Trust per Joule: The Thermoeconomics of Proof-of-Work Settlement

Contributions

The analysis makes five contributions.

1. It gives a source-grounded account of what Bitcoin Core checks when a node receives a block. The source separates proof-of-work verification, contextual block checks, transaction and script validation, and candidate chain selection.

2. It defines a scenario contract that names confirmations, settlement window, adversarial share, hardware access, energy intensity, propagation loss, electricity price, rental cost, rewards, attacker benefit, and protected loss.

3. It proves that aggregate energy is not sufficient to identify either hashrate-based reorganization risk or private attack margin.

4. It proposes a vector-valued assurance frontier and explains when a narrower avoided-loss-per-joule statistic can be formed.

5. It supplies a standard-library Python model and tests for the whitepaper approximation, finite-window catch-up, costs, monotonicity, confirmation frontiers, and equal-energy counterexamples.

Nonclaims

Several tempting claims are outside the result.

• The paper does not estimate Bitcoin’s current total electricity use.

• It does not estimate the probability of a successful attack on the current network.

• It does not treat a transaction as consuming a pro rata share of network energy.

• It does not equate confirmations with legal finality or guaranteed irreversibility.

• It does not claim that more energy makes an invalid transaction valid.

• It does not derive censorship resistance, decentralization, monetary value, or social trust from a double-spend calculation.

• It does not claim that the Bitcoin whitepaper approximation is the exact probability for the deployed peer-to-peer network.

• It does not claim that private attack expenditure equals social cost.

These exclusions are part of the measurement result. Without them, “trust per joule” would acquire more meanings than its inputs can support.

Protocol security

Nakamoto describes a chain of proof of work and gives a Poisson approximation for the probability that an attacker catches up while a recipient waits for confirmations [1]. That calculation made confirmation depth legible, but it is an idealized race. Rosenfeld develops the underlying hashrate-based double-spend processes in more detail [3]. Grunspan and Pérez-Marco derive a corrected expression, prove exponential decay in confirmation count under their assumptions, and condition risk on observed validation time [4]. The present paper retains the whitepaper calculation only as a reproducible benchmark and labels it accordingly.

Bonneau and coauthors survey Bitcoin’s technical security and economic incentives, organizing open problems across consensus, mining, networking, privacy, and related mechanisms [14]. Their breadth also shows why one double-spend calculation cannot serve as a total security score.

The Bitcoin Backbone analysis proves common-prefix and chain-quality properties in a formal execution model [2]. Its results are conditional on assumptions about honest mining power, rounds, message delivery, and the adversary. That structure supports the central position here: a security statement is indexed by a model, not by joules alone. Gervais and coauthors model how block interval, block size, mining power, and network delay affect proof-of-work security [7]. Decker and Wattenhofer measure block and transaction propagation in the Bitcoin network [8]. Croman and coauthors identify propagation and verification constraints in decentralized blockchain scaling [9].

Mining behavior is not exhausted by a majority threshold. Eyal and Sirer show how strategic block withholding can alter mining rewards [10]. Sapirshtein, Sompolinsky, and Zohar compute optimal selfish-mining policies for an explicit model [11]. These results do not become energy coefficients. They show why behavior, connectivity, and reward rules belong in the threat scenario.

Economic security

Budish separates a miner zero-profit condition from an attack incentive constraint [5]. In his model, recurring payments to miners must be sufficiently large relative to the one-off value available from an attack. The important point for the present framework is structural: competitive expenditure and attack deterrence are related through assumptions about costs, rewards, and attacker benefit. Observed electricity expenditure does not reveal all three.

Carlsten and coauthors analyze instability when transaction fees replace the block subsidy as the main miner reward [6]. Their modeled strategies illustrate why the time profile and conditional recovery of rewards matter, not only total expenditure. Easley, O’Hara, and Basu study the joint evolution of fees and mining incentives [12]. Huberman, Leshno, and Moallemi analyze congestion and fees in a permissionless payment system [13]. These papers study different mechanisms, but all reject an account in which electricity alone determines economic security.

Energy estimates

The Cambridge Bitcoin Electricity Consumption Index describes a hybrid top-down method that combines network hashrate, an equipment basket, profitability assumptions, electricity price assumptions, and power usage effectiveness [15]. Its methodology emphasizes that actual electricity demand cannot be observed directly from the protocol and publishes lower, upper, and best estimates. This is appropriate measurement practice. Even a perfect estimate of operational electricity, however, would remain an input estimate. It would not identify attacker access, private benefit, or recipient exposure.

