  A widespread security claim of the Bitcoin system, presented in the original
Bitcoin white-paper, states that the security of the system is guaranteed as
long as there is no attacker in possession of half or more of the total
computational power used to maintain the system. This claim, however, is proved
based on theoretically flawed assumptions.
  In the paper we analyze two kinds of attacks based on two theoretical flaws:
the Block Discarding Attack and the Difficulty Raising Attack. We argue that
the current theoretical limit of attacker's fraction of total computational
power essential for the security of the system is in a sense not $\frac{1}{2}$
but a bit less than $\frac{1}{4}$, and outline proposals for protocol change
that can raise this limit to be as close to $\frac{1}{2}$ as we want.
  The basic idea of the Block Discarding Attack has been noted as early as
2010, and lately was independently though-of and analyzed by both author of
this paper and authors of a most recently pre-print published paper. We thus
focus on the major differences of our analysis, and try to explain the
unfortunate surprising coincidence. To the best of our knowledge, the second
attack is presented here for the first time.
