20 ms·

When Bitcoin was running up to $20,000, I tried to analyze the system and come to a personal conclusion about its equilibrium value, because I didn't want to mi

When Bitcoin was running up to $20,000, I tried to analyze the system and come to a personal conclusion about its equilibrium value, because I didn't want to miss out if it really was the currency of the future. I ended up not investing, because of the possibility of a double-spend attack. I think that cryptocurrency enthusiasts are seriously underestimating the importance of double-spending attacks to the economics of bitcoin and other cryptocurrencies. A few points that convinced me not to put my money into this system: If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. There is no equilibrium point for transaction fees where this attack becomes uneconomical. The only defense is that the market for hash capacity is imperfect. The market for hash capacity is going to become more efficient over time. ASIC miners will be commoditized, so that hardware investment becomes a much smaller factor in hash cost versus energy. This might be even worse during a bitcoin downturn, because there could be a glut of ASIC miners. Miners will coordinate with market prices, turning off capacity when the price dips (for example, because someone is underbidding to create a 51% attack). If mining becomes more decentralized, it will be harder for miners to act in their common interest (fending off 51% attacks) and against their immediate interest (selling their hashrate to the highest bidder, or taking it off the market during an underbidding attack). High transaction volume is not necessarily any help - the more transaction volume, the higher the cost of the attack, but the greater the rewards. The semi-anonymous nature of bitcoin means that one could easily flood the network with double-spend transactions. Attacking a huge network like bitcoin would be an audacious and expensive act, but there are certainly organizations with the resources to do it, e.g. intelligence agencies, organized crime. The massive rewards to such an attack also offset fixed costs such as writing and testing the software to carry out the attack.

