Here is an email I sent to Vitalik discussing how detrimental P+epsilon is to the economic security of Bitcoin. I argue that it is actually not comparable to costless simulation (and indeed, much weaker) since it does not allow a consensus break and still requires somebody to expend resources, putting a bound on how many P+epsilon forks can exist.

Sorry to post an exerpt from a private email conversation, Vitalik -- if you'd like me to take it down you are welcome to ask. And ofc I will not complain if you post any of your replies :)

Hi Vitalik,

Sorry for the late reply. I think the problem here is that while the P+ε attack is costless from the attacker's POV, it isn't costless to the network. That is, there is still work being done on the malicious history, and everyone will agree that it is the "real" history despite being maliciously defined.

This means that P+ε can't be used to cause a consensus failure; it could maybe be used to create long forks though the attacker would have to put up a correspondingly large commitment.

It also means that there can't be more than one P+ε attack going on at once ... if there is, one of the attackers loses and actually has to pay out. If lots of people are motivated to attack you could even get into a situation where you need some sort of consensus system just to determine the highest P+ε bidder! (I'm half-kidding here -- IRL I guess there aren't too many people motivated to do this attack and I guess they'd also be very visible.)

To contrast, "costless simulation" really is costless (or cheap) for everybody. So if I do a costless simulation attack, and you also do a costless simulation attack, we aren't stepping on each others' toes and neither of us gets screwed...and for users looking at the history after the fact there is no way for them to tell which of ours is the "real" history.

I might post this as a blog comment on your P+ε post, but figured I should send it to you first in case you think it's way off-base or have an offhand response.

Cheers,

Andrew