Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Attack Incentive and Security of Exchanging Tokens on Proof-of-Work Blockchain

Ryosuke Abe
November 12, 2018

Attack Incentive and Security of Exchanging Tokens on Proof-of-Work Blockchain

I presented this in ASIAN INTERNET ENGINEERING CONFERENCE (AINTEC) 2018 (2018.11.12 -14 at Bankok, Thailand). The paper is published in ACM Digital Library(https://dl.acm.org/citation.cfm?id=3289171). This work is an achievement as my internship at mercari Inc. (merpay).

Abstract
In a consensus algorithm based on Proof-of-Work, miners are motivated by crypto rewards. Furthermore, security is guaranteed because a cost of a 50% attack chance is higher than the potential rewards. However, because of the sudden price jump of cryptocurrencies and cheap prices of mining machines like ASICs, the cost and profit were on equilibrium for Bitcoin in 2017. In this situation, attackers are motivated by the balance between hash power and profits. In this paper, we describe that there is relevance between mining power on the network and price of tokens that can be taken securely on a blockchain. Users who exchange tokens on the PoW blockchain should monitor mining power and exchange tokens cheaper than the attack cost so that profit and cost of the attacker are not in equilibrium.

Ryosuke Abe

November 12, 2018
Tweet

More Decks by Ryosuke Abe

Other Decks in Technology

Transcript

  1. BLOCKCHAIN Attack Incentive and Security of Exchanging Tokens on Proof-of-Work

    Blockchain 2018.11.12 - 14 ASIAN INTERNET ENGINEERING CONFERENCE (AINTEC) 2018 Ryosuke Abe, Keio University Keita Nakamura, Mercari, Inc. Kentaro Teramoto, Mercari, Inc. Misato Takahashi, Mercari, Inc.
  2. Blockchain A I N T E C 2 0 1

    8 B l o c k c h a i n a n d S e c u r i t y w #MPDLDIBJOJTBDPSFUFDIOPMPHZPG#JUDPJO w*O#JUDPJO FBDIOPEFTUPSFTUSBOTBDUJPOEBUB 59 JOCMPDLDIBJOTUIBUFBDIOPEF IPMET w&BDIOPEFWFSJGJFTUIFDPSSFDUOFTTPG59TXJUISFGFSSJOHBCMPDLDIBJO w&BDIOPEFSFGVTFTDPOUSBEJDUJOH59TMJLFlEPVCMFTQFOEJOHz w"$POTFOTVTBMHPSJUINCBTFEPO1SPPGPG8PSLNBLFTCMPDLDIBJOTJOFBDIOPEF IBTDPOTJTUFOU w1SPPGPG8PSL 1P8 JTBNBUIFNBUJDBMQV[[MFDBOCFTPMWFECZTQFOEJOH DPNQVUBUJPOQPXFS w5IFDPOTFOTVTBMHPSJUINJTTFDVSFVOMFTTBOBUUBDLFSPCUBJOTPWFSPG DPNQVUBUJPOBMQPXFSJOUIFOFUXPSL 2
  3. Blockchain A I N T E C 2 0 1

    8 R e s e a r c h Q u e s t i o n w 5IFTFDVSJUZJTHVBSBOUFFEPOUIFTJUVBUJPOBOBUUBDLFSJTOPUNPUJWBUFEUP PCUBJODPNQVUBUJPOQPXFS w 8FNBEFBDPTUQSPGJUNPEFMPGEPVCMFTQFOEJOHBUUBDL w 8FBOBMZ[FEUIF#JUDPJOOFUXPSLJTTFDVSFPSOPU 3 F r o m t h e i n c e n t i v e a s p e c t , i s P r o o f - o f - W o r k B l o c k c h a i n s e c u r e ?
  4. Blockchain A I N T E C 2 0 1

    8 R e s e a r c h Q u e s t i o n w 5IFTFDVSJUZJTHVBSBOUFFEPOUIFTJUVBUJPOBOBUUBDLFSJTOPUNPUJWBUFEUP PCUBJODPNQVUBUJPOQPXFS w 8FNBEFBDPTUQSPGJUNPEFMPGEPVCMFTQFOEJOHBUUBDL w 8FBOBMZ[FEUIF#JUDPJOOFUXPSLJTTFDVSFPSOPU w 3FTVMU w /P EPVCMFTQFOEJOHBUUBDLXBTQSPGJUBCMFJOUIF#JUDPJOOFUXPSL 4 F r o m t h e i n c e n t i v e a s p e c t , i s P r o o f - o f - W o r k B l o c k c h a i n s e c u r e ?
  5. Blockchain A I N T E C 2 0 1