What is added here

The literature already contains energy estimates, double-spend models, formal protocol properties, network-delay analyses, and economic incentive constraints. The proposed delta is their accounting interface. It makes the required declarations explicit, proves an energy insufficiency result, keeps node validation distinct from mining, and connects the formal objects to an executable assurance frontier. This is a synthesis and measurement contribution, not a new consensus theorem.

Header proof of work

In src/pow.cpp, CheckProofOfWork delegates to CheckProofOfWorkImpl. The implementation derives the target from the compact difficulty field, rejects negative, zero, overflowing, or above-limit targets, and rejects a header hash larger than the target [18]. This check is narrow. It establishes that the header meets the claimed work target under the configured consensus parameters.

Block and transaction validity

In src/validation.cpp, CheckBlockHeader invokes the proof-of-work check. The separate CheckBlock function performs context-independent validation. It checks the header, Merkle root, size limits, coinbase placement, transaction structure, and legacy signature-operation limits [19]. Later in block connection, Consensus::CheckTxInputs checks transaction inputs against the unspent-output view, sequence locks are enforced, script checks run, and the coinbase output is capped by subsidy plus fees [20]. The definition of CheckTxInputs, including missing or spent input, coinbase-maturity, value-range, and fee checks, is in [21].

This separation matters economically. Miners search for headers and choose transactions to propose. Full nodes independently decide whether the resulting block satisfies consensus rules. A miner cannot spend someone else’s output, create an excessive coinbase, or bypass a script merely by attaching more work to that invalid block. Nodes reject the block.

Work and chain candidates

The GetBitsProof function converts the encoded target into a per-block work value [23]. The candidate-selection function begins from the best work candidate and inspects the path to the active chain. Candidates with failed ancestors or missing data are not usable for activation [22]. The phrase “most-work chain” therefore needs its qualification: work selects among candidates that can pass the validation pipeline. Work is not a waiver from the rules.

Validation is not mining

The source supports a three-part distinction.

1. Validity: Does a block satisfy the consensus rules enforced by this node?

2. Work ordering: Among usable chain candidates, which has the greatest accumulated proof?

3. Settlement policy: Given a valid active chain and a threat model, how long should an economic actor wait before treating a payment as sufficiently unlikely to be reorganized?

The first is a deterministic software decision relative to consensus rules and local data. The second is a consensus selection rule. The third is an economic risk decision. Energy participates directly in block production and indirectly in the second and third questions. It does not replace the first.

Physical boundary

For the numerical model, honest operational energy during $T$ is $$E_H(T)=H_H\eta_H T, \qquad E_A(T)=H_A\eta_A T. \label{eq:energies}$$ The units are consistent when $H$ is terahashes per second and $\eta$ is joules per terahash. These quantities cover hashing equipment only in the reference fixture. Facility overhead, embodied energy, networking, full-node operation, manufacturing, and end-user devices are excluded. A study may add them, but must change the boundary label and recompute the denominator.

The network’s ongoing energy is a shared security input. Allocating $E_H/n$ to each of $n$ transactions is an accounting convention, not a causal statement about the marginal electricity required for that transaction. Empty blocks still require proof of work. A marginal transaction can often be included without a proportional change in global hashrate. Per-transaction energy is therefore not used in the frontier.

Threat boundary

The adversary in the reference model attempts a private-chain catch-up or reorganization. It has a declared maximum hashrate $H_A$, begins at a stated deficit, and acts for a finite window $T$. Its objective is summarized by $B_A$, while $L_P$ describes the loss borne by the protected party if the specified event succeeds.

This adversary is not an eclipse attacker, a routing attacker, a coercive state, a software supply-chain attacker, or a cartel pursuing censorship without a double spend. Those threats require different variables and outcome functionals. The tuple may be extended, but a result obtained for one threat must not be relabeled as total network security.

Time boundary

Three clocks appear.

1. The energy measurement interval $\tau$ determines the joule account.

2. Confirmation depth $z$ records how much accepted chain growth a recipient observes before a settlement decision.

3. The response window $T$ limits the post-confirmation event whose probability and private cost are evaluated.

An annual energy estimate, a six-confirmation rule, and a two-hour attack window are not naturally commensurate. Converting the annual estimate to a two-hour flow assumes that hashrate and efficiency are stationary over the interval. That assumption should be stated, not hidden in unit conversion.

