I don’t believe it’s gonna be a big issue, as the user doesn’t have to withdraw all utxos at a time. The user just need to deposit a certain amount of ETH, and repeat that for a few times.
I mean, for the bond, it just needs to be larger than the tx fee, like $1 usd as you mentioned. then others will have the incentives to challenge. It doesn’t have to relate to the amount of withdrawal. my 2c
The example assumes that every invalid utxos must be challenged. But it can be changed to challenging 1 invalid utxo is enough to cancel the whole withdrawal. So bond for just 1 transaction is enough.
You mean that Plasma spec should be changed ?
No, I don’t think it’s a requirement. It’s just a design choice to handle a special case.
If you feel fit, you can even disable mass withdrawal altogether and this case will never happen.
All of these things need to be defined mathematically and analyzed - every change to the protocol tends to have lots of potential repercussions imho
Yes, I agree. But it is specific for your application/implementation. Plasma in the general sense is a pattern, not a specification. That’s why there are several Plasma styles already .
Also, I believe that in the original plasma paper, the solution for this case has already been discussed. It was mass-exit with bitmap of UTXOs which requires a bond to be placed. Any fraud proof can cancel the whole withdrawal.
In our implementation, there is a minimum bond when exiting that is forfeited to the challenger if successful. This is to ensure that it always economically makes sense to challenge, discourages a user to submit multiple exits for funds ( your scenario above ), and encourages people to play the role of bounty hunters of a side chain. Revenue for just watching and ensuring the integrity of the plasma chain.
In this scenario, if Eve attempts to withdraw her original $10 output, then someone can just submit a single fraud proof showing that that $10 output was spent. The bond placed with the withdrawal is deliberately large enough that it covers the cost of challenging. I’m not sure I see the issue here.
Can you explain this more?
Each time Eve spends 1 cent she generates a new intermediate UTXO, If one exits all these intermediate UTXOs at once - how can a single fraud proof be used for all of them ?
Ah you’re saying exit all intermediate UTXOs. The value of the UTXO doesn’t matter, just that the minimum bond must be large enough to cover the cost of challenge. So there’s some small UTXO value at which it’s no longer worth it to exit.
Let’s say cost to exit < 1c, so Alice will try to exit from the UTXOs. Alice puts up a bond = cost to challenge, which may be larger than 1c. Someone is therefore incentivized to challenge, even if the UTXO values are small.
Lets say, Eve puts $10,000 dollars, and then creates 1,000,000 intemediate UTXOs
If Eve exits all of these UTXOs unchallenged, then her potential gain is $5B
Lets say exit transaction gas fee is $1, then Eve needs to have $1M to pay for the gas fees.
Now the challengers will need to pay (altruistically) $1M to submit fraud proofs to challenge Eve.
if they successfully challenge Eve, then Eve loses $1M and challengers lose $1M.
Eve can then make another attempts. Lets say after 100 attempts she exhausts the money that challengers are altruistically willing to pay. At that point both Eve and challengers kist $100M each.
Since challengers dont have any more money (or are not willing to fight any more), Eve makes $1B and wins.
So crypto economically it seems that challengers need to be compensated ? Would you agree? Otherwise it seems to be hard to rely on altruistic behavior …
In addition to the $1M Eve has to pay for the gas costs of each exit, she has to put up a bond on each individual exit. This is so that the challenge never loses money by successfully challenging. Hence, it will cost Eve at least $2M to exit the 1M intermediate UTXOs she has created.
We never want to make users doing anything altruistic. Every exit has a bond attached that will pay the challenger’s gas cost and more. So the challenger pays X in gas cost (and some other costs) but receives X+N in return for a successful challenge.
Ok - good 
Now I understand ) I think this can be a way to address the issue.
Couldn’t this be gamed? I know one of the biggest assumptions in Plasma is root blockchain availability, but in the example discussed here Eve might be able to cheaply pull off a successful attack.
I guess this can be prevented by making the challenge period reasonably high, thus forcing Eve to pay a lot to keep the spam on-going, and efficiently calculating the bond costs. I’m not sure how the latter could be achieved though.
Point 3 could also be improved if Eve load balances her spam by cleverly waiting for the market to organically slow down the network. Running a Plasma chain after CryptoKitties launched would’ve been rather problematic.
Good point! Looks like bonds are not going to secure things.
@PaulRBerg I think you might be on the right track to a valid attack model here.
But the longer the period, the worse the UX for the honest users gets. IMHO, even the current 7 days challenge period could turn out to be a big problem. How many people used to e.g. centralized trading platforms/exchanges will accept to wait 7 days to withdraw their funds?
I believe bond requirements would have to be calculated dynamically, and I would surely love to see that mathematical model. I don’t like to be negative, but I think that is close to impossible to design. Also, even if we assume that we have such a model, if it calculates that (some of) the exits should require 10ETH bonds (we assume that that calculation is correct from the security point of view), that will also completely ruin the UX for the honest users…
Actually exiting 1,000,000 UTXOs is hard (and costly) but I agree that this is problematic and we need better models around bond prices. Mainly we should be looking at exactly how high these bonds need to be to prevent this sort of behavior. Assuming a bond is fixed at X ETH and a challenge costs Y gas, it’s simple to determine when the explicit reward of challenge will be negative. How much would it cost to drive gas prices up that much for the entire challenge period?
Generally I don’t think static bonds cut it, but I’m also not aware of any efficient method for determining the current gas price. In reality there are probably some external incentives (companies want to keep user funds safe) we can take advantage of, but I’d rather capture these in the protocol.
This problem also exists in Plasma Cash (I think), although it’s probably logistically harder to set up. You’d also have to target one person in particular.
Isn’t it trivial to determine the current gas price by simply looking at the Txs in the last block (number of blocks)? Maybe I’m missing something obvious… 
Even if I’m right and you can easily determine the gas price at a certain moment X and calculate the bond according to that (I assume we have a good, working model for this), the problem is that the attacker can start spamming and pumping the gas price e.g. 48 hours after that moment X. The (only) two solutions for this:
(UX nightmare))This is very much true, setting up the attack initially described by @kladkogex is a logistical ordeal, but I think we always should assume that the worst scenario can happen and will happen if we let it.
Many factors at play here, but the attacker could act cleverly and corroborate on random, organic bloats of the main chain.
@kfichter was saying that, despite the latest gas price in the most recent block, there’s still absolutely no guarantee that the next block won’t contain a list of transactions with attached fees worth ㆔1 each if someone is willing to spend that amount of money. Presuming normal conditions though, indeed, the last block might be a good proxy for estimating the gas prices, but this thread has been presuming horror conditions, not trivial or rational ones.
Method 1 is indeed a UX nightmare and method 2 might be a scary model from an economic standpoint. If I know there’s always the threat of paying double or triple or more to get my funds back to Ethereum, I wouldn’t even deposit on Plasma in the first place.
Perhaps the optimal solution is to have a model where the operator is able to top up the bonds of every undercapitalised exit. He can afford to periodically scan the Plasma contract for any spooky exits and the main chain for sudden gas cost increases. The presumption here is that the operator has a strong incentive to keep the Plasma chain running, because the cost of a successful attack would be higher than the summed topped up bonds. Afterwards, they could impose slightly higher fees on Plasma to amortise these expenses. Now, there is an elastic limit of how much the bond top-ups can be, but there’s a relatively similar limit to the main chain’s attack size, hence I intuitively feel that these two vectors eventually cancel out.