Pith. sign in

REVIEW 15 references

Bitcoin Security under Temporary Dishonest Majority

T0 review · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Extends the Bitcoin backbone security analysis to temporary dishonest majority with offline parties, but leaves the central proofs to a self-cited full version.

arxiv 1908.00427 v1 pith:AW6KWRP2 submitted 2019-08-01 cs.CR

Georgia Avarikioti , Lukas Kaeppeli , Yuyi Wang , Roger Wattenhofer This is my paper · ORCID
classification cs.CR
keywords bitcoinmajoritymodeldishonesthonestparticipantssecuritysynchronous
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Bitcoin's security is usually analyzed under the assumption that more than half of the mining power is honest at all times. This paper tries to relax that assumption. It asks what happens if dishonest miners are the majority for a period of time, as long as the expected number of honest miners that are online and active is still larger than the dishonest miners. The authors call offline honest miners 'sleepy'. They also let the adversary cause honest miners to go offline, for example by denial-of-service attacks. The paper sets up three models of communication: a synchronous model with no delays, a bounded-delay (semi-synchronous) model, and a synchronous model where offline parties miss messages. In each model, the authors state lemmas about how many blocks honest and adversarial miners can produce, and they derive upper bounds on the fraction of sleepy miners that can be tolerated for a given fraction of corrupted miners. They plot these bounds for a realistic Bitcoin block rate. The central problem is that the submitted paper does not actually prove the main security properties, namely chain growth, common prefix, and chain quality. The text says 'The proofs can be found in the full version' and the full version is reference [2], which is the same paper. Several key lemmas are also stated without proof. So the claim 'We prove Bitcoin is secure under temporary dishonest majority' is not supported by the text as written. The models and some preliminary inequalities are clear, but the load-bearing derivations are missing.
Extended reading notes

Core claim

The paper's central assertion is stated in the Abstract: 'We prove Bitcoin is secure under temporary dishonest majority.' More specifically, Section 3 claims that in the q-bounded synchronous model, the Bitcoin backbone protocol satisfies chain growth, common prefix, and chain quality under the expected honest majority assumption t <= c(1-delta)E[nalert], with proofs deferred to the full version [2]. If the paper is correct, Bitcoin tolerates an adversary that may corrupt a fraction of parties and put honest parties offline, provided the expected number of alert honest parties is a c(1-delta) majority.

Load-bearing premise

In Section 5.1, the security bounds in the message-loss model rely on the assumption that 'the adversary is not informed if a party Pi is set to sleep, after sending an instruction (sleep, Pi) to the control program C.' The derived upper bounds on s assume the adversary cannot tell which sleep instructions succeeded. If the adversary knew which honest parties were asleep, the honest majority condition would have to be t + E[nsleepy] <= c(1-delta)E[n*_alert], and the paper states this would require a different model. This ignorance-of-sleep-success assumption is load-bearing: if real-world attackers can detect when their DDoS or eclipse attempts succeed, the tolerance bounds in this paper do not apply.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the expected-honest-majority condition parameterized by delta, c, and epsilon; on the i.i.d. sleepy model; and on the adversary's ignorance of sleep success. The typical-execution lemma and random oracle are standard. No new entities are introduced.

free parameters (4)
  • c = 0.5 in Section 6
    Upper bounds the adversary's mining power relative to alert honest parties; chosen by hand, not derived. The plotted sleepy-party bounds depend on c.
  • delta = delta >= 2E[Xi]+2eps (sync), >= 2Delta E[Xi]+4eps+4Delta/(eta kappa) (semi-sync), >= 3eps+2E[X*_i] (message loss)
    Advantage parameter introduced ad hoc to force the adversarial block bound below the honest unique-success bound (Z(S) < Y(S)).
  • epsilon = 0.005 in Section 6
    Concentration parameter in typical execution; chosen by hand.
  • E[Xi] = 0.03 for all three models in Section 6
    Expected success probability per round; fixed to a Bitcoin-realistic value, although it depends on s, the variable being bounded. The paper acknowledges ignoring this dependency.
assumptions (5)
  • standard math Random oracle and diffusion functionalities model the hash function and network communication.
    Standard ideal-world modeling in the blockchain literature, from [7].
  • domain assumption Each honest party is independently set to sleep with probability s each round.
    Models crash failures as i.i.d. offline events; used to compute E[nalert].
  • standard math Typical execution: Chernoff concentration and no hash collisions hold with overwhelming probability.
    Lemma 1, relying on the random oracle being collision-resistant.
  • domain assumption The adversary is not informed whether a sleep instruction succeeds.
    Section 5.1 asserts realism and states a knowing adversary would require a different model; this is load-bearing for the message-loss bounds.
  • ad hoc to paper 2E[Xi] <= 1.
    Used in the proof of Lemma 3 but not stated as a general assumption; justified only by noting Bitcoin's E[Xi] is 2 to 3 percent.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Bitcoin Security under Temporary Dishonest Majority." pith.science (2026). https://pith.science/paper/AW6KWRP2

@misc{pith2026190800427,
  author       = {Pith},
  title        = {Pith review of: Bitcoin Security under Temporary Dishonest Majority},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AW6KWRP2}},
  note         = {Machine review of arXiv:1908.00427}
}
read the original abstract

We prove Bitcoin is secure under temporary dishonest majority. We assume the adversary can corrupt a specific fraction of parties and also introduce crash failures, i.e., some honest participants are offline during the execution of the protocol. We demand a majority of honest online participants on expectation. We explore three different models and present the requirements for proving Bitcoin's security in all of them: we first examine a synchronous model, then extend to a bounded delay model and last we consider a synchronous model that allows message losses.

