Commons license.

Your support will help MIT OpenCourseWare

continue to offer high-quality, educational resources for free.

To make a donation or to view additional materials

from hundreds of MIT courses, visit MIT OpenCourseWare

at ocw.mit.edu.

NEHA NARULA: Welcome back.

Today, we are going to talk about forks.

So I think you guys have had a guest lecture last week

from Alin Tomescu, who talked about his project, Catena.

And one of the really interesting things about Catena

is that he's trying to prevent a server from equivocating.

So he's trying to keep a server from being

able to say one answer to some people and another answer

to another person.

That's kind of the goal of this whole blockchain thing.

But there's actually something really complex

that happens when we start to change what's

happening in the network, and we start

to change the software that's happening in the network.

And so this lecture is going to be about forks.

And I want you guys to feel free to raise your hands

and ask questions during class, because this stuff is actually

kind of non-intuitive sometimes.

So a blockchain is a chain of blocks which have previous hash

pointers inside of them.

So a question-- can a block point to two previous blocks

at the same time?

Anybody know the answer to this question?

No, exactly, that is the whole point.

There is exactly one spot in the block header

for a previous hash block.

And so a block can only point to one previous block.

A single block cannot point to two previous blocks.

However, can this happen?

Can two different blocks point to the same previous block

header?

Yes, yes, and this happens all the time.

Now, part of the reason that this happens all the time

is because the way that blocks are

found in the bitcoin network is completely probabilistic.

There are many people who are trying

to find the next block at the same time.

And it's entirely possible that two different miners

will get lucky in a time period that

is within the time it takes for a block to get gossipped

around the network.

And so, totally, two people can find the same block

at the same time.

This is actually what's known as a fork.

And you can kind of see why.

We have a fork in the chain right here.

But what does it really mean when

there's a fork in the chain?

I just told you that this is something

that happens all the time.

And these cryptocurrency networks seem to keep running.

They seem to be keep going.

So perhaps it's not as bad as it seems,

even though it seems to be violating

one of the major tenets of what a blockchain is.

Well, it is kind of bad, actually,

because when you have these two blocks here,

is there anything that makes one the right blockchain

over the other blockchain?

Just if this is one blockchain right here,

and this is another blockchain right there,

how is one supposed to distinguish between this?

Yeah?

AUDIENCE: The one with the most work.

NEHA NARULA: The one with the most work,

OK, that's a great sort of way of thinking about it.

What if they have similar amounts of proof of work.

Then what?

AUDIENCE: The one that's accepted

by the majority of the network.

NEHA NARULA: The one that's accepted

by the majority of the network.

How do we know which one is accepted

by the majority of the network?

It gets extended, OK, great.

So that's a really good way of looking at it.

Before we go into what that means,

do people understand why if this state were to persist

it would be a really bad situation?

One thing that we could have, given

that there's two blocks, what that really means

is that we have two versions of history.

We have two versions of the ledger

if these two things are not the same.

Different coins might be spent on one side of the fork,

versus on the other side of the fork.

In fact, the same coin might be spent in two different people

on either sides of these forks.

And so over here, Alice might be spending her coin to Bob.

Over here, Alex might be spending that same coin--

and, remember, coins can only be spent once.

Even if Alice has other coins, she

specifies which coin she's spending.

Alice might spend that coin over to Carol.

And so if Bob sees this, he thinks he got paid.

If Carol sees this, she thinks she got paid.

And we violated one of the fundamental tenets

of the blockchain, which is not to double spend coins.

You can't create money out of nowhere.

If these two things would persist,

if we don't resolve this fork somehow,

then we literally have two different versions

of the same currency.

This is kind of as though I took the money

in my pocket, my dollar bill, and I xeroxed them all,

and managed to convince some people that the Xerox was also

real.

This is the exact same thing as what's

happening when you have these two things persist.

OK, so how do we fix it?

Well, which is the right one?

And just given what I've shown you right here,

it is not clear which is the right one.

And like I also said, this happens all the time

in the bitcoin network because the bitcoin network

is probabilistic.

