<p>It depends on what you're actually asking. Bitcoin doesn't exist within the normal model of BFT consensus so in one sense the answer is <a href="http://catb.org/jargon/html/M/mu.html" rel="noreferrer">mu</a>.</p>

<p>Under conventional assumptions Bitcoin will converge on a stable history if honest participants have a majority hashpower. But the arguments given as to why you could expect this hashpower majority assumption to hold are essentially economic.</p>

<p>You can show under some models, at least, that if the behavior of hashpower is governed by short term profitability, that if attackers control more than a third then they can make it more profitable for the profit seeking rest to essentially cooperate. See <a href="https://bitcoin.stackexchange.com/questions/tagged/selfish-mining">selfish-mining</a> for an example (the exact threshold for selfish-mining depends on the attacker's communication advantage, which is one of the reasons that block propagation and worst case block propagation speeds are a concern). This doesn't contradict the above because it requires that the miners be profit-maximizing rather than honest... but it is a fair argument in light of the economic arguments for the existence of hashpower to begin with.</p>

<p>Interestingly, if you assume that hashpower increases exponentially forever for both the defenders and the attackers ( e.g. you take Moore's law to be an actual physical law ) then any attacker that maintains any constant fraction of the hashpower will 'eventually' replace the chain with probability 1, including tiny fractions like 0.001%.  This isn't an actual weakness, however, because the resulting time that the attacker would have to persist while getting no income from their attack quickly turns into trillions of years for sensible numbers, but it's interesting to think about as just an example of how different from BFT consensus Bitcoin is.</p>

<p>See also <a href="https://bitcoin.stackexchange.com/questions/77601/pow-51-attack-vs-bft-1-3-attack?rq=1">PoW 51% attack vs. BFT 1/3 attack?</a></p>

CC BY-SA 4.0
2019-03-13T10:37:11.313Z
2019-03-13T10:37:11.313Z
G. Maxwell
<p>According to this answer: <a href="https://bitcoin.stackexchange.com/a/58908/41513">https://bitcoin.stackexchange.com/a/58908/41513</a> a Byzantine Fault Tolerant (BFT) consensus <strong>threshold</strong> is <strong>1/3</strong>.</p>

<p>On the other hand, there is a common belief that Bitcoin network is secure till <strong>majority</strong> of mining power (i.e. more than <strong>1/2</strong>) is honest, that means Byzantine Fault Tolerant <strong>threshold</strong> of Bitcoin network is <strong>1/2</strong>. </p>

<p><strong>Which threshold is correct? 1/3 or 1/2 ?</strong></p>

<security><proof-of-work><consensus><safety>
Byzantine Fault Tolerance Threshold of Bitcoin: 1/2 or 1/3? (Edited)
Questioner
# Byzantine Fault Tolerance Threshold of Bitcoin: 1/2 or 1/3? (Edited)

(Asked by: username_0 on 2018-11-08)

According to this answer: <https://bitcoin.stackexchange.com/a/58908/41513> a Byzantine Fault Tolerant (BFT) consensus **threshold** is **1/3**.

On the other hand, there is a common belief that Bitcoin network is secure till **majority** of mining power (i.e. more than **1/2**) is honest, that means Byzantine Fault Tolerant **threshold** of Bitcoin network is **1/2**.

**Which threshold is correct? 1/3 or 1/2 ?**

**Tags:** security, proof-of-work, consensus, safety


---

## 1 answers

### Answer by username_1 on 2019-03-13. Score: 6

It depends on what you're actually asking. Bitcoin doesn't exist within the normal model of BFT consensus so in one sense the answer is [mu](http://catb.org/jargon/html/M/mu.html).

Under conventional assumptions Bitcoin will converge on a stable history if honest participants have a majority hashpower. But the arguments given as to why you could expect this hashpower majority assumption to hold are essentially economic.

You can show under some models, at least, that if the behavior of hashpower is governed by short term profitability, that if attackers control more than a third then they can make it more profitable for the profit seeking rest to essentially cooperate. See [selfish-mining](https://bitcoin.stackexchange.com/questions/tagged/selfish-mining) for an example (the exact threshold for selfish-mining depends on the attacker's communication advantage, which is one of the reasons that block propagation and worst case block propagation speeds are a concern). This doesn't contradict the above because it requires that the miners be profit-maximizing rather than honest... but it is a fair argument in light of the economic arguments for the existence of hashpower to begin with.

Interestingly, if you assume that hashpower increases exponentially forever for both the defenders and the attackers ( e.g. you take Moore's law to be an actual physical law ) then any attacker that maintains any constant fraction of the hashpower will 'eventually' replace the chain with probability 1, including tiny fractions like 0.001%. This isn't an actual weakness, however, because the resulting time that the attacker would have to persist while getting no income from their attack quickly turns into trillions of years for sensible numbers, but it's interesting to think about as just an example of how different from BFT consensus Bitcoin is.

See also [PoW 51% attack vs. BFT 1/3 attack?](https://bitcoin.stackexchange.com/questions/77601/pow-51-attack-vs-bft-1-3-attack?rq=1)


---

