Predicting the confirmation time of Bitcoin transactions

Transcription

1 Prediting the onfirmation time of Bitoin transations D.T. Koops Korteweg-de Vries Institute, University of Amsterdam arxiv: v1 [s.dc] 21 Sep 218 September 28, 218 Abstrat We study the probabilisti distribution of the onfirmation time of Bitoin transations, onditional on the urrent memory pool (i.e., the queue of transations awaiting onfirmation). The results of this paper are partiularly interesting for users that want to make a Bitoin transation during heavy-traffi situations, when the transation demand exeeds the blok apaity. In suh situations, Bitoin users tend to bid up the transation fees, in order to gain priority over other users that pay a lower fee. We argue that the time until a Bitoin transation is onfirmed an be modelled as a partiular stohasti fluid queueing proess (to be preise: a Cramér-Lundberg proess). We approximate the queueing proess in two different ways. The first approah leads to a lower bound on the onfirmation probability, whih beomes inreasingly tight as traffi dereases. The seond approah relies on a diffusion approximation with a ontinuity orretion, whih beomes inreasingly aurate as traffi intensifies. The auray of the approximations under different traffi loads are evaluated in a simulation study. 1 Introdution Bitoin is a virtual urreny, in the sense that it an be used to transat or store value in a peer-to-peer network on the internet. The main innovation of Bitoin is that it an operate without entral authority, as opposed to traditional money aounts that are run by banks. The Bitoin network has been running sine 29; whih is when the genesis blok was mined by an unknown person who refers to himself as Satoshi Nakamoto. Sine then the popularity of Bitoin has inreased substantially. What beame painfully obvious during Deember January 218, when the prie of Bitoin reahed new all-time highs, is that the network is not apable of dealing with all transations for low fees when the traffi intensity on the blokhain inreases too muh. During this period, Bitoin users were paying as muh as 5 US dollar for a simple transation. The reason that users were paying suh hefty fees, is that the network was logged, and transations with a higher fee get priority. It is lear that from a user perspetive, it would be useful to have preise estimates of the 1

2 onfirmation time during suh irumstanes. This is the problem that is addressed in this paper. Let us onsider in some more detail how the Bitoin blokhain works. Bitoin relies on a protool alled proof-of-work. This protoal is basially a voting mehanism that deides whih transations should be inluded in the blokhain, and it ats as a replaement of a trusted third party. A blokhain is a hain of bloks, eah of whih ontains a bunh of transations that are onsidered verified or onfirmed. Newly found bloks an be linked to the last blok in the blokhain (in priniple bloks an also be linked to earlier bloks, but then they will not be aepted by other nodes as the longest hain is seen as valid). Computers with strong omputational power are ompeting to solve a ryptographi puzzle as quikly as possible, in order to get the right to determine the next blok. Computers that perform this task are alled miners, and they reeive mining rewards for being the first to mine a new blok. The referene to mining omes from the fat that these miners have to searh large outome spaes, and they need to get luky to find a blok. In that sense it is somewhat omparable to e.g. gold mining, where a large area is searhed and oasionally some gold is found. It should be noted that all this omputational effort is spent purely as a voting proedure, in the sense that solving the puzzle allows one to submit a vote on what should be the next blok (although the vote need not be aepted by the majority of other nodes, e.g. if it ontains invalid transations). Another, possibly more obvious, voting mehanism would be to randomly selet a omputer or IP address to propose the next blok. The problem with this idea is twofold. Firstly, there should be some entral party that determines who gets seleted, whih reates a single point of failure whih is exatly what Bitoin tries to avoid. Seondly, one an fake having many omputers or heaply reate many IP-addresses, whereas it is impossible to solve the ryptographi puzzles without doing the work. The above explanation should larify the idea behind, and the name of, the proofof-work protool. In addition to the mining reward, the miner reeives the transation fees orresponding to all transations in the blok. When users want to make a Bitoin transation, they send the details of the transation, along with a fee, to a node in the Bitoin network. This node will spread the transation to other nodes. When a transation is known within the network, we say that it is inside the mempool (short for memory pool). Miners are free to put any transations from the mempool they want into the new blok, but they obviously have the inentive to put the transations in the blok with the highest fee density (i.e., highest fee per unit of transation data, often stated in Satoshi per byte, where Satoshi refers to 1 8 Bitoin). The size of a transation depends on the number of inoming transations (inputs) that are linked to outgoing addresses (outputs). This implies that the size of a transation is not fixed, and hene the number of transations that fit in a blok varies. The bloks that are added to the hain have a maximum size of 1 Megabyte (MB): this is hardoded in the Bitoin software and ensures that the network remains stable. The diffiulty of the ryptographi puzzle is periodially adjusted in suh a way that a blok is mined on average every 1 minutes (assuming that the so alled hash rate, i.e. omputational power, of the network remains fixed). This leads to a transation apaity of about 7 transations 2

