<p>The reason <strong><em>p</em></strong> and <strong><em>q</em></strong> are not equal is because the attacker is indeed pitted against the cumulative power of the entire network vs. being pitted against one miner. </p>

<p>If there was just one miner to compete with, then both the attacker and miner would have equal chances of finding the next block and <strong><em>p</em></strong> is indeed equal to <strong><em>q</em></strong> in that case (assuming identical hardware and hashing power). But when there are <strong><em>n</em></strong> miners, each of them working independently, then the chances that one of them finds the next block increase dramatically. The rate factor becomes <strong><em>$n \lambda$</em></strong> instead of just <strong><em>$\lambda$</em></strong>. See <a href="https://en.wikipedia.org/wiki/Exponential_distribution#Distribution_of_the_minimum_of_exponential_random_variables" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/Exponential_distribution#Distribution_of_the_minimum_of_exponential_random_variables</a> and so now <strong><em>p/q=n</em></strong>. </p>

<p>Another way to get above result is to recognize that mining a block is like winning a lottery where everyone has equal chances (again assuming identical compute power). So if there are <strong><em>n</em></strong> miners plus 1 attacker, then <strong><em>p/q=n</em></strong></p>

<p>Bitcoin is pure genius.</p>

CC BY-SA 4.0
2019-08-03T01:44:06.013Z
"If there was just one miner to compete with ... p is indeed equal to q in that case". The probability of finding the block is proportional to the number of tries, which means that it is proportional to the hash power that you have. Even if there are two miners, one could be using a huge datacenter, while the other might be mining on his 10 year old laptop. Their hash power would not be the same, and hence p and q will also not be equal to one another. Hash rate is the metric to be used to find out the probability of a miner finding the next block.
Ugam Kamat
CC BY-SA 4.0
2019-08-03T01:48:09.247Z
This is very confused. Even if there was just one attacker and one honest miner, there is no reason to assume they have the same hashrate. Hashrate depends on how much hardware and electricity each has at its disposal.
Pieter Wuille
CC BY-SA 4.0
2019-08-03T01:30:01.460Z
2019-08-03T18:44:38.590Z
2019-08-03T18:44:38.590Z
morpheus
<blockquote>
  <p>No one has an upper hand in this process. So shouldn't p and q be equal to each other?</p>
</blockquote>

<p>The chances of finding a valid block header that meets the target requirement increases proportionally to the number of tries. This means that it is proportional to the hash power that you have. Even if there are two miners, one could be using a huge datacenter (the size of United States), while the other might be mining on his 10 year old laptop. Their hash power would not be the same, and hence p and q will also not be equal to one another. Hash rate is the metric to be used to find out the probability of a miner finding the next block.</p>

<blockquote>
  <p>Then all an attacker needs to do is to form a pool whose compute power is greater than max(p_i). Am I missing something? In other words, the pool with max compute power can attack the blockchain already.</p>
</blockquote>

<p>What you are describing is a 51% attack. With the current hashrate of the Bitcoin network, it would require HUGE investments (billions of dollars) from the entity who is planning to do such attacks. At that investment level, the economic incentive to launch such attacks may be tiny, unless it's a state actor who is trying to annihilate the confidence of the network. Even if a fraudulent miner amasses >50% of the hash rate of the network, full nodes MAY try to patch themselves to reject such blocks (for example: if that attacker tries to broadcast a longest chain that is > 6 blocks different than the original chain, to prevent double spends).</p>

CC BY-SA 4.0
2019-08-03T01:56:02.257Z
2019-08-03T01:56:02.257Z
Ugam Kamat
<p>I am trying to understand Satoshi's paper [<a href="https://bitcoin.org/bitcoin.pdf" rel="nofollow noreferrer">1</a>]. On page 6 of the paper, he calculates the probability that someone can attack the blockchain from <em>z</em> blocks behind. He begins by defining:</p>

<p><a href="https://i.sstatic.net/spufC.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/spufC.png" alt="enter image description here"></a></p>

<p>My question: The mining of a block i.e., solving the hash puzzle is a completely brute-force trial-and-error process in which one keeps trying a random nonce until one gets a hit. No one has an upper hand in this process. So shouldn't <em>p</em> and <em>q</em> be equal to each other? </p>

<p><strong>EDIT</strong>: since comment would have been very long. Responding to the comments, in that case it gets even worse. <em>q</em> can be greater than <em>p</em>. Let the Bitcoin network be composed of <em>M</em> mining pools with their compute power be given by <em>p_i</em>. Then all an attacker needs to do is to form a pool whose compute power is greater than max(p_i). Am I missing something? <em>In other words, the pool with max compute power can attack the blockchain already</em>. </p>

<p>In an ideal design, if I want to attack the blockchain, I should be pitted against the sum of <em>p_i</em> not the max of <em>p_i</em>. </p>

CC BY-SA 4.0
2019-08-02T17:10:44.240Z
not if they are dependent on the hashpower of the attacker vs the hashpower of the honest node
JBaczuk
CC BY-SA 4.0
2019-08-02T17:11:48.807Z
My question assumes the hashpower are equal. I think its a safe assumption.
morpheus
CC BY-SA 4.0
2019-08-02T17:24:14.100Z
@morpheus That's not a reasonable assumption. Why would the attacker have exactly half of the hashrate?
Pieter Wuille
CC BY-SA 4.0
2019-08-02T17:42:36.320Z
Help me understand. Given N miners each having same computer, everyone has equal chance of finding the next block, no?
morpheus
CC BY-SA 4.0
2019-08-02T20:50:08.320Z
The attacker may have multiple computers. Or a datacenter. Or be the NSA.
Pieter Wuille
CC BY-SA 4.0
2019-08-02T23:25:28.027Z
related: https://bitcoin.stackexchange.com/q/36192/5406
Murch
CC BY-SA 4.0
2019-08-02T23:26:15.213Z
"No one has an upper hand in this process. So shouldn't p and q be equal to each other?" is not accurate. The chance of succeeding follows the number of tries each participant is making.
Murch
CC BY-SA 4.0
2019-08-02T23:43:06.233Z
@Murch, yes I get that. I had made an assumption that an attacker would be able to assemble same hash power as the most powerful mining pool. In that case wouldn't p be equal to q? And why is that not a safe assumption? (think of the most powerful pool as the one who wants to attack :)
morpheus
<attack>
Probability an honest node finds the next block vs. probability the attacker finds the next block
morpheus
# Probability an honest node finds the next block vs. probability the attacker finds the next block

