  We study the incentives behind double-spend attacks on Nakamoto-style
Proof-of-Work cryptocurrencies. In these systems, miners are allowed to choose
which transactions to reference with their block, and a common strategy for
selecting transactions is to simply choose those with the highest fees. This
can be problematic if these transactions originate from an adversary with
substantial (but less than 50\%) computational power, as high-value
transactions can present an incentive for a rational adversary to attempt a
double-spend attack if they expect to profit. The most common mechanism for
deterring double-spend attacks is for the recipients of large transactions to
wait for additional block confirmations (i.e., to increase the attack cost). We
argue that this defense mechanism is not satisfactory, as the security of the
system is contingent on the actions of its users. Instead, we propose that
defending against double-spend attacks should be the responsibility of the
miners; specifically, miners should limit the amount of transaction value they
include in a block (i.e., reduce the attack reward). To this end, we model
cryptocurrency mining as a mean-field game in which we augment the standard
mining reward function to simulate the presence of a rational, double-spending
adversary. We design and implement an algorithm which characterizes the
behavior of miners at equilibrium, and we show that miners who use the
adversary-aware reward function accumulate more wealth than those who do not.
We show that the optimal strategy for honest miners is to limit the amount of
value transferred by each block such that the adversary's expected profit is 0.
Additionally, we examine Bitcoin's resilience to double-spend attacks. Assuming
a 6 block confirmation time, we find that an attacker with at least 25% of the
network mining power can expect to profit from a double-spend attack.
