Ok. I'll ask another way. What's the equivalent of 51% attack here? What proportion of purchases in what period is needed to abuse the system?
Resetting of uptime and purchases after each forged block makes no difference here. Any real attacker will have many nodes with sufficient uptime and can distribute new purchases accordingly. There is also possibility of fake purchases - "send the money to yourself" type. True, there is 1% fee (actually half of it) but this will be compensated by forging blocks.
Well let me try to break this down.
Purchases aren't the only weight calculated to determine who will forge a block. It is a calculation based on Node up-time since last block forged + purchases to a valid merchant ID since last block forged.
The weight in the calculation for node time is higher than the weight for purchase power. For purchases to count towards the weight calculation, they would have had to have been done to a validated merchant. The only was to "send money to yourself" and earn weight for it, would be for you to open a store and purchase a large amount of items from your own store. You would have to do this repeatedly every minute in order to sustain enough weight to continue to forge blocks as the network will automatically eliminate all accumulated weight for that address as soon as a block is forged.
Not only that but this is behavior that would be noticeable to everyone on the network and a store can be flagged and invalidated for fraud. Node up-time would be the key element in the calculation for block weight, but purchase power is being thrown in to push people over the edge when multiple nodes have similar up-time. For instance, on day 1 if 1000 create nodes and run them full time, that is 1000 nodes competing for each block with almost identical up-time (until they start forging blocks), if some of those users were actually using Crypti to buy goods from validated merchants, then they would forge first, as opposed to those only running a node.
Your comment about node resets, etc not mattering isn't necessarily something I agree with. The network understands the weight calculation and if an address forges a block, it won't have sufficient weight to forge another unless it is the only active node on the network. For 1 person to conduct a 51% attack, I would guess that they would have to maintain a majority of all nodes on the network but I would still think confirmations would be an issue.
It's a good question and I'm not going to brush it off. I am going to talk to Bitseed & Boris (the engineer's behind the algorithm and network) and see if they can give a more technical description of how a 51% attack would play out. I know we haven't released a ton of specifics on the calculations and algorithm yet as we don't want to open ourselves up to clones, but maybe they can give a glimpse into a few details.