4

EDIT There is a clearer description of some parts of the problem in the link questions.


If there is a transaction value much higher than the payment for mining 10 new blocks, how can you trust this transaction?

To go more in detail. If I am a bad boy and pay with a proof-of-work cryptocurrency a large sum. Large means that the value is much higher than the payment for mining 10 new blocks. After that I wait some time - for example, so long, that 10 new blocks are mined in between - so that everybody thinks the transaction is sure. Than I bribe the miners with half the value of my transaction to create a new chain without my transaction. Because half the value of my transaction is very much and the miners are egoistic, they will create the new chain to get more payment in this way.

Is there any solution for such attacks in the construction of any cryptocurrency working with proof-of-work?

The only solution I see is, that we trust only transactions values which are comparable with mining-costs. But then the cryptocurrency is very inefficient.

  • How will you bribe miners to create a fork 10 blocks behind the current tip? You will put a large fee on that transaction. Why wouldn't miners include that transaction in the block on top of current tip? – croraf Dec 1 '17 at 13:15
  • I would bribe the miners in real life not with a large fee that everybody can notice. And part of the bribe is that the miners create the fork. – user65934 Dec 1 '17 at 13:18
  • So you give them 2x reward of 10 blocks if they make 10 blocks you want them to make? – croraf Dec 1 '17 at 13:21
  • Yes, for example, maybe also much more than 2x. – user65934 Dec 1 '17 at 13:22
  • 1
    Not a full answer, but here is a relevant paper: cs.umd.edu/~gasarch/reupapers/bitcoin.pdf – Pieter Wuille Dec 4 '17 at 3:31
1

I think what you're describing is a 51% attack, but with a 3rd party that is not a miner, incentivizing the miner's 'bad behaviour'. Even with an off-blockchain bribe, you would need 51%+ of miners to make this attack work (otherwise the 'original chain' would always outrun the 'bribed chain').

So, if an 'egoistic' miner wanted to perform this attack, I think it would make more sense for them to do it for their own transaction, not for someone else. Performing this attack with the involvement of a third party only increases the risk for the miner (what if the third party doesn't pay the bribe? etc). I think it makes more sense for a miner to just perform the attack themselves: send 1000 btc to an exchange, convert to altcoin, withdraw, and then roll back the btc chain to remove the transaction that sent coins to the exchange.

There is a reason this sort of attack hasn't occurred: miners see it as being less profitable in the long run.

  • But the question stays: Why do "miners see it as being less profitable in the long run."? – user65934 Dec 4 '17 at 8:18
  • 1
    Because the miners think they'll make the most profit by continuing to secure the bitcoin network, rather than just take a quick bribe and watch the public confidence in the network drop (ie price drops). Miners expect to make profit off their equipment for a lot longer time than the next ten blocks, the bribe would have to be huge, at least as large as 51% of the mining reward for the next year or more. – chytrik Dec 4 '17 at 9:29
  • That's just a technical argument. Maybe someday (today?) there is an alt-coin resistant against attack scenario, which miners can mine when PoW currencies go down, so bribe is only about mining reward during the attack. – user65934 Dec 4 '17 at 9:32
  • I don't think the existence of an alt-coin with that property would incentivize miners to perform this attack. Technical users may understand well enough to migrate to a 'safer' coin, but the more general public would lose trust in cryptocurrencies, so the 'market cap of the industry' would fall. So again, I don't think miners would choose to perform this attack – chytrik Dec 4 '17 at 20:54
  • 1
    The more complicated you make the plan, the higher the risk of it not working. What if the exchange you're using to short goes down due to a DOS attack, caused by market panic as people race to exit? The safest play is to mine cooperatively. I posted a similar question that you responded to, in there the rough math has 51% of the yearly mining reward set to ~$3.3billion. Miners would expect their position in the market to continue yielding profits for years to come (as they re-invest in their operations), so I think the bribe would have to be in the 11 digit range to be enticing. Thats a lot! – chytrik Dec 4 '17 at 22:07
0

Let's play this out assuming the block reward plus fees averaged to 15 btc. This would make 10 blocks worth about 150 btc.

