Double spend races

TL;DR

This paper refines the analysis of double spend attacks in Bitcoin, providing a precise probability formula, correcting previous assumptions, and offering a more detailed risk assessment based on confirmation counts and validation times.

Contribution

It corrects Nakamoto's original double spend analysis, introduces a closed-form probability formula, and offers an asymptotic approximation for better risk evaluation.

Findings

Probability of double spend success decreases exponentially with confirmations.

Larger confirmation counts are needed than previously estimated.

Conditional probability analysis improves risk assessment accuracy.

Abstract

We correct the double spend race analysis given in Nakamoto's foundational Bitcoin article and give a closed-form formula for the probability of success of a double spend attack using the Regularized Incomplete Beta Function. We give a proof of the exponential decay on the number of confirmations, often cited in the literature, and find an asymptotic formula. Larger number of confirmations are necessary compared to those given by Nakamoto. We also compute the probability conditional to the known validation time of the blocks. This provides a finer risk analysis than the classical one.

Equations

$$P(z)=I_{4pq}(z,1/2)\$$

$$I_x(a,b)=\frac{\Gamma (a+b)}{\Gamma (a)\Gamma (b)}{\int }_0^x{t}^{a-1}(1-t{)}^{b-1}dt.$$

$$\begin{array}[]{|c||c|c|c|c|c|c|c|c|}\hline\cr q&0.10&0.15&0.20&0.25&0.30&0.35&0.40&0.45\\ \hline\cr z&6&9&13&20&32&58&133&539\\ \hline\cr z_{SN}&5&8&11&15&24&41&81&340\\ \hline\cr\end{array}$$

$$P(z)\sim \frac{s^z}{\sqrt{\pi (1-s)z}}.$$

$$P_{SN}(z)\sim \frac{e^{-zc(\lambda )}}{2}$$

$$\kappa =\frac{{\tau }_1}{z{t}_0},$$

$$P_{SN}(z)=P(z,1),$$

$$P(z)={\int }_0^{+\infty }P(z,\kappa )d{\rho }_z(\kappa ),$$

$$d{\rho }_z(\kappa )=\frac{z^z}{(z-1)!}{\kappa }^{z-1}{e}^{-z\kappa }d\kappa .$$

$$P(z,\kappa )=1-Q(z,\kappa zq/p)+{\left(\frac{q}{p}\right)}^z{e}^{\kappa z\frac{p-q}{p}}Q(z,\kappa z).$$

$$Q(s,x)=\frac{\Gamma (s,x)}{\Gamma (x)},$$

$$\Gamma (s,x)={\int }_x^{+\infty }{t}^{s-1}{e}^{-t}dt$$

$$P(z,\kappa )\sim \frac{1}{1-\kappa \lambda }\frac{1}{\sqrt{2\pi z}}{e}^{-zc(\kappa \lambda )}.$$

$$P(z,1)=P_{SN}(z)\sim \frac{1}{2}{e}^{-zc(\lambda )}.$$

$$P(z,\kappa )\sim \frac{\kappa (1-\lambda )}{(\kappa -1)(1-\kappa \lambda )}\frac{1}{\sqrt{2\pi z}}{e}^{-zc(\kappa \lambda )}.$$

$$P(z,p/q)-1/2\sim \frac{1}{2\pi z}\left(\frac{1}{3}+\frac{q}{p-q}\right).$$

$$1-P(z,\kappa )\sim \frac{\kappa (1-\lambda )}{(\kappa -1)(\kappa \lambda -1)}\frac{1}{\sqrt{2\pi z}}{e}^{-zc(\kappa \lambda )}.$$

$$z_0^{\ast }=\max \left(\frac{2}{\pi (1-q/p{)}^2},\frac{1}{2\sqrt{2}}-\frac{\left(1+\frac{1}{\sqrt{2}}\right)}{2}\frac{\log \left(\frac{2\psi (p)}{\pi }\right)}{\psi (p)}\right)$$

$$\mathbb{P}[\mathbf{T}>t_1+t_2|T>t_2]=\mathbb{P}[\mathbf{T}>t_1].$$

$$\mathbb{P}[\mathbf{T}>t_1+t_2]=\mathbb{P}[\mathbf{T}>t_1+t_2|T>t_2].\mathbb{P}[\mathbf{T}>t_2]=\mathbb{P}[\mathbf{T}>t_1].\mathbb{P}[\mathbf{T}>t_2].$$

$$f_{\mathbf{T}}(t)=\alpha e^{-\alpha t}$$

$${\mathbf{S}}_n={\mathbf{T}}_1+\dots +{\mathbf{T}}_n$$

$$f_{{\mathbf{S}}_n}(t)=\frac{{\alpha }^n}{(n-1)!}{t}^{n-1}{e}^{-\alpha t},$$

$$F_{{\mathbf{S}}_n}(t)={\int }_0^t{f}_{{\mathbf{S}}_n}(u)du=1-e^{-\alpha t}\sum _{k=0}^{n-1}\frac{(\alpha t{)}^k}{k!}.$$

$$\mathbf{N}(t)=\#\{k\ge 1;{\mathbf{S}}_k\le t\}=\max \{n\ge 0;{\mathbf{S}}_n<t\}.$$

$$\mathbb{P}[\mathbf{N}(t)=n]=F_{{\mathbf{S}}_n}(t)-F_{{\mathbf{S}}_{n+1}}(t)=\frac{(\alpha t{)}^n}{n!}{e}^{-\alpha t},$$

$$q_n=(q/p{)}^n.$$

$$q_n=q{q}_{n-1}+p{q}_{n+1},$$

$$\mathbb{P}[{\mathbf{T}}^{\prime }<\mathbf{T}]=\frac{{\alpha }^{\prime }}{\alpha +{\alpha }^{\prime }},$$

$$p$$

Full text

To the memory of our beloved teacher André Warusfel who taught us how to have fun with the applications of mathematics.