Taek 8y ago
In the bitcoin system, miners make literally billions of dollars a year protecting the network. Any successful attack on the bitcoin network is going to massively erode confidence, reduce the price, reduce the usage, and therefore reduce the value of all that single-purpose, bitcoin-only hardware. Large miners don't want to see Bitcoin get attacked because it destroys their income and de-values their incredibly expensive hardware. This is also why miners won't just let you borrow their hashrate for a while - it's a big issue if you use that hashrate to undermine their cash cow.
- onecooldev24 8y ago
  Top miners can short twice as many BTC futures to create one last profitable destruction.
  - mrep 8y ago
    All the while raking in boatloads from the double spending.
  - Taek 8y ago
    If a large miner comes to you asks for a multi billion dollar short position, you should be suspicious.
    - facetube 8y ago
      Yep. totally safe, someone on the internet said we should.
    - Cthulhu_ 8y ago
      That's when you just split your short through a few thousand shell accounts.
- chemmail 8y ago
  Logical and sound arguments. However you underestimate human greed, human stupidity. Not everyone is operating on a Nash Equilibrium.
  - Erlich_Bachman 8y ago
    This will all be valid concerns the day we see a real 51% attack on real Bitcoin. So far Nash seems to be working.
tlarkworthy 8y ago
I think the argument is that by doing a 51% attack you undermine the market value so you never get the rewards. This makes sense, but only for the leading crypto coin. As we see here today, you can 51% attack smaller coins, which should imply an increase in the value of Bitcoin from consolidation.
- tehsauce 8y ago
  The spooky thing that this made me realize, is that if anyone did find a vulnerability in bitcoin (or any cryptocurrency) is that they would have a greater incentive to only slowly leech off the system, because they will be able to siphon out much more over time than if everyone panics over security. The weapon is no good unless it's secret.
  - dragonwriter 8y ago
    Assuming you want to make money directly, sure. If you want to harm a community in which the currency is widely used, the incentives are different.
    - h1d 8y ago
      What kind of incentive does the attacker have to just harm a community of a distributed system?
      - rspeer 8y ago
        How about environmentalism?
        mlvljr 8y ago
        Not this again!!
      - jungturk 8y ago
        An interest in a competing financial system.
drexlspivey 8y ago
What a lot of people in the thread seem to be missing is that when you receive a huge payment you can require a higher amount of confirmations to accept it. High enough that it would make the 51% attack unprofitable.
- onecooldev24 8y ago
  you can split the payment to multiple small amounts.
  - mehrdadn 8y ago
    Confused... I thought the claim was about receiving and not sending?
    - onecooldev24 8y ago
      if multiple accounts send multiple small payments (controlled by the same guy), then the exchange wont wait as long for the confirmations.
      - CydeWeys 8y ago
        The exchange can have thresholds for total volume per given time interval then. Once the total amount of pending transactions breaches a given volume, the transaction period for more transactions within the window goes up.
- cdetrio 8y ago
  Requiring more confirmations decreases the probability that a transaction will be reverted, under the assumption that an attacker has < 49% of the hashpower. If you attempt an attack with 49%, then you have a fair chance of mining, say, 6 blocks before the rest of the network. If you get unlucky then you sacrifice those rewards. But if you mine with 51% then your attack chain is (probabilistically) guaranteed to eventually become the longest chain, so there won't be any loss of revenue.
snarf21 8y ago
I think one of the other issues is that each transaction that they are double spending can be worth so much. If each transaction was maxed out at say $100, the incentive to double spend the transaction becomes smaller. Obviously that changes a lot about the costs of mining and transactions, just saying the bigger a single transaction or value in a single address, the larger the likelihood of an attack. We see the same things with cash, they only run the "counterfeit" pen on $20 or larger. Just wondering if there is some kind of crypto currency where the transactions had a max of some kind. Would the difficulty be able to be much smaller and blocks every minute (since there would be so many more to transact)? This isn't well formed, just off the top.....
- bondi 8y ago
  This would probably lead to a huge increase in transactions, and PoW mining as of now will not to be able to process tranactions fast enough and the coin ends up clogged and unusable.
onecooldev24 8y ago
can you explain this in better words: "then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack."
- bo1024 8y ago
  I think what jhpriestly is saying is: As the market gets efficient, the price of renting mining capacity will approach the profits earned from transaction fees. So renting mining capacity will almost pay for itself, i.e. is almost free. But then you might as well rent a lot of it, like 51%, because it's allowing you to attack the chain almost for free.
  - bb88 8y ago
    I think a good question is, is there a market for renting asic mining gear? Yes, but only if mining the coins via renting is cheaper than buying them outright. If you're a miner, it makes sense to rent out your gear, because you get a guaranteed payment higher than you could make via mining.
    - PeterisP 8y ago
      I've heard an opinion (but I'm not certain) that mined coins are considered less traceable than purchased coins. For any purchase, there's a trail that leads to you through however you paid for it; for mining, the mined coins are totally disconnected from the hardware that mined the block and how you bought it.
  - onecooldev24 8y ago
    Well then the buyer and seller would race to gain 51% of mining power (as its free) which will make it more expensive because of the constant biding war.
bo1024 8y ago
Those are some really great and interesting points. However, I think there is a resource you didn't mention that combats such attacks: time. If I'm a vendor, e.g. I pay cash for bitcoin, then I can tune the amount of time the transaction is held in limbo or escrow based on the vulnerability of the network. For instance, I can decide not to finalize the transaction until I see a chain with 12 new blocks added after the transaction block. So an attacker has to control 51% for 2 hours to successfully scam me. Or I can make it 24 blocks (4 hours), or whatever. Not sure this can mitigate the attacks and market forces you discuss, but it might. I see Bitcoin moving toward an intermediary system where you have a "Bitcoin balance" with a "Bitcoin bank" that allows you to make immediate transactions and takes on the risk and time delay of settling these transactions on the blockchain over the course of the next day or two.
- thaumasiotes 8y ago
  > I see Bitcoin moving toward an intermediary system where you have a "Bitcoin balance" with a "Bitcoin bank" that allows you to make immediate transactions and takes on the risk and time delay of settling these transactions on the blockchain over the course of the next day or two. How would this system differ from an ordinary bank in the system we have now?
  - CydeWeys 8y ago
    It's still trustless, decentralized, yadda yadda.
    - thaumasiotes 8y ago
      In what sense is a system where you hold all your bitcoins in a "bitcoin bank" decentralized or trustless?
      - CydeWeys 8y ago
        The second layer solutions such as Lightning Network don't require you letting other people hold your Bitcoin. They're still decentralized and trustless.
ryanlol 8y ago
>Attacking a huge network like bitcoin would be an audacious and expensive act, but there are certainly organizations with the resources to do it, e.g. intelligence agencies, organized How do you propose they would go about doing this? Would they jam up the whole worlds chip production to source the ASICs at above market rates? How could this be profitable? Perhaps by taking over existing mining operations, but then you’d need to somehow perform the attack before you’re detected.
rjkennedy98 8y ago
The numbers I've seen quoted for a double spend attach on Bitcoin Cash (assuming guaranteed block space) are that it would cost about 50K to double spend on a 0-conf transaction. So really, you can confidently accept 0-conf for <1K reasonably. More that that you can accept 1-conf or more which can take a minute or two. BTC rejects 0-conf transactions, but they are already in use around the world and are successful as far as I know.
- Retric 8y ago
  Except you profit from mined blocks. In theory you should be able do do a 51% attack for a profit even without double spending as you capture high value transactions over a longer timespan than normal. Aka in 10 ten blocks you get the same number of high value transactions as would normally occur over 20 blocks. Where you would end up with the same 10 blocks without a 51% attack but someone else would also mine 10 blocks and capture some of those high value transaction fees.
- garmaine 8y ago
  It costs nothing to double-spend a 0-conf transaction.
