16 ms·

BTC Endgame

288 points by jbegley 6y ago

yrral 6y ago
I think under these circumstances, the economic majority of bitcoin users will fork to use, eg a new hash algorithm, rendering the seized mining farms useless. Remember, bitcoin is a collective trusted network based on agreement between users, miners and developers. If the miners turn, just switch to a set of new miners. You mention that this wouldn't work in your article. Can you explain why?
- AffableSpatula 6y ago
  In order for change in hash function to work, it would require remonitising to a significant hash rate. Why would anyone invest in mining equipment on that new hash function if they already know how the game ends? (ie. their equipment being written off)
  - deleted 6y ago
    [deleted]
  - yrral 6y ago
    Theres no need to start at a huge hash rate. You can fork and then reset/reduce the difficulty, or adjust the difficulty in the way BCH does. You can also use POW algorithms that can be done only on commodity hardware like GPUs or CPUs so that the community can do it in a more distributed way.
    - AffableSpatula 6y ago
      If the difficulty is low then re-attacking the forked chain is inexpensive so you have exactly the same problem. Additionally, reducing the hashrate reduces the settlement assurances increasing the number of confirmations required to be sure your transaction is finalised.
  - nostrademons 6y ago
    Human beings already know how our game ends (we die), and yet we do all sorts of things on this earth in the ~80 years before that, even knowing that everything we do for ourselves becomes meaningless once we're gone. Time preferences are a thing. Lots of folks do things with a time horizon much lower than their equipment being written off. Whole companies are destroyed for quarterly earnings, relationships are destroyed for a promo that lasts only for the ~2-5 years that you've got remaining at the company, people get married even knowing that 50% of them end in divorce, parents birth children knowing that they'll leave the nest and develop their own opinions and say they don't love you and eventually die.
  - doggosphere 6y ago
    The same reason they got into it in the first place; you can make money by doing it.
- pjfin123 6y ago
  Yeah it seems like the real defense of an obvious attack is "This Ethereum proof of stake chain with all of the wallets from right before the attack is the new Bitcoin".
  - hanniabu 6y ago
    Ethereum doesn't store Bitcoin wallets. I'm assuming you mean tokenized BTC (wBTC/rBTC)?
    - webinvest 6y ago
      No, he means if something bad happens to Bitcoin, there are thousands of other cryptocurrencies for users to migrate to. However since most cryptocurrency prices are denominated in bitcoin, a crash in bitcoin historically meant a crash in all of the rest.
- student2k 6y ago
  No or flawed governance in bitcoin, check decred
esotericn 6y ago
In the general case I don't think that majority miner attacks can be defended against without changing the hash algorithm. Specific cases like "empty blocks" could be addressed via a hard fork. But there's nothing stopping miners from faking transactions in blocks, sending amounts to themselves, filling the block with OP_RETURNs, or just doing the minimum possible to get around your "fix". PoW absolutely relies on >50% of miners being honest, always has done.
- AffableSpatula 6y ago
  The purpose of this project is to challenge people to be specific about the details of that hard fork. Currently there are no theoretical proposals, or concrete BIPs to address.
- safog 6y ago
  Can't you do worse things if you have >50% hash power? It seems like DoS is pretty mild all things considered.
  - esotericn 6y ago
    It depends how rationally the market responds, I guess. A reorg attack and a DoS are equivalent in my mind - anyone who's capable of pulling off a lengthy DoS is also capable of performing a reorg attack, whether they actually do or not is kind of irrelevant.
    - AffableSpatula 6y ago
      there is a type of reorg attack I proposed that's now been dubbed a "purge attack", that has the effect of destabalising the network by creating a window for all affected users to double spend their previously "finalised" transactions: https://medium.com/deribitofficial/destabilizing-bitcoin-consensus-with-purge-attacks-68018bf3b927 https://medium.com/deribitofficial/destabilizing-bitcoin-con...
thysultan 6y ago
For the first attack listed you'd need to be the 99% of mining power at which point the 1% could also just fork and leave you to your endeavours.
- AffableSpatula 6y ago
  The purpose of the project is to encourage people to be concrete in what their proposed ruleset changes are to defend the attack.
  - thysultan 6y ago
    It's not an attack vector precisely because of that. Another scenario is the 1% could just then continue mining non-empty blocks from where the attacker left of which would make them the most accurate blockchain with regards to proof of work, this case is even more passive than the hard fork option if you are in sync with the attacker at the time of the attack.
atemerev 6y ago
What a great idea. The attack described there is plausible, and experimenting in the means of defence before it happens is crucial for the continuity of cryptocurrncies.
paulgb 6y ago
The linked Medium posts have a bit more content https://joekelly100.medium.com/how-to-kill-bitcoin-part-1-is-bitcoin-unstoppable-code-7a1b366f65ee https://joekelly100.medium.com/how-to-kill-bitcoin-part-1-is... Note that this is from last July, when the price of BTC was significantly lower and thus the price of the attack is likely higher now. That said, this becomes more feasible in the long-run when mining is purely funded by transaction fees. Something I don’t see talked about much is the fact that, although Bitcoin is intended to be non-inflationary in the long run, the mining network that keeps it secure is currently 80-90% subsidized by inflation.
- AffableSpatula 6y ago
  Hey, author here - I think you're absolutely right that there is a risk that demand for blockspace doens't generate sufficient block reward to provide useful security guarantees. If that is the case, it could cause the price of BTC to fall which could create a negative feedback loop. This would, at best, create an end of the 21m cap and at worst trigger a collapse of the game entirely.
  - jpsalm 6y ago
    Yea that's what I don't understand either. Is the plan to secure a fully-mined chain just rampant value-inflation in a way that is completely detached from supply and demand? Today my 1e-1000 bitcoin is worth 10 carrots, tomorrow it is worth 20 everything else held equal? How does that even work in practice? Alternatively you need transactions to pay entirely for the security of the chain. This doesn't seem feasible when chain security costs rise everyday as the cost of energy deceases. And if transaction fees increase to compensate and people transact less the whole thing blows up.
