# Running private lotteries attack
**URL:** https://forum.algorand.co/t/running-private-lotteries-attack/519
**Category:** General
**Created:** [May 15, 2019, 4:19pm UTC](https://forum.algorand.co/t/running-private-lotteries-attack/519 "2019-05-15T16:19:11Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jason](https://forum.algorand.co/u/jason)
#### Post date: [May 15, 2019, 4:19pm UTC](https://forum.algorand.co/t/running-private-lotteries-attack/519/1 "2019-05-15T16:19:11Z")
Probably a naive question, but it will help with learning the system… Does anything prevent a malicious Eve from splitting their tokens into billions of smaller tokens, and then running the sortition on all of them…constantly… and then waiting to act badly until they happen to at some moment hold a sufficient number of votes to act decisively (and maliciously)?
---
### Author:  [@JasonW](https://forum.algorand.co/u/JasonW)
#### Post date: [May 16, 2019, 2:42pm UTC](https://forum.algorand.co/t/running-private-lotteries-attack/519/2 "2019-05-16T14:42:04Z")
Dividing stake across multiple accounts does not increase your chance of winning lotteries or increase the weight of your stake.
---
### Author:  [@jason](https://forum.algorand.co/u/jason)
#### Post date: [May 16, 2019, 3:06pm UTC](https://forum.algorand.co/t/running-private-lotteries-attack/519/3 "2019-05-16T15:06:42Z")
> Dividing stake across multiple accounts does not increase your chance of winning lotteries or increase the weight of your stake.
This is a claim without any supporting argument, reference, or evidence. Please try, at least a little, to support your claim.
The discussion on page 28 of the white paper [[https://arxiv.org/pdf/1607.01341.pdf](https://arxiv.org/pdf/1607.01341.pdf)] seems to say very clearly that the number of users (not the size of their stake) matters a great deal:
“A careful, Markov-chain-like analysis shows that, no matter what options the Adversary chooses
to make at round r −1, _as long as he cannot inject new users in the system_, he cannot decrease the
probability of an honest user to be the leader of round r + 40 much below h. This is the reason for
which we demand that the potential leaders of round r are users already existing in round r − k.”
My attack proposal was simply that moles may lay hidden for much longer than k rounds, acting benignly until cued (or having their account compromised) only much later.
---
### Author:  [@algorand-sybil](https://forum.algorand.co/u/algorand-sybil)
#### Post date: [May 16, 2019, 6:58pm UTC](https://forum.algorand.co/t/running-private-lotteries-attack/519/4 "2019-05-16T18:58:55Z")
This is an interesting attack. A protocol that’s vulnerable to an adversary splitting stake is definitely not resilient against the Sybil attack, which is something that’s required of any permissionless cryptocurrency.
I believe that the Algorand protocol uses the output of the verifiable random function, weighted by stake, to sample from a binomial distribution. Due to the additivity of the binomial distribution, splitting stake should not increase a user’s chance of selection. I got that from section 5.1 of the following document: [https://algorandcom.cdn.prismic.io/algorandcom%2Fa26acb80-b80c-46ff-a1ab-a8121f74f3a3\_p51-gilad.pdf](https://algorandcom.cdn.prismic.io/algorandcom%2Fa26acb80-b80c-46ff-a1ab-a8121f74f3a3_p51-gilad.pdf)
Unfortunately the ideas are not all condensed into one paper, which makes things a bit harder to find.
Modulo stake-splitting, I believe that all of the inputs to cryptographic sortition are committed to in an unpredictable way well ahead of selection, which as you brought up is argued to be secure with the “Markov-chain-analysis”. By strong unforgability of the VRF, Eve needs to hold more than some fraction of the stake to control a committee with overwhelming probability.
I’m being a bit imprecise and vague here, so please let me know if this makes sense!
---
### Author:  [@ihagopian](https://forum.algorand.co/u/ihagopian)
#### Post date: [May 18, 2019, 10:23pm UTC](https://forum.algorand.co/t/running-private-lotteries-attack/519/5 "2019-05-18T22:23:25Z")
To complement what @algorand-sybil said (which its username is funny for this thread discussion 🙂).
The most important point of not _injecting new users in the system_ is being completely sure that all the keys that participate in sortition with seed _Qr_, weren’t created knowing what the value of _Qr_ was going to be.
An adversary can have an edge on predicting that some future seed has a particular value, thus can generate keys that will have an advantage in the sortition using that seed. That’s bad, and the additive property of the binomial distribution wouldn’t hold since this manipulated keys coins wouldn’t have the same chance of sortition success compared to others.
To _fix_ this problem, when seed _Qr_ is used for sortition, is safer only to consider keys created a _long time ago_ were the value _Qr_ couldn’t be better predicted than random. The sortition will be _fair_.
Considering your attack idea, the design is totally ok if you generate keys with a long time before admitting them to _executing_ your attack. When you created them, you couldn’t predict what the value of the first seed would be, so your keys have the same chance of being selected as any other key in the system. And of course, an equal probability of having all that coins in only one key (due to additivity of binomial distribution).
Don’t take this as an official response since I also reconstructed knowledge merging various papers, but I hope can be useful.