4

I more or less understand how an attacker (with less than 50%+1 of the hashing power) can artificially lower the block difficulty by messing with timestamps. I also understand how such an attacker could, on his own chain, at one point "ramp up" the difficulty of his last blocks to match the current chain's difficulty (I've read the other questions containing the time-warp-attack tag). What I don't understand is how at one point his chain, with less total chainwork, can be accepted by the network.

Say we're at block 100 on the honest chain and an attacker crafted a fake chain starting from block 50. He's now at block 105 and his block 105 has the same difficulty (that he ramped up) as the honest's chain 's block 100. He decides to broadcast his chain and he "wins" because he succeeded with his time warp attack (the question here is not about the feasability, budget-wise, of pulling such an attack today on the Bitcoin network: it's about the technical aspect of the attack).

What I don't get is that the honest chain has more total chainwork from block 50 to 100 than the total chainwork on the attacker's chain from block 50 to 105. The attacker, in the case of a time warp attack, has less than 50%+1 of the hashrate. So it's impossible for him to come up with x blocks that have more total PoW than the y blocks that the honest majority have mined meanwhile (even if he has more blocks, without 50%+1 he simply cannot have more chainwork than the honest majority).

So how comes that this re-org is accepted by the clients? When there's a re-org of the chain of several blocks, ain't the total chainwork of both chains compared?

4

When there's a re-org of the chain of several blocks, isn't the total chainwork of both chains compared?

Yes, that's true. In fact, that's how a reorg of any size is considered. However, that wasn't always the case. In the first version of Bitcoin, the client compared purely by chain height. In version 0.3.3 (released July 2010) we switched to comparing by chain work. Today, you can't pull off a timewarp attack without a majority of hashpower.

However, let's say that you did have a majority of hashpower. What could you do with a time warp attack? You could mint an arbitrary number of blocks, and get more mining reward than you're entitled to. You could prevent the timestamp from advancing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.