Can a pool keep blocks for itself without giving out rewards to miners? Can it do this in secret?
Yes. This is one of a few problems with current pool implementations.
Miners are trusting pools to:
- give miners their fair share of any blocks the pool mines
- payout on all blocks mined
- not censor transactions
- give miners hashing blobs for the main chain they want to mine
- not be performing a 51% attack
- display accurate information about the pool (e.g. its hashrate, payouts, etc)