Why is Poisson instead of Negative Binomial used for computing attacker's potential progress? In chapter 11 of the Satoshi's paper it is claimed that:


  The recipient waits until the transaction has been added to a block
  and z blocks have been linked after it. He doesn't know the exact
  amount of progress the attacker has made, but assuming the honest
  blocks took the average expected time per block, the attacker's
  potential progress will be a Poisson distribution with expected
  value zq/p.


I think the precise model should be a negative binomial distribution instead of a Poisson one.

My question is: Is Satoshi's solution an approximation or is it supposed to describe accurately the problem?
I have found the answer in this article by Meni Rosenfeld, page 7. The problem should indeed be modeled with a Negative Binomial distribution, and the computations done on Satoshi's paper are approximations.

The fact of matter is that the quality of the approximation does not rely on the expected high number of trials required to mine a block, but in the general similarity between the negative binomial and the Poisson distributions. This leads to non-negligible differences between the actual probability and the probability computed by Satoshi, e.g. for q=10% and 5 confirmations, Satoshi says P=17.73523%, while Rosenfeld says P=19.762%.