Comment by patio11 | Hacker News Reader

Comment by patio11 | Hacker News Reader

Parent Full thread

Oh that is beautiful.

So if you're playing along at home: the consensus Bitcoin chain is the longest one consistent with the rules of Bitcoin Core, the lineal descendant of the Satoshi client.

This consensus chain currently includes 1+ transactions T, which effected this theft.

The proposal is for a large number of miners to abandon the consensus chain and start mining a new chain at one transaction prior to T, replaying all real transactions minus T plus a new transaction which would moot T.

With enough hashpower, this chain eventually surpasses the current longest chain and at that point all points on network, not just mining cartel, will agree that T never happened.

This is supposed to be impossible because it is incentivize-incompatible, as the mining cartel would lose an incredible amount of segniorage to make it happen and it wouldn't be a sure thing. Point #2 is mooted by mining centralization, a ship which has sailed. Point #1 could get mooted by a payment outside the standard understanding of the Bitcoin protocol.

Comedy gold!

Someone further down the thread also mentioned a very good point in that the attackers could potentially start a bidding war against such a fork. They would have nothing to lose compared to a situation where the heist is reversed.

They have a fairly elegant mechanism to do so, too: just chain transactions from T to the addresses the miners send their coinbase transactions to. If miners go forward with the re-write history plan, the bribe gets undelivered, Back to the Future style.

It might be one of the first cases of bribery where the briber doesn't have to talk to the bribee to discuss the object of the conspiracy, the price, or how the bribe would be delivered.

Schelling-point bribery

Kinda reminds me of Eliezer's concept of acausal blackmail

Amazing.

Oh it gets better! The attackers can do things like entangle their stolen Bitcoin in systemically important institutions. Say, send 0.01 BTC to Coinbase. Coinbase is probably not operationally capable of separation that Bad Bitcoin from their Good Bitcoin before it's been comingled with customer funds. At that point, reversing T would also invalidate consequential transactions by Coinbase, which is probably something they can't allow to happen, so they would pay miners to not reverse.

Comedy. Gold!

It sounds like miners could find a replacement revenue stream even if block rewards go to zero and transaction fees are low: Hold the blockchain hostage for reversal and sell out to the highest bidder!

(Of course, this would likely drive the value of 1 BTC to exactly $0)

(Edit: This is all a demonstration of how the security of the blockchain absolutely depends on mining hashpower being widely decentralized and distributed)

Which is one of the more practical reasons a rollback is very, very unlikely to happen. (It would have been fairly unlikely even in the case of ethereum/theDAO, had not the nature of that exploit effectively locked the funds for a month.)

What happens to people/exchanges that had already accepted stolen cryptocoin after such "justice forks"?

In that new valid blockchain, the transaction where they were given that coin will simply not be there.

I'm not 100% sure but I think that anyone can re-submit the "undone" transaction to the new blockchain, as long as the source address hasn't already spent its balance on the new chain? Isn't this what's called a "replay"?

Comedy gold indeed.

> This is supposed to be impossible because it is incentivize-incompatible

Enter the wonderful world of coco values and side payments in game theory. Incentive compatibility and strategyproofness arguments break down when parties are compensated (implicitly or explicitly) out-of-band. That's not always a bad thing - it can lead to more efficient, utility maximizing equilibria. That said, under the status quo, we're trading one flavor of centralization (monetary policy) for another (core committers and mining pools).

Not to mention repeated game effects (of setting a precedent in this case), which make the setting even more difficult to analyze.

And yet, despite all of this and more, the chaotic Bitcoin apparatus lumbers doggedly forward, with little sign of stopping. Should be interesting to see where it ends up.

Reply on news.ycombinator.com