Blockchain Security: Sybil Attacks, Forks, and The DAO Hack
Book: Cryptoeconomics
Authors: Jian Gong, Wei Xu
ISBN: 978-0-367-42993-5
Previous: Behavioral Economics | Next: Blockchain in China
Chapter 6 asks the uncomfortable question: freedom without security is worthless. Gong separates real-world economics (discover laws) from cryptoeconomics (design rules in code).
Sybil attacks
One attacker, many fake identities. In P2P networks, redundancy assumes independent nodes. Sybils fake independence.
On Bitcoin, “Sybil” often means hashrate concentration. Control 51% of mining work, control transaction ordering.
Gong cites multi-billion dollar hardware costs for a Bitcoin attack (2018 numbers). Economic deterrence, not moral appeal.
New small chains are softer targets. Low hashrate, few nodes, cheap takeover. Several projects died this way.
More diverse miners (countries, incentives) raises collusion cost. But upgrades get harder as stake grows. Trade-off never ends.
Forks: soft, hard, political
Accidental fork: two miners find blocks at once. Longest chain wins.
Planned fork: protocol upgrade.
Soft fork: new rules stricter than old. Non-upgraded nodes still accept new blocks if majority enforces.
Hard fork: incompatible rule change. Splits chain. Bitcoin Cash (8MB blocks) and Ethereum Classic (post-DAO) are the textbook cases.
Gong frames forks positively: innovation pressure valve. When community cannot agree, fork or fracture. BitShares founder Dan Larimer leaving after consensus failure is the human cost.
P + ε attack (security edition)
Chapter 4 introduced the bribery game. Chapter 6 applies it to validator votes.
Attacker subsidizes minority votes. Honest Nash equilibrium collapses. Casper’s staked deposits are the countermove. Cheating costs real ETH, not just missed rewards.
The DAO hack
June 2016: $150M crowdfunded DAO drained via recursive call bug. 3.6M ETH gone. ETH price halved.
Ethereum hard-forked at block 1,920,000 to bail out investors. Dissenters kept Ethereum Classic. “Code is law” met “law is politics.”
Gong treats The DAO as a social experiment, not just a bug:
- Decentralized crisis response is slow and centralizing
- Attackers hard to prosecute when exploit is technically allowed
- Open-source contributors: who is liable?
- Miners held veto power over the rescue fork
Core lesson: decentralization does not remove governance. It moves it.
Zero-knowledge proofs
Prove you know a secret without revealing it. Zcash hides sender, receiver, and amount.
Bitcoin transparency helps audit. It also exposes balances once an address leaks. WannaCry payments showed the tracking risk.
ZK privacy trades auditability for safety. Stolen Zcash is harder to trace. Freedom and responsibility tug both ways.
System view
Gong closes with a stakeholder map:
- Code writers (incentivize honest contributions)
- Maintainers (avoid creeping centralization)
- Miners/validators (spread rewards, spread power)
- Users (simple, safe UX)
- Investors (less pure speculation)
Bitcoin’s simplicity helped. Attack surface is narrow. Concentrated mining is a risk, but attacking also destroys the attacker’s bag.
My take
Chapter 6 pairs well with Chapter 4. Theory meets scar tissue.
The DAO section is still essential reading for anyone hyping “trustless” organizations. The fork was a choice. Choices need politics.
ZK section is brief but honest about the privacy paradox. No free lunch.