Topic: Satoshi Dice -- Statistical Analysis - page 81. (Read 192896 times)

It seems I'm a little late to that conversation.  But it seems to me that the most basic attack for an arbitrary individual is simply trying to broadcast competing transactions at the same time.  But if there's any chance for it to succeed, it has to be done right away before you know if you've won.  Thus, you'd invalidate half of your losers and winners.  Other attacks, while possible, are generally reserved to a select few people who have > 1% of mining power, and to bets that are significantly over the maximum bet rate right now and would not be worth it.

On the other hand, I could see that the time delay could allow SatoshiDice to queue up a few transactions, and rearrange their ordering to try to maximize the number of losing bets made.  They have pre-scripted, verifiable secrets, but there's no way to prove the order in which they received certain transactions.  If this were the case, it would be reflected in the stats...

Btw, I love the SatoshiDice concept.  I really like the transparency of it, too.  It's a very elegant, open setup that gives me confidence they are legit.  But you don't know for sure until you do some hard number crunching

P.S. -- I just updated the table.  About 35k bets total as of midday May 10.  And the stats looks fairly consistent with expectations...

But if I can double spend (e.g., Finney attack) to invalidate only my losing wagers, did I really lose?

See:
 - https://bitcointalksearch.org/topic/m.882919

My script uses the list of 24 addresses from satoshidice.com.  I do not track all addresses that start with "1dice", only the ones from that site.  So that's not an issue.

I thought all reward transactions included the wager transaction as an input.  Thus, if someone invalidated the wager by double-spending, they'd also invalidate the reward transaction.  And thus it would be pointless.

There are 24 specific 1diceXXX vanity addresses that SatoshiDice generated for their service.

Anyone can create their own 1diceXXX address as well, but that doesn't have any impact on the statistics for those 24.

There is one attack method I'm aware off ... send wagers that are too low (below the minimum) or too high (exceed the maximum) and thus the site sends a refund by returning the payment (and pays the transaction fee, mind you).  The service has ways to deal with that if it becomes a problem (deduct the fee before sending the refund, for example).

The other problem is the dust-like wagers.  The minimums are small enough that the site loses money on the smallest wagers due to transaction fees for the return payment.  That too can be adjusted should it become a problem.

But any transfer within the accepted range is a wager, and thus gets played and the return transaction created.   I can''t think of anything further that this third party could do (or why) to mess with the site.   (well, the Satoshi Dice site does describe other attack vectors, but they are precise and require double spending using Finney attack or other methods.)

Do you already have an account at Seals? The only thing easier for me to donate than bitcons is Seals chips!

a quick basic question: would it be possible for any third party to alter these statistics if he was generating 1diceXXX vanity addresses and sending random transactions around?

So how many bets a day are they running at?

I thought they started around the 27th April, so based on the 30k you found that is 18 bets (so 36 transactions) a block!

So this one site is responsible for the jump in transactions:
http://blockchain.info/charts/n-transactions-per-block

And I guess the jump in fees:
http://blockchain.info/charts/transaction-fees?timespan=60days&showDataPoints=false&daysAverageString=1&show_header=true&scale=0&address=

Once I fill it up a little more (with localized statistics and confidence bounds), I might modify the version of Armory I'm running to leverage the already-loaded blockchain.  That way, I can recalculate all the stats every 5 min and update a plot somewhere...

Why?  I don't know...  because I'm a statistician and I can.  

I guess I spent of lot of months online playing poker, and spent time on the 2+2 forums doing similar analysis to try to identify players or phenomenon that were suspicious.  I guess it's one way to keep the gambling sites honest...

Easier access to the blockchain like this for reporting purposes will be very useful.  Thank you for doing this!

Here's the latest output:


I grab satoshidice.com (via urllib.urlopen('http://satoshidice.com')) and pull out all 24 addresses and current odds, etc.   Then, I scan the blockchain starting at block 175k, collecting all bets made to any of the 24 "1dice" addresses, and then look for transactions that spend the wager transaction (because Satoshi dice always spends the wager transaction to send rewards, which helps protect against double-spends).  

All bets are recorded as Win, Lose, or Refund.  If a user sends more than the maximum bet, it will be refunded.  That is a non-negligible number of the bets made, especially the 65000x bets.

The percentages under "win" and "lose" are only for the subset of win/lose bets, i.e.  win/(win+lose) and lose/(win+lose).  Refunds are not counted except to fill int the "accounted-for" field which simply identifies how many bets there are in the blockchain that could be associated with reward/return payments.

The script is using armoryengine.py to scan the blockchain for SatoshiDice bets and rewards, and then compute statistics.  The exact code is at the bottom of sample_armory_code.py in the BitcoinArmory project.  If you want to try running it yourself, you're going to have to check out the project and compile the CppBlockUtils library yourself.  It's really not hard in Linux... it's really hard in Windows...