Pierre-O Goard
email: pierre-olivier.goard@univ-lyon1.fr

Fraud risk assessment within blockchain transactions

Keywords: 60G55, 60G40, 12E10 Bitcoin blockchain, double-spending problem, risk theory, order statistic point processes, renewal processes, boundary crossing problems

The probability of successfully spending twice the same bitcoins is considered. A double-spending attack consists in issuing two transactions transferring the same bitcoins. The rst transaction, from the fraudster to a merchant, is included in a block of the public chain. The second transaction, from the fraudster to himself, is recorded in a block that integrates a private chain, exact copy of the public chain up to substituting the fraudster-to-merchant transaction by the fraudster-tofraudster transaction. The double-spending hack is completed once the private chain reaches the length of the public chain, in which case it replaces it. The growth of both chains are modeled by two independent counting processes. The probability distribution of the time at which the malicious chain catches up with the honest chain, or equivalently the time at which the two counting processes meet each other, is studied. The merchant is supposed to await the discovery of a given number of blocks after the one containing the transaction before delivering the goods. This grants a head start to the honest chain in the race against the dishonest chain.

Introduction

Bitcoin is a decentralized peer-to-peer (P2P) payment system that relies on Proof of Work (PoW). Electronic payments are performed by issuing transactions that transfers Bitcoins (BTCs) between Bitcoin peers. These transactions are broadcast to a network of Bitcoin miners. These miners will compete to solve a cryptographic puzzle in order to build a block that contains the pending transactions. The rst miner to solve the problem receives a certain number of BTCs, which is agreed upon by everyone in the network. At the time of the writing, this bounty is 12.5 BTCs; this value is halved every 210,000 blocks. The block is then included in the blockchain which plays the part of a public ledger recording all the transactions between bitcoin peers. Once a transaction enters the blockchain, it is considered validated. The only way to reverse the process, and for instance replace this transaction by another one, is to redo the work of the associated block and all the subsequent blocks. The blockchain allows in theory to prevent from double-spending the same BTCs. A double-spending attack consists in buying a good from a vendor and transfering the same bitcoins to oneself. Two conicting transactions exist then in the network. The buyer-to-vendor transaction is included in the blockchain by the honest miners while a group of colluding miners work on their own private branch, exact replication of the principal chain up to substituting the buyer-to-vendor transaction by the buyer to buyer one. In the presence of two versions of the blockchain, the network always opt for the longest because more computational eort has been put into it. If the conspiring miners' chain ever becomes as long as the honest chain, it will replace it. The double-spending is then successful.

Satoshi Nakamoto stresses in his whitepaper [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF] that a successful double-spending attack is rather unlikely as long as the pool of honest miners retain the majority of the computing power. The vendor is advised to wait for a certain number of blocks, say k ∈ N, to be added to the chain before delivering the good. Assuming that, in the meantime, the attackers manage to discover l < k blocks, then the honest chain is ahead by z = k -l.

The case l ≥ k implies that double-spending occurs right away. The derivation of the probability of a successful double-spending attack relies on an analogy with the one-sided gambler's ruin problem. Namely, the forthcoming block belongs to the honest chain with probability p or to the malicious chain with probability q = 1 -p. The dierence between the length of the chains is then a random walk {Z n , n ∈ N} on Z dened as

Z n = z + Y 1 + . . . + Y n , for n ∈ N, (1)
where the Y i 's are the independent and identically distributed (i.i.d.) steps of the random walk. Assuming that the honest miners have more resources implies that p > q, the probability that the malicious chain ever catches up with the honest one, given it is z blocks behind, is (q/p) z . For a full treatment of the gambler's ruin problem, the reader is refered to the monograph of Asmussen and Albrecher [START_REF] Asmussen | Ruin Probabilities[END_REF].

The aim of this work is to rene the model underlying the double-spending problem.

Counting processes are introduced to keep track of the number of blocks in the competing chains. These processes are generated by sequences of arrival times whose probability distribution reect the block discovery frequency and the distribution of the computing power among honests and malicious miners. The probability distribution of the time at which the malicious chain overtakes (if it ever does) the honest chain is studied. Note that the probability mass function (p.m.f.) of the stopping time

τ z = inf{n ∈ N ; Z n = 0}
in Nakamoto's framework is a consequence of the rst hitting time theorem with

P (τ z = n) = z n P(Z n = 0), for n ≥ z, (2)
see for instance Van Der Hofstad and Keane [20, Theorem 1] and the references therein.

Let {N (t) , t ≥ 0} and {M (t) , t ≥ 0} be two independent counting processes governing the block arrival over time in the honest and the malicious chain respectively. Assume that the honest chain is z ≥ 1 blocks ahead of the malicious chain at t = 0. Consider the stopping time τ z = inf{t ≥ 0 ; M (t) = z + N (t)}.

(3) at which the double spending attack is successful. Denote by {T k , k ≥ 1} and {S k , k ≥ 1} the block arrival times in the honest and malicious chain respectively. Figure 1 illustrates the race between the two processes. The distribution of τ z is studied for dierent

t n S 1 • S 2 • S 3 • S 4 • T 1 • 1- 2- z = 3- 4- τ z ×
Figure 1: Time until the double-spending attack is completed: (solid) length of the honest chain {z + N (t) , t ≥ 0}, (dashed) length of the malicious chain {M (t) , t ≥ 0}. sets of assumptions over the counting processes {N (t) , t ≥ 0} and {M (t) , t ≥ 0}.

In Section 2 and 3, the length of the honest chain {z + N (t) , t ≥ 0} is driven by an Order Statistic Point Process (OSPP), that is, provided that N (t) = n, the jump times T 1 , . . . , T n have the same distribution as the order statistics of a sample of n i.i.d. random variables concentrated on [0, t] with distribution function F t . In Section 2, the probability density function (p.d.f.) of τ z is derived in terms of Abel-Gontcharov (A-G) polynomials when the length of the malicious chain {M (t) , t ≥ 0} is a renewal process (i.e. generated by i.i.d. inter-arrival times). In Section 3, the survival function (s.f.) of τ z is expressed in terms of Appell polynomials in the case where {M (t) , t ≥ 0} is an OSPP.

The probability of a successful double-spending attempt, dened by P(τ z < ∞), is further considered. An upper-bound is derived in Section 4 when both {N (t) , t ≥ 0} and {M (t) , t ≥ 0} are renewal processes. An exact expression is obtained when {N (t) , t ≥ 0} is a Poisson process.

The formulas derived in this work hold for a xed value z. In practice, because the length of the dishonest chain is unknown to the vendor at the time of the shipping, the delay should be modelled as an integer-valued random variable Z. Nakamoto [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF] assumed Z was Poisson distributed with parameter z q p (that is, the average number of blocks mined in the malicious chain when k blocks have been mined in the honest chain). Rosenfeld [START_REF] Rosenfeld | Analysis of hashrate-based double spending[END_REF] stresses in his analysis that the right distribution is the negative binomial one. The distribution of the double spending time follows from inserting the formulas given below in the law of total probability after conditionning upon the possible values of Z. The determination of the distribution of Z might not be an easy task in the general case and should be considered for further investigation.

Nakamoto [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF] assumed that double spending occurs when the length of the malicious chain reaches exactly the length of the honest chain. The situation in which two chains of the same length coexist in the network is called a fork. The situation resolved as soon as a block is added to either one of the two chains. Some authors, including Rosenfeld [START_REF] Rosenfeld | Analysis of hashrate-based double spending[END_REF] for instance, argue that the double spending time should be dened as

τ + z = inf{t ≥ 0 ; M (t) = N (t) + z + 1}.
The results obtained in this paper apply in this context by noting that τ + z = τ z+1 almost surely.

