with 10 confirms, the chance of a person with 20% staking power forging 10 consecutive blocks would be (0.2)^10 would take over a million blocks to happen.
Not (0.2)^10. Look at bitcoin's original paper: if I mine my own private chain the chances are much higher.
20% with 11 confirms gives a probability of 0.1%
So, 1 in 1000.
1000 NXT blocks is about 10hs one double spend every 10 hsEDIT: 1000 NXT blocks is about 30hs, one double spend every 30 hsI'm not asking to be paid in advance: we haven't discussed the terms yet (escrow or not? show code to everyone or just devs? etc), I just want to know how much would I get so I can decide if it's worth the effort or not.
There are two different attacks, that might or might not be combined.
1) Double spending with only small % of the supply
This is a private chain attack. This is by design and it applies to all POS implementations.
I've read some people say that NXTs are like simulated POW mining rigs. The analogy works for many situations so think of it like this: coins that are not forging are like mining rigs that are not powered on - useless. So the total network hashrate that I need to beat it not the total supply: it's only the total amount of coins that is actively forging at the specific time of the attack.
Now if NXT coins work like simulated POW miners you can read Satoshi's original Bitcoin paper and see how to calculate the probability of a double spend with only a few % of the network's hashrate. That % of the network's hashrate translates to a % of the actively forging coins (NOT THE TOTAL SUPPLY).
Good news is this can be mitigated by waiting for more confirmations. Bad news is it cannot be really completely fixed. Some say "transparent forging" or "economic clustering" can fix this, but I say they can't because they would open new attack vectors.
I can demonstrate this With 2M testnet (can be leased) or 50M mainnet (can be leased too), but I need to modify the client first.
2) Staking weight inflation
I can exploit how NXT works so I will forge more often than I should. I could make 1M NXT forge as often as 2M should. This might allow a 51% attack with only 25%.
I can demonstrate this against others in testnet: make an account with 206K and have it forge. My 206K account with my secret sauce will forge more blocks in the same time (we should let it run for a few days to make sure there is an edge and it's not just luck). I still need to modify the client first and until I test it in practice I don't know exactly how much will the advantage be. Estimations are that I can double my weight.
This can be fixed, and I would give the code used to attack and the idea on how to fix it.