Placeholder Image

Subtitles section Play video

  • The following content is provided under a Creative

  • Commons license.

  • Your support will help MIT OpenCourseWare

  • continue to offer high-quality, educational resources for free.

  • To make a donation or to view additional materials

  • from hundreds of MIT courses, visit MIT OpenCourseWare

  • at ocw.mit.edu.

  • NEHA NARULA: Welcome back.

  • Today, we are going to talk about forks.

  • So I think you guys have had a guest lecture last week

  • from Alin Tomescu, who talked about his project, Catena.

  • And one of the really interesting things about Catena

  • is that he's trying to prevent a server from equivocating.

  • So he's trying to keep a server from being

  • able to say one answer to some people and another answer

  • to another person.

  • That's kind of the goal of this whole blockchain thing.

  • But there's actually something really complex

  • that happens when we start to change what's

  • happening in the network, and we start

  • to change the software that's happening in the network.

  • And so this lecture is going to be about forks.

  • And I want you guys to feel free to raise your hands

  • and ask questions during class, because this stuff is actually

  • kind of non-intuitive sometimes.

  • So a blockchain is a chain of blocks which have previous hash

  • pointers inside of them.

  • So a question-- can a block point to two previous blocks

  • at the same time?

  • Anybody know the answer to this question?

  • No, exactly, that is the whole point.

  • There is exactly one spot in the block header

  • for a previous hash block.

  • And so a block can only point to one previous block.

  • A single block cannot point to two previous blocks.

  • However, can this happen?

  • Can two different blocks point to the same previous block

  • header?

  • Yes, yes, and this happens all the time.

  • Now, part of the reason that this happens all the time

  • is because the way that blocks are

  • found in the bitcoin network is completely probabilistic.

  • There are many people who are trying

  • to find the next block at the same time.

  • And it's entirely possible that two different miners

  • will get lucky in a time period that

  • is within the time it takes for a block to get gossipped

  • around the network.

  • And so, totally, two people can find the same block

  • at the same time.

  • This is actually what's known as a fork.

  • And you can kind of see why.

  • We have a fork in the chain right here.

  • But what does it really mean when

  • there's a fork in the chain?

  • I just told you that this is something

  • that happens all the time.

  • And these cryptocurrency networks seem to keep running.

  • They seem to be keep going.

  • So perhaps it's not as bad as it seems,

  • even though it seems to be violating

  • one of the major tenets of what a blockchain is.

  • Well, it is kind of bad, actually,

  • because when you have these two blocks here,

  • is there anything that makes one the right blockchain

  • over the other blockchain?

  • Just if this is one blockchain right here,

  • and this is another blockchain right there,

  • how is one supposed to distinguish between this?

  • Yeah?

  • AUDIENCE: The one with the most work.

  • NEHA NARULA: The one with the most work,

  • OK, that's a great sort of way of thinking about it.

  • What if they have similar amounts of proof of work.

  • Then what?

  • AUDIENCE: The one that's accepted

  • by the majority of the network.

  • NEHA NARULA: The one that's accepted

  • by the majority of the network.

  • How do we know which one is accepted

  • by the majority of the network?

  • It gets extended, OK, great.

  • So that's a really good way of looking at it.

  • Before we go into what that means,

  • do people understand why if this state were to persist

  • it would be a really bad situation?

  • One thing that we could have, given

  • that there's two blocks, what that really means

  • is that we have two versions of history.

  • We have two versions of the ledger

  • if these two things are not the same.

  • Different coins might be spent on one side of the fork,

  • versus on the other side of the fork.

  • In fact, the same coin might be spent in two different people

  • on either sides of these forks.

  • And so over here, Alice might be spending her coin to Bob.

  • Over here, Alex might be spending that same coin--

  • and, remember, coins can only be spent once.

  • Even if Alice has other coins, she

  • specifies which coin she's spending.

  • Alice might spend that coin over to Carol.

  • And so if Bob sees this, he thinks he got paid.

  • If Carol sees this, she thinks she got paid.

  • And we violated one of the fundamental tenets

  • of the blockchain, which is not to double spend coins.

  • You can't create money out of nowhere.

  • If these two things would persist,

  • if we don't resolve this fork somehow,

  • then we literally have two different versions

  • of the same currency.

  • This is kind of as though I took the money

  • in my pocket, my dollar bill, and I xeroxed them all,

  • and managed to convince some people that the Xerox was also

  • real.

  • This is the exact same thing as what's

  • happening when you have these two things persist.

  • OK, so how do we fix it?

  • Well, which is the right one?

  • And just given what I've shown you right here,

  • it is not clear which is the right one.

  • And like I also said, this happens all the time

  • in the bitcoin network because the bitcoin network

  • is probabilistic.

  • So the way that people figure out which one is the right one

  • is they wait.

  • They wait and see which side gets extended.

  • And by the nature of probability,

  • one side is going to eventually win out, and get extended

  • more often than the other side.

  • It's very unlikely for two forks to randomly sort

  • of probabilistically exist at roughly the same way

  • for the same amount of time for very long.

  • Now, as someone said, you might look at this.

  • How do you distinguish between these two things?

  • There is this common idea that in blockchains we

  • take the longest chain.

  • Longest is a little bit misleading actually.

  • It's not the longest chain.

  • It's the heaviest work chain.

  • So we pick the chain that has the most proof of work

  • on it, even if that happens to have

  • a smaller number of blocks.

  • Usually that's not the case.

  • That's not what happens.

  • The reason for that-- does anyone

  • know why we take the heaviest chain instead of the longest

  • chain?

  • AUDIENCE: So that nobody can cheat and lower

  • the level of difficulty.

  • NEHA NARULA: Right, so it's not very easy to do this.

  • But over time, someone could slowly

  • decrease difficulty level, and then

  • create a nice, really long chain with many low difficulty

  • blocks, and then say, hey, I've got the longest chain.

  • I have the most number of blocks.

  • Despite the fact that your chain has more proof of work on it,

  • you should all take my chain.

  • And they could do that with less than a majority

  • of the hash power.

  • Now, this is not easy attack to do.

  • But it is a possible attack.

  • And so that's why we take the heaviest chain, which

  • represents the most hash power in the system, the majority

  • of the system.

  • So forks happen all the time.

  • Forks are normal.

  • The way that people who see forks decide

  • which side of the fork to use, is they

  • check and see which one has the most proof of work,

  • the heaviest proof of work.

  • Now, one thing that's kind of cool,

  • is, as you probably learned about two classes ago,

  • even SPV nodes, even clients, can

  • tell which chain has the most proof of work