1. Introduction.

The main breakthrough in [Nakamoto 2008] is the solution to the double spend problem. Before this discovery no one knew how to avoid the double spending of an electronic currency unit without the supervision of a central authority. This made Bitcoin the first form of peer-to-peer (P2P) electronic currency.

A double spend attack can only be attempted with a substantial fraction of the hashrate used in the proof-of-work of the Bitcoin network. The attackers will start a double spend race against the rest of the network to replace the last blocks of the blockchain by secretly mining an alternate blockchain. The last section of the Bitcoin’s white paper [Nakamoto 2008] computes the probability that the attackers catch up. However Nakamoto’s analysis is not accurate since he makes the simplifying assumption that honest miners validate blocks at the expected rate. We present a correct analysis and give a closed-form formula for the exact probability.

Theorem 1**.**

Let $0<q<1/2$, respectively $p=1-q$, be the relative hash power of the group of the attackers, respectively of honest miners. After $z$ blocks have been validated by the honest miners, the probability of success of the attackers is

[TABLE]

where $I_{x}(a,b)$ is the regularized incomplete beta function

[TABLE]

In general, for $z\geq 2$, these probabilities $P(z)$ are larger than those $P_{SN}(z)$ obtained by Nakamoto. From the standpoint of bitcoin security, this shows than larger confirmation times $z$ are necessary compared to those $z_{SN}$ given by Nakamoto, in particular this happens when the share of hashrate $q$ of the attackers is important. The following table shows the number $z$ of confirmations to wait compared to those $z_{SN}$ given by Nakamoto for an attacking hashrate of $10\%$ (or $q=0.1$) and a probability of success of the attackers less than $0.1\%$.

[TABLE]

Table 1. Comparison of number of confirmations.

Nakamoto claims in [Nakamoto 2008] that the probability $P(z)$ converges exponentially to [math] with $z$. This result is intuitively expected and cited at large but there is no proof available in the literature. We give here a rigorous proof of this result. More precisely we give precise asymptotics both for $P_{SN}(z)$ and $P(z)$ showing the exponential decay.

Theorem 2**.**

When $z\to+\infty$ we have , with $s=4pq<1$,

[TABLE]

and with $\lambda=q/p$, and $c(\lambda)=\lambda-1-\log\lambda>0$,

[TABLE]

We can check that $-\log s>c(\lambda)$ which means that $P_{SN}(z)\prec P(z)$ for $z$ large.

A finer risk analysis.

We analyze a new parameter in the risk of a double spend. The probability of success of the attackers increases with the time $\tau_{1}$ it takes to validate the $z$ transactions since they have more time to secretly mine their alternate blockchain. On the other hand the task of the attackers is more difficult if the validations happen faster than the expected time. The value of $\tau_{1}$ is known, therefore what is really relevant is the conditional probability assuming $\tau_{1}$ is known. We introduce the dimensionless parameter $\kappa$ which measures the deviation from average time:

[TABLE]

where $t_{0}$ is the average time of block validation by honest miners ($t_{0}=\tau_{0}/p$, where $\tau_{0}=10\,{\hbox{\rm min}}$ for the Bitcoin network).

Figure 1. Probability of success as a function of $\kappa$ with $q=0.1$

We study the probability $P(z,\kappa)$ of success of the attackers. We can recover the previous probabilities with the $P(z,\kappa)$, $0<\kappa<1$.

Theorem 3**.**

We have

[TABLE]

and

[TABLE]

with the density function

[TABLE]

We give a closed-form formula for $P(z,\kappa)$.

Theorem 4**.**

We have

[TABLE]

Here $Q$ denotes the incomplete gamma function

[TABLE]

where

[TABLE]

We find also the asymptotics for $z\to+\infty$ for different values of $\kappa$.

Theorem 5**.**

The following hold for $z\to+\infty$,

1. (1)

For $0<\kappa<1$,

[TABLE] 2. (2)

For $\kappa=1$,

[TABLE] 3. (3)

For $1<\kappa<p/q$,

[TABLE] 4. (4)

For $\kappa=p/q$, $P(z,p/q)\to 1/2$ and

[TABLE] 5. (5)

For $p/q<\kappa$, $P(z,\kappa)\to 1$ and

[TABLE]

Using a concavity argument we show that $P(1)\leq P_{SN}(1)$, but in general, for $z\geq z_{0}$, we have $P_{SN}(z)\leq P(z)$. We do compute an explicit, non sharp, value $z_{0}$ for which this inequality holds:

Theorem 6**.**

Let $z\in{\mathbb{N}}$. A sufficient condition for having $P_{SN}(z)<P(z)$ is $z\geq z_{0}$ with $z_{0}=\lceil z_{0}^{*}\rceil$ being the smallest integer greater or equal to

[TABLE]

where $\psi(p)=\frac{q}{p}-1-\log\left(\frac{q}{p}\right)-\log\left(\frac{1}{4pq}\right)>0$.