    8 T r a n s a c t i o n a n d B l o c k w #MPDLDIBJOJODMVEFTBMM59JOUIF OFUXPSL w &BDIOPEFDBOWFSJGZ59PG DSZQUPDVSSFODJFTCZSFGFSSJOHUPB CMPDLDIBJO w /PEFTDBOEFUFDUlEPVCMF TQFOEJOHz w /PEFTTUPSFBTFUPG7FSJGJFE59T BTBl#MPDLzJOBCMPDLDIBJO w #MPDLJODMVEFTBDSZQUPHSBQIJD IBTIPGBQSFWJPVTCMPDL 5 59 "##5$ 59 "$#5$ 59 "%#5$ #MPDL 59 #$#5$ 59 $%#5$ 59 %"#5$ #MPDL )BTIPG 1SFWJPVT#MPDL )BTIPG 1SFWJPVT#MPDL
  6. Blockchain A I N T E C 2 0 1

    8 C o n s e n s u s a n d F o r k w #JUDPJOVTFTBDPOTFOTVTTDIFNFCBTFEPO1SPPGPG8PSL w "IBTIPGBCMPDLJTMPXFSUIBOUBSHFUBOEGJOEJUPOMZCZTQFOEDPNQVUBUJPOBM QPXFS w &BDIOPEFUBLFTUIFCMPDLNPTUDPNQVUBUJPOQPXFSTTQFOEBTUIFDPSSFDUCMPDL w 5PNPUJWBUFOPEFTUPNBLFCMPDLT UIFTZTUFNSFXBSETTPNFDSZQUPDVSSFODJFTUP UIFNBLFSXIPTVDDFFETJONBLJOHBCMPDL w 6TJOHUIFNFUBQIPSPGHPMENJOJOH NBLJOHBCMPDLCZTPMWJOH1P8JTDBMMFE lNJOJOHz BOECMPDLNBLFSJTDBMMFElNJOFSz 6 $PSSFDU $IBJO 1SPQPTFE#Z/PEF" 1SPQPTFE#Z/PEF# 1SPQPTFE#Z/PEF$
  7. Blockchain A I N T E C 2 0 1

    8 To R e w r i t e T r a n s a c t i o n s w 5PSFXSJUF59T BOBUUBDLFSOFFETUPDSFBUFOFXDIBJOMPOHFSUIBOBDIBJO UBLFTBTDPSSFDUBUUIBUUJNF w 5IFBUUBDLFSOFFETUPNPTUSBQJEMZNBLFCMPDLTJOUIFOFUXPSLCZ TQFOEJOHDPNQVUBUJPOBMQPXFSMBSHFSUIBOIPOFTUPOFT ‎5IFBUUBDLFSOFFETPWFSPGDPNQVUBUJPOBMQPXFSJOUIFOFUXPSLGPS TVSFUPTVDDFTTGVMBUUBDL 7 1SPQPTFE#Z/PEF" 1SPQPTFE#Z/PEF# 1SPQPTFE#Z/PEF$ $PSSFDU $IBJO
  8. Blockchain A I N T E C 2 0 1

    8 To k e n e x c h a n g i n g o n B l o c k c h a i n w *GPGDPNQVUBUJPOQPXFSJTIPOFTU 1P8CMPDLDIBJOJTEJGGJDVMUUPSFXSJUF ‎JUDBOBEBQUOPUPOMZGPSDSZQUPDVSSFODZCVUBMTPGPSPUIFSBQQMJDBUJPOT w &UIFSFVN0OFPGQSPHSBNNBCMF#MPDLDIBJOTUIBUVTFSDBOEFGJOFUPLFOCZ PSJHJOBMMBOHVBHFTMJLF4PMJEJUZ w 5IFSFBSFTFWFSBMQSPQPTBMTUIBUNBOBHFUIFSJHIUTPGUPLFOTDPOUSPM w &Y BQIZTJDBMBTTFUMJLFMBOET NVTJDEBUB w &3$  4UBOEBSETUIBUEFGJOFUPLFOTBOEUSBOTGFSUIBU PXOFSTIJQ w #ZDPNCJOBUJPOXJUIPUIFSQSPHSBNT VTFSTDBOFYDIBOHFUPLFOBVUPNBUJDBMMZ 8
  9. Blockchain A I N T E C 2 0 1

