What is a Finney attack?

Question

What is a Finney attack? Extra points for explaining its purpose, the prerequisites for it to be possible, how the attack can be performed and the origin of the name "Finney attack".

Answer 1

The Finney attack is named after Hal Finney, who suggested it in this comment. (Hal happens to be the first recipient of a Bitcoin transaction, and the first person to comment on the release of the Bitcoin source code.)

It is a double spending attack with the following features:

• It only works if the merchant accepts unconfirmed transactions.

• It still works, however, if the merchant waits a few seconds to verify that everyone in the network agrees he was paid.

• It requires the attacker to be mining and controlling the content of his blocks; however, he can in theory do this with any hashrate, in particular significantly less than 50% of the network hashrate.

It proceeds as follows:

1. The attacker mines blocks normally; in the block he is trying to find, he includes a transaction which sends some of his coins back to himself, without broadcasting this transaction.

2. When he finds a block, he does not broadcast it; instead, he sends the same coins to a merchant for some goods or service.

3. After the merchants accepts the payment and irreversibly provides the service, the attacker broadcasts his block; the transaction that sends the coins to himself, included in this block, will override the unconfirmed payment to the merchant.

If the time from finding the block until the attacker sends payment and the merchant accepts it is t, and the average time to find a block is T, there is a probability of t/T that another block will be found on the network in this time; in this case the attack will fail, and the attacker will lose the block reward of B.

This means that the average cost of attempting the attack is about (t/T) * B; as a rule of thumb the merchant should wait at least t=V*T/B (V is the value of the transaction), to make sure that trying to carry out this attack against him isn't profitable; this may not be sufficient though, as a nimble attacker can use the same block for multiple attacks, potentially gaining the total of their value.

Clearly, the lower the attacker's hashrate, the less opportunities he has to carry out the attack. If the attack is for obtaining some illiquid good, it is difficult to make the need for this good coincide with finding a block. If the attack is for obtaining something liquid (e.g. exchanging bitcoins for other money), an opportunity is ever-present but the merchant is likely to require a few confirmations. This makes the attack difficult to use in practice.

Answer 2

The Finney attack is a variation of a double-spend attack. The attacker creates two transactions - one crediting the victim and one crediting themselves. They keep the first transaction for now and proceed to try mining the second one into a block. When they succeed (this may take awhile), they quickly make a purchase with the first transaction, get the goods they purchased, and then release the pre-mined block. This way the first transaction will become invalidated, even if it is propagated through the whole network.

This variant of double-spend attack is harder to execute (mining a block by oneself hasn't been easy for a long while), but is undetectable until it has been fully executed. The only way to protect oneself against such an attack is to require at least one confirmation for transaction before giving out purchased goods, and requiring more confirmations for transactions worth more.