Nakamoto [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF] did not state explicitly that the block arrival is dictated by a homogeneous Poisson process. However, the probability of a successful double-spending attack, as we will see later, when the length of the public and private chains are governed by two Poisson processes of intensity λ and µ, is given by (µ/λ) z . Hence, the intensities plays the same role as p and q as they reect the hashrate of the miners. Every single result given in this work holds when the rival chains are modeled by homogeneous Poisson process because the homogeneous Poisson process is the one and only renewal process enjoying the order statistic property. The formulas, which may seems involved in the general cases, simplies when the arrival of blocks is Poisson. Now, is it worth considering more sophisticated models to track the growth of the blockchains?

A statistical study over the inter-block times has been conducted in a recent work of Bowden et al. [START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF]. The authors collected the timestamp information in the header of the blocks. As pointed out in [START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF], the timestamp information cannot be readily used, and preprocessing it represents quite a challenge in itself. The data after preprocessing is available on Rhys Bowden Github repository [START_REF] Bowden | Intersection of the longest increasing subsequences[END_REF]. The empirical mean of the interblock time is 9.41 minutes while the standard deviation is of 11.05 minutes. The high variance of the inter-block time is a known aw which impedes the consistent ow of validated transactions. Opting for a renewal process instead of a Poisson process allows to let the inter-block time have a two-parameters distribution, gamma or Weibull say, and therefore account for the second order moment in the statistical inference. To the time required for the creation of a block is sometimes added a propagation delay. A newly discovered block is appended to the chain only once the word about that block has been spread to the entire network. If it is accepted that the block mining time is an exponential random variable, the actual time at which the block integrates the chain is an exponential random variable perturbed by another non-negative noise. The result may or may not be exponentially distributed. One of the many takeaways of Bowden et al. [START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF] is that the rate at which blocks are discovered varies over time according to the adjustment of the cryptopuzzles diculty. The authors of [START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF] proposed dierent models allowing for a time-dependent discovery rate with deterministic or even random diculty adjustment. When the diculty adjustment is deterministic then a non-homogeneous Poisson process is suitable. This is fortunate as the non-homogeneous Poisson process is a particular instance of OSPP. The point processes having the order statistic property have been characterized a while ago by Puri [START_REF] Puri | On the characterization of point processes with the order statistic property without the moment condition[END_REF]. The OSPPs are either mixed Poisson processes up to a timescale transforma-tion or mixed sample processes. This class encompasses classical point processes such as the mixed Poisson process, the non-homogeneous Poisson process, the linear birth process with immigration and the linear death process.

From a mathematical standpoint, this work ressembles an early work of Picard and Lefèvre [START_REF] Picard | On the rst meeting or crossing of two independent trajectories for some counting processes[END_REF] where the probability distribution of the rst rendez-vous time between two counting processes is derived. The formulas already involved the Appell and A-G polynomials and even extend to the case of compound processes. The denition of the stopping time is slightly dierent in the case considered here. Plus, the reasoning diers as it relies extensively on the order statistic property and the connection between the aforementionned families of polynomials and the order statistics joint distribution. It is more in the spirit of Goard and Lefèvre [START_REF] Goard | Boundary crossing of order statistics point processes[END_REF] where the crossing of an OSPP through a moving boundary is under study. These arguments are inspired from risk theory when solving the ruin problem in ordered risk models, see e.g. Lefèvre and Picard [24,[START_REF] Lefèvre | Ruin probabilities for risk models with ordered claim arrivals[END_REF], Ignatov and Kaishev [START_REF] Ignatov | First crossing time, overshoot and Appell Hessenberg type functions[END_REF], Dimitrova et al. [START_REF] Dimitrova | On the rst crossing of two boundaries by an order statistics risk process[END_REF], Goard and Lefèvre [START_REF] Goard | Duality in ruin problems for ordered risk models[END_REF], and Goard [START_REF] Goard | Two-sided exit problems in the ordered risk model[END_REF]. To the best of my knowledge, the closest link to queueing theory is the single server queue with either work or customer removal introduced by Gelenbe et al. [START_REF] Gelenbe | Queues with negative arrivals[END_REF] and further considered in Boucherie and Boxma [START_REF] Boucherie | The workload in the M/G/1 queue with work removal[END_REF], Jain and Sigman [START_REF] Jain | Generalizing the Pollaczek-Khintchine formula to account for arbitrary work removal[END_REF], and Harrison and Pitel [START_REF] Harrison | The M/G/1 queue with negative customers[END_REF] for dierent queues.

The related risk process includes lump addition, see Boucherie et al. [START_REF] Boucherie | A note on negative customers, GI/G/1 workload, and risk processes[END_REF]. In Perry et al. [START_REF] Perry | Boundary crossing for the dierence of two ordinary or compound Poisson processes[END_REF][START_REF] Perry | A two-sided rst-exit problem for a compound Poisson process with a random upper boundary[END_REF], renewal-type arguments are used to study the distribution of boundary crossing times of the dierence between two Poisson processes and linear boundaries. Regarding the evaluation of the probability of a successful double-spending attack, P(τ z < ∞), the rst step consists in swapping the role of time and space. Namely, a correspondence is established between the ruin times of two risk models with inverted characteristics. This trick is now standard in risk theory, see for instance Mazza and Ruillère [START_REF] Mazza | A link between wave governed random motions and ruin processes[END_REF], Dickson and Borovkov [START_REF] Borovkov | On the ruin time distribution for a Sparre Andersen process with exponential claim sizes[END_REF], Shi and Landriault [START_REF] Shi | Distribution of the time to ruin in some Sparre-Andersen risk models[END_REF], Dimitrova et al. [START_REF] Dimitrova | On nite-time ruin probabilities in a generalized dual risk model with dependence[END_REF], and Goard and Lefèvre [START_REF] Goard | Duality in ruin problems for ordered risk models[END_REF]. A classical Martingale approach allows then to derive an expression of the probability of successfully spending twice the sames BTCs.

The rest of the paper is organized as follows, in Section 2 a formula for the p.d.f. of τ z when {N (t) , t ≥ 0} is an OSPP and {M (t) , t ≥ 0} is a renewal process is derived in terms of Abel-Gontcharov polynomials. In Section 3, a formula for the s.f. of τ z when both {N (t) , t ≥ 0} and {M (t) , t ≥ 0} are OSPPs is provided in terms of Appell polynomials. Section 4 is concerned with the probability of the double-spending attack ever being successful. Section 5 is devoted to numerical illustrations.

2

The p.d.f. of the double-spending time

In this section, the length of the honest chain {z +N (t) , t ≥ 0} is governed by an OSPP. Its jump times, provided that N (t) = n, have the same joint distribution as a vector of order statistics. Namely, it holds that

[T 1 , . . . , T n |N (t) = n] D = (V 1:n , . . . , V n:n ), (4) where D
= stands for equality in distribution and V 1:n , . . . , V n:n correspond to the order statistics of n i.i.d. random variables having a c.d.f. F t (s), for 0 ≤ s ≤ t. The length of the malicious chain is a renewal process generated by a sequence of i.i.d. inter-arrival times {∆ S k , k ≥ 1} having a p.d.f. denoted by f ∆ S . The sequence of arrival times {S n , n ∈ N}, with the convention S 0 = 0, corresponds to the partial sums of the interarrival times sequence. The p.d.f. of S n , for n ∈ N, is given by

f Sn (t) = f * n ∆ S (t), for t ≥ 0, (5)
where f * n denote the n-fold convolution of f ∆ S with itself. Let z ≥ 1 be an integer, the following result gives a formula for the p.d.f. of

τ z = inf{t ≥ 0 ; M (t) = N (t) + z},
time at which the double-spending attack is completed.

Theorem 1. If {N (t) , t ≥ 0} is an OSPP and {M (t) , t ≥ 0} is a renewal process then the p.d.f. of τ z is given by

f τz (t) = E (-1) N (t) h N (t) (t, z)f * [N (t)+z] ∆ S (t) , t ≥ 0, (6)
where

h n (t, z) = E G n 0 F t (S z ), . . . , F t (S n+z-1 ) S n+z = t , (7)
and G n (0|.) is an A-G polynomial such as dened in the Appendix A.