    8 R e s e a r c h Q u e s t i o n ( A g a i n ) w 5IFTFDVSJUZJTHVBSBOUFFEPOUIFTJUVBUJPOBOBUUBDLFSJTOPUNPUJWBUFEUP PCUBJODPNQVUBUJPOQPXFS w 5IFDPTUBOEQSPGJUDBOCFFTUJNBUF w $PTUJTQSJDFPGDPNQVUBUJPOQPXFS IBSEXBSF FMFDUSJDDPTU  w 1SPGJUJTQSPGJUPGEPVCMFTQFOEJOHBOENJOJOHSFXBSET ‎8FNBLFBNPEFMPGBUUBDLBOEFTUJNBUFDPTUBOEQSPGJU 9 F r o m t h e i n c e n t i v e a s p e c t , i s P r o o f - o f - W o r k B l o c k c h a i n s e c u r e ?
  10. Blockchain A I N T E C 2 0 1

    8 D o u b l e - S p e n d i n g A t t a c k M o d e l ᶃ w"TTVNQUJPO w"UUBDLFSIBTPG DPNQVUBUJPOQPXFS ‎)FDBOBMXBZTSFXSJUFQBTU 59 "OBUUBDLFSQBZTDPJOT .FSDIBOU"WFSJGJFTQBZNFOU CZDIFDLJOHJUJTJOTFSUFEJOB CMPDLDIBJO .FSDIBOU"TFOEB NFSDIBOEJTFUPUIFBUUBDLFS 10 "UUBDLFS .FSDIBOU" .FSDIBOU# "UUBDLFSQBJEUP .FSDIBOU"
  11. Blockchain A I N T E C 2 0 1

    8 D o u b l e - S p e n d i n g A t t a c k M o d e l ᶄ "GUFSUIFBUUBDLFSHFUTUIF NFSDIBOEJTF IFQBZTBOPUIFS NFSDIBOU#XIPIBWFOPULOPXO CMVFCMPDL w5IF59TIPXTUIBUIFQBZTUIF TBNFDPJOTJOQIBTF 5IFBUUBDLFSNJOFTOFXCMPDL JODMVEFTUIFTFDPOE59BOENBLFTB GPSLJOUIFOFUXPSL .FSDIBOU#WFSJGJFTQBZNFOUCZ DIFDLJOHJUJTJOTFSUFEJOB CMPDLDIBJO 5IFBUUBDLFSHFUTBOPUIFS NFSDIBOEJTF 11 4BNF#JUDPJOT .FSDIBOU" .FSDIBOU# "UUBDLFS "UUBDLFSQBJEUP .FSDIBOU#
  12. Blockchain A I N T E C 2 0 1

    8 .FSDIBOU" .FSDIBOU# "UUBDLFS -PTU#JUDPJOTBOE .FSDIBOEJTF D o u b l e - S p e n d i n g A t t a c k M o d e l ᶅ 5IFBUUBDLFSDPOUJOVFT NJOJOHTPUIBUBQQFOECMPDLT BGUFSGPSLFECMPDL .BKPSJUZPGUIFOFUXPSL BDDFQUGPSLFECMPDLTBOE XJUIESBXUIFGJSTU59 .FSDIBOU"MPTFTUIFDPJO BOEUIFNFSDIBOEJTF 12
  13. Blockchain A I N T E C 2 0 1

    8 W h e n i s A t t a c k I n c e n t i v e E s t a b l i s h e d ? w 5IFTJUVBUJPOJT w *OUIJTTJUVBUJPO FWFSZNFSDIBOUTIPVMEDPOTJEFSUIBUCVZFSNBZBUUBDL w $PTUDPOTJTUTPG w 1SJDFPGIBSEXBSF w &MFDUSJDDPTU w 1SPGJUDPOTJTUTPG w 1SJDFPGNFSDIBOEJTF w .JOJOH3FXBSET 13 Profit > Cost
  14. Blockchain A I N T E C 2 0 1

