Stumbled upon this really insightful piece by David Vorick, developer of Sia, dated May 13, 2018, but even more relevant today, I would say. Here's some takeaways:
About a year ago, myself and some members of the Sia team started Obelisk, a cryptocurrency ASIC manufacturing company. Our first ASICs are going to ship in about 8 weeks, and our journey with Obelisk has given us a lot of insight into the world of cryptocurrency mining.
One of the reasons we started Obelisk was because we felt that coin devs in general had a very poor view into the mining world, and that the best way to understand it would be to get our hands dirty and bring a miner to market.
We’ve been pessimistic on ASIC resistance for a long time, and our journey into the hardware world solidly confirmed our position. Hardware is extremely flexible. General purpose computational devices like CPUs, GPUs, and even DRAM all make substantial compromises to their true potential in order to be useful for general computation. For basic hardware development, most algorithms can see substantial optimization just by taking away all of that generality and focusing on one specific thing.
The vast majority of ASIC-resistant algorithms were designed by software engineers making assumptions about the limitations of custom hardware. These assumptions tend to be incorrect.
The key is to make sorting memory. A lot of algorithm designers don’t seem to realize that in an ASIC, you can merge the computational and storage pieces of a chip. When a GPU does equihash computations, it has to go all the way out to off-chip memory, bring data to the computational cores, manipulate the data, and then send the altered data all the way back out to the off-chip memory.
For equihash, the manipulations that you need to make to the data are simple enough that you can just merge the memory and computation together, meaning that you can do most of your manipulating in-place, substantially reducing the amount of energy used to move data back and forth, and also substantially decreasing the amount of time between adjustments to the data. This greatly increases efficiency and speed.
We also had loose designs for ethash (Ethereum’s algorithm). Admittedly, ethash was not as easily amenable to ASICs as equihash, but as we’ve seen from products on the market today, you can still do well enough to obsolete GPUs. Ethash is by far the most ASIC resistant algorithm we’ve looked at, most of the others have shortcuts that are even more significant than the shortcuts you can take with equihash.
At the end of the day, you will always be able to create custom hardware that can outperform general purpose hardware. I can’t stress enough that everyone I’ve talked to in favor of ASIC resistance has consistently and substantially underestimated the flexibility that hardware engineers have to design around specific problems, even under a constrained budget. For any algorithm, there will always be a path that custom hardware engineers can take to beat out general purpose hardware. It’s a fundamental limitation of general purpose hardware.
A lot of people believe that computing is broken up into 3 categories: CPU, GPU, and ASIC. While those are the categories that are generally visible to the public, in the chip world there’s really only one type of chip: an ASIC. Internally, Nvidia, Intel, and other companies refer to their products as ASICs. The categories as known to the public are really a statement about how flexible the ASIC is.
Two examples of products between a GPU and an ASIC would be the Baikal miners and the Google TPU. These are chips which can cover a flexible range of applications at performances which are substantially better than a GPU. The Baikal case specifically is interesting, because it’s good enough to obsolete GPUs for a large number of coins, all using the same basic chip. These chips appear to be flexible enough to follow hardforks as well.
I think there are a lot of people out there who do not realize that flexible ASICs are possible, and expected that routinely doing small hardforks to disrupt any ASICs on the network would be sufficient. It may be sufficient sometimes, but just as algorithms can attempt to be ASIC resistant, ASICs can attempt to be hardfork resistant, especially when the changes are more minor.
A few months ago, it was publicly exposed that ASICs had been developed in secret to mine Monero. My sources say that they had been mining on these secret ASICs since early 2017, and got almost a full year of secret mining in before discovery. The ROI on those secret ASICs was massive, and gave the group more than enough money to try again with other ASIC resistant coins.
It’s estimated that Monero’s secret ASICs made up more than 50% of the hashrate for almost a full year before discovery, and during that time, nobody noticed. During that time, a huge fraction of the Monero issuance was centralizing into the hands of a small group, and a 51% attack could have been executed at any time.
We’ve heard rumors of plenty of other secret ASICs. People who own secret ASICs tend not to talk about them very much, but as of March 2018, we had heard of secret ASIC rumors specifically for both Equihash and Ethash, and then for many other smaller coins that don’t have any ASICs on them yet. We believe a full 3 different groups were actively mining on Zcash with different ASICs prior to the Bitmain Z9 announcement.
We know of mining farms that are willing to pay millions of dollars for exclusive access to designs for specific cryptocurrencies. Even low ranking cryptocurrencies have the potential to make millions in profits for someone with exclusive access to secret ASICs. As a result, an informal underground industry has been set up around secret mining. The heavy amount of secrecy involved means it’s disconnected and mostly operates off of rumor and previous relationships.
The ASIC game has become such an advanced game because there is so much money on the table. Even small coins can be worth tens of millions of dollars, which is more than enough to justify a high-risk production run.
The mining game is weighted heavily in favor of the manufacturers. They get to control the hardware production, the supply, and they know more about the state of the industry than anyone else. The profitability of a miner largely depends on variables that the manufacturer controls without disclosure to anyone else.
In the case of Halong’s Decred miner, we saw them “sell out” of an unknown batch size of $10,000 miners. After that, it was observed that more than 50% of the mining rewards were collecting into a single address that was known to be associated with Halong, meaning that they did keep the majority of the hashrate and profits to themselves. Our investigation into the mining equipment strongly suggests to us that the total manufacturing cost of the equipment is less than $1,000, meaning that anyone who paid $10,000 for it was paying a massive profit premium to the manufacturer, giving them the ability to make 9 more units for themselves. Beyond this, the buyer has no idea how many were sold nor where the difficulty would be when the units shipped. The manufacturer does know whether or not the buyer is going to be able to make a return, but the buyer does not. The buyer is trusting the manufacturer entirely.
At the end of the day, cryptocurrency miner manufacturers are selling money printing machines. A well-funded profit maximizing entity is only going to sell a money printing machine for more money than they expect they could get it to print themselves. The buyer needs to understand why the manufacturer is selling the units instead of keeping them for themselves.
Most manufacturers however have access to good electricity deals, and unless you have some deal with free electricity or are otherwise running a cutting edge professional operation, you are not likely to do better than the manufacturer.
This is likely not the case in cryptocurrency mining though, because the shelf life of miners tends to be under two years, and to a business that’s not a long time at all to wait for healthy returns.
A huge portion of the time spent is on full-custom routing for the chip. There’s a much faster development process called place-and-route which trims about 3 months off of the chip development time, but produces chips that are 2x-5x slower than what a full-custom team can produce. We think that if we used a place-and-route design methodology, we could get our product delivery timeline close to 6 months.
We believe it took Bitmain about 5 months to create the A3 miner, and we believe it took Halong about 9 months to create the B52 miner. We suspect both of these were completed using place-and-route methodologies, especially given the relatively poor performance of each.
Rather insightful and still very relevant, I would say....
In case anybody has missed it.