Effective adversarial share

The computational reference uses $$q_{\mathrm{eff}}= \frac{H_A} {H_A+H_H(1-s_H)}. \label{eq:qeff}$$ The stale fraction is a compact sensitivity parameter for productive honest work lost to propagation or coordination effects. It is not a calibrated Bitcoin networking model. In the fixture, $s_H$ is a sudden, uncompensated loss during a window shorter than the relevant difficulty response. The reference interval $\Delta$ is tied to nominal pre-shock $H_H$, so the productive honest rate slows to $(1-s_H)/\Delta$ during the modeled window. This is not a persistent equilibrium stale rate. Under a difficulty-compensated equilibrium convention, the honest productive rate would instead remain $1/\Delta$, and both Equations (linked) and the equation would require renormalization by $H_H(1-s_H)$. The parameter shows why nominal hashrate alone is not enough: two networks with the same $H_H$ and $H_A$ can have different effective races if honest work reaches the competing tip at different rates.

For $q_{\mathrm{eff}}<1/2$, the gambler’s-ruin probability that an attacker starting $z$ blocks behind ever catches up is $$G_z(q_{\mathrm{eff}})= \left(\frac{q_{\mathrm{eff}}}{1-q_{\mathrm{eff}}}\right)^z. \label{eq:gambler}$$ For $q_{\mathrm{eff}}\geq 1/2$, this eventual probability is one in the stylized unbounded random walk. The expression is not a prediction about the timing, profitability, detectability, or operational feasibility of an attack.

PROVED. The result applies to Equation (linked), not to every attack strategy or network condition.

The whitepaper approximation

The Bitcoin whitepaper assumes honest share $p=1-q$, adversarial share $q$, and a Poisson count of attacker progress while the recipient waits for $z$ honest blocks. With $\lambda=zq/p$, its approximation is $$\mathcal{R}_N(z,q)= 1-\sum_{k=0}^{z} \frac{e^{-\lambda}\lambda^k}{k!} \left[ 1-\left(\frac{q}{p}\right)^{z-k} \right], \qquad q<p. \label{eq:nakamoto}$$ For $q\geq p$, it returns one. The companion code implements the same recurrence as the whitepaper sample and reproduces its values for $q=0.1$ and $z=1,\ldots,6$.

Later analyses correct and refine the whitepaper calculation [3, 4]. For that reason the notation $\mathcal{R}_N$ names the approximation rather than calling it “the Bitcoin attack probability.” It is retained because it is widely recognizable and because exact reproduction provides a useful test fixture.

A finite post-confirmation window

A recipient may also ask a different question: if an attacker is currently $z$ blocks behind, what is the probability of hitting zero deficit within the next $T$ seconds? Let the merged block-discovery process have mean $$\mu(T)=\frac{T}{\Delta} \left[ (1-s_H)+\frac{H_A}{H_H} \right]. \label{eq:meanblocks}$$ Conditional on $n$ discoveries, a dynamic program advances the deficit by $-1$ with probability $q_{\mathrm{eff}}$ and $+1$ with probability $1-q_{\mathrm{eff}}$. State zero is absorbing success. If $h_n(z,q)$ is the hit probability within $n$ steps, then $$\mathcal{R}_T(z,q,\mu)= \sum_{n=0}^{\infty} e^{-\mu}\frac{\mu^n}{n!}h_n(z,q). \label{eq:finite}$$

The implementation truncates the Poisson sum after $$n_{\max}= \left\lceil \mu+12\sqrt{\mu+1}+25 \right\rceil$$ and returns bounds. When the initial Poisson mass is representable, the lower bound assigns the genuine residual tail the latest computed hit probability; the upper bound assigns it probability one. If the initial mass underflows to zero, the implementation returns the uninformative but valid interval $[0,1]$. Thus numerical truncation or underflow is not silently reported as exact.

CONDITIONAL. The proof is exact for the declared Poisson random-walk model. Whether that model is an adequate empirical account is a separate question.

Why two risks are reported

$\mathcal{R}_N$ and $\mathcal{R}_T$ answer different questions. In $\mathcal{R}_N$, the attacker may have made progress while the recipient waits for the honest chain to add $z$ blocks. In $\mathcal{R}_T$, the attacker begins the post-confirmation window at a fixed deficit $z$. The numerical values should not match. Reporting both makes the temporal assumption visible and prevents a model switch from looking like a change in observed security.