    - wmf 6y ago
      The "official" plan is for low-value transactions to happen on the Lightning Network and high-value (e.g. >$1M) transactions paying high fees to happen on-chain.
flyGuyOnTheSly 6y ago
>There is currently no defense for this attack in Bitcoin, as the simulation demonstrates. The entire Bitcoin miner reward model is the defense for this attack. Nation states have powerful computers... but nowhere near as powerful as the decentralized Bitcoin mining network combined. Even if they did currently, the endgame for Bitcoin as envisioned by Satoshi Nakamoto was for everyone on the planet to be mining Bitcoin at the same time. If a Nation State could ever become more powerful than every single private processor on the planet combined... I think it would be game over for a lot more than just Bitcoin.
- AffableSpatula 6y ago
  ASIC chip fabrication is centralised in China. The government could seize the means of production, as well as the centralised mining operations that they've attracted by subsidising electricity.
  - reitzensteinm 6y ago
    If a handful of governments that control fabs agree Bitcoin has to go, the efficiency of ASIC mining becomes a big threat. Governments can purchase large runs of ASICs while other mining will revert to GPU. Controlling 51% of the hash rate in this manner isn't as outlandish. Further, you're not limited to double spend attacks. If you're the government with a decent advantage, you just treat your own chain as true and never accept blocks from other miners. The reward for mining will collapse, since even if you produce a valid block it'll not be on the longest chain once government miners catch up. And once the reward for mining collapses you can probably even power down some of the ASICs. There are counter measures, but combined with attacking the financial onramps and making possession criminal, it's hard for me to believe that BTC would survive an attack like this. But of course, it's predicated on large governments agreeing it's worth seriously attacking. I don't know how likely that is.
- flixic 6y ago
  Nation state wouldn't need to become more powerful than all miners if most miners (more accurately, vast majority of hash power) were located in one, authoritarian country with a penchant of controlling "private" businesses.
nostrademons 6y ago
You don't need a DoS attack under the assumptions of this project. It's already assumed that you control ~80% of hash rate, so you execute a 51% attack that mass double-spends coins and destroy all confidence in the integrity of the currency. Poof, nobody uses it. Note that China already controls ~65% of Bitcoin hash rate, so if they wanted to execute this right now, they probably could. That they haven't is one reason I'm bullish on cryptocurrency, and specifically Ethereum and Stellar, and it's entirely separate from why many other Bitcoin bulls are bullish on cryptocurrency. You don't need proof-of-work to secure a blockchain. You only need game theory: as long as each participant has more to gain from allowing Bitcoin's continued existence than destroying it (and they can't subvert or destroy it in a way that will be invisible to other market participants), it will continue to exist. China gains no benefit from destroying Bitcoin; they can just continue to let it exist and tax all the Bitcoin miners in China, generating revenue for themselves and their citizens and continuing to be a thorn in the side of dollar hegemony. This also implies that proof-of-stake (if done right) is just as good as proof-of-work, which'll solve the energy issues associated with Bitcoin. And it means that cryptocurrency adoption, if it happens, isn't going to be because it's particularly good: rather, it'll be because the U.S. has destroyed the dollar. There's value in cryptocurrency simply in it being an alternative that's readily available, so that civilization doesn't stop if the U.S. does end up miscalculating and hyperinflating the dollar.
- AffableSpatula 6y ago
  I'm not so sure. If you don't need proof of work to secure a blockchain, then why is the free market of Bitcoin consensus continuing to expend huge amounts of capital to stick with it as its sybil resistance mechanism? If it wasn't considered a value destroying move, the transition away from PoW would've happened already no?
  - nostrademons 6y ago
    It has, in new cryptocurrencies. Virtually all cryptocurrencies launched since 2017 are proof-of-stake: Cardano, EOS, Stellar, Polkadot, Tezos, TRON. Ethereum is in the process of a very expensive and painful transition from proof-of-work to proof-of-stake. The reason you haven't seen this in the global cryptocurrency industry is because of network effects and adoption curves. Most programmers would probably agree that C++ is archaic and that the software industry has moved on to newer languages like Rust, Go, Kotlin, ES6, etc. Why then do Microsoft, Amazon, Apple, Google, etc. all rely on large quantities of C++ code? Because they were founded in the last millennia, when C++ was basically the only alternative for what they were trying to do, and have deeply enmeshed ecosystems and value chains that are all dependent on their existing C++ codebase. Throw it out and you throw out the $5T+ in value they've built. They couldn't have built that up without the 20 year head start they have, but if you're founding a tech company now, you're pretty dumb to use C++. Similarly, Bitcoin has built a whole ecosystem of miners, speculators, traders, exchanges, payment systems, wallets, etc. Throw proof-of-work out and you throw all that out, and along with it your advantage over Ethereum, Cardano, Stellar, etc.
stale2002 6y ago
Ehh, this blog posts focuses way too much on technical tricks that are, in reality, not really the main risks to the bitcoin network. For example, the blog posts focuses on things like 51% attacks to either reorg the chain, or prevent transactions from being published. This is not really as big of a deal. When 51% attacks happen, it certain disrupts crypto networks in the short term. But the defenders always have the nuclear option in their back pocket, which is to change the proof of work algorithm, and force the attackers to spend a bunch of money building their attack infrastructure up again. Threats to change the POW algorithm, were thrown around during the 2017 blocksize debate, when things got really heated, and parties involved were threatened what amounted to 51% attacks. So it is already established that this is something that devs consider doing. The only real avenue of attack against crypto networks, is simply the social one. You simply arrest anyone who does anything at all related to crypto, and hope the threat of government violence is enough to make it so most people dont use crypto. Those social attacks would be the most likely to succeed, IMO, but they also have the problem of being difficult to implement. You know, because we living in a society, with a court system, and elections, and people that care about not living in a totalitarian hellscape, so any attempt by the government to simply arrest everyone, will likely be punished politically. So sure. The blog post is correct that if the government simply arrests or kills everyone who has anything to do with bitcoin, then they could stop crypto. But the counter argument to that, is such recommendations are completely out there, and extreme, and society wouldn't let that happen and would punish the people doing that. The actual attack vectors that matter, are not some fantasy land conspiracy, of every world government becoming a dictatorship. Instead, the attack vectors that matter would instead be every day bad actors, that seek to defraud people, in secret, and are not willing or able to kill/arrest everyone in the world who opposed it.
