Egoistic miners combined with large transactions destroy PoW?

Question

EDIT There is a clearer description of some parts of the problem in the link questions.

---

If there is a transaction value much higher than the payment for mining 10 new blocks, how can you trust this transaction?

To go more in detail. If I am a bad boy and pay with a proof-of-work cryptocurrency a large sum. Large means that the value is much higher than the payment for mining 10 new blocks. After that I wait some time - for example, so long, that 10 new blocks are mined in between - so that everybody thinks the transaction is sure. Than I bribe the miners with half the value of my transaction to create a new chain without my transaction. Because half the value of my transaction is very much and the miners are egoistic, they will create the new chain to get more payment in this way.

Is there any solution for such attacks in the construction of any cryptocurrency working with proof-of-work?

The only solution I see is, that we trust only transactions values which are comparable with mining-costs. But then the cryptocurrency is very inefficient.

Answer 1

I think what you're describing is a 51% attack, but with a 3rd party that is not a miner, incentivizing the miner's 'bad behaviour'. Even with an off-blockchain bribe, you would need 51%+ of miners to make this attack work (otherwise the 'original chain' would always outrun the 'bribed chain').

So, if an 'egoistic' miner wanted to perform this attack, I think it would make more sense for them to do it for their own transaction, not for someone else. Performing this attack with the involvement of a third party only increases the risk for the miner (what if the third party doesn't pay the bribe? etc). I think it makes more sense for a miner to just perform the attack themselves: send 1000 btc to an exchange, convert to altcoin, withdraw, and then roll back the btc chain to remove the transaction that sent coins to the exchange.

There is a reason this sort of attack hasn't occurred: miners see it as being less profitable in the long run.

Answer 2

Let's play this out assuming the block reward plus fees averaged to 15 btc. This would make 10 blocks worth about 150 btc.

Attack #1 - Single-transaction incentive:

1. Alice has 600btc in address A
2. Alice sends all 600btc from address A to Bob's address B
3. Bob waits 6 blocks and then signs his mansion over to Alice
4. Alice drives to her hideout and waits till the 10th block
5. Alice posts a new transaction from address A sending 300btc to address C with mining fees of 300btc
6. Miners see that transaction rewind the blockchain and set to work to get that fee.
7. A miner finds that block and awards themselves that fee.
8. That chain is now 9 blocks behind the original chain with no additional incentive to stay there, so miners jump back to the original chain.

Outcome: This method of attack will not work as the fork will be abandoned.

Attack #2 - Multi-transaction incentive:

1. Alice has 6000btc in address A
2. Alice sends all 6000btc from address A to Bob's address B
3. Bob waits 6 blocks and then signs his 10 mansions over to Alice
4. Alice drives to her hideout and waits till the 10th block
5. Alice posts a new transaction from address A sending 5700btc to address C with mining fees of 300btc
6. Miners see that transaction rewind the blockchain and set to work to get that fee.
7. A miner finds that block and awards themselves that fee.
8. In the 2nd block, Alice sends 5400btc from C to D with a fee of 300btc
9. In the 3rd block, Alice sends 5100btc from D to E with a fee of 300btc
10. In the 4th block, Alice sends 4800btc from E to F with a fee of 300btc
11. In the 5th block, Alice sends 4500btc from F to G with a fee of 300btc
12. In the 6th block, Alice sends 4200btc from G to H with a fee of 300btc
13. In the 7th block, Alice sends 3900btc from H to I with a fee of 300btc
14. In the 8th block, Alice sends 3600btc from I to J with a fee of 300btc
15. In the 9th block, Alice sends 3300btc from J to K with a fee of 300btc
16. In the 10th block, Alice sends 3000btc from K to L with a fee of 300btc
17. In the 11th block, Alice sends 2700btc from L to M with a fee of 300btc
18. The forked chain is now 1 block ahead of the original chain, so the normal incentive causes miners to stay on the forked chain.

Outcome: On paper, this method of attack benefits miners and Alice. However, in practice this attack still falls short for a couple of reasons:

1. How will miners know on the first block of the fork that Alice will continue to provide the incentive needed to keep that fork alive? If Alice stops at any time, all would-be profits will disappear when miners go back to the original chain. One possibility is that Alice pre-publishes all 11 transactions.
2. Because the blockchains are public knowledge, a successful attack of this magnitude would shake public faith in Bitcoin. This is because users can no longer trust 6-blocks to be sufficient to know whether a transaction has been accepted or not, since 10-blocks of transactions were rolled back using this attack. This would undermine the fundamental decentralized trust of Bitcoin, crashing the system that miners are so heavily invested in. Thus, even though miners would have more bitcoin in the short-term, that bitcoin would be severely devalued. Further, it will undermine the entire platform they are so heavily invested in, which is against their interests.

