# Profitable Double-Spending Attacks
## 6 Related Works  
By [PERSON] [1] and [PERSON] [6], the probabilities have been studied that a DS attack will ever succeed when there is no time limit, i.e., the cut-time is set to \(t_{cut}=\infty\). Both of them applied PCPs to model the growth of chains \(H(t)\) and \(A(t)\). On one hand, the main difference between them was in probability calculations of the block confirmation process in Definition 1. [PERSON] applied the PCPs to both \(H(t)\) and \(A(t)\), whereas [PERSON] assumed the time spent for \(H(t)\geq N_{BC}\) deterministic to simplify the calculation. On the other hand, they both used the gambler's ruin approach to obtain the asymptotical behavior of \(S_{i}\) as \(i\rightarrow\infty\) by manipulating the recurrence relationship between two adjacent states. Namely, their results are based on an assumption that an indefinite number of attack chances are given [12]. On the contrary, we introduce the cut-time \(t_{cut}\) which generalizes analytical framework to the more interesting finite attack time and inferior attacker regime. By setting \(t_{cut}\) infinite, the same result \(\mathbb{P}_{DSA}\) was obtained in [6] as well. By setting a finite \(t_{cut}\), our results shall be useful when attack chances are limited due to limited amount of resources such as time and cost. In addition, we show in Theorem 2 that DS attacks with \(p_{A}<0.5\) must set a finite \(t_{cut}\) in order to expect a non-negative profit. It shall be noted that there has been no intermediate result like \(p_{DSA,i}\) in Lemma 1. We use Lemma 1 to derive the novel results. [PERSON] [6] and [PERSON] et al. [13] have analyzed the profitability of DS attacks. However, they put additional assumptions on the attack scenario to simplify the calculation of the attack time. Specifically, [PERSON] assumed the attack time to be a constant. [PERSON] et al. assumed that the attack stops if either the normal peers or the attacker achieves the block confirmation first. On the contrary, in our model, an attack can be continued for a random attack time as long as it brings profit, even if the normal peers achieve the block confirmation before the attacker does. In [PERSON] et al. [14], the profit of DS attack has been analyzed. Interestingly, they have discussed the need of cut-time for DS attacks with \(p_{A}<0.5\), which is theoretically proven in this paper in Theorem 2. They also calculated the profit of DS attacks with a finite time-limit (see Section IV-C in [14]), but their calculation was not as precise as ours in three points:  
First, the probability of attack success within a finite time-limit, i.e., \(\mathbb{P}_{AS}(t_{cut})\) in Equation (23) was never considered, which requires the distribution of the DS achieving time, i.e., \(T_{DSA}\) given in Proposition 1. Instead, their calculation used \(\mathbb{P}_{DSA}\) referring to the result in Rosenfeld [6]. This contradicts their time-limited attack scenario, since \(\mathbb{P}_{DSA}\) in [6] was resulted from the assumption of infinite time-limit. Second, they approximated costs and revenues of DS attack spent within a time-limit. Estimation of the costs and revenues requires estimations of the numbers of blocks respectively mined by honest nodes and attackers within a time-limit, but those were assumed to be constant. This was due to the absence of the time analysis we provide in Proposition 1. Third, they assumed the average block generation rates \(\lambda_{H}\), \(\lambda_{A}\) respectively by honest miners and by attackers are always the same. Since, the proportions \(p_{H}\), \(p_{A}\) of computing power occupied by the two groups can be quite different in general, such a result is not very useful. We agree to their assumption that most blockchains control the difficulty of block mining puzzle to keep the average speed of block generation constant, and thus \(\lambda_{H}\) can be considered as a constant. However, \(\lambda_{A}\) should be left as a varying quantity by \(p_{A}\).