[Paper Review] An Explanation of Nakamoto's Analysis of Double-spend Attacks

A. Pinar Ozisik, Brian Neil Levine|arXiv (Cornell University)|Jan 15, 2017

Advanced Queuing Theory Analysis5 references12 citations

TL;DR

This paper provides a detailed mathematical explanation and validation of Satoshi Nakamoto's model for double-spend attack probability in Bitcoin, deriving the Gambler's Ruin-based formula and identifying a key error in the Poisson density approximation. It validates the model via Monte Carlo simulation, showing that the Poisson approximation introduces significant error for small block depths, especially at low attack probabilities.

ABSTRACT

The fundamental attack against blockchain systems is the double-spend attack. In this tutorial, we provide a very detailed explanation of just one section of Satoshi Nakamoto's original paper where the attack's probability of success is stated. We show the derivation of the mathematics relied upon by Nakamoto to create a model of the attack. We also validate the model with a Monte Carlo simulation, and we determine which model component is not perfect.

Motivation & Objective

• To provide a rigorous, step-by-step derivation of Nakamoto’s double-spend attack probability model as presented in the Bitcoin whitepaper.
• To validate Nakamoto’s mathematical model using Monte Carlo simulation, ensuring empirical accuracy of the theoretical predictions.
• To identify and analyze the specific component of the model that introduces deviation from real-world behavior, particularly under low attack probabilities.
• To clarify the assumptions and limitations of the Gambler’s Ruin analogy in the context of blockchain double-spend attacks.
• To correct a subtle but impactful error in Nakamoto’s use of the Poisson distribution for modeling block arrival times.

Proposed method

• Derives the Gambler’s Ruin probability model used by Nakamoto, showing how the success probability depends on the attacker’s mining power fraction q and block depth z.
• Uses the formula $ Q_z = \left(\frac{q}{p}\right)^z $ for $ p > q $, where p is the honest miners' block discovery rate and q the attacker’s, to model the attacker’s chance of catching up from z blocks behind.
• Applies a Poisson process to model block arrivals, assuming independent and memoryless block discovery times with rate λ = 10 minutes.
• Implements a Monte Carlo simulation that independently simulates block mining by honest and attacker miners, tracking whether the attacker can overtake the chain after z blocks.
• Compares the simulation results to both the infinite-budget model (Eq. 42) and the finite-budget model (Eq. 43), using y = z + 35 as a practical upper bound on attacker resources.
• Identifies the source of discrepancy between model and simulation by isolating three components: $ Q_z $, λ, and the Poisson density function, using controlled comparisons.

Experimental results

Research questions

• RQ1 What is the mathematical derivation behind Nakamoto’s formula for double-spend attack success probability, and how does it relate to the Gambler’s Ruin problem?
• RQ2 How accurate is Nakamoto’s theoretical model when compared to empirical results from a Monte Carlo simulation of the attack?
• RQ3 Which component of the model—$ Q_z $, λ, or the Poisson density function—most significantly contributes to the discrepancy between theory and simulation?
• RQ4 How does the finite computational budget of an attacker affect the attack probability, and how well does the infinite-budget assumption approximate reality?
• RQ5 Why does the model show higher relative error for low values of q, and what causes the observed deviation in simulation results?

Key findings

• The model’s prediction of double-spend success probability closely matches the Monte Carlo simulation for q < 0.45, indicating strong empirical validity under moderate attack power.
• The primary source of error in the model is the Poisson density function approximation, which underestimates the probability of rare events, especially for small values of z and low q.
• The comparison of $ Q_z $ and λ values between model and simulation shows perfect alignment, confirming that these components are correctly modeled.
• The relative error between the model and simulation reaches up to 100% for low values of q, primarily due to the Poisson approximation’s poor handling of low-probability block arrival sequences.
• The finite-budget model (Eq. 43) with y = z + 35 closely approximates the infinite-budget case (Eq. 42), validating its use as a practical substitute.
• The study corrects a subtle but meaningful error in Nakamoto’s original model: the Poisson approximation introduces systematic bias, particularly in the tail probabilities of the attack success distribution.