Return to Question

Section 11 presents calculations of the probability of double spending  (P) given an attacker relative hash rate q and a block count z.

P can only be understood by knowing exactly what z represents. From the Calculations section:

There appears to be an error somewhere in the Calculations section leading to a contradiction. I'm looking for an answer that either points the error out, or explains what I'm misinterpreting.

Section 11 presents calculations of the probability of double spending, P(z, q), given an attacker relative hash rate q and a block count z.

P(z, q) can only be understood by knowing exactly what z represents. From the Calculations section:

There appears to be an error somewhere in the Calculations section leading to a contradiction. I'm looking for an answer that either points the error out, or explains what I'm misinterpreting.

EDIT

One response offers the suggestion that Satoshi may have been talking about a Finney attack. In other words, the attacker has already pre-mined a block before attempting the double spend. Assuming the attacker can propagate blocks faster than the network, there would be a 100% chance of success. In this scenario, the attacker and network are tied at z=0, and given faster block propagation, the advantage goes to the attacker.

However, the Calculations section explicitly disallows a Finney attack. In particular, the attacker has mined no blocks prior to the attack:

The receiver generates a new key pair and gives the public key to the sender shortly before signing. This prevents the sender from preparing a chain of blocks ahead of time by working on it continuously until he is lucky enough to get far enough ahead, then executing the transaction at that moment. Once the transaction is sent, the dishonest sender starts working in secret on a parallel chain containing an alternate version of his transaction.

I believe at least part of the problem is mathematical. Specifically, Satoshi gives the value of λ as:

When z=0, λ=0.

Referring back to Satoshi's original derivation of double-spending probability P(z, q):

λ=0 means that every term is zero, independent of hash rate. In other words, the attacker can never double spend.

This contradicts the "rearranged" form of the equation, which gives a probability of 100% as noted above.

I'm no math specialist, but from what I can tell, the two forms of P(z, q) that Satoshi gives are not equivalent for z=0. In fact, they give the opposite answer:

• in one case, the attacker always fails, P(z, q) = 0
• in the other case, the attacker succeeds with 100% probability, P(z, q) = 1.

Either way, the attacker's relative hash rate doesn't factor into the analysis when z=0.

I realize that other treatments of this problem have appeared. For now, I'm just interested in fixing the apparent problem with the white paper's analysis for z=0.

Is this possible, and if so, how can I do that?

Section 11 presents calculations of the probability of double spending (P) given an attacker relative hash rate q and a network block count z.

I'm not sure how to interpret a situation in which z = 0. The results say that that P = 1, regardless of attacker hash rate.

Does z = 0 mean that a transaction hasn't yet been confirmed, or that it has been confirmed but its block hasn't yet been extended?

If the latter, this would imply an attacker with zero hash rate can double spend with 100% success. It would also conflict with this statement:

The recipient waits until the transaction has been added to a block and z blocks have been linked after it. He doesn't know the exact amount of progress the attacker has made, but assuming the honest blocks took the average expected time per block, the attacker's potential progress will be a Poisson distribution with expected value... [my emphasis]

What am I missing?

Edit: To be clear, there appears to be a contradiction. A transaction with one confirmation (z=0) has a 100% probability of being double-spent (P=1.0), regardless of the attacker's hash rate.

I'm looking for an answer that addresses this apparent contradiction.

Section 11 presents calculations of the probability of double spending (P) given an attacker relative hash rate q and a block count z.

P can only be understood by knowing exactly what z represents. From the Calculations section:

The recipient waits until the transaction has been added to a block and z blocks have been linked after it. He doesn't know the exact amount of progress the attacker has made, but assuming the honest blocks took the average expected time per block, the attacker's potential progress will be a Poisson distribution with expected value... [my emphasis]

Clearly, the transaction has one confirmation. The transaction "has been added to a block" and zero blocks have been linked after it. In other words, the transaction is hosted by the tip of the active chain.

Nevertheless, the probability of this transaction being double-spent is 100%, regardless of the attacker's hash power. In fact, the probability is 100% even with no active attacker.

This contradiction is reinforced by the equation Satoshi gives:

When z = 0, P = 1.0.

What am I missing?

There is at least one answer to this question that claims that z=0 means that the transaction is unconfirmed. That's inconsistent with the paragraph I quoted.

There appears to be an error somewhere in the Calculations section leading to a contradiction. I'm looking for an answer that either points the error out, or explains what I'm misinterpreting.

Section 11 presents calculations of the probability of double spending (P) given an attacker relative hash rate q and a network block count z.

I'm not sure how to interpret a situation in which z = 0. The results say that that P = 1, regardless of attacker hash rate.

Does z = 0 mean that a transaction hasn't yet been confirmed, or that it has been confirmed but its block hasn't yet been extended?

If the latter, this would imply an attacker with zero hash rate can double spend with 100% success. It would also conflict with this statement:

The recipient waits until the transaction has been added to a block and z blocks have been linked after it. He doesn't know the exact amount of progress the attacker has made, but assuming the honest blocks took the average expected time per block, the attacker's potential progress will be a Poisson distribution with expected value... [my emphasis]

What am I missing?

Section 11 presents calculations of the probability of double spending (P) given an attacker relative hash rate q and a network block count z.

I'm not sure how to interpret a situation in which z = 0. The results say that that P = 1, regardless of attacker hash rate.

Does z = 0 mean that a transaction hasn't yet been confirmed, or that it has been confirmed but its block hasn't yet been extended?

If the latter, this would imply an attacker with zero hash rate can double spend with 100% success. It would also conflict with this statement:

The recipient waits until the transaction has been added to a block and z blocks have been linked after it. He doesn't know the exact amount of progress the attacker has made, but assuming the honest blocks took the average expected time per block, the attacker's potential progress will be a Poisson distribution with expected value... [my emphasis]

What am I missing?

Edit: To be clear, there appears to be a contradiction. A transaction with one confirmation (z=0) has a 100% probability of being double-spent (P=1.0), regardless of the attacker's hash rate.

I'm looking for an answer that addresses this apparent contradiction.