A second counterexample: equal energy, unequal attack margin

Suppose two scenarios have the same $E_H,H_H,H_A,\eta_A,T,z$, but electricity prices $p_e^{(1)}\neq p_e^{(2)}$. A stylized gross private attack cost is $$C_A^{\mathrm{gross}} = \frac{E_A}{3.6\times 10^6}p_e + H_Ap_r\frac{T}{3600} + F_A. \label{eq:grosscost}$$ Here $p_r$ is denominated in USD per unit of hashrate capacity per hour, $\mathrm{USD}/((\mathrm{TH/s})\,\mathrm{h})$. Thus $H_Ap_r(T/3600)$ has units of USD. Holding all other terms fixed, the cost difference is $$C_A^{(1)}-C_A^{(2)} = \frac{E_A}{3.6\times10^6} \left(p_e^{(1)}-p_e^{(2)}\right).$$ The two networks have identical honest energy and hashrate-based risk, yet the private cost of the specified attack differs. If attacker benefits lie between the two costs, their incentive margins have opposite signs.

PROVED for Equation (linked). Whether electricity can be obtained at $p_e$, whether suitable hardware is rentable at $p_r$, and whether those prices remain fixed during an attack are CONDITIONAL.

Ownership and access

Network hashrate is not the same as attacker-accessible hashrate. An equipment fleet can be physically distributed yet coordinated by a small number of pool operators. Conversely, a large nominal pool share need not imply ownership or unilateral control of every participant’s machines. Rentals, firmware access, legal compulsion, pool switching, and supply-chain constraints alter the amount of hardware that an attacker can direct over a given window. Aggregate energy reveals none of these relationships.

A mature empirical study would publish a range $[H_A^L,H_A^U]$ rather than one unsupported share. It would distinguish ownership, routine pool assignment, rapid redirection capability, and new-hardware acquisition. The assurance frontier can then be evaluated over that range.

Gross cost, recovered rewards, and benefit

An attacker may recover block rewards if its private chain becomes accepted. Let $n_A(T)$ be expected attacker blocks in the reference window: $$n_A(T)= \frac{T}{\Delta}\frac{H_A}{H_H}. \label{eq:attackerblocks}$$ Using the midpoint $\bar R_T$ of the finite-window probability bounds as a declared approximation, the companion model computes $$\mathbb{E}[R_A]=\bar R_T\,n_A(T)R_B, \qquad C_A^{\mathrm{net}}= C_A^{\mathrm{gross}}-\mathbb{E}[R_A]. \label{eq:netcost}$$ The attack margin is $$M_A=C_A^{\mathrm{net}}-B_A. \label{eq:margin}$$ A positive $M_A$ means modeled private cost exceeds modeled private benefit. A negative value means the fixture does not establish deterrence. Neither sign is a statement about legality, ethics, social welfare, or the behavior of a nonprofit attacker.

The reward-recovery expression is intentionally simple. A richer model would account for fees in the attacker’s selected transactions, orphaned honest rewards, price impact, detection, capital depreciation, hedging, and the attacker’s ability to short related assets. The simple expression remains useful because it prevents the common mistake of treating all mining expenditure as irrecoverable attack cost.

Budish’s stock-flow distinction

Budish’s economic limit can be read as a warning against confusing an equilibrium flow with a one-time deviation payoff [5]. Miners receive a recurring compensation flow. A double-spend or sabotage opportunity can create a stock benefit. Deterrence requires a relationship between the two under a specified attack duration and recovery assumption. Observing the flow cost alone does not identify the stock benefit.

The margin in Equation (linked) is a local implementation of that logic, not a reproduction of Budish’s full model. It names the attack window, private resources, conditional recovered rewards, and benefit. It does not assume that competitive honest mining necessarily earns zero economic profit, nor does it infer $B_A$ from market capitalization.

Fee composition and dynamic incentives

Miner revenue contains subsidy and transaction fees. As the subsidy changes, fee timing can affect strategic behavior. Carlsten and coauthors show in a modeled fee-dominant regime that miners may face incentives to fork, withhold, or undercut [6]. Easley, O’Hara, and Basu analyze fee formation and miner participation as users and miners interact [12].

The frontier therefore asks for expected reward value per accepted attacker block rather than a timeless “security budget.” A serious application would model the distribution of fees across candidate blocks, the maturity and spendability of rewards, and price response to a visible attack. One annual revenue number cannot capture these dynamics.

