Quote from: shunsaitakahashi on March 19, 2018, 02:09:42 PM

Quote from: Kogs on March 19, 2018, 06:16:39 AM

There is more than that the longest chain wins, it's actually the longest valid chain wins.

Completely agree that it's the longest valid chain that wins. But it is not always possible to know if a selfish transaction is invalid. The validity rules embedded in the software can check for some invalid situations but not for every possible invalid situation. If validity rules were able to check for every invalid situation there would be no 51% attack (https://www.investopedia.com/terms/1/51-attack.asp).

Quote from: Kogs on March 19, 2018, 06:16:39 AM

Quote from: shunsaitakahashi on March 18, 2018, 11:29:37 PM

... they may have to accept those blocks with selfish transactions ...

Note the use of may purely for that reason

As ranochigo and bob123 already mentioned, the 51% attack has nothing todo with consensus rules.
Even with a 51% attack you would not be able to create invalid transactions as they would be rejected by any other participants.

But you could do the following, even if it is very hard to do because you really need massive amount of hash power even to lower the difficulty. If you don't manage it to mine 2016 blocks the difficulty will not decrease. And with a high enough difficulty to begin with, you might need 1 week or longer to just mine one single block. To mine 2016 blocks would then take years.

But lets say just for fun the attacker does have the necessary hash power.
What could he do with a 51% attack?

1) He could prevent transactions which are broadcasted and are inside the mempool to get into a block so that the transaction keeps unconfirmed as long as he keeps the 51% advantage.
2) If he really is the only one who mines this coin he could rollback transactions. For this he defines a specific blockhight from the past, lets say he start 2 weeks in the past (about 2000 blocks before the current block hight) and continue mining from this block and create a fork. At some point his fork might be longer than the original one and then all other participants would need to reorg their chain and your chain become the longest valid one.
The only reason why someone would do this, is when he plans to replay one of his own transactions.
Lets say he made a transactions 2 weeks ago where he transmitted 10 coins. The transaction was confirmed by the network and got into one block. If he starts mining one block before the block of his transaction he could create a replay transaction which use one of the same UTXOs from the original transaction and send the coins to one of his address instead of the original target. In this case the orignal transaction would become invalid and the original receiver of the coins would not get it.

But you can do this only with transactions where you control the private key. All other transactions which were inside the blocks you rollbacked would just go back to the mempool and wait for anybody to mine them again. They are not lost. Either the attacker himself mines those reorganized transactions on his side of the fork or like in point 1 described, he just ignores them and they stay in the mempool forever or until any other miner starts mining and he looses the 51% advantage.

Actually there is a chance that those rollbacked transaction are lost forever if the other participants of the network did not had the original rollbacked blocks in their local blockchain. For example they start syncing the blockchain from the beginning or from an older point than the attacker started the reorg. But if anybody did have this reorg blocks in their local blockchain, those transaction would be broadcasted again (through the reorg process of the bitcoin client) and later mined again by any other miner.

That's actually the only 2 attack points you have with a 51% attack.
Point 2 above (to get already spent coins back) makes only sense if the coins do have any value (but if no one is interested in those coins - no node is online, no one is mining then the value of this coin will be 0). And then it's maybe still more profitable to just mine as much blocks as possible on top of the last block to get the block reward.

In all other situations where you start creating invalid blocks/transactions you would just create an invalid fork of the blockchain which does not give you any advantage as all other participants would just reject your blocks.