<p>The thing to consider is, "what does the attacker have to give up in order to attack me?"  If the cost of that thing is less than the reward from a successful attack, then attacking is rational from a purely economic standpoint.  (Obviously, attacking someone comes with a non-economic moral cost.)</p>

<p>A miner who controls more than half of the network hash rate, and expects to maintain that control indefinitely, will lose nothing by attacking you.  This is the so-called 51-percent attack.</p>

<p>A miner who controls less than half of the hash rate will likely lose a chance at a certain amount of income, but how much depends on how close they get to half of the network hash rate.  I created the following image a few months ago to illustrate this:</p>

<p><img src="https://raw.githubusercontent.com/harding/bitcoin.org/mining/img/mining/en-confirmed-double-spend-cost.png" alt="Cost Of Attack In Forfeit Income"></p>

<p>If you look at the <a href="https://blockchain.info/pools">BlockChain.info mining pools chart</a>, you see there are several which can make affordable attacks against both once-confirmed and six-confirmed transactions.  I suspect all that prevents them from doing so is their reputation in the community.</p>

<p>The others factor are:</p>

<ol>
<li><p>How much can the attacker get from you in a single attack?  For example, can they order multiple 50 BTC items at the same time?</p></li>
<li><p>How easily can the attacker profit from an attack against you?  For example, how much can they resell those 50 BTC items for?  Most attackers aren't going to want 20 digital copies of Plan 9 From Outer Space, but they'd love 20 times 50 BTC worth of another crypto currency.</p></li>
</ol>

<p>Unfortunately, this factors don't apply just to you: they apply to everyone the attacker can attack at the same time.  For example, if they can make 10 BTC by ripping you off and 190 BTC by ripping other people off, then an attack which costs less than 200 BTC is economically worth it.  This means you can't fully analyze your risk by looking just at your items.</p>

<p>Waiting for more confirmations will always increase your security substantially, and I expect there are few things is this world worth 50 BTC that people can't wait an hour or two for them to arrive.  (But hey, maybe I'm just not rich enough to be spending $20,000 USD on a regular basis.)</p>

<p>If this is all very depressing, I'm sorry.  Long term, the goal of the community will be to decrease miner centralization.  If no miner or mining pool controls more than about 1% of the network hash rate, attacks against once-confirmed transactions become both expensive and unpredictable, and attacks against six-confirmed transactions become practically impossible.</p>

<h3>Footnote: Math</h3>

<p>In the image above, the average cost of a successful attack here is</p>

<pre><code>r * h * b / p(h,b) - r * (b-1)
</code></pre>

<p>Where <em>r</em> is the block reward (25 BTC), <em>h</em> is the percentage of network
hash rate, <em>b</em> is the number of blocks to create (confirmations plus
one), and <em>p()</em> is Satoshi's probability calculator from bitcoin.pdf page
7. r * h * b is the average value of work used per attempt; p(h,b) is
the probability of success per attempt; r * (b-1) is the block reward
the attacker would've received if they mined honestly.</p>

<p>For reference, the time (average number of blocks elapsed) an attack takes is simply</p>

<pre><code>1 / p(h,b)
</code></pre>

CC BY-SA 3.0
2014-11-17T02:03:21.930Z
Great answer :) What does `c` stand for in the last formula?
Doug Peters
CC BY-SA 3.0
2014-11-17T02:08:09.500Z
So practically it doesn't cost a thing to a miner to perform such an attack if his hash power is greater than 10% of the total hashing power in the network?
Doug Peters
CC BY-SA 3.0
2014-11-17T02:51:01.287Z
@DougPeters Whoops `c` == `b` (`c` was for confirmations, but then I realized the formula was confirmations plus one, so I changed it to `b` for blocks).   For one conf at 10%, `p(0.10,2) == 0.050978`, so the cost is 48.8 BTC. Cost doesn't actually equal 0 BTC until 50%, but the scale of the chart doesn't allow showing such "small" amounts.
David A. Harding
CC BY-SA 3.0
2014-11-17T15:39:46.337Z
@RickyDemer great idea!  However, when I looked at it closer, I found a bug in my formula (it was returning negative results).  I fixed the bug and now the regular plot shows the expected long tail (and the numeric output matches the model of 50%==0 cost perfectly).  I updated the answer accordingly and I don't think a log axis is needed any more.  Thanks for making me pay closer attention!
David A. Harding
CC BY-SA 3.0
2014-11-18T16:37:14.177Z
@DavidA.Harding I was wondering if you have a matrix in place presenting `cost of attack` against `hash power`, I would love to take a closer look at the estimated cost for hashing power < 25%.
Doug Peters
CC BY-SA 3.0
2014-11-18T17:01:41.177Z
@DougPeters here's the [code used to generate the plot](https://github.com/harding/bitcoin.org/blob/mining/img/mining/en-confirmed-double-spend-cost.gnuplot).  MIT license.  Note, if I had to do it all over again, I'd use something besides bash & bc for the math. :-)
David A. Harding
CC BY-SA 3.0
2014-11-17T01:37:02.363Z
2014-11-17T15:36:40.727Z
2014-11-17T15:36:40.727Z
David A. Harding
<p>A customer sends me a payment for some digital good at my service, where delayed delivery is a deal-breaker, so I only wait for 1 confirmation by the network before releasing the links for the purchased digital item. </p>

<p>The prices of these itemsrange from 0,0001 XBT to 50 XBT.</p>

<p>I do realize that I should probably configure my service to wait for more confirmations for more expensive items, and taken that the current reward for the miners for a new block is 25 XBT would it be safe to assume that no hacker will have any incentive from performing an attack the new block (that contains the transactions that paid for the digital items from my store) when the sum of value of the total items I have sold that have 0-confirmed payments is smaller than 25 XBT?</p>

<p>Likewise, would 2 confirmations (total miner reward: 2 x 25 XBT) be considered as a safe threshold for items that cost 50 XBT?</p>

CC BY-SA 3.0
2014-11-17T03:38:45.047Z
Thanks @RickyDemer, however green addresses are more applicable in b2b scenarios, my service is pure b2c.
Doug Peters
<confirmations><attack><hacking>
When to worry about 1-confirmation payments
Doug Peters
# When to worry about 1-confirmation payments

(Asked by: username_0 on 2014-11-17)

A customer sends me a payment for some digital good at my service, where delayed delivery is a deal-breaker, so I only wait for 1 confirmation by the network before releasing the links for the purchased digital item.

