how does bitcoin's 6 confirmation really help?

Question

I've read the following:

transaction is “confirmed” once it is buried 6 blocks into the blockchain. This is taken to be a sufficient proof of work such that reversing 6 blocks to double spend coins in a specific transaction is infeasible. As we mentioned

Let's say Alice's blocks(honest node) is A->B->C and I included my transaction into that node which transforms 1BTC to starbucks to buy some coffee. (I am a malicious node), so my local chain is A->B->C' (note: It's C' and not C, and C' doesn't include my starbucks transaction, since i am trying to use 51% attack and double spend).

Now, Alice and other nodes do append blocks to their chain. Let's say A->B->C->D->E->F->G->H->I->J. That's great C block is already more than 6 deep into the blockchain. While Alice and others were building this chain, I am also building my chain(I have 51% hash rate power). and My local chain now looks like this A->B->C'->D'->E'->F'->G'->H'->I'->J' . Now, I solved one more and now after J', I also got K'...

If I now broadcast this, Alice is gonna accept this(longest) and I still double-spent it...

So, how does 6 confirmation really help at all? if someone has 51% power, 6 confirmation really doesn't matter. Any easy and good explanations about this?

My observation and answer IMHO: I think 6 confirmation doesn't solve double spend or 51% attack. It's for the situation when blocks get mined at the same time. If that's the case,it's possible that someone's transaction might get slashed since other longest chain will appear after blocks don't get mined anymore at any given point. So 6 confirmation means that blocks don't get mined at the same time for 6 times sequentially. Correct ?

UPDATE: @murch This is what you're saying:

Generally, requiring more confirmations before considering a transaction reliable makes reorganization attacks more expensive

And This is the only thing I don't understand.

If a malicious user has 51% attack power, why would more confirmations make it harder for him to attack ?

• HN(honest Node) - A->B->C
• AN(Attacker Node) - A-B-C

Attacker makes a transaction to HN (sending 5BTC to some merchant). but not in his own node, since it's local and doesn't broadcast. So we have the following:

• HN(honest Node) - A->B->C->D(includes 5btc transaction)
• AN(Attacker Node) - A-B-C->D' (note D' , it's different from D - because it doesn't include the 5BTC transaction).

Scenario 1) HN just mines nodes, and AN also mines nodes. Let's say they mined E and E' respectively. Now the 5BTC transaction has the confirmation of 2 block. Attacker mined one more block F' and broadcasted it. HN will reorganize chain. and 5BTC is not in AN's chain anymore... So attack successfully happened.

Scenario 2) While AN mines nodes, HN also mines nodes. attacker is faster, so AN mined 10 blocks starting at D'. HN mined 5 blocks starting at D. Now even though HN's D block has 6 confirmations, AN now broadcasts its longer chain and reorganization will happen on HN (removing D block, which consists of 5BTC transaction). so attack succeded.

So, we have 2 scenarios, one with 2 confirmations, one with 6 confirmations. How did 6 help at all in these cases, or at least cease the danger ?

Answer 1

Generally, all confirmations are relativistic: any chaintip could still be replaced with a heavier chain! However, reorganizations become increasingly costly and unlikely the more proof of work is piled on a block.

You are right, an attacker exerting a majority-attack can censor or rollback any transactions, and thus perform a doublespend-attack to return a payment they previously made to another party to themselves (also see What can an attacker with 51% of hash power do?). If you are receiving payments that are orders of magnitudes larger than block rewards, you should consider additional precautions (e.g. KYC, collateral, waiting for more confirmations). The occurrence of a sustained majority attack on Bitcoin could be considered a fatal scenario for Bitcoin: no transaction could be trusted anymore at any number of confirmations.

You may have read that Bitcoin requires the majority of the hashrate to be "honest" to work. Honest in this context means "not collaborating to attack the network" or "independently creating good-faith blocks". Fortunately, it is rather expensive to control the majority of the hashrate. Each block reward is currently worth about $70,000, so a six block majority attack would likely cost $350,000+ in electricity cost alone. Additionally, it would require access to a majority of highly coveted and expensive hardware. Industrial Bitcoin miners have made enormous investments into application specific integrated circuits (ASICs), which can be used for nothing else than SHA-256d mining. The most likely way for a majority attack to come to pass on Bitcoin would be for someone to take over the mining controllers of multiple of the largest mining pools. I would hope that this would be discovered and remedied quickly.

That is not to say that your majority attack scenario hasn't come to pass before. Especially minority forks of larger networks, or other coins that use the same hashing algorithm than bigger networks have been majority attacked in the past. For example Bitcoin Gold was attacked with a 1,300 block reorganization in January 2020.