Probability an honest node finds the next block vs. probability the attacker finds the next block

Question

I am trying to understand Satoshi's paper [1]. On page 6 of the paper, he calculates the probability that someone can attack the blockchain from z blocks behind. He begins by defining:

My question: The mining of a block i.e., solving the hash puzzle is a completely brute-force trial-and-error process in which one keeps trying a random nonce until one gets a hit. No one has an upper hand in this process. So shouldn't p and q be equal to each other?

EDIT: since comment would have been very long. Responding to the comments, in that case it gets even worse. q can be greater than p. Let the Bitcoin network be composed of M mining pools with their compute power be given by p_i. Then all an attacker needs to do is to form a pool whose compute power is greater than max(p_i). Am I missing something? In other words, the pool with max compute power can attack the blockchain already.

In an ideal design, if I want to attack the blockchain, I should be pitted against the sum of p_i not the max of p_i.

Answer 1

No one has an upper hand in this process. So shouldn't p and q be equal to each other?

The chances of finding a valid block header that meets the target requirement increases proportionally to the number of tries. This means that it is proportional to the hash power that you have. Even if there are two miners, one could be using a huge datacenter (the size of United States), while the other might be mining on his 10 year old laptop. Their hash power would not be the same, and hence p and q will also not be equal to one another. Hash rate is the metric to be used to find out the probability of a miner finding the next block.

Then all an attacker needs to do is to form a pool whose compute power is greater than max(p_i). Am I missing something? In other words, the pool with max compute power can attack the blockchain already.

What you are describing is a 51% attack. With the current hashrate of the Bitcoin network, it would require HUGE investments (billions of dollars) from the entity who is planning to do such attacks. At that investment level, the economic incentive to launch such attacks may be tiny, unless it's a state actor who is trying to annihilate the confidence of the network. Even if a fraudulent miner amasses >50% of the hash rate of the network, full nodes MAY try to patch themselves to reject such blocks (for example: if that attacker tries to broadcast a longest chain that is > 6 blocks different than the original chain, to prevent double spends).

Answer 2

The reason p and q are not equal is because the attacker is indeed pitted against the cumulative power of the entire network vs. being pitted against one miner.

If there was just one miner to compete with, then both the attacker and miner would have equal chances of finding the next block and p is indeed equal to q in that case (assuming identical hardware and hashing power). But when there are n miners, each of them working independently, then the chances that one of them finds the next block increase dramatically. The rate factor becomes $n \lambda$ instead of just $\lambda$. See https://en.wikipedia.org/wiki/Exponential_distribution#Distribution_of_the_minimum_of_exponential_random_variables and so now p/q=n.

Another way to get above result is to recognize that mining a block is like winning a lottery where everyone has equal chances (again assuming identical compute power). So if there are n miners plus 1 attacker, then p/q=n

Bitcoin is pure genius.