Optimal Reward Allocation via Proportional Splitting

Venue: To appear at the 8th Conference on Advances in Financial Technologies (AFT 2026)

The paper addresses the gap between theoretical game-theoretic guarantees and practical deployability in proof-of-work (PoW) blockchain reward mechanisms. Following Bitcoin's selfish mining attack, which demonstrated that a minority miner can capture rewards exceeding its power share under proportional rewards, various mechanisms were introduced to enhance game-theoretic resilience. The authors state: "The only proof-of-work reward rule with a Nash-equilibrium guarantee, FruitChains, demands reward finality on the order of days. The rules that settle in minutes have no such guarantee, and one of them, Reward Splitting, still outperforms FruitChains on most of the metrics that matter in deployment. This paper closes that gap between theory and practice."

The authors note recent real-world relevance: "In August 2025, the Qubic mining pool conducted a documented attack against the PoW-based Monero network, causing multiple chain reorganizations and triggering emergency mitigation proposals from the Monero research community."

The paper makes three main contributions:

1. Introduction of FairChain: a two-level transformation for any proof-of-work Nakamoto-style protocol that incorporates low-difficulty samples called workshares alongside blocks at the protocol layer, and applies Proportional Reward Splitting (PRS) at the reward layer.

2. Theoretical guarantee: The authors prove that FairChain is a ρ-coalition-safe ϵ-Nash equilibrium for sufficiently large parameters, matching FruitChains in theory.

3. Practical evaluation: Using Markov decision processes (MDPs), the authors compute the optimal adversarial policy under each utility function, rather than the gain of any one attack. They find that "At a six-block confirmation window, FairChain raises the deviation threshold to 38% of mining power and beats every mechanism in that framework on incentive compatibility, subversion gain (except FruitChains above 42%), and censorship susceptibility (except FruitChains below 25%)."

Additionally, the construction has been adopted by a live PoW blockchain, with sub-kilobyte per-block storage overhead in deployment.

The design begins with separating two roles that existing mechanisms conflate. Reward Splitting makes attacks less profitable by compensating non-canonical work, but it uses a coarse 50–50 split whenever competing objects exist at the same height. FruitChains obtains a finer estimate of mining power from low-work samples, but its theoretical parameters are too large for practical finality.

PRS combines these ideas: "it keeps the anti-forking effect of rewarding competing work, while replacing the coarse split by the measured mining-power distribution. For example, an adversary contributing 30% of the power at a height receives approximately 30% of its reward."

A workshare has the same structure as a block and is produced by the same mining loop, but satisfies a lower work threshold. The intrinsic work of any hash-based object is defined as:

work(obj) = λ − ⌊log H(obj)⌋

where λ is the output length of the hash function H. The more zero bits, the higher the work.

Parties propagate workshares through the network and publish them in blocks, as they do with transactions. Since workshares and blocks are outputs of the same hash query, a miner neither chooses between the two nor knows in advance whether a query yields a workshare, a block, or neither.

PRS "could be applied to any PoW Nakamoto-style blockchain (e.g., Bitcoin, PoEM, Monero) by making two changes: blocks record workshares on-chain, and the reward rule is replaced with proportional splitting. Neither change affects the fork choice rule or block production, so security follows directly from the host protocol's guarantees."

The fork-choice rule and block-production loop are left untouched, so the host chain's security carries over unchanged.

At each block height, PRS distributes a fixed reward among all eligible work objects at that height in proportion to their intrinsic work. Two parameters control eligibility:

• Recency window R: sets the finalization delay: the reward for height h is settled at height h + R, and only work objects published within that window are counted.

• Fork eligibility window k: limits which forks contribute: an object is eligible only if the block it references lies at most k blocks into a fork, excluding objects that build on deeply invalid chains.

The height of a workshare or uncle is the height of the block it references via hB′, not the block in which it is published.

The authors provide an optimization in which workshares can be kept off-chain, thereby eliminating any on-chain costs of our transformation. Since workshares play no role in chain selection, only in reward allocation, miners can share them over the P2P network. Once the rewards for height hi are finalized at height hi + R, all work objects older than R + k blocks behind the current tip can be safely discarded. This results in sub-kilobyte per-block storage overhead in deployment.