Proof. The event {τ z ∈ (t, t + dt)}, for t ≥ 0, corresponds to the exact time at which the double-spending attack is successful as the malicious chain takes over the honest one. At time t = 0, the honest chain is ahead by z ≥ 1 blocks. Assuming that later, at time t > 0, the honest miners manage to add N (t) = n ∈ N blocks to the chain then the malicious chain must be of length M (t -) = n + z -1 at some time t -< t and jump to the level n + z exactly at t. Conditioning over the values of {N (t) , t ≥ 0} yields

{τ z ∈ (t, t + dt)} = +∞ n=0 {τ z ∈ (t, t + dt)} ∩ {N (t) = n}. (8)
In the case where N (t) = 0, the only requirement is that the z th jump of {M (t) , t ≥ 0} occurs at time t. It then follows that

{τ z ∈ (t, t + dt)} ∩ {N (t) = 0} = {S z ∈ (t, t + dt)} ∩ {N (t) = 0}, (9)
and consequently

f τz|N (t)=0 (t) = f * z ∆ S (t), t ≥ 0, (10)
where f τz|N (t)=0 (t) denotes the conditional p.d.f. of τ z given that N (t) = 0. On the set {N (t) ≥ 1}, one needs to make sure that {M (t) , t ≥ 0} behaves properly by constraining its jump times so that it does not reach N (s) + z at any time s < t and performs the (n + z) th jump at t. Hence, it holds that

{τ z ∈ (t, t + dt)} ∩ {N (t) ≥ 1} = +∞ n=1 n k=1 {T k ≤ S z+k-1 } ∩ {S z+n ∈ (t, t + dt)} ∩ {N (t) = n}.
Applying the law of total probability yields

P ({τ z ∈ (t, t + dt)} ∩ {N (t) ≥ 1}) = +∞ n=1 P n k=1 {T k ≤ S z+k-1 } ∩ {S z+n ∈ (t, t + dt)} N (t) = n P[N (t) = n]. (11)
In virtue of the order statistic property, the successive jump times (T 1 , . . . , T n ) are distributed as the order statistics (V 1:n , . . . , V n:n ) of a sample of n i.i.d. random variables with c.d.f. F t (s), 0 ≤ s ≤ t. The conditional probability in (11) may be rewritten as

P n k=1 {V k:n ≤ S z+k-1 } ∩ {S z+n ∈ (t, t + dt)} = P n k=1 {U k:n ≤ F t (S z+k-1 )} ∩ {S z+n ∈ (t, t + dt)} = P n k=1 {U k:n ≤ F t (S z+k-1 )} S z+n ∈ (t, t + dt) P[S z+n ∈ (t, t + dt)] = E (-1) n G n [0 F t (S z ), . . . , F t (S z+n-1 )] S z+n ∈ (t, t + dt) P[S z+n ∈ (t, t + dt)], (12)
where U 1:n , . . . , U n:n denote the order statistics of a sample of n i.i.d. uniform random variables on [0, 1], and G n (.|.) corresponds to the A-G polynomials as dened in the Appendix A. Inserting ( 12) into ( 11) and letting dt be small enough yields

f τz|N (t)≥1 (t) = +∞ n=1 E (-1) n G n [0 F t (S z ), . . . , F t (S z+n-1 )] S z+n = t × f S z+n (t)P[N (t) = n].
The nal step consists in noting that G 0 (x) = 1 for every x ∈ R, and writing

f τz (t) = +∞ n=0 E (-1) n G n [0 F t (S z ), . . . , F t (S z+n-1 )] S z+n = t f * (z+n) ∆ S (t)P[N (t) = n], (13)
which is equivalent to the announced result [START_REF] Boucherie | A note on negative customers, GI/G/1 workload, and risk processes[END_REF].

The stopping time τ z may be interpreted as the rst meeting time of the OSPP {N (t), t ≥ 0)} and the lower randomized boundary dened by {M (t) -z, t ≥ 0}. This remarks explains why Theorem 1 is reminiscent of the results given in Goard and Lefèvre [17, Proposition 3.1] and Goard and Lefèvre [START_REF] Goard | Duality in ruin problems for ordered risk models[END_REF]Theorem 3.1], where the rst-meeting problems of an OSPP with a lower deterministic boundary are handled. The numerical evaluations of (6), to compute for instance the probability that the double-spending attack succeed within a xed time period, looks challenging. A method based on the truncation of the innite series in (13) coupled with a numerical integration routine, in the same vein as what is proposed in Borovkov and Dickson [START_REF] Borovkov | On the ruin time distribution for a Sparre Andersen process with exponential claim sizes[END_REF], can be put together. The next result shows how formula (6) may be simplied in the case where {N (t) , t ≥ 0} is a mixed Poisson process.

Corollary 1. If {N (t) , t ≥ 0} is a mixed Poisson process then the p.d.f. of τ z is given by

f τz (t) = E z z + N (t) f * [N (t)+z] ∆ S (t) , for t ≥ 0. (14)
Proof. As {N (t), t ≥ 0} is a mixed Poisson process then we can apply Theorem 1 replacing F t (s) by s/t for s ≤ t. The function h n (t, z) dened in [START_REF] Bowden | Intersection of the longest increasing subsequences[END_REF] becomes

h n (t, z) = E 1 t n G n 0 S z , . . . , S n+z-1 S n+z = t ,
after applying the identity (77). Conditioning upon the values of S z , and applying successively the identities (77) and (79) leads to

h n (t, z) = 1 t n E E G n 0 S z , . . . , S n+z-1 S z , S n+z S n+z = t = 1 t n E E G n -S z 0, ∆ S z+1 . . . , n-1 k=1 ∆ S z+k n k=1 ∆ S z+k = S n+z -S z S n+z = t = 1 t n E (-S z )[-S z -(S n+z -S z )] n-1 S n+z = t = (-1) n t n E S z (S z+n ) n-1 S n+z = t = (-1) n z n + z . (15)
Substituting ( 15) into (6) yields the announced result [START_REF] Göbel | Bitcoin blockchain dynamics: The selsh-mine strategy in the presence of propagation delay[END_REF].

The formula given in Corollary ( 1) is reminiscent of the rst-hitting time theorem and also the so-called Kendall identity, see for instance Borovkov and Burq [START_REF] Borovkov | Kendall's identity for the rst crossing time revisited[END_REF], which gives the p.d.f. of the rst-meeting time of a spectrally negative Lévy process with a lower linear boundary. The following example gives rise to an expression for the p.d.f. of τ z that allows the evaluation of the probability of a successful double-spending attack P(τ z < ∞).

f ∆ S (x) = µe -µx , for x ≥ 0. (16)
Applying Corollary 1 yields, after a couple of rearrangements, the following expression for the p.d.f. of τ z ,

f τz (t) = +∞ n=0 z z + n 2n + z -1 n µ µ + λ n+z λ µ + λ n (λ + µ) 2n+z t 2n+z-1 e -t(µ+λ) Γ(2n + z) , (17)
for t ≥ 0. Assuming that λ > µ and integrating [START_REF] Goard | Boundary crossing of order statistics point processes[END_REF] with respect to t yields the probability of successful double-spending attack with

P(τ z < ∞) = +∞ n=0 z z + n 2n + z -1 n µ µ + λ n+z λ µ + λ n = λ + µ λ z z +∞ n=0 2n + z -1 n 1 z + n λµ (µ + λ) 2 n+z = λ + µ λ z z +∞ n=0 2n + z -1 n λµ (µ+λ) 2 0 t n+z-1 dt = λ + µ λ z z +∞ n=0 2n + z -1 n λµ (µ+λ) 2 0 t n+z-1 dt = λ + µ λ z z λµ (µ+λ) 2 0 t z-1 +∞ n=0 2n + z -1 n t n dt = λ + µ λ z z λµ (µ+λ) 2 0 t z-1 C(t) z-1 √ 1 -4t dt, (18)
where

C(t) = 1 - √ 1 -4t 2t , (19)
denotes the generating function of Catalan's numbers, see for instance Aigner [1, Chapter 3]. Note that the last equality follows from an exercise in the textbook of Aigner [START_REF] Aigner | A Course in Enumeration[END_REF]Exercise 3.25]. Inserting [START_REF] Harrison | The M/G/1 queue with negative customers[END_REF] into [START_REF] Goard | Duality in ruin problems for ordered risk models[END_REF] yields, after straightforward integration,

P(τ z < +∞) = µ λ z .
The result given above is consistent with Corollary 3, see Section 4.

