10
6
Satoshi writes at the bottom of page 3 of his white paper that "If two nodes broadcast different versions of the next block simultaneously, some nodes may receive one or the other first. In that case, they work on the first one they received, but save the other branch in case it becomes longer." It seems here that the correct chain is the longest one, although maybe satoshi was just being a little careless with phrasing.
However, I have read other places that nodes choose the correct chain in Bitcoin by selecting the chain that represents the most work (or, in other words, the chain that would be hardest to undo). I'll call this the strongest chain. This is not necessarily the same as the longest chain since, for example, it is conceivable to have a block which took many more hashes to find a valid nonce than two other blocks with a much easier difficulty level. This stack exchange is one place that I have read this.
Question 1: Which is the correct method that nodes use to determine the correct chain, longest chain or strongest chain?
My second question is more relevant if the answer to question 1 is that the correct chain is the strongest chain. It relates to orphaned blocks.
If the correct chain is the one that represents the most work then why are orphaned blocks such a problem? It seems like if a node solves a block and broadcasts it then everyone will know about it in a matter of seconds and then can start mining on the new block without any wasted work. Even if 2 miners solve a block at (near to) the same time, most blocks will see the two new blocks and choose the one with the lower header hash (because it is harder to find lower hashes). It seems that the nodes should come to a consensus in a matter of seconds then, if the correct chain is chosen by strongest (rather than longest) chain. The only time that a miner could spend working on the wrong chain would be time spent mining between receiving a solved block which is soon after replaced by a different solved block with a slightly lower hash. How long could that be, 10 sec?
Question 2: Are orphaned blocks a big problem for miners? If the block generation time were 1 minute, instead, would orphaned blocks be a much bigger problem?
Although it might make orphans more likely, wouldn't choosing the correct chain this way minimize the net effect of orphans? Because, right now, if someone gets a block broadcasted to them which will eventually not be the correct block then they will waste the whole 10 minutes mining that block until the next block is solved. It seems like the network would come to a consensus more quickly and only mine on the correct blocks. – morsecoder – 2014-07-28T14:11:09.800
As to miners trying to undo blocks, it seems like rational miners wouldn't do this most of the time. Every nonce is like a lottery ticket and if they see that a new block is out, I can't see why they would keep spending their lottery tickets on mining on top of the old block rather than the new one which is more likely to be accepted. In those two cases that you mentioned, I can see why they might try to undo the most recent block (although, the fees don't really seem to be enough incentive now), but those seem like exceptions rather than the rule for what would happen. – morsecoder – 2014-07-28T14:38:48.200
@StephenM347 Your system would also make double-spends by powerful miners easier. Currently, if you have some decent chunk of the mining power and you want to reverse a 1-confirmation transaction, you need to mine two blocks in a row. But with your system, the miner could instead just replace the latest block, which in many cases would be much easier than solving two blocks in a row (depending on the latest block's "strength"). – theymos – 2014-07-28T17:22:30.683
@StephenM347 In any case, orphans aren't much of a problem for the network, so there's no need to change things. Miners don't like orphans because it causes them to lose blocks or waste work, but making miners happy is not important. – theymos – 2014-07-28T17:24:33.470
Are the extremely easy attacks you mention here limited to the time warp attack? Even if time warp attack were a non-issue, would it still be bad to compare chains based on length? – morsecoder – 2015-02-10T04:42:29.140
@StephenM347 Time warp isn't relevant. The extremely easy attack is that it's easier to create 400,000 difficulty-1 blocks than to create 1 block at the current difficulty. So if only the number of blocks mattered (and there were no checkpoints), the current chain could be overtaken very easily. – theymos – 2015-02-10T14:33:50.907
Well, to mine 400,000 blocks at the min difficulty you'd have to alter the timestamps to be really far in the future (assuming you can't leverage the time warp), in which case the chain wouldn't be accepted as the correct chain. I think the time warp attack is relevant because it lets you mine more blocks with the min difficulty without pushing the timestamps way off into the future. I have an open question about this here.
– morsecoder – 2015-02-10T14:48:30.037If the "longest" chain is the one with the most work and two blocks in the same difficulty period always add the same amount of work to the chain why is it wrong to simply count the blocks? What extremely easy attacks does it enable? – Vlastimil Ovčáčík – 2016-01-18T06:40:10.787
1This answer doesn't precisely define "work". The work of a block is actually defined as floor(2^256 / (target + 1)), where 'target' is the target threshold converted from the 'nBits' field of the block header. (See the GetBlockProof function in src/pow.cpp.) – Daira Hopwood – 2017-02-04T04:45:10.317
The history was really interesting. – Jinhua Wang – 2019-04-09T13:54:53.983