Paper 2012/248

Two Bitcoins at the Price of One? Double-Spending Attacks on Fast Payments in Bitcoin

Ghassan O. Karame, Elli Androulaki, and Srdjan Capkun

Abstract

Bitcoin is a decentralized payment system that is based on Proof-of-Work. Bitcoin is currently gaining popularity as a digital currency; several businesses are starting to accept Bitcoin transactions. An example case of the growing use of Bitcoin was recently reported in the media; here, Bitcoins were used as a form of fast payment in a local fast-food restaurant. In this paper, we analyze the security of using Bitcoin for fast payments, where the time between the exchange of currency and goods is short (i.e., in the order of few seconds). We focus on double- spending attacks on fast payments and demonstrate that these attacks can be mounted at low cost on currently deployed versions of Bitcoin. We further show that the measures recommended by Bitcoin developers for the use of Bitcoin in fast transactions are not always effective in resisting double-spending; we show that if those recommendations are integrated in future Bitcoin implementations, double-spending attacks on Bitcoin will still be possible. Finally, we leverage on our findings and propose a lightweight countermeasure that enables the detection of double-spending attacks in fast transactions.

Metadata
Available format(s)
PDF
Category
Applications
Publication info
Published elsewhere. Unknown where it was published
Keywords
Bitcoin
Contact author(s)
ghassan karame @ neclab eu
History
2012-05-03: received
Short URL
https://ia.cr/2012/248
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2012/248,
      author = {Ghassan O.  Karame and Elli Androulaki and Srdjan Capkun},
      title = {Two Bitcoins at the Price of One? Double-Spending Attacks on Fast Payments in Bitcoin},
      howpublished = {Cryptology {ePrint} Archive, Paper 2012/248},
      year = {2012},
      url = {https://eprint.iacr.org/2012/248}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.