- In order to prevent the network from splitting into two networks that both think they are the valid network (thus allowing double spending), the network must be aware of its size (number of nodes) after every round. If the size ever drops by one-half or more in a single round, every genuine node will know to drop off the network and renegotiate onto the correct network. Since there can be at most one fragment that retains over half the nodes after experiencing a rip in the network fabric, this prevents multiple simultaneous subnets from developing. If none of the subnets retain more than half of the nodes, all nodes will drop out and the network will require restarting (I haven't worked out the details as to how that would be done). This would be catastrophic, but at least no corruption would occur to the Ledger. Ripping large portions off of the network fabric would be extremely difficult to do, but could occur if a large-scale internet breakdown occurs (neutron bomb event, severing of all intercontinental internet transatlantic cables, etc.)
- In order for the nodes to accept a transaction, both the sender and the receiver must digitally sign the order. Of course, the sender must sign it to authorize the funds withdrawal from his account. But having the receiver also authorize the transaction totally prevents misdirected funds transfers.
-- Shatosi
