<p>The "longest" chain is the one with the most <em>work</em>. A chain's <em>work</em> is equal to the expected number of hashes it would take for someone to replicate a chain of the same number of blocks and the exact same difficulty steps. So currently each block adds about 2<sup>66</sup> work to the chain because it takes on average ~2<sup>66</sup> hashes to solve a block with the current difficulty. Blocks with less difficulty add less work. (The current total chain work is around 2<sup>80</sup>.) <strong>However, two blocks in the same difficulty period always add the same amount of work to the chain.</strong> A block with a lower hash is not considered better than one with a higher hash.</p>

<p>Satoshi didn't initially realize that choosing the correct chain by just counting blocks allows for some extremely easy attacks. Version 0.1 just counted blocks. That's why the paper just says "longest". The idea of "chain work" was added a little later.</p>

<p>Resolving orphans as you suggest might actually make orphans more likely because miners would be incentivized in some cases to try replacing the most recent block rather than extending it, especially right before a big difficulty adjustment or when the most recent block contains a lot of fees.</p>

<p>Orphaned blocks happen every now and then. Eligius reports around 2% orphaned blocks. They would indeed be much more common if the target time was 1 minute since blocks would be generated faster and there would therefore be more opportunity for conflicts between blocks.</p>

CC BY-SA 3.0
2014-07-28T14:11:09.800Z
Although it might make orphans more likely, wouldn't choosing the correct chain this way minimize the net effect of orphans? Because, right now, if someone gets a block broadcasted to them which will eventually not be the correct block then they will waste the whole 10 minutes mining that block until the next block is solved. It seems like the network would come to a consensus more quickly and only mine on the correct blocks.
morsecoder
CC BY-SA 3.0
2014-07-28T14:38:48.200Z
As to miners trying to undo blocks, it seems like rational miners wouldn't do this most of the time. Every nonce is like a lottery ticket and if they see that a new block is out, I can't see why they would keep spending their lottery tickets on mining on top of the old block rather than the new one which is more likely to be accepted. In those two cases that you mentioned, I can see why they might try to undo the most recent block (although, the fees don't really seem to be enough incentive now), but those seem like exceptions rather than the rule for what would happen.
morsecoder
CC BY-SA 3.0
2014-07-28T17:22:30.683Z
@StephenM347 Your system would also make double-spends by powerful miners easier. Currently, if you have some decent chunk of the mining power and you want to reverse a 1-confirmation transaction, you need to mine two blocks in a row. But with your system, the miner could instead just replace the latest block, which in many cases would be much easier than solving two blocks in a row (depending on the latest block's "strength").
theymos
CC BY-SA 3.0
2014-07-28T17:24:33.470Z
@StephenM347 In any case, orphans aren't much of a problem for the network, so there's no need to change things. *Miners* don't like orphans because it causes them to lose blocks or waste work, but making miners happy is not important.
theymos
CC BY-SA 3.0
2015-02-10T04:42:29.140Z
Are the extremely easy attacks you mention here limited to the time warp attack? Even if time warp attack were a non-issue, would it still be bad to compare chains based on length?
morsecoder
CC BY-SA 3.0
2015-02-10T14:33:50.907Z
@StephenM347 Time warp isn't relevant. The extremely easy attack is that it's easier to create 400,000 difficulty-1 blocks than to create 1 block at the current difficulty. So if only the number of blocks mattered (and there were no checkpoints), the current chain could be overtaken very easily.
theymos
CC BY-SA 3.0
2015-02-10T14:48:30.037Z
Well, to mine 400,000 blocks at the min difficulty you'd have to alter the timestamps to be really far in the future (assuming you can't leverage the time warp), in which case the chain wouldn't be accepted as the correct chain. I think the time warp attack is relevant because it lets you mine more blocks with the min difficulty without pushing the timestamps way off into the future. I have an open question about this [here](http://bitcoin.stackexchange.com/questions/35978/was-the-time-warp-attack-the-only-reason-it-was-not-safe-to-compare-chains-by-le).
morsecoder
CC BY-SA 3.0
2016-01-18T06:40:10.787Z
If *the "longest" chain is the one with the most work* and *two blocks in the same difficulty period always add the same amount of work to the chain* why is it wrong to simply count the blocks? What extremely easy attacks does it enable?
Vlastimil Ovčáčík
CC BY-SA 3.0
2017-02-04T04:45:10.317Z
This answer doesn't precisely define "work". The work of a block is actually defined as floor(2^256 / (target + 1)), where 'target' is the target threshold converted from the 'nBits' field of the block header. (See the GetBlockProof function in src/pow.cpp.)
Daira-Emma Hopwood
CC BY-SA 4.0
2019-04-09T13:54:53.983Z
The history was really interesting.
Jinhua Wang
CC BY-SA 3.0
2014-07-28T06:24:11.777Z
2014-07-28T17:33:08.637Z
2014-07-28T17:33:08.637Z
theymos
<p>Satoshi writes at the bottom of page 3 of his white paper that "If two nodes broadcast different versions of the next block simultaneously, some nodes may receive one or the other first. In that case, they work on the first one they received, but save the other branch in case it becomes longer." It seems here that the correct chain is the longest one, although maybe satoshi was just being a little careless with phrasing.</p>