3 per seond (depending on the size of the transations). The time until a blok is found is approximately exponentially distributed [6], whih an be reasoned as follows. Miners searh a very large searh spae at random. Eah trial is independent of the previous, and eah trial has an equal probability of suess. Therefore, the number of trials until suess has a geometri distribution. Sine the suess probability is very small and eah trial takes in priniple equally long, the geometri distribution an be approximated very losely by its ontinuous ounterpart: the exponential distribution. The miner who solves the puzzle first, will take a time that is the minimum of all exponential times of all miners, whih is again exponentially distributed. However, with data ranging over long enough time-spans, the hypothesis that bloks arrive after an exponential time an be falsified [4]. This an be explained by the fat that the hash rate of the whole network typially hanges signifiantly in between diffiulty adjustments. During times of ongestion, a Bitoin user that wants to make a transation is interested in the relation between the fee and onfirmation time harateristis. The most obvious harateristis are the expeted or worst-ase onfirmation times (whih means that the transation will be onfirmed with, say, 95% probability at that time). These quantities an be easily derived from the onfirmation time distribution, whih is the fous in this paper. 1.1 Current literature and algorithms In the Bitoin Core.15 release there is a funtion alled estimatesmartfee. The input to this funtion is the maximum number of bloks after whih you want your transation to be inluded, and the output is the estimated fee that ahieves this with a 95% probability. The estimation is purely data driven. The proedure keeps trak of the number of transations in a partiular fee density buket that made it into into the blokhain after a given number of bloks. Exponential smoothing is applied (with smoothing fator.998), to give higher weight to more reent transations. For more details, see [3]. This algorithm will provide a reasonable benhmark, but one may expet improvements if the urrent mempool is also taken into aount. Moreover, a purely data-driven approah only extrapolates from past data and is therefore lagging behind if the environment hanges quikly. A model-based approah will be more flexible in adjusting to urrent irumstanes. Alternatively, there is an estimator based on simulation, see [2] and [1]. This algorithm is model based, and assumes arrivals and bath servies at Poisson epohs. The transation size (in bytes) and transation fee are sampled from a joint distribution based on histori bloks. This algorithm has been baktested on historial data, and appears to performs well. A disadvantage is that simulations tend to be time onsuming. In our approah we try to apply mathematial analysis in order to gain more insight and to avoid omputationally burdensome simulations. The paper [6] provides an analytial probabilisti modeling approah for onfirmation times, where the transation proess is seen as a M/M N /1 queue with priorities and preemption. The stationary time until onfirmation is analyzed. This provides understanding 3