Theorem 1 (Security of FairChain): "For any constant 0 < δ < 1, and any p, pf, let R = 16, kf = 2qRk, and T0 = 5kf/δ. Then, in ΓFairChain-environments, the Workshare protocol denoted ΠFairChain(p, pf, R) satisfies (i) kf-consistency, (ii) chain growth rate (T0, g0, g1) with g0 = (1−δ)(1−ρ)npf and g1 = (1+δ)npf, and (iii) fairness (T0, δ)."

The analysis proves four key properties:

1. Workobject Freshness: A key property is for any Workobject mined by an honest player to stay sufficiently fresh to be incorporated. The paper achieves a slightly better freshness parameter (R = 16) compared to FruitChains (R = 17).

2. Workobject Consistency: The proof bounds the number of inconsistent Workobjects in a chain, showing that "except with probability e(−Ω(q(R+2)k)), there were at most (1+δ′)2·q(R+2)k < 2qRk = kf 'inconsistent' Workobjects in the chain."

3. Workobject Growth: Both lower and upper bounds are established. The lower bound shows that except with probability e(−Ω((t−wait)αf)) the chain must have grown by at least (1−δ)αf·t − 2kf new Workobjects.

4. Workobject Fairness: The proof shows that the number of Workobjects in the sequence is at least: (1−δ)ϕT, establishing δ-approximate fairness.

The final theoretical result states: "Any secure blockchain protocol that satisfies δ-approximate fairness (where δ < 0.3) w.r.t T(κ) length windows can be used as the ledger underlying a cryptocurrency system while ensuring 3δ-incentive compatibility if players (i.e., miners) only care about how much money they receive."

The proof shows that the fraction of adversarial blocks in any T(κ)-length window of the chain is upper bounded by (1+δ)ρ and the total amount of compensation received by the attacker is bounded by (1+δ)ρ·V; in contrast, if the coalition had been following the honest protocol, they are guaranteed to receive at least (1−δ)ρ·V; thus, "the multiplicative increase in utility is: (1+δ)/(1−δ) ≤ 1 + 3δ when δ < 0.3."

The evaluation follows the framework of Zhang and Preneel and uses "a Markov decision process (MDP) whose states encode the adversary's private chain, the public chain, the current fork status, and the recent reward history. Solving this MDP yields the optimal adversarial policy for each utility objective, rather than measuring the performance of a fixed attack strategy."

The MDP state is a tuple of four elements ⟨la, lc, fork, history⟩:

• la: length of the private adversarial chain

• lc: length of the honest public chain

• fork: takes three values (active, cLast, aLast)

• history: a bitstring representing consecutive attacker blocks in the main chain

State transitions occur via actions: Adopt, Wait, Match, and Overridek.

The evaluation uses the same parameters for the eligibility windows: the recency window R = 6 and the fork eligibility window k = 6. The parameter γ (percentage of honest miners adopting adversarial forks) is set to 0.5 for Bitcoin, RS, and PRS, and 0 and 1 for FruitChains. The fruit-to-block ratio is set to 1.

Incentive Compatibility (IC): PRS outperforms all other mechanisms on IC. For adversarial power up to 25%, all mechanisms except FruitChains are optimal. RS and PRS both remain optimal through 35%; beyond that, PRS strictly outperforms RS. Specifically, "FairChain requires an adversary to exceed 38% of the power to earn more than its fair share, against 35% for the next-best mechanism, Reward Splitting. At 38% power, an adversary earns 38% of all rewards under FairChain, against 40% under Reward Splitting and more than 50% under Bitcoin or FruitChains."

Subversion Gain: "For the most part, PRS is again the better option. In particular, up to 30% all mechanisms except FruitChains perform optimally, i.e., the adversary has zero gain. For the range of adversarial power between 30% and 38% PRS is the best option, whereas between 38% and 42% it is in effect equally good to Bitcoin. Above 42%, FruitChains with γ = 0 performs better."