Attack #1 - Single-transaction incentive:

  1. Alice has 600btc in address A
  2. Alice sends all 600btc from address A to Bob's address B
  3. Bob waits 6 blocks and then signs his mansion over to Alice
  4. Alice drives to her hideout and waits till the 10th block
  5. Alice posts a new transaction from address A sending 300btc to address C with mining fees of 300btc
  6. Miners see that transaction rewind the blockchain and set to work to get that fee.
  7. A miner finds that block and awards themselves that fee.
  8. That chain is now 9 blocks behind the original chain with no additional incentive to stay there, so miners jump back to the original chain.

Outcome: This method of attack will not work as the fork will be abandoned.

Attack #2 - Multi-transaction incentive:

  1. Alice has 6000btc in address A
  2. Alice sends all 6000btc from address A to Bob's address B
  3. Bob waits 6 blocks and then signs his 10 mansions over to Alice
  4. Alice drives to her hideout and waits till the 10th block
  5. Alice posts a new transaction from address A sending 5700btc to address C with mining fees of 300btc
  6. Miners see that transaction rewind the blockchain and set to work to get that fee.
  7. A miner finds that block and awards themselves that fee.
  8. In the 2nd block, Alice sends 5400btc from C to D with a fee of 300btc
  9. In the 3rd block, Alice sends 5100btc from D to E with a fee of 300btc
  10. In the 4th block, Alice sends 4800btc from E to F with a fee of 300btc
  11. In the 5th block, Alice sends 4500btc from F to G with a fee of 300btc
  12. In the 6th block, Alice sends 4200btc from G to H with a fee of 300btc
  13. In the 7th block, Alice sends 3900btc from H to I with a fee of 300btc
  14. In the 8th block, Alice sends 3600btc from I to J with a fee of 300btc
  15. In the 9th block, Alice sends 3300btc from J to K with a fee of 300btc
  16. In the 10th block, Alice sends 3000btc from K to L with a fee of 300btc
  17. In the 11th block, Alice sends 2700btc from L to M with a fee of 300btc
  18. The forked chain is now 1 block ahead of the original chain, so the normal incentive causes miners to stay on the forked chain.

Outcome: On paper, this method of attack benefits miners and Alice. However, in practice this attack still falls short for a couple of reasons:

  1. How will miners know on the first block of the fork that Alice will continue to provide the incentive needed to keep that fork alive? If Alice stops at any time, all would-be profits will disappear when miners go back to the original chain. One possibility is that Alice pre-publishes all 11 transactions.
  2. Because the blockchains are public knowledge, a successful attack of this magnitude would shake public faith in Bitcoin. This is because users can no longer trust 6-blocks to be sufficient to know whether a transaction has been accepted or not, since 10-blocks of transactions were rolled back using this attack. This would undermine the fundamental decentralized trust of Bitcoin, crashing the system that miners are so heavily invested in. Thus, even though miners would have more bitcoin in the short-term, that bitcoin would be severely devalued. Further, it will undermine the entire platform they are so heavily invested in, which is against their interests.

Thus, it will not be in miners' long-term best interests to partake in such an attack.

The only way it would possibly work is if a majority of miners want Bitcoin to fail, and in that case Bitcoin has much bigger problems.

Attack #3 - Non Transaction-Fee Bribe:

  1. Alice has 600btc in address A
  2. Alice sends all 600btc from address A to Bob's address B
  3. Bob waits 6 blocks and then signs his mansion over to Alice
  4. Alice drives to her hideout and waits till the 10th block
  5. Alice bribes all miners to move to a forked chain. If this were on-chain from wallet A, it would look like the following:
    1. For all the miners that earned block rewards and fees in the 10 blocks, she pays them that amount for a total sum of 150btc
    2. For all the miners in the world, she pays them the fraction of the hashing power they have of the remaining 150btc
  6. Miners see that transaction which benefits all of them, rewind the blockchain and set to work to get that transaction.
  7. All miners stay on that chain since it starts them all off with more bitcoin than the original chain, plus it has the same rewards.