4 of the inner working of the Bitoin blokhain on a system level, but it does not unover the dynamis from a user perspetive. For example, due to stationarity assumptions, the paper does not take into aount information suh as the urrent mempool and it is ignored that transations have different sizes. Our paper aims to inlude these features, as they play an important role for prediting onfirmation times. 1.2 Our approah and ontributions There are two soures of unertainty of when a transation will be onfirmed: future blok arrivals and future transation arrivals. Sine the average number of transations per blok is of the order 2, there will also be of the order 2 arrivals per bath departure in heavy-traffi situations. On suh a sale, the main soure of randomness is the blok arrival proess. Therefore, it is natural to model the amount of data with a higher fee as a Cramér-Lundberg proess; this is a proess well known from insurane mathematis and introdued in Setion 2 below. In suh models, the proess slopes upwards with a fixed rate and there are jumps down at Poisson epohs. Typially, in the literature, it is assumed that the jumps down are phase type (e.g. exponential or Erlang), in whih ase relatively expliit results an be obtained with regards to the time until onfirmation. However, in the ase of Bitoin, the jumps will be of size at most 1 (MB), sine that is the max apaity of a blok. We assume that all bloks will be ompletely filled whenever possible, whih oinides with the miner s best interests. Cramér-Lundberg models with deterministi jumps down did not reeive muh attention in the literature, as results tend to be muh more involved. One an appeal to general results involving spetrally negative Lévy proesses, of whih our model is a speial ase, or expressions for the busy period in an M/D/1 queue starting in a level x (f. [7] or [9]). In either ase, those results involve a double Laplae transform with respet to initial workload level and time, of whih the inversion is omputationally involved and potentially numerially unstable. Therefore we aim to derive more expliit and simple results. Firstly, we derive a lower bound on the probability that the transation will be onfirmed within a speified number of bloks. This approximation turns out to be lose to simulated values when the traffi is relatively low. However, in heavy-traffi situations, the lower bound is very loose. Therefore, we also develop a seond approah, based on a orreted diffusion approximation. In the diffusion approximation approah, we replae the Cramér-Lundberg proess by a Brownian motion with the same drift, variane and starting point. This onsiderably simplifies the analysis for the onfirmation time, as it is known that the hitting time of a Brownian motion with a drift towards the boundary has an inverse Gaussian distribution. Subsequently, we note that the approximation an be improved substantially by doing a ontinuity orretion. This orretion entails that the Brownian motion does not start in the same starting point as the Cramér-Lundberg proess, but it is adjusted by the expeted undershoot (i.e., the expetation of the value that proess hits whenever it rosses zero from above for the first time). A omputational proedure to alulate the expeted undershoot is provided. Subsequently, the improvement as a result of the ontinuity orretion is assessed by simulations. 4

5 1.3 Outline In Setion 2 we introdue our notation and the Cramér-Lundberg model, and we state the mathematial objetive. In Setion 3 we desribe the main theory: in Setion 3.1 we ompute a lower bound to the probability of onfirmation within a ertain number of bloks. This bound is relatively tight as traffi is low, but its performane is poor in heavy traffi. Subsequently, in Setion 3.2 we onsider a diffusion approximation whih is partiularly suitable for heavy-traffi regimes, but also works remarkably well in moderate-traffi situations. It is desribed how the approximation is orreted using the expeted undershoot. Finally, in Setion 4, the relative performane of the (orreted) Brownian approximations and the (simulated) Cramér-Lundberg model is onsidered. 2 Model Given a transation with a partiular fee, let X(t) denote the position of that transation in the mempool at time t, if it is ordered by fee density. We suppose that X(t) satisfies a Cramér-Lundberg type of model, i.e.: X(t) = x + t P (t), where the proess is saled suh that bloks have size 1 and the time is saled suh that the Poisson proess P (t) has interarrival times of mean 1, x is the initial position in the mempool upon entering, and is the rate at whih transation data with higher priority arrives. One the proess hits zero, it means that the transation under onsideration has been onfirmed. Thus τ = inf{t : X(t) = } means that the transation has been onfirmed after τ time units. The main mathematial objetive in this paper is to reover the distribution of τ. To ensure that P(τ < ) = 1, we assume that E X(1) <. This is not restritive, as users want to have their transations onfirmed with probability one at some point in the future, whih is ahieved by paying a suffiiently high fee. A sample path of the X( ) proess is shown in Figure 1, whih is ompared to a snapshot of true mempool data. Notie the similarity between how these two proesses behave. It appears that the slope in the true mempool proess is approximately onstant in this time window, orresponding to our modeling assumption. 3 Mathematial results In this setion, we first derive a lower bound, whih will be tight in light-traffi situations (as will be demonstrated in Setion 4). Subsequently, we desribe the diffusion approximation approah, whih involves deriving an algorithm that an determine the expeted overshoot of the Cramér-Lundberg model with deterministi jumps. 5

