During a 51% attack, What Can the Attacker Actually Accomplish?

Question

During an attack on the network, where the attacker has more than 51% of hashing power (or the equivalent of Ether in PoS), what can the attacker do and not do to the chain and the contracts on it?

It is my understanding that they can't fake your signature (as they don't have your private key) and so they can't steal your coins or execute your contracts. So is it only thing they can accomplish limited to a double-spend?

Answer 1

In a temporary 51% attack, the attacker can:

• censor or reorder transactions at will (i.e. prevent you from using your money or any dApps)
• doublespend ether/tokens/shares at will to drain non-blockchain resources of exchanges or vendors
• steal from certain types of contracts which rely on deposit-challenge-verify mechanisms shorter in length than the attack
• "double-spend" inside payment and state channels with challenge periods shorter in length than the attack
• collect 100% of the block and transaction rewards during the attack
• etc.

In a sustained 51% attack, the attacker can:

• do all of the above
• steal from all deposit-challenge-verify contracts and most payment/state channels of which they were a participant
• reduce or otherwise manipulate difficulty on the network (optionally with the result of changing the total number of ether in existence).
• steal any coins not dating from the genesis block (by reversing old blocks and claiming backdated block rewards)
• delete your contracts or transaction history (by reversing old blocks and censoring their original inclusion)
• etc.

A 51% attack in and of itself does not allow the attacker to:

• obtain your private key or fake your signature
• falsely claim inaccurate outcomes of a contract's operation
• move your ether/tokens/shares (except by a technique mentioned above)
• etc.

Note: the above analysis assumes a PoW 51% attack. PoS 51% attacks have some similar properties, but a fuller analysis depends on the exact type of PoS in use.

Answer 2

As we've seen, all a 51% attack does is to produce a fork. In cases where the attack does not have majority support, the 49% can just continue to mine on the original chain, exchanges can continue to trade on the original chain, and the attacker will have received block rewards in a token that is worthless, the attacker will have wasted a lot of resources on non-rewarded PoW, and the attack will not have accomplished anything.

The reason Satoshi Nakamoto highlighted the 51% attack is probably because it is a trend for a whitepaper to have a bit of self-critique. Now 7 years later, we've seen real world examples of these attacks, and have a better understanding of them, and can see that the risk has been exaggerated as miners are only a minor part of the security model of blockchains. As long as there are enough miners to prove that the blockchain remains intact, 51% attack "spin-off chains" would not really do any damage.

TL;DR: The PoW consensus is ultimately meant to prove integrity of the blockchain, not to prevent spin-off chains.