Censorship Susceptibility: "FruitChains is the best option only for adversarial power up to 25%, after which point PRS is the best option. Notably, even for smaller values of adversarial power, the difference between PRS and FruitChains is less than 2%."

Workshare Eligibility Window (R): "Larger values of R result in better performance, that is, lower adversarial rewards. Consequently, PRS is optimal for larger values of adversarial power; when R = 3, PRS is optimal for adversarial power up to 33%, whereas for R = 9 this goes up to 38%."

Fork Eligibility Window (k): Lower values of k result in better performance, i.e., lower adversarial rewards. Notably, PRS under k = 6 performs better (for the most part) than RS under k = 1.

The paper analyzes how many workshares are needed to accurately estimate the power distribution. Using the Chernoff bound: "Pr[X ≤ (1−δ)·E[X]] < ϵ = e(−δ2·n·ph/2), solving for n gives n = −2·log(ϵ)/(δ2·ph)."

With error bound ϵ = 0.05: "assume adversarial power is 15%. 7,832 workshares achieve 3% inaccuracy (with error probability 5%), requiring 612 KB per block. Similarly, 1,000 workshares achieve approx. 8.5% inaccuracy at 79 KB. On the other hand, assuming 35% adversarial power, 3% inaccuracy is achieved with 10,242 workshares, which corresponds to 800 KB."

"The reward mechanism introduced in this paper has been adopted in a deployed system: a live PoW blockchain based on PoEM, which records workshares on-chain and allocates rewards proportionally to workshare-estimated mining power."

The deployed parameters include: "a hard cap of 9 workshares per block and a soft target of 3, where each workshare header is approximately 120 bytes... Workshares older than 2 blocks (freshness parameter) are rejected by peers. Rewards are paid proportionally to each miner's workshare-estimated power, with a linear staleness discount applied to shares approaching the freshness timeout, incentivizing timely propagation. At the current parameters, the storage overhead amounts to under 1 KB per block above baseline."

The paper positions itself relative to several prior works:

• FruitChains: "was shown to be a ρ-coalition-safe ϵ-Nash equilibrium... our mechanism achieves the same guarantee, as the analysis of FruitChains carries over in our case almost directly. Nonetheless, FairChain outperforms FruitChains in practice."

• StrongChain: publishes workshares on-chain... However, StrongChain's analysis is lacking in many aspects — it offers only a high-level description of reward allocation and analyzes only a specific selfish mining strategy, whereas FairChain's MDP analysis evaluates the optimal adversarial strategy.

• Subchains and Flux: the main idea is the formation of 'sub-chains', that is, chains of objects with less PoW than blocks. However, as was shown in [25], Subchains performs worse in practice compared to Reward Splitting.

• Ethereum's uncle rewards: "Ritz and Zugenmaier show empirically that such a fixed partial reward is insufficient: it actually lowers the mining power threshold at which selfish mining becomes profitable... The core issue is that a fixed reward subsidizes the adversary regardless of their actual mining power. FairChain avoids this by splitting rewards proportionally to the power distribution."

The paper explains why PRS outperforms FruitChains in practice: "One explanation lies in the tradeoff between 'Rewarding the Bad' and 'Punishing the Good' identified in [25]. FruitChains eliminates the incentive to fork by rewarding the adversary for failed attempts. PRS does the same through workshares, but to a lesser degree: it splits rewards proportionally rather than yielding the full contested reward to the adversary."

Regarding dynamic difficulty, the paper notes: "Our theoretical analysis follows the methodology of [16], which operates in the static-difficulty setting; we therefore do not establish formal guarantees for variable-difficulty executions... A formal analysis of PRS under variable difficulty is left for future work."

Based on the paper, here are the specific improvements that can be made to AI systems, particularly those involved in blockchain protocol design, mechanism design, and game-theoretic analysis:

1. Improved Adversarial Strategy Optimization via MDPs

• Improvement: Implement the paper's Markov Decision Process (MDP) framework to compute the optimal adversarial policy for any given reward mechanism, rather than evaluating a single pre-defined attack (e.g., selfish mining).

