<p>The "apparent" work is 2x higher than actual work due to luck, but the reason it's good bitcoin doesn't use the apparent work is because it has bad stability properties due to variance, and bad game theory interactions.</p>

<p>Imagine Bitcoin were worked the way you suggested-- Say, for example, you mine a block and by chance it has 10x the 'work' expected.  It would be best for you to not announce that block but instead continue to try to extend it in private. If the publicly disclosed work starts getting close to your lucky block, then you announce it. This is a pretty bad incentive.</p>

<p>The extreme of this is that you start trying to mine at block 1, and hope by luck to end up with enough "apparent work" to wipe out the whole chain. </p>

<p>So under this model the probability of successfully reorging off a static chunk through pure luck doesn't go down with more blocks.</p>

CC BY-SA 4.0
2018-12-12T21:38:40.043Z
2018-12-12T21:38:40.043Z
G. Maxwell
<p><em>Background info:</em></p>

<p>The block hash must be less than a certain value (as defined by the difficulty function) in order for the block to be valid. </p>

<p>Generally, as time has progressed, network difficulty has increased. So as the blockheight has increased, the cutoff value for a valid blockhash has decreased. </p>

<p>—————</p>

<blockquote>
  <p>Why not just e.g. add together all block hashes (as bigints) and consider the longest chain to be the one with the biggest or smallest sum?</p>
</blockquote>

<p>I think it may be easiest to explain why this sort of implementation is broken by giving an example. Let’s consider a system following the ‘smallest sum for a given blockheight’ rule:</p>

<p>—————</p>

<p>For simplicity, let’s imagine a pow function that has an output value range of 1-100. Let’s say the network difficulty is currently set so that any output of 10 or less is valid. </p>

<p>Now, miner A finds a block at height X, with blockhash 10. This is valid, and so it is added to the chain. </p>

<p>Miner B sees this, but continues to mine blockheight X, because if they can find a block with hash 9 or less, then their new chain will replace the previously accepted one. By forcing a reorganization this way, they may be able to successfully commit a double spend attack, etc. </p>

<p>—————</p>

<p>This example shows how a miner could game the algorithm to rewrite the blockchain. The same is true for a ‘largest sum for a given blockheight’ rule: if a miner finds a small blockhash (eg. Blockhash = 5 in the example above), another miner could profit by continuing to mine on the older block, forcing a reorganization if they find a block with a larger, but still valid, blockhash. </p>

<p>For the bitcoin network to function properly, the game theory needs to incentivize miners to <em>always</em> mine at the chain tip. Using a difficulty function instead of the explicit blockhash value helps ‘level the playing field’, so to speak. This is because <strong>any valid blockhash is no better or worse than any other valid blockhash.</strong></p>

CC BY-SA 4.0
2018-07-24T18:53:01.283Z
This makes sense but I'm still unclear about something. Let's say the network splits briefly and both sides mine two new blocks with hashes that meet the difficulty target. When the network re-merges who wins?
Adam Ierymenko
CC BY-SA 4.0
2018-07-25T01:16:14.177Z
They will not ‘remerge’ until one chain is extended further than the other. The winner will be the chain that is extended further. The ‘losing’ side of the network will reorganize those two blocks to join the longest chain. Look up ‘orphan blocks’ to learn more. In practice it is quite rare for an orphan block chain to be deeper than one block.
chytrik
CC BY-SA 4.0
2018-07-20T14:56:43.633Z
2018-07-21T01:05:05.947Z
2018-07-21T01:05:05.947Z
chytrik
<p>Why does Bitcoin apply a difficulty function to block hashes and then use the output of this function to add up and determine the "longest" chain?</p>

<p>Why not just e.g. add together all block hashes (as bigints) and consider the longest chain to be the one with the biggest or smallest sum?</p>

<p>Is there some mathematical reason for this or is it just a performance optimization or a way of avoiding excessive dependence on big integer arithmetic?</p>

<blockchain><mining-theory><difficulty><best-chain>
Why aren't block hashes used directly as scores for difficulty purposes?
Adam Ierymenko
# Why aren't block hashes used directly as scores for difficulty purposes?

(Asked by: username_0 on 2018-07-20)

Why does Bitcoin apply a difficulty function to block hashes and then use the output of this function to add up and determine the "longest" chain?

Why not just e.g. add together all block hashes (as bigints) and consider the longest chain to be the one with the biggest or smallest sum?

Is there some mathematical reason for this or is it just a performance optimization or a way of avoiding excessive dependence on big integer arithmetic?

**Tags:** blockchain, mining-theory, difficulty, best-chain


---

## 2 answers

### Answer by username_2 on 2018-07-20. Score: 6 | Accepted answer

*Background info:*

The block hash must be less than a certain value (as defined by the difficulty function) in order for the block to be valid.

Generally, as time has progressed, network difficulty has increased. So as the blockheight has increased, the cutoff value for a valid blockhash has decreased.

—————

> Why not just e.g. add together all block hashes (as bigints) and consider the longest chain to be the one with the biggest or smallest sum?

I think it may be easiest to explain why this sort of implementation is broken by giving an example. Let’s consider a system following the ‘smallest sum for a given blockheight’ rule:

—————

For simplicity, let’s imagine a pow function that has an output value range of 1-100. Let’s say the network difficulty is currently set so that any output of 10 or less is valid.

Now, miner A finds a block at height X, with blockhash 10. This is valid, and so it is added to the chain.

Miner B sees this, but continues to mine blockheight X, because if they can find a block with hash 9 or less, then their new chain will replace the previously accepted one. By forcing a reorganization this way, they may be able to successfully commit a double spend attack, etc.

—————

This example shows how a miner could game the algorithm to rewrite the blockchain. The same is true for a ‘largest sum for a given blockheight’ rule: if a miner finds a small blockhash (eg. Blockhash = 5 in the example above), another miner could profit by continuing to mine on the older block, forcing a reorganization if they find a block with a larger, but still valid, blockhash.

For the bitcoin network to function properly, the game theory needs to incentivize miners to *always* mine at the chain tip. Using a difficulty function instead of the explicit blockhash value helps ‘level the playing field’, so to speak. This is because **any valid blockhash is no better or worse than any other valid blockhash.**

> **Comments:**
> **username_0**: This makes sense but I'm still unclear about something. Let's say the network splits briefly and both sides mine two new blocks with hashes that meet the difficulty target. When the network re-merges who wins?  
> **username_2**: They will not ‘remerge’ until one chain is extended further than the other. The winner will be the chain that is extended further. The ‘losing’ side of the network will reorganize those two blocks to join the longest chain. Look up ‘orphan blocks’ to learn more. In practice it is quite rare for an orphan block chain to be deeper than one block.  

---

### Answer by username_1 on 2018-12-12. Score: 7

The "apparent" work is 2x higher than actual work due to luck, but the reason it's good bitcoin doesn't use the apparent work is because it has bad stability properties due to variance, and bad game theory interactions.

Imagine Bitcoin were worked the way you suggested-- Say, for example, you mine a block and by chance it has 10x the 'work' expected. It would be best for you to not announce that block but instead continue to try to extend it in private. If the publicly disclosed work starts getting close to your lucky block, then you announce it. This is a pretty bad incentive.

The extreme of this is that you start trying to mine at block 1, and hope by luck to end up with enough "apparent work" to wipe out the whole chain.

So under this model the probability of successfully reorging off a static chunk through pure luck doesn't go down with more blocks.


---