- AffableSpatula 6y ago
  I don't think China being a dictatorship is much of a conspiracy. That's where a lot of ASICs are deployed, as well as the majority of the fabrication of the hardware itself.
  - stale2002 6y ago
trevelyan 6y ago
Distributed Proof-of-Work is not vulnerable to this: https://org.saito.tech/eliminating-51-attacks-in-proof-of-work-blockchains/ https://org.saito.tech/eliminating-51-attacks-in-proof-of-wo... The community of users simply attaches harder cryptographic proofs to their transactions, forcing up the cost of producing empty blocks. The approach is capable of bankrupting nation-states as a side-effect of eliminating 51% attacks.
- nine_k 6y ago
  Why won't it make transactions prohibitively expensive? Each transaction needs a trustless agreement of many, many nodes.
  - Vecr 6y ago
    Not unless the block sizes down, or the block times/ block/transaction relaying latency go way up. The great firewall of China might cause some issues, but in theory it should not get worse.
  - trevelyan 6y ago
    You don't need a transaction to be routed by many nodes: how quickly it propagates (and thus how quickly it gets included/confirmed) just depends on how much hashing you do before sending it. The halving penalty on work just forces attackers (who have +1 routing hop compared to honest nodes) to double the work of those honest nodes if they wish to outcompete them in producing a longer chain (i.e. no 51% attack). It also allows users to respond to attacks in real-time by affixing harder proofs to their transactions, increasing the attack-cost on the network in minutes should anyone try to pull off the sort of gambit described in the linked page.
muttantt 6y ago
My prediction is that Bitcoin will crash 50-80% in the next 12 months due to insider/rogue employee hack at Coinbase, and/or some other event that will render wallets irrecoverable or the company insolvent.
mullingitover 6y ago
There's a much simpler endgame: China starts enacting export controls on ASICs.
- latchkey 6y ago
  Good thing Global Foundries, Samsung and TSMC have their fabs in many countries. I'd worry about them before I'd worry about a single country.
darig 6y ago
I never understood why empty blocks is allowed... you can start immediately and get a head start over other mining pools. Granted it is just the time to load in transactions from the mempool and hash the result of appending them to the blockchain, but still... if you're in a race, why not take any advantage you can get? I've monitored the chain for years, and empty blocks are very very common. I know there is a civil war of people that want to make the block size larger vs keep it the same... I think at this point it they would both agree that every block should at least be 90%+ full before it is accepted. That seems like a simple fix. The attackers would then like just fill up the blocks passing a tiny amount of bitcoin between all their wallets, but at that point they might as well just use the mempool. In the end, if you have mining dominance, you win. No point denying that. If you want to "ban" miners, or rewrite history, bitcoin is no longer decentralized.
- shivekkhurana 6y ago
  The network needs a blocks every 10 minutes or so in order to mint a coinbase transaction (the tx that generates new Bitcoins). This is important to ensure that the network reaches 21million cap on time. If new blocks are not minted every 10 minutes, the calculation to reach 21million will be distorted.
  - darig 6y ago
    The network adjusts the difficulty (number of prefixed 0's in the hash) based on estimated mining capacity based on a running average time to complete previous blocks. There is no "on time" to reach the 21 million cap. All those "calculations" that would be "distorted" are those of the hedge fund managers who are holding strictly out of speculation. There is no way to prove an entity hasn't been mining on the side, capable of mining blocks faster than the main chain, even keeping up with increased difficulty, and any day they could publish their chain to the network, and it would be accepted as it was the longest chain. This would obviously destroy bitcoin, so the only reason to do that would be pure terrorism. Exploiting a 51% attack to double spend would also destroy the trust, so any attacker in it for the money is currently just mining empty blocks and getting rewarded for it, and there is nothing anyone can do to stop them. Once the 21 millions coins are all in the wild, transaction fees will need to be enough to entice them to keep running... otherwise, they cash out and burn it all down. If they aren't capable of burning it all down, perhaps the number of people validating transactions on the network goes way down... and the difficulty goes way down... until eventually all those old people from the mining days could turn their machines back on one day for a much easier 51% that they are now capable of. The whole thing is a mess.
Geee 6y ago
The defense is that there are thousands of other cryptocurrencies that would take Bitcoin's place. So the attackers wouldn't gain anything in the end.
- kasparkallas 6y ago
  What if the attacker is invested in other cryptocurrencies? Think outside the box.
  - Geee 6y ago
    Governments are the only entities who could try to attack Bitcoin if they collaborated. The only motivation would be to stop the network, not to make gains in other cryptocurrencies.
- FridgeSeal 6y ago
  Oh cool so my magical internet money that I’m meant to use as my main currency is essentially untrustworthy as an actual store of value, because I’m supposed to keep migrating to whatever the hasn’t-had-a-51%-attack-yet flavour of the month currency is?
  - Geee 6y ago
    You missed the point.
unyttigfjelltol 6y ago
The entire multi-billion BTC ecosystem is built on software that still hasn't reached "Version 1.0"? Bitcoin Core 0.21? A development beta? LOL.