Figures

Figures reproduced from arXiv: 1908.00427 by the authors.

Figure 1
Figure 1. This figure shows the upper bound on the fraction of sleepy parties, depending on the fraction of corrupted parties. One might be wondering how we could allow such high values for s. We have fixed E[Xi ], respectively E[X∗ i ], for our calculations. We can do this without loss of generality, since these expected values are dependent on p, which depends on the difficulty parameter T . The adjustment of T , used to re… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 15 canonical work pages

  1. [1]

    In: 2017 IEEE Symposium on Security and P rivacy, SP 2017, San Jose, CA, USA, May 22-26, 2017

    Apostolaki, M., Zohar, A., Vanbever, L.: Hijacking bitco in: Routing attacks on cryptocurrencies. In: 2017 IEEE Symposium on Security and P rivacy, SP 2017, San Jose, CA, USA, May 22-26, 2017. pp. 375–392 (2017)

    work page 2017

  2. [2]

    Avarikioti, G., K¨ appeli, L., Wang, Y., Wattenhofer, R.: Bitcoin Security under Temporary Dishonest Majority (2019)

    work page 2019

  3. [3]

    In: Bitcoin18: Proceedings of the 5th Workshop on Bitcoin and Blockchain Research (2018 )

    Bonneau, J.: Hostile blockchain takeovers (short paper) . In: Bitcoin18: Proceedings of the 5th Workshop on Bitcoin and Blockchain Research (2018 )

    work page 2018

  4. [4]

    In: IEEE P2P 2013 Proceedings (Sep 2013)

    Decker, C., Wattenhofer, R.: Information propagation in the bitcoin network. In: IEEE P2P 2013 Proceedings (Sep 2013)

    work page 2013

  5. [5]

    In: 2015 IEEE Symposium on S ecurity and Privacy, SP 2015, San Jose, CA, USA, May 17-21, 2015

    Eyal, I.: The miner’s dilemma. In: 2015 IEEE Symposium on S ecurity and Privacy, SP 2015, San Jose, CA, USA, May 17-21, 2015. pp. 89–103 (2015)

    work page 2015

  6. [6]

    In: Commun

    Eyal, I., Sirer, E.G.: Majority is not enough: Bitcoin min ing is vulnerable. In: Commun. ACM (Nov 2013)

    work page 2013

  7. [7]

    Garay, J.A., Kiayias, A., Leonardos, N.: The bitcoin back bone protocol: Analysis and applications. In: Advances in Cryptology - EUROCRYPT 20 15 - 34th An- nual International Conference on the Theory and Applicatio ns of Cryptographic Techniques, Sofia, Bulgaria, April 26-30, 2015, Proceeding s, Part II. pp. 281–310 (2015)

    work page 2015

  8. [8]

    In: Proceedings of the 24th USENIX Co nference on Security Symposium

    Heilman, E., Kendler, A., Zohar, A., Goldberg, S.: Eclips e attacks on bitcoin’s peer-to-peer network. In: Proceedings of the 24th USENIX Co nference on Security Symposium. pp. 129–144. SEC’15, USENIX Association, Berkeley, CA, USA (2015)

    work page 2015

Show all 15 references
  1. [9]

    In: Pr oceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Secur ity, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017

    Kwon, Y., Kim, D., Son, Y., Vasserman, E.Y., Kim, Y.: Be sel fish and avoid dilem- mas: Fork after withholding (F A W) attacks on bitcoin. In: Pr oceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Secur ity, CCS 2017, Dallas, TX, USA, October 30 - Novemb...

    2017

  2. [10]

    In: https://bitcoin.org/bitcoin.pdf (Oct 2008)

    Nakamoto, S.: Bitcoin: A peer-to-peer electronic cash s ystem. In: https://bitcoin.org/bitcoin.pdf (Oct 2008)

    2008

  3. [11]

    2016 IEEE Europ ean Symposium on Security and Privacy (EuroS&P) pp

    Nayak, K., Kumar, S., Miller, A., Shi, E.: Stubborn minin g: Generalizing selfish mining and combining with an eclipse attack. 2016 IEEE Europ ean Symposium on Security and Privacy (EuroS&P) pp. 305–320 (2015)

    2015

  4. [12]

    In: Taka gi, T., Peyrin, T

    Pass, R., Shi, E.: The sleepy model of consensus. In: Taka gi, T., Peyrin, T. (eds.) Advances in Cryptology – ASIACRYPT 2017. pp. 380–409. Sprin ger International Publishing, Cham (2017)

    2017

  5. [13]

    In: Financial Cryptography and Data Security - 20t h International Confer- ence, FC 2016, Christ Church, Barbados, February 22-26, 201 6, Revised Selected Papers

    Sapirshtein, A., Sompolinsky, Y., Zohar, A.: Optimal se lfish mining strategies in bitcoin. In: Financial Cryptography and Data Security - 20t h International Confer- ence, FC 2016, Christ Church, Barbados, February 22-26, 201 6, Revised Selected Papers. pp. 515–532 (2016)

    2016

  6. [14]

    In: IEEE Infocom 2006 (Apr 2 006)

    Singh, A., Ngan, T.W.J., Druschel, P., Wallach, D.S.: Ec lipse attacks on overlay networks: Threats and defenses. In: IEEE Infocom 2006 (Apr 2 006)

    2006

  7. [15]

    In: Springer, pp

    Sit, E., Morris, R.: Security considerations for peer-t o-peer distributed hash tables. In: Springer, pp. 261269 (Oct 2002)

    2002

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.