When Bitcoin was running up to $20,000, I tried to analyze the system and come to a personal conclusion about its equilibrium value, because I didn't want to miss out if it really was the currency of the future.
I ended up not investing, because of the possibility of a double-spend attack. I think that cryptocurrency enthusiasts are seriously underestimating the importance of double-spending attacks to the economics of bitcoin and other cryptocurrencies.
A few points that convinced me not to put my money into this system:
If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. There is no equilibrium point for transaction fees where this attack becomes uneconomical. The only defense is that the market for hash capacity is imperfect.
The market for hash capacity is going to become more efficient over time. ASIC miners will be commoditized, so that hardware investment becomes a much smaller factor in hash cost versus energy. This might be even worse during a bitcoin downturn, because there could be a glut of ASIC miners.
Miners will coordinate with market prices, turning off capacity when the price dips (for example, because someone is underbidding to create a 51% attack). If mining becomes more decentralized, it will be harder for miners to act in their common interest (fending off 51% attacks) and against their immediate interest (selling their hashrate to the highest bidder, or taking it off the market during an underbidding attack).
High transaction volume is not necessarily any help - the more transaction volume, the higher the cost of the attack, but the greater the rewards. The semi-anonymous nature of bitcoin means that one could easily flood the network with double-spend transactions. Attacking a huge network like bitcoin would be an audacious and expensive act, but there are certainly organizations with the resources to do it, e.g. intelligence agencies, organized crime. The massive rewards to such an attack also offset fixed costs such as writing and testing the software to carry out the attack.
I think the argument is that by doing a 51% attack you undermine the market value so you never get the rewards. This makes sense, but only for the leading crypto coin. As we see here today, you can 51% attack smaller coins, which should imply an increase in the value of Bitcoin from consolidation.
The spooky thing that this made me realize, is that if anyone did find a vulnerability in bitcoin (or any cryptocurrency) is that they would have a greater incentive to only slowly leech off the system, because they will be able to siphon out much more over time than if everyone panics over security. The weapon is no good unless it's secret.
> I think the argument is that by doing a 51% attack you undermine the market value so you never get the rewards.
Only if you make it public. A 51% attack works at a poker table too, but only if the marks don't know the game is rigged.
A successful double spend makes it public, as well as announcing your intentions to get to 51%. If you're quiet and can pull off a successful 51%, you can create the double spend before anyone knows.
You can profit from undermining the market. Futures volumes may currently be too low to find enough liquidity to use them for financing a major attack but this could change when BB’s start selling them in earnest to clients.
My conclusion is that since this is true, the real thing maintaining the system is mutual cooperation of sufficient mining interest. When you look at the theoretical division of hashpower in btc, it looks too stable over generations of hardware. Any non-colluding ecosystem should have centralized. I conclude btc is a collusion system.
So why the pow? Is this stabilizing the actors somehow? It seems like an explicitly managed network would be no less centralized, way more efficient, and way more user friendly.
In the bitcoin system, miners make literally billions of dollars a year protecting the network. Any successful attack on the bitcoin network is going to massively erode confidence, reduce the price, reduce the usage, and therefore reduce the value of all that single-purpose, bitcoin-only hardware.
Large miners don't want to see Bitcoin get attacked because it destroys their income and de-values their incredibly expensive hardware. This is also why miners won't just let you borrow their hashrate for a while - it's a big issue if you use that hashrate to undermine their cash cow.
There is another--less talked about--way to double-spend: developers can cause forks and double-spend during the confusion.
In 2013, the network forked unexpectedly [0] and the Bitcoin network had 2 chains for about 4 hours. During those 4 hours, it is entirely possible that people sent BTC to exchanges they knew were going to be on the chain that ended up being orphaned.
A conniving team of centralized developers can take this a step further and discover or intentionally plant a consensus bug that causes such a fork and because developers ultimately tell everyone which chain contains the "fix" (in 2013, they commanded that the minority chain was the right one), the developers know which chain will be orphaned and thus which exchange they can exploit.
What a lot of people in the thread seem to be missing is that when you receive a huge payment you can require a higher amount of confirmations to accept it. High enough that it would make the 51% attack unprofitable.
Requiring more confirmations decreases the probability that a transaction will be reverted, under the assumption that an attacker has < 49% of the hashpower. If you attempt an attack with 49%, then you have a fair chance of mining, say, 6 blocks before the rest of the network. If you get unlucky then you sacrifice those rewards. But if you mine with 51% then your attack chain is (probabilistically) guaranteed to eventually become the longest chain, so there won't be any loss of revenue.
Great points. The thing is though that a double spend would harm both the attacker and all others on the network. It would weaken the trust. It is a double edged sword. You would have to do the double spend without anyone noticing and then liquidate your earnings as fast as possible. With more combined hashing power this would become very hard to do.
There are a lot of problems other than double spend with the Bitcoin. Transactions fees rise very quickly because of the block size limit of about 1MB. You can't really rely on 0-confirmation transactions. The saviour lightning network in my opinion is the wrong solution to the scaling problem. It changes fundamentally how bitcoins are exchanged and steers away from the original white paper by Satoshi. Not that this is wrong... it just becomes another project altogether.
It is often asserted (for example, in the Bitcoin white paper [22]) that a cartel can double-spend Bitcoins. In a strict sense, this is true: a cartel can spend a Bitcoin by paying it to a player Alice, receiving goods or services, and then shifting the consensus choice of history to a branch where that coin is instead paid to a different player Bob. However, we argue that double-spending by a cartel has a limited payoff. Bitcoins have value because people are willing to trade them for goods and services. If players were unwilling to accept Bitcoins for trade or unwilling to spend Bitcoins for fear of having their payments nullified, the value of Bitcoins would diminish significantly as players lost confidence in the system. Worse, because players are encouraged to generate a new identity for each transaction and because identities are not linked to any side information, players cannot easily determine whether a proffered payment is coming from the double-spending cartel or an honest user. Thus, a rational player should refuse to accept any payments when there is a significant threat of double-spending.
As a cartel must outmine the entire Bitcoin network and thus outspend the entire Bitcoin network for as long as it would remain a cartel, we believe it is very unlikely that a cartel could double-spend enough to recover the cost of the attack...
As described above, a 51% cartel attack is unlikely to generate enough reward within the Bitcoin economy to be worthwhile to the attacker. However, this does not rule out the possibility of a 51% attack that aims to destroy the Bitcoin economy in order to achieve utility outside the Bitcoin economy. We call this the Goldfinger attack after the character in film who tries to undermine U.S. currency by ruining its gold backing [15]...
In all of these cases, the attacker must achieve enough utility to justify the substantial cost of an attack. We agree with Becker et al. that it is unlikely that a protest movement could muster the resources to launch a successful attack. And at present it does not appear possible to acquire a short position on Bitcoins that is large enough to justify an attack. (2013)
The Economics of Bitcoin Mining, or Bitcoin in the Presence of Adversaries
Joshua A. Kroll, Ian C. Davey, and Edward W. Felten,
Princeton University
You have used technical analysis for making an investment decision. Scientific method, skeptical approach, great. And the assumption is "the tech is broken, the price will fall because of it, won't buy".
But, if we take on step further and continue our experiment, lets compare the actual facts with the assumption.
And what we see? Two cryptocurrencies (Bitcoin Gold and Verge) which were successfully attacked this week, didn't lose in market cap.
How comes? What conclusion should we take from this assumption/fact, if continue being scientific? Do we need a new assumption?
> there are certainly organizations with the resources to do it, e.g. intelligence agencies, organized crime
Nation states. Don't forget the large number of sanctioned regimes who would (a) have the resources to execute such an attack and (b) find great profit in doing so.
Plenty of legit and rouge nations (or departments within them) who would find that tempting I think. Currency politics and all aside that is a tempting way to make money.
> If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates
"Renting 51%" (of any global market) and "at market rates" are mutually exclusive.
> There is no equilibrium point for transaction fees where this attack becomes uneconomical.
The counterforce against doublespending is not transaction fee but cost of ownership of mining equipment.
Some other arguments against your conclusion:
- As mentioned nearby, for big transactions you want to wait longer than 6 confirmations.