- xiphias2 6y ago
  It may be 0.21 but it is one of the best reviewed software in tbe worls for security issues. Also there's a trillion dollar bounty especially on the public signature infrastructure.
- hiimtroymclure 6y ago
  what on earth does choice of versioning have to do with anything. React Native isn't at 1.0 and tons of companies use it. Google releases versions/APIs of their software with tons of bugs.
- JohnJamesRambo 6y ago
  If only other software was rated this accurately. What would the Cyberpunk game release be? 0.01?
- jwblackwell 6y ago
  Get in now while it's still early!
- owenversteeg 6y ago
  Fun side note - as of today, that's actually the one trillion dollar BTC ecosystem.
davidw 6y ago
> via a wargame Oh, I know, I know! "The only winning move is not to play"
- AffableSpatula 6y ago
  :)
- sillysaurusx 6y ago
  I recently watched that on YouTube. Sadly, it's private now: https://www.youtube.com/watch?v=HNLQ-O-Qx3Y&ab_channel=YouTubeMovies https://www.youtube.com/watch?v=HNLQ-O-Qx3Y&ab_channel=YouTu... The movie still holds up today, which I didn't expect. It gets pretty dumb at times, but no dumber than a Michael Bay flick.
statquontrarian 6y ago
Is it fair to say this is a subset of the general problem of majoritary-consensus networks (which includes PoW, PoS, PoA, PoR, PoET, and PoTS cryptocurrencies)? https://doi.org/10.1109/COMST.2020.2969706 https://doi.org/10.1109/COMST.2020.2969706
mshumi 6y ago
BTC fork using Algorand consensus. Same bitcoin, same LEDGER, but the consensus technology is vastly superior. Why willfully ignore 10 years of advances in cryptography and distributed computing.
- FridgeSeal 6y ago
  For presumably the same reason the crypto-currency community in general will fully disregards decades on decades of economic theory and experience to pursue a libertarian wet dream?
asdffdsa 6y ago
Assuming that the Chinese government can exercise control of the top 5 Chinese companies that control > 50% of the hash rate, what's stopping the Chinese government from corrupting the blockchain? E.g. only transactions from whitelisted wallet ids (e.g. CCP-approved institutions) go through, extortion, etc.
- narrator 6y ago
  The rest of the network could fork the chain to "NOCCP" chain or whatever. There are also a lot of other cryptocurrencies out there now.
lamontcg 6y ago
There's a way simpler endgame: We hit the peak of the bubble and people start pulling money out and it unwinds in a systemic bank panic.
- giantandroids 6y ago
  That is possible, but it's also possible for any store of value , gold , fiat, stocks..
  - lamontcg 6y ago
    Stocks are held up because they do have a grounding in the value of the corporations in the broader economy. For their value to go to zero everyone would have to pull out of the broad economy, stop buying manufactured goods and go back to farming their land. There are a huge number of incentives that make it extraordinarily difficult for people to just wake up one day and pull out of the economy, stocks and USD. There's literally no such incentives for crypto. Nobody has to buy into crypto or they can't buy food or cars or homes or pay their taxes or anything else. Opting out of crypto is very easy, opting out of the US economy is very hard.
  - audunw 6y ago
    It’s crazy that some people seriously think Bitcoin is anything like these stores of value. All these are ties to some fundamental value to society. If gold goes down, manufacturing will buy more of it because they use them for ICs and lots of other things. Most companies have some tangible assets behind them. If a stocks price goes far enough down someone might buy up a controlling stake and liquidate all the assets. A fiat currency in a functional state is generally strongly tied to borrowing for real physical assets. It’s deeply entangled with the economy. There is no bottom for Bitcoin. Especially now that it’s not a very viable currency for most purchases or for lending. What’s more, value is continually being extracted from the currency. People cashing out and payments to miners (who are basically just burning a lot of the money they make by converting electricity to heat without doing much useful work). In gold or stocks the money put in actually exists in something valuable to society, and you own a piece of that. The the value might be boosted up 2-10x its real value today, perhaps due to its perceived future value. But you do own a piece of something tangible. With Bitcoin, the money you put in is already gone. Used by a miner to pay for electricity or an early miner/purchaser who is now cashing out to buy an apartment. You just gotta pray that a few years down someone is willing to buy bitcoins from you for its perceived value alone. Because nobody is going to buy it for any other reason. Not to make something out of it (gold), not to liquidate the assets behind it (stocks), and not to pay taxes or pay back their mortgage (fiat currencies) There’s so much utter insane and thinking around cryptocurrency these days. Especially Bitcoin. It’s madness. I mean, it’s a super cool tech. But I think that blinds a lot of people to the facts around it.
x1000 6y ago
An interesting aspect of these cryptocurrencies is the aspect of consensus, not through the intended mechanisms like PoW, but through societal acceptance. Look at BTC and BTG (bitcoin and bitcoin gold). One has the suffix of "gold" while the other maintains the (arguably?) superior lack of any such embellishments/augmentations. Was it the miner's decision to call it that? Was it the users? Look at Ethereum v Ethereum classic. Same deal. We have two chains that share a common history, yet at some point the users of both decided to split and then society had to come to a consensus on what each chain would be called. Again, did the miners sit around and conspire to which chain would be called "Ethereum?" I don't think so. I think the decision was decentralized and emergent. My point is, even if there was a nefarious actor who attempted a 51% attack, it seems like there would be enough of a societal pressure to ignore their empty blocks. There would exist a chain that would still be valued by the perpetrators, but not so much by the individuals being harmed by such an attack. The attacked chain would be maintained and acquire a new name "Bitcoin Hacked" or something similar, and the chain where society ignores the empty blocks would go on its merry way still being called "bitcoin."
- habitue 6y ago
  I take the point you're making (in principle, there is some off-chain consensus at work here), but for these particular examples I believe society didn't decide these names as much as the people deciding to do the forks did.
kaonashi 6y ago
if a nation-state wanted to attack btc, they'd simply make transactions between its currency and btc illegal, and prosecute citizens and exchanges which transact with its citizens