    8 C o s t f o r t h e A t t a c k w $PTUPG"UUBDLJTTVNPG)BSEXBSFDPTUBOE&MFDUSJDDPTU 14 Hard = Hashnetwork Hashasic × Priceasic Elect = Hashnetwork Hashasic × Wattasic × AttackTime 1000 × EP Parameters Unit Description TH/s The total hash power posted in the blockchain network TH/s A hash power of a mining asic Watt A power consumption of a mining asic American Dollar A price of a mining asic American Dollar An electronic price for one hour (kwh) Hour Time that an attacker operates ASIC Hashnetwork Hashasic Wattasic Priceasic EP AttackTime
  15. Blockchain A I N T E C 2 0 1

    8 P r o f i t o f t h e A t t a c k ᶃ M i n i n g R e w a r d w 1SPGJUJTTVNPGQSJDFPGNFSDIBOEJTFBOENJOJOHSFXBSET w .JOJOH3FXBSET w 5IFSBUJPUIBUBNJOFSDBOGJOE1P8BOTXFSBOENBLFTBCMPDLJTUIFTBNF BTIBTISBUFUIFNJOFSIBT w "OFYQFDUFEWBMVFPGNJOJOHSFXBSEGPSBCMPDLJT w &BDINJOJOHQSPDFTTJTBOJOEFQFOEFOUUSJBM w "OFYQFDUFEWBMVFPGOUJNFTNJOJOHSFXBSET 15 Reward × HashRate + 0 × (1 − HashRate) = Reward × HashRate Rewardsn = n ∑ i=1 Reward × HashRate
  16. Blockchain A I N T E C 2 0 1

    8 P r o f i t o f t h e A t t a c k ᶄ M e r c h a n d i s e w "UUBDLTVDDFTTEFQFOETPOQSPCBCJMJTUJDCBTFEPO)BTI3BUFPGBOBUUBDLFS w "TVDDFTTQSPCBCJMJUZ  PGBOBUUBDLUIBUSFXSJUFTCMPDLXJUI DPNQVUBUJPOBMQPXFSJTTIPXOJO#JUDPJO8IJUFQBQFS w "OFYQFDUFEWBMVFPGQSPGJUCZBOBUUBDLUIBUSFXSJUFTCMPDLXJUI DPNQVUBUJPOBMQPXFSBOEUIFBUUBDLFSHFUTNFSDIBOEJTF EPMMBS JT 16 z HashRate Cz Cz = 1 − z ∑ k=0 λke−k k! × 1 − ( HashRate 1 − HashRate )z−k z HashRate L Profit = L × Cz + z ∑ i=1 Reward × HashRate λ = z × HashRate 1 − HashRate
  17. Blockchain A I N T E C 2 0 1

    8 A n a l y s i s o f A t t a c k I n c e n t i v e i n t h e B i t c o i n N e t w o r k w 8FBOBMZ[FUIFDPOEJUJPOPGTFDVSJUZJO#JUDPJOGSPNTUBUJDBMJOGPSNBUJPOSFQPSUFECZ CMPDLDIBJOJOGP w"TTVNQUJPO w.JOFSTVTF"OUNJOFS4JBOEUIFFMFDUSJDQSJDFBTBOBWFSBHF"NFSJDBOQSJDF w"OBUUBDLFSTIBTISBUFJT w.JOJOHCZBOZOPEFJOUIFOFUXPSLJTTVDDFTTɹɹɹɹɹUJNFTJOPOFEBZ 17 24(h) × 60(m) 10(m) = 144 Parameters Unit Assumption Source TH/s variable blockchain.info American Dollar variable blockchain.info TH/s variable blockchain.info TH/s 14 TH/s Antminer S9i Watt 1372 Watt Antminer S9i American Dollar 608 dollar Antminer S9i American Dollar 0.1 dollar U.S. Energy Information Administration Hour 24h Time from order to delivery Hashnetwork Hashasic Wattasic Priceasic EP AttackTime HashRate Reward
  18. Blockchain A I N T E C 2 0 1