- Also, as recipient you might want to distribute huge payments into smaller ones distributed over time.
- It's in the interest of mining capacity lenders to make sure you don't get 51% because it renders their equipment worthless in case you are successful.
- As you correctly stated, low prices will lead to lower hash rates (and higher prices to higher rates). This means actually that bitcoin will be more stable (it's harder to obtain 51%) if prices rise. There's an equilibrium on that side as well! That is, if double spending is what you're worried about.
> If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. There is no equilibrium point for transaction fees where this attack becomes uneconomical. The only defense is that the market for hash capacity is imperfect.
At this point in time the current hashrate of the bitcoin network is 32.500 PH/s, up from 5.000 PH/s a year ago and 1.400 PH/s two years ago. If you rent 51% of the network it's going to be rather obvious that something is happening, that will however not prevent an attack. Let us assume that you can rent capacity because the miners are greedy, what price would you have to pay? Let's assume that you can buy from miners that want to exit the mining business, so they do not care about deprecating the value of their hardware nor the bitcoin value itself.
So the assumptions are that 51% of the available capacity don't care if bitcoin tank and burn as long as they profit enough, and you're able to buy that. A 0.43% difficulty increase daily (average over last 2 years), bitcoin price of 7.600$, a 4MW powerdraw, and electricity prices of $0.08/KWh
Miners controlling 51% would profit north of $1.000.000.000 yearly, and if they just want to be compensated for that one year, you have to pay $1.000.000.000 to rent 51%. That is a lot of money, and at $20.000 high it would be tripple that value.
However, why would 51% of the capacity suddenly exit? Rather they want to be compensated for multiple years of profit, lets say 5 years and it's not unreasonable to expect bitcoin to reach $70.000 in that time. So we're looking at a $50.000.000.000 cost to coordinate the attack. That's expensive, and with that kind of money there are other ways to make them multiply. Who would pay that to ensure destruction of the thing we know as Bitcoin? After all, the success means it's likely that another *coin takes over, where you cannot 51% as easily.
It is far from clear that Bitcoin will likely ever reach $70,000. That implies an approx market cap of $1,200,000,000,000 or more. Would Bitcoin ever be useful enough or generate more value than Google or several Big Energy companies combined to justify and sustain that valuation?
I do believe you are vastly underestimating how difficult an attack on the bitcoin network would be. I seriously doubt anyone other than a handful of state level actors could pull it off, and even then I am not sure. The amount of energy we are talking is tremendous, and gets orders of magnitude larger the more blocks you go backwards in time. The XVG hack only went back 22 blocks, that is mathematically, and most certainly financially and perhaps even physically impossible with bitcoin. The amount of energy and money spent would never, ever make it worth it.
Interesting points. A defense against this type of attack is to use at least the hybrid proof-of-stake design that Ethereum is rolling out in about three months; blocks are proposed by proof of work, but proof of stake periodically adds a layer of "economic finality." Here's a paper: https://arxiv.org/abs/1710.09437
Those are some really great and interesting points. However, I think there is a resource you didn't mention that combats such attacks: time. If I'm a vendor, e.g. I pay cash for bitcoin, then I can tune the amount of time the transaction is held in limbo or escrow based on the vulnerability of the network.
For instance, I can decide not to finalize the transaction until I see a chain with 12 new blocks added after the transaction block. So an attacker has to control 51% for 2 hours to successfully scam me. Or I can make it 24 blocks (4 hours), or whatever.
Not sure this can mitigate the attacks and market forces you discuss, but it might. I see Bitcoin moving toward an intermediary system where you have a "Bitcoin balance" with a "Bitcoin bank" that allows you to make immediate transactions and takes on the risk and time delay of settling these transactions on the blockchain over the course of the next day or two.
> I see Bitcoin moving toward an intermediary system where you have a "Bitcoin balance" with a "Bitcoin bank" that allows you to make immediate transactions and takes on the risk and time delay of settling these transactions on the blockchain over the course of the next day or two.
How would this system differ from an ordinary bank in the system we have now?
I'm a bit ignorant about cryptocurrency, but doesn't "I pay cash for bitcoin" sort of prove the parent's point that it's not "the currency of the future?"
I think one of the other issues is that each transaction that they are double spending can be worth so much. If each transaction was maxed out at say $100, the incentive to double spend the transaction becomes smaller. Obviously that changes a lot about the costs of mining and transactions, just saying the bigger a single transaction or value in a single address, the larger the likelihood of an attack.
We see the same things with cash, they only run the "counterfeit" pen on $20 or larger.
Just wondering if there is some kind of crypto currency where the transactions had a max of some kind. Would the difficulty be able to be much smaller and blocks every minute (since there would be so many more to transact)? This isn't well formed, just off the top.....
This would probably lead to a huge increase in transactions, and PoW mining as of now will not to be able to process tranactions fast enough and the coin ends up clogged and unusable.
When Bitcoin was hitting $20,000, which I never thought they'd do, I mostly concluded I'd missed any investment opportunity.
I plausibly could have invested a few hundred or thousand in Bitcoin was in the low hundreds, and if I hodl'd to the moon realized a hundredfold gain, which would have been nice.
But once you're at the moon, then what?
The new price predictions are things like "If Bitcoin replaces gold it could be worth $135,000/BTC.". Which is a lot, and a little far fetched, but also only 6x from the last peak.
I'm not interested in a risky investment which takes years to come to fruition and only yields 6x. It's too risk for a safe investment and too low-yield for a risky investment. Boat missed.
If the scenario you laid out actually pans out it would be very good for Bitcoin, because there is a lot of free energy in the world but it is highly distributed.
The dominant form of mining would be utility companies and individuals redirecting excess electricity generated from their renewable electric power generators, during off-peak hours and spikes in generation, to mining, and the constituents would be both numerous and globally distributed, owing to the wide geography areas across which renewable energy resources are found.
> If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. There is no equilibrium point for transaction fees where this attack becomes uneconomical. The only defense is that the market for hash capacity is imperfect.
You're killing your goose with the golden eggs. That is, if a currencies remains in use.
>Attacking a huge network like bitcoin would be an audacious and expensive act, but there are certainly organizations with the resources to do it, e.g. intelligence agencies, organized
How do you propose they would go about doing this? Would they jam up the whole worlds chip production to source the ASICs at above market rates? How could this be profitable?
Perhaps by taking over existing mining operations, but then you’d need to somehow perform the attack before you’re detected.
Your analysis isn't really a good one, since Proof of Work consensus through mining, isn't really used anymore by the new coins.
It seems you're too focused on a specific decentralized consensus solution, while there are already much better ones out there, e.g. Iota with a tangle, skycoin with a web of trust or Elastos that are immune to 51% attacks.
It will never go to absolute zero as long as there are still people who at the very least see it as a joke. "Remember when BTC was $20000? I just bought 50000 of them, I would have been a billionair! Haha!"
Also tell people in Venezuela how their Bolivar is not going to zero, because they have to pay their taxes with it.
What do you mean, “underbidding”, e.g. “underbidding attack”? I don’t understand this term in the context of your hypotheses which assumes a perfectly efficient market for hashpower
Suppose that it takes $50 of energy to find a hash at current difficulty. Transaction fees are at $50 (in BTC). I can offer miners $51 for their hash power, but they might be suspicious. So the other thing I can do is confirm transactions for $49 in fees, which I'm calling underbidding. This will drive miners out of the market.
blockchains are not immutable, the software that blockchain servers run can be updated to any chain with the most social consensus, if an attack was that bad it can be fixed with a few git pushes and pulls, the price might suffer but even that is not a guarantee, price movements have a greater influence than fundamental value in crypto
can you explain this in better words: "then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack."
I think what jhpriestly is saying is: As the market gets efficient, the price of renting mining capacity will approach the profits earned from transaction fees. So renting mining capacity will almost pay for itself, i.e. is almost free. But then you might as well rent a lot of it, like 51%, because it's allowing you to attack the chain almost for free.
>If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack.
