start	end	text
0	7260	Hello everyone, this is Bo Min Lee from Constamp. I'm a security auditor.
7840	13400	And the topic today I'm going to talk about is double spending in BSV.
13400	15200	Is it possible?
16860	24820	Firstly, I will briefly explain what is Bitcoin SV, also called BSV.
24820	29540	And secondly, I will talk about is double spending possible.
29540	36440	What is double spending? And is double spending possible for BSV in its current condition?
36840	42180	Thirdly, I will talk about how to implement exactly, more details,
42180	47980	how to do the double spending in BSV, and what's the cost.
49500	59520	Finally, I will talk about another way to do double spending, specifically in BSV only.
60520	63860	First, what is BSV?
64160	71820	In 2017, we forked Bitcoin Cash.
72360	84140	And the goal of the BSV team is to stick to the great original vision of Bitcoin,
84140	87100	try to make it the cash for everyone.
87840	89420	I mean literally for everyone.
89420	91220	Everyone can use it as a cash.
91220	102300	But not only like cryptocurrency as a trading pair to the hedging or speculation.
103260	105760	BSV's goal is to be the cash for everyone.
105760	110940	So to achieve that, you need to be fast in reaching the settlement state.
110940	115120	Just like nowadays, what the cash is, right?
115500	129920	They have to achieve this by enabling certain characteristics and certain technical characteristics, right?
129920	133820	So the first one, I think the core concept of it is two.
133820	136600	First is to increase the block size.
136600	140100	Second one is to support the zero combination.
140100	142520	That's what they claimed.
143600	145380	So this is for BSV.
146700	151340	In this slide, I'm going to explain briefly what is double spending.
152200	159620	So first, in a normal trading scenario, there's a buyer and a seller, right?
159620	161900	And there's a BSV blockchain.
161900	172140	So all the balance changes depend on the transaction the buyer sent to the BSV blockchain.
172140	178080	We enable the transfer of Bitcoin SV, right?
178080	180740	And this is a trading scenario.
180740	184180	When a buyer wants to purchase a product from the seller,
184180	190300	first tell the seller that I'm going to purchase one good from you, okay?
190300	194320	And then send a transaction to BSV blockchain.
194520	197640	Let's call it transaction one or whatever.
197640	200320	Send one BSV to the seller.
200320	203160	This is what this transaction do.
203160	208180	And then the seller check that the transaction is okay, is valid,
208180	212400	and it's BSV balance of the seller's wallet plus one.
212400	216940	And then the seller is feel safe, good.
216940	220740	And then the seller will deliver the product to the buyer.
221040	223460	So this sounds great, right?
223600	225200	Seller earns money.
225340	228460	However, the next buyer ran away.
228460	235400	Suddenly, he did something, revert the original transaction.
235400	237500	We call that transaction one, right?
237500	239480	The transaction one was reverted.
239720	244820	And the seller will find out that the transaction one is reverted.
244820	251000	So then the BSV balance will minus one because it no longer exists.
251380	256680	Then seller cannot get back the product and the buyer has run away.
256680	260560	So this is what double spending is.
260560	262300	The seller lose money.
262640	264140	The buyer is a hacker.
265140	274000	So to explain how to do that in BSV, firstly, I will talk about what is POW insured.
274000	276620	Because this is related.
276940	284640	First, POW is the most commonly used algorithm for the public blockchain system nowadays.
284640	288920	It's a consensus algorithm that includes BSV.
288920	293560	BSV also use POW-based consensus algorithm.
293560	296220	And the concept of it, I'll just talk about the concept.
296220	313360	The concept of this is that probability of a miner a chance to execute any, to include any transaction that they select is proportional to the computational power that the miners owns.
313360	318680	This is the easiest way to understand this concept.
319660	324460	And then we have a website called crypto51.app.
324560	334580	It shows all the coins, all the famous coins, the symbol, the market gap, the algorithm they are using, and the hash rate it currently have.
334580	340400	Which means the total power, total hash power that they currently have on the network.
340700	348400	And the one hour attack cost, if you want to attack it, using the 51% attack.
348400	351940	Oh, I should explain what is the 51% attack cost here.
351940	366080	So the probability of a miner to include transaction, whatever he wants, is proportional to its mining power, right?
366080	380960	So 51% of hashing power means it has 51% of probability to be the miner that can include transactions.
380960	386340	To be the miner to change the ledger, right?
386340	400420	So 51% attack means an attacker having the hashing power for more than 51%.
400420	403360	So I can do something malicious.
403680	412480	Here is the hashing rate that is currently owned by that different network here, different blockchain.
412480	441200	So on the other hand, or on the other word, if you are a hacker and you have a hash rate more than 51%, for instance, for Bitcoin SV, you have more than 1,500 Pega hash rates and then you can do something malicious like double spending.
441840	447360	And this is a one hour attacker cost if you want to spend it on the internet.
447360	450400	I mean during the hash rate. So I'll talk about it later.
451620	461720	So then the following I'm going to explain is the core concept of double spending using this 51% attack.
461740	468180	What can really be done and what is the underlying mechanism of it?
468180	471080	So here I will take Bitcoin as an example.
471080	476660	The first step, let us look at this blockchain.
476660	484940	We have an original blockchain. It's a green one like 38, 39, 40, 41, 42, right?
484940	497720	And the first step, if you want to attack someone using the double spending attack, the first step for you to do is to fork your own blockchain, private blockchain.
497720	507980	You'll be a miner and have a hash power more than 51%, right?
507980	511820	So you fork your own private blockchain and you do not broadcast.
511820	516880	You don't broadcast and you concave, concave, blockchain longer and longer.
516880	518460	This is the first step.
518900	525840	And then the second step is to spend the Bitcoin only on the original blockchain.
525840	529080	Only on this one, like R40.
529080	535080	And then when you spend that Bitcoin, you are the buyer, right?
535080	546280	And the seller will perceive that they have obtained 100 Bitcoin and provide you with goods.
546280	557560	And then simultaneously in the blockchain that you currently manage, but not broadcasting, you just don't send that transaction.
557880	563420	You exclude that transaction from the blockchain that you are maintaining.
564640	566420	This is step two.
567920	576320	So step three, because you have the 51%, your hash power is more than 51%, so you are faster than the others.
576320	586380	You have higher probability to concave a longer blockchain than the others, than the original blockchain.
586560	589960	So you just exploit that.
589960	593360	You build a longer blockchain based on your power.
593360	603500	So now you are on block 42, but the others, the public blockchain, the consensus is just reaching the block 41.
603500	606720	This is the current status in step three.
606940	613320	And the step four, this is what you're actually hacking them.
613860	618520	You broadcast the private blockchain, the longer one, the longer blockchain that you are using.
618520	625660	You broadcast that to the network and the others, based on the consensus algorithm, they will accept the longer chain.
625660	632100	So when they see your blockchain, they will see, oh, maybe we should include this one and replace the original one.
632500	634820	And that's what will happen.
637870	645690	And then the private blockchain that you concave, that you build, become a new consensus blockchain.
645690	653510	And then the original blockchain, this part of the blockchain will be abandoned.
653610	654850	So this is what's happening.
654850	661910	And when this happens, the transaction you excluded will not be included in the new blockchain.
662590	667690	Hence, that transaction is reverted because it no longer exists.
667690	676790	And the poor seller will just find out that, oh, they lose 100 blockchain and they lose the product.
676790	677950	Oh my God.
677950	679650	This is what's happening.
680870	694630	So this is the concept of double spending in a DLW-based blockchain, taking Bitcoin as an example.
694630	698210	So to be more specific, how are we going to do that?
698210	699810	How can we do that?
699990	718110	Should we purchase many ASICs to purchase many machines and build an office to do that?
718890	720410	We don't.
720810	723250	Nowadays, we have NiceCash.
723250	736130	NiceCash is a place that allows people to peer-to-peer purchasing hash power from the others to rent them for a period of time.
736130	741590	And it's a marketplace of hash power.
741590	757850	So what you have to do using the NiceCash is to rent, is to pay, find your sellers and pay them with Bitcoin and rent hash power from it.
758190	766870	And what exactly you will have to do, if you want to carry out this kind of attack, you should first create a mining pool.