288 points by jbegley 6y ago

I think under these circumstances, the economic majority of bitcoin users will fork to use, eg a new hash algorithm, rendering the seized mining farms useless. Remember, bitcoin is a collective trusted network based on agreement between users, miners and developers. If the miners turn, just switch to a set of new miners. You mention that this wouldn't work in your article. Can you explain why?

AffableSpatula 6y ago
In order for change in hash function to work, it would require remonitising to a significant hash rate. Why would anyone invest in mining equipment on that new hash function if they already know how the game ends? (ie. their equipment being written off)
- deleted 6y ago
  [deleted]
- yrral 6y ago
  Theres no need to start at a huge hash rate. You can fork and then reset/reduce the difficulty, or adjust the difficulty in the way BCH does. You can also use POW algorithms that can be done only on commodity hardware like GPUs or CPUs so that the community can do it in a more distributed way.
  - AffableSpatula 6y ago
    If the difficulty is low then re-attacking the forked chain is inexpensive so you have exactly the same problem. Additionally, reducing the hashrate reduces the settlement assurances increasing the number of confirmations required to be sure your transaction is finalised.
- nostrademons 6y ago
  Human beings already know how our game ends (we die), and yet we do all sorts of things on this earth in the ~80 years before that, even knowing that everything we do for ourselves becomes meaningless once we're gone. Time preferences are a thing. Lots of folks do things with a time horizon much lower than their equipment being written off. Whole companies are destroyed for quarterly earnings, relationships are destroyed for a promo that lasts only for the ~2-5 years that you've got remaining at the company, people get married even knowing that 50% of them end in divorce, parents birth children knowing that they'll leave the nest and develop their own opinions and say they don't love you and eventually die.
- doggosphere 6y ago
  The same reason they got into it in the first place; you can make money by doing it.
pjfin123 6y ago
Yeah it seems like the real defense of an obvious attack is "This Ethereum proof of stake chain with all of the wallets from right before the attack is the new Bitcoin".
- hanniabu 6y ago
  Ethereum doesn't store Bitcoin wallets. I'm assuming you mean tokenized BTC (wBTC/rBTC)?
  - webinvest 6y ago
    No, he means if something bad happens to Bitcoin, there are thousands of other cryptocurrencies for users to migrate to. However since most cryptocurrency prices are denominated in bitcoin, a crash in bitcoin historically meant a crash in all of the rest.
student2k 6y ago
No or flawed governance in bitcoin, check decred

esotericn 6y ago

In the general case I don't think that majority miner attacks can be defended against without changing the hash algorithm. Specific cases like "empty blocks" could be addressed via a hard fork. But there's nothing stopping miners from faking transactions in blocks, sending amounts to themselves, filling the block with OP_RETURNs, or just doing the minimum possible to get around your "fix". PoW absolutely relies on >50% of miners being honest, always has done.

AffableSpatula 6y ago
The purpose of this project is to challenge people to be specific about the details of that hard fork. Currently there are no theoretical proposals, or concrete BIPs to address.
safog 6y ago
Can't you do worse things if you have >50% hash power? It seems like DoS is pretty mild all things considered.
- esotericn 6y ago
  It depends how rationally the market responds, I guess. A reorg attack and a DoS are equivalent in my mind - anyone who's capable of pulling off a lengthy DoS is also capable of performing a reorg attack, whether they actually do or not is kind of irrelevant.
  - AffableSpatula 6y ago
    there is a type of reorg attack I proposed that's now been dubbed a "purge attack", that has the effect of destabalising the network by creating a window for all affected users to double spend their previously "finalised" transactions: https://medium.com/deribitofficial/destabilizing-bitcoin-consensus-with-purge-attacks-68018bf3b927 https://medium.com/deribitofficial/destabilizing-bitcoin-con...

thysultan 6y ago

For the first attack listed you'd need to be the 99% of mining power at which point the 1% could also just fork and leave you to your endeavours.

AffableSpatula 6y ago
The purpose of the project is to encourage people to be concrete in what their proposed ruleset changes are to defend the attack.
- thysultan 6y ago
  It's not an attack vector precisely because of that. Another scenario is the 1% could just then continue mining non-empty blocks from where the attacker left of which would make them the most accurate blockchain with regards to proof of work, this case is even more passive than the hard fork option if you are in sync with the attacker at the time of the attack.

atemerev 6y ago

What a great idea. The attack described there is plausible, and experimenting in the means of defence before it happens is crucial for the continuity of cryptocurrncies.

paulgb 6y ago

The linked Medium posts have a bit more content https://joekelly100.medium.com/how-to-kill-bitcoin-part-1-is-bitcoin-unstoppable-code-7a1b366f65ee https://joekelly100.medium.com/how-to-kill-bitcoin-part-1-is... Note that this is from last July, when the price of BTC was significantly lower and thus the price of the attack is likely higher now. That said, this becomes more feasible in the long-run when mining is purely funded by transaction fees. Something I don’t see talked about much is the fact that, although Bitcoin is intended to be non-inflationary in the long run, the mining network that keeps it secure is currently 80-90% subsidized by inflation.