Lenin was right: "When it comes time to hang the capitalists, they will vie with each other for the rope contract."[0]
The numbers I've seen quoted for a double spend attach on Bitcoin Cash (assuming guaranteed block space) are that it would cost about 50K to double spend on a 0-conf transaction. So really, you can confidently accept 0-conf for <1K reasonably. More that that you can accept 1-conf or more which can take a minute or two. BTC rejects 0-conf transactions, but they are already in use around the world and are successful as far as I know.
Except you profit from mined blocks. In theory you should be able do do a 51% attack for a profit even without double spending as you capture high value transactions over a longer timespan than normal. Aka in 10 ten blocks you get the same number of high value transactions as would normally occur over 20 blocks. Where you would end up with the same 10 blocks without a 51% attack but someone else would also mine 10 blocks and capture some of those high value transaction fees.
If you wait long enough, say, for 144 confirmations (or 24 hours, whichever is greater) then a double spend may as well be the least of your worries, for bitcoin, or any of the top mined crypto-currencies.
These double-spend attacks are only successful if the receiving party doesn't wait long enough.
Also, could't find any sources from exchanges if they were actually successful? The article didn't mention which exchanges.
Quote:
"Blockchain data indicates that the attacker successfully reversed transactions as far back as 22 blocks, leading developers to advise raising confirmation requirements to 50 blocks."
So as long as exchanges wait 50 blocks before crediting, they should be all right.
Oddly enough, one of the selling points of Bitcoin Gold (a hard fork of Bitcoin) was its use of Equihash instead of SHA-256. The idea was that a memory-hard proof-of-work function would inoculate Bitcoin Gold from miner centralization.
The problem with mining centralization is that sufficiently powerful miners can attack the network by rewriting blocks. This opens the door to double spending.
This was exactly the attack the article described.
It appears that Bitcoin Gold's decision to use Equihash led to this mess. The algorithm is used by several other coins. Hardware optimized for this algorithm can therefore be used with equal ease to mine on a network or attack it.
Bitcoin Cash may be headed for a similar fate. It retains SHA-256, but is a minority chain in terms of hash power. A powerful Bitcoin miner deciding to perform double spends on Bitcoin Cash would have everything needed to do repeat the Bitcoin Gold attack.
It's possible that any altcoin that becomes sufficiently valuable will suffer similar attacks to the ones that have now taken place on Verge and Bitcoin Gold.
The problem I think is that there are 25 cryptocurrencies bigger than it. Particularly with its form of mining, it's trivially easy for say a big player in the 10th largest currency to shift their mining power to a smaller one like Bitcoin Gold, overpowering everything else.
Normally the non-51% attack argument is that anyone who invests enough in 51% of the infrastructure and has sufficient coins to profit from double-spending, is very unlikely to do so because it would render the coins and mining equipment worthless or at least worth less than the investment had cost.
That'd be true for bitcoin, but not for a GPU-mined 26th largest cryptocurrency. You can completely destroy it, cash out and use your equipment elsewhere on coins in which people still have faith.
> It's possible that any altcoin that becomes sufficiently valuable will suffer similar attacks to the ones that have now taken place on Verge and Bitcoin Gold.
The trust in these systems seems to be based on proving a negative.
The lack of an attack is neither a proof of robustness nor proof that one or more zero days aren’t already known. We can only “know” it’s safe when the temptation to use an exploit is far too high to resist.
I think there are a lot of people who imagine “an attack” as a ready-aim-fire affair. There’s a juicy target, someone concocts a plan and then uses it.
But as you illustrate, maybe there is already a plan and someone is waiting for the target to get juicy enough. Aim, ready, fire.
I guess the conclusion is that if you're attempting to create a new PoW cryptocurrency you better make sure to tweak your PoW algorithm enough to make sure that existing miners cannot easily convert their special purpose mining rigs to sink you for fun and/or profit.
All those arguments do make sense, but only if the underlying cryptocurrency is actually big enough. That it has enough hashpower (in whatever algorithm) - to be secure. Bitcoin Gold simply was too small.
Sounds like it isn't very wise to come up with new cryptocurrencies as long as the mining network is unregulated and the double spending problem isn't solved...
All of the major Bitcoin miners are very pro Bitcoin cash. They basically created Bitcoin cash. They would be more likely to attack Bitcoin Core, if anything.
I would also point out that Bitcoin cash is the 4th largest crypto currency in the world, by market cap. If IT is in danger.... Well I fear for everyone else even more.
So this would require an attacker to pay into the exchange with BTCg, have the deposit clear and approve for trading, trade it for another currency, and have that trade settle and be clear for withdrawal, and then process the withdrawal, all in under 4 hours. After which point the attacking miner surfaces a longer chain they had been keeping which doesn’t include the original BTCg deposit.
Alternatively, if the exchange isn’t smart enough to pay short-term withdrawals with inputs that link back to the recent deposit, an attacker could just deposit and then withdraw with no trade and the withdraw transaction is valid even if the deposit is double-spent.
An exchange that lets a trader deposit millions in one crypto-asset, exchange it for another, and clear a withdrawl in 4 hours... got what was coming to them? Where’s the KYC process for a million-dollar deposit?
There’s a reason new deposits in a brokerage account take a few days to settle / be cleared for trading. And again after selling before funds can be withdrawn. And that’s a currency where most transactions can be reversed!
It would be one thing to allow 10 block settlement for Bitcoin main-net. It’s another to allow it with a thinly mined alt-coin.
Exchanges need to be built with the fluid nature of blockchain conflict resolution in mind.
You can estimate the cost of double-spend attacks on each chain at any time, calculate your potential exposure, track where the related funds are now in your system, and mitigate your exposure by delaying the outflow of funds that have outsize exposure to double-spend attack potential.
In the simple case, you might allow withdrawal of a single $10 deposit after 2 confirmations but enforce a long 1000-confirmation waiting period on a million-dollar deposit, in order to increase the cost of executing a double-spend against your exchange beyond the point which you estimate it becomes infeasible.
It's a little trickier in practice because someone could split their million-dollar deposit into 1000 thousand-dollar deposits from separate addresses into separate accounts. But you can still track your exposure in aggregate, and you should design a system to hold all impacted funds as long as is necessary to make a double-spend attack infeasible.
You can be upfront with your clients about what's happening and why their withdrawals are sometimes delayed: it would increase confidence in the safety of honest customers' deposits while discouraging thieves from targeting you.
>But you can still track your exposure in aggregate, and you should design a system to hold all impacted funds as long as is necessary to make a double-spend attack infeasible.
also, you can monitor the value of transactions in the last few blocks. 500% spike in transaction value in the last 2 blocks? better add a few more blocks to the confirmation requirement, or require withholding on those deposits.
You're hitting the nail on the head on this one. Couldn't have said it myself.
Majority of current exchanges are playing it absolutely fast-and dangerous. It's no surprise with new exchanges popping up like mushrooms.
I'd bet that the top exchanges didn't lose anything on this. I'd actually wager this didn't happen to an exchange, but some other type of site, like a BTG Betting site or something.
Many people use exchanges for arbitrage. Exchanges benefit from arbitrage since they take a fee out of every trade and because they want their prices to be close to the international price of the asset.
This trade would look exactly the same as an arbitrage move.
I still maintain that letting the assets come in and leave on a different blockchain within 24 hours is akin to a “RTFM” level mistake.
If exchanges are enticing arbitrage through insanely quick setttlement and clearance times on the order of 2 hours after closing a position, they are just playing with fire.
If there wasn’t an actual trade, just transfering in and out, not chaining the transactions is similarly RTFM.
If the facts are as I understand them, I think the exchange bears a significant portion of the blame.
It’s like the story a couple weeks ago where Deutche Bank accidentally approved a wire transfer for $35 billion dollars.
Bitcoin gold was a fork to try and decentralize mining. It changed to a proof of work that is supposed to be ASIC resistant. It looks like the typical situation is mining by GPU for equihash (BTG PoW).
BTG hashrate is at ~30MH/s at the moment, where Zcash's hashrate is at ~486MH/s.
I don't have the numbers off hand, but it'd be interesting to see how many GPUs you'd need to pull of a double spend against BTG and if any of the other equihash coins saw a drop off during the attack.
It'd be really interesting if it wasn't a rental attack, but an invested miner just switching over to BTG to achieve the hack.