- IncRnd 8y ago
  > it would cost about 50K to double spend on a 0-conf transaction That makes no sense. If there are no confirmations, there is no cost, because nothing happened. This comment is a 0-conf transaction on BTC...
split_tender 8y ago
What do you mean, “underbidding”, e.g. “underbidding attack”? I don’t understand this term in the context of your hypotheses which assumes a perfectly efficient market for hashpower
- jhpriestley 8y ago
  Suppose that it takes $50 of energy to find a hash at current difficulty. Transaction fees are at $50 (in BTC). I can offer miners $51 for their hash power, but they might be suspicious. So the other thing I can do is confirm transactions for $49 in fees, which I'm calling underbidding. This will drive miners out of the market.
  - sobani 8y ago
    Wouldn't this mean you ignore the transactions with the higher fees for the other miners to pick up, thereby making mining more profitable for them? How bitcoin transacting work is not that the miners publish their price and someone accepts that price and thus sends the transaction to that miner. How it works is that you publish your transaction with the fee you're willing to pay and if your fee is high enough, it will get included in the next block.
DINKDINK 8y ago
This attacked occurred on BTG a clone of Bitcoin, appropriating the name “Bitcoin” Gold. It has nothing to do with Bitcoin.
- rspeer 8y ago
  REG: Right. You're in. Listen. The only people we hate more than the Romans are the fucking Judean People's Front. P.F.J.: Yeah... JUDITH: Splitters. P.F.J.: Splitters... FRANCIS: And the Judean Popular People's Front. P.F.J.: Yeah. Oh, yeah. Splitters. Splitters... LORETTA: And the People's Front of Judea. P.F.J.: Yeah. Splitters. Splitters... REG: What? LORETTA: The People's Front of Judea. Splitters. REG: We're the People's Front of Judea! LORETTA: Oh. I thought we were the Popular Front. REG: People's Front! C-huh. FRANCIS: Whatever happened to the Popular Front, Reg? REG: He's over there. P.F.J.: Splitter!
  - throwaway37585 8y ago
    Can you please post something relevant to the topic under discussion? There’s enough noise on this thread as it is.
    - Cthulhu_ 8y ago
      You needed a throwaway account just to tell someone off?
      - throwaway37585 8y ago
        I did not make a throwaway account “just to tell someone off”, and you could’ve figured that out in 5 seconds by looking at my comment history.
  - Intermernet 8y ago
    Someone should just fork Bitcoin and call it Splitcoin.
DennisP 8y ago
Interesting points. A defense against this type of attack is to use at least the hybrid proof-of-stake design that Ethereum is rolling out in about three months; blocks are proposed by proof of work, but proof of stake periodically adds a layer of "economic finality." Here's a paper: https://arxiv.org/abs/1710.09437 https://arxiv.org/abs/1710.09437
- IncRnd 8y ago
  Just a cautionary note - you are describing the future in the present tense.
  - DennisP 8y ago
    "In three months"...there's a chance that a problem will be found by the people doing formal verification, but otherwise there don't seem to be any potential roadblocks. Client implementation is very simple, partly because most of the protocol is implemented by a smart contract, which is already done. Ethereum does a hard-fork upgrade a couple times a year.
    - deleted 8y ago
      [deleted]
- cdetrio 8y ago
  51% attacks on the block proposal mechanism could prevent the PoS commitments from ever becoming finalized (i.e. violate liveness), though.
  - DennisP 8y ago
    True, that's a risk it will still share with pure PoW. But at least you don't have to worry about doublespends after your transaction has finalized. Full Casper may have stronger liveness guarantees eventually, I'm not sure. At a minimum it's easier to manually intervene to get the network going again. (You could also do that in PoW by changing the hash algorithm, but you can probably only pull it off once, migrating from ASIC to general purpose hardware.)
dustingetz 8y ago
2nd and 3rd gen blockchain tech is not vulnerable to double-spend attack, i believe. Only the legacy chains (Bitcoin, Litecoin etc) are
djsumdog 8y ago
Wouldn't this level of energy consumption be noticeable and stand out? What about the sheer number of ASIC units? Right now what would minimum amount of power would be necessary? How many homes/neighborhood worth? How many Amazon data centers?
branchless 8y ago
Here's my reason for not "investing" (it's no investing, it's speculation): * bitcoin is not mandated as the sole accepted currency for settling tax in any sovereign state, therefore it can go to zero
- sobani 8y ago
  It will never go to absolute zero as long as there are still people who at the very least see it as a joke. "Remember when BTC was $20000? I just bought 50000 of them, I would have been a billionair! Haha!" Also tell people in Venezuela how their Bolivar is not going to zero, because they have to pay their taxes with it.
JumpCrisscross 8y ago
> there are certainly organizations with the resources to do it, e.g. intelligence agencies, organized crime Nation states. Don't forget the large number of sanctioned regimes who would (a) have the resources to execute such an attack and (b) find great profit in doing so.
- duxup 8y ago
  Plenty of legit and rouge nations (or departments within them) who would find that tempting I think. Currency politics and all aside that is a tempting way to make money.
flashmob 8y ago
If you wait long enough, say, for 144 confirmations (or 24 hours, whichever is greater) then a double spend may as well be the least of your worries, for bitcoin, or any of the top mined crypto-currencies. These double-spend attacks are only successful if the receiving party doesn't wait long enough. Also, could't find any sources from exchanges if they were actually successful? The article didn't mention which exchanges. Quote: "Blockchain data indicates that the attacker successfully reversed transactions as far back as 22 blocks, leading developers to advise raising confirmation requirements to 50 blocks." So as long as exchanges wait 50 blocks before crediting, they should be all right.
EGreg 8y ago
By the way doesn’t your argument also destroy anarcho capitalist utopia scenarios? Someone could rent the local courts for a week, pillage everyone, and leave. Or just come with a larger army.
hudon 8y ago
There is another--less talked about--way to double-spend: developers can cause forks and double-spend during the confusion. In 2013, the network forked unexpectedly [0] and the Bitcoin network had 2 chains for about 4 hours. During those 4 hours, it is entirely possible that people sent BTC to exchanges they knew were going to be on the chain that ended up being orphaned. A conniving team of centralized developers can take this a step further and discover or intentionally plant a consensus bug that causes such a fork and because developers ultimately tell everyone which chain contains the "fix" (in 2013, they commanded that the minority chain was the right one), the developers know which chain will be orphaned and thus which exchange they can exploit. [0] https://freedom-to-tinker.com/2015/07/28/analyzing-the-2013-bitcoin-fork-centralized-decision-making-saved-the-day/ https://freedom-to-tinker.com/2015/07/28/analyzing-the-2013-...
facetube 8y ago
One of the many practical vulnerabilities.
hvidgaard 8y ago
> If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. There is no equilibrium point for transaction fees where this attack becomes uneconomical. The only defense is that the market for hash capacity is imperfect. At this point in time the current hashrate of the bitcoin network is 32.500 PH/s, up from 5.000 PH/s a year ago and 1.400 PH/s two years ago. If you rent 51% of the network it's going to be rather obvious that something is happening, that will however not prevent an attack. Let us assume that you can rent capacity because the miners are greedy, what price would you have to pay? Let's assume that you can buy from miners that want to exit the mining business, so they do not care about deprecating the value of their hardware nor the bitcoin value itself. So the assumptions are that 51% of the available capacity don't care if bitcoin tank and burn as long as they profit enough, and you're able to buy that. A 0.43% difficulty increase daily (average over last 2 years), bitcoin price of 7.600$, a 4MW powerdraw, and electricity prices of $0.08/KWh Miners controlling 51% would profit north of $1.000.000.000 yearly, and if they just want to be compensated for that one year, you have to pay $1.000.000.000 to rent 51%. That is a lot of money, and at $20.000 high it would be tripple that value. However, why would 51% of the capacity suddenly exit? Rather they want to be compensated for multiple years of profit, lets say 5 years and it's not unreasonable to expect bitcoin to reach $70.000 in that time. So we're looking at a $50.000.000.000 cost to coordinate the attack. That's expensive, and with that kind of money there are other ways to make them multiply. Who would pay that to ensure destruction of the thing we know as Bitcoin? After all, the success means it's likely that another *coin takes over, where you cannot 51% as easily.
- nopinsight 8y ago