    8 E x p e c t e d V a l u e o f R e w a r d s a n d A t t a c k C o s t w 5IFSFMBUJPOPGBOE JTNBJOMZ w *OUIFIJHIKVNQPGQSJDFJO  BUUBDLFSTBSFNPUJWBUFECZBOZ QSPGJUTPGEPVCMFTQFOEJOH   ‎*OUIJTTJUVBUJPO CFDBVTFEPVCMF TQFOEJOHBUUBDLXBTQSPGJUBCMF  #JUDPJOXBTOPUTFDVSF 18 Cost Rewards144 Cost > Rewards144 L
  19. Blockchain A I N T E C 2 0 1

    8 H o w L o n g T i m e A t t a c k i s P r o f i t a b l e ? w )PXNBOZCMPDLTBUUBDLFSUSZUP SFXSJUFEFQFOETPOFMBQTFEUJNFTGSPN UIFGJSTU59HFOFSBUFEVOUJMBUUBDLFS HFUNFSDIBOEJTF w #MPDL/VNUIBUUIFBUUBDLFSUSJFTUP SFXSJUF w *O#JUDPJO JT BWFSBHFNJOVUFT w *O MPXFSUIBOIPVSBUUBDLXBT QSPGJUBCMFCZSFXBSET 19 BlockNum = ElapsedTimes BlockGenerationInterval BlockGenerationInterval
  20. Blockchain A I N T E C 2 0 1

    8 R e s u l t a n d D i s c u s s i o n o f B i t c o i n N e t w o r k A n a l y s i s w *O UIFEPVCMFTQFOEJOHBUUBDLPG#JUDPJOJTQSPGJUBCMFPOMZCZNJOJOHSFXBSE w 1SJDFPG#JUDPJOIBTBIBSNGVMFGGFDUUPUIFJODFOUJWFPGEPVCMFTQFOEJOHBUUBDL w 0GDPVSTF UIFDPTUGPSBUUBDLPO#JUDPJOOFUXPSLJTFOPVHIIJHI w *O#JUDPJO JGEPVCMFTQFOEJOHBUUBDLJTEFUFDUFE UIFQSJDFPGCJUDPJOTJTEPXOTP UIBUEJTJODFOUJWFGPSBUUBDLFST w *O&UIFSFVN UIFQSJDFPGUPLFOT FH MBOETEFTDSJCFECZ&3$ JTTPNFUJNFT OPUBGGFDUFECZOFUXPSLTFDVSJUZ w *OPVSNPEFM UIFDPTUEFQFOETPOUIFIBTIQPXFSBOEUIFQSPGJUEFQFOETPOQSJDF PGUPLFOT ‎5IFSFTIPVMECFSFMFWBOUCFUXFFOUIFIBTIQPXFSBOEUIFQSJDF 20
  21. Blockchain A I N T E C 2 0 1

    8 M i t i g a t i o n o f A t t a c k I n c e n t i v e ( S h o r t T i m e S o l u t i o n ) w 'PSQSFWFOUJOHNPUJWBUFEPVCMFTQFOEJOH BNFSDIBOULFFQTBQSJDFPG UPLFOT  POBCMPDLDIBJOJTMPXFS w 8IFO QSFWFOUJOHUPNPUJWBUFCZUIFUPLFOQSJDFJT JNQPTTJCMF w 8IFO BUUBDLFSEPFTOPUHBJOJODFOUJWF w )FODF UIFNFSDIBOUDBOQSFWFOUUPNPUJWBUFCZUPLFOTUIBUJUTQSJDFJT MPXFSUIBO w *OQSBDUJDF NFSDIBOUTTIPVMENPOJUPSUIFDPNQVUBUJPOBMQPXFSJOUIF OFUXPSLUPFTUJNBUFUIFBUUBDLDPTU 21 Cost < Rewardsn Cost > Rewardsn Cost < L + Rewardsn Cost − Rewardsn L
  22. Blockchain A I N T E C 2 0 1

