The scenario was designed by user:croraf and me in discussing a question of mine yesterday. To make it more clear, I want to present it here again in a stricter design.
To do it in a clear way, first four assumptions:
- Transactions are accepted when N blocks confirm them.
- We can make contact to the majority of the miners, they are egoistic and barely invested in the PoW currency.
- An attack with the majority of mining power is possible. To make it more clear: We assume that rewriting blockchain history with undoing many transactions is so surprising, that we can get our benefits from the attack before the currency goes down.
- There is an alt coin, resistant against our following attack scenario, without value correlation to PoW currencies. Mining hardware allows to mine the alt coin as well as the PoW currency.
Now the attack scenario.
We do a transaction with a higher value than mining benefits from N blocks. We wait until N blocks confirm our transaction, so the transaction is accepted by assumption 1. Than we bribe the majority of miners to create a fork to make our transaction undone. The bribe must be only a little bit more than the mining benefits on the "real" chain because they are egoistic and are not interested in keep the currency alive by assumption 2. Only paying the bribe the cost of the attack is very low relative to the promised win! The miners and we get our benefits from the attack before the currency is down by assumption 3. Then the PoW currency maybe goes down, but the bribed miners can go to mine the alt coin without any loss, what is possible by assumation 4.
Where is the fault, in the attack scenario or in the assumptions?
I think the attack scenario is correct and the suggested faults in the assumptions from the discussion yesterday can't convince my.
The most important critics I already know:
Assumption 1: We should only trust transactions with values comparable with mining costs, but this makes the currency inefficient, which was showed here.
Assumption 3: If you don't trust this assumption, so you deny usual attack scenario of PoW currency. If you do so, why shouldn't we do PoW with a very low difficulty and a very small mining power then?
EDIT: I think we can skip assumption 3 by doing the attack with a short position which means we do the high value transaction in the beginning with cryptos we have lended. I seems clear that the currency goes down after such a big attack and so we even profit from the short.