6 6 Transation data Time Figure 1: Top: atual mempool data over time, as retrieved from [5], during a 16 hour timeframe in January 218. Bottom: a sample path of the Cramér-Lundberg model. 3.1 A lower bound Let T 1, T 2,... be a set of i.i.d., exponentially distributed, random variables with unit mean, that represent the time until the next blok is found. Define X i = X(T i ). Then it holds that X n+1 = X n + T n 1. For now, we assume that there is no stiky boundary at zero: the proess an beome negative and positive again. This means that, in the model, the transation ould swith from onfirmed to unonfirmed. Therefore the atual probability of onfirmation will be larger than the probability that the X( ) proess is negative, i.e. we find a lower bound. Consider the following proposition. Proposition 1. Suppose that given a fee density φ, one an determine the rate = (φ) at whih transations with a fee density higher than φ arrive and one an observe the initial plae in the mempool x = x (φ), whih is ordered by fee density. Then the probability of 6

7 onfirmation in at most n bloks, is bounded by P(onfirmation in n bloks) 1 n 1 k= y k n k! e yn, with y n := max{ n x, }. Proof. The sum of n independent exponentially distributed random variables is Erlang distributed. In partiular, with y n (x) := n x +x, it holds that n n P(X n > x) = P(x n + T i > x) = P T i > x + n x i=1 i=1 { 1 if x+n x = n 1 y n(x) k k= e yn(x) if x+n x >. k! Sine X n implies onfirmation in n bloks, it follows that P(onfirmation in n bloks) P(X n ) = 1 P(X n > ) { if n x = 1 n 1 y n() k k= e yn() if n > x k!, whih yields the result. This gives us a lower bound whih an be alulated very effiiently. The simulations in Setion 4 reveal that the bound is quite tight when traffi is light (say,.5), but the bound beomes poor in heavy-traffi situations. 3.2 Diffusion approximation To simplify the analysis, we ould replae the Cramér-Lundberg proess by a Brownian motion with a mathing drift and variane. Due to our time and spae saling, it is easy to see that the variane of the Cramér-Lundberg proess equals unity. It is well known that the hitting time of a Brownian motion with a drift towards a onstant boundary has an inverse Gaussian distribution. In ertain ases, however, this approximation will perform rather poorly. For instane, if the starting position x = and the slope =, then the hitting time is simply the realization of the first exponential interarrival time of the Poisson proess. However, due to its properties, the Brownian motion will immediately go below the boundary with probability one. We an orret for this, by noting that the undershoot of the Cramér-Lundberg proess below level will be of size 1 in this ase, and by letting the Brownian motion start in level 1. For general >, the expeted undershoot an still be alulated via the theorem and algorithm stated below. The idea of orreting a diffusion approximation of a random walk by hanging the initial point (and the drift) of the approximating Brownian motion is not new, f. e.g. [11]. We ontribute to this line of researh by alulating the expeted overshoot expliitly for this partiular Cramér-Lundberg model. In the following theorem and its proof, we write n x to denote x, i.e. the smallest integer greater than or equal to x. 7

8 Theorem 1. The undershoot S x below level of the Cramér-Lundberg proess that starts in level x, with P (t) a Poisson proess with rate 1, satisfies, for x 1, and for x > 1, E S x = E S x = 1 + e 1 x ( + E S 1 ) x, (1) nx x E S x+y 1 e y dy + e nx x E S nx. (2) The proof of this theorem an be found after the algorithm below. Note that Algorithm 1 is ideally implemented in a programming language that supports symboli mathematis, suh as Mathematia. Algorithm 1. Initialize: Set and n max (omment: n max needs to be large enough so that E S nmax lim x E S x and the x in value of interest E S x satisfies x < n max ) Step 1: Set n = 1. While n n max : express f n (x) = n x e y f n 1 (x + y 1) dy + e n x (omment: a n is a onstant that is yet to be determined) Step 2: Determine a n Set n = 1. While n n max 1: Solve a n = f n+1 (n) for a n+1 and inrement n n + 1 (omment: this step expresses a n into a n 1, into a n 2,..., and finally into a ) Set a nmax 1 = a nmax and solve for a (omment: sine eah a n was expressed into a, we have thus determined eah a n ) Output: E S x is given by f nx (x) Proof of Theorem 1 and Algorithm 1. By the memorylessness property of the exponential distribution, we have for x 1 E S x = E[S x T 1 < 1 x] P(T 1 < 1 x) + E[S 1 T 1 1 x] P(T 1 1 x) = E[S x 1 {T1 <1 x}] + e (1 x)/ E[S 1 ] = E[(1 T 1 x)1 {T1 <1 x}] + e (1 x)/ E[S 1 ] = (1 x) P(T 1 < 1 x) E[T 1 1 {T1 <1 x}] + e (1 x) E[S 1 ] = (1 x) P(T 1 < 1 x) 1 x ye y dy + e 1 x E[S 1 ] = (1 x)(1 e 1 x ) (x 1 )e 1 x + e 1 x E[S 1 ] = 1 + e 1 x ( + E S 1 ) x, a n so in partiular E S = 1 + e 1/ ( + E S 1 ). 8

