# Resilience Analysis for Double Spending via Sequential Decision Optimization
## 6 Attack Planning as an Optimal Stopping Problem  
Assume that the attacker can freely choose the time of payment. Doing so, he/she can work on a private secret branch long before his/her payment is placed. For such situation, the analysis of the double spending is different from the approach explained in Section 3 and requires solving a stopping problem. Consider the block difference dynamics \((Z_{t})_{t=0}^{T}\) from (5). Launching the double-spending attack at the block time \(\tau=0,\ldots,T\) simply means that the payment will be included into block \(\tau+1\) of the official branch. (Recall that the secret branch contains an invalidation of the paying transaction by a non-inclusion of the attacker's paying transaction into secret branch). That is, the crucial question is how to choose the block time \(\tau=0,\ldots,T\) optimally at which the payment is made. Notice that although the state space \(\mathbb{Z}\) of the Markov chain \((Z_{t})_{t=0}^{T}\) is infinite, all relevant situations occur within a finite range. On this account, it is possible to formulate an equivalent optimal stopping/switching problem whose state process follows a finite-state and finite-horizon Markov chain. The idea is to appropriately adjust the original Markov dynamics to not leave a finite state range. For this, let us agree that  
\[\left\{\tilde{Z}_{t}>t+n\right\}=\left\{Z_{t}<-n\right\},\quad t=0,1,2\ldots, \tag{19}\]  
represents a sure opportunity for a successful double spending launched at time \(\tau=t\). Indeed, by attacking immediately with payment at \(\tau=t\) if \(\{Z_{t}<-n\}\) occurs, the last confirmation block is obtained at the time \(t+n\), and the next official block is obtained at block time \(t+n+1\) when the secret branch is at least of the same length \(Z_{t+n+1}\leq Z_{t}+n+1\leq 0\) as the official chain, i.e., right before the block time \(t+n+1\), the secret branch must have been longer. **Remark 3**: _Please note that the insight (19) can be combined with the geometric distribution (9) to conclude that if the mining capacity ratio is positive, then the probability to succeed in the double-spending attack at least once in an infinite sequence of attempts equals to one. Indeed, suppose that \(q>0\). Having started secret mining, the probability of the event \(\{\tilde{Z}_{1}>1+n\}\) that the attacker has more than \(n+1\) blocks in the secret chain at the time when one official block has been completed is positive due to (9). However, if the attacker has not succeeded in overtaking \(\{\tilde{Z}_{1}\leq 1+n\}\), then the secret branch will be discarded, and a new chain bifurcation will be started, this time right after the current official block, with the attempt to overtake the official branch by more than \(n+1\) at the time when the next official block is obtained. This second independent attempt yields a success with the same positive probability. Repeating this procedure, one obtains a sequence of Bernoulli experiments, each with the same positive success probability, which yields a success with probability one after a finite number of trials._  
Now, we clarify the relevant time horizon of the stopping problem. Because we have imposed a finite limit \(T\) on the length of the official branch, we agree that for \(\tau>T-n\) a successful attack is not possible. Specifically, since the payment is placed into block \(\tau+1\) and \(n\) confirming blocks are expected, the last confirmation block \(\tau+n>T\) would be beyond the maximal branch length which can be abandoned. That is, we can assume that the time \(\tau\) must be chosen within the finite-horizon \(\tau=0,\ldots,\tilde{T}\) with the last time point \(\tilde{T}=T-n\). The decision whether to attack must be based on the current block time \(t=0,\ldots,\tilde{T}\) and on the recent block difference \(Z_{t}\).