4 ms·

so to be safe, an exchange should require more confirmations depending on size of deposit. Basically the number of confirmations you could finance an attack fo

so to be safe, an exchange should require more confirmations depending on size of deposit. Basically the number of confirmations you could finance an attack for with the deposit.

Klathmon 8y ago
Yes, and most do. Many will semi-routinely increase the number of confirmations during times where it could be necessary (like chain splits or network upgrade events), or adjust the number of confirmations depending on the size of the currency and overall usage. Another mitigation is to shut down trading until the attack is over. Maintaining a 51% attack is expensive (assuming there is at least SOME usage of the coin), and if you just say "we won't be doing business for the next 24 hours", the attacker now has to maintain that attack for the next 24 hours, and if the company wants, they can just extend the time. Eventually (hopefully!) the attacker will run out of money, and the "correct" chain will take it over again.
- jeremyjh 8y ago
  The attack cannot be observed until it is accomplished. Naturally the chain will be long enough to target the exchange the spend was made at.
  - Klathmon 8y ago
    it can't be observed until it's acted on, but it may not be done after the first "attack", especially if it's cheap enough to launch on that specific coin.
pietjepuk88 8y ago
I'm not sure how easy it would be for exchanges to implement variable confirmations depending on the amount transferred, but I would say that what you suggest is a very reasonable way to limit the risk of suffering such an attack. I would say that especially exchanges that support fringe coins would better look into something like that. Even if the exchange's potential loss is only a couple hundred or thousand dollars, it's worth doing in my opinion, even if only to avoid the technical or legal hassle that would otherwise follow. I would say that most (other) fringe coins are not as easily attacked as ETC was. They have very illiquid markets, and you cannot really sell a significant amount of them before you basically just deplete the order books. And merchants are typically not accepting anything other than the major coins either. I guess ETC was still riding along on its partially shared name/history with its bigger brother. Eventually, some more details on the double spend transactions might shed some light on who suffered a loss in this case. It might be an exchange, but most of them require KYC nowadays (so it becomes hard to get away with).
alkonaut 8y ago
Shouldn’t any sale/transaction be considered “not final” (goods can’t be shipped, for example) until the official chain has progressed to a point where you can be sure the cost of producing a censored fork is higer than the transaction in question? That is: you buy something expensive then it might not ship for a month or two. I guess you could buy a hundred gadgets at $100 each from a hundred places in one day and then produce a fork censoring your whole $10k shopping spree?
- hippich 8y ago
  you can't predict that - the alternative chain is mined privately and it is a matter of amount at stake how long this mining will continue.
  - alkonaut 8y ago
    But in the publicly visible (longest, official) chain, can't I estimate the effort that was used to mine from a certain transaction up to the head? Say the transaction I want to hide is b, then the attacker would need to mine a longer alternative chain (c', d'...). If transaction b was for $1000 and we can estimate that the mining of the visible chain c...f is at least $2k with a conservative estimate, can't we estimate that the attackers chain c'...g' must cost something at least vaguely proportoinal to that as well? Is it not even possible to make a conservative guesstimate of cost-vs-chain-length? a<-b<-c<-d<-e<-f \ c'<-d'<-e'<-f'<-g'

so to be safe, an exchange should require more confirmations depending on size of deposit. Basically the number of confirmations you could finance an attack for with the deposit.

Klathmon 8y ago

Yes, and most do. Many will semi-routinely increase the number of confirmations during times where it could be necessary (like chain splits or network upgrade events), or adjust the number of confirmations depending on the size of the currency and overall usage. Another mitigation is to shut down trading until the attack is over. Maintaining a 51% attack is expensive (assuming there is at least SOME usage of the coin), and if you just say "we won't be doing business for the next 24 hours", the attacker now has to maintain that attack for the next 24 hours, and if the company wants, they can just extend the time. Eventually (hopefully!) the attacker will run out of money, and the "correct" chain will take it over again.

jeremyjh 8y ago
The attack cannot be observed until it is accomplished. Naturally the chain will be long enough to target the exchange the spend was made at.
- Klathmon 8y ago
  it can't be observed until it's acted on, but it may not be done after the first "attack", especially if it's cheap enough to launch on that specific coin.

pietjepuk88 8y ago

I'm not sure how easy it would be for exchanges to implement variable confirmations depending on the amount transferred, but I would say that what you suggest is a very reasonable way to limit the risk of suffering such an attack. I would say that especially exchanges that support fringe coins would better look into something like that. Even if the exchange's potential loss is only a couple hundred or thousand dollars, it's worth doing in my opinion, even if only to avoid the technical or legal hassle that would otherwise follow. I would say that most (other) fringe coins are not as easily attacked as ETC was. They have very illiquid markets, and you cannot really sell a significant amount of them before you basically just deplete the order books. And merchants are typically not accepting anything other than the major coins either. I guess ETC was still riding along on its partially shared name/history with its bigger brother. Eventually, some more details on the double spend transactions might shed some light on who suffered a loss in this case. It might be an exchange, but most of them require KYC nowadays (so it becomes hard to get away with).

alkonaut 8y ago

Shouldn’t any sale/transaction be considered “not final” (goods can’t be shipped, for example) until the official chain has progressed to a point where you can be sure the cost of producing a censored fork is higer than the transaction in question? That is: you buy something expensive then it might not ship for a month or two. I guess you could buy a hundred gadgets at $100 each from a hundred places in one day and then produce a fork censoring your whole $10k shopping spree?

hippich 8y ago
you can't predict that - the alternative chain is mined privately and it is a matter of amount at stake how long this mining will continue.
- alkonaut 8y ago
  But in the publicly visible (longest, official) chain, can't I estimate the effort that was used to mine from a certain transaction up to the head? Say the transaction I want to hide is b, then the attacker would need to mine a longer alternative chain (c', d'...). If transaction b was for $1000 and we can estimate that the mining of the visible chain c...f is at least $2k with a conservative estimate, can't we estimate that the attackers chain c'...g' must cost something at least vaguely proportoinal to that as well? Is it not even possible to make a conservative guesstimate of cost-vs-chain-length? a<-b<-c<-d<-e<-f \ c'<-d'<-e'<-f'<-g'