gistfile1.txt

Bitcoin’s Cost of Counter-Censorship

When miners or outside sponsors attempt to suppress transactions, Bitcoin’s
defense is not a committee vote but a market response. The network raises a
price for inclusion on the honest tip and stretches the time an attacker must
sustain losses. The cost of counter-censorship is what users and miners
collectively spend to make the next parent-confirming block the higher-paying
choice. It is not a permanent stipend. It is elastic and appears exactly when
censorship or reorg risk appears.

The miner’s decision is local and economic. Let p be the attacker’s share of
hashpower, S the subsidy, F_parent the fees sitting on the parent-confirming
tip, and F_attacker the fees on the deviating tip. A rational miner extends the
parent when its expected value exceeds the attacker’s:
(1 - p^2) * (S + F_parent) > S + F_attacker.
This encodes the core intuition: an honest block survives with probability
roughly 1 - p^2 in the immediate window, while an attacker’s payout is
conditional on winning. Counter-censorship is about pushing F_parent up and
keeping F_attacker low so the inequality holds.

Two fee-bumping tools concentrate the bounty. Replace-by-Fee lets a sender
rebroadcast the same spend with a higher fee. Child-Pays-for-Parent lets a
receiver or third party attach a high-fee child that only pays out in a block
that also confirms the parent. Miners build blocks using ancestor-inclusive
feerate, so the child’s fee boosts the whole package. The result is
mechanical: the richest fees accumulate on the parent-confirming chain, and
omitted transactions become a public bounty for whichever miner defects from
the censor’s plan. Mempool eviction reinforces this by dropping the lowest
package feerates first, not isolated parents, so low-value spam cannot displace
a high-fee bundle.

Counter-censorship also uses time. Receivers raise confirmation thresholds when
risk rises. If a high-value payment normally clears at z confirmations, a
venue can require z+k during turbulence. For an attacker near 51 percent, the
expected private work to overtake grows roughly like (z + 1) / (2p - 1) block
events. Each block of delay increases the attacker’s energy bill and prolongs
coinbase-maturity risk, while honest miners continue to harvest the visible fee
pot on the public tip. In practice this means the network can trade latency for
safety: users tolerate more confirmations and pay higher priority fees for a
period, and that combination drives up the attacker’s real-time cost faster
than the attacker can starve everyone else.

Who pays the defense bill? Not everyone. Price is set at the margin by the
users who most need inclusion now: exchange and custodian operations, UTXO
maintenance and key rotations, OTC settlement, layer-two anchors, rebalances,
and force-closes. A relatively small cohort bidding against each other can lift
the top of the block until EV favors the parent tip. Routine traffic can pause
or use layers. The cost is thus targeted: urgent users pay more during
incidents, while the base layer stays affordable or idle in quiet periods.
Difficulty retargeting ensures liveness as revenue ebbs and flows. If revenue
dips, some hash turns off, blocks slow, difficulty falls, remaining miners earn
the new break-even, and the system is ready for the next spike in demand for
confirmations.

As the subsidy halves, the counter-censorship lever gets longer. Rearranging
the EV rule gives the fee threshold:
F_parent > (S * p^2 + F_attacker) / (1 - p^2).
When S declines, the fee needed to tilt miners toward the parent declines in
lockstep. In the fee-dominant limit, it is enough that F_parent is slightly
richer than a censor’s fee-poor tip. This is counterintuitive but important.
Even if the absolute total reward per block trends lower over decades, the
marginal cost to defeat a censorship attempt becomes easier to assemble on
demand, because the honest side no longer needs to overcome a large,
attacker-collectable subsidy.

Pool coordination does not neutralize this. Pools route work; they do not own
ASICs. A cartel that withholds transactions is unstable in the face of a
visible bounty. The first pool that defects collects the pot now, and miners
can repoint hash within minutes if their pool consistently leaves money on the
table. Emerging tools like job negotiation reduce template control by pool
operators further, but even without them the game is a prisoner’s dilemma that
favors defection to the higher-EV parent tip.

There are costs and externalities. During stress, some users overpay, some are
delayed, and UX degrades. That is the price of keeping validation cheap for
everyone while letting the market surge-price scarce blockspace only when it is
truly scarce. The alternative, paying a fixed inflationary stipend forever or
enlarging blocks to keep fees low at all times, misallocates spend to days when
there is nothing to defend and risks pricing out home validation. Bitcoin
chooses to keep the referee cheap and the defense budget reactive.

The hard bound remains: a single actor with a durable super-majority that is
indifferent to cost can censor any Nakamoto chain. Bitcoin’s objective is to
make such coalitions hard to assemble and brittle to maintain. Counter-
censorship does that by turning every omitted transaction into money on the
table, by letting venues raise the time horizon attackers must finance, and by
ensuring that the subsidy’s decline lowers, rather than raises, the fee needed
to keep miners honest at the margin.

In sum, Bitcoin’s cost of counter-censorship is a flexible, market-driven bill
that arrives only when attacks arrive. Fees and confirmations rise to fund the
next honest block while the attacker burns energy and forgoes the same revenue.
The more the system leans on fees, the sharper this response becomes, because a
small fee edge now dominates the decision rule that steers hash to the parent-
confirming chain.