AffableSpatula 6y ago
Hey, author here - I think you're absolutely right that there is a risk that demand for blockspace doens't generate sufficient block reward to provide useful security guarantees. If that is the case, it could cause the price of BTC to fall which could create a negative feedback loop. This would, at best, create an end of the 21m cap and at worst trigger a collapse of the game entirely.
- jpsalm 6y ago
  Yea that's what I don't understand either. Is the plan to secure a fully-mined chain just rampant value-inflation in a way that is completely detached from supply and demand? Today my 1e-1000 bitcoin is worth 10 carrots, tomorrow it is worth 20 everything else held equal? How does that even work in practice? Alternatively you need transactions to pay entirely for the security of the chain. This doesn't seem feasible when chain security costs rise everyday as the cost of energy deceases. And if transaction fees increase to compensate and people transact less the whole thing blows up.
  - wmf 6y ago
    The "official" plan is for low-value transactions to happen on the Lightning Network and high-value (e.g. >$1M) transactions paying high fees to happen on-chain.

flyGuyOnTheSly 6y ago

>There is currently no defense for this attack in Bitcoin, as the simulation demonstrates. The entire Bitcoin miner reward model is the defense for this attack. Nation states have powerful computers... but nowhere near as powerful as the decentralized Bitcoin mining network combined. Even if they did currently, the endgame for Bitcoin as envisioned by Satoshi Nakamoto was for everyone on the planet to be mining Bitcoin at the same time. If a Nation State could ever become more powerful than every single private processor on the planet combined... I think it would be game over for a lot more than just Bitcoin.

AffableSpatula 6y ago
ASIC chip fabrication is centralised in China. The government could seize the means of production, as well as the centralised mining operations that they've attracted by subsidising electricity.
- reitzensteinm 6y ago
  If a handful of governments that control fabs agree Bitcoin has to go, the efficiency of ASIC mining becomes a big threat. Governments can purchase large runs of ASICs while other mining will revert to GPU. Controlling 51% of the hash rate in this manner isn't as outlandish. Further, you're not limited to double spend attacks. If you're the government with a decent advantage, you just treat your own chain as true and never accept blocks from other miners. The reward for mining will collapse, since even if you produce a valid block it'll not be on the longest chain once government miners catch up. And once the reward for mining collapses you can probably even power down some of the ASICs. There are counter measures, but combined with attacking the financial onramps and making possession criminal, it's hard for me to believe that BTC would survive an attack like this. But of course, it's predicated on large governments agreeing it's worth seriously attacking. I don't know how likely that is.
flixic 6y ago
Nation state wouldn't need to become more powerful than all miners if most miners (more accurately, vast majority of hash power) were located in one, authoritarian country with a penchant of controlling "private" businesses.

nostrademons 6y ago

You don't need a DoS attack under the assumptions of this project. It's already assumed that you control ~80% of hash rate, so you execute a 51% attack that mass double-spends coins and destroy all confidence in the integrity of the currency. Poof, nobody uses it. Note that China already controls ~65% of Bitcoin hash rate, so if they wanted to execute this right now, they probably could. That they haven't is one reason I'm bullish on cryptocurrency, and specifically Ethereum and Stellar, and it's entirely separate from why many other Bitcoin bulls are bullish on cryptocurrency. You don't need proof-of-work to secure a blockchain. You only need game theory: as long as each participant has more to gain from allowing Bitcoin's continued existence than destroying it (and they can't subvert or destroy it in a way that will be invisible to other market participants), it will continue to exist. China gains no benefit from destroying Bitcoin; they can just continue to let it exist and tax all the Bitcoin miners in China, generating revenue for themselves and their citizens and continuing to be a thorn in the side of dollar hegemony. This also implies that proof-of-stake (if done right) is just as good as proof-of-work, which'll solve the energy issues associated with Bitcoin. And it means that cryptocurrency adoption, if it happens, isn't going to be because it's particularly good: rather, it'll be because the U.S. has destroyed the dollar. There's value in cryptocurrency simply in it being an alternative that's readily available, so that civilization doesn't stop if the U.S. does end up miscalculating and hyperinflating the dollar.

AffableSpatula 6y ago
I'm not so sure. If you don't need proof of work to secure a blockchain, then why is the free market of Bitcoin consensus continuing to expend huge amounts of capital to stick with it as its sybil resistance mechanism? If it wasn't considered a value destroying move, the transition away from PoW would've happened already no?
- nostrademons 6y ago
  It has, in new cryptocurrencies. Virtually all cryptocurrencies launched since 2017 are proof-of-stake: Cardano, EOS, Stellar, Polkadot, Tezos, TRON. Ethereum is in the process of a very expensive and painful transition from proof-of-work to proof-of-stake. The reason you haven't seen this in the global cryptocurrency industry is because of network effects and adoption curves. Most programmers would probably agree that C++ is archaic and that the software industry has moved on to newer languages like Rust, Go, Kotlin, ES6, etc. Why then do Microsoft, Amazon, Apple, Google, etc. all rely on large quantities of C++ code? Because they were founded in the last millennia, when C++ was basically the only alternative for what they were trying to do, and have deeply enmeshed ecosystems and value chains that are all dependent on their existing C++ codebase. Throw it out and you throw out the $5T+ in value they've built. They couldn't have built that up without the 20 year head start they have, but if you're founding a tech company now, you're pretty dumb to use C++. Similarly, Bitcoin has built a whole ecosystem of miners, speculators, traders, exchanges, payment systems, wallets, etc. Throw proof-of-work out and you throw all that out, and along with it your advantage over Ethereum, Cardano, Stellar, etc.

stale2002 6y ago

Ehh, this blog posts focuses way too much on technical tricks that are, in reality, not really the main risks to the bitcoin network. For example, the blog posts focuses on things like 51% attacks to either reorg the chain, or prevent transactions from being published. This is not really as big of a deal. When 51% attacks happen, it certain disrupts crypto networks in the short term. But the defenders always have the nuclear option in their back pocket, which is to change the proof of work algorithm, and force the attackers to spend a bunch of money building their attack infrastructure up again. Threats to change the POW algorithm, were thrown around during the 2017 blocksize debate, when things got really heated, and parties involved were threatened what amounted to 51% attacks. So it is already established that this is something that devs consider doing. The only real avenue of attack against crypto networks, is simply the social one. You simply arrest anyone who does anything at all related to crypto, and hope the threat of government violence is enough to make it so most people dont use crypto. Those social attacks would be the most likely to succeed, IMO, but they also have the problem of being difficult to implement. You know, because we living in a society, with a court system, and elections, and people that care about not living in a totalitarian hellscape, so any attempt by the government to simply arrest everyone, will likely be punished politically. So sure. The blog post is correct that if the government simply arrests or kills everyone who has anything to do with bitcoin, then they could stop crypto. But the counter argument to that, is such recommendations are completely out there, and extreme, and society wouldn't let that happen and would punish the people doing that. The actual attack vectors that matter, are not some fantasy land conspiracy, of every world government becoming a dictatorship. Instead, the attack vectors that matter would instead be every day bad actors, that seek to defraud people, in secret, and are not willing or able to kill/arrest everyone in the world who opposed it.

