The double-spend problem and the Byzantine generals

Wonder

1. If a digital file can be copied perfectly and instantly, what stops it being spent twice?
2. How can a group of strangers with no shared identity agree on a single history without a leader to arbitrate disputes?
3. What makes a vote in an open network more valuable than another person’s word?

Explore

1. A digital token is merely a file. Unlike physical cash, it can be duplicated bit-for-bit with zero cost and no degradation. If Alice sends ten units to Bob, she retains the original file and can send those same ten units to Charlie simultaneously. Until 2008, every working digital cash system depended on a trusted issuer: online schemes checked each payment centrally, and offline schemes could only identify double-spenders after the fact.
2. David Chaum’s DigiCash had every payee deposit coins with the bank, which checked each serial number against its list of spent coins. Hal Finney’s Reusable Proofs of Work relied on a single server running open-source code on secure hardware to track spent tokens. Wei Dai’s b-money proposed servers that posted deposits and could be fined for cheating, but it was never built. Each design kept a trusted party, or a known group, at its center.
3. In 1982, Leslie Lamport, Robert Shostak, and Marshall Pease formalized the Byzantine Generals Problem in ACM Transactions on Programming Languages and Systems. Generals surrounding a city must agree to attack or retreat, but some generals are traitors who send conflicting messages; the messengers themselves are reliable. With unsigned messages, agreement is possible only if fewer than one-third of the generals are traitors (n ≥ 3f+1); with one-third or more, no protocol can guarantee it.
4. Classic fault-tolerant protocols like PBFT require a known, fixed set of participants. This works for internal bank ledgers but fails in open networks where anyone can join. John Douceur identified the Sybil attack in 2002: an adversary can generate unlimited fake identities to dilute honest votes or control quorums. In an open peer-to-peer network, identity is cheap and infinite, so any scheme that counts identities can be taken over by a single actor.
5. Satoshi Nakamoto’s whitepaper addressed this directly. Its abstract presents bitcoin as a solution to double-spending without a trusted third party. Instead of relying on identity or institutional trust, the system ties each block to a cumulative proof of work. Votes are weighted by computation, which cannot be multiplied by inventing identities; an attacker must out-compute the honest network to rewrite history.
6. The result is probabilistic finality. A transaction is not permanently final in a mathematical sense but becomes increasingly secure as each new block extends the chain. As long as an attacker controls less than half the hashing power, the chance of reversal falls exponentially with every confirmation. This trade-off accepts the theoretical possibility of reversal to gain practical immutability without central control. Open a block explorer and observe how the cumulative work grows with each block height; this accumulating cost is what anchors the ledger to physical reality.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• L. Lamport, R. Shostak, M. Pease, 'The Byzantine Generals Problem', ACM TOPLAS (1982)
• J. Douceur, 'The Sybil Attack', Peer-to-Peer Systems (2002)
• S. Nakamoto, 'Bitcoin: A Peer-to-Peer Electronic Cash System' (2008)
• M. Castro & B. Liskov, 'Practical Byzantine Fault Tolerance', OSDI (1999)