JoelKatz:

In Bitcoin, because you can verify the validity of the entire blockchain and a valid transaction contains proof that the sender authorized it, you can in principle trace your coins back to their origin and have a proof of authorization for each step along the way. This means that if your coins ever end up disappearing, it must be because either a) they were double-spent at some point, and the current longest chain includes the other transaction or b) the block they originated in isn't part of the longest chain. This also means there's no way to end up controlling coins that you didn't control before except by receiving them or by mining a block, which puts limitations on the kinds of attacks possible. (An attacker must legitimately control coins in order to double spend them, for example – they can't just print money.)

In Ripple I understand that validators only needs the most recent ledger, meaning there isn't any guarantee that such a chain of proof exists. Are there any attacks that have the rough form


That is, is there some event like a massive power outage or a network split or colluding validators which somebody could exploit to update balances in their favor? Perhaps it might go like this: a power outage makes it so that a colluding set of validators is temporarily the majority, and they propose a ledger with malicious changes. Several ledger closes go by before the rest of the validators are up again, and when they look at the network they see that the current ledger includes the malicious changes. Because no record of a transaction needs to exist for a balance to be considered valid, there's no way to prove that the new balances are illegitimate, and the malicious ledger looks valid.

Am I understanding things correctly? What conditions could this happen under? What sort of resources would an attacker need to make this happen? Are there any limitations on what could be done in this type of attack? How could the community recognize and react to such an attack?