3 The s.f. of the double-spending time

In this section, the length of the honest and the malicious chains are governed by two independent OSPPs. The order statistic property satised by

{M (t) , t ≥ 0} implies that [S 1 , . . . , S m |M (t) = m] D = (V * 1:m , . . . , V * m:m ), where V * 1:m , . . . , V * m:m denote the order statistics of a sample V * 1 , . . . , V * m of m i.i.d. random variables having a c.d.f. F * t (s), for 0 ≤ s ≤ t.
Note that, regarding {N (t) , t ≥ 0}, the notation of Section 2 is preserved. The following result gives a formula in terms of Appell polynomials for the s.f. of τ z = inf{t ≥ 0 , M (t) = N (t) + z}.

Theorem 2. If {N (t) , t ≥ 0} and {M (t) , t ≥ 0} are two OSPPs then the s.f. of τ z is given by

P(τ z > t) = E A M (t) 1 0, . . . , 0, F * t [V 1:N (t) ], . . . , F * t [V M (t)+1-z:N (t) ] I M (t)≤N (t)+z-1 , (20)
for t ≥ 0, where A n (1|.) is an Appell polynomial such as dened in the Appendix A.

Proof. If M (t) ≥ N (t) + z, at time t ≥ 0, then the double-spending attack already occured. Consider the event {τ z > t}, conditioning upon the possible values of the counting processes leads to

{τ z > t} = +∞ n=0 n+z-1 m=0 {τ z > t} ∩ {N (t) = n} ∩ {M (t) = m}. (21)
The double-spending attack did not happen before time t ≥ 0 if M (t) is smaller or equal to z -1, irrespective of the value of N (t). If M (t) falls between z and N (t) + z then N (t) must have jumped, at least once, and an investigation over the jump times of both point processes must be conducted. The event {τ z > t} is further rewritten as

{τ z > t} = z-1 m=0 {M (t) = m} ∪ +∞ n=1 n+z-1 m=z m k=z {S k > T k+1-z } ∩ {N (t) = n} ∩ {M (t) = m}. ( 22
)
The law of total probability yields

P (τ z > t) = P [M (t) ≤ z -1] + +∞ n=1 n+z-1 m=z P m k=z {S k > T k+1-z } N (t) = n, M (t) = m × P [N (t) = n, M (t) = m] . (23)
Now, by the order statistic property, it holds that

[(T 1 , . . . , T m+1-z )|N (t) = n] D = (V 1:n , . . . , V m+1-z:n ) and [(S z , . . . , S m )|M (t) = m] D = (V * z:m , . . . , V * m:m ).
Therefore, the conditional probability in (23) may be rewritten as

P m k=z {V * k:m > V k+1-z:n } = P m k=z {U k:m > F * t (V k+1-z:n )} = A m 1 0, . . . , 0, F * t (V 1:n ), . . . , F * t (V m+1-z:n ) , (24)
where U 1:m , . . . , U m:m are the order statistics of a sample of m i.i.d. uniform random variable on (0, 1) and A m (.|.) denote the Appell polynomials dened in the Appendix A. Inserting ( 24) into (23) yields

P (τ z > t) = P [M (t) ≤ z] + +∞ n=1 n+z-1 m=z A m 1 0, . . . , 0, F * t (V 1:n ), . . . , F * t (V m+1-z:n ) × P [N (t) = n, M (t) = m] , (25)
which is the same as [START_REF] Van Der Hofstad | An elementary proof of the hitting time theorem[END_REF] after noticing that A m (1|0, . . . , 0) = 1 for every m ∈ N.

In Subsection 5.2, a Monte Carlo evaluation of the expectation of ( 20) is performed. This type of estimator has been studied in Goard and Lefèvre [START_REF] Goard | Boundary crossing of order statistics point processes[END_REF]Section 6] and named Appell Polynomial Monte Carlo (APMC). The procedure entails a variance reduction in comparison to a crude Monte Carlo evaluation. The following result shows how formula [START_REF] Van Der Hofstad | An elementary proof of the hitting time theorem[END_REF] simplies remarkably for z = 1, when the OSPPs are similar in a sense detailed below.

Corollary 2. Assume that z = 1. If {N (t) , t ≥ 0} and {M (t) , t ≥ 0} are two OSPPs such that F t (s) = F * t (s) for every s ≤ t then the s.f. of τ z is given by

P(τ z > t) = E N (t) -M (t) + 1 N (t) + 1 I M (t)≤N (t) , for t ≥ 0. (26)
Proof. Let {N (t) , t ≥ 0} and {M (t) , t ≥ 0} be two OSPPs such that F t (s) = F * t (s) for every s ≤ t. Applying Theorem 2, with z = 1, yields

P(τ z > t) = E A M (t) 1 U 1:N (t) , . . . , U M (t):N (t) I M (t)≤N (t) , for t ≥ 0.
Recall the probabilistic interpretation of the Appell polynomial in Proposition 1 with

P(τ z > t) = E P U * 1:M (t) > U 1:N (t) , . . . , U * M (t):M (t) > U M (t):N (t) I M (t)≤N (t) , for t ≥ 0.
Applying Bertrand's ballot theorem, allowing for ties, yields the announced result [START_REF] Lefèvre | Risk models in insurance and epidemics: A bridge through randomized polynomials[END_REF].

The case treated in the numerical illustrations considers that the length of the chains are governed by two non-homogeneous Poisson processes, which is consistent with the empirical study conducted in Bowden et al. [START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF], as explained in the following example.

Example 2. Bowden et al. [START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF] recommend to model the arrival of blocks as a nonhomogeneous Poisson process with an intensity function designed to capture the evolution of the global hashrate on one hand and the diculty adjustment of the cryptopuzzles on the other hand. The block number n is associated to a hash f (n) which is a number drawn randomly from the lattice {0, 1, . . . , 2 256 -1}. Mining a block consists in computing the hash of the block until it is lower than a target L. The number of trial required is then a geometric random variable Geom(L × 2 -256 ) with associated p.m.f. (1

-L × 2 -256 ) k-1 L × 2 -256 for k ≥ 1.
The diculty is adjusted by tuning the target L. Denote by {T k , k ≥ 1} the sequence of arrival time of the blocks. The diculty is adjusted every 2, 016 blocks to maintain an average 1 block mined every 10 minutes So, mining 2, 016 takes about 2 weeks. This leads to the denition of a piecewise constant target function L(t) as

L(t) = L 0 , for t ∈ (0, T 2016 ), L k , for t ∈ (T 2016k
, T 2016(k+1) ), and k > 0, [START_REF] Mazza | A link between wave governed random motions and ruin processes[END_REF] where the sequence of real numbers {L k , k ≥ 0} is dened recursively as

L k = 2 224 , for k = 0, L k-1 × T 2016k -T 2016(k-1) 1209600
for k > 0.

Note that the time unit is the second and 1, 209, 600 seconds correspond to 2 weeks. The number of trials relates to the mining time through the (global) hashrate function H(t).