They reversed 22 blocks, the recommendation is to increase the # of confirmations to rely upon to 50. If you are trying to react to 51% attack doubling the number of confirmations only doubles the cost of attack, and the attacker likely just doubled the number of BTG they have. If they can pay the electricity/rental cost for the attack they have enough BTG to execute the attack in a cost effective manner again.
You can rent hashing power on Nicehash, which currently has ~77MSol/s available for rent. I'm not 100% familiar with how the auction process works, but it looks like I could purchase 26MSol/s via a fixed contract for 1 hour for ~1BTC.
Am I misunderstanding something here, or can I maintain a 51% attack right now for ~$8k an hour. This can't be right.
It is risky, but it is right, that's exactly why took a while to happen. A relatively small botnet can overtake many smaller coins in hash power in no time, that's the hypothesis where I'd put the money.
It should come lower than that...rental price seems to be around 0.5 BTC/MSol/day, so the price for one hour would be 0.5 * 26 / 24 = 0.54 BTC, roughly $4k
I was curious about the cost as well, so I ran some rough numbers.
417.5 BTC/GH/day for equihash if you're renting from nicehash [1].
Block interval 10 minutes [2]. 144 blocks per day target yields 0.0869 BTC/block, so cost of the 22 block reversal was ~1.91 BTC, or roughly $15k.
I'm curious if this was done as one large deposit, or many smaller deposits. I've imagined a system where block confirmations required are based on a computed cost of attack done like I did above, which would be pretty effective for very large single transaction double spends. A bit trickier to handle multiple deposits spread across multiple user accounts.
As the space matures I'd love to see a company that offers double spend insurance for a given tx.
For example changes could wait for 10 minutes worth of blocks then request a quote for double spend insurance. The company evaluates the probability of a double spend and maybe even has a couple standing contracts with rentable hashing power to be able to target smaller PoW chains and prevent any double spend attack.
There are lots of interesting and cool problems to be solved in evaluating the safety of a given tx. Unfortunately I don't know if the space is mature enough that exchanges would actually use the service.
> If the exchange is aware of the attack, they may also freeze his account, so that all the funds will be locked inside the Exchange. A failed 21 block attack performed with a 10,000 BTG deposit where the Exchange freezes the account in time will result in a 10,262.5 BTG loss for the attacker. (From link.)
That sounds problematic. If I deposited coins and the exchange determined I was attacking them (how does that work beforehand?) to confiscate my money I'd be pretty miffed.
Not only that, but also an attacker can wait until the money is "safe" outside the exchange before revealing the attack. If the attacker really has more than half of the hash rate, there's no time limit; the malicious chain will always be longer than the innocent one.
Except Bitmain has announced and will be shipping to preorders the first Equihash ASIC (Antminer z9) in July... only 3000 z9's would be needed to equal 30 Megahash, which would be $6M at the z9's $2k price tag. Bitmain obviously has been mining themselves with the z9's for a while, so I would bet that they noticed this and jumped on it before shipping their "lightly used" units out.
I run around 630 sol/s per 1080ti GPUs, each costed me around 950$. You'd also need to add the electricity in there, I think the challenge is to control an infrastructure being able to do over 15 MH/s as opposed to having the capital.
Not every distributed consensus algorithm is happy with 51%. If you increased the minimum to 60% you’d increase the number of machines the attacker requires by 50%.
If 100 machines play fair, >50% requires 101 evil machines, but >60% requires 151 evil machines.
I think you're misunderstanding the meaning behind a 51% attack?
An honest network participant will accept the chain with the largest accumulated proof of work. This is necessary to resolve forks of the chain, which are a natural occurrence.
A 51% attack means that the attacker can create a chain with more work than the rest of the network.
The idea that you can say "we require 60%" makes no sense by itself - you have to say what you actually mean in the context of a competitive and adversarial distributed proof of work blockchain network...
Maybe you have some ideas how to avoid history-rewriting attacks, in which case you should write a white-paper and launch your own sh1tcoin or ICO (only half joking).
Crypto currencies are worthless unless they have an enormous amount of hashing power behind them.
We could really do with a webpage with a list of crypto currencies, the hashing power currently behind them, and how much it would cost somebody to take over 50% of the network.
So, that's an interesting pair of ideas, in that it gets me thinking that any Bitcoin-style cryptocurrency might ultimately be doomed by its own design.
Shooting from the hip:
They've go this 51% vulnerability that is well known and hypothetically cannot be truly closed. Instead, we rely on the idea that mounting such an attack would be "too expensive". But at the same time, the cost/benefit of mounting such an attack is fairly easy to estimate using public data - all you really need to know is the cost to get to 51% and stay there for a given amount of time, which you can infer by monitoring mining activity, and the current price of the currency you'd want to attack. And you have to assume that whenever the cost of mounting such an attack dips below the benefit, such a thing _will_ happen.
So then, I think that implies that the only other feature you'd need to throw into the mix to ensure a cryptocurrency is ultimately doomed is to make the rate at which new coin can be mined asymptotically approach zero. Such a feature would mean that, in the long term, miners' revenue would ultimately be dominated by transaction fees, which, this being a supremely commodity service, market forces will presumably tend to keep relatively low. That would, in turn, limit the number of miners the economy can support, which would serve to limit the cost of mounting a 51% attack.
Meanwhile, what with a money supply that can't grow being inherently deflationary, the benefit of mounting such an attack would be constantly growing, for as long as said cryptocurrency remains in use.
On the other hand, there will be people who have a vested interest in preventing such attacks. If you own a lot of BTC, a successful attack can drastically lower the value of your assets, so it makes sense to deploy some of that capital to secure the network. And of course this goes even more so for business in the crypto space that rely on BTC remaining secure.
One example of this sort of behavior is in mining. We tend to think of miners as being selfish to a fault, and to some degree, that's true. But sometimes miners have the opportunity to mine empty blocks (a form of attack), and refrain from doing so, because it would harm the ecosystem as a whole and jeopardize their long-term profitability.
> They've go this 51% vulnerability that is well known and hypothetically cannot be truly closed. Instead, we rely on the idea that mounting such an attack would be "too expensive". But at the same time, the cost/benefit of mounting such an attack is fairly easy to estimate using public data - all you really need to know is the cost to get to 51% and stay there for a given amount of time, which you can infer by monitoring mining activity, and the current price of the currency you'd want to attack. And you have to assume that whenever the cost of mounting such an attack dips below the benefit, such a thing _will_ happen.
Or, to turn this around, if X is the amount of money needed to sustain a 51% attack for 1 block, then you have to wait for 1 confirmation for every X amount of coins received.
> all you really need to know is the cost to get to 51% and stay there for a given amount of time
That's actually, if anything, underestimating the likelihood of a 51% attack. It seems that the more likely path to that situation is collusion between segments of the existing mining community. For such a cartel, the "cost" is zero, it's just a matter of trust.
Interesting point. The cryptocurrency energy consumption problem will never be solved, since if it is, it will be economically feasible to attack. So cryptocurrency adoption in the mainstream will require massive electricity consumption.
You might even say it will ultimately require at least 51% of worldwide electricity production, to ensure no actor (including nation-states) can suddenly on-line additional capacity to seize control.
And then if that's true, one might dream of a power plant arms race, where two competing nations build additional power plants as fast as possible to prevent the other from gaining enough electrical capacity to attack the network...
Not necessarily, non-hashing consensus seems to be where most blockchain projects are going. So these would require a stake of assets or similar, instead of wasting computing cycles.
> Crypto currencies are worthless unless they have an enormous amount of hashing power behind them.
Why would you think an enormous amount of hashing power helps? Even with Bitcoin, the actual marginal cost of a 51% attack is quite low. The difficulty is the capital expense of actually connecting to a couple GW of power and finding enough rentable ASICs.
I think this is fundamental. In a proof-of-work scheme, if the mining rewards in whatever time frame is considered a full confirmation are less than the amount of gain available using a 51% attack, then a 51% attack is economical.