• What the improved AI system can do: Given a blockchain protocol's parameters (confirmation window, fork-choice rule, reward rule), the AI can automatically solve the MDP to find the exact mining-power threshold where deviation becomes profitable and quantify the maximum expected gain. This allows for rapid, quantitative comparison of new reward mechanisms against existing ones (Bitcoin, FruitChains, Reward Splitting) without relying on manual attack analysis.

2. Dynamic Reward Allocation Parameter Tuning

• Improvement: Integrate the Proportional Reward Splitting (PRS) logic into an AI-driven protocol configuration system.

• What the improved AI system can do: The system can automatically tune the two key PRS parameters—the workshare eligibility window (R) and the fork eligibility window (k)—to optimize for a specific objective (e.g., maximizing the adversarial power threshold, minimizing subversion gain, or minimizing censorship susceptibility). It can simulate the trade-offs shown in Figures 5 and 6 to find the optimal parameter set for a given deployment, balancing security against reward finality delay.

3. Real-time Mining Power Estimation and Fair Reward Allocation

• Improvement: Use the workshare sampling accuracy analysis (Section 5.4) to build an AI module that estimates the current honest/adversarial power distribution in real-time.

• What the improved AI system can do: The system can calculate the minimum number of workshares required to achieve a target estimation accuracy (e.g., within 3% inaccuracy with 95% confidence) based on the current network hash rate. It can then dynamically adjust the workshare inclusion rate or the reward-splitting ratio to ensure that rewards are allocated proportionally to actual power, even as the network's hash rate fluctuates, thereby maintaining incentive compatibility.

4. Automated Security and Fairness Verification

• Improvement: Encode the theoretical guarantees (Theorem 1) into a formal verification tool for PoW protocols.

• What the improved AI system can do: Given a new or modified Nakamoto-style protocol, the AI can automatically check whether it satisfies the required conditions for consistency, chain growth, and fairness (δ-approximate fairness). It can verify that the protocol's parameters (e.g., block difficulty, workshare difficulty, recency window R) meet the bounds (e.g., R=16, kf=2qRk) to guarantee a ρ-coalition-safe ϵ-Nash equilibrium, preventing costly design flaws before deployment.

5. Optimal Off-chain Storage Management

• Improvement: Implement the storage optimization described in Section 3.5 into a node client.

• What the improved AI system can do: The AI can manage the lifecycle of workshares, automatically determining when they can be safely discarded based on the reward finality window (R + k). It can also decide whether to store workshares on-chain or off-chain based on current network bandwidth and storage costs, minimizing per-block overhead (achieving sub-kilobyte overhead as in the deployment) without compromising the ability to validate historical reward allocations.

Following the publication of Bitcoin's arguably most famous attack, selfish mining, various works have introduced mechanisms to enhance blockchain systems' game-theoretic resilience. The only proof-of-work reward rule with a Nash-equilibrium guarantee, FruitChains, demands reward finality on the order of days. The rules that settle in minutes have no such guarantee, and one of them, Reward Splitting, still outperforms FruitChains on most of the metrics that matter in deployment. This paper closes that gap between theory and practice. We introduce FairChain, a two-level transformation for any proof-of-work Nakamoto-style protocol. At the protocol layer, FairChain records low-difficulty samples called workshares alongside blocks. At the reward layer, it applies Proportional Reward Splitting (PRS): each height's reward is divided among the competing work objects in proportion to the intrinsic work behind them, with workshares supplying a fresh power estimate at every height. The fork-choice rule and block-production loop are left untouched, so the host chain's security carries over unchanged. Workshares can be discarded once the corresponding rewards mature, leaving zero on-chain footprint. We prove FairChain is a-coalition-safe epsilon-Nash equilibrium for sufficiently large parameters, matching FruitChains in theory. To evaluate practical performance, we leverage Markov decision processes and compute the optimal adversarial policy under each utility function, rather than the gain of any one attack. At a six-block confirmation window, FairChain raises the deviation threshold to 38% of mining power and beats every mechanism in that framework on incentive compatibility, subversion gain (except FruitChains above 42%), and censorship susceptibility (except FruitChains below 25%).