Was the time warp attack the only reason it was not safe to compare chains by length?

Question

One of the weaknesses of bitcoin listed on that wiki is that it was once vulnerable to the time warp attack. This attack lets a miner with >50% of the hash power to solve many more blocks in a short amount of time, essentially gaining a higher than appropriate reward. It can also be used to create a chain that is extremely long very quickly while keeping the difficulty low.

Was the time warp attack the only reason it was not safe to compare chains by length? Asked a different way, if the time warp bug was fixed in bitcoin, would comparing chains by length always produce the same result as comparing by work done?

Relevant: Theymos suggests in this answer:

Satoshi didn't initially realize that choosing the correct chain by just counting blocks allows for some extremely easy attacks. Version 0.1 just counted blocks. That's why the paper just says "longest". The idea of "chain work" was added a little later.

Answer 1

If the time warp bug was fixed in bitcoin, would comparing chains by length always produce the same result as comparing by work done?

No. It's easy to create a chain with more chainwork but fewer blocks. For example, lets say we have a chain with 2,016 difficulty 1 blocks. This chain is created in 20,160 minutes so the difficulty doesn't change next period, meaning that by block 4,032 we have 4032diff chainwork:

  2016 *  diff1 == 2016diff
+ 2016 *  diff1 == 2016diff
--------------------------
  4032 blocks with 4032diff

Then somebody mines an alternative chain with mining equipment that's 4 times faster, producing the first 2,016 blocks in 5,040 minutes. Difficulty increases to 4 and by block 2,521 this chain has more chain work but less blocks than the first-described chain.

  2016 *  diff1 == 2016diff
+  505 *  diff4 == 2020diff
--------------------------
  2521 blocks with 4036diff

I assume you're more interested in practical attacks against Bitcoin's mainnet chain if that chain still used longest-is-best logic. Here's an easy one:

• The Genesis Block is dated 3 January 2009. If you mined only difficulty 1 blocks from then until now (144 blocks a day), you'd have about (144*365*6)+(30*144)==319680 blocks.

• The "real" block chain has 342,908 blocks, a 23,228 block difference.

• Because difficulty can only increase 4x in a single 2,016-block period, mining 23,228 blocks would only requiring going from difficulty 1 to difficulty 4**(23228 / 2016) == 4194304.

• Although difficulty 4,194,304 sounds high. Current mainnet difficulty is 44,455,415,962. So, if I did my math right, you can create a chain longer than mainnet with roughly 0.001% of the current network hashrate.