40 votes

51% attack - apparently very easy? refering to CZ's "rollback btc chain" - How to make sure such corruptible scenario can never happen so easily?

Disclaimer: I believe this question may be primarily opinion-based and not very appropriate for this site, but there are a number of technical misunderstandings that can be clarified along with it, so ...
Pieter Wuille's user avatar
33 votes
Accepted

What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?

The theory It is assumed that in order to forge an ECDSA signature you need to compute the private key for a given public key first (this operation is known as the "discrete logarithm" (DL), ...
Pieter Wuille's user avatar
27 votes
Accepted

Why do we call it a 51% attack instead of a 50% attack?

The distinction is of theoretical importance only. But if the attacker controls exactly 50%, then it's true that the attacker will eventually catch up, but he won't stay caught up: the honest ...
Nate Eldredge's user avatar
25 votes

Why does Bitcoin no longer have checkpoints?

The issue is that you assume a majority attack is an attack that can be prevented. It is not. It is a fundamental breakdown of the security assumptions. Proof of work (PoW)'s assumption is that the ...
Pieter Wuille's user avatar
24 votes
Accepted

Attacking Bitcoin with a supercomputer

"TL;DR: Bitcoin mining is virtually immune to someone attacking it with a supercomputer, because the mining market is already flooded with supercomputers custom tailored to the job at the hardware ...
Murch's user avatar
  • 75.3k
20 votes
Accepted

Why can't mining pools provide fake transactions within the generated blocks?

Suppose Alice wants to add a fake transaction where she receives X ammount of BTC. I understand that in order to add that transaction to the blockchain she would have to compete against all the other ...
Nate Eldredge's user avatar
14 votes
Accepted

What is time warp attack and how does it work in general?

The Bitcoin Protocol (consensus rules) has two relevant rules for the timestamps in block headers: A node will not accept a block whose timestamp is more than two hours in the future. A node will not ...
David A. Harding's user avatar
13 votes

Birthday attack on P2SH

Why does this document seem to imply that the birthday attack only works for multisig P2SH and then only for one of the signers? The birthday attack (to the best of my knowledge) requires that the ...
Pieter Wuille's user avatar
13 votes
Accepted

Miner modifies unconfirmed transactions and put it into the block

Is is possible that a miner modified a unconfirmed transaction (like changing the output of transaction to the miner himself) and put it into the local block, and after 10 mins the miner luckily ...
Ava Chow's user avatar
  • 70.4k
11 votes

What is a Feeler Connection? When is it used?

A feeler connection is a short-lived outbound connection that only starts up after your node has established the required 8 outbound connections and 2 block-relay-only outbound connections. The ...
vnprc's user avatar
  • 405
10 votes

Attack the network by temporarily adding hash power?

Yes it is possible. You already answered your own question: "This could dramatically increase the time it takes for transactions to be confirmed, as well as makes it not profitable for other miners. ...
Yao Choa's user avatar
  • 263
10 votes
Accepted

What prevents similar time-warp attacks in Bitcoin as happened to Verge?

Nothing directly prevents it in Bitcoin, and indeed the attack has been demonstrated on testnet3 many times---it's the primary reason that testnet3 currently has almost three times as many blocks as ...
David A. Harding's user avatar
10 votes

51% attack - apparently very easy? refering to CZ's "rollback btc chain" - How to make sure such corruptible scenario can never happen so easily?

(adding some color) Some discussion I saw suggested that people promoting this believed they only needed to achieve >50% hashpower, which caused them to overestimate the feasibility. Reorging with ...
G. Maxwell's user avatar
  • 7,727
9 votes
Accepted

Understanding a Bitcoin Double Spending Transaction by Performing one on yourself

How to Double Spend You can double spend using Electrum quite easily. Even without duplicating your wallet, be it on the same or on 2 different machines. Btw.: Duplicating wallets is super easy with ...
UTF-8's user avatar
  • 3,224
8 votes

Attacking Bitcoin with a supercomputer

It's not done every 14 days - it's done every 2016 blocks, which will happen in 14 days if hashpower stays the same. If hashpower goes up, then the retarget happens sooner.
Nick ODell's user avatar
  • 29.4k
8 votes

What is a block-relay-only connection? What is it used for?