The hashrate function corresponds to the number of hashes computed per second by the entire network of miners. Hence, the instantaneous average mining time is given by

2 256
H(t)L(t) and the intensity function of the underlying non-homogeneous Poisson process is given by

λ(t) = H(t)L(t) 2 256 , for t ≥ 0. (28)
There are two main drivers of the hashrate. First, the improvement of the mining machines which enhances the computing power of the miners. Second, the number of miners in the network. The miners enter and exit the network according to how protable mining BTCs is at the moment. This last factor depends on the price of the electricity and the value of the BTCs at a given point in time. The target L(t) is an information that can be collected from the header of the block. The hashrate H(t) is retrieved from the knowledge of the diculty and the timestamp data. The authors of [START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF] proposed an exponential function of the form H(t) = e at+b arguing that the log hashrate is piecewisely linear over time. The values of a and b follow from the linear interpolation within successive time periods. Once the hashrate function has been determined, the length of the blockchain {N (t) , t ≥ 0} is a non-homogeneous Poisson process with intensity function λ(t) dened in [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF]. Assuming that N (t) = n, the arrival times T 1 , . . . , T n are distributed as the order statistics of n i.i.d. random variables with associated c.d.f.

F t (s) = Λ(s) Λ(t) , for s ≤ t, (29)
where Λ(t) = t 0 λ(s)ds. In the event of a double-spending attack, the diculty of the puzzle is the same for the honest miners and the colluding miners. The dierence between the two pools lies in their computing power and thus their hashrate function. We may assume that both the honest and dishonest miners contribute to the global hashrate of the network in an additive way. More specically, let H 1 (t) = p × H(t) be the hashrate of the honest miners and H 2 (t) = (1 -p) × H(t), where p ∈ (0, 1) represents the repartition of the computing resources among the miners. Theorem 2 is applicable and formula [START_REF] Van Der Hofstad | An elementary proof of the hitting time theorem[END_REF] simplies to

P(τ z > t) = E A M (t) 1 0, . . . , 0, U 1:N (t) , . . . , U M (t)+1-z:N (t) I M (t)≤N (t)+z-1 , (30)
because F * t (s) = F t (s) for every s ≤ t. An evaluation via Monte-carlo simulation is possible by generating values for M (t), N (t), and U 1:N (t) , . . . , U M (t)+1-z:N (t) . Appell polynomials do not usually admit a closed-form expression but can be computed recursively via the relations provided in the appendix A, see Proposition 2.

Note that the evaluation of (20) may be achieved through the truncation of the innite series in (25) followed by numerical integration, in the same vein as what is done in Dimitrova et al. [START_REF] Dimitrova | On the evaluation of nite-time ruin probabilities in a dependent risk model[END_REF]. Another solution would be to resort to a fully recursive evaluation as in Lefèvre and Loisel [START_REF] Lefèvre | Finite-time ruin probabilities for discrete, possibly dependent, claim severities[END_REF]. [START_REF] Borovkov | On the ruin time distribution for a Sparre Andersen process with exponential claim sizes[END_REF] The probability of a successful double-spending attack In this section, we study the probability of a successful double-spending attack, P(τ z < +∞), when the length of the chains {z +N (t) , t ≥ 0} and {M (t) , t ≥ 0} are modeled by independent renewal processes generated by their respective sequence of i.i.d. inter-arival times denoted by

{∆ T k , k ≥ 1} and {∆ S k , k ≥ 1}. Assume that (A1) E(∆ S ) > E(∆ T ), (A2) The equation log E e θ(∆ T -∆ S ) = 0, (31)
has a unique non-negative solution denoted by γ, refered to as the adjustment coecient.

The stopping time τ z = inf{t ≥ 0; M (t) = z + N (t)} coincides with the ruin time τ z = inf{t ≥ 0; R(t) = 0} associated to the risk process

R(t) = z + N (t) -M (t), t ≥ 0. ( 32
)
Dene the claim surplus process as

S(t) = M (t) -N (t), t ≥ 0. (33)
In risk theory, processes such as (32) model the evolution of the net worth of an insurance company over time. Here, the insurance company holds an initial capital of amount z, its premium income is governed by {N (t) , t ≥ 0} while {M (t) , t ≥ 0} corresponds to its liability at time t ≥ 0. Note that I am only using risk theory terminology to improve the presentation, I am not claiming that one should model the evolution of the nancial reserves of any non-life insurance company via [START_REF] Puri | On the characterization of point processes with the order statistic property without the moment condition[END_REF]. When studying the distribution of the ruin time is problematic, a simple trick consists in passing to a dual risk model. This approach is rather standard (see the references given in the introduction). For the sake of clarity, the idea is recalled hereafter and illustrated by Figure 2. Figure 2(a) displays the ruin problem in model [START_REF] Puri | On the characterization of point processes with the order statistic property without the moment condition[END_REF]. The initial ruin problem is converted into another equivalent ruin problem. Increment the value of {M (t), t ≥ 0} by one unit and consider the risk model

R(t) = z + N (t) -[M (t) + 1], t ≥ 0. ( 34
)
Further dene the ruin time

τz = inf{t ≥ 0 ; z + N (t) < [M (t) + 1]}, (35)
which coresponds to the rst-crossing time of {M (t) + 1 , t ≥ 0} through the upper boundary

{N (t) + z , t ≥ 0}, see Figure 2(b). It holds that τ z a.s. = τz , (36)
R * (n) = S z-1 + n k=1 ∆ S k+z-1 -∆ T k , for n ∈ N. ( 37
)
The initial capital is S z-1 , the sequence {∆ S k+z-1 , k ≥ 1} models the premium collected at each time period, and the sequence {∆ T k , k ≥ 1} represents the total claim amounts incurred during each time period. The conventions S 0 = 0 and T 0 = 0 are adopted. The claim surplus process {S * (n) , n ≥ 1} is given by

S * (n) = n k=1 ∆ T k -∆ S k+z-1 , (38)
The ruin time is dened as

σ S z-1 = inf{n ∈ N ; R * (n) ≤ 0} and relates to τ z = inf{t ≥ 0 ; R(t) = 0} as τ z a.s. = τz a.s. = S σ S z-1 +z-1 , (39)
which implies that

P(τ z < ∞) = P(σ S z-1 < ∞). ( 40
)
Again the one-to-one correpondence between the trajectories leading to ruin in the multiple risk models entail the equality almost surely. The following result provides, inter-alia, an upper bound for the probability of a successful double-spending attack.

Theorem 3. If {N (t) , t ≥ 0} and {M (t) , t ≥ 0} are two independent renewal processes such that (A1)-(A2) hold then

P(τ z < ∞) = E e -γ∆ S z-1 E e γξ(S z-1 ) τ z < ∞ , (41)
where ξ(S z-1 ) = S(σ S z-1 ) -S z-1 denotes the overshoot, immediately after ruin, in model (37). The following Cramér-Lundberg upper bound holds

P(τ z < ∞) ≤ E e -γ∆ S z-1 . ( 42
)
Proof. → -∞ stands for convergence almost surely, follows from assumption (A1) and the law of large numbers. Let the initial reserves S z-1 = s ≥ 0 be xed in (37). The application of [2, Proposition 3.1] allows to rewrite the ultimate ruin probability as

P(σ s < ∞) = e -γs E e γξ(s) σ s < ∞ , ( 43
)
where ξ(u) = S * (σ s ) -s denotes the overshoot given that ruin occured in model (37). Thanks to the connection (40), by conditioning on the values of S z-1 , it holds that

P(τ z < ∞) = E e -γS z-1 E e γξ(S z-1 ) τ z < ∞ = E e -γ∆ S z-1 E e γξ(S z-1 ) τ z < ∞ . ( 44
)
The upper bound (42) follows from noting that E e γξ(S z-1 ) σ s < ∞ > 1.

t n S 1 • S 2 • S 3 • S 4 • S 5 • T 1 • T 2 • 1- 2- 3- z = 4- 5- 6- τ z × (a)
Ruin time in the risk model [START_REF] Puri | On the characterization of point processes with the order statistic property without the moment condition[END_REF]. (solid) Trajectory of the process {z + N (t) , t ≥ 0}, (dashed) Trajectory of the process

