I'm trying to dig deep into Casper and one of the things that keep coming up is the long-range attack in PoS. I understand the attack at a high level - basically you would go back some large amount of blocks where you had a large stake in the network and start forging blocks such that when you arrived at the height of the main chain, you would hold a large amount of the currency and take over the chain.
I saw a similar question here regarding the attack whose answer quoted the below excerpt from the Ethereum blog:
In a naively implemented proof of stake, suppose that there is an attacker with 1% of all coins at or shortly after the genesis block. That attacker then starts their own chain, and starts mining it. Although the attacker will find themselves selected for producing a block only 1% of the time, they can easily produce 100 times as many blocks, and simply create a longer blockchain in that way.
The question I have regarding this quote is how exactly would the secret chain outpace parent chain? From my understanding, the general way to mine a block in PoS 3 is to solve this equation:
hash(kernel) ≤ target × balance of UTXO
Where the kernel is derived from the below:
- nTimeTx : current timestamp (incremented every second)
- nTxPrevTime: Timestamp of the UTXO
- nPrevoutNum: Output number of the UTXO
- nTxPrevOffset: Offset of the UTXO inside the block
- nTimeBlockFrom: Timestamp of the block which provided the UTXO
- nStakeModifier : a 64-bit string seeded from the block chain
How can you manipulate this to mine blocks faster than the parent chain? Would it be the timestamps?
EDIT: After thinking about this a bit more, I'm not sure if this attack is actually feasible... it seems purely theoretical. My logic is as follows: suppose the attacker created his own chain with even 50% of the total 'mainchain' coins. Since he is on his own chain, he will have 100% of the total staked coins on his own chain. With the 100% of the total coins on his own chain, he will certainly be the only minter on the secret chain and will be selected for half of the total possible 'minting opportunities' on the chain.
Indeed, because he is the only staker online in his own chain, he will mint every block, but the issue is the attacker is still subject to the 1 transaction per UTXO per second, so he cannot produce blocks faster. He can certainly produce a massive blockchain much larger than the mainchain because the time for him to accelerate through a couple years is only maybe a couple seconds in the simulation, but the issue will be that the head timestamp might be twice as long as the mainchain (perhaps a year), and clients will simply not accept a chain whose head is years into the future.
If anyone has any additional insight or has another approach to thinking about the problem, I would appreciate it! I found this source to be quite good.