28 ms·

Oh that is beautiful. So if you're playing along at home: the consensus Bitcoin chain is the longest one consistent with the rules of Bitcoin Core, the lineal

by patio11 10y ago

Oh that is beautiful. So if you're playing along at home: the consensus Bitcoin chain is the longest one consistent with the rules of Bitcoin Core, the lineal descendant of the Satoshi client. This consensus chain currently includes 1+ transactions T, which effected this theft. The proposal is for a large number of miners to abandon the consensus chain and start mining a new chain at one transaction prior to T, replaying all real transactions minus T plus a new transaction which would moot T. With enough hashpower, this chain eventually surpasses the current longest chain and at that point all points on network, not just mining cartel, will agree that T never happened. This is supposed to be impossible because it is incentivize-incompatible, as the mining cartel would lose an incredible amount of segniorage to make it happen and it wouldn't be a sure thing. Point #2 is mooted by mining centralization, a ship which has sailed. Point #1 could get mooted by a payment outside the standard understanding of the Bitcoin protocol. Comedy gold!

dwaltrip 10y ago
And yet, despite all of this and more, the chaotic Bitcoin apparatus lumbers doggedly forward, with little sign of stopping. Should be interesting to see where it ends up.
0x0 10y ago
Someone further down the thread also mentioned a very good point in that the attackers could potentially start a bidding war against such a fork. They would have nothing to lose compared to a situation where the heist is reversed.
- patio11 10y ago
  They have a fairly elegant mechanism to do so, too: just chain transactions from T to the addresses the miners send their coinbase transactions to. If miners go forward with the re-write history plan, the bribe gets undelivered, Back to the Future style. It might be one of the first cases of bribery where the briber doesn't have to talk to the bribee to discuss the object of the conspiracy, the price, or how the bribe would be delivered.
  - 0x0 10y ago
    Amazing.
    - patio11 10y ago
      Oh it gets better! The attackers can do things like entangle their stolen Bitcoin in systemically important institutions. Say, send 0.01 BTC to Coinbase. Coinbase is probably not operationally capable of separation that Bad Bitcoin from their Good Bitcoin before it's been comingled with customer funds. At that point, reversing T would also invalidate consequential transactions by Coinbase, which is probably something they can't allow to happen, so they would pay miners to not reverse. Comedy. Gold!
      - 0x0 10y ago
        It sounds like miners could find a replacement revenue stream even if block rewards go to zero and transaction fees are low: Hold the blockchain hostage for reversal and sell out to the highest bidder! (Of course, this would likely drive the value of 1 BTC to exactly $0) (Edit: This is all a demonstration of how the security of the blockchain absolutely depends on mining hashpower being widely decentralized and distributed)
      - topynate 10y ago
        Which is one of the more practical reasons a rollback is very, very unlikely to happen. (It would have been fairly unlikely even in the case of ethereum/theDAO, had not the nature of that exploit effectively locked the funds for a month.)
  - defen 10y ago
    Schelling-point bribery Kinda reminds me of Eliezer's concept of acausal blackmail
- ucho 10y ago
  What happens to people/exchanges that had already accepted stolen cryptocoin after such "justice forks"?
  - greyman 10y ago
    In that new valid blockchain, the transaction where they were given that coin will simply not be there.
    - 0x0 10y ago
      I'm not 100% sure but I think that anyone can re-submit the "undone" transaction to the new blockchain, as long as the source address hasn't already spent its balance on the new chain? Isn't this what's called a "replay"?
lpage 10y ago
Comedy gold indeed. > This is supposed to be impossible because it is incentivize-incompatible Enter the wonderful world of coco values and side payments in game theory. Incentive compatibility and strategyproofness arguments break down when parties are compensated (implicitly or explicitly) out-of-band. That's not always a bad thing - it can lead to more efficient, utility maximizing equilibria. That said, under the status quo, we're trading one flavor of centralization (monetary policy) for another (core committers and mining pools).
- ryporter 10y ago
  Not to mention repeated game effects (of setting a precedent in this case), which make the setting even more difficult to analyze.

by patio11 10y ago

dwaltrip 10y ago

And yet, despite all of this and more, the chaotic Bitcoin apparatus lumbers doggedly forward, with little sign of stopping. Should be interesting to see where it ends up.

0x0 10y ago

Someone further down the thread also mentioned a very good point in that the attackers could potentially start a bidding war against such a fork. They would have nothing to lose compared to a situation where the heist is reversed.

patio11 10y ago
They have a fairly elegant mechanism to do so, too: just chain transactions from T to the addresses the miners send their coinbase transactions to. If miners go forward with the re-write history plan, the bribe gets undelivered, Back to the Future style. It might be one of the first cases of bribery where the briber doesn't have to talk to the bribee to discuss the object of the conspiracy, the price, or how the bribe would be delivered.
- 0x0 10y ago
  Amazing.
  - patio11 10y ago
    Oh it gets better! The attackers can do things like entangle their stolen Bitcoin in systemically important institutions. Say, send 0.01 BTC to Coinbase. Coinbase is probably not operationally capable of separation that Bad Bitcoin from their Good Bitcoin before it's been comingled with customer funds. At that point, reversing T would also invalidate consequential transactions by Coinbase, which is probably something they can't allow to happen, so they would pay miners to not reverse. Comedy. Gold!
    - 0x0 10y ago
      It sounds like miners could find a replacement revenue stream even if block rewards go to zero and transaction fees are low: Hold the blockchain hostage for reversal and sell out to the highest bidder! (Of course, this would likely drive the value of 1 BTC to exactly $0) (Edit: This is all a demonstration of how the security of the blockchain absolutely depends on mining hashpower being widely decentralized and distributed)
    - topynate 10y ago
      Which is one of the more practical reasons a rollback is very, very unlikely to happen. (It would have been fairly unlikely even in the case of ethereum/theDAO, had not the nature of that exploit effectively locked the funds for a month.)
- defen 10y ago
  Schelling-point bribery Kinda reminds me of Eliezer's concept of acausal blackmail
ucho 10y ago
What happens to people/exchanges that had already accepted stolen cryptocoin after such "justice forks"?
- greyman 10y ago
  In that new valid blockchain, the transaction where they were given that coin will simply not be there.
  - 0x0 10y ago
    I'm not 100% sure but I think that anyone can re-submit the "undone" transaction to the new blockchain, as long as the source address hasn't already spent its balance on the new chain? Isn't this what's called a "replay"?

lpage 10y ago

Comedy gold indeed. > This is supposed to be impossible because it is incentivize-incompatible Enter the wonderful world of coco values and side payments in game theory. Incentive compatibility and strategyproofness arguments break down when parties are compensated (implicitly or explicitly) out-of-band. That's not always a bad thing - it can lead to more efficient, utility maximizing equilibria. That said, under the status quo, we're trading one flavor of centralization (monetary policy) for another (core committers and mining pools).

ryporter 10y ago
Not to mention repeated game effects (of setting a precedent in this case), which make the setting even more difficult to analyze.