Bitcoin and Cryptocurrency Technologies

When we think about a rational miner deciding whether or not to merge mine, we find more
problems with the security of merge mining. Recall that roughly speaking, mining makes sense if the
expected reward equals or exceeds the expected costs. For Bitcoin mining, the cost is primarily that of
hash computation. But for someone who’s already a Bitcoin miner deciding whether or not to merge
mine an altcoin, there is no additional cost from hashing. Instead, the additional costs arise from two
factors: the computation, bandwidth, and storage needed to validate the altcoin transactions, and
need to keep software up to date and perhaps make informed decisions if the altcoin is undergoing
hard or soft forks.
This reasoning yields two insights. First, merge mining has strong economies of scale, because all
miners incur roughly the same costs regardless of their hash power. This is in stark contrast to Bitcoin
where cost is proportional to hash power, to a first approximation. So for a low‐value altcoin, a small
solo miner will find it unprofitable to merge mine it because the cost exceeds the meager reward they
will make due to their low hash power. Keep in mind that as of 2015, the potential revenue from
mining altcoins remains a small fraction of Bitcoin mining revenue. This predicts that compared to
Bitcoin, merge‐mined altcoins will have a greater centralization or concentration of mining power.
A related prediction is that most miners will choose to outsource their transaction validation. The
smaller the altcoin, the greater the incentive to outsource. The natural way to do this is to join a
Bitcoin mining pool. That’s because pools typically take those computations out of miners’ hands. The
pool operator assembles a Bitcoin block that incorporates blocks from (zero or more) altcoins, after
validating the transactions in the Bitcoin block as well as all those altcoin blocks. The miner merely
tries to solve for the nonce. These predictions are borne out in practice. For example, GHash.IO, at
one time the largest Bitcoin mining pool, allows merge mining Namecoin, IXCoin and DevCoin. So
those became the most popular merge‐mined altcoins.
The second insight from the economic reasoning is perhaps even more worrying for security than the
concentration of mining power. When miners’ primary cost is proof of work, by design there is no way
for miners to “cheat”. There is no shortcut to mining given the security of hash functions, and
additionally, other miners easily can and will verify the proof of work. Both assumptions fail when the
cost is that of transaction validation. A miner could assume that transactions they heard about are
valid and hope to get away with it. Besides, for other miners to validate a block and its transactions is
just as much work as it was for the miner who found it. For these reasons, we should expect that at
least for small merge miners, there’s an incentive to skimp on validation. The existence of improperly
validating miners makes attacks easier because a malicious miner can create a block that will cause
the rest of the miners to disagree on what the longest valid branch is.
To summarize, merge mining solves one security problem but creates many others, in part because
the economics of merge mining differ in important ways from the economics of exclusive mining.
Overall, it’s far from clear that merge mining is a good idea for a new altcoin concerned about mining
attacks.
279