Source-linked AI summary
Analysis of Hashrate-Based Double Spending
Meni Rosenfeld
TL;DR
Double-spending requires convincing a merchant that a transaction is confirmed and then persuading the network to accept a conflicting transaction. The paper clarifies Bitcoin’s stochastic attack processes, derives successful double-spend probabilities, and dispels myths about six confirmations and waiting time.
Problem
Double-spending creates a synchronization problem because recipients need a universally accepted signal that a transaction is final and cannot be reversed.
Method
The paper models the attacker’s catch-up process as a continuous-time Markov chain and derives success probabilities from its recurrence relation.
Results
The paper derives successful double-spend probabilities and shows that six confirmations are neither universally sufficient nor necessary, depending on attacker hashrate and acceptable risk.
Takeaways & Limitations
Security depends on attacker hashrate and confirmation count rather than a universally safe default or elapsed waiting time alone.
Takeaways & Limitations
The economic analysis assumes the attacker gives up after 20 blocks without successful catch-up, without modeling an optimal stopping point.
Abstract
from arXiv · showhide
Bitcoin is the world's first decentralized digital currency. Its main technical innovation is the use of a blockchain and hash-based proof of work to synchronize transactions and prevent double-spending the currency. While the qualitative nature of this system is well understood, there is widespread confusion about its quantitative aspects and how they relate to attack vectors and their countermeasures. In this paper we take a look at the stochastic processes underlying typical attacks and their resulting probabilities of success.
1 Introduction
Bitcoin uses blockchain proof of work to make transaction finality and protection against double-spending depend on accumulated computational work. The paper analyzes how attackers with substantial computational power can undermine this protection.
- Double-spending lets an attacker receive a product, then replace the merchant’s payment with a conflicting transaction returning the coins to himself.
- The core challenge is synchronization: participants need a universally accepted signal that a transaction is final and cannot be replaced.
- Bitcoin groups transactions into blocks and uses hash-based proof of work to acknowledge them, treating a transaction as final after sufficient work.
- Linking blocks makes the work supporting a transaction continually increase, so matching a conflicting transaction requires prohibitive computational effort.
- An attacker controlling substantial computational power may nevertheless elevate a conflicting transaction to the same confirmation status.
2 The blockchain and branch selection
Bitcoin’s blocks form a tree of competing transaction histories, while nodes select the branch representing the most proof of work. Temporary forks are resolved when a new block makes one branch longer, and confirmations measure a transaction’s depth toward the chain’s leaf.
- The blockchain and branch selection: Each Bitcoin block references an earlier block by its identifying hash, producing a tree rooted at the genesis block.
- The blockchain and branch selection: A branch is a leaf-to-genesis path representing one transaction history; branches are internally consistent but may conflict with one another.
- The blockchain and branch selection: Nodes select the longest branch, more precisely the branch with the most proof of work, and use first-learned tie-breaking until a tie is broken.
- The blockchain and branch selection: Temporary disagreement creates a blockchain fork, which a newly found block resolves by making one branch longer and acceptable to all nodes.
- The blockchain and branch selection: A transaction has n confirmations when its block lies on the valid chain and n blocks appear on the path from that block to the chain’s leaf, inclusive.
3 Playing catch-up
The paper models double-spending as a race between honest and attacker branches, where success occurs when the attacker’s branch becomes longer. The resulting success probability depends on the attacker’s hashrate share and current disadvantage.
- A double-spend begins with a merchant-facing payment while the attacker secretly mines a conflicting branch paying himself.After sufficient confirmations, the attacker releases his branch if it becomes longer than the public branch, causing the network to accept his payment instead.
- The attacker’s disadvantage z changes by +1 for an honest block and −1 for an attacker block, forming a continuous-time Markov chain.The upward and downward transition rates are p/T0 and q/T0, respectively.
- Success is reaching z = −1, when the attacker’s branch becomes longer; otherwise the attack fails.The process can be analyzed in discrete time because only whether the attacker ever catches up matters, not when it happens.
- The catch-up probability is 1 when q > p, and (q/p)^(z+1) when q ≤ p and z ≥ 0.If the attacker already has a longer branch, z < 0, and success probability is also 1.