766870	777710	And you have to modify the pool's configuration, modify the node, the code of nodes to enable the functionalities, special functionalities,
777710	782530	because you don't want it to behave normally like an ordinary node.
782530	786850	You want the node to do something that you want it to do, right?
786850	795410	So you have to change the code, modify the code to excuse a predefined transaction from adding it to a block.
795410	797490	This is what you have to do.
797490	809450	And then you also have to enable it to temporarily stop broadcasting the fourth version of blockchain and temporarily hold it.
809810	821450	And then it can broadcast it and it's longer than the current blockchain or whatever you want it to broadcast.
821450	829490	So after you do this, you point all the hash power you purchased to the mining pool you built.
829490	837230	And then the nodes you purchased from NiceHash, they will behave as you expect.
837230	841270	You can guide them, you can have them do whatever you want.
842590	847070	So this is the user interface from NiceHash.
847070	853350	This is how you can purchase hash power from NiceHash.
853350	857310	You can see the European market is a US market.
857310	868390	And when you press on the hash power marketplace, you can see all the book of hash power.
868390	879830	And then you select the correct algorithm you want because these different machines may be running different algorithms.
879830	888230	So you have to choose the algorithm that you need and use Bitcoin to pay all the purchase.
888230	891730	This is what this marketplace only accepts.
891930	894670	You can determine the duration and the amount.
895330	897310	This is the order form.
897310	906290	You can determine the price, the limit price, the limit hash power, the amount you're going to pay for.
906550	908570	You can select your mining pool.
908570	922140	You can choose the duration and the amount of hashing power you want to purchase.
922140	924000	And then just place purchase.
930730	937730	So the introduction I was talking about is about the 15.1 attack, a normal attack.
937730	952610	This kind of attack can be carried out to most of different chains that use POW as a consensus algorithm like Ethereum and Classic.
952610	954870	Recently there's a big news.
955250	959730	If you are not familiar with it, you can try to look on it on the internet.
960490	967070	And that kind of attack can be used on most of the POW consensus algorithm.
967070	976910	But here I'm going to introduce the second type of double spending attack, which is especially just for the BS Bitcoin SV.
977930	985730	Before talking about that, I will have to talk about the more details about BSV.
985730	996290	But first, BSV users believe that there's no need to wait for confirmation for a Bitcoin SV transaction.
996410	1005650	And why is that? Because they believe they can do the zero confirmation.
1006410	1013610	These claims about why zero confirmation is okay for BSV are all of these.
1013670	1021970	And most important thing, my point of view, is that they believe that the propagation of transaction is very fast.
1023370	1028210	Then the miner, they follow first seen safe road.
1028210	1043250	Namely, if a miner includes one transaction with this input, and then later it presents another transaction with the same input,
1043250	1048770	then the miner will consider that a false one.
1048770	1052190	And then they just accept the first one. It's seen.
1052190	1056830	So once they accept the transaction, they will not accept another one.
1056830	1061550	Trying to revert the first one or do something else. Malicious.
1061650	1064190	So this is the first seen safe road.
1064190	1078450	And then that is what I consider the core concept is that even if someone managed to stop a spend through a confirmation,
1078450	1088830	it can still be detected by connecting, by having the receiver or the seller in our trading example.
1088830	1094870	It's trivial. By connecting to several nodes and wait for five seconds and just try pulling the nodes
1094870	1098230	and let them know what transaction they have.
1098290	1106910	Is there any transaction that with the same input but different in spending?
1106930	1116170	If there is, they are conflicting to each other and we know that somebody is doing some malicious action.
1116710	1119830	So this is what their claims.
1121890	1139410	However, previously, there's a researcher, Razul, he did a demo to do this, what is so-called a zero confirmation double spend attack.
1139450	1149390	What he actually did is he used a mobile phone and spent his Bitcoin SV.
1149390	1158850	And then when he sent a transaction and he sent a transaction later, that revert the first one.
1159070	1169130	So if you want to emulate is that if a seller sees this kind of stuff, he may give his products out,
1169130	1173330	but with a reverted transaction, he will lose money.
1174210	1177410	So this is why it's so-called zero confirmation double spending.
1177410	1185730	And the core concept of it is to prevent nodes from propagating a transaction between the miners and the other miners.