AffableSpatula 6y ago
I don't think China being a dictatorship is much of a conspiracy. That's where a lot of ASICs are deployed, as well as the majority of the fabrication of the hardware itself.
- stale2002 6y ago

trevelyan 6y ago

Distributed Proof-of-Work is not vulnerable to this: https://org.saito.tech/eliminating-51-attacks-in-proof-of-work-blockchains/ https://org.saito.tech/eliminating-51-attacks-in-proof-of-wo... The community of users simply attaches harder cryptographic proofs to their transactions, forcing up the cost of producing empty blocks. The approach is capable of bankrupting nation-states as a side-effect of eliminating 51% attacks.

nine_k 6y ago
Why won't it make transactions prohibitively expensive? Each transaction needs a trustless agreement of many, many nodes.
- Vecr 6y ago
  Not unless the block sizes down, or the block times/ block/transaction relaying latency go way up. The great firewall of China might cause some issues, but in theory it should not get worse.
- trevelyan 6y ago
  You don't need a transaction to be routed by many nodes: how quickly it propagates (and thus how quickly it gets included/confirmed) just depends on how much hashing you do before sending it. The halving penalty on work just forces attackers (who have +1 routing hop compared to honest nodes) to double the work of those honest nodes if they wish to outcompete them in producing a longer chain (i.e. no 51% attack). It also allows users to respond to attacks in real-time by affixing harder proofs to their transactions, increasing the attack-cost on the network in minutes should anyone try to pull off the sort of gambit described in the linked page.

muttantt 6y ago

My prediction is that Bitcoin will crash 50-80% in the next 12 months due to insider/rogue employee hack at Coinbase, and/or some other event that will render wallets irrecoverable or the company insolvent.

mullingitover 6y ago

There's a much simpler endgame: China starts enacting export controls on ASICs.

latchkey 6y ago
Good thing Global Foundries, Samsung and TSMC have their fabs in many countries. I'd worry about them before I'd worry about a single country.

darig 6y ago

I never understood why empty blocks is allowed... you can start immediately and get a head start over other mining pools. Granted it is just the time to load in transactions from the mempool and hash the result of appending them to the blockchain, but still... if you're in a race, why not take any advantage you can get? I've monitored the chain for years, and empty blocks are very very common. I know there is a civil war of people that want to make the block size larger vs keep it the same... I think at this point it they would both agree that every block should at least be 90%+ full before it is accepted. That seems like a simple fix. The attackers would then like just fill up the blocks passing a tiny amount of bitcoin between all their wallets, but at that point they might as well just use the mempool. In the end, if you have mining dominance, you win. No point denying that. If you want to "ban" miners, or rewrite history, bitcoin is no longer decentralized.

shivekkhurana 6y ago
The network needs a blocks every 10 minutes or so in order to mint a coinbase transaction (the tx that generates new Bitcoins). This is important to ensure that the network reaches 21million cap on time. If new blocks are not minted every 10 minutes, the calculation to reach 21million will be distorted.
- darig 6y ago
  The network adjusts the difficulty (number of prefixed 0's in the hash) based on estimated mining capacity based on a running average time to complete previous blocks. There is no "on time" to reach the 21 million cap. All those "calculations" that would be "distorted" are those of the hedge fund managers who are holding strictly out of speculation. There is no way to prove an entity hasn't been mining on the side, capable of mining blocks faster than the main chain, even keeping up with increased difficulty, and any day they could publish their chain to the network, and it would be accepted as it was the longest chain. This would obviously destroy bitcoin, so the only reason to do that would be pure terrorism. Exploiting a 51% attack to double spend would also destroy the trust, so any attacker in it for the money is currently just mining empty blocks and getting rewarded for it, and there is nothing anyone can do to stop them. Once the 21 millions coins are all in the wild, transaction fees will need to be enough to entice them to keep running... otherwise, they cash out and burn it all down. If they aren't capable of burning it all down, perhaps the number of people validating transactions on the network goes way down... and the difficulty goes way down... until eventually all those old people from the mining days could turn their machines back on one day for a much easier 51% that they are now capable of. The whole thing is a mess.

Geee 6y ago

The defense is that there are thousands of other cryptocurrencies that would take Bitcoin's place. So the attackers wouldn't gain anything in the end.

kasparkallas 6y ago
What if the attacker is invested in other cryptocurrencies? Think outside the box.
- Geee 6y ago
  Governments are the only entities who could try to attack Bitcoin if they collaborated. The only motivation would be to stop the network, not to make gains in other cryptocurrencies.
FridgeSeal 6y ago
Oh cool so my magical internet money that I’m meant to use as my main currency is essentially untrustworthy as an actual store of value, because I’m supposed to keep migrating to whatever the hasn’t-had-a-51%-attack-yet flavour of the month currency is?
- Geee 6y ago
  You missed the point.

unyttigfjelltol 6y ago

The entire multi-billion BTC ecosystem is built on software that still hasn't reached "Version 1.0"? Bitcoin Core 0.21? A development beta? LOL.