The prices of these itemsrange from 0,0001 XBT to 50 XBT.

I do realize that I should probably configure my service to wait for more confirmations for more expensive items, and taken that the current reward for the miners for a new block is 25 XBT would it be safe to assume that no hacker will have any incentive from performing an attack the new block (that contains the transactions that paid for the digital items from my store) when the sum of value of the total items I have sold that have 0-confirmed payments is smaller than 25 XBT?

Likewise, would 2 confirmations (total miner reward: 2 x 25 XBT) be considered as a safe threshold for items that cost 50 XBT?

**Tags:** confirmations, attack, hacking

> **Comments:**
> **username_0**: Thanks @RickyDemer, however green addresses are more applicable in b2b scenarios, my service is pure b2c.  

---

## 1 answers

### Answer by username_1 on 2014-11-17. Score: 12 | Accepted answer

The thing to consider is, "what does the attacker have to give up in order to attack me?" If the cost of that thing is less than the reward from a successful attack, then attacking is rational from a purely economic standpoint. (Obviously, attacking someone comes with a non-economic moral cost.)

A miner who controls more than half of the network hash rate, and expects to maintain that control indefinitely, will lose nothing by attacking you. This is the so-called 51-percent attack.

A miner who controls less than half of the hash rate will likely lose a chance at a certain amount of income, but how much depends on how close they get to half of the network hash rate. I created the following image a few months ago to illustrate this:

![Cost Of Attack In Forfeit Income](https://raw.githubusercontent.com/username_1/bitcoin.org/mining/img/mining/en-confirmed-double-spend-cost.png)

If you look at the [BlockChain.info mining pools chart](https://blockchain.info/pools), you see there are several which can make affordable attacks against both once-confirmed and six-confirmed transactions. I suspect all that prevents them from doing so is their reputation in the community.

The others factor are:

1. How much can the attacker get from you in a single attack? For example, can they order multiple 50 BTC items at the same time?
2. How easily can the attacker profit from an attack against you? For example, how much can they resell those 50 BTC items for? Most attackers aren't going to want 20 digital copies of Plan 9 From Outer Space, but they'd love 20 times 50 BTC worth of another crypto currency.

Unfortunately, this factors don't apply just to you: they apply to everyone the attacker can attack at the same time. For example, if they can make 10 BTC by ripping you off and 190 BTC by ripping other people off, then an attack which costs less than 200 BTC is economically worth it. This means you can't fully analyze your risk by looking just at your items.

Waiting for more confirmations will always increase your security substantially, and I expect there are few things is this world worth 50 BTC that people can't wait an hour or two for them to arrive. (But hey, maybe I'm just not rich enough to be spending $20,000 USD on a regular basis.)

If this is all very depressing, I'm sorry. Long term, the goal of the community will be to decrease miner centralization. If no miner or mining pool controls more than about 1% of the network hash rate, attacks against once-confirmed transactions become both expensive and unpredictable, and attacks against six-confirmed transactions become practically impossible.

### Footnote: Math

In the image above, the average cost of a successful attack here is

```
r * h * b / p(h,b) - r * (b-1)

```

Where *r* is the block reward (25 BTC), *h* is the percentage of network
hash rate, *b* is the number of blocks to create (confirmations plus
one), and *p()* is Satoshi's probability calculator from bitcoin.pdf page
7. r \* h \* b is the average value of work used per attempt; p(h,b) is
the probability of success per attempt; r \* (b-1) is the block reward
the attacker would've received if they mined honestly.

For reference, the time (average number of blocks elapsed) an attack takes is simply

```
1 / p(h,b)

```

> **Comments:**
> **username_0**: Great answer :) What does `c` stand for in the last formula?  
> **username_0**: So practically it doesn't cost a thing to a miner to perform such an attack if his hash power is greater than 10% of the total hashing power in the network?  
> **username_1**: @username_0 Whoops `c` == `b` (`c` was for confirmations, but then I realized the formula was confirmations plus one, so I changed it to `b` for blocks).   For one conf at 10%, `p(0.10,2) == 0.050978`, so the cost is 48.8 BTC. Cost doesn't actually equal 0 BTC until 50%, but the scale of the chart doesn't allow showing such "small" amounts.  
> **username_1**: @RickyDemer great idea!  However, when I looked at it closer, I found a bug in my formula (it was returning negative results).  I fixed the bug and now the regular plot shows the expected long tail (and the numeric output matches the model of 50%==0 cost perfectly).  I updated the answer accordingly and I don't think a log axis is needed any more.  Thanks for making me pay closer attention!  
> **username_0**: @username_1 I was wondering if you have a matrix in place presenting `cost of attack` against `hash power`, I would love to take a closer look at the estimated cost for hashing power < 25%.  
> **username_1**: @username_0 here's the [code used to generate the plot](https://github.com/username_1/bitcoin.org/blob/mining/img/mining/en-confirmed-double-spend-cost.gnuplot).  MIT license.  Note, if I had to do it all over again, I'd use something besides bash & bc for the math. :-)  

---