We also provide a double entry tables of the $P(z,\kappa)$ for different values of $(q,\kappa)$ for $z=3$ and $z=6$. For a complete set of tables for $z=1,2,\ldots 9$ of practical use we refer to the companion article [Grunspan & Pérez-Marco 2017].

2. Mathematics of mining.

We review some basic results in probability (see [Feller 1971] vol.2, p.8) and of Bitcoin mining (see [Pérez-Marco 2016] for an overview of Bitcoin protocol).

A hashing algorithm digest any file into a fixed length string of bits. The slightiest modification of the original file produces a completely different output. The bits of the output appear with a random frequency and it is computationnally hard to find collisions (different inputs yielding the same output). Hashing algorithms are used for example to check the integrity and non-tampering of files.

The two main hashing algorithms used in the Bitcoin protocol are RIPEMD-160 and SHA-256 that produce outputs of $160$ and $256$ bits respectively. The mining algorithm consists in performing the double SHA-256 of the block header (doubled to prevent “padding attacks”).

The consensus protocol and security in the Bitcoin network relies on the process of bitcoin mining and validating transactions. It consists on the iteration of computation of block header hashes changing a nonce 222More precisely, a double hash SHA256(SHA256(header)) is computed, changing a nonce and an extra-nonce. in order to find a hash below a predefined threshold, the difficulty [Nakamoto 2008]. For each new hash the work is started from scratch, therefore the random variable $\boldsymbol{T}$ measuring the time it takes to mine a block is memoryless, which means that for any $t_{1},t_{2}>0$

[TABLE]

Therefore we have

[TABLE]

This equation and a continuity argument determines the exponential function and implies that $\boldsymbol{T}$ is an exponentially distributed random variable:

[TABLE]

for some parameter $\alpha>0$, the mining speed, with $t_{0}=1/\alpha={\mathbb{E}}[\boldsymbol{T}]$.

If $({\boldsymbol{T}}_{1},\ldots,{\boldsymbol{T}}_{n})$ is a sequence of independent identically distributed exponential random variables (for example ${\boldsymbol{T}}_{k}$ is the mining time of the $k$-th block), then the sum

[TABLE]

is a random variable following a gamma density with parameters $(n,\alpha)$ (obtained by convolution of the exponential density):

[TABLE]

and cumulative distribution

[TABLE]

We define the random process ${\boldsymbol{N}}(t)$ as the number of mined blocks at time $t$. Setting $S_{0}=0$, we have

[TABLE]

Since ${\boldsymbol{N}}(t)=n$ is equivalent to ${\boldsymbol{S}}_{n}\leq t$ and ${\boldsymbol{S}}_{n+1}>t$ we get

[TABLE]

which means that ${\boldsymbol{N}}(t)$ has a Poisson distribution with expectation $\alpha t$.

3. Mining race.

We consider the situation described in section 11 of [Nakamoto 2008] where a group of attacker miners attempts a double spend attack. The attacker group has a fraction $0<q<1/2$ of the total hash rate, and the rest, the honest miners, has a fraction $p=1-q$. Thus the probability that the attackers find the next block is $q$ while the probability for the honest miners is $p$. Nakamoto computes the probability for the attackers to catch up when $z$ blocks have been mined by the honest group. In general to replace the chain mined by the honest miners and succeed a double spend the attackers need to mine $z+1$ blocks, i.e. to mine a longer chain. In the analysis it is assumed that we are not near an update of the difficulty which remains constant 333The difficulty is adjusted every 2016 blocks..

The first discussion in section 11 of [Nakamoto 2008] is about computing the probability $q_{z}$ of the attacker catching up when they lag by $z$ blocks behind the honest miners. The analysis is correct and is similar to the Gamblers Ruin problem. We review this.

Lemma 3.1**.**

Let $q_{n}$ be the probability of the event $E_{n}$, “catching up from $n$ blocks behind”. We have

[TABLE]

Proof.

Note that after one more block has been mined, we have for $n\geq 1$,

[TABLE]

and the only solution to this recurrence with $q_{0}=1$ and $q_{n}\to 0$ is $q_{n}=(q/p)^{n}$ (see [Feller 1971]).

∎

We consider the random variables ${\boldsymbol{T}}$ and ${\boldsymbol{S}}_{n}$, resp. ${\boldsymbol{T}}^{\prime}$ and ${\boldsymbol{S}}^{\prime}_{n}$, associated to the group of honest, resp. attacker, miners. And also consider the random Poisson process ${\boldsymbol{N}}(t)$, resp. ${\boldsymbol{N}}^{\prime}(t)$. The random variables ${\boldsymbol{T}}$ and ${\boldsymbol{T}}^{\prime}$ are clearly independent and have exponential distributions with parameters $\alpha$ and $\alpha^{\prime}$. We have

[TABLE]

so

[TABLE]

Moreover, $\inf({\boldsymbol{T}},{\boldsymbol{T}}^{\prime})$ is an exponentially distributed random variable with parameters $\alpha+\alpha^{\prime}$ which represents the mining speed of the entire network, honest and attacker miners together. The Bitcoin protocol is calibrated such that $\alpha+\alpha^{\prime}=\tau_{0}$ with $\tau_{0}=10\,{\hbox{\rm min}}$. So we have

[TABLE]