Private cost is not social cost

Electricity expenditure can be a transfer to producers, a use of scarce generation, and a source of external costs. Hardware rental is a payment to an owner and may reallocate machines from honest mining. A successful reorganization can impose losses on recipients, miners, exchanges, and holders. Adding these terms without an incidence model double counts some flows and misses others.

Accordingly, $C_A$ is labeled private attack cost. A social-cost account would need a separate boundary and valuation functional, including generation externalities, displaced loads, hardware opportunity costs, and distributional effects. That extension belongs to environmental and welfare accounting, not the catch-up equation.

Conditional avoided loss per joule

A narrower scalar is possible when a decision maker declares a counterfactual. Let $z_0$ be a baseline confirmation policy and $z_1$ an alternative. Under a fixed loss-on-success approximation, $$\Delta \mathbb{E}[L_P] = L_P\left[ \mathcal{R}(z_0)-\mathcal{R}(z_1) \right]. \label{eq:avoidedloss}$$ If $\Delta E$ is the incremental energy causally attributable to changing the policy, then $$\operatorname{ALPJ} = \frac{\Delta \mathbb{E}[L_P]}{\Delta E} \quad[\mathrm{USD}_{2026}/\mathrm{J}]. \label{eq:alpj}$$

This ratio often cannot be estimated from a confirmation-policy change. A recipient who waits longer does not normally cause the global mining network to expend proportionally more energy. In that case $\Delta E$ may be near zero under a marginal operational boundary even though elapsed network energy is large. Dividing avoided loss by all network energy during the wait would be an allocation rule, not incremental causation.

PROVED as an accounting statement. Identification of either increment from empirical data is CONDITIONAL.

Why no universal “trust” scalar appears

Reorganization probability, censorship delay, resistance to invalid state transitions, availability, and loss recovery are not interchangeable units. Weights could combine them, but the weights would encode a value functional. The present framework refuses to hide that choice. A study that needs a scalar must name the outcome, utility or loss mapping, and affected population.

This is also why the title uses “Trust per Joule” as a question and program label. In the actual accounting, “trust” is replaced by specified events and losses. The terminology is useful only when it directs attention to the conversion chain. It becomes misleading when treated as a natural unit.

The equal-energy fixture

System A uses $H_H=100{,}000{,}000$ TH/s at $20$ J/TH. System B uses $50{,}000{,}000$ TH/s at $40$ J/TH. Over 7,200 seconds both consume $$E_H=1.44\times10^{13}\ \mathrm{J}.$$ With the same attacker hardware and stale fraction, their effective attacker shares are approximately 0.0917 and 0.1681. At six confirmations, the whitepaper approximation returns approximately $$1.45\times10^{-4} \quad\text{and}\quad 5.21\times10^{-3}.$$ The latter is about 36 times the former despite equal honest energy. The calculation is COMPUTATIONAL; the general non-identification result is PROVED by 4.

Propagation sensitivity

Holding nominal energy fixed while increasing $s_H$ from zero to 0.15 raises $q_{\mathrm{eff}}$ in the fixture. Both modeled catch-up risks increase. The parameter does not claim that all stale blocks result from propagation, or that an attacker is immune to its own delays. It serves as a controlled counterexample: communication can change productive work without changing the joule total.

Invalid state transitions

An invalid transaction fails consensus checks. The source audit in 3 shows checks for input availability, scripts, lock constraints, and reward limits. An attacker with dominant hashrate can create a high-work chain that its own modified software calls valid. Unmodified full nodes need not accept it. The attacker may cause disruption by withholding valid blocks or by mining a valid alternative history, but proof of work does not convert an invalid spend into a valid one.

The assurance outcome here is therefore not “truth.” It is resistance to a specified valid-chain history attack under a threat model. Calling the output truth would collapse rule enforcement, evidence, and economic finality.

Reorganization and double spending

A reorganization replaces a suffix of the active chain with a higher-work valid suffix. A double spend is one possible economic use: a payment appears in the replaced history while a conflicting valid transaction appears in the winning history. Not every reorganization contains a double spend, and not every loss from a reorganization is borne by one recipient.

The variable $L_P$ must therefore name the protected position. An exchange deposit, sale of a physical good, derivative settlement, and cross-chain bridge have different loss mappings and recourse. Confirmation depth alone cannot standardize them.

