An Analysis of Attacks on Blockchain Consensus

Abstract

We present and validate a novel mathematical model of the blockchain mining process and use it to conduct an economic evaluation of the double-spend attack, which is fundamental to all blockchain systems. Our analysis focuses on the value of transactions that can be secured under a conventional double-spend attack, both with and without a concurrent eclipse attack. We account for an attacker capable of increasing profits by targeting multiple merchants simultaneously. Our model quantifies the importance of several factors that determine the attack's success, including confirmation depth, attacker mining power, and a confirmation deadline set by the merchant. In general, the security of a transaction against a double-spend attack increases roughly logarithmically with the depth of the block, made easier by the increasing potential profits, but more difficult by the increasing proof of work required. We find that a merchant requiring a single confirmation is protected against attackers that possess as much as % of the mining power, but only provided that the total value of goods at risk for double-spend is less than BTC. A merchant that requires a much longer confirmations (≈ hours) will prevent an attacker from breaking even unless he possesses more than 35% of the current mining power, or the value of goods at risk exceeds M BTC.

SoK: Oracles from the Ground Truth to Market Manipulation

“…Other consensus attacks [12,53,58] exist but are less related to oracles. We omit discussion of them.…”

Characterizing Cryptocurrency Exchange Scams

“…Most of them were focused on detecting the ponzi schemes [12,13,16]. Besides, a large number of studies focused on detecting and analyzing attacks from different levels, including blockchain consensus [14], smart contract [11], abnormal transactions [15,18], etc. Despite cryptocurrency exchanges are the key infrastructure of the blockchain ecosystem, however, the security-related issues, including the scam problem studied in this work, have not been well-studied yet.…”

“…The benefit is usually a portion of commission fee, depending on the referral rules of different exchanges 13 . Figure 12(4) is a code snippet of a Bithumb trojan app 14 . As highlighted in the decompiled code, it will collect users' text messages, contracts, and call logs secretly, and then upload them to http://bithumbinback.pro/, which was the attacker's private server.…”

On Profitability of Nakamoto double spend

“…We will answer this question in a forthcoming article. In [3], the authors study the profitability of a double-spend attack with a cut-off time strategy, S z+1 ∧ S z+1 (in our notation). In [14] the authors consider a fixed cut-off time (in case of failure, the attack ends at a fixed time).…”