A theoretical low cost attack scenario in PoW currencies

Question

The scenario was designed by user:croraf and me in discussing a question of mine yesterday. To make it more clear, I want to present it here again in a stricter design.

To do it in a clear way, first four assumptions:

1. Transactions are accepted when N blocks confirm them.
2. We can make contact to the majority of the miners, they are egoistic and barely invested in the PoW currency.
3. An attack with the majority of mining power is possible. To make it more clear: We assume that rewriting blockchain history with undoing many transactions is so surprising, that we can get our benefits from the attack before the currency goes down.
4. There is an alt coin, resistant against our following attack scenario, without value correlation to PoW currencies. Mining hardware allows to mine the alt coin as well as the PoW currency.

Now the attack scenario.

We do a transaction with a higher value than mining benefits from N blocks. We wait until N blocks confirm our transaction, so the transaction is accepted by assumption 1. Than we bribe the majority of miners to create a fork to make our transaction undone. The bribe must be only a little bit more than the mining benefits on the "real" chain because they are egoistic and are not interested in keep the currency alive by assumption 2. Only paying the bribe the cost of the attack is very low relative to the promised win! The miners and we get our benefits from the attack before the currency is down by assumption 3. Then the PoW currency maybe goes down, but the bribed miners can go to mine the alt coin without any loss, what is possible by assumation 4.

Where is the fault, in the attack scenario or in the assumptions?

I think the attack scenario is correct and the suggested faults in the assumptions from the discussion yesterday can't convince my.

The most important critics I already know:

Assumption 1: We should only trust transactions with values comparable with mining costs, but this makes the currency inefficient, which was showed here.

Assumption 3: If you don't trust this assumption, so you deny usual attack scenario of PoW currency. If you do so, why shouldn't we do PoW with a very low difficulty and a very small mining power then?

EDIT: I think we can skip assumption 3 by doing the attack with a short position which means we do the high value transaction in the beginning with cryptos we have lended. I seems clear that the currency goes down after such a big attack and so we even profit from the short.

Answer 1

Where is the fault, in the attack scenario or in the assumptions?

The fault lies that you've discounted the opportunity cost it takes for an adversary or a conglomerate of miners to subvert the chain by forking off from some prior block. The key here is that there is inherent cost to forking the blockchain at some arbitrary height and re-creating the blocks. The cost can be formularised as block subsidy + total transaction fees in the number of blocks an adversary wishes to re-produce.

Firstly, honest miners will not be party to this, because they'd have to forgo their prior earnings and do double the work to re-earn the difference in your promised bribe transactions fees, so the conflict transaction you intend to bribe the miner with must be so great that it has to be double (at least) block subsidy + total transaction fees * N. Where N is the total number of blocks you want to re-organise. More importantly, what is it that the attacker seeks to achieve by donating away such a large sum worth of bribes (is it actually incentive-compatible to do so)?

Secondly, Assumption 3. simply does not make much sense as it lacks incentive compatibility. As you have shown, sure a miner can perform a naked short on an exchange before colluding to perform your described attack, there is risk to undertaking such a trade as an exchange out of popular interest can renege or withhold payments to a colluding miner that undertakes such a transaction. Simply put, it is more incentive-compatible for miners to mine transactions in an honest manner.