This is technically less expensive than attack #2, but requires more than 50% of miners in the world to participate and so the coordination effort is enormous. This is because all participating miners must coordinate their mining software to be able to play by these rules. Further, depending on the number of miners/mining pools who don't participate, this will increase the number of blocks that Alice would need to float. For example, if 30% of miners do not participate, by the time the 10th block on the forked chain rolls around there will be around 13 blocks on the original chain.
This would again have the same scenario where it would be public knowledge that miners rewrote history and undermined (no pun intended) the blockchain. Even if it Alice's transaction was off-chain, it will still break the core principle that transactions 6-blocks deep are safe and thus devalue Bitcoin.

Again, the only way this would possibly work is if a majority of miners want Bitcoin to fail.

  • Did you read my comments about? The scenario is to bribe miners in real live and not doing it by fees which is maybe to obvious. And when there are large sums you can bribe miners with so much money that they don't care if bitcoin is maybe down afterwards. Besides, I mean Attack #2. – user65934 Dec 1 '17 at 16:37
  • By the way PoW miners are not "heavily invested" in the system. That's maybe the problem of all. I think the attack isn't possible in a PoW-PoS hybrid, so miners can go there after they crashed the PoW currencies. – user65934 Dec 1 '17 at 16:57
  • @sigmabe Thanks for the clarification, I added a third scenario based on your first comment. – Briguy37 Dec 1 '17 at 17:19
  • @sigmabe In regards to PoW, I suppose you are right that they aren't necessarily "heavily invested" in Bitcoin. Instead, they are heavily invested in their mining hardware. Now that we have alt-chains that their mining hardware will work on, they could escape the Bitcoin massacre by jumping to mine the alt. However, unless the alt has protection against a similar attack it will undermine the faith there too, so your suggestion of a PoW-PoS hybrid or something else to thwart this is spot-on as a requirement to get this type of attack to work. – Briguy37 Dec 1 '17 at 17:28
  • Yes, third scenario is better. But I don't see how it solves the problem. Yes, you need the majority of mining power, but it isn't as expensive as thought. You don't have to pay the mining hardware and energy, you only have to pay the money to bribe. And I think you don't need much money to bribe, because miners are egoistic and can go to a better coin afterwards. – user65934 Dec 1 '17 at 17:28
0

I think you have a valid point. Let's say I control 50% of the mining. How much would I accept to start a new fork from 10 blocks back?

With 50% of the mining, I'd be getting about half of the blocks, or 5 of the 10 blocks just mined. Asking me to fork from 10 blocks back would mean I'd be giving up these 5 blocks worth of payment.

The question then is how long it would take me to catch up to the real block chain from 10 blocks behind. At 50% of mining, I'd be flipping a coin to try to get 10 more heads than tails. On average, that takes some number of flips, say N. So, I would have to mine an additional N blocks, on average, to catch up to the current chain.

So, if you pay me more than N+5 blocks worth, then it would on average be more profitable for me to start a chain for you than to continue the current chain.

However, this is the average, and the distribution has a long tail, meaning it might take hundreds of blocks until the new chain is longer than the current one. There are some ways we could deal with this risk:

1) I charge you a per-block fee, and you pay me as long as you want me to mine for you. There is no promise I will ever catch up to the current chain, but I'll keep trying as long as you keep paying more than I'd make with legitimate mining.

2) I charge you up front and take the risk. In this case I'm on the hook to catch you up to the existing chain. I'd probably charge a large premium based on the potential to divert my mining resources for a long time. Also, it's possible I never will catch up, so I'd probably add a refund clause to cut my losses if it looks hopeless.

The idea that I'd mine legitimately because I want Bitcoin to succeed has some truth, because there is some setup cost to mining and I want a return on this investment, but for the right price I'd probably take the risk of killing Bitcoin. That risk is captured in the premium I charge you over my normal mining income.

Plugging in some numbers, I'll use Briguy37's assumption of 15 BTC per block mined, and let's assume N is 20 and my premium is 100%. Then, I'd charge 25*15*2 = 750 BTC to do this fork.

We can argue the exact numbers, but the main point seems to be what you were saying, which is that large transactions are not as trustworthy as smaller ones.

I would take this one step farther and argue that some smaller transactions may not be trustworthy either. Suppose I agree to pay 100 people 10 BTC each. That's 1000 BTC from me, but each transaction is only 10 BTC as far as the recipients know. if I time them all the same, the cost to reverse all of them is the same as if they were a single transaction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy