I've been thinking about double spends and selfish miners. Imagine a miner mining selfishly for some reason. Wouldn't she get to double spend for free?
- Sender prepares a transaction paying herself and spending all her UTXOs
- Sender mines secretly on the honest best chain tip until she gets a lucky streak of N+1-k (not revealed) blocks in a row, while the honest miners get none. Her double spend tx is in any of those blocks.
- Sender places order, gets an address from receiver, and broadcast a transaction paying to the receiver's address.
- The honest transaction gets N confirmations on the honest chain, during which time the sender produces k more blocks secretly.
- Receiver accepts the payment and deliver the goods.
- Sender broadcasts her lucky streak containing the double spend tx which has more work than the honest chain.
So if sender has 25% hashpower and N=6, she needs to premine 5 blocks before sending the transaction and be pretty sure to succeed. This is because the sender will probably be able to produce 2 blocks during the time it takes the honest miners to produce 6 blocks. N+1-k=6+1-2=5.
Using this method, the sender can always keep a tx spending all her UTXOs in her private branch. As soon as she gets a lucky streak, she can place orders in one or many shops, spending all her money. and with high probability succeed with the double spending.
Peter Todd's calculations (
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2013-November/003607.html) on selfish mining shows that you don't need more than 30% of the total hashpower to find more blocks than the other miners.
Isn't the conclusion of this that a big (>29.3%) miner that mines selfishly for some reason, gets to double spend at no extra cost?
Another way to look at it may be that this double spend attack is a good reason to do selfish mining. But then it's at the cost of some lost blocks, since you have a higher risk of losing out on your block rewards when mining selfishly. Your gains from double spend must exceed those losses.
Are there any errors in my reasoning?