  It is far from clear that Bitcoin will likely ever reach $70,000. That implies an approx market cap of $1,200,000,000,000 or more. Would Bitcoin ever be useful enough or generate more value than Google or several Big Energy companies combined to justify and sustain that valuation?
  - ObeyTheGuts 8y ago
    google value is in bitcoins
teekert 8y ago
> If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. There is no equilibrium point for transaction fees where this attack becomes uneconomical. The only defense is that the market for hash capacity is imperfect. You're killing your goose with the golden eggs. That is, if a currencies remains in use.
antocv 8y ago
Not all cryptocurrencies are secured by hashpower or "mining", have you considered those? Examples like Delegated Proof-of-Stake or "eusocial oligarchy like consensus" systems like Byteball?
viach 8y ago
You have used technical analysis for making an investment decision. Scientific method, skeptical approach, great. And the assumption is "the tech is broken, the price will fall because of it, won't buy". But, if we take on step further and continue our experiment, lets compare the actual facts with the assumption. And what we see? Two cryptocurrencies (Bitcoin Gold and Verge) which were successfully attacked this week, didn't lose in market cap. How comes? What conclusion should we take from this assumption/fact, if continue being scientific? Do we need a new assumption?
- bobbrown 8y ago
  In the long term the market behaves rational. It might take some time, but - if he is right - odds are on his side. A mid-term (3-7 years) of irrational behaviour in a market in not unusual. Some will benefit from it.
  - viach 8y ago
    > In the long term the market behaves rational. How do you know the current behavior is irrational? We probably just don't know what kind of rationality is behind this. What if it is not drive by the technical merits of blockchain, but still based on some rationality, we reject to agree with?
deleted 8y ago
[deleted]
tobiaswk 8y ago
Great points. The thing is though that a double spend would harm both the attacker and all others on the network. It would weaken the trust. It is a double edged sword. You would have to do the double spend without anyone noticing and then liquidate your earnings as fast as possible. With more combined hashing power this would become very hard to do. There are a lot of problems other than double spend with the Bitcoin. Transactions fees rise very quickly because of the block size limit of about 1MB. You can't really rely on 0-confirmation transactions. The saviour lightning network in my opinion is the wrong solution to the scaling problem. It changes fundamentally how bitcoins are exchanged and steers away from the original white paper by Satoshi. Not that this is wrong... it just becomes another project altogether.
CryptoPunk 8y ago
If the scenario you laid out actually pans out it would be very good for Bitcoin, because there is a lot of free energy in the world but it is highly distributed. The dominant form of mining would be utility companies and individuals redirecting excess electricity generated from their renewable electric power generators, during off-peak hours and spikes in generation, to mining, and the constituents would be both numerous and globally distributed, owing to the wide geography areas across which renewable energy resources are found.
dmichulke 8y ago
> If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates "Renting 51%" (of any global market) and "at market rates" are mutually exclusive. > There is no equilibrium point for transaction fees where this attack becomes uneconomical. The counterforce against doublespending is not transaction fee but cost of ownership of mining equipment. Some other arguments against your conclusion: - As mentioned nearby, for big transactions you want to wait longer than 6 confirmations. - Also, as recipient you might want to distribute huge payments into smaller ones distributed over time. - It's in the interest of mining capacity lenders to make sure you don't get 51% because it renders their equipment worthless in case you are successful. - As you correctly stated, low prices will lead to lower hash rates (and higher prices to higher rates). This means actually that bitcoin will be more stable (it's harder to obtain 51%) if prices rise. There's an equilibrium on that side as well! That is, if double spending is what you're worried about.
wellboy 8y ago
Your analysis isn't really a good one, since Proof of Work consensus through mining, isn't really used anymore by the new coins. It seems you're too focused on a specific decentralized consensus solution, while there are already much better ones out there, e.g. Iota with a tangle, skycoin with a web of trust or Elastos that are immune to 51% attacks.
samolang 8y ago
If bitcoin becomes 'the currency of the future' then renting 51% of the capacity at market rates will be prohibitively expensive.
saalweachter 8y ago
When Bitcoin was hitting $20,000, which I never thought they'd do, I mostly concluded I'd missed any investment opportunity. I plausibly could have invested a few hundred or thousand in Bitcoin was in the low hundreds, and if I hodl'd to the moon realized a hundredfold gain, which would have been nice. But once you're at the moon, then what? The new price predictions are things like "If Bitcoin replaces gold it could be worth $135,000/BTC.". Which is a lot, and a little far fetched, but also only 6x from the last peak. I'm not interested in a risky investment which takes years to come to fruition and only yields 6x. It's too risk for a safe investment and too low-yield for a risky investment. Boat missed.
roymurdock 8y ago
It is often asserted (for example, in the Bitcoin white paper [22]) that a cartel can double-spend Bitcoins. In a strict sense, this is true: a cartel can spend a Bitcoin by paying it to a player Alice, receiving goods or services, and then shifting the consensus choice of history to a branch where that coin is instead paid to a different player Bob. However, we argue that double-spending by a cartel has a limited payoff. Bitcoins have value because people are willing to trade them for goods and services. If players were unwilling to accept Bitcoins for trade or unwilling to spend Bitcoins for fear of having their payments nullified, the value of Bitcoins would diminish significantly as players lost confidence in the system. Worse, because players are encouraged to generate a new identity for each transaction and because identities are not linked to any side information, players cannot easily determine whether a proffered payment is coming from the double-spending cartel or an honest user. Thus, a rational player should refuse to accept any payments when there is a significant threat of double-spending. As a cartel must outmine the entire Bitcoin network and thus outspend the entire Bitcoin network for as long as it would remain a cartel, we believe it is very unlikely that a cartel could double-spend enough to recover the cost of the attack... As described above, a 51% cartel attack is unlikely to generate enough reward within the Bitcoin economy to be worthwhile to the attacker. However, this does not rule out the possibility of a 51% attack that aims to destroy the Bitcoin economy in order to achieve utility outside the Bitcoin economy. We call this the Goldfinger attack after the character in film who tries to undermine U.S. currency by ruining its gold backing [15]... In all of these cases, the attacker must achieve enough utility to justify the substantial cost of an attack. We agree with Becker et al. that it is unlikely that a protest movement could muster the resources to launch a successful attack. And at present it does not appear possible to acquire a short position on Bitcoins that is large enough to justify an attack. (2013) The Economics of Bitcoin Mining, or Bitcoin in the Presence of Adversaries Joshua A. Kroll, Ian C. Davey, and Edward W. Felten, Princeton University https://www.econinfosec.org/archive/weis2013/papers/KrollDaveyFeltenWEIS2013.pdf https://www.econinfosec.org/archive/weis2013/papers/KrollDav...
- Hupriene 8y ago
  This seems to miss the point that the mining pays for itself in collected transaction fees. Double spend is just icing on the cake.
ojr 8y ago
blockchains are not immutable, the software that blockchain servers run can be updated to any chain with the most social consensus, if an attack was that bad it can be fixed with a few git pushes and pulls, the price might suffer but even that is not a guarantee, price movements have a greater influence than fundamental value in crypto
tacon 8y ago
>If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. Lenin was right: "When it comes time to hang the capitalists, they will vie with each other for the rope contract."[0] [0] https://quoteinvestigator.com/2018/02/22/rope/ https://quoteinvestigator.com/2018/02/22/rope/
russdpale 8y ago
I do believe you are vastly underestimating how difficult an attack on the bitcoin network would be. I seriously doubt anyone other than a handful of state level actors could pull it off, and even then I am not sure. The amount of energy we are talking is tremendous, and gets orders of magnitude larger the more blocks you go backwards in time. The XVG hack only went back 22 blocks, that is mathematically, and most certainly financially and perhaps even physically impossible with bitcoin. The amount of energy and money spent would never, ever make it worth it.

