All-out Attack: Optimal Block Withholding Under Pay-Per-Share Scheme

Source: arXiv:2607.01209 · Published 2026-07-01 · By Mustafa Doger, Sennur Ulukus

TL;DR

This paper studies Block Withholding (BWH) attacks against mining pools operating under share-based payout schemes, specifically Pay-Per-Share (PPS) and Full-PPS (FPPS), which are prevalent in modern Nakamoto-style blockchains. Prior work mainly analyzed BWH under block-dependent reward schemes where rewards occur only when a block is found, using a zero-sum game framework. Contrary to previous claims of incentive compatibility under PPS, the authors prove that PPS and FPPS are vulnerable to an optimal attack called the All-out Attack (AoA). In AoA, the attacker commits its full mining power to the victim pool, regularly submits partial Proof-of-Work shares (pPoW) to get paid immediately, but withholds all full Proof-of-Work blocks (fPoW), thereby causing the victim pool operator to pay out resources without receiving block rewards. Post the first difficulty adjustment, this leads to increased pPoW submission rates due to reduced difficulty, providing a relative revenue gain of α/(1-α) per unit hashpower, where α is the attacker’s mining power fraction. This behavior benefits all honest miners and the attacker equally while imposing losses only on the victim operator. Advanced BWH variants like Fork After Withholding (FAW) do not yield higher profits under PPS. The paper rigorously models these dynamics, providing both analytical and numerical validation.

Key findings

• Under PPS/FPPS, the optimal BWH attack is the All-out Attack (AoA), where the attacker allocates 100% of hashpower to the victim pool submitting only pPoW and withholding all fPoW.
• Before the first difficulty adjustment, the attacker incurs negligible loss due to withheld fPoWs, approximately 2^{-Z} fraction, which is near zero for practical systems (Lemma 1, Eq. 8).
• After the first difficulty adjustment, the reduced block difficulty increases the attacker’s pPoW submission rate by a factor of 1/(1-α), yielding a relative revenue gain per unit hashpower of α/(1-α) (Corollary 1, Theorem 1).
• All honest miners also benefit from the difficulty reduction at the same rate as the attacker, while the victim pool operator suffers a net loss proportional to the attacker’s hashpower (Eqs. 16-19).
• Advanced BWH extensions such as Fork After Withholding (FAW), Power Adjusting Withholding (PAW), and Temporary PAW (T-PAW) do not increase attacker profits under PPS/FPPS, unlike in block-dependent schemes.
• If the attacker’s hashpower fraction α ≤ 2^{-Z}, honest mining is optimal; otherwise, AoA maximizes adversarial revenue (Theorem 1).
• Numerical plots (Fig 1) show PPS schemes suffer larger adversarial profit margins compared to block-dependent schemes under BWH for realistic α and victim pool power β values.
• The attack exploits the difficulty adjustment mechanism, making PPS/FPPS schemes not incentive compatible, contrary to some previous analyses that assumed incentive compatibility.

Threat model

The adversary is a mining entity controlling a fraction α of the total network hashpower, capable of joining victim mining pools and submitting partial PoW shares while withholding valid full PoW blocks. The attacker aims to maximize revenue by exploiting the pool’s share-based payout mechanism, and the blockchain’s difficulty adjustment algorithm. The adversary cannot break the cryptographic puzzle, falsify proofs, or manipulate the network beyond withholding and selective submission of shares and blocks.

Methodology — deep read

1. Threat Model & Assumptions: The adversary controls a fraction α of total network hashpower and targets a victim mining pool controlling β fraction of hashpower, with α + β ≤ 0.5. The attacker can allocate its hashpower arbitrarily and choose whether to submit full PoW solutions (fPoW) or only partial PoW shares (pPoW) to the pool. Honest miners follow Nakamoto longest-chain protocol, immediately broadcasting valid blocks and mining honestly. The adversary withholds all fPoWs but reports all pPoWs when conducting the attack (the All-out Attack). Advanced attack variants such as FAW may involve releasing withheld blocks in strategic manners. The pool pays miners under PPS or FPPS schemes—i.e., immediate payment upon share submission—shifting risk to the pool operator. The difficulty adjustment algorithm (DAA) re-targets block mining difficulty every epoch aiming for a fixed average epoch time τ₀.

2. Data: The analysis is theoretical and model-based, with parameters including α (attacker hashpower fraction), β (victim pool hashpower fraction), and difficulty parameters Z_f, Z_p representing the number of leading zeros required for fPoW and pPoW respectively. The difference Z = Z_f - Z_p controls the share difficulty ratio. Assumptions include negligible transaction fees and normalized total block reward per epoch.