{M (t) , t ≥ 0}. t n S 1 • S 2 • S 3 • S 4 • S 5 • T 1 • T 2 • 1- 2- 3- z = 4- 5- 6- τz × (b)
Ruin time in the risk model [START_REF] Sapirshtein | Optimal selsh mining strategies in bitcoin[END_REF]. (solid) Trajectory of the process {z + N (t) , t ≥ 0}, (dashed) Trajectory of the process The next result species the expression for the probability P(τ z < ∞) in the case where {N (t) , t ≥ 0} is a Poisson process. Corollary 3. If {N (t) , t ≥ 0} is a homogeneous Poisson pocess of intensity λ and {M (t) , t ≥ 0} is a renewal process, independent from {N (t) , t ≥ 0}, such that (A1)-(A2) holds then

{M (t) + 1 , t ≥ 0}. t t n S 1 • S 2 • S 3 • S 4 • S 5 • T 1 • T 2 • 1 • 2 • z -1 • 4 • 5 • (c) 90 • anticlockwise rotation of Figure 2(b). n t S z-1 = S 3 • S 4 • S σ S z-1 +z-1 = S 5 • T 1 • T 2 • 1 • σ S z-1 • 3 • (d)
P(τ z < ∞) = λ -γ λ E e -γ∆ S z-1 . (45)
If {M (t) , t ≥ 0} is also a homogeneous Poisson process of intensity µ < λ then

P(τ z < ∞) = µ λ z . (46)
Proof. As {N (t) , t ≥ 0} is a homogenous Poisson process, it is renewal process and (41)

holds. The sequence of inter-arrival times {∆ T k , k ≥ 1} is formed by i.i.d. exponential random variables with parameter λ which implies that the overshoot ξ(S z-1 ) is also exponentially distributed with parameter λ by virtue of memorylessness of the exponential distribution. It follows that

E e γξ(S z-1 ) τ z < ∞ = λ λ -γ .
Substituting in (41) yields (45). Now, assume that {M (t), t ≥ 0} is also a Poisson process with intensity µ < λ. The sequence of inter-arrival times {∆ S k , k ≥ 1} is made of i.i.d. exponential random variable with parameter µ. The equation ( 31) is equivalent to

log λµ (λ -θ)(µ + θ) = 0, (47)
and admits γ = λ -µ as only non-negative solution. Substituting γ = λ -µ into (45) yields (46).

This result allows conrmation of Corollary 1, see Example 1. Note that the probability of a successful double-spending attack when the length of the chains are two independent Poisson processes may be retrieved without using the duality argument as shown in the following remark. Remark 4.1. Assume that {N (t), t ≥ 0} and {M (t) , t ≥ 0} are two independent homogeneous Poisson processes with respective intensity λ and µ such that λ > µ. The claim surplus process, already dened in [START_REF] Rosenfeld | Analysis of hashrate-based double spending[END_REF] as

S(t) = M (t) -N (t), for t ≥ 0, (48)
is the dierence between two independent Poisson processes and thus a Lévy process. [2, Theorem 1.2] then implies that the process dened by e θS(t)-tκ(θ) , for t ≥ 0,

where κ(θ) = log E [θS(1)], is a Martingale. The equation κ(θ) = 0 is equivalent to

µe θ + λe -θ -(λ + µ) = 0, (50)
and admits a unique non-negative solution γ = log(λ/µ). Consequently, the process {e γS(t) , t ≥ 0} is a Martingale. Moreover, the condition λ > µ entails S(t) a.s. → -∞.

Applying [2, Proposition 3.1] yields

P(τ z < ∞) = e -γz E e γξ(z) τ z < ∞ , (51)
where ξ(z) = S(τ z ) -z denotes the overshoot after ruin occured in model [START_REF] Puri | On the characterization of point processes with the order statistic property without the moment condition[END_REF]. In the case considered here there is no overshoot as S(τ z ) = z. Substituting γ = log(λ/µ) into (51) yields (45).

Numerical illustrations

The numerical results presented here are based on the data collected by Bowden [START_REF] Bowden | Intersection of the longest increasing subsequences[END_REF] and the analysis conducted in Bowden et al. [START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF]. In Subsection 5.1, data is used to t the inter-block time distribution within the public chain. The lack of data regarding the growth of the malicious chain is circumvented by assuming that the inter-block times in the malicious chain are dened as a transformation of the inter-block times in the public chain. This allows us to illustrate the results given in Section 2 and 4. Subsection 5.2 focuses on the case where the lengths of the chains are governed by non-homogeneous Poisson processes which seems to be the most suitable model according to Bowden et al. [START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF]. It allows, in turn, to illustrate the results derived in Section 3.

Length of the chains as renewal process

In this subsection, the length of the chains {N (t) , t ≥ 0} and {M (t) , t ≥ 0} are assumed to be governed by renewal processes. The rst task consists in studying the t of the inter-block time distribution to the data provided in Bowden [START_REF] Bowden | Intersection of the longest increasing subsequences[END_REF]. Figure 3 the rst few blocks presents a few spikes (to the magnitude of the day) before reaching stationarity arround the 200, 000 th block, see Figure 3(a). If we limit our analysis to the latest blocks, starting for instance from the 400, 000 th , then the data admits fewer outliers, with a maximum of 2 hours, see Figure 3(b). The inference of the block arrival is therefore based on the inter-arrival times starting from the 400, 000 th block onward which still represents 96, 628 data points. The empirical mean is equal to 9.57 minutes while the standard deviation is signicantly lower than the overall one with 9.56 minutes. Regarding the block arrival in the malicious chain, no data is available. The only a priori information is that the inter-block time should be larger to account for the unbalanced repartition of the computing power in favor of the honest miners. The growth of {M (t) , t ≥ 0} should be slower than the growth of {N (t) , t ≥ 0}. In the sequel, two denitions of the inter-arrival times {∆ S k , k ≥ 1} that generate {M (t) , t ≥ 0} are compared in terms of the risk of a double-spending attack.

Dene

∆ S D = ∆ T r , (52)
where r > 1. The inter-arrival times {∆ S k , k ≥ 1} are i.i.d. exponential random variables and the process {M (t) , t ≥ 0} is a homogeneous Poisson process with intensity λ/r. Corollary 3 applies and the probability of successful double spending attack is given by

P(τ z < ∞) = 1 r z . ( 53
)
The p.d.f. of the double spending time f τz follows from applying Corollary 1 and is given in [START_REF] Goard | Boundary crossing of order statistics point processes[END_REF] after substituting λ = λ and µ = λ/r.

Dene

∆ S D = ∆ T 1 + . . . + ∆ T r , (54)
where r > 1 is integer-valued. The inter-arrival times {∆ S k , k ≥ 1} are i.i.d. gamma random variables Gam(r, λ) with associated p.d.f.

f ∆ S (t) = e -λt t r-1 λ t Γ(r) , for t ≥ 0. (55)
The process {M (t) , t ≥ 0} is, in turn, a renewal process. Corollary 3 applies and the probability of successful double spending attack is given by

P(τ z < ∞) = λ -γ λ λ λ + γ r(z-1) , ( 56
)
where γ is the only non-negative solution to the equation

log λ r (λ -θ)(λ + θ) r-1 = 0. ( 57
)
Note that the root in (57) is derived numerically using the uniroot built-in function in R. The p.d.f. f τz of the double-spending time follows from the application Corollary 1 and reduces, after a couple of rearrangements, to

f τz (t) = +∞ n=0 z z + n Γ[r(n + z) + n] Γ(n + 1)Γ[r(n + z)]2 r(n+z)+n (2λ) r(n+z)+n t r(n+z)+n-1 e -2λt Γ[r(n + z) + n] ,
(58) for t ≥ 0.