Taek 8y ago

In the bitcoin system, miners make literally billions of dollars a year protecting the network. Any successful attack on the bitcoin network is going to massively erode confidence, reduce the price, reduce the usage, and therefore reduce the value of all that single-purpose, bitcoin-only hardware. Large miners don't want to see Bitcoin get attacked because it destroys their income and de-values their incredibly expensive hardware. This is also why miners won't just let you borrow their hashrate for a while - it's a big issue if you use that hashrate to undermine their cash cow.

onecooldev24 8y ago
Top miners can short twice as many BTC futures to create one last profitable destruction.
- mrep 8y ago
  All the while raking in boatloads from the double spending.
- Taek 8y ago
  If a large miner comes to you asks for a multi billion dollar short position, you should be suspicious.
  - facetube 8y ago
    Yep. totally safe, someone on the internet said we should.
  - Cthulhu_ 8y ago
    That's when you just split your short through a few thousand shell accounts.
chemmail 8y ago
Logical and sound arguments. However you underestimate human greed, human stupidity. Not everyone is operating on a Nash Equilibrium.
- Erlich_Bachman 8y ago
  This will all be valid concerns the day we see a real 51% attack on real Bitcoin. So far Nash seems to be working.

tlarkworthy 8y ago

I think the argument is that by doing a 51% attack you undermine the market value so you never get the rewards. This makes sense, but only for the leading crypto coin. As we see here today, you can 51% attack smaller coins, which should imply an increase in the value of Bitcoin from consolidation.

tehsauce 8y ago
The spooky thing that this made me realize, is that if anyone did find a vulnerability in bitcoin (or any cryptocurrency) is that they would have a greater incentive to only slowly leech off the system, because they will be able to siphon out much more over time than if everyone panics over security. The weapon is no good unless it's secret.
- dragonwriter 8y ago
  Assuming you want to make money directly, sure. If you want to harm a community in which the currency is widely used, the incentives are different.
  - h1d 8y ago
    What kind of incentive does the attacker have to just harm a community of a distributed system?
    - rspeer 8y ago
      How about environmentalism?
      - mlvljr 8y ago
        Not this again!!
    - jungturk 8y ago
      An interest in a competing financial system.

drexlspivey 8y ago

What a lot of people in the thread seem to be missing is that when you receive a huge payment you can require a higher amount of confirmations to accept it. High enough that it would make the 51% attack unprofitable.

onecooldev24 8y ago
you can split the payment to multiple small amounts.
- mehrdadn 8y ago
  Confused... I thought the claim was about receiving and not sending?
  - onecooldev24 8y ago
    if multiple accounts send multiple small payments (controlled by the same guy), then the exchange wont wait as long for the confirmations.
    - CydeWeys 8y ago
      The exchange can have thresholds for total volume per given time interval then. Once the total amount of pending transactions breaches a given volume, the transaction period for more transactions within the window goes up.
cdetrio 8y ago
Requiring more confirmations decreases the probability that a transaction will be reverted, under the assumption that an attacker has < 49% of the hashpower. If you attempt an attack with 49%, then you have a fair chance of mining, say, 6 blocks before the rest of the network. If you get unlucky then you sacrifice those rewards. But if you mine with 51% then your attack chain is (probabilistically) guaranteed to eventually become the longest chain, so there won't be any loss of revenue.

snarf21 8y ago

I think one of the other issues is that each transaction that they are double spending can be worth so much. If each transaction was maxed out at say $100, the incentive to double spend the transaction becomes smaller. Obviously that changes a lot about the costs of mining and transactions, just saying the bigger a single transaction or value in a single address, the larger the likelihood of an attack. We see the same things with cash, they only run the "counterfeit" pen on $20 or larger. Just wondering if there is some kind of crypto currency where the transactions had a max of some kind. Would the difficulty be able to be much smaller and blocks every minute (since there would be so many more to transact)? This isn't well formed, just off the top.....

bondi 8y ago
This would probably lead to a huge increase in transactions, and PoW mining as of now will not to be able to process tranactions fast enough and the coin ends up clogged and unusable.

onecooldev24 8y ago

can you explain this in better words: "then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack."

bo1024 8y ago
I think what jhpriestly is saying is: As the market gets efficient, the price of renting mining capacity will approach the profits earned from transaction fees. So renting mining capacity will almost pay for itself, i.e. is almost free. But then you might as well rent a lot of it, like 51%, because it's allowing you to attack the chain almost for free.
- bb88 8y ago
  I think a good question is, is there a market for renting asic mining gear? Yes, but only if mining the coins via renting is cheaper than buying them outright. If you're a miner, it makes sense to rent out your gear, because you get a guaranteed payment higher than you could make via mining.
  - PeterisP 8y ago
    I've heard an opinion (but I'm not certain) that mined coins are considered less traceable than purchased coins. For any purchase, there's a trail that leads to you through however you paid for it; for mining, the mined coins are totally disconnected from the hardware that mined the block and how you bought it.
- onecooldev24 8y ago
  Well then the buyer and seller would race to gain 51% of mining power (as its free) which will make it more expensive because of the constant biding war.

