A theoretical low cost attack scenario in PoW currencies

The scenario was designed by user:croraf and me in discussing a question of mine yesterday. To make it more clear, I want to present it here again in a stricter design.

To do it in a clear way, first four assumptions:

1. Transactions are accepted when N blocks confirm them.
2. We can make contact to the majority of the miners, they are egoistic and barely invested in the PoW currency.
3. An attack with the majority of mining power is possible. To make it more clear: We assume that rewriting blockchain history with undoing many transactions is so surprising, that we can get our benefits from the attack before the currency goes down.
4. There is an alt coin, resistant against our following attack scenario, without value correlation to PoW currencies. Mining hardware allows to mine the alt coin as well as the PoW currency.

Now the attack scenario.

We do a transaction with a higher value than mining benefits from N blocks. We wait until N blocks confirm our transaction, so the transaction is accepted by assumption 1. Than we bribe the majority of miners to create a fork to make our transaction undone. The bribe must be only a little bit more than the mining benefits on the "real" chain because they are egoistic and are not interested in keep the currency alive by assumption 2. Only paying the bribe the cost of the attack is very low relative to the promised win! The miners and we get our benefits from the attack before the currency is down by assumption 3. Then the PoW currency maybe goes down, but the bribed miners can go to mine the alt coin without any loss, what is possible by assumation 4.

Where is the fault, in the attack scenario or in the assumptions?

I think the attack scenario is correct and the suggested faults in the assumptions from the discussion yesterday can't convince my.

The most important critics I already know:

Assumption 1: We should only trust transactions with values comparable with mining costs, but this makes the currency inefficient, which was showed here.

Assumption 3: If you don't trust this assumption, so you deny usual attack scenario of PoW currency. If you do so, why shouldn't we do PoW with a very low difficulty and a very small mining power then?

EDIT: I think we can skip assumption 3 by doing the attack with a short position which means we do the high value transaction in the beginning with cryptos we have lended. I seems clear that the currency goes down after such a big attack and so we even profit from the short.

• I would make 10 generic, substituting it with N. And remove 3rd assumption from the list. – croraf Dec 2 '17 at 18:23
• Hello again, nice to see you. Yes, you are right, 10 is no special number and so a made it generic now. I've done 3rd assumption because this was the main argument in the discussion yesterday by @Briguy37. – user65934 Dec 2 '17 at 18:34
• what do you mean by "transactions are accepted when N blocks confirm them"? Every node in the network accepts transaction, validates them against a set of rules, and then they go in a mempool, and then will be included by a miner into a block. So if you wait "N blocks", others have processed it already... Independant from this, there are evaluations of mining power (the 51% attack). Probably also with 40%. How do you "bribe" the miners? The software running follows bitcoin rules. If they create a block that differs, they lose the "intended" benefit (aka coinbase values cannot be spent). – pebwindkraft Dec 3 '17 at 7:44
• ahh, I see: you want to wait N blocks, and then send your "high value tx" to the net, and convince the majority of miners to do a fork. Nothing easy as this! If you have flawed the net like this, everyone would go away from the currency, and you have made a one-time win? – pebwindkraft Dec 3 '17 at 7:48
• I first sent the high value transaction, then wait until I can be sure that I get the thing I've payed for and then I bribe miners to accept double spending the money from the transaction, so I do usual majority attack. Different is that the costs are in my opinion in PoW only the costs for bribing the miners and not the costs for holding the mining power. So the attack is much cheaper than supposed. – user65934 Dec 3 '17 at 9:02

The fault lies that you've discounted the opportunity cost it takes for an adversary or a conglomerate of miners to subvert the chain by forking off from some prior block. The key here is that there is inherent cost to forking the blockchain at some arbitrary height and re-creating the blocks. The cost can be formularised as block subsidy + total transaction fees in the number of blocks an adversary wishes to re-produce.
Firstly, honest miners will not be party to this, because they'd have to forgo their prior earnings and do double the work to re-earn the difference in your promised bribe transactions fees, so the conflict transaction you intend to bribe the miner with must be so great that it has to be double (at least) block subsidy + total transaction fees * N. Where N is the total number of blocks you want to re-organise. More importantly, what is it that the attacker seeks to achieve by donating away such a large sum worth of bribes (is it actually incentive-compatible to do so)?
• Yes, that's clear, we must pay a fee to lend the coins for the short. Maybe the fee is very big and for lending coins worth 10 million $we must pay 1 million$ fees. All in all we have now the 10 million $airplain we've bought with our transaction. And the only costs are 1 million$ fees for the short and 1 million $to bribe the miners. – user65934 Dec 3 '17 at 16:02 • Maybe there's a misunderstanding: We hold a short position not the miners. Our short is realized by lending coins for 10 million$ for doing the attack. – user65934 Dec 3 '17 at 16:17