ASIC mining during boom time helps mitigate the issue a bit, since the ASICs are worth more if the currency isn’t devalued by 51% attacks, but even Bitcoin will be vulnerable of older, less efficient ASICs start flooding the market, which seems inevitable if the price of BTC stagnates enough.
You're looking at this as a static _binary_ model, while actually, the 51% attack is heavily dynamic. The profitability of the attack heavily depends on factors that are absolutely dynamic and not publicly available:
- The exchange/betting website not catching onto your scheme
- The volume of the coin being enough to mass sell it and not majorly affect the price
- How fast the community can act in unison against you
This point should be made more often. It also supports the ethereum and EOS use case, a general purpose computing blockchain and distributed vm, it allows smaller utility coins to be backed by the same size network as the eth token and ecosystem, something they would never do on their own. The token's security is proportional to it's network size. Fragmentation of the already small subset of people capable of running blockchain nodes that actually do run nodes is great for innovation but bad for network security and confidence.
Whilst that's an interesting page, it lacks the most important part of my request: "and how much it would cost somebody to take over 50% of the network"
That graph doesn't tell me how much it costs to launch a 50% attack. Maybe I'm just lazy, but I want a table with the name of the crypto currency in one column, and the cost in USD to launch an attack in another column.
> Ordinarily, the blockchain would resolve this by including only the first transaction in the block, but the attacker was able to reverse transactions since they had majority control of the network.
Not a very precise explanation, just checking, what exactly does this mean?
I always thought the way a 51% double-spend attack worked was by broadcasting a transaction for human consumption (eg, I'll give you Y coins for Z dollars), then secretly mining your own blockchain for the N successive chains following it. After the humans have completed the human-level transactions after waiting the standard N successive blocks with no transaction conflicts, you release your own secret blockchain fork back into the public with data that contradicts the current popular one and instruct your network to ignore the competing publicly-acceptable chain. The new private one wins so long as it is equally as long as the public one which it should be because you have more compute power than the rest of the public.
You are correct. The longest chain is accepted as the correct one, so if you have 51% hashpower and secretly mine while maintaining majority hashpower the whole time, your chain will be longer and you can publish it at any time, and effectively rewrite recent history.
Has there been other approaches at solving the double spend problem? I know ByteCoin (which is from scratch and uses 'CryptoNote' (or CryptoNight?) and respectively it's forks which includes Monero are designed a little different and I think they boast having solved the double spend problem too but I am not sure if they just do the same decisions as Bitcoin concerning updating the Blockchain?
>Obtaining this much hashpower is incredibly expensive
Is it? Presumably you only need to maintain it for a short amount of time. Sounds like something one could smash with google cloud preemptible GPUs or similar. Especially since such an attacker is presumably not above using a stolen CC or three.
Well, under the standard assumptions of blockchains like Bitcoin, yes it's incredibly expensive to obtain enough hashing power to do a 51% attack. There's a lot of nuance to it though.
In this case, Bitcoin Gold chose to have an "ASIC Resistant" algorithm, Equihash, and likely was only protected by GPUs mining the network. Bitmain has recently released an ASIC for Equihash that is substantially cheaper and more energy efficient than using GPUs, meaning that some pool which was able to buy a large number of the ASICs would have had a pretty easy time gaining enough hashrate to launch a 51% attack.
This is one of the big risks of attempting ASIC resistance. In the event that someone produces an ASIC, your coin is a complete sitting duck.
but hashrate on BTG has been falling consistently since inception, it doesnt look like someone invested in a load of ASIC devices to perform this attack, more like they kept the same operation and watched its % grow as other miners left the chain for a more profitable coin.
Under normal free market assumptions, the cost of double spending is simply the expected reward of each block multiplied by the number of blocks that need to be mined. For bitcoin, where the reward for finding a block is currently ~$100,000, that means you should be able to double spend by mining 6 blocks at a cost of less than a million dollars.
The question is: are bitcoin miners subject to the usual free market assumptions? If someone offered you double the market rate to hire a bitcoin miner for an hour would you accept that offer or not?
As a miner, you are likely not going to accept because your entire revenue stream comes from the cryptocurrency being stable. If someone uses your hashrate to launch an attack, it's a direct threat to your future revenue especially if the attack discredits the security of the token you mine.
In this case though, Bitcoin Gold shares a hashing algorithm (Equihash) with many other blockchains. It is possible that some Zcash mining farm decided to attack Bitcoin Gold because they felt the revenue from attacking Bitcoin Gold was greater than the potential damage to their income, which is primarily Zcash based.
I'm just grasping at straws here, but generally speaking it's a bad idea to share hashing algorithms with another cryptocurrency, especially if that cryptocurrency is substantially more valuable (in terms of monthly block reward) than your own.
And, all GPU-mined coins are essentially sharing one algorithm, because the hardware can jump between them easily. So all GPU based coins share this vulnerability, where the tiny GPU mined coins could easily be attacked or wiped out by a large Ethereum farm at any point.
The math doesn't work that way because honest miners amortize the capital cost of their specialized equipment over long periods of time. An attacker undermines the network's value and so must operate on shorter timescales. The capital costs of an attack could perhaps be partially recovered via resale, but getting order ~50% of the existing network's specialized hardware might prove prohibitively difficult even given sufficient capital.
[edit] And renting existing miners' equipment would be difficult because you would have to: figure out who they are, convince them to point their equipment to your pool, run your own dark pool servers to handle data from tons of miners, run infrastructure to make payouts to these miners, hope that exchanges don't have reorg procedures that prevent you from accomplishing your double spend, hope your chain reorg doesn't panic the market for long enough for you to double spend exchange to another coin that won't be tanking (due to the reorg).
The article says they reversed some transactions up to 22 blocks later, which is 220 minutes, or 3 hours 40 minutes. So they would only need 51% for that time, but they didn't just add 51% of hashing power or that would be noticeable on the charts. From the looks of it [0] the hashrate has been falling slowly since BTG was created, so the miner may have just become the one with 51% by virtue of keeping mining with the same setup and then watching others stop mining, increasing his share of the network with no extra effort on their behalf. I would assume this miner also realises that BTG is dead/dying and is trying to extract as much as possible from it before they move their equipment to a new chain. If this attack method proves sufficiently profitable perhaps the miner will look at dying chains he can easily overpower instead of trying to mine a more profitable chain with a higher hash rate.
I'm just waiting for the day when it's revealed that ~70% of miners on a top 5 cryptocurrency are compromised by a specialized worm or malware. We'll probably only find out after the double spending is discovered but this type of outcome seems almost inevitable. The people writing this type of software are definitely financially motivated, but I can easily imagine such a person throwing away millions of dollars in 0-days just to fulfill such a hackneyed cyberpunk cliche.
Also, we know that things like stuxnet exist. Imagine something even a fraction as crazy as that targeting mining nodes. It's going to happen eventually.
>We'll probably only find out after the double spending is discovered but this type of outcome seems almost inevitable
attacks like this is harder to pull off than you think. miners constantly submit "shares" to the pool, which are then validated to credit them a share in the block reward[1]. depending on the difficulty threshold of the shares are, these could be submitted a few times a minute to every few minutes. if you hacked and gained control of the miners, sure you can redirect all the hashing power to you, but this will be detected quite quickly. with thousands of dollars on the line per minute, you can bet that everybody has monitoring in place to detect a dip in shares submission. also keep in mind that you have to keep this going for about 1 hour (for your initial transaction to confirm) without people noticing. moreover, the core problem stealing hash power to do a 50% attack is that block times will skyrocket on the main chain, which will let everybody (and not just the pool operator) know that something's up. plus after this attack, you can bet that exchanges will start requiring additional confirmations for large deposits, and instituting withholding times for cryptocurrency withdraws.
[1] I don't know whether large mining operators do this. Strictly speaking, they don't but I'd imagine they do this because it lets them know that their rigs are up and producing valid hashes (ie. not malfunctioning). It's almost certain that small mining operators use pools.
You're right that there are a few canaries in the coal mine, but there are a lot of creative options if you have the ability to execute arbitrary code on a mining node botnet, assuredly some of which are yet to be discovered (as far as we know). Consider as well the many financial opportunities available to someone who may have an interest in sabotaging or disrupting some kind of mining activity, perhaps in subtle ways that are not usually noticed.
