**Analysis.** It is easy to see that the query cost of this attack is \(\frac{1}{4m}\), where \(m\) is the expansion factor. Further, since each query requires \(1+m\) tokens, the token cost is \(\frac{1+m}{4m}\). (Or, \(1+m+\Delta\) if the API has an overhead of \(\Delta\) tokens.) Note that if \(m=1\), i.e., there is no expansion, this attack reduces to our first attack and the analysis similarly gives a query cost of \(\nicefrac{{1}}{{4}}\) and a token cost of \(\nicefrac{{1}}{{2}}\).