# Profitable Double-Spending Attacks
## 2 The Attack Model
### Attack Scenario  
We extend a DS attack scenario which has been considered by [PERSON] [1] and [PERSON] [6]. Specifically, we add a time-finite attack scenario. There are two groups of miners, the normal group of honest miners and a single attacker. The normal group tends the honest chain.  
When the attacker decides to launch a DS attack, he/she makes a target transaction for the payment of goods or services. In the target transaction, the transfer of cryptocurrency ownership from the attacker to a victim is written. We denote \(t=0\) as the time at which the last block of the honest chain has been generated. At time \(t=0\), the attacker announces the target transaction to normal group so that normal group starts to put it into the honest chain. At the same time \(t=0\), the attacker makes a fork of the honest chain which stems from the last block and builds it in secret. We refer to this secret fork as fraudulent chain. In the fraudulent chain, a fraudulent transaction is contained which alters the target transaction in a way that deceives the victim and benefits the attacker.  
Before shipping goods or providing services to the attacker, the victim will obviously choose to wait for a few more blocks on the honest chain in addition to the block on which the his/her transaction has been entered, i.e., so-called block confirmation. [PERSON] et al. [21] showed the importance of block confirmation: attackers are able to double-spend against zero block-confirmation even without mining a single block on the fraudulent chain at all. The number of blocks the victim chooses to wait for is referred to as the block confirmation number \(N_{BC}\in\mathbb{N}\), which includes the block on which the target transaction is entered.  
The attacker chooses to make the fraudulent chain public if his/her attack was successful. An attack is successful if the fraudulent chain is longer than the honest chain after the moment the block confirmation is satisfied. We define two necessary conditions \(\mathcal{G}^{(1)},\mathcal{G}^{(2)}\), for a success of DS attack:  
**Definition 1**.: _A DS attack succeeds only if there exists a DS attack achieving (DSA) time \(T_{DSA}\in(0,\infty)\) such that_  
1. \(\mathcal{G}^{(1)}\)_: (block confirmation) the length of the honest chain for the duration of time_ \(T_{DSA}\) _has grown greater than or equal to_ \(N_{BC}\)_, and_
2. \(\mathcal{G}^{(2)}\)_: (success in PoW competition) the length of the fraudulent chain for the duration of time_ \(T_{DSA}\) _has grown longer than that of the honest chain._  
Rational attackers will not wait for his success indefinitely since growing the attacker's chain incurs the expense per time spent for operating the computing power. The attack thus shall put a limit to the end time to cut loss. We refer to this end time as the cut-time \(t_{cut}\in\mathbb{R}^{+}\). A sufficient condition for the success of DS attack can be defined with applying the cut-time \(t_{cut}\):  
**Definition 2**.: _For a given cut-time \(t_{cut}\in\mathbb{R}^{+}\), the success of DS attack is declared if, and only if, there exists a DSA time \(T_{DSA}\in(0,t_{cut})\) at which \(\mathcal{G}^{(1)}\) and \(\mathcal{G}^{(2)}\) in Definition 1 have been achieved._