These results can also be obtained in the following way. The hash function used in bitcoin block validation is $h(x)=\hbox{\rm{SHA256}}(\hbox{\rm{SHA256}}(x))$. The hashrate is the number of hashes per second performed by the miners. At a stable hashrate regime, the average time it takes to validate a block by the network is $\tau_{0}=10\ {\hbox{\rm min}}$. If the difficulty is set to be $d\in(0,2^{256}-1]$, we validate a block when $h(BH)<d$, where $BH$ is the block header. The pseudo-random output of SHA256 shows that we need to compute an average number of $m=2^{256}/d$ hashes to find a solution. Let $h$, resp. $h^{\prime}$, be the hashrates of the honest miners, resp. the attackers. The total hashrate of the network is $h+h^{\prime}$, and we have

[TABLE]

Let $t_{0}$, resp. $t^{\prime}_{0}$, be the average time it takes to validate a block by the honest miners, resp. the attackers. We have

[TABLE]

and from this we get that $\tau_{0}$ is half the harmonic mean of $t_{0}$ and $t^{\prime}_{0}$,

[TABLE]

and also

[TABLE]

Going back to the Poisson distribution parameters, we have

[TABLE]

and we recover the relations

[TABLE]

4. Nakamoto’s analysis.

Once the honest miners mine the $z$-th block, the attackers have mined $k$ blocks with a probability computed in the next section (Proposition 5.1). If $k>z$, then the attackers chain is adopted and the attack succeeds. Otherwise the probability they catch up is $(q/p)^{z}$ as computed above, therefore the probability $P$ of success of the attack is

[TABLE]

Then Nakamoto makes the simplifying assumption that the blocks have been mined according to average expected time per block. This is asymptotically true when $z\to+\infty$ but false otherwise. More precisely, he approximates ${\boldsymbol{N}}^{\prime}({\boldsymbol{S}}_{z})$ by ${\boldsymbol{N}}^{\prime}(t_{z})$ where

[TABLE]

As we have seen above, the random variable ${\boldsymbol{N}}^{\prime}(t_{z})$ follows a Poisson distribution with parameter

[TABLE]

The final calculus in [Nakamoto 2008] is then

[TABLE]

However, this analysis is not correct since ${\boldsymbol{N}}^{\prime}({\boldsymbol{S}}_{z})\not={\boldsymbol{N}}^{\prime}(t_{z})$.

5. The correct analysis.

Let ${\boldsymbol{X}}_{n}={\boldsymbol{N}}^{\prime}({\boldsymbol{S}}_{n})$ be the number of blocks mined by the attackers when the honest miners have just mined the $n$-th block. We compute the distribution for ${\boldsymbol{X}}_{n}$.

Proposition 5.1**.**

The random variable ${\boldsymbol{X}}_{n}$ has a negative binomial distribution with parameters $(n,p)$, i.e. for $k\geq 0$,

[TABLE]

Proof.

Let $k\geq 0$. We have that ${\boldsymbol{N}}^{\prime}$ and ${\boldsymbol{S}}_{n}$ are independent, therefore

[TABLE]

∎

Thus, contradicting to Nakamoto’s claim, we have proved that the distribution of ${\boldsymbol{X}}_{n}$ is not a Poisson law with parameter $nq/p$. Rosenfeld [Rosenfeld 2014] noticed the inacuracy of Nakamoto’s approximation and proposed empirically the negative binomial distribution as a better approximation, not realizing that this was the exact distribution444From [Rosenfeld 2014]. “We will not use this assumption (Nakamoto’s one), but rather model $m$ more accurately as a negative binomial variable”, and from [Rosenfeld 2012] “Instead of a Poisson distribution, I used a more accurate negative binomial distribution.”. Only asymptotically we have convergence to the Poisson distribution:

Proposition 5.2**.**

In the limit $n\to+\infty$, $q\to 0$, and $l_{n}=nq/p\to\lambda$ we have:

[TABLE]

Proof.

We have

[TABLE]

and the result follows using $\left(1+\frac{l_{n}}{n}\right)^{n}\rightarrow e^{\lambda}$. ∎

We can now compute the probability of success of the attackers catching up a longer chain. This computation was previously done in [Rosenfeld 2014].

Proposition 5.3**.**

(Probability of success of the attackers) The probability of success by the attackers after $z$ blocks have been mined by the honest miners is

[TABLE]

Proof.

As explained before, we have

[TABLE]

∎

Figure 2. Nakamoto’s and real probability

Numerical application.

Converting to R code, given $0<q<1/2$ and $z\geq 0$, this simple function computes our probability $P(z)$:

prob<-function(z,q){

p=1-q;

sum=1;

for (k in 0:(z-1)) {sum=sum-(p^zq^k-q^zp^k)*choose(k+z-1,k)} ;

return(sum)

}

We can compare with the probability $P_{SN}$ computed in [Nakamoto 2008].

$z$ $P(z)$ $P_{SN}(z)$

[math] $1.0000000$ $1.0000000$

$1$ $0.2000000$ $0.2045873$

$2$ $0.0560000$ $0.0509779$

$3$ $0.0171200$ $0.0131722$

$4$ $0.0054560$ $0.0034552$

$5$ $0.0017818$ $0.0009137$

$6$ $0.0005914$ $0.0002428$

$7$ $0.0001986$ $0.0000647$

$8$ $0.0000673$ $0.0000173$

$9$ $0.0000229$ $0.0000046$

$10$ $0.0000079$ $0.0000012$

Table 2. Probabilities for $q=0.1$.

