How can a block withholding attack be performed, what would be its purpose and who is it a danger to?

Edit: when I posted this I was thinking about withholding a block you mined in a pool. But withholding blocks can form the basis for many different attacks. I think this is still useful as a broad question. It is a central concept in bitcoin security.

up vote 4 down vote accepted

There are two types of block withholding attacks. One, known as the Finney Attack, aims for financial gain when a double spend occurs. The second is to cause financial harm to a pool operator. A miner that solves a block can withhold a valid hash after finding one. The cost to the miner is trivial (from not being awarded the share) but the cost to the pool is large as the pool loses a chance to earn the 50 BTC block award subsidy.

  • 2
    Unless the pool is PPS, the cost to the attacker is not trivial as he is one of the participants who would be given some of the block reward. Also there is a for-profit block withholding attack against mining pools, lie-in-wait. – Meni Rosenfeld Oct 3 '12 at 20:21
  • If you're doing that attack why would you even have to do the hashing to begin with. Can't you just tell the pool you're doing work and hope you're assigned the correct value – David Jun 12 '13 at 1:03
  • Remember when 50btc was the reward...DAYUMMM – bkunzi01 Aug 14 '17 at 19:35

The simplest form of it called Finney attack, named for Hal Finney who first described it. The attack is variation of a double-spend attack involving accepting 0-confirmation transactions.

An attacker would generate a valid block but will not broadcast it, and then broadcast transaction A as a payment for a good or service. A merchant will see transaction A with nothing conflicting with it and accept the 0-confirmation transaction. Right after that the attacker would broadcast the generated block with transaction B which will conflict with transaction A, the Bitcoin network will accept his block and invalidate transaction A.

The attack is quite costly because there is a time gap between generation of the block by the attacker and completing transaction A, during which someone else on the network could generate a valid block and broadcast it, thus invalidating the valid block generated by attacker. Therefore it is practical only if the merchant sells the product online and it could be release immediately, e.g. a key for a software product.

A general form of this attack was described by Satoshi Nakamoto: White Paper, section 11. In theory, an attacker could pre-generate any number of blocks, e.g. if a merchant requires 1 confirmation before releasing a product an attacker would pre-generate 2 blocks ahead of the network and only then broadcast transaction A to double spend. But with each block the cost increases exponentially, and the practice of accepting 6 confirmations before releasing the purchase makes this attack possible only in case where the attacker has close to 50% of network hash rate or more.

  • “who first described it”… And what is section 11 of the white paper all about? – Stéphane Gimenez Oct 3 '12 at 15:56
  • @Stéphane Gimenez, white paper described the general form of this attack, and Hal Finney described the specific case for 0-confirmation transaction, but I should probably include the link to the white paper – Serith Oct 3 '12 at 16:06

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.