Cost to Flood — the attacker-side storage externality (v1)

Status: v1 NOTE (2026-08-10) · Program: Bitcoin Resource Accounting Companion: research/working-paper.md (node-side SCCR v2.2.0), research/cost-to-flood-plan.md Origin: a reviewer's comment — "a nation state could flood your computer with garbage or put so much crap in UTXO that you can't run a node." We priced it.

The one-sentence thesis

The node-side measurement (SCCR ≈ 0.22) says fees under-price storage; the attacker-side measurement — what it costs to impose that storage — is the leverage ratio of the vulnerability, and it has never been measured.

The headline numbers (verified 2026-08-10)

Quantity	Value	Meaning
P_flood (fill one block)	$329–1,231	at fee floor (0.0052 BTC) vs avg (0.0195 BTC)
P_year (fill every block)	$17M–65M/yr	~52,596 blocks × P_flood
C_node_imposed (10-yr node cost)	~$197M	one year of full-block flood × N=32K × T=10
Leverage ratio L	3.0×	node cost imposed ÷ attacker cost paid
L_dust (storage leg)	0.9×	dust's per-node storage cost is less than its fee
Boundedness	~52.6 GB/yr	max vbytes the block-weight cap allows

The three results

1. The leverage ratio L = 3.0×

Filling every block at the fee floor costs the attacker ~$65M/yr and imposes ~$197M of 10-year storage cost on the network. The vulnerability is real and moderately leveraged — the attacker gets ~3× the cost they pay. Not the apocalypse, not harmless. A nation-state budget sustains this indefinitely.

2. Dust is a WEAK attack on storage (L_dust = 0.9×) — the counterintuitive result

The per-node lifetime storage cost of a dust UTXO is slightly less than the fee that creates it (~$0.246 to mint, ~$0.229 imposed). Dust's real threat is the validation/RAM leg, not storage — the UTXO set is an in-memory index every node must hold. This is exactly what the 4-resource model anticipated: the cost surfaces differ by leg.

3. The attack is bounded but qualitatively harmful

Block weight caps chain growth at ~52.6 GB/yr of permanent vbytes, and UTXO growth is block-bounded. The attack cannot make Bitcoin un-runnable tomorrow — but sustained full-block flooding raises node costs, pushes operation toward institutions, and degrades the "anyone can verify without permission" property. That is the centralization pressure the paper's unpriced-permanence thesis predicts.

Boundedness (the theorem)

max_vbytes/yr = (4,000,000 WU/block ÷ 4) × 52,596 blocks ≈ 52.6 GB/yr

Block weight is a hard cap; the chain cannot grow faster than this in vbytes. UTXO growth is bounded by the number of outputs per block. The attack is therefore quantitatively bounded but qualitatively harmful: it cannot destroy the network, but it can price node operation up.

What this means (honest framing)

It's a vulnerability, not a death certificate. An unpriced externality is a defect in the pricing of a resource — measurable, and fixable.
The leverage ratio is the number that matters. If L ≫ 1 the threat is live; at L = 3.0 it is real but not existential. The 0.9× dust result shows the attack surface is leg-specific.
The reply to the reviewer said it plainly: "If you have attack scenarios you'd want priced, I'd genuinely like to run them." This note is the first batch.

Status

Published: P_flood/P_year/C_node_imposed/L/L_dust/boundedness computed and verified; this v1 note.

In progress / open: budget scenario table (nation-state budgets → node impact); dust-RAM leg measurement; decision: standalone vs fold into the working-paper §5.8.

Bitcoin Sahi Research — Cost to Flood (attacker-side externality), v1 note (2026-08-10). Numbers verified against frozen capture + live mempool.space.

← All research · ← Back to Learn