Table 1 reports the value of ( 53 for r = 2 along with the reference horizontal lines y = P(τ 1 < ∞). Note that the innite series in ( 17) and ( 58) are truncated to the order K = 50. In both cases, the merchant who is waiting for two hours is not taking much risk as the c.d.f. reaches the barrier P(τ 1 < ∞). Namely, if P(τ 1 < ∞) -P(τ 1 < t) = , for some t ≥ 0 and > 0, then the probability of the double-spending ever being successful, conditionning upon {τ z > t}, may be written as

P(τ z = +∞|τ z > t) = P(τ z = +∞) P(τ z = +∞) + .
That probability becomes close to one as we let tend toward 0. The R code is accessible online at [START_REF] Goard | Online accompaniment for "Fraud risk assessment within blockchain transactions[END_REF] for the sake of reproducibility.

and may be integrated as

Λ(t) = t 0 λ(s)ds = pe b L 2 256 a e at -1 . (62)
Note that we have equivalently

λ * (t) = (1 -p)e at+b L 2 256 , (63)
and

Λ * (t) = t 0 λ * (s)ds = (1 -p)e b L 2 256 a e at -1 . (64)
In view of these assumptions, the conditional distribution of the block arrival times given the length of the chain is the same in the honest and the malicious chain. Namely, it holds that F t (s) = F * t (s) and the probability P(τ z > t) of the double-spending attack being unsuccessful before t may be estimated via [START_REF] Perry | A two-sided rst-exit problem for a compound Poisson process with a random upper boundary[END_REF]. The practical evaluation is handled via Monte Carlo simulations, note that the numerical value of an Appell polynomials of any order may be computed recursively using the relations given in the appendix A, see Proposition 2. Let the time unit be one second, consider a 2 weeks long time period which corresponds to 1, 209, 600 seconds. Let us set the parameters of the hashrate function to a = -9.44 × 10 -9 and b = 27.1 according to the rst row of the table in Bowden et al. [8, Table 1]. The diculty is assumed to be constant, equal to

L = 2016 × 2 256 a e b (e a * 1209600 -1)
, in order to have on average 2, 016 blocks discovered by the end of the time horizon (i.e. two weeks). Figure 6 displays the integrated intensity functions (62) and (64) over time.

The parametrization entails a linear growth (on average) of the chains which makes our example close to the homogeneous Poisson arrival situation. Formula ( 20) is dicult to use for risk management purposes without the knowledge of the mass of probability associated to τ z = ∞. This issue is addressed by assuming that an attacker gives up his double-spending attempt if not completed within three hours (10,800 seconds). It makes little sense in practice for an attacker to carry on an attack for two weeks. We then investigate the probability of a successful double-spending attack attempted every three hours over the course of two weeks. Namely, denote by

t k = k × 10800, for 0 ≤ k < 112,
the probabilities of interest, where

τ z,k = inf{t ∈ (t k , t k+1 ) ; M (t) = z + N (t) M (t k ) = N (t k ) = 0}.
Let us assume that the honest chain is 1 block ahead, which in turn, allows to use Formula [START_REF] Lefèvre | Risk models in insurance and epidemics: A bridge through randomized polynomials[END_REF] given in Corollary 2 and alleviate the computational burden associated to the recursive evaluation of Appell polynomials. Figure 7 displays the value of the probabilities (65) over the two weeks of operations for various repartition p ∈ {0.6, 0.7, 0.8, 0.9} of the hash power. Note that the evaluation is based on 10, 000 trajectories of {N (t) , t ≥ 0} and {M (t) , t ≥ 0}. The probabilities p z,k are constant over time, this was expected as the arrival of blocks is almost time-homogenous due to the parametrization of the global hashrate function. The source code is available online [START_REF] Goard | Online accompaniment for "Fraud risk assessment within blockchain transactions[END_REF] and the reader is invited to experiment the eect of modifying the parameters a and b on the double-spending probabilities.

Concluding remarks

In this paper, the model, initially proposed by Satoshi Nakamoto [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF], to comprehend the double-spending issue is rened. Assuming that the lengths of the competing blockchains are governed by counting processes leads to interesting boundary crossing problems. This renement oers more exibility to reect accurately the block discovery frequency as well as the distribution of the computing power among honest and dishonest miners through the calibration of the arrival times that generate the aforementionned counting pocesses. Theorem 3 is useful to advise the merchant on how many subsequent blocks should be added to the chain before shipping the good. Theorem 1 and 2 enable to gure the time at which the double-spending attack is most likely to occur. This is helpful to provide merchants with guidelines on how long they should wait before shipping a good, which compliments the advice on the number of blocks.

Throughout this paper, the lag z > 0, between the honest and malicious chain is assumed to be deterministic. In practice, because the length of the dishonest chain is unknown to the vendor at the time of the shipping, the delay should be assumed stochastic. From a mathematical point of view, the question is when do we initialize the counting processes {N (t) , t ≥ 0} and {M (t) , t ≥ 0}. If the starting time is the time at which the good is shipped then Z and the counting processes are independent. Thus we can apply the law of total probability together with the formulas derived above. We have an atom at 0 with probability mass P(Z ≤ 0). If we initialize the counting processes at the time of issuance of the transactions then Z and the counting processes are linked. The vendor is asked to wait for say k ∈ N blocks to be added to the blockchain before shipping the good. The honest chain is then ahead by Z = k -M (T k ), where T k is the arrival time of the k th block in the honest chain. The time interval [0, T k ] is a burn-in period during which it does not matter which chain is leading. If {N (t) , t ≥ 0} and {M (t) , t ≥ 0} are Poisson processes then T k has a gamma distribution, the stopped processes at T k are again Poisson processes, and M (T k ) is governed by a negative binomial distribution which is consistent with Rosenfeld's ndings [START_REF] Rosenfeld | Analysis of hashrate-based double spending[END_REF]. The general case will be studied in an upcoming research work.

The success of the blockchain method has resulted in bitcoin becoming increasingly popular and inspiring other electronic payment method. It is worth mentionning that the results derived in this paper maybe relevant to understand other systems where similar blockchain policies are used.

Selsh mining, described for instance in Sapirshtein et al. [START_REF] Sapirshtein | Optimal selsh mining strategies in bitcoin[END_REF], Göbel et al. [START_REF] Göbel | Bitcoin blockchain dynamics: The selsh-mine strategy in the presence of propagation delay[END_REF], and Eyal and Siren [START_REF] Eyal | Majority is not enough: Bitcoin mining is vulnerable[END_REF], is another type of miners' misconduct. Nowadays, it is no longer feasible to mine BTCs in isolation. Empirical evidence shows that BTCs miners behave strategically by gathering in pools. All members contribute to the solution of each cryptopuzzle, and share the rewards proportionally to their contribution. Selsh mining is a strategy that can be used by a minority pool to obtain more revenue. The key idea is for the pool of selsh miners to keep its discovered blocks private while honest nodes continue to mine on the public chain. Assuming that the private chain has the lead over the public chain, when the public branch approaches the selsh miners' one, the private chain is released publicly. It results in a waste of resources for all the miners but Eyal and Siren [START_REF] Eyal | Majority is not enough: Bitcoin mining is vulnerable[END_REF] showed that the revenue of the selsh miners goes beyond the revenue expected by following the usual protocol given their share of the total computing power. The results presented here may be relevant in the context of a self-mining attack as it boils down again to the race between two counting processes.

=

  stands for equality almost sure as it is true for every trajectory. Then rotate Figure 2(b) by 90 • anticlockwise to get Figure 2(c). Shifting the origin from (0, 0) to (z -1, 0) nally leads to Figure 2(d). The ruin problem displayed on Figure 2(d) concerns a discrete time risk model denoted by {R * (n) , n ≥ 1} and dened as

  Ruin time in the risk model (37). (solid) Trajectory of the process {T k , k ≥ 0}, (dashed) Trajectory of the process {S z-1+k , k ≥ 0}.

