Hot answers tagged

40

The Finney attack is named after Hal Finney, who suggested it in this comment. (Hal happens to be the first recipient of a Bitcoin transaction, and the first person to comment on the release of the Bitcoin source code.) It is a double spending attack with the following features: It only works if the merchant accepts unconfirmed transactions. It still works,...


37

Disclaimer: I believe this question may be primarily opinion-based and not very appropriate for this site, but there are a number of technical misunderstandings that can be clarified along with it, so I'll give it a shot. There are many nuances involved here, and I fear that a large part of them didn't reach as much of an audience as the exchange announcing ...


27

The distinction is of theoretical importance only. But if the attacker controls exactly 50%, then it's true that the attacker will eventually catch up, but he won't stay caught up: the honest population will eventually overtake his chain, and we'll be in an unstable situation where control of the "best" chain will bounce back and forth between them forever....


23

"TL;DR: Bitcoin mining is virtually immune to someone attacking it with a supercomputer, because the mining market is already flooded with supercomputers custom tailored to the job at the hardware level." (via Cort Ammon in comments) First of all, the difficulty reset happens after 2016 blocks. That's only after about 14 days if the hashrate is stable. When ...


23

The theory It is assumed that in order to forge an ECDSA signature you need to compute the private key for a given public key first (this operation is known as the "discrete logarithm" (DL), and its hardness is the basis for ECDSA's security). In order to do so, you must actually have the public key. Once you have the public key, it is assumed that you ...


22

A double spend is an attack where the given set of coins is spent in more than one transaction. There are a couple main ways to perform a double spend: Send two conflicting transactions in rapid succession into the Bitcoin network. This is called a race attack. Pre-mine one transaction into a block and spend the same coins before releasing the block to ...


21

Suppose Alice wants to add a fake transaction where she receives X ammount of BTC. I understand that in order to add that transaction to the blockchain she would have to compete against all the other miners to generate the next block, which makes it improbable to happen as an individual against them. No, that isn't correct. No matter how much mining power ...


18

The issue is that you assume a majority attack is an attack that can be prevented. It is not. It is a fundamental breakdown of the security assumptions. Proof of work (PoW)'s assumption is that the majority of the hashrate will cooperate and converge on a single chain, because it is most financially advantageous thing to do. When that is no longer the case, ...


16

The simplest form of it called Finney attack, named for Hal Finney who first described it. The attack is variation of a double-spend attack involving accepting 0-confirmation transactions. An attacker would generate a valid block but will not broadcast it, and then broadcast transaction A as a payment for a good or service. A merchant will see transaction A ...


14

The Finney attack is a variation of a double-spend attack. The attacker creates two transactions - one crediting the victim and one crediting themselves. They keep the first transaction for now and proceed to try mining the second one into a block. When they succeed (this may take awhile), they quickly make a purchase with the first transaction, get the ...


12

The thing to consider is, "what does the attacker have to give up in order to attack me?" If the cost of that thing is less than the reward from a successful attack, then attacking is rational from a purely economic standpoint. (Obviously, attacking someone comes with a non-economic moral cost.) A miner who controls more than half of the network hash rate,...


11

There are several groups of people that could have incentives to DDoS mining pools: Owners of other mining pools. Mining pools make profit from the blocks mined by their miners. So it would make perfect sense for them to attack other pools to encourage users to abandon the pool and perhaps find a new home at theirs. People mining at other pools, including ...


11

Ripple solves the double spend problem by consensus. Everyone who wants to run a server on the Ripple network picks a set of validators and tries to reach a consensus with them on which transactions are valid. The Ripple equivalent of Bitcoin's 51% attack would be if some group obtained control over enough validators that the consensus process failed. ...


11

Is is possible that a miner modified a unconfirmed transaction (like changing the output of transaction to the miner himself) and put it into the local block, and after 10 mins the miner luckily solved the PoW, putting the block on the chain and broadcast it to others? No, because the transaction would be invalid. The vast majority of transactions contain ...


10

As I suggested in my Bitcoin master thesis, a 51% attack would cost in a bulk part of about 7 million dollars to execute. The figure will change depending on the technology used, the current difficulty and so forth. This option would make Bitcoin or any other Bitcoin-like currency useless. However, if the USA goverment was to crack down on Bitcoin as a ...