Readit News
I ended up not investing, because of the possibility of a double-spend attack. I think that cryptocurrency enthusiasts are seriously underestimating the importance of double-spending attacks to the economics of bitcoin and other cryptocurrencies.
A few points that convinced me not to put my money into this system:
If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. There is no equilibrium point for transaction fees where this attack becomes uneconomical. The only defense is that the market for hash capacity is imperfect.
The market for hash capacity is going to become more efficient over time. ASIC miners will be commoditized, so that hardware investment becomes a much smaller factor in hash cost versus energy. This might be even worse during a bitcoin downturn, because there could be a glut of ASIC miners.
Miners will coordinate with market prices, turning off capacity when the price dips (for example, because someone is underbidding to create a 51% attack). If mining becomes more decentralized, it will be harder for miners to act in their common interest (fending off 51% attacks) and against their immediate interest (selling their hashrate to the highest bidder, or taking it off the market during an underbidding attack).
High transaction volume is not necessarily any help - the more transaction volume, the higher the cost of the attack, but the greater the rewards. The semi-anonymous nature of bitcoin means that one could easily flood the network with double-spend transactions. Attacking a huge network like bitcoin would be an audacious and expensive act, but there are certainly organizations with the resources to do it, e.g. intelligence agencies, organized crime. The massive rewards to such an attack also offset fixed costs such as writing and testing the software to carry out the attack.
2. Rent 51% and mine a fork in secret for a week
3. Wreak havoc
4. Collect money
Only if you make it public. A 51% attack works at a poker table too, but only if the marks don't know the game is rigged.
A successful double spend makes it public, as well as announcing your intentions to get to 51%. If you're quiet and can pull off a successful 51%, you can create the double spend before anyone knows.
So why the pow? Is this stabilizing the actors somehow? It seems like an explicitly managed network would be no less centralized, way more efficient, and way more user friendly.
Large miners don't want to see Bitcoin get attacked because it destroys their income and de-values their incredibly expensive hardware. This is also why miners won't just let you borrow their hashrate for a while - it's a big issue if you use that hashrate to undermine their cash cow.
In 2013, the network forked unexpectedly [0] and the Bitcoin network had 2 chains for about 4 hours. During those 4 hours, it is entirely possible that people sent BTC to exchanges they knew were going to be on the chain that ended up being orphaned.
A conniving team of centralized developers can take this a step further and discover or intentionally plant a consensus bug that causes such a fork and because developers ultimately tell everyone which chain contains the "fix" (in 2013, they commanded that the minority chain was the right one), the developers know which chain will be orphaned and thus which exchange they can exploit.
[0] https://freedom-to-tinker.com/2015/07/28/analyzing-the-2013-...
There are a lot of problems other than double spend with the Bitcoin. Transactions fees rise very quickly because of the block size limit of about 1MB. You can't really rely on 0-confirmation transactions. The saviour lightning network in my opinion is the wrong solution to the scaling problem. It changes fundamentally how bitcoins are exchanged and steers away from the original white paper by Satoshi. Not that this is wrong... it just becomes another project altogether.
As a cartel must outmine the entire Bitcoin network and thus outspend the entire Bitcoin network for as long as it would remain a cartel, we believe it is very unlikely that a cartel could double-spend enough to recover the cost of the attack...
As described above, a 51% cartel attack is unlikely to generate enough reward within the Bitcoin economy to be worthwhile to the attacker. However, this does not rule out the possibility of a 51% attack that aims to destroy the Bitcoin economy in order to achieve utility outside the Bitcoin economy. We call this the Goldfinger attack after the character in film who tries to undermine U.S. currency by ruining its gold backing [15]...
In all of these cases, the attacker must achieve enough utility to justify the substantial cost of an attack. We agree with Becker et al. that it is unlikely that a protest movement could muster the resources to launch a successful attack. And at present it does not appear possible to acquire a short position on Bitcoins that is large enough to justify an attack. (2013)
The Economics of Bitcoin Mining, or Bitcoin in the Presence of Adversaries
Joshua A. Kroll, Ian C. Davey, and Edward W. Felten, Princeton University
https://www.econinfosec.org/archive/weis2013/papers/KrollDav...
But, if we take on step further and continue our experiment, lets compare the actual facts with the assumption.
And what we see? Two cryptocurrencies (Bitcoin Gold and Verge) which were successfully attacked this week, didn't lose in market cap.
How comes? What conclusion should we take from this assumption/fact, if continue being scientific? Do we need a new assumption?
A mid-term (3-7 years) of irrational behaviour in a market in not unusual. Some will benefit from it.
It has nothing to do with Bitcoin.
Dead Comment
Nation states. Don't forget the large number of sanctioned regimes who would (a) have the resources to execute such an attack and (b) find great profit in doing so.
"Renting 51%" (of any global market) and "at market rates" are mutually exclusive.
> There is no equilibrium point for transaction fees where this attack becomes uneconomical.
The counterforce against doublespending is not transaction fee but cost of ownership of mining equipment.
Some other arguments against your conclusion:
- As mentioned nearby, for big transactions you want to wait longer than 6 confirmations.
- Also, as recipient you might want to distribute huge payments into smaller ones distributed over time.
- It's in the interest of mining capacity lenders to make sure you don't get 51% because it renders their equipment worthless in case you are successful.
- As you correctly stated, low prices will lead to lower hash rates (and higher prices to higher rates). This means actually that bitcoin will be more stable (it's harder to obtain 51%) if prices rise. There's an equilibrium on that side as well! That is, if double spending is what you're worried about.
At this point in time the current hashrate of the bitcoin network is 32.500 PH/s, up from 5.000 PH/s a year ago and 1.400 PH/s two years ago. If you rent 51% of the network it's going to be rather obvious that something is happening, that will however not prevent an attack. Let us assume that you can rent capacity because the miners are greedy, what price would you have to pay? Let's assume that you can buy from miners that want to exit the mining business, so they do not care about deprecating the value of their hardware nor the bitcoin value itself.
So the assumptions are that 51% of the available capacity don't care if bitcoin tank and burn as long as they profit enough, and you're able to buy that. A 0.43% difficulty increase daily (average over last 2 years), bitcoin price of 7.600$, a 4MW powerdraw, and electricity prices of $0.08/KWh
Miners controlling 51% would profit north of $1.000.000.000 yearly, and if they just want to be compensated for that one year, you have to pay $1.000.000.000 to rent 51%. That is a lot of money, and at $20.000 high it would be tripple that value.
However, why would 51% of the capacity suddenly exit? Rather they want to be compensated for multiple years of profit, lets say 5 years and it's not unreasonable to expect bitcoin to reach $70.000 in that time. So we're looking at a $50.000.000.000 cost to coordinate the attack. That's expensive, and with that kind of money there are other ways to make them multiply. Who would pay that to ensure destruction of the thing we know as Bitcoin? After all, the success means it's likely that another *coin takes over, where you cannot 51% as easily.
For instance, I can decide not to finalize the transaction until I see a chain with 12 new blocks added after the transaction block. So an attacker has to control 51% for 2 hours to successfully scam me. Or I can make it 24 blocks (4 hours), or whatever.
Not sure this can mitigate the attacks and market forces you discuss, but it might. I see Bitcoin moving toward an intermediary system where you have a "Bitcoin balance" with a "Bitcoin bank" that allows you to make immediate transactions and takes on the risk and time delay of settling these transactions on the blockchain over the course of the next day or two.
How would this system differ from an ordinary bank in the system we have now?
Deleted Comment
Just wondering if there is some kind of crypto currency where the transactions had a max of some kind. Would the difficulty be able to be much smaller and blocks every minute (since there would be so many more to transact)? This isn't well formed, just off the top.....
I plausibly could have invested a few hundred or thousand in Bitcoin was in the low hundreds, and if I hodl'd to the moon realized a hundredfold gain, which would have been nice.
But once you're at the moon, then what?
The new price predictions are things like "If Bitcoin replaces gold it could be worth $135,000/BTC.". Which is a lot, and a little far fetched, but also only 6x from the last peak.