bo1024 8y ago

Those are some really great and interesting points. However, I think there is a resource you didn't mention that combats such attacks: time. If I'm a vendor, e.g. I pay cash for bitcoin, then I can tune the amount of time the transaction is held in limbo or escrow based on the vulnerability of the network. For instance, I can decide not to finalize the transaction until I see a chain with 12 new blocks added after the transaction block. So an attacker has to control 51% for 2 hours to successfully scam me. Or I can make it 24 blocks (4 hours), or whatever. Not sure this can mitigate the attacks and market forces you discuss, but it might. I see Bitcoin moving toward an intermediary system where you have a "Bitcoin balance" with a "Bitcoin bank" that allows you to make immediate transactions and takes on the risk and time delay of settling these transactions on the blockchain over the course of the next day or two.

thaumasiotes 8y ago
> I see Bitcoin moving toward an intermediary system where you have a "Bitcoin balance" with a "Bitcoin bank" that allows you to make immediate transactions and takes on the risk and time delay of settling these transactions on the blockchain over the course of the next day or two. How would this system differ from an ordinary bank in the system we have now?
- CydeWeys 8y ago
  It's still trustless, decentralized, yadda yadda.
  - thaumasiotes 8y ago
    In what sense is a system where you hold all your bitcoins in a "bitcoin bank" decentralized or trustless?
    - CydeWeys 8y ago
      The second layer solutions such as Lightning Network don't require you letting other people hold your Bitcoin. They're still decentralized and trustless.

ryanlol 8y ago

>Attacking a huge network like bitcoin would be an audacious and expensive act, but there are certainly organizations with the resources to do it, e.g. intelligence agencies, organized How do you propose they would go about doing this? Would they jam up the whole worlds chip production to source the ASICs at above market rates? How could this be profitable? Perhaps by taking over existing mining operations, but then you’d need to somehow perform the attack before you’re detected.

rjkennedy98 8y ago

The numbers I've seen quoted for a double spend attach on Bitcoin Cash (assuming guaranteed block space) are that it would cost about 50K to double spend on a 0-conf transaction. So really, you can confidently accept 0-conf for <1K reasonably. More that that you can accept 1-conf or more which can take a minute or two. BTC rejects 0-conf transactions, but they are already in use around the world and are successful as far as I know.

Retric 8y ago
Except you profit from mined blocks. In theory you should be able do do a 51% attack for a profit even without double spending as you capture high value transactions over a longer timespan than normal. Aka in 10 ten blocks you get the same number of high value transactions as would normally occur over 20 blocks. Where you would end up with the same 10 blocks without a 51% attack but someone else would also mine 10 blocks and capture some of those high value transaction fees.
garmaine 8y ago
It costs nothing to double-spend a 0-conf transaction.
IncRnd 8y ago
> it would cost about 50K to double spend on a 0-conf transaction That makes no sense. If there are no confirmations, there is no cost, because nothing happened. This comment is a 0-conf transaction on BTC...

split_tender 8y ago

What do you mean, “underbidding”, e.g. “underbidding attack”? I don’t understand this term in the context of your hypotheses which assumes a perfectly efficient market for hashpower

jhpriestley 8y ago
Suppose that it takes $50 of energy to find a hash at current difficulty. Transaction fees are at $50 (in BTC). I can offer miners $51 for their hash power, but they might be suspicious. So the other thing I can do is confirm transactions for $49 in fees, which I'm calling underbidding. This will drive miners out of the market.
- sobani 8y ago
  Wouldn't this mean you ignore the transactions with the higher fees for the other miners to pick up, thereby making mining more profitable for them? How bitcoin transacting work is not that the miners publish their price and someone accepts that price and thus sends the transaction to that miner. How it works is that you publish your transaction with the fee you're willing to pay and if your fee is high enough, it will get included in the next block.

DINKDINK 8y ago

This attacked occurred on BTG a clone of Bitcoin, appropriating the name “Bitcoin” Gold. It has nothing to do with Bitcoin.

rspeer 8y ago
REG: Right. You're in. Listen. The only people we hate more than the Romans are the fucking Judean People's Front. P.F.J.: Yeah... JUDITH: Splitters. P.F.J.: Splitters... FRANCIS: And the Judean Popular People's Front. P.F.J.: Yeah. Oh, yeah. Splitters. Splitters... LORETTA: And the People's Front of Judea. P.F.J.: Yeah. Splitters. Splitters... REG: What? LORETTA: The People's Front of Judea. Splitters. REG: We're the People's Front of Judea! LORETTA: Oh. I thought we were the Popular Front. REG: People's Front! C-huh. FRANCIS: Whatever happened to the Popular Front, Reg? REG: He's over there. P.F.J.: Splitter!
- throwaway37585 8y ago
  Can you please post something relevant to the topic under discussion? There’s enough noise on this thread as it is.
  - Cthulhu_ 8y ago
    You needed a throwaway account just to tell someone off?
    - throwaway37585 8y ago
      I did not make a throwaway account “just to tell someone off”, and you could’ve figured that out in 5 seconds by looking at my comment history.
- Intermernet 8y ago
  Someone should just fork Bitcoin and call it Splitcoin.

DennisP 8y ago

Interesting points. A defense against this type of attack is to use at least the hybrid proof-of-stake design that Ethereum is rolling out in about three months; blocks are proposed by proof of work, but proof of stake periodically adds a layer of "economic finality." Here's a paper: https://arxiv.org/abs/1710.09437 https://arxiv.org/abs/1710.09437

IncRnd 8y ago
Just a cautionary note - you are describing the future in the present tense.
- DennisP 8y ago
  "In three months"...there's a chance that a problem will be found by the people doing formal verification, but otherwise there don't seem to be any potential roadblocks. Client implementation is very simple, partly because most of the protocol is implemented by a smart contract, which is already done. Ethereum does a hard-fork upgrade a couple times a year.
  - deleted 8y ago
    [deleted]
cdetrio 8y ago
51% attacks on the block proposal mechanism could prevent the PoS commitments from ever becoming finalized (i.e. violate liveness), though.
- DennisP 8y ago
  True, that's a risk it will still share with pure PoW. But at least you don't have to worry about doublespends after your transaction has finalized. Full Casper may have stronger liveness guarantees eventually, I'm not sure. At a minimum it's easier to manually intervene to get the network going again. (You could also do that in PoW by changing the hash algorithm, but you can probably only pull it off once, migrating from ASIC to general purpose hardware.)

