Skip to main content

The Back-of-Envelope Calculation of the Transaction Confirmation Number

Think of the chain quality attack as a gambler's ruin problem. The attacker has an infinite number of coins, but the honest miners have σ\sigma, which is the transaction confirmation number. In each round, one player wins a coin, and the other loses a coin. The honest miner loses if there is no coin in his hands. The attacker never gives up—note that this assumption requires that the attacker controls less than a third of the total mining power.

Now analysis of the gambler's ruin tells us the probability that the attacker wins the game is

P(attacker wins)=(p1p)σ,{\rm P(attacker\ wins)}=(\frac{p}{1-p})^\sigma,

where pp is the probability that the attacker wins a coin. If we consider the attacker as a selfish miner with perfect network propagation advantage, we have

p=α+o1αo,p=\frac{\alpha+o}{1-\alpha-o} ,

where α\alpha is the attacker's mining power share, oo is the proportion of orphaned blocks among all the blocks. See this paper for the rationale behind the above equation. Note that this orphan rate definition is slightly different from the orphan rate in the NC-Max paper. Now we have

P(attacker wins)=(α+o12α2o)σ{\rm P(attacker\ wins)}=(\frac{\alpha+o}{1-2\alpha-2o})^\sigma

If we assume o=0o=0 and σ=6\sigma=6 in Bitcoin, α=0.25\alpha=0.25 , to get the same probability that the attacker wins the game, we need to have

(0.250.5)6=(0.25+o0.52o)σ,(\frac{0.25}{0.5})^6=(\frac{0.25+o}{0.5-2o})^\sigma ,


σ=log0.25+o0.52o0.015625.\sigma=\log_{\frac{0.25+o}{0.5-2o}}0.015625 .

In Nervos CKB, when o=5%o=5\%, σ=14.4\sigma=14.4; when o=2.5%o=2.5\%, σ=8.4\sigma=8.4.

If we assume, similar to Bitcoin, o=0o=0, σ=6\sigma=6, and α=0.3\alpha=0.3, to achieve the same level of security in Nervos CKB, when o=2.5%o=2.5\%, we have σ=23.29\sigma=23.29.

If we assume, similar to Ethereum, o=6%o=6\%, σ=12\sigma=12, and α=0.25\alpha=0.25, to achieve the same level of security in Nervos CKB, when o=0.025%o=0.025\%, we have σ=4.96\sigma=4.96.

In reality, oo can be estimated as 0=u200/(200+u200)0=u{200}/(200+u{200}), where u200u_{200} is the number of uncle blocks embedded in the last 200 main chain blocks. By definition σ\sigma cannot be smaller than 6; when σ>30\sigma>30, use 30 as an upper bound.