Forks, finality & the longest-chain rule

Chain A is canonical right now — it simply has more blocks.

Extend either chain and watch the "canonical" tag jump to whichever fork is longer. There's no vote, no authority deciding — the rule is mechanical: more blocks wins, full stop. A fork that falls behind doesn't get argued away; it just stops being extended, because no rational miner keeps building on the losing side.

1. A fork is just two chains sharing a prefix

   Both Chain A and Chain B in this chapter start from the same genesis block, then diverge — each new block hashes in the previous block's hash, so a fork is nothing more than two different sequences of blocks after the split point.

2. The longest chain is canonical

   $\text{longestChain}(\{\text{chains}\}) = \arg\max_c \; \text{length}(c)$ (ties have no winner yet). Real chains compare cumulative proof-of-work, not raw block count, but with one difficulty target shared by everyone, the two are the same thing.

3. Finality is a probability, not a guarantee

   A block already has $z$ confirmations once $z$ further blocks are built on top of it. An attacker controlling a fraction $q$ of the network's power can still try to grow a secret, longer fork in secret and replace it — but the odds fall off fast as $z$ grows.

4. The reversal probability shrinks exponentially in confirmations

   $P_{\text{reverse}}(z) = \left(\dfrac{q}{1-q}\right)^{z}$ — every additional confirmation multiplies the attacker's chances by the same ratio $q/(1-q)$, which is less than 1 whenever the attacker controls a minority ($q < 0.5$) of the network.

• $z$ — confirmations: how many blocks are stacked on top of the one in question.
• $q$ — the attacker's share of total mining power; $q/(1-q)$ is the ratio the probability shrinks by per confirmation.

Drag right to add confirmations. With an attacker holding 20% of the network's power, each additional confirmation multiplies their odds of catching up by another factor of 0.25 — finality is never absolute, just increasingly unlikely to fail.

Drag along the curve to add confirmations and watch the reversal probability collapse. This is why "wait for N confirmations" is a real, if informal, security parameter: N isn't chosen because reversal becomes impossible, but because it becomes vanishingly, practically impossible.

Chain A: 3 blocks (a1→216, a2→14, a3→883). Chain B: 2 blocks (b1→247, b2→399). Attacker share $q=0.2$.

1. Which chain is canonical right now

   $\text{length}(A)=3 > \text{length}(B)=2$, so Chain A is canonical — even though Chain B's blocks are individually just as validly hashed.

2. Chain B catches up and passes

   If Chain B mines two more blocks (length 4), the rule flips: $4 > 3$ means Chain B is now canonical, and every honest node that was building on Chain A discards those blocks and switches.

3. Reversal probability at z = 2 confirmations

   $\left(\dfrac{0.2}{0.8}\right)^{2} = 0.25^{2} = 0.0625$ — a 1-in-16 chance the attacker still catches up, still too risky to treat as final.

4. Reversal probability at z = 3 confirmations

   $0.25^{3} = 0.015625$ — this is the first depth where the probability drops under this chapter's finality threshold of $0.02$. Two confirmations weren't enough; three are.