9 With n x = x and using a similar argument as above, we have for n x 1 < x n x, E S x = E[S x T < n x x] P(T < n x x) + E[S nx T n x x] P(T n x x) = E[S x T < n x x] P(T < n x x) + e nx x = E[S x 1 {T <nx x}] + e nx x = nx x E S nx E S x+y 1 e y dy + e nx x E S nx. E S nx This finishes the proof of the proposition. The algorithm is a straightforward appliation of the proof. Using a slightly different approah than Algorithm 1, it is even possible to derive exat error bounds on the expeted undershoot after n iterations. This an be done by using the expression of E S n 1 in terms of E S n, for all n. Example 1. Using the theory above in the speial ase = 1, it an be reursively alulated that E S = 1 e + 1 e E S e E S 1 E S = E S = E S = 2 e(e 1) e(e 1) E S 2 e(e 1) E S (e 1)(1 + 2(e 2)e) + 2 e 4e 2 + 2e E S e 4e 2 + 2e E S 3 3 e(15 + e) 24 (e 1)e(1 + e(5 + 2(e 3)e)) + (e 1) 2 E S 4 e 3 (1 + e(5 + 2(e 3)e)) E S 4. Sine learly E S n 1, for every n, we know that the error is at most the prefator of E S n+1. Therefore, after four iterations, it follows that E S [.496,.51]. This orresponds to the value.5 ±.1 (where the value after ± indiates the standard error) that we found by simulation. An implementation of Algorithm 1 in Mathematia leads to Figure 2, where is varied ranging from = to = 1. In the partiular ase = 1 (whih implies zero drift and is known as no safety loading in the insurane literature), the limiting density of the undershoot an be expliitly alulated, as the initial position tends to infinity. Indeed, 9

10 1 = 1 = ESx.6.4 ESx x x 1 =.5 1 = ESx.6.4 ESx x x Figure 2: The expeted undershoot E S x as a funtion of the initial position x. Note that as traffi beomes more intense, the undershoot is less variable as funtion of the starting position, and onverges faster to its limiting value. with Y the random variable orresponding to jump sizes, [1, Theorem 6] states that the limiting density of the undershoot in ase of zero drift and finite variane jump sizes satisfies f(y) = z P(Y > z + y) dz. z P(Y > z) dz 1

11 In [8] it is derived under the same assumptions that ( ) P lim S x > y = E[max{, (Y y)2 }], x E Y 2 whih in ase deterministi jumps of unit size simplifies to ( ) P lim S x > y = (1 x) 2, for x 1. x It follows that lim E[S x] = 1 x 3, whih is indeed the value to whih E S x appears to onverge, for x large, in the plot of Figure 2 orresponding to the ase of = 1. 4 Simulation In this setion we ompare the diffusion and orreted diffusion approximation to the simulated Cramér-Lundberg proess, both in a heavy-traffi ( =.95) and a light-traffi ( =.25) regime. In most ases we suppose that the starting position is x = 1: depending on your preferenes and the traffi, it is reasonable in pratie to pik your fee suh that your initial position in the queue is of the order of one blok. By Algorithm 1 we determined that the orretion in the Brownian motion is approximately E S 1 =.3643 when =.95 and E S 1 = when =.25. Consider Figure 3 for the results. It is quikly observed that the orreted diffusion approximation is generally signifiantly more aurate than the unorreted diffusion approximation. Moreover, it appears that in the heavy-traffi situation the diffusion approximation is more aurate than in the light-traffi situation. In the light-traffi situation we an resort to the lower bound algorithm, of whih the bounds will be quite tight in light traffi. Due to the nature of Proposition 1, we have to ompare the onfirmation probability after n bloks (rather than onfirmation probability after a time t). We report the results orresponding to the lower bound in Tables 1, 2 and 3. We onsidered three ases: =.25, =.5 and =.75. In Tables 2 and 3 we hose a starting point x = 1, but in Table 1 we inreased the starting point to x = 4 (with =.25 and x = 1 most onfirmations would simply be after two bloks). Note that the lower bound is indeed below the simulated values, or above it within a standard deviation. In addition, it an be seen that the lower bound beomes inreasingly loose as inreases. With pratial appliations in mind, we ould say that the lower bounds are tight enough if and only if.5, espeially when one is interested in onfirmation probabilities within the 9% to 1% range. 11

