2e405311a4
docs/analysis/51-percent.md: what a 51 percent attacker can and cannot do on Igneum, with numbers (the selected-chain race over a 90-s hold, the lock as the reorder bound, the veto at 1/3 of weight and its rental cost, the departure case and the LEAVE item, the p2p surface). docs/analysis/horizon/consensus-security.md: the attack catalogue across GHOSTDAG ordering, the difficulty rule, the finality weight, miner signalling, proof records, the exec layer and p2p, each with the bound and the rental cost at the measured USD 11.7 per GH/s-hour; the pruned-node unwrap class with its sibling list in the sync and IBD flows; fourteen ranked defences, three of them not recommended with the reason. Models and results: sim/horizon/consensus-security/ (ghostdag_sim.py, finality_horizon.py, cost_model.py, signalling.py, result files). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
5.6 KiB
Miner signalling: the 95 percent game, one-day window, floor height
Generated by sim/horizon/consensus-security/signalling.py. Arithmetic on the P2 rule; price USD 11.7 per GH/s-hour (measured, bench-log 6 Oct 2026).
1. The threshold is a hard line: binomial noise over 86,400 blocks
| true signalling share p | std of the window share | P(window share >= 95%) on a given day |
|---|---|---|
| 93.0% | 0.09 points | 0.0000 |
| 94.0% | 0.08 points | 0.0000 |
| 94.5% | 0.08 points | 0.0000 |
| 94.9% | 0.07 points | 0.0908 |
| 95.0% | 0.07 points | 0.5000 |
| 95.1% | 0.07 points | 0.9133 |
| 95.5% | 0.07 points | 1.0000 |
| 96.0% | 0.07 points | 1.0000 |
Reading: a 94.5% fleet never flips by luck (P = 0.0000); a 95.1% fleet flips on its first full day (P = 0.91). A holdout of 5.1% of blue blocks blocks the signal path for ever; only the floor height ends it.
2. The holdout: what 6 percent of the hash costs to hold until the floor
A holdout needs 5% plus one block of the blue blocks of every day until N6. Rented on top of a network of N GH/s that otherwise signals 100%: h/(1 - h) x N for h = 6%.
| network hash | rented hash for a 6% holdout | per day | 14 days (a devnet-scale floor) | 30 days |
|---|---|---|---|---|
| 1 GH/s | 0.064 GH/s | USD 18 | USD 251 | USD 538 |
| 10 GH/s | 0.638 GH/s | USD 179 | USD 2509 | USD 5377 |
| 100 GH/s | 6.383 GH/s | USD 1792 | USD 25093 | USD 53770 |
| 1000 GH/s | 63.830 GH/s | USD 17923 | USD 250928 | USD 537702 |
What the holdout gains: nothing but delay, bounded by the floor. The holdout earns block subsidy on its hash like any miner (6% of blocks), so its net cost is the rental premium over revenue, which at a rental market in equilibrium is near zero. The floor is therefore the whole defence against a veto, and the floor is a fixed height: the hazard of 6 October 2026 (the DAA 198,000 crossing while the fleet was still updating: a two-sided chain and a 229-block reorg, CLAUDE.md 6 Oct rules) returns at N6 for any node not yet on the new object.
3. The renter: forcing the flip early with one day of 95 percent
The window is one day of blue blocks and the byte is the template builder's. A renter who patches the byte and holds 95% of a day's blue blocks flips the class at the next epoch boundary whether or not the real fleet has the object. Hash needed: 0.95/0.05 x N = 19 N for 24 h (the window must be full and 95% signalling; a lower share over more days never reaches 95% because the window slides).
| network hash | rented hash for one day | cost of the day | supply |
|---|---|---|---|
| 1 GH/s | 19 GH/s | USD 5335 | the market could not supply a TH/s on 6 Oct (bench-log) |
| 10 GH/s | 190 GH/s | USD 53352 | the market could not supply a TH/s on 6 Oct (bench-log) |
| 100 GH/s | 1900 GH/s | USD 533520 | the market could not supply a TH/s on 6 Oct (bench-log) |
| 1000 GH/s | 19000 GH/s | USD 5335200 | the market could not supply a TH/s on 6 Oct (bench-log) |
What it buys: an activation while part of the fleet lacks the object. For the v4 cut nothing: the signalling binary IS the v4 binary, so every node that reads the high byte can mine v4 (section 6.1 item 1), and a pre-signalling node already refuses the high-byte headers. For a later object (v5) it is the fork of the nodes still on v4, the same shape as a fixed height crossed early. Bound: the share of the fleet not on the new object at the forced flip, which the renter chooses. Defence that costs nothing in liveness: require the threshold on each of D consecutive daily windows (D = 7 makes the renter's bill 7x and gives a week of public warning: the chain shows the share every epoch in programClassV4SignalBps), or weight the signal by the 30-day finality window, which a one-day rental cannot fill (W2: a day is 1/30 of the table).
4. Signal then defect
A node that signals (byte 4) and after the flip runs the old class produces headers whose PoW fails under the new program: refused by every node, its blocks are lost, nobody else is touched (check_header_version then the PoW check). A pool that signals with its template and whose hashers run old workers loses the hashers' blocks after the flip (the worker computes the program from the template's class; a stale worker's blocks fail PoW). Bound: the defector's own income, zero to anyone else. Signal-then-defect is not an attack on the chain; it is a mis-upgraded miner.
5. The one-day window against the 30-day finality window
| window | renter's hash | renter's cost | honest latency | what it buys the defence |
|---|---|---|---|---|
| one day (P2 as proposed) | 19 N for 24 h | USD 5335 at 1 GH/s, 533520 at 100 GH/s | flips within a day of the last upgrade | a renter forces it in a day |
| 7 consecutive days at 95% | 19 N for 7 x 24 h | USD 37346 at 1 GH/s, 3734640 at 100 GH/s | flips a week after the last upgrade | 7x the bill and a week of visible share |
| 30-day blue-block window (the finality table) | the renter must mine 95% of 30 days of blocks: 19 N for 30 days | USD 160056 at 1 GH/s, 16005600 at 100 GH/s | flips 30 days after the fleet is ready (the status file's objection) | same bound as finality's own 2/3: the 20-day public event |
Recommendation to the lane that owns P2: keep the one-day tally for the live share display, require the threshold on D = 7 consecutive daily windows for the flip, keep the floor as the backstop but set it no nearer than 7 days past the publish on any network miners run (14,400 DAA = 4 h was a devnet value), and never let a floor cross while under 95% is signalling without a node-side line that says which boxes are not on the object (the stale-box list is already a P1 pass rule).