$z$ $P(z)$ $P_{SN}(z)$

[math] $1.0000000$ $1.0000000$

$5$ $0.1976173$ $0.1773523$

$10$ $0.0651067$ $0.0416605$

$15$ $0.0233077$ $0.0101008$

$20$ $0.0086739$ $0.0024804$

$25$ $0.0033027$ $0.0006132$

$30$ $0.0012769$ $0.0001522$

$35$ $0.0004991$ $0.0000379$

$40$ $0.0001967$ $0.0000095$

$45$ $0.0000780$ $0.0000024$

$50$ $0.0000311$ $0.0000006$

Table 3. Probabilities for $q=0.3$.

[TABLE]

Table 4. Solving for $P$ less than 0.1%.

Therefore the correct results for bitcoin security are worse than those given in [Nakamoto 2008]. The explanation is that Nakamoto’s result is correct only if the mining time by the honest miners is exactly the expected time. Times longer than average help the attackers.

6. Closed-form formula.

We give a closed-form formula for $P(z)$ using the regularized incomplete beta function $I_{x}(a,b)$ (see [Abramovitch & Stegun 1970] (6.6.2)).

Theorem 6.1**.**

We have, with $s=4pq$,

[TABLE]

We recall that the incomplete beta function is defined (see [Abramovitch & Stegun 1970] (6.6.1)), for $a,b>0$ and $0\leq x\leq 1$, by

[TABLE]

and the classical beta function is defined (see [Abramovitch & Stegun 1970] (6.2.1)) by $B(a,b)=B_{1}(a,b)$.

The Regularized Incomplete Beta Function is defined (see [Abramovitch & Stegun 1970] (6.6.2) and (26.5.1)) by

[TABLE]

Proof.

The cumulative distribution of a random variable ${\boldsymbol{X}}$ with negative binomial distribution, with $0<p<1$ and $q=1-p$ as usual (see [Abramovitch & Stegun 1970] (26.5.26))) is given by

[TABLE]

This results from the formula (see [Abramovitch & Stegun 1970] (6.6.1))

[TABLE]

that we prove by integrating by parts the definition of $B_{x}(a,b)$.

Thus we get

[TABLE]

Making the change of variables $t\mapsto 1-t$ in the integral definition, we also have a symmetry relation (see [Abramovitch & Stegun 1970] (6.6.3))

[TABLE]

Therefore we have $I_{p}(z,z)+I_{q}(z,z)=1$, and $P(z)=2I_{q}(z,z)$. The result follows using (see [Abramovitch & Stegun 1970] (26.5.14)), $I_{q}(z,z)=\frac{1}{2}I_{s}(z,1/2)$, where $s=4pq$.

∎

7. Asymptotic and exponential decay.

Nakamoto makes the observation ([Nakamoto 2008] p.8), without proof, that the probability decreases exponentially to [math] when $z\to+\infty$. We prove this fact for the true probability $P(z)$ using the closed-form formula from Proposition 6.1,

Proposition 7.1**.**

When $z\to+\infty$ we have, with $s=4pq<1$,

[TABLE]

By integration by parts we get the following elementary version of Watson’s Lemma:

Lemma 7.2**.**

Let $f\in C^{1}({\mathbb{R}}_{+})$ with $f(0)\not=0$ and absolutely convergent integral

[TABLE]

then, when $z\to+\infty$, we have

[TABLE]

Then we get the following asymptotics (see also [López & Sesma 1999]):

Lemma 7.3**.**

For $s,b\in{\mathbb{R}}$, we have when $z\to+\infty$,

[TABLE]

Proof.

Making the change of variable $u=\log(s/t)$ in the definition

[TABLE]

we get

[TABLE]

and the result follows applying Lemma 7.2 with $f(u)=(1-se^{-u})^{b-1}$. ∎

Now we end the proof of Proposition 7.1. By Stirling asymptotics,

[TABLE]

so

[TABLE]

8. A finer risk analysis.

In practice, in order to avoid a double spend attack, the recipient of the bitcoin transaction waits for $z\geq 1$ confirmations. But he also has the information on the time $\tau_{1}$ it took to confirm the transaction $z$ times. Obviously the probability of success of the attackers increases with $\tau_{1}$. The relevant parameter is the relative deviation from the expected time

[TABLE]

Our purpose is to compute the probability $P(z,\kappa)$ of success of the attackers. Note that $P(z,1)$ is the probability computed by Nakamoto [Nakamoto 2008],

[TABLE]

Computation of $P(z,\kappa)$.

The attackers mined $k\geq 0$ blocks during the time $\tau_{1}$ with probability that follows a Poisson distribution with parameter

[TABLE]

that means

[TABLE]

For $\kappa=1$ we recover Nakamoto’s approximation.

The cumulative Poisson distribution can be computed with the incomplete regularized gamma function ([Abramovitch & Stegun 1970] (26.4))

[TABLE]

where

[TABLE]

is the incomplete gamma function and $\Gamma(s)=\Gamma(s,0)$ is the regular gamma function. We have

[TABLE]

We compute as before

[TABLE]

Figure 3. Probability of success as a function of $\kappa$

Thus we get a explicit closed-form formula for $P(z,\kappa)$,

Theorem 7**.**

We have

[TABLE]

and

[TABLE]

9. Asymptotics of $P(z,\kappa)$ and $P_{SN}(z)$.

We find the asymptotics of $Q(z,\lambda z)$ when $z\to+\infty$ for different values of $\lambda>0$.