1185750	1191370	So he connect to all the nodes of the network and send them the transaction simultaneously.
1191630	1196450	Whatever the number of the nodes are, just send them.
1196450	1211050	And using the ratio of the two types of transaction, using the ratio of the miners number to determine which transaction should be valid at the end of the day.
1211730	1214730	And in this scenario, it's the reverted one, right?
1214730	1216830	Just revert the first one.
1217050	1220490	And yeah, that's the core concept of doing that.
1220490	1229530	So there's a suggestion of CSW, one of the big supporters for BSV, about this.
1229530	1232650	About how to safely use BSV for everyone.
1233030	1237790	First, it's party claims.
1238050	1243390	I think it's more like not a technical side suggestion.
1243390	1248890	It's more like a business logic side suggestion on using BSV safely.
1248890	1253630	And I'll explain a simplified version of the suggestion in the next page.
1253670	1257710	So this is what he suggested.
1257710	1265410	It's to use Bitcoin SV, take it into a traditional trading workflow, and use it like that.
1265410	1280670	Instead of just sending out... instead of the example I gave you in the first few slides about the developer and trader, that workflow, he would consider that it's not safe.
1281370	1285430	He suggests that everyone use this workflow instead.
1285430	1287670	It's more like a traditional trading workflow.
1287670	1290310	So let's talk about it.
1290310	1296930	First, this kind of scenario first will let the merchant create a transaction template.
1296930	1298270	It's like an invoice.
1298270	1305530	You send the invoice to the customer first, and then have the customer sign the transaction and hand it to the merchant.
1306290	1314510	Then the merchant will post the miners to check that there's no transaction with the same input currently on the network.
1314570	1316690	No one knows about it.
1316690	1323430	Then the merchant can then broadcast it to multiple miners at the same time.
1323430	1326990	Broadcast the signed one, the signed transaction from the customer.
1326990	1330450	Broadcast it to multiple miners at the same time.
1330450	1344430	And after broadcasting it, the merchant will ask the miners to check if there's any conflicting transaction after that.
1344430	1352170	After two seconds, the merchant can hand over the product and he knows he's safe.
1352930	1354370	So what's the core concept?
1354370	1372350	The core concept of it is that the merchant decides when and how to send the transaction and detect any transaction with the same input before and after he sends that transaction to the mining miners.
1372350	1386550	So in this way, the sellers, the attacker will be hard for them to decide when to send their reverting transaction like the former example, the hacking example.
1386550	1391650	The core concept is that the merchant decides when and how to send the transaction.
1391930	1401290	And in that case, he can keep holding the miners to see if this buyer is trying to do anything malicious.
1402770	1408590	So at last, in regard to this zero confirmation double spending attack on BSV,
1408590	1416130	I would like to leave a last comment for this suggestion and for this attack and for this feature.
1416130	1424210	I think people should understand any merchant who supports the zero confirmation of BSV should also understand that
1424210	1430570	you should implement the tracking strategy suggested by CSW in that last page.
1430570	1436170	Because if you don't, it might be a potential target of an attack.
1436170	1439170	You should implement that tracking strategy.
1440490	1443010	So this is the reference.
1443150	1445330	And that's all for today.
1445350	1446750	Thank you everyone for listening.
1446750	1448010	Thanks for your time.
1448010	1449990	I'm open for questions.
1503610	1506330	So you have to trust all miners?
1506330	1510270	No, we don't have to trust all the miners.
1510310	1515550	Just like holding them, holding different ones.
1515550	1522130	It's hard for all the miners to cheat you at the same time, right?
1522130	1523970	So you just hold different miners.
1523970	1532370	And if any one of them is trustworthy, you know you have the good ground truth.
1537200	1541790	So is this attack happened before?
1541990	1542780	Yes.
1543030	1547290	The zero confirmation one happened before.
1548010	1557550	The researcher Razoo, he actually demoed his attack and put it on the internet.
1557550	1558640	There was a video.
1559010	1560710	You can see it.
1563150	1564470	Twice this week.
1564470	1569270	What Jay is talking about is for Ethereum Classic.
1569270	1570390	Twice a week.
1570390	1572700	It is a 51% attack.