Thus, it will not be in miners' long-term best interests to partake in such an attack.

The only way it would possibly work is if a majority of miners want Bitcoin to fail, and in that case Bitcoin has much bigger problems.

Attack #3 - Non Transaction-Fee Bribe:

1. Alice has 600btc in address A
2. Alice sends all 600btc from address A to Bob's address B
3. Bob waits 6 blocks and then signs his mansion over to Alice
4. Alice drives to her hideout and waits till the 10th block
5. Alice bribes all miners to move to a forked chain. If this were on-chain from wallet A, it would look like the following:
   1. For all the miners that earned block rewards and fees in the 10 blocks, she pays them that amount for a total sum of 150btc
   2. For all the miners in the world, she pays them the fraction of the hashing power they have of the remaining 150btc
6. Miners see that transaction which benefits all of them, rewind the blockchain and set to work to get that transaction.
7. All miners stay on that chain since it starts them all off with more bitcoin than the original chain, plus it has the same rewards.

This is technically less expensive than attack #2, but requires more than 50% of miners in the world to participate and so the coordination effort is enormous. This is because all participating miners must coordinate their mining software to be able to play by these rules. Further, depending on the number of miners/mining pools who don't participate, this will increase the number of blocks that Alice would need to float. For example, if 30% of miners do not participate, by the time the 10th block on the forked chain rolls around there will be around 13 blocks on the original chain.
This would again have the same scenario where it would be public knowledge that miners rewrote history and undermined (no pun intended) the blockchain. Even if it Alice's transaction was off-chain, it will still break the core principle that transactions 6-blocks deep are safe and thus devalue Bitcoin.

Again, the only way this would possibly work is if a majority of miners want Bitcoin to fail.

Answer 3

I think you have a valid point. Let's say I control 50% of the mining. How much would I accept to start a new fork from 10 blocks back?

With 50% of the mining, I'd be getting about half of the blocks, or 5 of the 10 blocks just mined. Asking me to fork from 10 blocks back would mean I'd be giving up these 5 blocks worth of payment.

The question then is how long it would take me to catch up to the real block chain from 10 blocks behind. At 50% of mining, I'd be flipping a coin to try to get 10 more heads than tails. On average, that takes some number of flips, say N. So, I would have to mine an additional N blocks, on average, to catch up to the current chain.

So, if you pay me more than N+5 blocks worth, then it would on average be more profitable for me to start a chain for you than to continue the current chain.

However, this is the average, and the distribution has a long tail, meaning it might take hundreds of blocks until the new chain is longer than the current one. There are some ways we could deal with this risk:

1) I charge you a per-block fee, and you pay me as long as you want me to mine for you. There is no promise I will ever catch up to the current chain, but I'll keep trying as long as you keep paying more than I'd make with legitimate mining.

2) I charge you up front and take the risk. In this case I'm on the hook to catch you up to the existing chain. I'd probably charge a large premium based on the potential to divert my mining resources for a long time. Also, it's possible I never will catch up, so I'd probably add a refund clause to cut my losses if it looks hopeless.

The idea that I'd mine legitimately because I want Bitcoin to succeed has some truth, because there is some setup cost to mining and I want a return on this investment, but for the right price I'd probably take the risk of killing Bitcoin. That risk is captured in the premium I charge you over my normal mining income.

Plugging in some numbers, I'll use Briguy37's assumption of 15 BTC per block mined, and let's assume N is 20 and my premium is 100%. Then, I'd charge 25*15*2 = 750 BTC to do this fork.

We can argue the exact numbers, but the main point seems to be what you were saying, which is that large transactions are not as trustworthy as smaller ones.

I would take this one step farther and argue that some smaller transactions may not be trustworthy either. Suppose I agree to pay 100 people 10 BTC each. That's 1000 BTC from me, but each transaction is only 10 BTC as far as the recipients know. if I time them all the same, the cost to reverse all of them is the same as if they were a single transaction.