Lemma 9.1**.**

We have

1. (1)

For $0<\lambda<1$, $Q(z,\lambda z)\to 1$ and $1-Q(z,\lambda z)\sim\frac{1}{1-\lambda}\frac{1}{\sqrt{2\pi z}}e^{-z(\lambda-1-\log\lambda)}$. 2. (2)

For $\lambda=1$, $Q(z,z)\to 1/2$ and $1/2-Q(z,z)\sim\frac{1}{3\sqrt{2\pi z}}$. 3. (3)

For $\lambda>1$, $Q(z,\lambda z)\sim\frac{1}{\lambda-1}\frac{1}{\sqrt{2\pi z}}e^{-z(\lambda-1-\log\lambda)}$.

Proof.

(1) By [Digital Library of Mathematical Functions] (8.11.6) and Stirling formula,for $\lambda<1$ we have

[TABLE]

(2) Also by [Digital Library of Mathematical Functions] (8.11.12) and Stirling formula,

[TABLE]

and

[TABLE]

(3) By [Digital Library of Mathematical Functions] (8.11.7) and Stirling formula,for $\lambda>1$ we have

[TABLE]

∎

For $x>0$ we define $c(x)=x-1-\log x$, which is positive since the graph of $x\mapsto 1-x$ is the tangent at $x=1$ to the concave graph of the logarithm function. We denote $0<\lambda=q/p<1$.

We have that the Nakamoto probability $P_{SN}(z)$ also decreases exponentially with $z$ as claimed by Nakamoto in [Nakamoto 2008] without proof.

Proposition 9.2**.**

We have for $z\to+\infty$,

[TABLE]

Proof.

The result follows from the closed-form formula from Theorem 7,

[TABLE]

and then from points (1) and (2) of Lemma 9.1,

[TABLE]

and

[TABLE]

∎

More generally, we have five different regimes for the asymptotics of $P(z,\kappa)$ for $0<\kappa<1$, $\kappa=1$, $1<\kappa<p/q$, $\kappa=p/q$ and $\kappa>p/q$.

Proposition 9.3**.**

We have for $z\to+\infty$,

1. (1)

For $0<\kappa<1$,

[TABLE] 2. (2)

For $\kappa=1$,

[TABLE] 3. (3)

For $1<\kappa<p/q$,

[TABLE] 4. (4)

For $\kappa=p/q$, $P(z,p/q)\to 1/2$ and

[TABLE] 5. (5)

For $p/q<\kappa$, $P(z,\kappa)\to 1$ and

[TABLE]

Proof.

(1) If $\kappa<1$ then also $\kappa q/p<1$, and

[TABLE]

and

[TABLE]

and then

[TABLE]

Since $Q(z,\kappa z)\to 1$ we have,

[TABLE]

(2) This was proved in Proposition 9.2.

(3) When $1<\kappa<p/q$ then by Lemma 9.1,

[TABLE]

and

[TABLE]

So we have

[TABLE]

(4) The previous asymptotic at the start of the proof of (3) is also valid for $1<\kappa=p/q$ and gives

[TABLE]

and by Lemma 9.1,

[TABLE]

(5) For $\kappa>p/q$ we use again the same asymptotic of (3) to get

[TABLE]

and again

[TABLE]

so

[TABLE]

∎

10. Comparing asymptotics of $P(z)$ and $P_{SN}(z)$.

We have an asymptotic comparison,

Proposition 10.1**.**

We have for $z\to+\infty$,

[TABLE]

Proof.

Note that

[TABLE]

So with $s=4pq<1$ we have

[TABLE]

and for $z$ large

[TABLE]

∎

As we will see later we can be more explicit about the inequality between $P_{SN}(z)$ and $P(z)$.

11. Recovering $P(z)$ from $P(z,\kappa)$.

We have seen above that $P_{SN}(z)$ can be recover from $P(z,\kappa)$ by taking the value at $\kappa=1$. It turns out that we can also recover $P(z)$ as a weighted average on $\kappa$ of $P(z,\kappa)$.

Theorem 8**.**

We have

[TABLE]

with the density function

[TABLE]

We check that

[TABLE]

We can write

[TABLE]

where

[TABLE]

Then the Theorem follows from a direct computation,

Lemma 11.1**.**

For $k\geq 0$, we have

[TABLE]

We give a second more conceptual proof.

Proof.

Consider the random variable

[TABLE]

We have seen above that ${\boldsymbol{S}}_{z}\sim\Gamma(z,\alpha)$ so ${\boldsymbol{\kappa}}\sim\Gamma(z,\alpha\frac{z\tau_{0}}{p})=\Gamma(z,z)$. So the density $d\rho_{z}$ is the distribution of ${\boldsymbol{\kappa}}$. It is enough to prove that

[TABLE]

We have

[TABLE]

And by conditioning by ${\boldsymbol{S}}_{z}$ we get

[TABLE]

since ${\mathbb{P}}[{\boldsymbol{N}}^{\prime}({\boldsymbol{S}}_{z})=k|{\boldsymbol{S}}_{z}]=\frac{(\alpha^{\prime}{\boldsymbol{S}}_{z})^{k}}{k!}e^{\alpha^{\prime}{\boldsymbol{S}}_{z}}$, $q_{z-k}=(q/p)^{z-k}$, and

[TABLE]

∎

We also note that ${\mathbb{E}}[{\boldsymbol{\kappa}}]=1$.

