Adversarial security
Generated by swift run LatticeSim --seed 42 (deterministic; reproduces this checked-in artifact). swift run LatticeSim --adversarial --seed 42 renders the same report to stdout.
Economic security of no-finality consensus as a function of the attacker’s share f of this chain’s imported root-grind contributions. Exact path proofs, the setup-wide root-work floor, and per-chain target classification happen before these scenarios. All scenarios drive the real chain-local ChainState fork choice: true cumulative work first, then the lexicographically smaller canonical CID of the competing child blocks (spec §9.4). Parent canonicity and sibling state are not inputs.
(a) Deep reorg — achievable reorg depth vs f
Section titled “(a) Deep reorg — achievable reorg depth vs f”Honest segment depth: 24 blocks (work=1 each), 200 seeded race trials per f. The attacker privately races the honest segment and publishes; greater true cumulative work wins, while equal work uses the smaller-CID tie-break.
| f | honest depth | mean reorg depth | max reorg depth | reorg probability |
|---|---|---|---|---|
| 10.0% | 24 | +0.000 | 0 | 0.0% |
| 20.0% | 24 | +0.000 | 0 | 0.0% |
| 25.0% | 24 | +0.000 | 0 | 0.0% |
| 30.0% | 24 | +0.000 | 0 | 0.0% |
| 33.0% | 24 | +0.120 | 24 | 0.5% |
| 40.0% | 24 | +1.680 | 24 | 7.0% |
| 45.0% | 24 | +4.440 | 24 | 18.5% |
| 50.0% | 24 | +9.960 | 24 | 41.5% |
| 60.0% | 24 | +21.360 | 24 | 89.0% |
Reorg probability and mean depth grow monotonically with f and stay near zero well below majority: deep reorgs become likely only as f approaches and exceeds 50%, where the private branch out-works the honest segment over the same race.
(b) Selfish mining — revenue share vs f
Section titled “(b) Selfish mining — revenue share vs f”Eyal–Sirer closed-form revenue evaluated at the tie-break advantage γ the node’s own fork choice realises. The matched-tie (“0′”) race is driven through the REAL fork choice. With equal targets and independent block hashes, either miner’s block wins half the ties, so the network measures γ = 1/2. gain = share − f becomes positive above f = 1/4.
| f | revenue share | gain (share − f) | profitable |
|---|---|---|---|
| 10.0% | 7.2% | -0.028 | no |
| 20.0% | 18.2% | -0.018 | no |
| 25.0% | 25.0% | +0.000 | no |
| 30.0% | 32.7% | +0.027 | yes |
| 33.0% | 37.9% | +0.049 | yes |
| 40.0% | 52.6% | +0.126 | yes |
| 45.0% | 68.1% | +0.231 | yes |
| 50.0% | 100.0% | +0.500 | yes |
| 60.0% | 100.0% | +0.400 | yes |
With the fork-choice-measured γ = 1/2 the threshold is exactly f = 1/4: below it the attacker earns less than its fair share; above it selfish mining is profitable.
(c) Balancing attack — feasibility/cost vs f
Section titled “(c) Balancing attack — feasibility/cost vs f”Two equal-work honest branches; the attacker must win every re-balancing PoW race to sustain the competition. Horizon: 64 rounds, 200 seeded trials per f.
| f | mean stall (rounds) | max stall | survival prob | mean attacker blocks |
|---|---|---|---|---|
| 10.0% | +0.110 | 2 | 0.0% | +0.110 |
| 20.0% | +0.240 | 3 | 0.0% | +0.240 |
| 25.0% | +0.395 | 5 | 0.0% | +0.395 |
| 30.0% | +0.540 | 4 | 0.0% | +0.540 |
| 33.0% | +0.560 | 6 | 0.0% | +0.560 |
| 40.0% | +0.765 | 7 | 0.0% | +0.765 |
| 45.0% | +0.920 | 12 | 0.0% | +0.920 |
| 50.0% | +0.985 | 9 | 0.0% | +0.985 |
| 60.0% | +1.450 | 8 | 0.0% | +1.450 |
Each round the attacker must re-win a PoW race it loses with probability 1 − f, so full-horizon survival scales as f^horizon while each sustained round burns one attacker block. This is a cost/probability curve, not a separate 50% threshold.
Security-budget thresholds
Section titled “Security-budget thresholds”Two distinct thresholds fall out of the curves and must be priced separately — conflating them silently over-states the security budget:
- Majority threshold (deep-reorg safety): f > 50%. Out-working a
24-deep honest segment becomes likely above majority. - Balancing liveness cost: full-horizon survival scales as f^horizon in this model; it does not introduce a fixed 50% threshold.
- Economic threshold (selfish-mining profitability): f = 1/4 = 25%. This is the lower economic-security bound and the binding one for the security budget. It is the analytic Eyal–Sirer crossing R(f, γ=1/2) = f at the γ = 1/2 the fork choice measures — well below majority — so a rational attacker has a revenue incentive to deviate at the classic threshold long before it can reorg or stall the chain.
A security budget must be priced against the lower of the two — the selfish-mining economic threshold — not the 50% majority point. The budget is the honest root-grind cost required to keep an attacker below that fraction of this chain’s verified work stream; another chain’s canonical history cannot change work already imported here.
Source: Lattice/docs/consensus/adversarial-report.md at 54.2.1