Censorship

Censorship asks whether a valid transaction is excluded or delayed. A simple majority attacker can refuse to include it in blocks the attacker mines, but the transaction may still enter blocks produced by others. Sustained censorship can involve orphaning blocks that include the target, bribing miners, network partitioning, or policy coordination. Relevant outputs include inclusion delay, probability of inclusion before a deadline, fee escalation, and the fraction of reachable honest hashrate.

None of these is computed by Equation (linked). A censorship-per- joule study would require a separate threat tuple, transaction propagation model, miner policy model, and outcome definition. Reusing double-spend risk as a censorship score would be a category error.

Availability and liveness

Block production can slow if hashrate leaves before difficulty adjusts. Network partitions can make local views diverge. Software bugs can interrupt validation. These are liveness and availability questions. They interact with energy and mining participation but are not equivalent to catch-up risk.

A broad assurance dashboard could add expected inclusion time, tail block interval, node reachability, client diversity, and recovery procedures. The present paper leaves those quantities OPEN.

Energy and efficiency

Network hashrate is inferred from observed proof and block timing rather than measured at every machine. Hardware efficiency varies across models, firmware, temperature, voltage, maintenance state, and facility configuration. CBECI constructs an equipment basket and publishes a range [15]. An empirical assurance study should preserve that range: $$\eta_H\in[\eta_H^L,\eta_H^U], \qquad E_H\in[E_H^L,E_H^U].$$ It should state whether reported joules are machine electricity, facility electricity with power usage effectiveness, or lifecycle energy.

Attacker hardware access

The hardest input may be $H_A$. A useful evidence table would separate:

• hardware physically owned by a candidate attacker;

• hashrate normally pointed to a pool but redirectable by machine owners;

• rentable compatible hardware with binding availability and duration;

• idled inventory that can be activated within the attack window;

• capacity that could be coerced, compromised, or subsidized;

• new capacity whose manufacturing lead time exceeds the window.

Each class has a different access probability and cost. Pool dashboards alone do not identify ownership or unilateral control. Manufacturer shipment claims do not identify deployment. A defensible study would publish a low, central, and high access scenario with provenance.

Prices and opportunity costs

Marginal electricity price may differ from an average tariff. Curtailable industrial loads can face interruptible contracts. A miner may own generation or have sunk prepaid energy. Hardware can have a resale value and an honest mining opportunity cost. The reference $p_r$ combines access and time but is not adequate for every ownership structure.

The attack-cost range should therefore be formed from scenarios rather than false precision: $$C_A\in \left[ C_A(H_A^L,\eta_A^L,p_e^L,p_r^L), C_A(H_A^U,\eta_A^U,p_e^U,p_r^U) \right],$$ with dependence handled explicitly. Taking every lower or upper endpoint may produce impossible joint scenarios if, for example, the most efficient hardware is not available at the lowest rental price.

Propagation

Propagation is a distribution, not one stale fraction. Block size, topology, relay protocols, geographic distance, validation time, and adversarial routing all matter. Decker and Wattenhofer provide an early empirical account [8]; Gervais and coauthors show why delay enters a security model [7]. Current measurement would need current node observations and a sampling design. The fixture’s $s_H$ is only a sensitivity knob.

Benefit and protected loss

Attacker benefit can include a double-spent asset, short position, competing system gain, political objective, or extortion. Protected loss can include direct asset loss, hedging cost, service interruption, and recovery. These variables are partly private and counterfactual. Point estimates should not be invented from public market capitalization.

Partial identification is preferable. If $$B_A\in[B_A^L,B_A^U], \qquad L_P\in[L_P^L,L_P^U],$$ then the frontier should report corresponding margin and expected-loss ranges. A deterrence statement that survives the sensitivity range requires $M_A>0$ throughout the admissible benefit range, not merely at a convenient midpoint.

Minimum reporting table

Test claims

The dedicated test file checks ten behaviors.

1. The whitepaper $q=0.1$ table is reproduced to printed precision.

2. Catch-up risk falls strictly with depth for $q<1/2$.

3. Catch-up risk rises strictly with adversarial share in the tested range.

4. Finite-window risk rises with the window and does not exceed the eventual random-walk probability.

5. Poisson underflow returns the conservative interval $[0,1]$.

6. Gross attack cost rises with duration and accessed hashrate.

7. Both reported risks fall along the tested confirmation frontier.

8. Equal honest energy can yield different effective attacker shares and risks.

9. Propagation loss can change risk without changing honest energy.

10. Invalid physical and economic inputs are rejected.

Passing tests are COMPUTATIONAL evidence that the code implements these fixtures. They do not establish that the fixture describes a live network. The distinction is essential: software correctness cannot supply missing empirical premises.

