Coin hopping Attack — What after a month of Bitcoin hardfork?

Block 481124 has special meaning on both the Bitcoin and BitcoinCash chains this week. For Bitcoin, it marks the point at which Segwit finally move to active, bringing with it a capacity increase and the potential for massive off-chain scaling through solutions like Lightning Network. For BitcoinCash, it delivered the first increase in mining difficulty since it’s split from Bitcoin on August 1st.

The week also saw the emergence of a new phenomenon on both networks , the back and forth movement of SHA-256 hash power as it chased the most profitable chain.

To understand the effect of having two high profile SHA-256 based cryptocurrencies we need to understand how the two chains manage mining difficulty. This, along with the price of the coins and the fees brought in from transaction fees, determines how profitable their mining is.

A block is mined when a miner solves a hashing problem with a targeted outcome. A miner is successful when a random number with the right number of zeros in has been generated. Hashing transforms a string of characters into a 256 bit number. The number bears no resemblance to the original inputs, but can be recreated by hashing that exact same original sequence of characters. The slightest change to the input creates an entirely new output. Hashing is a cornerstone of cryptography and is at the heart of the Bitcoin mining algorithm.

Miners hash the block header and a nonce, and then check to see if the output satisfies the requirements of the current difficulty target. As hashing the block header alone would return the same number, the nonce gives miners the ability to affect the output. Miners change the nonce value every time they try to solve the problem. The network stipulates what the solution is by stating how many zero bits the output must contain. Once a solution is accepted, a new block is created.

The network’s hash rate is so immense that it recently peaked at about 8.2 exa hashes per second (EH/s), that’s 8,200,000,000,000,000,000 attempts to find a block every second.

Bitcoin’s difficulty changes every 2016 blocks, known as the “difficulty re-target period,” after which the average time to find a block is calculated and the difficulty is adjusted either up or down. The difficulty is adjusted in order to generate 10 minute block times at the start of the next period. Because of this the 2016 block periods tend to last about two weeks, on average.

BCash’s Emergency Difficulty Adjustment (EDA) is an addition to the original Bitcoin protocol that was added by the BCash developers when they forked the protocol. The change was made in order to prevent their chain from stagnating after it split from Bitcoin. Some kind of difficulty drop was obviously going to be needed straight after the hard fork, as the BCash chain inherited Bitcoin’s difficulty level, but not the miners hashing power.

A change was added to the difficulty retargeting code in order to prevent the slow production of blocks from dragging on for months. It only activates when special ‘emergency’ conditions are met. This EDA code has no time-out or cool-down period and is always waiting to be called into action.

To determine whether to put EDA into effect the BCash code evaluates how long it took to mine the last 6 blocks. If it took over 12 hours then EDA will drop the difficulty by 20%. The key thing here is that this check is run after every single block is mined.

If the last 6 blocks took over 12 hours to mine EDA will drop the network difficulty by 20%. If the next block, found under this lowered difficulty, still results in the last 6 blocks taking over 12 hours the difficulty is dropped by a further 20%. The cumulative effect of this is that after a period of very long block times a very significant drop can be brought about relatively quickly.

A key point in understanding the effect EDA has is that it only works to decrease difficulty — the normal 2016 block difficulty re-target periods are the only triggers for an increase in difficulty.

When EDA operates over sequential blocks it drastically reduces the network’s mining difficulty. Any miners that then switch their hash power over can find blocks far more frequently that they can mining Bitcoin. Suddenly it can become more profitable to mine than Bitcoin, even though the price of BCash is lower. The amount of coins rewarded over a set time period will be far greater.

This leads to an influx of hash power as miners switch from mining Bitcoin to exploiting the low BCash difficulty. A significant drop in hash rate on the Bitcoin network will naturally have an effect on its own block times, to the detriment of its users.

Due to the reduced block times that result from miners gaming EDA the 2016 block difficulty re-target periods can be shorter in duration, far shorter than the two weeks they are intended to take. The result of this was seen as BCash hit block 481124, and a period of EDA-enabled low difficulty came to an end. The regular difficulty algorithm enforced a difficulty increase from 68 billion to 272 billion . It was then no longer more profitable to mine BCash and most miners began switching back to Bitcoin.

The likelihood of this becoming a cyclical event is high. It has been referred to as a ‘coin hopping attack.’ Miners are driven to follow profit and the difficulty of the BCash chain is likely to oscillate from ‘low and over-mined’ to ‘high and under-mined,’ as the rules of EDA are gamed for profit.

This may bestow BCash with wildly erratic block times. When BCash swings into the slow phase of the cycle (hard difficulty, few miners) it will fail to provide users with acceptable transaction confirmation times. When it swings the other way into the fast phase (low difficulty, many miners) users can’t be sure a confirmed transaction will be mined in the next block, as they come so quickly that the risk of re-org is increased. This behaviour is at odds with many of the stated goals that BCash set out to achieve.

Considering the current situation, there are several possible outcomes:

Inflation; A consequence of EDA is that if miners keep gaming it in this manner the increased inflation ratewill flood the BCH market with coins at a far greater rate than intended. This has the potential to lead to strong downward pressure on the value of the coin.

Equilibrium through price; If the price differential between the two chain’s coins was to lessen by some degree, it is possible that fewer steps down the EDA difficulty ladder will be required to make BCash mining profitable. This would result in less drastic swings back and forth between the two chains. In this scenario both chains would gravitate to ten minute average block times.

Equilibrium through a hard fork to change EDA; Namecoin experienced the exact same problem that we have outlined above, in 2011. Two chains with the same Proof of Work mining algorithm competed for hash power, resulting in coin-hopping. The Namecoin developer’s solution was to perform a hard fork, and introduce something called merged mining, which solved the problem. However, a hard fork to fix a hard fork would raise more concerns over the ability of the developers behind BCash to design and maintain a viable cryptocurrency. It remains a viable technical solution should the situation not resolve itself by other means.

Stagnation; This could well be the outcome if the swings get more exaggerated. One of the chains loses so much hash power that it is rendered effectively unusable. The value of its coins would drop without enough blocks being produced to make it a viable currency, further reducing the likelihood that miners look to it for profit. Segwit will activate on Bitcoin whilst BCash is still in its ‘slow’ mining phase , something that may well play out in Bitcoin’s favour.

Charts showing the rate of block discovery on the BCash network do not depict a stable system in self-regulating equilibrium. If nothing else, the gaming of BCash’s EDA shows conclusively that hash rate does indeed follow profit over all else.

How long the game will go on for is unknown. With the proposed Segwit2x hard fork now just three months away, who can possibly predict what will happen if another SHA-256 based blockchain enters the system.