- The success probability depends on the number of blocks, not the time constant T0, and decays exponentially with disadvantage when q < p.An attacker controlling more than half the network hashrate always catches up from any disadvantage.
4 Waiting for confirmations
The confirmation-waiting analysis asks how likely a secret conflicting branch is to overtake the merchant’s branch after n confirmations. It replaces a Poisson approximation with a negative binomial model for attacker blocks and then applies the catch-up probability.
- The double-spend probability depends on the attacker’s disadvantage z when the merchant reaches n confirmations.The attacker must wait until those confirmations arrive before releasing or continuing his private branch.
- The analysis rejects the assumption that n honest blocks arrive in average time nT0 and attacker blocks follow a Poisson distribution with mean nq/p.Instead, it models attacker blocks as a negative binomial variable counting successes before n honest-network failures.
- After n honest blocks and m + 1 attacker blocks, the catch-up race starts with z = n−m−1.The extra attacker block represents one block pre-mined before the attack began.
5 Graphs and analysis
The analysis visualizes how double-spend success varies with attacker hashrate and confirmations, showing that confirmations reduce but cannot eliminate risk. Near or above half the network hashrate, confirmation-based protection becomes ineffective.
- More confirmations decrease double-spend success, but success approaches 100% as attacker hashrate approaches half the network.
- For any target probability, required confirmations approach infinity as attacker hashrate approaches half the total network hashrate.
- For q ≥0.5, no amount of confirmations reduces success probability below 100%.
- Successful double-spending is possible with any attacker hashrate, while additional confirmations reduce its probability exponentially at a hashrate-dependent rate.
- The success probability depends on confirmations rather than the time constant, although the time constant matters if the attacker cannot sustain hashrate.
- The paper notes that six confirmations are neither universally necessary nor sufficient: their rationale assumes 10% attacker hashrate and an acceptable risk below 0.1%.
6 Economics of double-spending
The paper models double-spending economically by combining attack success probability with transaction value, rewards, and attacker behavior. It concludes that merchant safety depends on profitability, while the quantitative thresholds remain sensitive to modeling assumptions.
- Motivation: The paper analyzes a simple economic model because adversarial-setting probabilities are conservative for realistic attackers who target merchants only when attacks may be profitable.The model treats the exact economics as complex while highlighting the key moving parts.
- Model assumptions: An attack can target k merchants simultaneously, with each product costing v and having attacker value αv, where 0 < α ≤ 1.The model allows an effective common product value v and recognizes that purchased goods may be less liquid to the attacker.
- Profitability model: The attacker’s average profit combines guaranteed goods value kαv with failure losses of kv plus oB, weighted by success probability r and failure probability 1 − r.Here B is the block reward and o is the number of blocks found before giving up.
- Profitability model: An attack is uneconomical when its expected profit is nonpositive, so merchants are safe when their transaction conditions prevent profitability.The success probability r depends on n and q, while the model also accounts for the attacker’s block-reward losses.
- Limitations: o = 20 is a significant simplification because it assumes the attacker gives up after 20 unsuccessful blocks without changing the success probability.A more accurate model would optimize the stopping point using completion rewards and compounding losses.
- Security implications: Increasing T0 slightly improves security for a fixed confirmation count by increasing effective B, but worsens security for a fixed wait time because r dominates exponentially with confirmations.The paper’s economic analysis therefore distinguishes confirmation-based security from wait-time-based security.
- Limitations: A more accurate cost model could change the confirmation requirement from logarithmic to linear in transaction value, which the paper characterizes as poor security.That model would account for mining costs and resources obtained specifically to perform the attack.
- Security implications: Table 2 reports maximal safe transaction values in BTC as functions of attacker hashrate q and confirmation count n, but the values depend on many modeling assumptions.The authors advise treating these thresholds cautiously.
7 Conclusions
The paper explains Bitcoin’s blockchain protection against double-spending, derives successful-attack probabilities, and examines when attacks become economical. It uses these analyses to challenge the belief that sufficient confirmations provide absolute security.
- The paper explains Bitcoin’s blockchain, its protection against double-spending, and ways that protection can be undermined.
- It derives the probability of a successful double-spend and tabulates the result in several ways.
- It discusses conditions under which a double-spending attack can be economical and therefore likely.
- The analysis dispels popular myths, including the belief in absolute security from confirmations.