3. Architecture/Algorithm: The key analytic model decomposes miner rewards into coinbase rewards from discovered blocks and PPS payments for submitted shares. Under the attack, the adversary never submits fPoWs, so no block rewards accrue to it or the victim pool. Meanwhile, the victim pool operator pays out PPS rewards for submitted shares, including those from the attacker. The difficulty adjustment scales the difficulty downward due to fewer blocks generated (from withheld fPoWs), increasing the rate at which shares are found post-adjustment. This dynamic is captured by the block redundancy ratio δ_BWH = 1/(1 - α p_1) where p_1 is the fraction of adversarial hashpower allocated to the victim pool (set to 1 in AoA).

4. Training Regime: Not applicable as analysis is mathematical and simulated rather than learned. Theoretical derivations apply throughout.

5. Evaluation Protocol: The authors derive closed-form expressions for revenue changes ∆x(t) for attacker, victim pool miners, other honest miners, and victim pool operator over epochs before and after difficulty adjustment. They compare classical BWH attack strategies under block-dependent and share-based scheme models, highlighting differences. Numerical examples and plots illustrate revenue dynamics over time (notably Fig 1). No adversarial simulations with adaptive counterparts presented.

6. Reproducibility: The work is theoretical with proofs and formulas fully spelled out in the paper. No codebase is referenced, and data is conceptual rather than empirical. All model parameters and assumptions are detailed for replication of the analysis.

Technical innovations

• Demonstrating that AoA (allocating all adversarial hashpower to the victim pool and withholding all full PoW blocks) is the optimal BWH attack under PPS and FPPS, contrasting with previous conclusions of incentive compatibility.
• Proof that PPS/FPPS schemes are not incentive compatible, as withholding full blocks before the first difficulty adjustment causes negligible loss but post-adjustment yields increased revenue for attacker and honest miners while imposing losses on the victim pool operator.
• Analytical decomposition of rewards into coinbase and share submission components under share-based schemes, allowing clear isolation of the economic impact of withholding behavior.
• Showing that advanced BWH variants (FAW, PAW, T-PAW) do not increase adversarial profit under PPS/FPPS since releasing withheld blocks tends to increase difficulty, reducing mining efficiency.

Baselines vs proposed

• Classical BWH under block-dependent payout: adversarial revenue ratio maximized by optimized partial allocation p1 < 1 (Eq. 1).
• All-out Attack under PPS (p1 = 1): adversarial relative revenue gain per unit hashpower after difficulty adjustment is α / (1 - α) (Corollary 1, Eq. 16).
• Block-dependent scheme classical BWH vs PPS AoA: Numerical results in Fig. 1 show PPS AoA yields larger revenue gains for attacker compared to classical BWH under block-dependent schemes for same α and β.

Limitations

• Analysis assumes static adversary hashpower allocation; dynamic or adaptive strategies beyond AoA are not modeled in detail.
• Model neglects precise pool behaviors such as changing share difficulty, pool operator risk reserves, or variable transaction fees beyond simplified assumptions.
• No empirical or simulation validation with real-world mining data or live blockchain networks.
• Advanced BWH variants and complex strategic interactions (e.g., bribery via smart contracts from [22]) are acknowledged but not fully analyzed.
• Does not model potential network effects such as miner switching, pool reputation loss, or miner churn due to these attacks.
• Fork resolution behavior and uncle block mechanisms are simplified; real protocol nuances could alter attack impact and profitability.

Open questions / follow-ons

• How do real-world pool reserve management strategies and payout adjustments affect the feasibility and profitability of the All-out Attack?
• What are the dynamic behaviors when multiple adversaries conduct AoA simultaneously or when miner switching occurs in response to profitability shifts?
• Can modified difficulty adjustment mechanisms or share verification protocols mitigate or deter AoA under PPS/FPPS?
• How would integrating uncle blocks or alternative reward schemes influence the attack’s effectiveness and incentives?

Why it matters for bot defense

Bot-defense practitioners and CAPTCHA engineers can view this study as a compelling example of incentive vulnerabilities in complex economic protocols, emphasizing the need for robust incentive-compatible designs in systems relying on collaborative effort and reward sharing. While the context is cryptocurrency mining pools, analogous risk arises where attackers exploit intermediary trust or payout mechanisms to divert rewards without contributing value. Designing detection strategies for anomalous submission patterns (e.g., high partial submissions but no full completions) or incentivizing honesty through real-time, verifiable reward mechanisms can parallel efforts to distinguish bots from humans in CAPTCHA by evaluating consistent resource contribution versus withholding or manipulation behaviors. The paper also highlights the critical role of system parameters adjustments (like difficulty or challenge difficulty) on attacker incentives, relevant to dynamic CAPTCHA challenge adaptations to mitigate automated abuse.

Cite

@article{arxiv2607_01209,
  title={ All-out Attack: Optimal Block Withholding Under Pay-Per-Share Scheme },
  author={ Mustafa Doger and Sennur Ulukus },
  journal={arXiv preprint arXiv:2607.01209},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.01209}
}

Read the full paper

• arXiv:2607.01209 (abstract)
• arXiv:2607.01209 (PDF)