Numerical method

The whitepaper approximation uses a recurrence for Poisson mass rather than factorials. The finite-window calculation conditions on the number of merged block discoveries. At each step it stores the probability mass at each positive deficit and accumulates probability when the attacker moves from deficit one to zero. The outer Poisson mixture is then bounded using its residual tail.

The reference method is suitable for modest settlement windows. It rejects a Poisson cutoff above 10,000 events rather than allocating an unbounded dynamic program. Production risk software should use numerically specialized distributions, verify extreme-tail accuracy, and compare independent implementations.

Merchant or exchange policy

A recipient can use a scenario frontier to compare confirmation depths for a named deposit size and recourse structure. The decision is not “how much energy did this transaction use?” It is “given these network and attacker assumptions, how does waiting change modeled loss and operational delay?” Energy enters as one network input. The recipient’s delay cost belongs on the same decision table.

A practical policy might partition withdrawals by exposure, require more confirmations for unusual deposits, impose velocity limits, and use fraud signals. Those controls alter $L_P$ or the attacker’s realizable $B_A$. They can improve the position without changing network energy. That fact alone shows why energy cannot be the complete security control.

Miner and protocol analysis

For miners, the frontier can organize sensitivity to electricity prices, hardware efficiency, fees, and propagation. It does not prescribe a mining equilibrium. Strategic entry, pool choice, withholding, and capital investment require equilibrium models such as those studied in the mining literature [10, 11, 6].

For protocol analysis, the framework helps prevent boundary errors. A change to block relay may alter stale rates and effective race dynamics without changing device efficiency. A change to reward composition may alter attack opportunity cost without changing hashrate immediately. A validation-rule change may alter which histories are admissible while leaving proof-of-work energy unchanged.

Energy policy

An electricity regulator may care about grid congestion, emissions, demand flexibility, and local economic activity. Those outcomes require a grid and social boundary. A protocol assurance frontier cannot decide whether a marginal megawatt-hour has higher social value in mining, manufacturing, storage, or another use. That allocation problem belongs to a broader marginal-value-of- energy analysis.

The framework can still improve the debate. It replaces an unsupported claim that all mining electricity is “security” with an explicit chain from energy to hashrate, competitive share, valid-chain selection, event probability, and loss. A policy analyst can then dispute a particular assumption rather than a metaphor.

Dividing by transaction count

Annual network electricity divided by annual on-chain transactions produces an allocation average. It does not estimate the marginal energy of a transaction, the energy of one confirmation, or the energy that protects one asset. The network jointly orders blocks and maintains a history. Transaction batching, empty space, layer-two settlement, and demand changes break the causal reading.

Using market capitalization as protected value

Market capitalization is price times circulating supply. It is not the amount an attacker can steal, the loss caused by a reorganization, or a stock of value settled during one window. A visible attack may change price, making the quantity endogenous. Protected loss should be tied to affected positions and a counterfactual.

Calling all miner revenue a security budget

Revenue is a miner incentive and a resource available to support competition. Its relationship to attack deterrence depends on entry, costs, reward recovery, hardware access, and attacker benefit. Some attack strategies earn rewards. Some adversaries value disruption rather than profit. Revenue is therefore an input to an incentive model, not a measured quantity of assurance.

Assuming fifty percent is a complete threshold

An unbounded catch-up model has a qualitative change at one-half adversarial share. Other attacks may become profitable below one-half, particularly when communication advantage or strategic mining is present [10, 11]. A finite attack with more than one-half share is not instantaneous or free. The threshold is meaningful inside a specific model, not a universal switch for every security property.

Ignoring full nodes

Treating miners as sole arbiters of validity makes work appear able to authorize arbitrary state transitions. The source audit falsifies that description for the inspected Bitcoin Core release. Full nodes check blocks and transactions. Economic actors decide which software and rules they run. Mining and validation interact, but they are not the same function.

Reporting a point without its scenario

A probability such as $10^{-6}$ is uninterpretable without the event, adversarial share, starting state, timing, propagation assumptions, and model. A cost such as 80,040 USD is uninterpretable without hardware quantity, duration, electricity, rental terms, reward recovery, and fixed cost. The scenario tuple is not supplementary metadata. It is part of the result.

