Pool Detective | Mining Pool Monitoring

Ever since the introduction of the first mining pool for Bitcoin in November 2010, mining pools have been used by miners to reduce the variance in rewards of Proof-of-Work cryptocurrencies. Miners connect their computational resources to a pool - and the pool is responsible for dividing the work between the miners to prevent doing duplicate work. On top of that, the pool is responsible for dividing the mining rewards amongst its participating miners. 

The downside to the usage of mining pools, however, is that they introduce a centralized point of control over its participating miners. Mining pools give miners (or more specifically: their hardware) direct instructions over what they need to work on. 

This control gives mining pools the ability to have its miners work on a different cryptocurrency, or to unwillingly assist in performing attacks such as block withholding or even 51% attacks. Mining hardware is generally optimized for computing proof-of-work functions as efficiently as possible (measured in calculations per joule), and therefore the hardware is generally not equipped with additional logic to verify the work it’s given. 

We built a system, called PoolDetective, that actively monitors the workstream between our mining hardware and 25 mining pools across 10 different proof-of-work cryptocurrencies from 5 geographical locations. This includes the major Bitcoin mining pools, collectively responsible for over 75% of the network hashrate. On top of this, we ran (official) full nodes for each of the mined currencies, as well as monitored the peer-to-peer network using unofficial nodes for the propagation of new blocks.

We store all monitored data from mining, full nodes and block propagation and analyze this data for unexpected behavior by mining pools. Since launching the PoolDetective in November 2019 we have archived nearly 28 million mining jobs from the various pools, and have started analysis on this data. We have already seen evidence of mining pools sending work for different blockchains than expected, and are currently looking for other anomalies.

Pool Detective was a system we built at the DCI to monitor the behavior of mining pools that operate on Proof-of-Work cryptocurrencies such as Bitcoin, Litecoin and others. Mining pools have ultimate control over the work that constituent miners process and therefore their (mis)behavior can have large consequences for the security of Proof-of-Work networks. We conducted this research because we think it's important to perform detailed monitoring and analyze the behavior of pools, and no one else is doing that up to this level of detail.

What we do

Pool Detective acts as a miner on all of the mining pools we monitor. We record the traffic between the mining pool and our mining hardware. We also record data about block propagation on the peer-to-peer network, as well as validate blocks with a full node for each of the cryptocurrencies we monitor. We then look for unexpected behavior, such as:

Selfish mining

If a mining pool asks its miners to mine on top of a particular block, but the rest of the network does not yet know about the block, this is called selfish mining. The mining pool gains an unfair advantage by exhibiting this strategy. Our systems can detect selfish mining.

Work from the wrong chain

When two blockchains share the proof-of-work function, mining pools can send work from either chain and most mining hardware is unable to detect this, and will just execute the task. Our systems notice this behavior.

How it works

We spent a lot of time fine tuning the Pool Detective monitoring system. Here's a few of the main components:

Cryptocurrency mining

In order to properly conduct our monitoring, we run actual mining hardware to produce valid work for each of the pools we monitor. Meanwhile, we store all the traffic between our miners and the pools.

Monitor P2P Network

Custom Block Observer

We wrote a modified client to the peer-to-peer networks of Bitcoin and compatible cryptocurrencies to monitor the block propagation across the network. By running this observer from multiple distinct locations across the globe, we can more precisely pinpoint when blocks were found.

Integrating

API Exposing Monitoring Data

We've built an API to start exposing the data that Pool Detective gathers to third parties that want to use it.