Stratum share stealing!
Pool Target = Pool Difficulty / Network Target
I’ve caused some talk around share stealing, when I’m myself more worried about the integrity of block creation without doing the actual work. The truth is if you spam random nonce’s to a stratum pool you will be share stealing and possibly create valid blocks.
Share stealing in PPS and derivative payment scheme pools will earn you quite a bit, even if you are not using the intended algorithm to generate the nonce submissions.
Share stealing is possible, because in PoW cryptocurrencies Stratum pools only validate if the miners submitted block template + nonce can be used to create valid pow hash under or equal to the pool target in the stratum. Stratum pools use higher target than network target for calculating shares of a miner.
Simple example with the pool and network targets, if we have network target 200 and pool target which is 2 x network target at 400. Then miner submits nonce which generates PoW hash of 300. The pool accepts that nonce submission as share, but the network will not create block. That is because the nonce is valid for pool target, but not network target.
The biggest argument in discussions.
Some people have argued that this is because of pool’s high and low difficulty usage. Miners use this pool difficulty to decide if they submit nonce’s for jobs and the pool validates the submissions before submitting further to the node. As such lower difficulty will allow even correct algorithm to do more nonce submissions. This is not the problem with the actual nonce-spamming share stealing without, it’s a problem of counting different pool difficulty shares as equal shares in the payment scheme. Those that argue about miners using different static difficulties do not yet understand the nonce-spamming way of share stealing which is not a problem in the payment scheme and difficulties used by miners, but in the block validation itself.
Brace yourself, this is the harsh reality!
If mining pools lack proper safeguards, they become vulnerable to exploitation through nonce-spamming, regardless of the payout metho, whether PPS, PPLNS, PPS+, FPPS, or similar systems. Since pools reward miners based on accepted shares, share stealing remains a significant risk.
Currently, the only real deterrent against nonce-spamming attacks is a high network hash rate. Take Kaspa mining on Humpool as an example: while an attacker could attempt nonce-spamming for share stealing, the challenge of finding valid nonces that meet the pool target makes it nearly impossible without highly specialized hardware. Competing with ASIC efficiency would require not just an ASIC rig but potentially even a quantum computer to stand a chance.
Slow algorithms are particularly vulnerable to exploitation by faster machines. However, pools often deploy standard banning mechanisms to detect excessive invalid nonce submissions, limiting the impact of brute-force spamming. The real issue, though, lies in filtering out incorrect nonce submissions, particularly from miners using wrong algorithm.
For instance, kHeavyHash ASICs, designed for a specific algorithm, can rapidly generate nonce’s and target pools using slower algorithms. By spamming nonce’s with an incompatible algorithm, attackers effectively steal shares from the pool. This filtering process with wrong algorithm even stops sending valid nonce submissions for the indented algorithm, that could have contributed to block creation. As such the block rate of such miner is skewed to not finding blocks.
Get Hoosat Network’s stories in your inbox
Join Medium for free to get updates from this writer.
To maintain a fair mining ecosystem, pools must implement robust defenses against nonce-spamming and algorithm-based share stealing, ensuring legitimate miners are not penalized while keeping exploiters at bay.
The solution to filtered share stealing
When miners submit work they will never eliminate possibility of creating valid block with the pow hash is below or equal to target checks. Which happens in miner, stratum pools and in the nodes before valid block can be created. It is possible to calculate in the pool the miners expected shares for a period.
EMB = Expected block amount found for a miner
MS = Miner’s submitted shares
TPS = Total shares submitted by all miners
TPB = Total amount of blocks found in the period
EM = (MS / TPS) * TBP
This calculation shows how many blocks miner should have created for the shares. Comparing this value to the actual blocks found by the miner you will know if they are using some kind of nonce-spamming which does not generate valid blocks like the intended algorithm.
You can use T threshold to compare if you should flag or ban the miner.
T = Threshold percentage
AMB = Actual miners blocks in the time period.
if AMB < EMB * ( 1 — T) then flag or ban!
There, you’ve resolved filtered nonce spamming share stealing without using HTN’s Securing Proof of Work integrity patent-pending solution. This solution against such share-stealing in your pool won’t eliminate the possibility of creating blocks with nonce-spamming for any cryptocurrency, but it protects that your pool won’t pay to bad acting miners taking advantage of such nonce-spamming.
Conclusion
Share stealing through nonce spamming is a real threat to the integrity of mining pools, particularly those using PPS and similar payment schemes. By exploiting the difference between pool and network targets, malicious miners can inflate their rewards without contributing meaningfully to actual block discovery.
The solution lies in monitoring expected versus actual block contributions using the formula. By implementing a threshold-based detection system, pools can flag or ban miners engaging in unfair practices, ensuring a more secure and equitable mining environment.
As PoW mining continues to evolve, it’s crucial for pools to adopt smarter validation mechanisms. Addressing share stealing not only protects honest miners but also strengthens the overall network security by ensuring that computational power is being used efficiently toward legitimate block creation.
By refining pool verification strategies, the mining ecosystem can remain resilient against exploitation and uphold the trust that decentralized systems rely on.