<p>However, I have read other places that nodes choose the correct chain in Bitcoin by selecting the chain that represents the most work (or, in other words, the chain that would be hardest to undo). I'll call this the strongest chain. This is not necessarily the same as the longest chain since, for example, it is conceivable to have a block which took many more hashes to find a valid nonce than two other blocks with a much easier difficulty level. <a href="https://bitcoin.stackexchange.com/questions/5540/what-does-the-term-longest-chain-mean">This stack exchange</a> is one place that I have read this. </p>

<p><b>Question 1</b>: Which is the correct method that nodes use to determine the correct chain, longest chain or strongest chain? </p>

<p>My second question is more relevant if the answer to question 1 is that the correct chain is the strongest chain. It relates to orphaned blocks.</p>

<p>If the correct chain is the one that represents the most work then why are orphaned blocks such a problem? It seems like if a node solves a block and broadcasts it then everyone will know about it in a matter of seconds and then can start mining on the new block without any wasted work. Even if 2 miners solve a block at (near to) the same time, most blocks will see the two new blocks and choose the one with the lower header hash (because it is harder to find lower hashes). It seems that the nodes should come to a consensus in a matter of seconds then, if the correct chain is chosen by strongest (rather than longest) chain. The only time that a miner could spend working on the wrong chain would be time spent mining between receiving a solved block which is soon after replaced by a different solved block with a slightly lower hash. How long could that be, 10 sec? </p>

<p><b>Question 2</b>: Are orphaned blocks a big problem for miners? If the block generation time were 1 minute, instead, would orphaned blocks be a much bigger problem? </p>

<blockchain><blockchain-fork><best-chain><stale-block>
Strongest vs Longest chain and orphaned blocks
morsecoder
# Strongest vs Longest chain and orphaned blocks

(Asked by: username_0 on 2014-07-28)

Satoshi writes at the bottom of page 3 of his white paper that "If two nodes broadcast different versions of the next block simultaneously, some nodes may receive one or the other first. In that case, they work on the first one they received, but save the other branch in case it becomes longer." It seems here that the correct chain is the longest one, although maybe satoshi was just being a little careless with phrasing.

However, I have read other places that nodes choose the correct chain in Bitcoin by selecting the chain that represents the most work (or, in other words, the chain that would be hardest to undo). I'll call this the strongest chain. This is not necessarily the same as the longest chain since, for example, it is conceivable to have a block which took many more hashes to find a valid nonce than two other blocks with a much easier difficulty level. [This stack exchange](https://bitcoin.stackexchange.com/questions/5540/what-does-the-term-longest-chain-mean) is one place that I have read this.

**Question 1**: Which is the correct method that nodes use to determine the correct chain, longest chain or strongest chain?

My second question is more relevant if the answer to question 1 is that the correct chain is the strongest chain. It relates to orphaned blocks.

If the correct chain is the one that represents the most work then why are orphaned blocks such a problem? It seems like if a node solves a block and broadcasts it then everyone will know about it in a matter of seconds and then can start mining on the new block without any wasted work. Even if 2 miners solve a block at (near to) the same time, most blocks will see the two new blocks and choose the one with the lower header hash (because it is harder to find lower hashes). It seems that the nodes should come to a consensus in a matter of seconds then, if the correct chain is chosen by strongest (rather than longest) chain. The only time that a miner could spend working on the wrong chain would be time spent mining between receiving a solved block which is soon after replaced by a different solved block with a slightly lower hash. How long could that be, 10 sec?