12 n Sim mean Sim st. dev. Lower bound Table 1: Probability that the number of bloks until onfirmation is at most n, where =.25 and x = 4, based on 3, simulations. n Sim mean Sim st. dev. Lower bound Table 2: Probability that the number of bloks until onfirmation is at most n, where =.5 and x = 1, based on 3, simulations. n Sim mean Sim st. dev. Lower bound Table 3: Probability that the number of bloks until onfirmation is at most n, where =.75 and x = 1, based on 3, simulations. 12

13 Confirmation probability Confirmation probability =.25 Cramér-Lundberg.2 Diffusion Correted diffusion Time = Cramér-Lundberg.2 Diffusion Correted diffusion Time Confirmation probability Confirmation probability = Cramér-Lundberg.9 Diffusion.89 Correted diffusion Time = Cramér-Lundberg Diffusion.88 Correted diffusion Time Figure 3: In eah graph we ompare the simulated onfirmation times of the Cramér- Lundberg proess, with starting point x = 1, to the onfirmation times orresponding to the diffusion and orreted diffusion approximations. The two right-hand plots are zoomed in versions of the left-hand plots, the top two plots are for light traffi =.25 and the bottom two plots are for heavy traffi = Further researh and onluding remarks There are several ways to ontinue this researh, most notably in the following two ways: In this researh we assumed the existene of a single true mempool, but in fat eah node keeps trak of its own mempool. The mempools are ontinuously updated with eah other, but in reality there is some lag before new transations spread through the entire network. Therefore it an happen that a miner finds a blok while being unaware of some of the most reent transations, implying that they will not be inluded in the 13

14 blok even though their fees may be suffiient. This effet is hard to model and arguably quite small, and therefore we ignored it. The model should be baktested on data to find out about the pratial appliability. Fortunately, transation data and mempool data is publily available: it an be olleted by setting up a Bitoin node. It would be interesting to solidify the mathematial fundementals of this paper by proving the following onjeture: As the traffi ( 1) and time are saled appropriately, the Cramér-Lundberg proess with deterministi jumps of fixed size, onverges to a Brownian motion. As a result, the hitting time of the Cramér-Lundberg proess onverges to an inverse Gaussian distribution. Aknowledgements The author thanks Onno Boxma and Mihel Mandjes for their proofreading and helpful suggestions. The researh for this paper is funded by the NWO Gravitation Projet NET- WORKS, Grant Number Referenes [1] Github of fee estimation by simulation. [2] Interfae with live results of fee estimation algorithm. [3] An introdution to bitoin ore fee estimation. an-introdution-to-bitoin-ore-fee-estimation ad. [4] R. Bowden, H.P. Keeler, A.E. Krzesinski, and P.G. Taylor. Blok arrivals in the Bitoin blokhain. arxiv: v1, 218. [5] J. Hoenike. Live and histori mempool data. [6] S. Kasahara and J. Kawahara. Effet of bitoin fee on transation-onfirmation proess. ArXiv: [7] A.E. Kyprianou. Flutuations of Lévy Proesses with Appliations. Springer, Heidelberg, seond edition edition, 214. [8] T. Meeles. Bs thesis: The distribution of defiit at ruin Available on: tue.nl/ws/files/ /meeles_215.pdf. [9] A.G. Pakes. On the busy period of the modified GI/G/1 queue. Journal of Applied Probability, 1: , [1] H. Shmidli. On the distribution of the surplus prior and at ruin. ASTIN Bull, 29(2): , [11] D. Siegmund. Correted diffusion approximations in ertain random walk problems. Advanes in Applied Probability, 11(4):71 719,