Left a laptop pool mining on the testnet all day. Hasn't seemed to be any issues on my end, no disconnections or anything. The hashrate for my worker appears to be reported accurately on the pool site. The reward shares seem to be calculated and distributed properly.
No issues doing withdrawals, aside from what appears to be a minor glitch with the withdrawal form on the pool site where it adds the immature balance to available balance field after making a withdrawal (so if you have 100 available bbp, 500 immature bbp, withdraw 1 bbp, it'd show 599 bbp in the available balance field). That's purely an issue with the form, though, it's not actually adding to the immature balance to the available balance and you can't actually withdraw more than you have available.
It seems like the pool uses unique worker ids to link miners to pool accounts. I messed around with that a little and wasn't able to create a duplicate miner name that someone else is already using or anything potentially exploit-y that way.
How does the pool ensure that all workers are actually doing the work they're reporting, by the way? Each worker's portion of the reward seems to be exactly proportional to the % of the total pool hashrate they're contributing. If this is just being reported by the client, there will definitely be people attempting to falsify their hashrate. Is there some kind of share system operating behind the scenes so the pool can verify everyone's doing the work they're claiming?
Thanks a lot for the in-depth high quality testing, this helps immensely.
I see that you fired up a heavy duty miner in the middle of the night (where the reward was > 25000 hps) while you tested multiple workers per block and then multiple rigs pointed to one workerid. I believe that part is working correctly, based on the data and HPS readings and the reward distributions - so Im happy there.
10-4 on the withdrawal bug, I created a (punchlist) item to update the balance properly.
Good that it seems that the pool has no security issue, related to mining against the wrong accounts. Imo, if a person somehow discovers how to mine against anothers workerid, they would only be hurting themself, so thats why I dont enforce login credentials on the mining side. The web site of course requires authentication to add new workers, but the client may mine against a workerid without authentication. It does send 9 proprietary HTTP headers to the pool in order to receive the minerguid, but does not authenticate with any password. The pool enforces unique worker IDs globally with a constraint. (Another words, User B cant create a miner named MINER if MINER is in use).
On the per share rewards, if you look closely at the block_distribution report, you will see the reward per miner is not exactly the same as the HPS reading that is reported in the leaderboard. The number in parentheses is the number of shares solved by the miner during the round for that block * a synthetic number to arrive at a synthetic HPS reading. The synthetic reading is in parentheses and is actually used to calculate that rows subsidy amount. I am considering the fraudulent client issue, reporting the wrong work done per thread and hash count and resulting HPS, but yes, currently the HPS seems accurate because it is honoring what the client gives and using that for the leaderboard, but not for the payments. I was originally planning on adding a type of police subsystem to the pool, to detect cheaters as I think it will be apparent on the server side by doing some math formulas based on either cheating time sequences, or cheating work done nonce counts or both, but actually today when I woke up I was thinking of adding another type of shares-submitted and shares-solved per round to the work table, to see how accurate that is per block instead, and possibly using that for the leaderboard, so thats sort of up in the air