**Question 2**: Are orphaned blocks a big problem for miners? If the block generation time were 1 minute, instead, would orphaned blocks be a much bigger problem?

**Tags:** blockchain, blockchain-fork, best-chain, stale-block


---

## 1 answers

### Answer by username_1 on 2014-07-28. Score: 13 | Accepted answer

The "longest" chain is the one with the most *work*. A chain's *work* is equal to the expected number of hashes it would take for someone to replicate a chain of the same number of blocks and the exact same difficulty steps. So currently each block adds about 266 work to the chain because it takes on average ~266 hashes to solve a block with the current difficulty. Blocks with less difficulty add less work. (The current total chain work is around 280.) **However, two blocks in the same difficulty period always add the same amount of work to the chain.** A block with a lower hash is not considered better than one with a higher hash.

Satoshi didn't initially realize that choosing the correct chain by just counting blocks allows for some extremely easy attacks. Version 0.1 just counted blocks. That's why the paper just says "longest". The idea of "chain work" was added a little later.

Resolving orphans as you suggest might actually make orphans more likely because miners would be incentivized in some cases to try replacing the most recent block rather than extending it, especially right before a big difficulty adjustment or when the most recent block contains a lot of fees.

Orphaned blocks happen every now and then. Eligius reports around 2% orphaned blocks. They would indeed be much more common if the target time was 1 minute since blocks would be generated faster and there would therefore be more opportunity for conflicts between blocks.

> **Comments:**
> **username_0**: Although it might make orphans more likely, wouldn't choosing the correct chain this way minimize the net effect of orphans? Because, right now, if someone gets a block broadcasted to them which will eventually not be the correct block then they will waste the whole 10 minutes mining that block until the next block is solved. It seems like the network would come to a consensus more quickly and only mine on the correct blocks.  
> **username_0**: As to miners trying to undo blocks, it seems like rational miners wouldn't do this most of the time. Every nonce is like a lottery ticket and if they see that a new block is out, I can't see why they would keep spending their lottery tickets on mining on top of the old block rather than the new one which is more likely to be accepted. In those two cases that you mentioned, I can see why they might try to undo the most recent block (although, the fees don't really seem to be enough incentive now), but those seem like exceptions rather than the rule for what would happen.  
> **username_1**: @StephenM347 Your system would also make double-spends by powerful miners easier. Currently, if you have some decent chunk of the mining power and you want to reverse a 1-confirmation transaction, you need to mine two blocks in a row. But with your system, the miner could instead just replace the latest block, which in many cases would be much easier than solving two blocks in a row (depending on the latest block's "strength").  
> **username_1**: @StephenM347 In any case, orphans aren't much of a problem for the network, so there's no need to change things. *Miners* don't like orphans because it causes them to lose blocks or waste work, but making miners happy is not important.  
> **username_0**: Are the extremely easy attacks you mention here limited to the time warp attack? Even if time warp attack were a non-issue, would it still be bad to compare chains based on length?  
> **username_1**: @StephenM347 Time warp isn't relevant. The extremely easy attack is that it's easier to create 400,000 difficulty-1 blocks than to create 1 block at the current difficulty. So if only the number of blocks mattered (and there were no checkpoints), the current chain could be overtaken very easily.  
> **username_0**: Well, to mine 400,000 blocks at the min difficulty you'd have to alter the timestamps to be really far in the future (assuming you can't leverage the time warp), in which case the chain wouldn't be accepted as the correct chain. I think the time warp attack is relevant because it lets you mine more blocks with the min difficulty without pushing the timestamps way off into the future. I have an open question about this [here](http://bitcoin.stackexchange.com/questions/35978/was-the-time-warp-attack-the-only-reason-it-was-not-safe-to-compare-chains-by-le).  
> **username_2**: If *the "longest" chain is the one with the most work* and *two blocks in the same difficulty period always add the same amount of work to the chain* why is it wrong to simply count the blocks? What extremely easy attacks does it enable?  
> **username_3**: This answer doesn't precisely define "work". The work of a block is actually defined as floor(2^256 / (target + 1)), where 'target' is the target threshold converted from the 'nBits' field of the block header. (See the GetBlockProof function in src/pow.cpp.)  
> **username_4**: The history was really interesting.  

---