dustingetz 8y ago

2nd and 3rd gen blockchain tech is not vulnerable to double-spend attack, i believe. Only the legacy chains (Bitcoin, Litecoin etc) are

djsumdog 8y ago

Wouldn't this level of energy consumption be noticeable and stand out? What about the sheer number of ASIC units? Right now what would minimum amount of power would be necessary? How many homes/neighborhood worth? How many Amazon data centers?

branchless 8y ago

Here's my reason for not "investing" (it's no investing, it's speculation): * bitcoin is not mandated as the sole accepted currency for settling tax in any sovereign state, therefore it can go to zero

sobani 8y ago
It will never go to absolute zero as long as there are still people who at the very least see it as a joke. "Remember when BTC was $20000? I just bought 50000 of them, I would have been a billionair! Haha!" Also tell people in Venezuela how their Bolivar is not going to zero, because they have to pay their taxes with it.

JumpCrisscross 8y ago

> there are certainly organizations with the resources to do it, e.g. intelligence agencies, organized crime Nation states. Don't forget the large number of sanctioned regimes who would (a) have the resources to execute such an attack and (b) find great profit in doing so.

duxup 8y ago
Plenty of legit and rouge nations (or departments within them) who would find that tempting I think. Currency politics and all aside that is a tempting way to make money.

flashmob 8y ago

If you wait long enough, say, for 144 confirmations (or 24 hours, whichever is greater) then a double spend may as well be the least of your worries, for bitcoin, or any of the top mined crypto-currencies. These double-spend attacks are only successful if the receiving party doesn't wait long enough. Also, could't find any sources from exchanges if they were actually successful? The article didn't mention which exchanges. Quote: "Blockchain data indicates that the attacker successfully reversed transactions as far back as 22 blocks, leading developers to advise raising confirmation requirements to 50 blocks." So as long as exchanges wait 50 blocks before crediting, they should be all right.

EGreg 8y ago

By the way doesn’t your argument also destroy anarcho capitalist utopia scenarios? Someone could rent the local courts for a week, pillage everyone, and leave. Or just come with a larger army.

hudon 8y ago

There is another--less talked about--way to double-spend: developers can cause forks and double-spend during the confusion. In 2013, the network forked unexpectedly [0] and the Bitcoin network had 2 chains for about 4 hours. During those 4 hours, it is entirely possible that people sent BTC to exchanges they knew were going to be on the chain that ended up being orphaned. A conniving team of centralized developers can take this a step further and discover or intentionally plant a consensus bug that causes such a fork and because developers ultimately tell everyone which chain contains the "fix" (in 2013, they commanded that the minority chain was the right one), the developers know which chain will be orphaned and thus which exchange they can exploit. [0] https://freedom-to-tinker.com/2015/07/28/analyzing-the-2013-bitcoin-fork-centralized-decision-making-saved-the-day/ https://freedom-to-tinker.com/2015/07/28/analyzing-the-2013-...

facetube 8y ago

One of the many practical vulnerabilities.

hvidgaard 8y ago

> If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. There is no equilibrium point for transaction fees where this attack becomes uneconomical. The only defense is that the market for hash capacity is imperfect. At this point in time the current hashrate of the bitcoin network is 32.500 PH/s, up from 5.000 PH/s a year ago and 1.400 PH/s two years ago. If you rent 51% of the network it's going to be rather obvious that something is happening, that will however not prevent an attack. Let us assume that you can rent capacity because the miners are greedy, what price would you have to pay? Let's assume that you can buy from miners that want to exit the mining business, so they do not care about deprecating the value of their hardware nor the bitcoin value itself. So the assumptions are that 51% of the available capacity don't care if bitcoin tank and burn as long as they profit enough, and you're able to buy that. A 0.43% difficulty increase daily (average over last 2 years), bitcoin price of 7.600$, a 4MW powerdraw, and electricity prices of $0.08/KWh Miners controlling 51% would profit north of $1.000.000.000 yearly, and if they just want to be compensated for that one year, you have to pay $1.000.000.000 to rent 51%. That is a lot of money, and at $20.000 high it would be tripple that value. However, why would 51% of the capacity suddenly exit? Rather they want to be compensated for multiple years of profit, lets say 5 years and it's not unreasonable to expect bitcoin to reach $70.000 in that time. So we're looking at a $50.000.000.000 cost to coordinate the attack. That's expensive, and with that kind of money there are other ways to make them multiply. Who would pay that to ensure destruction of the thing we know as Bitcoin? After all, the success means it's likely that another *coin takes over, where you cannot 51% as easily.

nopinsight 8y ago
It is far from clear that Bitcoin will likely ever reach $70,000. That implies an approx market cap of $1,200,000,000,000 or more. Would Bitcoin ever be useful enough or generate more value than Google or several Big Energy companies combined to justify and sustain that valuation?
- ObeyTheGuts 8y ago
  google value is in bitcoins

teekert 8y ago

antocv 8y ago

Not all cryptocurrencies are secured by hashpower or "mining", have you considered those? Examples like Delegated Proof-of-Stake or "eusocial oligarchy like consensus" systems like Byteball?

viach 8y ago

You have used technical analysis for making an investment decision. Scientific method, skeptical approach, great. And the assumption is "the tech is broken, the price will fall because of it, won't buy". But, if we take on step further and continue our experiment, lets compare the actual facts with the assumption. And what we see? Two cryptocurrencies (Bitcoin Gold and Verge) which were successfully attacked this week, didn't lose in market cap. How comes? What conclusion should we take from this assumption/fact, if continue being scientific? Do we need a new assumption?

bobbrown 8y ago
In the long term the market behaves rational. It might take some time, but - if he is right - odds are on his side. A mid-term (3-7 years) of irrational behaviour in a market in not unusual. Some will benefit from it.
- viach 8y ago
  > In the long term the market behaves rational. How do you know the current behavior is irrational? We probably just don't know what kind of rationality is behind this. What if it is not drive by the technical merits of blockchain, but still based on some rationality, we reject to agree with?

deleted 8y ago

[deleted]

tobiaswk 8y ago

Great points. The thing is though that a double spend would harm both the attacker and all others on the network. It would weaken the trust. It is a double edged sword. You would have to do the double spend without anyone noticing and then liquidate your earnings as fast as possible. With more combined hashing power this would become very hard to do. There are a lot of problems other than double spend with the Bitcoin. Transactions fees rise very quickly because of the block size limit of about 1MB. You can't really rely on 0-confirmation transactions. The saviour lightning network in my opinion is the wrong solution to the scaling problem. It changes fundamentally how bitcoins are exchanged and steers away from the original white paper by Satoshi. Not that this is wrong... it just becomes another project altogether.