10

Yes it is possible. You already answered your own question: "This could dramatically increase the time it takes for transactions to be confirmed, as well as makes it not profitable for other miners. Granted this would only last until the difficulty is readjusted, but perhaps it could be enough to shake public confidence in the network." There are other ...


10

(adding some color) Some discussion I saw suggested that people promoting this believed they only needed to achieve >50% hashpower, which caused them to overestimate the feasibility. Reorging with only slightly over 50% would take weeks-- even months, creating massive disruption if successful, and virtually guaranteeing an effective public initiative to ...


9

The current maximum size of a block is 1 MB. Current block sizes are about half that, so the absolute worse case scenario is that the block chain grows in size twice as fast as it does now. That's not particularly scary. It's easy to create more than 1 MB of transactions every 10 minutes. If anyone does that, some transactions can't be included in blocks. ...


9

Nothing directly prevents it in Bitcoin, and indeed the attack has been demonstrated on testnet3 many times---it's the primary reason that testnet3 currently has almost three times as many blocks as Bitcoin, despite being launched several years after Bitcoin mainnet and with a something similar to[1] Bitcoin's 10-minute average block interval. Indirectly, ...


8

Transactions are signed with ECDSA. Incidentally, bitcoin addresses are hashes of the ECDSA public key that can spend them. You can't spend somebody else's coins unless you 1) do a bruteforce search to find their private key or 2) find a public key that hashes out to the same thing. Both are much, much harder than doing a double spend attack.


8

How to Double Spend You can double spend using Electrum quite easily. Even without duplicating your wallet, be it on the same or on 2 different machines. Btw.: Duplicating wallets is super easy with Electrum. Just go to Tools → Preferences → Transactions and check View transaction before signing. Close the settings, go to the "Send" tab, and enter the ...


8

It's not done every 14 days - it's done every 2016 blocks, which will happen in 14 days if hashpower stays the same. If hashpower goes up, then the retarget happens sooner.


8

The Bitcoin Protocol (consensus rules) has two relevant rules for the timestamps in block headers: A node will not accept a block whose timestamp is more than two hours in the future. A node will not accept a block unless it has a timestamp greater than the median of the previous 11 blocks. In Bitcoin, we call this Median-Time-Past (MTP). As you mention ...


7

You're absolutely correct. The following would completely work: Get ready to perform a Finney attack. Gamble some coins. If you lose, go through with the Finney attack. Otherwise, cancel your Finney attack, and collect your 1250 BTC from satoshidice. Is anybody doing this? I don't know.


7

There's no cooperation involved in mining, and they won't be trying the same hashes because (for example) they have different transaction pools and (possibly) different destination addresses. Mining pooling is just like non-pooled mining, except that the revenue is spread over time instead of getting blocks of 25BTC. Even when the pooled miners have a ...


7

Such transactions will be subject to fees. You can read about the fee schedule here. The fees apply if the transactions send a small amount of coins, or send the same coins over and over (giving the transactions a low priority score). The fee is set at BTC 0.0001 per 1000 bytes. Thus someone who wants to spam the block chain with 10 MB will have to pay ...


7

The victim could send any "shady" or unauthorized donation back to the originating address, and the refund would be just as public as the initial donation. The process could also be automated with a custom wallet software, so that, for example, all donations above a certain amount which are not explicitly approved are automatically refunded after x days.


6

Your transactions would be given the lowest priority as they are not paying fees, also if anyone is actually marginally successful in spamming the system it is entirely possible that the larger pools will simply not take their transactions, in fact some pools do filter out some transactions. This thread shows some of the restrictions that some mining pools ...


6

Ok, I'm spoiling the fun of you working it out yourself, but I had too much fun working it out myself to not post. In order to have as many target addresses as possible, let's suppose every satoshi that will ever exist (21e6 * 100e6 = 2.1e15 or 2.1 quadrillion) were in a different address. And let's suppose someone developed an ASIC that, at the same rate ...


6

The behaviour of the mempool or orphan tx pool should not influence the validity of blocks at all. When a block comes in: main.cpp:ProcessMessage deals with processing messages, and dispatches to: main.cpp:ProcessNewBlock deals with specifically processing block messages, which stores it on disk using AcceptBlock and then calls: main.cpp:ActivateBestChain ...


Only top voted, non community-wiki answers of a minimum length are eligible