I came up with an attack on my P2PTradeX protocol (https://bitcointalk.org/index.php?topic=91843.0), which, in most cases, would thwart severely its utility. Lets first review the protocol. A first party issues a conditional transaction in a block chain X, which contains a contract. The contract requests the the other party to provide a proof that a payment has been issued on the Bitcoin block chain. The proof consist of a Merkle branch from the Merkle root to the paying transaction, the block header plus the block headers of several confirmation blocks. The attack works as follows: if the attacker can perform simultaneous trades, then he can create a single counterfeit block branch containing many fake transactions. Almost 2200 standard looking fake transactions can be stored in a block. This block branch can be presented simultaneously to all the traders, sharing the cost of orphan mining over all the executed trades. The attack can be pipelined so the counterfeit branch is partially reused for each new batch of attacks performed in each new block. If the block reward is 25 BTC, then this limits the amount of money that can be safely traded to 11 mBTC per transaction, or 11 USD at 1K USD/BTC exchange rate.

Mitigations

If you want to trade higher amounts (say n BTC) you should either trade them by dividing n in many transactions of 11 mBTC each or, better, create a transaction whose size is (n*0.011) times the standard transaction size, adding more inputs. Outputs could also be added, but some other standard condition must be specified on transactions to avoid reusing the outputs for different trades.

Since traders request block chain branches that are recent, the attacker may not be able to reuse the fake block chain branch for many block intervals. To achieve the maximum revenue from the attack, the attacker may need to perform millions of simultaneous trades, at a rate of 3.6 trades per second. This may be impractical due to the lack of market for trades. If the trading market executes 1 order per second (1/7 of the maximum Bitcoin transaction rate) then the maximum secure trade per transaction rises to 40 mBTC.

Last, if the Bitcoin chain has periodic checkpoints (e.g. 1 per day) signed by a trusted authority, then the contracts may specify that the last block header should be check-pointed. This eliminates the problem completely but slows downs trade rate considerably and requires a TTP.

Conclusion

Its has to be evaluated if the P2PTradeX is worth its complexity now that it has been found that it severely limits the amounts traded. Recently some other protocols have been designed that achieve the same result but do not require changing the core protocol, such as the one described by Socrates1024 in https://bitcointalk.org/index.php?topic=193281.msg3315031#msg3315031. In comparison Socreates1024 protocol requires that some non-standard transaction templates are re-enabled in both block-chains but does not limit the amounts traded, while P2PTradeX does not impose any restriction on the Bitcoin side, while requires much computing effort on the alternate coin side, and restricts traded amounts.