CryptoPunk 8y ago

If the scenario you laid out actually pans out it would be very good for Bitcoin, because there is a lot of free energy in the world but it is highly distributed. The dominant form of mining would be utility companies and individuals redirecting excess electricity generated from their renewable electric power generators, during off-peak hours and spikes in generation, to mining, and the constituents would be both numerous and globally distributed, owing to the wide geography areas across which renewable energy resources are found.

dmichulke 8y ago

> If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates "Renting 51%" (of any global market) and "at market rates" are mutually exclusive. > There is no equilibrium point for transaction fees where this attack becomes uneconomical. The counterforce against doublespending is not transaction fee but cost of ownership of mining equipment. Some other arguments against your conclusion: - As mentioned nearby, for big transactions you want to wait longer than 6 confirmations. - Also, as recipient you might want to distribute huge payments into smaller ones distributed over time. - It's in the interest of mining capacity lenders to make sure you don't get 51% because it renders their equipment worthless in case you are successful. - As you correctly stated, low prices will lead to lower hash rates (and higher prices to higher rates). This means actually that bitcoin will be more stable (it's harder to obtain 51%) if prices rise. There's an equilibrium on that side as well! That is, if double spending is what you're worried about.

wellboy 8y ago

Your analysis isn't really a good one, since Proof of Work consensus through mining, isn't really used anymore by the new coins. It seems you're too focused on a specific decentralized consensus solution, while there are already much better ones out there, e.g. Iota with a tangle, skycoin with a web of trust or Elastos that are immune to 51% attacks.

samolang 8y ago

If bitcoin becomes 'the currency of the future' then renting 51% of the capacity at market rates will be prohibitively expensive.

saalweachter 8y ago

When Bitcoin was hitting $20,000, which I never thought they'd do, I mostly concluded I'd missed any investment opportunity. I plausibly could have invested a few hundred or thousand in Bitcoin was in the low hundreds, and if I hodl'd to the moon realized a hundredfold gain, which would have been nice. But once you're at the moon, then what? The new price predictions are things like "If Bitcoin replaces gold it could be worth $135,000/BTC.". Which is a lot, and a little far fetched, but also only 6x from the last peak. I'm not interested in a risky investment which takes years to come to fruition and only yields 6x. It's too risk for a safe investment and too low-yield for a risky investment. Boat missed.

roymurdock 8y ago

It is often asserted (for example, in the Bitcoin white paper [22]) that a cartel can double-spend Bitcoins. In a strict sense, this is true: a cartel can spend a Bitcoin by paying it to a player Alice, receiving goods or services, and then shifting the consensus choice of history to a branch where that coin is instead paid to a different player Bob. However, we argue that double-spending by a cartel has a limited payoff. Bitcoins have value because people are willing to trade them for goods and services. If players were unwilling to accept Bitcoins for trade or unwilling to spend Bitcoins for fear of having their payments nullified, the value of Bitcoins would diminish significantly as players lost confidence in the system. Worse, because players are encouraged to generate a new identity for each transaction and because identities are not linked to any side information, players cannot easily determine whether a proffered payment is coming from the double-spending cartel or an honest user. Thus, a rational player should refuse to accept any payments when there is a significant threat of double-spending. As a cartel must outmine the entire Bitcoin network and thus outspend the entire Bitcoin network for as long as it would remain a cartel, we believe it is very unlikely that a cartel could double-spend enough to recover the cost of the attack... As described above, a 51% cartel attack is unlikely to generate enough reward within the Bitcoin economy to be worthwhile to the attacker. However, this does not rule out the possibility of a 51% attack that aims to destroy the Bitcoin economy in order to achieve utility outside the Bitcoin economy. We call this the Goldfinger attack after the character in film who tries to undermine U.S. currency by ruining its gold backing [15]... In all of these cases, the attacker must achieve enough utility to justify the substantial cost of an attack. We agree with Becker et al. that it is unlikely that a protest movement could muster the resources to launch a successful attack. And at present it does not appear possible to acquire a short position on Bitcoins that is large enough to justify an attack. (2013) The Economics of Bitcoin Mining, or Bitcoin in the Presence of Adversaries Joshua A. Kroll, Ian C. Davey, and Edward W. Felten, Princeton University https://www.econinfosec.org/archive/weis2013/papers/KrollDaveyFeltenWEIS2013.pdf https://www.econinfosec.org/archive/weis2013/papers/KrollDav...

Hupriene 8y ago
This seems to miss the point that the mining pays for itself in collected transaction fees. Double spend is just icing on the cake.

ojr 8y ago

blockchains are not immutable, the software that blockchain servers run can be updated to any chain with the most social consensus, if an attack was that bad it can be fixed with a few git pushes and pulls, the price might suffer but even that is not a guarantee, price movements have a greater influence than fundamental value in crypto

tacon 8y ago

>If hash capacity were traded on a perfectly competitive market, then it would always make sense to rent 51% of the capacity at market rates, earn the transaction fees, and also perform a double-spending attack. Lenin was right: "When it comes time to hang the capitalists, they will vie with each other for the rope contract."[0] [0] https://quoteinvestigator.com/2018/02/22/rope/ https://quoteinvestigator.com/2018/02/22/rope/

russdpale 8y ago

I do believe you are vastly underestimating how difficult an attack on the bitcoin network would be. I seriously doubt anyone other than a handful of state level actors could pull it off, and even then I am not sure. The amount of energy we are talking is tremendous, and gets orders of magnitude larger the more blocks you go backwards in time. The XVG hack only went back 22 blocks, that is mathematically, and most certainly financially and perhaps even physically impossible with bitcoin. The amount of energy and money spent would never, ever make it worth it.