12. Range of $\kappa$.

The probability to observe a deviation greater than $\kappa$ is ${\mathbb{P}}[{\boldsymbol{\kappa}}>\kappa]$ with ${\boldsymbol{\kappa}}=\frac{p}{z\tau_{0}}{\boldsymbol{S}}_{z}$. We have that ${\boldsymbol{\kappa}}$ follows a $\Gamma$-distribution, ${\boldsymbol{\kappa}}\sim\Gamma(z,z)$, so

[TABLE]

Then, by Lemma 9.1, ${\mathbb{P}}[{\boldsymbol{\kappa}}>\kappa]\sim\frac{1}{\kappa-1}\frac{1}{\sqrt{2\pi z}}e^{-zc(\kappa)}$ for $\kappa>1$. Note that this probability does not depend on $p$. For $z=6$, we have ${\mathbb{P}}[{\boldsymbol{\kappa}}>4]\approx 3\cdot 10^{-6}$ and for $z=10$, ${\mathbb{P}}[{\boldsymbol{\kappa}}>4]\approx 4\cdot 10^{-9}$. So, in practice, the probability to have ${\boldsymbol{\kappa}}>4$ is very unlikely. Below, we have represented the graph of $\kappa\longmapsto P(z,\kappa)$ for different values of $z$ ($q=0.1$) and $0<\kappa<4$.

Figure 4. Probability $P(z,\kappa)$ as a function of $\kappa$

We see that $\kappa\longmapsto P(z,\kappa)$ is convex in the range of values of $\kappa$ considered. We study the convexity in more detail in the next section.

13. Comparing $P_{SN}(z)$ and $P(z)$.

Now we study the convexity of $\kappa\mapsto P(z,\kappa)$. Recall that $\lambda=q/p<1$. From Theorem 7 we have

[TABLE]

Since

[TABLE]

we get, after some cancellations,

[TABLE]

We observe that $\partial_{2}P(z,\kappa)>0$, so $P(z,\kappa)$ is an increasing function of $\kappa$ as expected. For the second derivative we have

[TABLE]

Therefore we study the sign of

[TABLE]

For $z=1$ we have

[TABLE]

therefore $\kappa\mapsto P(1,\kappa)$ is a concave function and by Jensen’s inequality

[TABLE]

Corollary 13.1**.**

We have (for all $0<q<1/2$)

[TABLE]

In general, for $z\geq 2$, we have the reverse inequality. To determine the sign of $g_{\lambda,z}$ we study its zeros.

The equation to solve is

[TABLE]

This is a polynomial equation in $1/\kappa$, the coefficients are increasing on $z$, and the left hand side is decreasing on $\kappa\in(0,+\infty)$ from $+\infty$ to [math], therefore there is a unique solution $\kappa(z)$, and

[TABLE]

We compute

[TABLE]

In this case the function $\kappa\mapsto P(z,\kappa)$ is convex only in the interval $(0,\kappa(z))$. For $z$ large, most of the support of the measure $d\rho_{z}$ is contained in this interval and we have by Jensen’s inequality

[TABLE]

where

[TABLE]

We can get some estimates on $\kappa(z)$ for $z\to+\infty$. The first observation is that for $z$ large we have $\kappa(z)>1$. The asymptotic limits for $Q(z,\kappa z)$ for $\kappa<1$ and $\kappa=1$ (Lemma 9.1) and Stirling asymptotic formula give that

[TABLE]

and $g_{\lambda,z}(\kappa)\not=0$.

For $\kappa>1$, we can use the asymptotic [Digital Library of Mathematical Functions] (8.11.7), $z\to+\infty$,

[TABLE]

and

[TABLE]

thus, since

[TABLE]

we have

[TABLE]

Now, if

[TABLE]

we have $g_{\lambda,\infty}(\kappa_{\infty})=0$, so we get:

Proposition 13.2**.**

[TABLE]

Using the second order asymptotic ([Digital Library of Mathematical Functions] (8.11.7)), for $\kappa>1$, $z\to+\infty$,

[TABLE]

so

[TABLE]

Writing

[TABLE]

and using

[TABLE]

we get

Proposition 13.3**.**

For $z\to+\infty$

[TABLE]

Also we have

[TABLE]

for

[TABLE]

so, for $z$ of the order of $(1-\lambda)^{-2}$ we have $\kappa(z)>1$.

14. Bounds for $P(z)$

Remember that we have set $s=4pq$. We have the following inequality that is a particular case of more general Gautschi’s inequalities [Gautschi 1959]:

Lemma 14.1**.**

Let $z\in{\mathbb{R}}_{+}$. We have

[TABLE]

Proof.

By Cauchy-Schwarz inequality, we have:

[TABLE]

On the other side, the last inequality with $z$ replaced by $z+\frac{1}{2}$ gives:

[TABLE]

∎

Lemma 14.2**.**

For $z>1$, we have

[TABLE]

Proof.

The function $x\longmapsto(1-x)^{-\frac{1}{2}}$ is non-decreasing. So, by definition of $I_{s}$ and the upper bound of the inequality of Lemma 14.1, we have

[TABLE]

In the same way, using the lower bound of the inequality of Lemma 14.1, we have

[TABLE]

∎

Note that this gives again the exponential decrease of Nakamoto’s probability.

