<p>As Mike and Antoine already explained, we pick the best chain by total accumulated work, not by height, where the work is counted per the blocks' difficulty. However, the original release of Bitcoin did actually use the height to pick the best chain, which was replaced with &quot;most work&quot; after people noticed this attack surface just like you did.</p>
<p>You cannot redo the work from block 1, because Bitcoin Core commits to a series of checkpoints that hard-code specific block hashes at specific heights. The youngest is at height 295,000 which is buried some eight years now. This protects against new nodes falling for extremely low-difficulty fake chains, even though the difficulty is about 5,000× higher today than that of the last checkpoint block.</p>
<p>Further, some years ago, Bitcoin Core introduced header-first synchronization: before Bitcoin Core will request any single block, it'll request the whole header chain from one peer (up to that peer's best chain tip). Since the header is sufficient to determine whether a block passes the difficulty requirement, a new node can use the less than 60 MB header chain to see whether what it's been given passes has more work than a sanity parameter called <code>minChainWork</code>. The node will only start requesting blocks from peers after it has received a header chain whose cumulative work exceeds <code>minChainWork</code> by two weeks worth of work. So, for an attacker to get you to even download a single block, their chain has to exceed a total work within a magnitude of Bitcoin's total work.</p>

CC BY-SA 4.0
2022-02-10T20:15:29.623Z
Best and only complete answer. The fact that the most important consensus rule changed  from "longest chain" to "most work chain" is rarely discussed and this leads to recurring questions like the OP.
bigjosh
CC BY-SA 4.0
2022-02-08T15:13:26.630Z
2022-02-10T20:22:01.163Z
2022-02-10T20:22:01.163Z
Murch
<p>What matters is the cumulative work, not the length of the chain. A block solved at a higher difficulty will add more work than a block (or several blocks for that matter) solved at a lower difficulty.</p>
<p>Therefore, you can't create a low difficulty chain from the genesis and get nodes who know about the current chain to reorg to yours.</p>
<p>For more details, see <a href="https://bitcoin.stackexchange.com/a/29744/101498">this answer</a>.<br />
Also note that a block only add work based on the current difficulty, not its hash. See <a href="https://bitcoin.stackexchange.com/a/97257/101498">this answer</a> for more on this.</p>

CC BY-SA 4.0
2022-02-08T10:35:24.743Z
2022-02-08T10:35:24.743Z
Antoine Poinsot
<p>Blocks with lower difficulty than the threshold are invalid. Also the “longest” in longest chain doesn’t refer to the number of blocks but to the cumulative difficulty.</p>

CC BY-SA 4.0
2022-02-08T02:18:35.077Z
Thanks for your fast reply that was the missing point.
SadPepo
CC BY-SA 4.0
2022-02-08T02:06:25.807Z
2022-02-08T02:06:25.807Z
Mike D
<p>I'm struggling with this question that should be easy to answer.</p>
<p>If the truth is the longest chain,
what if I redo all the work from Block 1
until I have the longest chain by keeping a constant low difficulty?
Then I could produce tons of blocks and just modify the timestamps to keep a constant difficulty. I should be able to generate a longer chain than the actual height.</p>
<p>I am aware that I am missing an important point.
What protections are in place against this process? Or my math is broken?</p>
<p>I hope I have expressed my thoughts well
Thank you in advance for your answers</p>

<proof-of-work><consensus><attack><chain-reorganization><best-chain>
Can you get the longest chain by keeping a constant low difficulty?
SadPepo
# Can you get the longest chain by keeping a constant low difficulty?

(Asked by: username_0 on 2022-02-08)

I'm struggling with this question that should be easy to answer.

If the truth is the longest chain,
what if I redo all the work from Block 1
until I have the longest chain by keeping a constant low difficulty?
Then I could produce tons of blocks and just modify the timestamps to keep a constant difficulty. I should be able to generate a longer chain than the actual height.

I am aware that I am missing an important point.
What protections are in place against this process? Or my math is broken?

I hope I have expressed my thoughts well
Thank you in advance for your answers

**Tags:** proof-of-work, consensus, attack, chain-reorganization, best-chain


---

## 3 answers

### Answer by username_1 on 2022-02-08. Score: 6

As username_4 and username_3 already explained, we pick the best chain by total accumulated work, not by height, where the work is counted per the blocks' difficulty. However, the original release of Bitcoin did actually use the height to pick the best chain, which was replaced with "most work" after people noticed this attack surface just like you did.

You cannot redo the work from block 1, because Bitcoin Core commits to a series of checkpoints that hard-code specific block hashes at specific heights. The youngest is at height 295,000 which is buried some eight years now. This protects against new nodes falling for extremely low-difficulty fake chains, even though the difficulty is about 5,000× higher today than that of the last checkpoint block.

Further, some years ago, Bitcoin Core introduced header-first synchronization: before Bitcoin Core will request any single block, it'll request the whole header chain from one peer (up to that peer's best chain tip). Since the header is sufficient to determine whether a block passes the difficulty requirement, a new node can use the less than 60 MB header chain to see whether what it's been given passes has more work than a sanity parameter called `minChainWork`. The node will only start requesting blocks from peers after it has received a header chain whose cumulative work exceeds `minChainWork` by two weeks worth of work. So, for an attacker to get you to even download a single block, their chain has to exceed a total work within a magnitude of Bitcoin's total work.

> **Comments:**
> **username_2**: Best and only complete answer. The fact that the most important consensus rule changed  from "longest chain" to "most work chain" is rarely discussed and this leads to recurring questions like the OP.  

---

### Answer by username_3 on 2022-02-08. Score: 3

What matters is the cumulative work, not the length of the chain. A block solved at a higher difficulty will add more work than a block (or several blocks for that matter) solved at a lower difficulty.

Therefore, you can't create a low difficulty chain from the genesis and get nodes who know about the current chain to reorg to yours.

For more details, see [this answer](https://bitcoin.stackexchange.com/a/29744/101498).  
Also note that a block only add work based on the current difficulty, not its hash. See [this answer](https://bitcoin.stackexchange.com/a/97257/101498) for more on this.


---

### Answer by username_4 on 2022-02-08. Score: 2

Blocks with lower difficulty than the threshold are invalid. Also the “longest” in longest chain doesn’t refer to the number of blocks but to the cumulative difficulty.

> **Comments:**
> **username_0**: Thanks for your fast reply that was the missing point.  

---