I'm not interested in a risky investment which takes years to come to fruition and only yields 6x. It's too risk for a safe investment and too low-yield for a risky investment. Boat missed.
The dominant form of mining would be utility companies and individuals redirecting excess electricity generated from their renewable electric power generators, during off-peak hours and spikes in generation, to mining, and the constituents would be both numerous and globally distributed, owing to the wide geography areas across which renewable energy resources are found.
You're killing your goose with the golden eggs. That is, if a currencies remains in use.
How do you propose they would go about doing this? Would they jam up the whole worlds chip production to source the ASICs at above market rates? How could this be profitable?
Perhaps by taking over existing mining operations, but then you’d need to somehow perform the attack before you’re detected.
Deleted Comment
It seems you're too focused on a specific decentralized consensus solution, while there are already much better ones out there, e.g. Iota with a tangle, skycoin with a web of trust or Elastos that are immune to 51% attacks.
Right now what would minimum amount of power would be necessary? How many homes/neighborhood worth? How many Amazon data centers?
* bitcoin is not mandated as the sole accepted currency for settling tax in any sovereign state, therefore it can go to zero
Also tell people in Venezuela how their Bolivar is not going to zero, because they have to pay their taxes with it.
Someone could rent the local courts for a week, pillage everyone, and leave.
Or just come with a larger army.
Examples like Delegated Proof-of-Stake or "eusocial oligarchy like consensus" systems like Byteball?
Lenin was right: "When it comes time to hang the capitalists, they will vie with each other for the rope contract."[0]
[0] https://quoteinvestigator.com/2018/02/22/rope/
That makes no sense. If there are no confirmations, there is no cost, because nothing happened. This comment is a 0-conf transaction on BTC...
These double-spend attacks are only successful if the receiving party doesn't wait long enough.
Also, could't find any sources from exchanges if they were actually successful? The article didn't mention which exchanges.
Quote:
"Blockchain data indicates that the attacker successfully reversed transactions as far back as 22 blocks, leading developers to advise raising confirmation requirements to 50 blocks."
So as long as exchanges wait 50 blocks before crediting, they should be all right.
The problem with mining centralization is that sufficiently powerful miners can attack the network by rewriting blocks. This opens the door to double spending.
This was exactly the attack the article described.
It appears that Bitcoin Gold's decision to use Equihash led to this mess. The algorithm is used by several other coins. Hardware optimized for this algorithm can therefore be used with equal ease to mine on a network or attack it.
Bitcoin Cash may be headed for a similar fate. It retains SHA-256, but is a minority chain in terms of hash power. A powerful Bitcoin miner deciding to perform double spends on Bitcoin Cash would have everything needed to do repeat the Bitcoin Gold attack.
BTW, a similar attack recently occured on Verge:
https://blog.theabacus.io/the-verge-hack-explained-7942f63a3...
It's possible that any altcoin that becomes sufficiently valuable will suffer similar attacks to the ones that have now taken place on Verge and Bitcoin Gold.
Normally the non-51% attack argument is that anyone who invests enough in 51% of the infrastructure and has sufficient coins to profit from double-spending, is very unlikely to do so because it would render the coins and mining equipment worthless or at least worth less than the investment had cost.
That'd be true for bitcoin, but not for a GPU-mined 26th largest cryptocurrency. You can completely destroy it, cash out and use your equipment elsewhere on coins in which people still have faith.
The trust in these systems seems to be based on proving a negative.
The lack of an attack is neither a proof of robustness nor proof that one or more zero days aren’t already known. We can only “know” it’s safe when the temptation to use an exploit is far too high to resist.
I think there are a lot of people who imagine “an attack” as a ready-aim-fire affair. There’s a juicy target, someone concocts a plan and then uses it.
But as you illustrate, maybe there is already a plan and someone is waiting for the target to get juicy enough. Aim, ready, fire.
I would also point out that Bitcoin cash is the 4th largest crypto currency in the world, by market cap. If IT is in danger.... Well I fear for everyone else even more.
Alternatively, if the exchange isn’t smart enough to pay short-term withdrawals with inputs that link back to the recent deposit, an attacker could just deposit and then withdraw with no trade and the withdraw transaction is valid even if the deposit is double-spent.
An exchange that lets a trader deposit millions in one crypto-asset, exchange it for another, and clear a withdrawl in 4 hours... got what was coming to them? Where’s the KYC process for a million-dollar deposit?
There’s a reason new deposits in a brokerage account take a few days to settle / be cleared for trading. And again after selling before funds can be withdrawn. And that’s a currency where most transactions can be reversed!
It would be one thing to allow 10 block settlement for Bitcoin main-net. It’s another to allow it with a thinly mined alt-coin.
You can estimate the cost of double-spend attacks on each chain at any time, calculate your potential exposure, track where the related funds are now in your system, and mitigate your exposure by delaying the outflow of funds that have outsize exposure to double-spend attack potential.
In the simple case, you might allow withdrawal of a single $10 deposit after 2 confirmations but enforce a long 1000-confirmation waiting period on a million-dollar deposit, in order to increase the cost of executing a double-spend against your exchange beyond the point which you estimate it becomes infeasible.
It's a little trickier in practice because someone could split their million-dollar deposit into 1000 thousand-dollar deposits from separate addresses into separate accounts. But you can still track your exposure in aggregate, and you should design a system to hold all impacted funds as long as is necessary to make a double-spend attack infeasible.
You can be upfront with your clients about what's happening and why their withdrawals are sometimes delayed: it would increase confidence in the safety of honest customers' deposits while discouraging thieves from targeting you.
also, you can monitor the value of transactions in the last few blocks. 500% spike in transaction value in the last 2 blocks? better add a few more blocks to the confirmation requirement, or require withholding on those deposits.
Majority of current exchanges are playing it absolutely fast-and dangerous. It's no surprise with new exchanges popping up like mushrooms.
I'd bet that the top exchanges didn't lose anything on this. I'd actually wager this didn't happen to an exchange, but some other type of site, like a BTG Betting site or something.
This trade would look exactly the same as an arbitrage move.
If exchanges are enticing arbitrage through insanely quick setttlement and clearance times on the order of 2 hours after closing a position, they are just playing with fire.
If there wasn’t an actual trade, just transfering in and out, not chaining the transactions is similarly RTFM.
If the facts are as I understand them, I think the exchange bears a significant portion of the blame.
It’s like the story a couple weeks ago where Deutche Bank accidentally approved a wire transfer for $35 billion dollars.
https://forum.bitcoingold.org/t/double-spend-attack-on-excha...
Bitcoin gold was a fork to try and decentralize mining. It changed to a proof of work that is supposed to be ASIC resistant. It looks like the typical situation is mining by GPU for equihash (BTG PoW).
BTG hashrate is at ~30MH/s at the moment, where Zcash's hashrate is at ~486MH/s.
I don't have the numbers off hand, but it'd be interesting to see how many GPUs you'd need to pull of a double spend against BTG and if any of the other equihash coins saw a drop off during the attack.
It'd be really interesting if it wasn't a rental attack, but an invested miner just switching over to BTG to achieve the hack.
They reversed 22 blocks, the recommendation is to increase the # of confirmations to rely upon to 50. If you are trying to react to 51% attack doubling the number of confirmations only doubles the cost of attack, and the attacker likely just doubled the number of BTG they have. If they can pay the electricity/rental cost for the attack they have enough BTG to execute the attack in a cost effective manner again.
Am I misunderstanding something here, or can I maintain a 51% attack right now for ~$8k an hour. This can't be right.
417.5 BTC/GH/day for equihash if you're renting from nicehash [1]. Block interval 10 minutes [2]. 144 blocks per day target yields 0.0869 BTC/block, so cost of the 22 block reversal was ~1.91 BTC, or roughly $15k.
I'm curious if this was done as one large deposit, or many smaller deposits. I've imagined a system where block confirmations required are based on a computed cost of attack done like I did above, which would be pretty effective for very large single transaction double spends. A bit trickier to handle multiple deposits spread across multiple user accounts.