(Asked by: username_0 on 2019-08-02)

I am trying to understand Satoshi's paper [[1](https://bitcoin.org/bitcoin.pdf)]. On page 6 of the paper, he calculates the probability that someone can attack the blockchain from *z* blocks behind. He begins by defining:

[![enter image description here](https://i.sstatic.net/spufC.png)](https://i.sstatic.net/spufC.png)

My question: The mining of a block i.e., solving the hash puzzle is a completely brute-force trial-and-error process in which one keeps trying a random nonce until one gets a hit. No one has an upper hand in this process. So shouldn't *p* and *q* be equal to each other?

**EDIT**: since comment would have been very long. Responding to the comments, in that case it gets even worse. *q* can be greater than *p*. Let the Bitcoin network be composed of *M* mining pools with their compute power be given by *p\_i*. Then all an attacker needs to do is to form a pool whose compute power is greater than max(p\_i). Am I missing something? *In other words, the pool with max compute power can attack the blockchain already*.

In an ideal design, if I want to attack the blockchain, I should be pitted against the sum of *p\_i* not the max of *p\_i*.

**Tags:** attack

> **Comments:**
> **username_1**: not if they are dependent on the hashpower of the attacker vs the hashpower of the honest node  
> **username_0**: My question assumes the hashpower are equal. I think its a safe assumption.  
> **username_2**: @username_0 That's not a reasonable assumption. Why would the attacker have exactly half of the hashrate?  
> **username_0**: Help me understand. Given N miners each having same computer, everyone has equal chance of finding the next block, no?  
> **username_2**: The attacker may have multiple computers. Or a datacenter. Or be the NSA.  
> **username_3**: related: https://bitcoin.stackexchange.com/q/36192/5406  
> **username_3**: "No one has an upper hand in this process. So shouldn't p and q be equal to each other?" is not accurate. The chance of succeeding follows the number of tries each participant is making.  
> **username_0**: @username_3, yes I get that. I had made an assumption that an attacker would be able to assemble same hash power as the most powerful mining pool. In that case wouldn't p be equal to q? And why is that not a safe assumption? (think of the most powerful pool as the one who wants to attack :)  

---

## 2 answers

### Answer by username_0 on 2019-08-03. Score: -1 | Accepted answer

The reason ***p*** and ***q*** are not equal is because the attacker is indeed pitted against the cumulative power of the entire network vs. being pitted against one miner.

If there was just one miner to compete with, then both the attacker and miner would have equal chances of finding the next block and ***p*** is indeed equal to ***q*** in that case (assuming identical hardware and hashing power). But when there are ***n*** miners, each of them working independently, then the chances that one of them finds the next block increase dramatically. The rate factor becomes ***$n \lambda$*** instead of just ***$\lambda$***. See <https://en.wikipedia.org/wiki/Exponential_distribution#Distribution_of_the_minimum_of_exponential_random_variables> and so now ***p/q=n***.

Another way to get above result is to recognize that mining a block is like winning a lottery where everyone has equal chances (again assuming identical compute power). So if there are ***n*** miners plus 1 attacker, then ***p/q=n***

Bitcoin is pure genius.

> **Comments:**
> **username_4**: "If there was just one miner to compete with ... p is indeed equal to q in that case". The probability of finding the block is proportional to the number of tries, which means that it is proportional to the hash power that you have. Even if there are two miners, one could be using a huge datacenter, while the other might be mining on his 10 year old laptop. Their hash power would not be the same, and hence p and q will also not be equal to one another. Hash rate is the metric to be used to find out the probability of a miner finding the next block.  
> **username_2**: This is very confused. Even if there was just one attacker and one honest miner, there is no reason to assume they have the same hashrate. Hashrate depends on how much hardware and electricity each has at its disposal.  

---

### Answer by username_4 on 2019-08-03. Score: 0

> No one has an upper hand in this process. So shouldn't p and q be equal to each other?

The chances of finding a valid block header that meets the target requirement increases proportionally to the number of tries. This means that it is proportional to the hash power that you have. Even if there are two miners, one could be using a huge datacenter (the size of United States), while the other might be mining on his 10 year old laptop. Their hash power would not be the same, and hence p and q will also not be equal to one another. Hash rate is the metric to be used to find out the probability of a miner finding the next block.

> Then all an attacker needs to do is to form a pool whose compute power is greater than max(p\_i). Am I missing something? In other words, the pool with max compute power can attack the blockchain already.

What you are describing is a 51% attack. With the current hashrate of the Bitcoin network, it would require HUGE investments (billions of dollars) from the entity who is planning to do such attacks. At that investment level, the economic incentive to launch such attacks may be tiny, unless it's a state actor who is trying to annihilate the confidence of the network. Even if a fraudulent miner amasses >50% of the hash rate of the network, full nodes MAY try to patch themselves to reject such blocks (for example: if that attacker tries to broadcast a longest chain that is > 6 blocks different than the original chain, to prevent double spends).


---