Calibrated access distributions

Research should estimate distributions over attacker-accessible hashrate for different windows. The unit of observation must separate hardware ownership, pool assignment, firmware control, rental contracts, and manufacturing lead time. Confidential commercial data may make partial identification more credible than point estimation.

Network-aware finite settlement

A network model could replace $s_H$ with measured relay distributions and validation times. It should allow asymmetric information, topology, eclipse risk, and strategic release. Outputs should distinguish common-prefix failure, temporary local disagreement, and economic double spend.

Joint payoff and price dynamics

Attack benefit, reward recovery, and asset price can be jointly endogenous. An attacker may hedge, short, or profit in another market. Recipients may halt withdrawals after observing unusual blocks. A dynamic game would connect these responses to the physical resource race.

Censorship frontier

A parallel paper should define censorship assurance in terms of inclusion probability by a deadline, reachable honest share, fees, and miner policy. It should not inherit the double-spend formula. The energy denominator can be shared only if both studies use the same physical boundary and time interval.

Empirical loss prevention

The economically realized output is avoided loss, not an abstract probability. Estimating it requires incident data, near misses, recourse, and selection effects. Systems with stronger controls may observe fewer attacks because attackers self-select away. A causal design must distinguish deterrence from failed or unobserved attempts.

Grid interaction

Mining can be geographically flexible and interruptible in some settings. Coupling the assurance frontier to nodal electricity prices and grid services would show when marginal operation is privately and socially valuable. Such a model must count displaced generation, emissions, and reliability effects at the relevant location and hour.

Energy

For the honest side, $$E_H= (100{,}000{,}000\ \mathrm{TH/s}) (20\ \mathrm{J/TH}) (7{,}200\ \mathrm{s}) =1.44\times10^{13}\ \mathrm{J}.$$ For the attacker, $$E_A= (10{,}000{,}000) (25) (7{,}200) =1.8\times10^{12}\ \mathrm{J}.$$ Unit cancellation leaves joules in both cases.

Effective share and expected discoveries

Productive honest rate is $$H_H(1-s_H)=100{,}000{,}000(0.99)=99{,}000{,}000\ \mathrm{TH/s}.$$ Thus $$q_{\mathrm{eff}}=\frac{10}{10+99}=0.091743119\ldots$$ when rates are expressed in millions of TH/s. The expected merged discoveries in two hours are $$\mu= \frac{7{,}200}{600} \left(0.99+\frac{10}{100}\right) =13.08.$$

Gross cost

Attacker electricity use is $$\frac{1.8\times10^{12}}{3.6\times10^6} =500{,}000\ \mathrm{kWh}.$$ At 0.06 USD/kWh, electricity cost is 30,000 USD. Hardware access is $$(10{,}000{,}000\ \mathrm{TH/s}) \left(\frac{0.000002\ \mathrm{USD}} {(\mathrm{TH/s})\,\mathrm{h}}\right) (2\ \mathrm{h}) =40\ \mathrm{USD}.$$ Adding the 50,000 USD fixed cost gives 80,040 USD.

The low hardware-access price is intentionally artificial. It makes each term visible and should not be interpreted as a market quote. A live study would need evidence that the specified quantity can be controlled at the specified price for the full interval.

Release pin procedure

The source pin can be reproduced without trusting a moving branch.

1. Open the official Bitcoin Core 31.1 release page.

2. Resolve Git tag v31.1 through the GitHub repository API.

3. Inspect the annotated tag object and its signature-verification field.

4. Follow the tag object’s target to the commit whose identifier is $$\mathtt{9be056a8a72b624dae9623b2f7bded92c2a21c91}.$$

5. Open raw or rendered files at that commit, preserving line anchors.

At the time of inspection, the annotated tag object identifier was $$\mathtt{bfa6a4b79cd4c1562fd32857e3147763efae37fb}.$$ The paper cites the commit because source files live at the commit object. The tag object records the release reference and signature metadata.

Interpretation checklist

The source lines justify the following limited statements.

• A block header’s hash is compared with a derived target.

• A block undergoes checks beyond header proof of work.

• Context-dependent input and script checks occur during block connection.

• The coinbase cannot exceed subsidy plus fees under the checked rules.

• Candidate-chain work ordering does not make known-invalid ancestry usable.

They do not, by themselves, prove peer-to-peer liveness, economic decentralization, absence of implementation bugs, or a numerical attack probability. Those claims require other evidence.