Block relay connections were added to bitcoin core in v0.19.0.1 in November 2019. Their purpose is to harden the peer-to-peer network against partition attacks. They do this through a clever ...
vnprc's user avatar
  • 405
8 votes
Accepted

Why are OP_MUL and OP_DIV disabled in Bitcoin?

OP_MUL and OP_DIV were removed by Satoshi Nakamoto in commit 4bd188c4383d6e614e18f79dc337fbabe8464c82. As with most changes in early days of the development, little rationale was explicitly given by ...
Antoine Poinsot's user avatar
7 votes
Accepted

What is protecting the mempool from being DDOSd?

First of all, there is no "The mempool". Every full node has an individual mempool, and as these contain no transactions that are already in blocks (confirmed transactions), by definition nodes cannot ...
Pieter Wuille's user avatar
7 votes
Accepted

How does headers-first prevent disk-fill attack?

To add to the other answer, since Bitcoin Core 24.0, there is an additional protection implemented against low-difficulty header spam: header pre-syncing. To recapitulate, since the headers-first ...
Pieter Wuille's user avatar
7 votes
Accepted

How does bitcoin prevent DDoS amplification via the `addr` p2p message type?

For a long time, there was a restriction to strongly prefer connecting to addresses with port 8333. This restriction was recently removed in PR 23542 and PR 23306, although a list of "bad ports&...
Lightlike's user avatar
  • 636
7 votes
Accepted

DDOS attack via BRC-20 & ordinals on Bitcoin

Do we currently see a DDOS attack on Bitcoin as the mempool is flooded with low value Transactions incl. BRC-20, ordinals etc. (where the transaction fee exceeds the transferred value)? I get why ...
Michael Folkson's user avatar
7 votes
Accepted

How can a collision attack reveal the private key?

If the attacker just tries random public keys and guesses the correct one, they obviously won't be able to spend the funds. What they can do is try random private keys and derive the public keys from ...
Vojtěch Strnad's user avatar
6 votes

Which blocks get to be checkpoints?

At least in Bitcoin Core, none. Checkpoints are legacy and will likely be removed at some point. Checkpoints were originally introduced as a way to enable skipping of signatures in the historical ...
Pieter Wuille's user avatar
6 votes
Accepted

How does a node compare two blockchains?

Block headers include a field called bits, which can be used to calculate the difficulty and hence the amount of proof-of-work in the chain. There's probably a shortcut to being able to eliminate a ...
Jimmy Song's user avatar
  • 7,759
6 votes

Miner modifies unconfirmed transactions and put it into the block

Every valid bitcoin transaction can only be created if you have the sender's private key, public key, and the receiver's public key. You can check that the transaction is valid without having the ...
Eliyahu's user avatar
  • 171
6 votes

How does headers-first prevent disk-fill attack?

since checkpoints are removed, we would be vulnerable to this attack Where did you see that checkpoints are removed? They're still in src/chainparams.cpp as of current master (commit f8bcef38f). ...
David A. Harding's user avatar
6 votes

Why do we call it a 51% attack instead of a 50% attack?

This is to impart the need for a higher hash rate than the rest of the (honest) miners. Mining success is probabilistic, however, so this 50% or 51% is an indication of the expected behaviour given an ...
user36303's user avatar
  • 786
6 votes

To what extent does asymmetric cryptography secure bitcoin transactions?

Is there a specific attack or bug which asymmetric cryptography prevents during bitcoin transactions? asymmetric cryptography is not really something that was added on top of Bitcoin in order to ...
RedGrittyBrick's user avatar
6 votes
Accepted

What happens if a miner deliberately ignores a transaction, and "wins"?

Miners have complete perogative over what transactions to include. They may include random transactions, the highest fee paying transactions, just their own transactions, or no transactions at all. If ...
Pieter Wuille's user avatar
6 votes

Can you get the longest chain by keeping a constant low difficulty?

As Mike and Antoine already explained, we pick the best chain by total accumulated work, not by height, where the work is counted per the blocks' difficulty. However, the original release of Bitcoin ...
Murch's user avatar
  • 75.3k

Only top scored, non community-wiki answers of a minimum length are eligible