[dmichulke]

So you're saying they just accept a block because it's in the longest chain and don't check for double-spends? I have a hard time believing that given that cost for checking should be extremely low relative to creating a valid block.

Never checked the source though

[lawn]

No, they do check for double-spends, but the transactions you reverse are now in the shorter chain and no longer exist in the history when you follow the longest chain.

Say for example you have these blocks:

    b1 <- b2 <- b3

And you have a transaction t in b2 that you want to reverse. Then you build another chain starting with b1 like so:

    b1 <- b2' <- b3' <- b4'

Where you double-spend t in b2'. The miners thinks that both b2 and b2' are valid. When they choose to switch from the b2 chain to the b2' chain, it will seem like all transactions in b2 and b3 just disappear (unless included in the other chain of course).

Does that make sense?

[dmichulke]

Yes it does. So you spend once in b2 and once in b2'.

Assuming 6 blocks of confirmation the attack is then:

1. Spend in b2, create blocks until b8.

2. Switch the chain to b2', spend again there and run with it until bX' > bX.

Assuming 6 blocks of confirmation and 51% hash power, you'll lose a lot of money in the process (it'll take ages until bX' > bX [1]) so it better be worth it. Also, you can probably estimate the risk of this happening via the transaction volume in the block. The higher, the more valuable a double spend would be.

[1] Assuming 6 blocks à 10 minutes and you achieving 51%/49% ~ 4% more hashpower, such an attack costs you 25h (150 blocks) so at the very least 150x3.75x51% ~ 286 BTC in opportunity cost plus equipment plus electricity plus the risk that someone switches on his new nodes and your 51% become only 50%.

The cost regarding your equipment will also be full purchase price because if you succeed, you ruin bitcoin and your equipment value becomes 0 with your attack.

[RcouF1uZ4gsC]

> because if you succeed, you ruin bitcoin and your equipment value becomes 0 with your attack.

This would be a feature not a bug if you are the government trying to undermine bitcoin.

[andirk]

Both are true. If you took over BTC you'd be inclined to keep it in tact else it's worthless currency-wise. But an entity can theoretically take over bitcoin to make it worthless.