# Resilience Analysis for Double Spending via Sequential Decision Optimization
## 6 Attack Planning as an Optimal Stopping Problem
The event that an attack launched at time \(\tau=0,\ldots\hat{T}\) is successful can be expressed in the form  
\[S(\tau)=\left\{\min_{i=\tau+n+1}^{T+1}Z_{i}\leq 0\right\}\quad\tau=0,\ldots, \hat{T}. \tag{20}\]  
There is a \"less than or equal to\" in this expression since if at the block time \(t=1,\ldots\hat{T}\) the process has reached non-positive domain \(Z_{t}\leq 0\), then immediately before the physical time corresponding to \(t\), the block difference has been negative because at \(t\) one official block was completed (block difference increased at \(t\) to \(Z_{t}\leq 0\)). In the second step, we define the stopping reward function as  
\[R_{\tau}(x) = \mathbb{E}(C1_{S(\tau)}-c1_{S(\tau)^{c}}\,|\,Z_{\tau}=x) \tag{21}\] \[= (C+c)\mathbb{P}(S(\tau)|\,Z_{\tau}=x)-c,\quad\tau=0,\ldots,\hat{ T},\;\;x\in\mathbb{Z},\]  
where the numbers \(C>0\) and \(c>0\) represent the gain and the loss resulting from the success or failure of the attack, respectively. Finally, let us agree that \(\tau=\hat{T}+1\) stands for the attacker's option to not launch any attack, which can be optimal if the chance of overtaking the official branch is too low, in view of a potential loss from an unsuccessful attack. To model such an opportunity, we define the scrap function for the time argument \(t=\hat{T}+1\) as  
\[R_{\hat{T}+1}(x)=0,\quad x\in\mathbb{Z}. \tag{22}\]  
Having introduced all ingredients, the choice of the attack time \(\tau^{*}\) yields the double-spending problem in the optimal stopping formulation:  
\[\left. \begin{array}{l}\text{determine the maximum and a maximizer to }\mathcal{T}\to\mathbb{R},\;\;\tau\mapsto\mathbb{E}(R_{\tau}(Z_{\tau}))\\ \text{where }\mathcal{T}\text{ denotes all }\{0,\ldots,\hat{T}+1\}\text{ valued stopping times.}\end{array} \right\} \tag{23}\]  
The next section deals with a solution to this problem. Like almost all stopping questions, our double-spending problem (23) is solved in terms of a recursive algorithm rather by an explicit formula. That is, investigating its solution structure requires numerical experimentation, thus parameter dependence of the optimal strategy is not obvious. Hence, we include a solution code, implemented in R.  
From the numerical experiments conducted so far, the authors observed that the solution is natural, intuitive, and not surprising. Specifically, in all calculations we determine the same behavior: The only optimal strategy is to follow secret mining without launching an attack until the block difference reaches or exceeds a critical value which depends on model parameters. For instance, the optimal attack is triggered when/if the secret branch overtakes the official branch by two or more blocks (we illustrate this by an example). In all experiments, we also observed that the optimal strategy is time-homogeneous (the block difference, triggering the attack does not depend on the length of the official branch). **Remark 4**. : _Let us explain how to interpret these outcomes, derive conclusions and elaborate on what has been gained compared to existing results._  
* _First, our analysis shows that under a (realistic) assumption that the payment moment can be chosen by the attacker, estimating success probability of a double-spending attack an ill-posed question. Specifically, since the increments of the branch length difference follow a geometric distribution (_6_), the attacker will succeed with probability one, by simply repeating over and over again the chain bifurcation, any time after having been overtaken by the official branch. Please note that this argument applies to a repeated sequence of attempts of arbitrary length rather to a single attempt, as pointed out in the remark after (_19_).__Second, the only reason such a strategy is not profitable are the costs of private mining related to the potential gain/loss from a successful/unsuccessful attack and their probabilities.