    8 To w a r d L o n g - Te r m S o l u t i o n w 'SPNJODFOUJWFBTQFDU BUUBDLFSTBSFNPUJWBUFENPSFFBTJMZCZTUBDLJOHNPSF CMPDLT w *UDPOUSBEJDUTUPBOPQFSBUJPOUIBUVTFSTXBJUGPSCMPDLDPOGJSNBUJPO w .JOJOHSFXBSETIBWFBIBSNGVMFGGFDUGSPNBUUBDLJODFOUJWFBTQFDU w 5IFNJOJOHSFXBSEJTBOJODFOUJWFGPSB59WBMJEBUJPOXPSLT w 8IFOUIF1P8CMPDLDIBJOTZTUFNTXFSFOPUGBNPVT NJOJOHSFXBSETNBEF JODFOUJWFTUIBUNJOFSTKPJOUIFOFUXPSL w "MSFBEZ1P8CMPDLDIBJOTZTUFNTBSFFOPVHIGBNPVT TPUIBUNJOFSTOPNPSF OFFEBEEJUJPOBMNPUJWBUJPO ‎5IFNPUJWBUJPOPGNJOFSJTOPUUPLFOT TIPVMECFTZTUFNDIBSBDUFSJTUJD w &Y .JOFSXBOUUPVTFUIF1P8CMPDLDIBJOTZTUFN 22
  23. Blockchain A I N T E C 2 0 1

    8 R e l a t e d W o r k s w 1SPPGPG8PSLFDPOPNJDBOBMZTJT w #-BVSJFFUBM1SPPGPG8PSL1SPWFT/PUUP8PSL*O5IJSE8PSLTIPQPOUIF&DPOPNJDTPG *OGPSNBUJPO4FDVSJUZ.JOOFBQPMJT ./ w %-JVFUBM1SPPGPG8PSLDBO8PSL*O5IF'JGUI8PSLTIPQPOUIF&DPOPNJDTPG*OGPSNBUJPO 4FDVSJUZ 8&*4  w "EBQUJOHHBNFUIFPSZUP1P8CMPDLDIBJO w *&ZBM5IF.JOFS`T%JMFNNB*O*&&&4ZNQPTJVNPO4FDVSJUZBOE1SJWBDZ*&&& r w /)PVZ5IF#JUDPJO.JOJOH(BNF443/&MFDUSPOJD+PVSOBM NBS  w 4UBCJMJ[FUIF1SJDFPGB$SZQUPDVSSFODZ w .*XBNVSB FUBM$BO8F4UBCJMJ[FUIF1SJDFPGB$SZQUPDVSSFODZ 6OEFSTUBOEJOHUIF%FTJHOPG #JUDPJOBOE*UT1PUFOUJBMUP$PNQFUFXJUI$FOUSBM#BOL.POFZ443/&MFDUSPOJD+PVSOBM PDU  w ,4BJUPFUBM)PXUP.BLFB%JHJUBM$VSSFODZPOB#MPDLDIBJO4UBCMF KBO BS9JW w #MPDLDIBJOFDPTZTUFNXJUIPVUNJOJOHSFXBSE w .$BSMTUFO FUBM0OUIF*OTUBCJMJUZPG#JUDPJO8JUIPVUUIF#MPDL3FXBSE1SPDFFEJOHTPGUIF "$.4*(4"$$POGFSFODFPO$PNQVUFSBOE$PNNVOJDBUJPOT4FDVSJUZ$$4`   23
  24. Blockchain A I N T E C 2 0 1

    8 S u m m a r y & F u t u r e W o r k w 8FQSPQPTFDPTUBOEQSPGJUNPEFMPGUIFEPVCMFTQFOEJOHBUUBDLPO1P8 #MPDLDIBJO w 5IFQSJDFPGBUPLFOPOBCMPDLDIBJOBGGFDUTUIFJODFOUJWFPGEPVCMFTQFOEJOH BUUBDL w 'SPN#JUDPJOTIJTUPSJDBMEBUB XFDBOTFFUIBUUIF#JUDPJOOFUXPSLXBTBUSJTLPG NPUJWBUJOHEPVCMFTQFOEJOHJO w "TBTIPSUUJNFTPMVUJPO UPQSFWFOUNPUJWBUJOHBUUBDL VTFSTTIPVMENPOJUPS DPNQVUBUJPOBMQPXFSJOUIFOFUXPSL w 'VUVSF8PSLT w *ODFOUJWFNPEFMPGNPSFFGGFDUJWFBUUBDLTUSBUFHJFT w "OBMZ[FJODFOUJWFTPGBUUBDLJOCMPDLDIBJOFDPTZTUFNXJUIPVUNJOJOHSFXBSE 24