(1 -

) and then is, since α 1 > α 2 , strictly positive. By Lemmas 2, 3 and 4, this contradicts the fact that x * 2 > x * 1 .

Similarly to what has been shown above, it is straightforward to check that N E = ∅.