So the way that people figure out which one is the right one

is they wait.

They wait and see which side gets extended.

And by the nature of probability,

one side is going to eventually win out, and get extended

more often than the other side.

It's very unlikely for two forks to randomly sort

of probabilistically exist at roughly the same way

for the same amount of time for very long.

Now, as someone said, you might look at this.

How do you distinguish between these two things?

There is this common idea that in blockchains we

take the longest chain.

Longest is a little bit misleading actually.

It's not the longest chain.

It's the heaviest work chain.

So we pick the chain that has the most proof of work

on it, even if that happens to have

a smaller number of blocks.

Usually that's not the case.

That's not what happens.

The reason for that-- does anyone

know why we take the heaviest chain instead of the longest

chain?

AUDIENCE: So that nobody can cheat and lower

the level of difficulty.

NEHA NARULA: Right, so it's not very easy to do this.

But over time, someone could slowly

decrease difficulty level, and then

create a nice, really long chain with many low difficulty

blocks, and then say, hey, I've got the longest chain.

I have the most number of blocks.

Despite the fact that your chain has more proof of work on it,

you should all take my chain.

And they could do that with less than a majority

of the hash power.

Now, this is not easy attack to do.

But it is a possible attack.

And so that's why we take the heaviest chain, which

represents the most hash power in the system, the majority

of the system.

So forks happen all the time.

Forks are normal.

The way that people who see forks decide

which side of the fork to use, is they

check and see which one has the most proof of work,

the heaviest proof of work.

Now, one thing that's kind of cool,

is, as you probably learned about two classes ago,

even SPV nodes, even clients, can

tell which chain has the most proof of work

simply by looking at the headers, the block headers.

They can see what the difficulty is.

And they can measure for themselves

which side of the chain has the most proof of work.

They don't even need all of the chain.

So this is a nice property of light clients,

is that they can download all of the block headers

and immediately tell which side of a fork

has the most proof of work.

Great, we call the block that ends up-- so what

do we do with this block?

Does anyone know what actually happens with this block?

Anybody?

OK, so this book is basically abandoned.

This block is just left.

It exists.

It points into the chain.

That's great.

In bitcoin, in particular, it's meaningless.

It doesn't mean anything.

Every transaction that was in that block

is not considered to have happened.

So those transactions need to be replayed

on the chain that ends up being the longest chain.

And this happens, like I said, all the time.

We call that block an orphan, because it doesn't have anyone.

It's kind of the wrong way around.

I mean, I think of this as a child.

But, whatever, this block doesn't have a parent.

But we call those blocks orphans.

And, again, remember, we pick the side

of the chain that ends up having the most proof of work.

Now, we draw these figures in two different ways.

Sometimes we draw the figures like this,

like there's this blockchain that exists out there,

that is written down, and that everyone is sort of looking at.

There's one blockchain.

But this isn't a logical representation.

In reality, there are many, many, many, many different

blockchains.

In fact, every node in the system

has its own version of the blockchain.

And it's what those nodes are doing together

that ends up deciding what the blockchain actually is.

So if these are nodes that are running the bitcoin protocol,

and when I say nodes, what's the difference

between a miner and a node?

AUDIENCE: Nodes verify transactions,

but miners push blocks.

NEHA NARULA: Exactly, so miners actually

create blocks in the system.

Miners have write access to the blockchain.

They actually produce new blocks.

People think a lot about what the miners are,

and what the miners can do.

And there's a lot of game theory thinking about the miners.

And, oh, what if they collude, but the hash power does this?

And sometimes we forget that nodes in the bitcoin network

are actually incredibly important too,

because it's the nodes in the bitcoin network

that are now creating blocks.

And, to be clear, someone could be a miner

and a node at the same time.

They're distinct roles.

The same entity could certainly run a node and be a miner.

But nodes are doing something really important

as well, which is they're reading all of the blocks.

And they're deciding which side of a fork to take,

and which blocks to accept and which blocks not to accept.

So let's say that these are all bitcoin nodes.

And this is what the blockchain looks like right now.

And we've used this figure multiple times.