IV Consensus Guide: Nakamoto consensus: the double-spend race, the arithmetic of confirmations, and the deployed most-work rule 1 Scope, sources, and the two double-spends 3 A probability toolkit

2 The block tree and the most-work rule

Zcash transactions are grouped into blocks, and every block names its parent by including the parent header’s hash (Crypto Guide, §“Hash functions and the random oracle model”); the genesis block alone has no parent. Blocks therefore form a tree rooted at genesis, and each root-to-leaf path — each branch — is one internally consistent version of history. Branches need not be consistent with one another: one branch can contain a transaction that conflicts with a transaction in a sibling branch, and that freedom is exactly the attack surface this volume quantifies.

2.1 Work, and the best chain

A single coherent history requires a rule every node can apply locally and use to converge once one valid branch is strictly preferred. The rule is not simply “longest”: it weighs each block by the computational effort represented by its header target.

Definition 2.1 (Work of a block).

Let $\mathsf{ToTarget}$ be the conversion from the header’s nBits field to its 256-bit target threshold (specification §7.7.4). The work of a block is

\mathsf{work}\;=\;\left\lfloor\frac{2^{256}}{\mathsf{ToTarget}(\texttt{nBits})% +1}\right\rfloor

(specification §7.7.5, “Definition of Work”). A lower target admits fewer valid headers, so a block meeting it certifies proportionally more expected hashing; work is that certificate made additive.

The deployed Zebra validator computes this quantity with a 256-bit in-word trick: zebra evaluates (!expanded.0 / (expanded.0 + 1)) + 1; the retired zcashd computed the identical expression on arith_uint256, with ~ spelling the complement. The form agrees with Definition 2.1 exactly: writing $t$ for the target and $A=2^{256}$ , the complement is $\lnot t=A-1-t$ , and

\displaystyle\left\lfloor\frac{A-1-t}{t+1}\right\rfloor+1=\left\lfloor\frac{A-% (t+1)}{t+1}\right\rfloor+1=\left\lfloor\frac{A}{t+1}\right\rfloor,

so the in-word computation equals the out-of-word quotient (checked by script over random targets).

Definition 2.2 (Best valid block chain).

Specification §3.3 (“The Block Chain”): a node “sums the work, as defined in §7.7.5, of all blocks in each valid block chain, and considers the valid block chain with greatest total work to be best. To break ties between leaf blocks, a node will prefer the block that it received first.”

Rosenfeld’s paper states the same rule for Bitcoin — “the branch representing the most proof of work”, with first-seen tie-breaking — so the model uses the same selection rule. The shorthand “longest chain” is exact only while difficulty is constant, which is precisely the paper’s Assumption 4.2 and not a property of the deployed chain (Section 8.2). Note also what the rule does not say: nothing marks a chain as permanently chosen. A node that learns of a heavier branch switches to it, however deep the fork point — subject only to the node-local rails of Section 8.4. Consensus is a standing competition, not an election with a winner.

Definition 2.3 (Confirmations).

A transaction has $n$ confirmations if it is included in a block of the best chain and there are $n$ blocks on the path from that block to the chain’s leaf, inclusive. The block containing the transaction is its first confirmation.

Different nodes may briefly disagree on the best chain when two blocks of equal cumulative work arrive in different orders. Absent a concurrent extension of the other branch, a later block makes one branch strictly heavier, and nodes converge on it once that block propagates (Figure 1). Such ties are the benign case. The attack of Section 5 is the malicious one: a fork manufactured in private and released only when it wins.

Refer to caption — Figure 1: Branch selection. Arrows point from child to parent. In panel (a) two blocks extend the same parent and the branches carry equal work; each node keeps the one it saw first. In panel (b) a new block lands on the upper branch, which now has strictly more cumulative work; during propagation, every node that knows this state selects the upper branch, unless the lower branch has meanwhile been extended. At constant difficulty “more work” and “longer” coincide, which is how the paper, and this volume’s figures, may draw block counts.

2.2 The attack

The double-spend attack, as the paper lays it out (§3):

1.

broadcast a transaction paying the merchant;
2.

secretly mine a branch from the last pre-transaction block, containing instead a conflicting transaction paying the attacker himself;
3.

wait until the merchant’s transaction has $n$ confirmations and the merchant, satisfied, hands over the goods;
4.

in the paper’s first-seen tie model, keep extending the secret branch until it carries more work than the public one, then broadcast it. Every node that sees it switches to it, the payment to the merchant is no longer part of history, and the attacker has both the goods and the coins.

Nothing in step 4 violates any validity rule — the released branch is a perfectly well-formed chain, merely a different one. The only question is probabilistic: with what probability does the secret branch ever get ahead? Answering it exactly in that first-seen model is the business of Sections 4 and 5; the toolkit comes first.