  Simple closed-form upper and lower bounds are developed for the security of
the Nakamoto consensus as a function of the confirmation depth, the honest and
adversarial block mining rates, and an upper bound on the block propagation
delay. The bounds are exponential in the confirmation depth and apply
regardless of the adversary's attack strategy. The gap between the upper and
lower bounds is small for Bitcoin's parameters. For example, assuming an
average block interval of 10 minutes, a network delay bound of ten seconds, and
10% adversarial mining power, the widely used 6-block confirmation rule yields
a safety violation between 0.11% and 0.35% probability.