Figure 2 :

 2 Figure 2: Boundary crossing problems in the various risk models.

  displays the inter-block times chronologically. The distribution of the inter-block times of (a) Time series of the interblock times. (b) Time series of the interblock time starting from the 40000 th block.

Figure 3 :

 3 Figure 3: Chronological series of the inter-block times.

Figure 4

 4 shows the histogram of the inter-block times. The p.d.f. of the exponential distribution Exp( λ), where λ = 1/9.57 corresponds to the method of moment estimator, matches reasonably well the histogram. On Figure 4(b), the empirical quantiles are plotted against the quantiles of the exponential distribution Exp( λ). The points overlap the (a) Histogram of the inter-block times distribution. (b) Q-Q plot to test the adequacy to the exponential distribution.

Figure 4 :

 4 Figure 4: Distribution of the inter-block times.

5 z 1

 51 ) and (56) for r = 2, 3, 4, 5 and z = 1, 2, 3, 4, 5. Although ∆ S ∼ Exp(λ/r) ∆ S ∼ Gamma(r, λ) r = 2 r = 3 r = 4 r = 5 r = 2 r = 3 r = 4 r =

  (a) P.d.f. of τ 1 . (b) C.d.f. of τ 1 as well as P(τ 1 < ∞).

Figure 5 :

 5 Figure 5: P.d.f. and c.d.f. of the double spending time τ 1 . (solid) {M (t) , t ≥ 0} is a homogeneous Poisson process with intensity λ/2. (dashed) {M (t) , t ≥ 0} is a renewal process with gamma Gam(r = 2, λ) distributed inter-arrival times.

Figure 6 :

 6 Figure 6: Integrated intensity functions over time: (solid) Λ(t) associated to {N (t) , t ≥ 0}, (dashed) Λ * (t) associated to {M (t) , t ≥ 0}.

Figure 7 :

 7 Figure 7: Evolution of the probability of performing a successful double-spending attack in the course of two weeks for various values of p: (solid) p = 0.6, (dashed) p = 0.7, (dotted) p = 0.8, (dot-dash) p = 0.9.

  Example 1. Assume that the length of the chains {z + N (t) , t ≥ 0} and {M (t) , t ≥ 0} are governed by two homogeneous Poisson processes of intensity λ and µ respectively. The inter-arrival times {∆ S k , k ≥ 1} are i.i.d. exponential random variables with parameter µ and associated p.d.f.

Table 1 :

 1 Probability of a successful double-spending attempt denitions 1 and 2 both means that the building of blocks is r times slower on average in the malicious chain, the probability of a successful double-spending attack is much smaller when {M (t) , t ≥ 0} is a renewal process with gamma distributed inter-arrival times. It shows the inuence of the shape of the distribution of the inter-arrival times on the likelihood of a double-spending attack. Figure5displays the p.d.f. and c.d.f. of the double-spending time τ

	5000 0.3333 0.2500 0.2000	0.3819 0.1608 0.0724 0.0342
	2 0.2500 0.1111 0.0625 0.0400	0.1459 0.0258 0.0052 0.0012
	3 0.1250 0.0370 0.0156 0.0080	0.0557 0.0042 0.0004 0.0000
	4 0.0625 0.0123 0.0039 0.0016	0.0213 0.0007 0.0000 0.0000
	5 0.0312 0.0041 0.0010 0.0003	0.0081 0.0001 0.0000 0.0000

1 = inf{t ≥ 0 ; N (t) + 1 = M (t)},

  Length of the chains as non-homogeneous Poisson processIn this subsection, the length of the chains {z + N (t) , t ≥ 0} and {M (t) , t ≥ 0} are assumed to be governed by two non-homogeneous Poisson processes. The intensity function of {N (t) , t ≥ 0} is given by The global hashrate is assumed to admit a parametric form with H(t) = e at+b , where the values of a and b are selected from Bowden et al.[START_REF] Bowden | Block arrivals in the bitcoin blockchain[END_REF] Table 1]. The diculty is assumed to be the same for all the miners so that L * (t) = L(t). More specically, let us consider a time span during which the diculty is contant, equal to L say. This is true for time periods that are about two weeks long as it corresponds to the average time to discover 2, 016 blocks. The intensity function λ(t) associated to {N (t) , t ≥ 0} becomes

	λ(t) =	pe at+b L 2 256 ,
	5.2
	λ(t) =	pH(t)L(t) 2 256 ,		(59)
	where H(t) denotes the global hashrate function, L(t) is the target function, and p ∈ (0, 1)
	reects the repartition of the computing power between honest and dishonest miners. The
			2 256	(t)	.	(60)

reader is refered to Example 2 for a denition of these quantities. The intensity function of {M (t) , t ≥ 0} is given by λ * (t) = (1 -p)H(t)L *

Acknowledgements

I want to thank the anonymous referee for carefully reading my work, making useful suggestions, and pointing out the work of Rosenfeld [33]. I am thankful to Stéphane Loisel, Alexis Bienvenue, and Patrick Laub for helping me improving the presentation of my paper. This work was initiated while I was visiting the department of statistics and applied probability at UC, Santa Barbara. I am thankful for the warm welcome I received. Special thanks to Andrea Angiuli who got me interested in cryptocurrencies and Jean-Pierre Fouque for his insightful remarks and comments.

A

Appell and Abel-Gontcharov polynomials

Appell and Abel-Gontcharov (A-G) polynomials are well-known in mathematics. They can be used to solve various problems in statistics and applied probabilty. A short presentation is provided below. We refer e.g. to Lefèvre and Picard [START_REF] Lefèvre | Risk models in insurance and epidemics: A bridge through randomized polynomials[END_REF] for a review with applications in risk modelling. Let U = {u i , i ≥ 1} be a sequence of real numbers, non-decreasing in our context. To U is attached a (unique) family of Appell polynomials of degree n in x, {A n (x|U ) , n ≥ 0}, dened as follows. Starting with A 0 (x|U ) = 1, the A n (x|U ) satisfy the dierential equations

with the border conditions

So, each A n , n ≥ 1, has the integral representation

dy n-1 . . .

In parallel, to U is attached a (unique) family of Abel-Gontcharov (A-G) polynomials of degree

where EU is the shifted family {u i+1 , i ≥ 1}, and with the border conditions

Note that both polynomial families are sometimes dened without the factor n! in (68) and (71). Of course, these polynomials are related through the identity

However, the two families (i.e. considered for all n ≥ 0) are distinct and enjoy quite dierent properties. From (68) and (71), one may see that the polynomials A n and G n , n ≥ 1, can be interpreted in terms of the joint distribution of the order statistics (U 1:n , . . . , U n:n ) of a sample of n independent uniform random variables on (0, 1).

These representations play a key role in the rst-meeting problems discussed in the paper. Numerically, it will be necessary to evaluate some special values of the polynomials. To this end, it is convenient to use the following recursive relations.

where the A n (0|U )'s are obtained recursively from

The A-G polynomials are computed through the recursion

Formulas (74), and (75) follow from the Taylor's expansion of A n , using also (66), and (67). Formula (76) follows from an Abelian expansion of x n based on (69), and (70). Details are omitted here. Of course, the computing time increases with the degree of the polynomials. Note that

with the same identity for G n . An important particular case in our study is when the parameters in U are random and correspond to partial sums of exchangeable random variables.

Proposition 3. Let {X n , n ≥ 1} be a sequence of exchangeable random variables, of partial sums S n = n k=1 X k with S 0 = 0. Then, for n ≥ 1,

E [G n (x|S 0 , . . . , S n-1 )|S n ] = x(x -S n ) n-1 .

(79)

Proof. The identity (78) was derived in Proposition A.1 of Lefèvre and Picard [START_REF] Lefèvre | A new look at the homogeneous risk model[END_REF], while the identity (79) follows from Goard and Lefèvre [START_REF] Goard | Duality in ruin problems for ordered risk models[END_REF].