[1]: https://api.nicehash.com/api?method=simplemultialgo.info
[2]: https://bitcointalk.org/index.php?topic=2284289.0;all
For example changes could wait for 10 minutes worth of blocks then request a quote for double spend insurance. The company evaluates the probability of a double spend and maybe even has a couple standing contracts with rentable hashing power to be able to target smaller PoW chains and prevent any double spend attack.
There are lots of interesting and cool problems to be solved in evaluating the safety of a given tx. Unfortunately I don't know if the space is mature enough that exchanges would actually use the service.
That sounds problematic. If I deposited coins and the exchange determined I was attacking them (how does that work beforehand?) to confiscate my money I'd be pretty miffed.
Deleted Comment
These are the absolute worst. All they're doing is causing the cost of graphics cards to go up.
If 100 machines play fair, >50% requires 101 evil machines, but >60% requires 151 evil machines.
An honest network participant will accept the chain with the largest accumulated proof of work. This is necessary to resolve forks of the chain, which are a natural occurrence.
A 51% attack means that the attacker can create a chain with more work than the rest of the network.
The idea that you can say "we require 60%" makes no sense by itself - you have to say what you actually mean in the context of a competitive and adversarial distributed proof of work blockchain network...
Maybe you have some ideas how to avoid history-rewriting attacks, in which case you should write a white-paper and launch your own sh1tcoin or ICO (only half joking).
We could really do with a webpage with a list of crypto currencies, the hashing power currently behind them, and how much it would cost somebody to take over 50% of the network.
Or does that already exist?
Shooting from the hip:
They've go this 51% vulnerability that is well known and hypothetically cannot be truly closed. Instead, we rely on the idea that mounting such an attack would be "too expensive". But at the same time, the cost/benefit of mounting such an attack is fairly easy to estimate using public data - all you really need to know is the cost to get to 51% and stay there for a given amount of time, which you can infer by monitoring mining activity, and the current price of the currency you'd want to attack. And you have to assume that whenever the cost of mounting such an attack dips below the benefit, such a thing _will_ happen.
So then, I think that implies that the only other feature you'd need to throw into the mix to ensure a cryptocurrency is ultimately doomed is to make the rate at which new coin can be mined asymptotically approach zero. Such a feature would mean that, in the long term, miners' revenue would ultimately be dominated by transaction fees, which, this being a supremely commodity service, market forces will presumably tend to keep relatively low. That would, in turn, limit the number of miners the economy can support, which would serve to limit the cost of mounting a 51% attack.
Meanwhile, what with a money supply that can't grow being inherently deflationary, the benefit of mounting such an attack would be constantly growing, for as long as said cryptocurrency remains in use.
One example of this sort of behavior is in mining. We tend to think of miners as being selfish to a fault, and to some degree, that's true. But sometimes miners have the opportunity to mine empty blocks (a form of attack), and refrain from doing so, because it would harm the ecosystem as a whole and jeopardize their long-term profitability.
Or, to turn this around, if X is the amount of money needed to sustain a 51% attack for 1 block, then you have to wait for 1 confirmation for every X amount of coins received.
That's actually, if anything, underestimating the likelihood of a 51% attack. It seems that the more likely path to that situation is collusion between segments of the existing mining community. For such a cartel, the "cost" is zero, it's just a matter of trust.
And then if that's true, one might dream of a power plant arms race, where two competing nations build additional power plants as fast as possible to prevent the other from gaining enough electrical capacity to attack the network...
Why would you think an enormous amount of hashing power helps? Even with Bitcoin, the actual marginal cost of a 51% attack is quite low. The difficulty is the capital expense of actually connecting to a couple GW of power and finding enough rentable ASICs.
I think this is fundamental. In a proof-of-work scheme, if the mining rewards in whatever time frame is considered a full confirmation are less than the amount of gain available using a 51% attack, then a 51% attack is economical.
ASIC mining during boom time helps mitigate the issue a bit, since the ASICs are worth more if the currency isn’t devalued by 51% attacks, but even Bitcoin will be vulnerable of older, less efficient ASICs start flooding the market, which seems inevitable if the price of BTC stagnates enough.
- The exchange/betting website not catching onto your scheme
- The volume of the coin being enough to mass sell it and not majorly affect the price
- How fast the community can act in unison against you
And maybe they're worthless even then. Time will tell on that.
I think this is only true if you assume that crypto-currencies must be based on proof-of-work algorithms.
What about proof of stake systems?
https://bitinfocharts.com/comparison/bitcoin%20gold-hashrate...
Not a very precise explanation, just checking, what exactly does this mean?
I always thought the way a 51% double-spend attack worked was by broadcasting a transaction for human consumption (eg, I'll give you Y coins for Z dollars), then secretly mining your own blockchain for the N successive chains following it. After the humans have completed the human-level transactions after waiting the standard N successive blocks with no transaction conflicts, you release your own secret blockchain fork back into the public with data that contradicts the current popular one and instruct your network to ignore the competing publicly-acceptable chain. The new private one wins so long as it is equally as long as the public one which it should be because you have more compute power than the rest of the public.
Is that basically what happened here?
Anyone care to weigh in on this?
Is it? Presumably you only need to maintain it for a short amount of time. Sounds like something one could smash with google cloud preemptible GPUs or similar. Especially since such an attacker is presumably not above using a stolen CC or three.
In this case, Bitcoin Gold chose to have an "ASIC Resistant" algorithm, Equihash, and likely was only protected by GPUs mining the network. Bitmain has recently released an ASIC for Equihash that is substantially cheaper and more energy efficient than using GPUs, meaning that some pool which was able to buy a large number of the ASICs would have had a pretty easy time gaining enough hashrate to launch a 51% attack.
This is one of the big risks of attempting ASIC resistance. In the event that someone produces an ASIC, your coin is a complete sitting duck.
The question is: are bitcoin miners subject to the usual free market assumptions? If someone offered you double the market rate to hire a bitcoin miner for an hour would you accept that offer or not?
In this case though, Bitcoin Gold shares a hashing algorithm (Equihash) with many other blockchains. It is possible that some Zcash mining farm decided to attack Bitcoin Gold because they felt the revenue from attacking Bitcoin Gold was greater than the potential damage to their income, which is primarily Zcash based.
I'm just grasping at straws here, but generally speaking it's a bad idea to share hashing algorithms with another cryptocurrency, especially if that cryptocurrency is substantially more valuable (in terms of monthly block reward) than your own.
And, all GPU-mined coins are essentially sharing one algorithm, because the hardware can jump between them easily. So all GPU based coins share this vulnerability, where the tiny GPU mined coins could easily be attacked or wiped out by a large Ethereum farm at any point.
[edit] And renting existing miners' equipment would be difficult because you would have to: figure out who they are, convince them to point their equipment to your pool, run your own dark pool servers to handle data from tons of miners, run infrastructure to make payouts to these miners, hope that exchanges don't have reorg procedures that prevent you from accomplishing your double spend, hope your chain reorg doesn't panic the market for long enough for you to double spend exchange to another coin that won't be tanking (due to the reorg).
[0] https://bitinfocharts.com/comparison/bitcoin%20gold-hashrate...
Also, we know that things like stuxnet exist. Imagine something even a fraction as crazy as that targeting mining nodes. It's going to happen eventually.
attacks like this is harder to pull off than you think. miners constantly submit "shares" to the pool, which are then validated to credit them a share in the block reward[1]. depending on the difficulty threshold of the shares are, these could be submitted a few times a minute to every few minutes. if you hacked and gained control of the miners, sure you can redirect all the hashing power to you, but this will be detected quite quickly. with thousands of dollars on the line per minute, you can bet that everybody has monitoring in place to detect a dip in shares submission. also keep in mind that you have to keep this going for about 1 hour (for your initial transaction to confirm) without people noticing. moreover, the core problem stealing hash power to do a 50% attack is that block times will skyrocket on the main chain, which will let everybody (and not just the pool operator) know that something's up. plus after this attack, you can bet that exchanges will start requiring additional confirmations for large deposits, and instituting withholding times for cryptocurrency withdraws.
[1] I don't know whether large mining operators do this. Strictly speaking, they don't but I'd imagine they do this because it lets them know that their rigs are up and producing valid hashes (ie. not malfunctioning). It's almost certain that small mining operators use pools.