xiphias2 6y ago
It may be 0.21 but it is one of the best reviewed software in tbe worls for security issues. Also there's a trillion dollar bounty especially on the public signature infrastructure.
hiimtroymclure 6y ago
what on earth does choice of versioning have to do with anything. React Native isn't at 1.0 and tons of companies use it. Google releases versions/APIs of their software with tons of bugs.
JohnJamesRambo 6y ago
If only other software was rated this accurately. What would the Cyberpunk game release be? 0.01?
jwblackwell 6y ago
Get in now while it's still early!
owenversteeg 6y ago
Fun side note - as of today, that's actually the one trillion dollar BTC ecosystem.

davidw 6y ago

> via a wargame Oh, I know, I know! "The only winning move is not to play"

AffableSpatula 6y ago
:)
sillysaurusx 6y ago
I recently watched that on YouTube. Sadly, it's private now: https://www.youtube.com/watch?v=HNLQ-O-Qx3Y&ab_channel=YouTubeMovies https://www.youtube.com/watch?v=HNLQ-O-Qx3Y&ab_channel=YouTu... The movie still holds up today, which I didn't expect. It gets pretty dumb at times, but no dumber than a Michael Bay flick.

statquontrarian 6y ago

Is it fair to say this is a subset of the general problem of majoritary-consensus networks (which includes PoW, PoS, PoA, PoR, PoET, and PoTS cryptocurrencies)? https://doi.org/10.1109/COMST.2020.2969706 https://doi.org/10.1109/COMST.2020.2969706

mshumi 6y ago

BTC fork using Algorand consensus. Same bitcoin, same LEDGER, but the consensus technology is vastly superior. Why willfully ignore 10 years of advances in cryptography and distributed computing.

FridgeSeal 6y ago
For presumably the same reason the crypto-currency community in general will fully disregards decades on decades of economic theory and experience to pursue a libertarian wet dream?

asdffdsa 6y ago

Assuming that the Chinese government can exercise control of the top 5 Chinese companies that control > 50% of the hash rate, what's stopping the Chinese government from corrupting the blockchain? E.g. only transactions from whitelisted wallet ids (e.g. CCP-approved institutions) go through, extortion, etc.

narrator 6y ago
The rest of the network could fork the chain to "NOCCP" chain or whatever. There are also a lot of other cryptocurrencies out there now.

lamontcg 6y ago

There's a way simpler endgame: We hit the peak of the bubble and people start pulling money out and it unwinds in a systemic bank panic.

giantandroids 6y ago
That is possible, but it's also possible for any store of value , gold , fiat, stocks..
- lamontcg 6y ago
  Stocks are held up because they do have a grounding in the value of the corporations in the broader economy. For their value to go to zero everyone would have to pull out of the broad economy, stop buying manufactured goods and go back to farming their land. There are a huge number of incentives that make it extraordinarily difficult for people to just wake up one day and pull out of the economy, stocks and USD. There's literally no such incentives for crypto. Nobody has to buy into crypto or they can't buy food or cars or homes or pay their taxes or anything else. Opting out of crypto is very easy, opting out of the US economy is very hard.
- audunw 6y ago
  It’s crazy that some people seriously think Bitcoin is anything like these stores of value. All these are ties to some fundamental value to society. If gold goes down, manufacturing will buy more of it because they use them for ICs and lots of other things. Most companies have some tangible assets behind them. If a stocks price goes far enough down someone might buy up a controlling stake and liquidate all the assets. A fiat currency in a functional state is generally strongly tied to borrowing for real physical assets. It’s deeply entangled with the economy. There is no bottom for Bitcoin. Especially now that it’s not a very viable currency for most purchases or for lending. What’s more, value is continually being extracted from the currency. People cashing out and payments to miners (who are basically just burning a lot of the money they make by converting electricity to heat without doing much useful work). In gold or stocks the money put in actually exists in something valuable to society, and you own a piece of that. The the value might be boosted up 2-10x its real value today, perhaps due to its perceived future value. But you do own a piece of something tangible. With Bitcoin, the money you put in is already gone. Used by a miner to pay for electricity or an early miner/purchaser who is now cashing out to buy an apartment. You just gotta pray that a few years down someone is willing to buy bitcoins from you for its perceived value alone. Because nobody is going to buy it for any other reason. Not to make something out of it (gold), not to liquidate the assets behind it (stocks), and not to pay taxes or pay back their mortgage (fiat currencies) There’s so much utter insane and thinking around cryptocurrency these days. Especially Bitcoin. It’s madness. I mean, it’s a super cool tech. But I think that blinds a lot of people to the facts around it.

x1000 6y ago

An interesting aspect of these cryptocurrencies is the aspect of consensus, not through the intended mechanisms like PoW, but through societal acceptance. Look at BTC and BTG (bitcoin and bitcoin gold). One has the suffix of "gold" while the other maintains the (arguably?) superior lack of any such embellishments/augmentations. Was it the miner's decision to call it that? Was it the users? Look at Ethereum v Ethereum classic. Same deal. We have two chains that share a common history, yet at some point the users of both decided to split and then society had to come to a consensus on what each chain would be called. Again, did the miners sit around and conspire to which chain would be called "Ethereum?" I don't think so. I think the decision was decentralized and emergent. My point is, even if there was a nefarious actor who attempted a 51% attack, it seems like there would be enough of a societal pressure to ignore their empty blocks. There would exist a chain that would still be valued by the perpetrators, but not so much by the individuals being harmed by such an attack. The attacked chain would be maintained and acquire a new name "Bitcoin Hacked" or something similar, and the chain where society ignores the empty blocks would go on its merry way still being called "bitcoin."

habitue 6y ago
I take the point you're making (in principle, there is some off-chain consensus at work here), but for these particular examples I believe society didn't decide these names as much as the people deciding to do the forks did.

kaonashi 6y ago

if a nation-state wanted to attack btc, they'd simply make transactions between its currency and btc illegal, and prosecute citizens and exchanges which transact with its citizens