<p>The Bitcoin blockchain has probabilistic finality. Theoretically, the best chaintip could be replaced in a reorganization to different chaintip, but the proof-of-work necessary to produce such a competing chaintip massively increases with the depth of the reorganization.</p>
<p>The <a href="https://bitcoin.stackexchange.com/a/92981/5406">longest reorganizations</a> ever seen on the network were 53 blocks due to the value overflow incident in 2010, and 24 blocks in response to the March-2013 chain fork.</p>
<p>The longest reorganization that occurred due to miners naturally finding competing blocks had a depth of four blocks —in April 2012. Since then, relay on the network has been immensely improved which has caused the occurrence of chain reorganizations to drop steeply. As far as I am aware, there have been no reorganizations with a depth of greater than one in <a href="https://bitcoin.stackexchange.com/a/97197/5406">several years</a>.</p>
<p>So, while there is never an absolute finality in Bitcoin, even a few blocks depth appear to be quite reliable.</p>
<p>Now, it would be certainly possible to have a rolling finality following the chaintip by some count of blocks. But as Pieter explains on <a href="https://bitcoin.stackexchange.com/a/75735/5406">Why does Bitcoin no longer have checkpoint?</a>, that depth would either be so large that it wouldn't prevent catastrophic attacks—a roll back of more than a day would certainly shake the trust in Bitcoin—,or so small, that it might impact naturally occurring reorganizations and change the security model of Bitcoin.</p>
<p>If we take a look beyond Bitcoin, we'll notice that e.g. some minority-hashrate forkcoins of Bitcoin have chosen to introduce rolling checkpoints. For example in BCH, nodes do not permit reorganizing further than ten blocks. While Bitcoin's central security assumption is that the majority of the hashrate is honest (as in, not colluding to attack), BCH cannot rely on that assumption given that is only attracting about 0.63% of the SHA-256d hashrate.</p>
<p><a href="https://i.sstatic.net/IIA6v.png" rel="noreferrer"><img src="https://i.sstatic.net/IIA6v.png" alt="Statistics on the hashrate distribution across a few SHA-256d based blockchains" /></a><br />
<sup>via <a href="https://coin.dance/" rel="noreferrer">coin.dance</a></sup></p>
<p>Presumably, the rolling checkpoint is an attempt at a new security model that permits an assumption of finality. Since a majority attack cannot be prevented, it has been replaced with social consensus that ten confirmations somehow indicate finality, and if the network were attacked, someone would somehow convince the remaining users to converge on a particular chaintip and prevent subsequent attacks. This is not a very interesting security model.</p>

CC BY-SA 4.0
2022-01-15T19:24:53.873Z
2022-01-15T19:45:35.350Z
2022-01-15T19:45:35.350Z
Murch
<p>My understanding is that finality is just a rule in the consensus which says any block that gets buried X block deep will be considered unchangeable by the consensus. This has nothing to do with proof of stake, BFT, or any specific consensus mechanism.</p>
<p>So if my understanding is correct is it possible to have a proof work chain that has finality?
If so, is there a proof of work chain out there that has a concept of finality?</p>

<proof-of-work><chain-reorganization>
Can a proof of work chain have finality?
Kyrielight
# Can a proof of work chain have finality?

(Asked by: username_0 on 2022-01-15)

My understanding is that finality is just a rule in the consensus which says any block that gets buried X block deep will be considered unchangeable by the consensus. This has nothing to do with proof of stake, BFT, or any specific consensus mechanism.

So if my understanding is correct is it possible to have a proof work chain that has finality?
If so, is there a proof of work chain out there that has a concept of finality?

**Tags:** proof-of-work, chain-reorganization


---

## 1 answers

### Answer by username_1 on 2022-01-15. Score: 5

The Bitcoin blockchain has probabilistic finality. Theoretically, the best chaintip could be replaced in a reorganization to different chaintip, but the proof-of-work necessary to produce such a competing chaintip massively increases with the depth of the reorganization.

The [longest reorganizations](https://bitcoin.stackexchange.com/a/92981/5406) ever seen on the network were 53 blocks due to the value overflow incident in 2010, and 24 blocks in response to the March-2013 chain fork.

The longest reorganization that occurred due to miners naturally finding competing blocks had a depth of four blocks —in April 2012. Since then, relay on the network has been immensely improved which has caused the occurrence of chain reorganizations to drop steeply. As far as I am aware, there have been no reorganizations with a depth of greater than one in [several years](https://bitcoin.stackexchange.com/a/97197/5406).

So, while there is never an absolute finality in Bitcoin, even a few blocks depth appear to be quite reliable.

Now, it would be certainly possible to have a rolling finality following the chaintip by some count of blocks. But as Pieter explains on [Why does Bitcoin no longer have checkpoint?](https://bitcoin.stackexchange.com/a/75735/5406), that depth would either be so large that it wouldn't prevent catastrophic attacks—a roll back of more than a day would certainly shake the trust in Bitcoin—,or so small, that it might impact naturally occurring reorganizations and change the security model of Bitcoin.

If we take a look beyond Bitcoin, we'll notice that e.g. some minority-hashrate forkcoins of Bitcoin have chosen to introduce rolling checkpoints. For example in BCH, nodes do not permit reorganizing further than ten blocks. While Bitcoin's central security assumption is that the majority of the hashrate is honest (as in, not colluding to attack), BCH cannot rely on that assumption given that is only attracting about 0.63% of the SHA-256d hashrate.

[![Statistics on the hashrate distribution across a few SHA-256d based blockchains](https://i.sstatic.net/IIA6v.png)](https://i.sstatic.net/IIA6v.png)  
via [coin.dance](https://coin.dance/)

Presumably, the rolling checkpoint is an attempt at a new security model that permits an assumption of finality. Since a majority attack cannot be prevented, it has been replaced with social consensus that ten confirmations somehow indicate finality, and if the network were attacked, someone would somehow convince the remaining users to converge on a particular chaintip and prevent subsequent attacks. This is not a very interesting security model.


---

