3 ms·

Unless I'm missing something, this doesn't pass the sniff test. If a 51% attack was successful, every other miner could easily spot this and would stop mining.

Unless I'm missing something, this doesn't pass the sniff test. If a 51% attack was successful, every other miner could easily spot this and would stop mining. The fact that this has not happened is more trustworthy than a random guy on Twitter.

immibis 1y ago
Why would every other miner stop mining, making it a 100% attack? Yesterday I was running a Monero node and looking at it, and got an unusually very high number of chain reorganization messages. I could believe a 51% attack happened.
- corimaith 1y ago
  A network might collectively just fork the chain and blacklist the attacker in that fork.
  - jadamson 1y ago
    That isn't possible - miners don't have an "identity" to blacklist.
    - im3w1l 1y ago
      You could do it with a whitelist. If there is a fork, give disproportionate weight to blocks mined by a whitelisted participant when doing the longest-chain calculation. Ideally you should include the proof of being on the whitelist in the block itself, but if that's not possible for some reason you could always send the information off-chain.
      - jadamson 1y ago
        That's centralization, which is the opposite of what's intended and has its own risks. Most blocks are mined by pools, so you'll have to whitelist them, and while you might trust the pool operators now, will you forever? You'll be making the cost of an attack significantly cheaper for them (or someone who steals their magic key, or tricks you into adding them to the blessed list).
        im3w1l 1y ago
        I agree that it is not ideal. But addressing some of the specific point brought up: 1. a) The list doesn't need to be hardcoded, it could be a configuration. b) So trust doesn't need to be permanent. c) It could be decentralized in the sense of allowing different people to have configs 2. Miners not on the list can still participate just with lower weight in the case of a fork. And they still get full reward.
        jadamson 1y ago
        1. A cryptocurrency requires consensus, so no, you can't have different configs for determining the validity of a chain. Making it a config variable only makes it faster to close the barn door after the horse has bolted. 2. Has no bearing on any point I made. What will likely happen is a PoS BFT layer on top of PoW, although there are other options being considered: https://github.com/monero-project/research-lab/issues/136 https://github.com/monero-project/research-lab/issues/136
        im3w1l 1y ago
        As long as people eventually reach the same conclusion about which chain is the legit one it's fine that they use different reasoning to arrive at that conclusion. If they fail to ever converge there is probably such a large disagreement in the community that a fork is for the best anyway.
        jadamson 1y ago
        > As long as people eventually reach the same conclusion about which chain is the legit one it's fine What? No, it very much it isn't. Consensus needs to be ongoing, within a handful of blocks (Monero locks transfers for 10 blocks for this reason, called "confirmations"). https://en.wikipedia.org/wiki/Double-spending#Decentralized_digital_currencies https://en.wikipedia.org/wiki/Double-spending#Decentralized_... https://www.getmonero.org/get-started/accepting/ https://www.getmonero.org/get-started/accepting/
      - treyd 1y ago
        If you're doing a whitelist of trusted parties you might as well do classical BFT without the mining.
treyd 1y ago
Unless the attacker was actively choosing to exploit the 51% hashrate power they have then it would still make economic sense for remaining minority miners to keep mining.

immibis 1y ago

Why would every other miner stop mining, making it a 100% attack? Yesterday I was running a Monero node and looking at it, and got an unusually very high number of chain reorganization messages. I could believe a 51% attack happened.

corimaith 1y ago
A network might collectively just fork the chain and blacklist the attacker in that fork.
- jadamson 1y ago
  That isn't possible - miners don't have an "identity" to blacklist.
  - im3w1l 1y ago
    You could do it with a whitelist. If there is a fork, give disproportionate weight to blocks mined by a whitelisted participant when doing the longest-chain calculation. Ideally you should include the proof of being on the whitelist in the block itself, but if that's not possible for some reason you could always send the information off-chain.
    - jadamson 1y ago
      That's centralization, which is the opposite of what's intended and has its own risks. Most blocks are mined by pools, so you'll have to whitelist them, and while you might trust the pool operators now, will you forever? You'll be making the cost of an attack significantly cheaper for them (or someone who steals their magic key, or tricks you into adding them to the blessed list).
      - im3w1l 1y ago
        I agree that it is not ideal. But addressing some of the specific point brought up: 1. a) The list doesn't need to be hardcoded, it could be a configuration. b) So trust doesn't need to be permanent. c) It could be decentralized in the sense of allowing different people to have configs 2. Miners not on the list can still participate just with lower weight in the case of a fork. And they still get full reward.
        jadamson 1y ago
        1. A cryptocurrency requires consensus, so no, you can't have different configs for determining the validity of a chain. Making it a config variable only makes it faster to close the barn door after the horse has bolted. 2. Has no bearing on any point I made. What will likely happen is a PoS BFT layer on top of PoW, although there are other options being considered: https://github.com/monero-project/research-lab/issues/136 https://github.com/monero-project/research-lab/issues/136
        im3w1l 1y ago
        As long as people eventually reach the same conclusion about which chain is the legit one it's fine that they use different reasoning to arrive at that conclusion. If they fail to ever converge there is probably such a large disagreement in the community that a fork is for the best anyway.
        jadamson 1y ago
        > As long as people eventually reach the same conclusion about which chain is the legit one it's fine What? No, it very much it isn't. Consensus needs to be ongoing, within a handful of blocks (Monero locks transfers for 10 blocks for this reason, called "confirmations"). https://en.wikipedia.org/wiki/Double-spending#Decentralized_digital_currencies https://en.wikipedia.org/wiki/Double-spending#Decentralized_... https://www.getmonero.org/get-started/accepting/ https://www.getmonero.org/get-started/accepting/
    - treyd 1y ago
      If you're doing a whitelist of trusted parties you might as well do classical BFT without the mining.

treyd 1y ago

Unless the attacker was actively choosing to exploit the 51% hashrate power they have then it would still make economic sense for remaining minority miners to keep mining.