标题： 自私矿工何时应该双花？ 显示英文标题

标题： When Should Selfish Miners Double-Spend?

摘要： 尽管自中本聪的“比特币”白皮书和伊亚尔和西雷的“多数派不足”论文以来，双花攻击和自私挖矿攻击已经被广泛研究，但除了复杂的MDP模型外，还没有对结合这两种攻击的严格随机分析。在本文中，我们首先结合了固执和自私挖矿攻击，即构建一种策略，攻击者在私有分支达到一定长度之前采取固执行为，然后切换为自私行为。我们提供了每个参数区域的最佳固执程度。接下来，我们提供了仍比诚实挖矿更有利的最大固执程度，并论证了固执程度与$k$-确认规则之间的联系。我们表明，在每次攻击周期中，如果固执程度高于$k$，则存在无成本的双花风险。该结果可以被视为在区块链设计中选择$k$的指南，在$k$-确认规则中。在每次周期中，对于给定的固执程度，我们严格制定双花风险有多大。我们在方案不如诚实挖矿有利的区域中提供了使攻击有利可图所需的最小双花值。我们进一步修改了固执阶段的攻击，以隐藏攻击并增加双花概率。最后，我们评估了结果，并为每个参数区域提供了最佳和最大固执程度以及收益。作为案例研究，使用比特币的$k=6$块确认规则，我们评估了每个池参数的攻击收益和双花风险。 显示英文摘要

摘要： Although, both double-spending and selfish-mining attacks have been extensively studied since the ``Bitcoin'' whitepaper of Nakamoto and the ``majority is not enough'' paper of Eyal and Sirer, there has been no rigorous stochastic analysis of an attack that combines the two, except for the complicated MDP models. In this paper, we first combine stubborn and selfish mining attacks, i.e., construct a strategy where the attacker acts stubborn until its private branch reaches a certain length and then switches to act selfish. We provide the optimal stubbornness for each parameter regime. Next, we provide the maximum stubbornness that is still more profitable than honest mining and argue a connection between the level of stubbornness and the $k$-confirmation rule. We show that, at each attack cycle, if the level of stubbornness is higher than $k$, there is a risk of double-spending which comes at no-cost to the adversary. The result can be seen as a guide for picking $k$ in the $k$-confirmation rule in a blockchain design. At each cycle, for a given stubbornness level, we rigorously formulate how great the risk of double-spending is. We provide the minimum double-spend value needed for an attack to be profitable in the regimes where the scheme is less profitable than honest mining. We further modify the attack in the stubborn regime in order to conceal the attack and increase the double-spending probability. Finally, we evaluate the results and provide the optimal and the maximum stubbornness levels for each parameter regime as well as the revenue. As a case study, with Bitcoin's $k=6$ block confirmation rule, we evaluate the revenue and double-spending risk of the attacks for each pool parameter.