Learn · I

On Difficulty

A lottery that sets its own price

A die has no memory, and that is its only kindness.

A miner plays a game with one rule. It takes a candidate block header, varies a 32-bit nonce (and, when the nonce runs out, the extranonce in the coinbase), and computes SHA-256 twice. The result, read as a 256-bit integer, is for every practical purpose uniformly distributed. If it falls below the target T, the block is valid. If not, nothing has been learned, and the miner tries again. Each hash is an independent trial with success probability

There is no partial credit and no gradient to follow. A hash that misses by a whisker is worth exactly what a hash that misses by a mile is worth: nothing. (Whiskers do have a use, as shares; that is the next essay.)

Difficulty is the same quantity on a friendlier scale: the easiest target Bitcoin ever allowed, T₁ = 0xFFFF · 2²⁰⁸, divided by today's. Substituting D = T₁ / T,

so a block costs D · 2³² hashes on average, about D × 4.3 billion. At D = 84 G, that is 3.6 × 10²⁰ hashes per block. Numbers like that stop meaning anything, so here is the target, found one zoom at a time.

Figure 1

Where the winning hashes live

Each bar is the highlighted sliver of the bar above, magnified. The slivers are drawn wider than scale so you can see them; the last bar is to scale. Only there does the target become visible.

Now give the miner a hashrate h. Trials happen so fast and succeed so rarely that the discrete process becomes, to excellent approximation, a Poisson process with rate

Two consequences follow, and between them they hold most of what there is to know about solo mining.

The first is how little λ depends on: your hashrate and the difficulty, nothing else. Other miners do not appear in the formula. A thousand rivals switching on tonight take nothing from you directly; they reach you only through D (and a slightly higher chance that someone else's block orphans yours), and D will not move until the next retarget. Put your own numbers in.

Figure 2

Your clock

Chance of at least one block by a given time, 1 − e^−λt. Difficulty is the network's live figure.

Hashrate Unit GH/sTH/sPH/s Difficulty (G)

Mean wait—

Median wait—

Within 24 h—

Within 30 days—

The second consequence is memorylessness. The waiting time is exponentially distributed with mean 1/λ, and the exponential is the only continuous distribution without memory:

Take a worked example, a 1 PH/s machine at 84 G: 1/λ ≈ 4.2 days. The median is ln 2 / λ ≈ 2.9 days, so half of all such blocks arrive sooner than that. The standard deviation is also 4.2 days, as large as the mean. And the chance of reaching the mean with nothing to show for it is e⁻¹ ≈ 37%. At that point the expected remaining wait is 4.2 days, unchanged from the morning you started. Slide the clock forward and watch what the future looks like from there.

Figure 3

The die has no memory

Left: the probability density of your wait, with the time already spent marked. Right: the rest of the curve from that point, rescaled by the chance you are still waiting. It is the curve you started with, wherever you put the slider. Uses the numbers from Figure 2.

Waited so far, as a share of the mean

—

From the day you started

From today, given nothing yet

The past has been spent, and the future owes you nothing for it. Equally, no run of bad luck has put you behind. Every hash is the first hash.

⁂

Why have a target at all? Because the protocol sells a fixed quantity, one block per 600 seconds, to buyers whose total demand it cannot see. Difficulty is the price, and the retarget is how the price discovers itself.

ECX reprices every 288 blocks, 48 hours at the intended pace. Let S = 172,800 s be the intended timespan of a window and S_m the measured one, clamped to [S/4, 4S]. Then

The clamp makes the moves lopsided: one window can lift difficulty by at most 7/6.25, about +12%, and drop it by at most 7/10, −30%.

The seventh does two jobs. The first is convergence. Suppose hashrate jumps and then holds still, and let x be the current target divided by the target that would give exact ten-minute blocks. Ignoring luck, one retarget gives exactly x′ − 1 = (6/7)(x − 1). The error shrinks geometrically, with a half-life of ln 2 / ln(7/6) ≈ 4.5 windows.

Figure 4

Hashrate doubles overnight

Average block time in each retarget window after the network's hashrate doubles on day 0. The shaded band is within 5% of ten minutes.

ECX, one seventh per windowUndamped rule, full correction

An undamped rule snaps back after one window. ECX takes 20 windows, about 31 days, to settle within 5%, and through all of it everyone already mining collects blocks at a price still below where it is heading. That sounds like a flaw until you see the second job, which is quiet.

Even with perfectly constant hashrate, the length of a 288-block window is a sum of 288 exponentials, so luck alone gives it a relative spread of 1/√288 ≈ 6%. An undamped rule feeds that noise straight into the difficulty. ECX's rule divides each shock by seven and lets it decay.

Figure 5

Pure luck, constant hashrate

Simulated difficulty over 120 windows (about eight months), as a deviation from where it ought to sit. Nothing changes but the dice.

Roll the dice again

The damping also changes the shape of strategy. A miner who switches off a fraction f of the network for one window drags the next difficulty down by about f/7, not f, and the cut then fades over the following windows instead of vanishing at once. The total discount comes out about the same, but no one, lucky or scheming, can yank the price far in a single step. The seventh is not caution. It is mechanism design.

⁂

Last, the game itself. In the long run the retarget holds D · 2³² ≈ 600 · H, with H the total network hashrate, so your share of blocks is h / H. Economists know this structure as a Tullock contest: a lottery whose tickets cost money. With R the block reward (subsidy plus fees) and c the cost of one hash, both in ECX, miners add hashrate until the marginal hash only breaks even:

Figure 6

Where the wall comes to rest

What one more hash earns falls as difficulty rises; what it costs does not. Difficulty settles where the two meet.

Earned per hash, R / (D · 2³²)Cost per hash, c

The equilibrium difficulty depends on the reward and the marginal cost of a hash, not on how many miners there are. With free entry and a common cost per hash, total spending on hashing rises to meet the total reward: the full rent dissipation of an open contest. (Miners with cheaper power keep the difference; the marginal miner keeps nothing.) Economists call this equilibrium. Miners call it Tuesday. The difficulty you see is a fossil of that argument, the number at which the world, collectively, decided one more hash was barely worth it.