Closed sternhenri closed 5 years ago
From an early sim run by @sa8 this attack seems to be a bigger deal than I initially thought. It affects chain quality (fairness).
Here is how you run it (straw man):
This will sometimes work due to the "headstart" the adversarial miner gets. Specifically because of block withholding, the attacker gets to count both their and the honest parties' blocks in the first round of the attack, whereas the honest miner can only look at their own. This assumes that the adversarial miner will "drag" and wait as long as possible to release their blocks in case an attack is possible.
For reference, this attack is due to the "headstart" and doesn't apply to a longest chain protocol, but rather to GHOSTy ones. PHANTOM and Fantomette avoid this (numbers to be computed) through their variant of the Tipset rule, i.e. blocks can refer to other blocks across chains, i.e. here, the honest miners can start referring to adversarial chains after the withheld chain is released, thereby mitigating the attack (honest miners' blocks are accepted after all), with anticone rules getting the adversary rejected (thereby reducing adversary earnings -- fuzzy on details here).
@sa8's sim shows that this attack pays off pretty well:
We can imagine a smarter attack that makes things worse:
There might be an argument that this attack is hard to pull off with a perfect VDF and no lookback but I don't quite see it.
Conversation around this yielded a few things:
While the headstart issue is particular to EC (due to how tipsets work), a mitigation will have to be a fix for block withholding as a whole given the "headstart" can't be tackled on its own without risking punishing honest miners.
Some mitigation ideas:
Spitballing other mitigation strategies:
^ @ZenGround0, @nicola, @sternhenri: sounds like a good candidate to tackle next week ;-) I'd love to help formalize this and build an "attack and mitigations" catalog.
Still need to think about Expected Reward