15. An upper bound for $P_{SN}(z)$

Proposition 15.1**.**

We have,

[TABLE]

This upper bound is quite sharp in view of the asymptotics in Proposition 9.3 (2).

Lemma 15.2**.**

Let $z\in{\mathbb{N}}^{\ast}$ and $\lambda\in{\mathbb{R}}_{+}^{\ast}$.

1. (1)

If $\lambda\in]0,1[$, then $1-Q(z,\lambda z)<\frac{1}{1-\lambda}\frac{1}{\sqrt{2\pi z}}e^{-(\lambda-1-\log\lambda)z}$ 2. (2)

$Q(z,z)<\frac{1}{2}$**

Proof.

For (1) We use [Digital Library of Mathematical Functions] (8.7.1)

[TABLE]

which is valid for $a,x\in{\mathbb{R}}$. Let $\lambda\in]0,1[$. Using $\Gamma(z+1)=z\Gamma(z)$, we get:

[TABLE]

On the other hand, by [Digital Library of Mathematical Functions] (5.6.1), we have

[TABLE]

and for any $0<\lambda<1$,

[TABLE]

For (2) this comes directly from [Digital Library of Mathematical Functions] (8.10.13). ∎

Recalling that $P_{SN}(z)=P(z,1)=1-Q\left(z,\frac{q}{p}z\right)+(q/p)^{z}e^{z(p-q)/p}Q(z,z)$, we get Proposition 15.1.

16. Comparing again $P_{SN}(z)$ and $P(z)$.

The aim of this section is to compute an explicit rank $z_{0}$ (no sharp) for which $P_{SN}(z)<P(z)$ for $z\geq z_{0}$.

Lemma 16.1**.**

Let $\alpha>0$. For all $x>\log\alpha$, $e^{x}-\alpha x>\frac{\alpha}{2}(x-\log\alpha)^{2}+\alpha(1-\log\alpha)$.

Proof.

Let $g(x)=e^{x}-\alpha x-\frac{\alpha}{2}(x-\log\alpha)^{2}-\alpha(1-\log\alpha)$. We have $g^{\prime}(x)=e^{x}-\alpha-\alpha(x-\log\alpha)$, $g^{\prime\prime}(x)=e^{x}-\alpha$ and $g^{(3)}(x)=e^{x}$. So, $g(\log\alpha)=g^{\prime}(\log\alpha)=g^{\prime\prime}(\log\alpha)=0$ and $g^{(3)}>0$. Therefore, $g(x)>0$ for $x>\log\alpha$. ∎

Lemma 16.2**.**

For $\alpha>0$ and $x>\left(1+1/\sqrt{2}\right)\log\alpha$ we have $e^{x}>\alpha x$.

Proof.

The inequality is trivial when $x\leq 0$. So, we can assume that $x>0$. For $0<\alpha<1$, we have $e^{x}>x>\alpha x$. For $1<\alpha<e$, by Lemma 16.1, we have $e^{x}-\alpha x>0$ for $x>\log\alpha$. For $\alpha>e$, the largest root of the polynomial $\frac{\alpha}{2}(x-\log\alpha)^{2}+\alpha(1-\log\alpha)$ is $\log\alpha+\sqrt{2(\log\alpha-1)}$ which is smaller than $(1+1/\sqrt{2})\log\alpha$ since $\sqrt{2(u-1)}\leq u/\sqrt{2}$ for $u\geq 1$. So, the inequality results from Lemma 16.1 again. ∎

Lemma 16.3**.**

For $\mu,\psi,x>0$, if

[TABLE]

then we have

[TABLE]

Proof.

We have

[TABLE]

By Lemma 16.2, the last inequality is satisfied as soon as

[TABLE]

Moreover, we have

[TABLE]

∎

Theorem 16.4**.**

Let $z\in{\mathbb{N}}$. A sufficient condition for having $P_{SN}(z)<P(z)$ is $z\geq z_{0}$ with $z_{0}=\lceil z_{0}^{*}\rceil$ being the smallest integer greater or equal to

[TABLE]

where $\psi(p)=\frac{q}{p}-1-\log\left(\frac{q}{p}\right)-\log\left(\frac{1}{4pq}\right)>0$.

Proof.

First, note that

[TABLE]

So, $\psi(p)>0$ and $z_{0}$ is well defined. Let $z>z_{0}$. By Lemma 14.2 and Corollary 15.1 it is enough to prove that

[TABLE]

We have $z\geq z_{0}\geq\frac{2}{\pi\left(1-\frac{q}{p}\right)^{2}}$, thus $\frac{1}{1-\frac{q}{p}}\frac{1}{\sqrt{2\pi z}}\leq\frac{1}{2}$. So, the inequality is satisfied as soon as $e^{-z\psi(p)}<\frac{\left(\frac{1}{\sqrt{\pi}}\right)}{\sqrt{z+\frac{1}{2}}}$ and the result follows from Lemma 16.3. ∎

[TABLE]

Table 5. Sharp values

17. Tables for $P(z,\kappa)$.

For complete Satoshi Tables see [Grunspan & Pérez-Marco 2017].

[TABLE]

Table 6. $P(3,\kappa)$ ($z=3$) for different values of $\kappa$ and $q$ in $\%$.

[TABLE]

Table 7. $P(6,\kappa)$ ($z=6$) for different values of $\kappa$ and $q$ in $\%$.

Acknowledgements: We are grateful to N. Emerson for his comments and remarks.