Nakamoto Consensus & Probabilistic Finality

Nakamoto consensus combines proof of work (PoW), a fork-choice rule, transaction validation, and incentives so anonymous nodes can converge on a history without a fixed validator list. It does not run a vote that says “final”; instead, reversing a block becomes less likely and more expensive as additional work accumulates above it.

Proof of work is a costly lottery #

A miner repeatedly varies header data until the double-SHA-256 block-header hash, interpreted as an integer, is no greater than the target $T$. One trial succeeds with probability approximately

$$p = \frac{T+1}{2^{256}}.$$

The nonce is not a proof by itself; the sufficiently small hash is. Verification is one hash computation, while creation requires many expected trials. Difficulty retargeting adjusts the target so aggregate block production remains near the protocol's intended rate as network hash power changes.

Fork choice: most cumulative work #

Network delay means two valid blocks can extend the same parent. Nodes tentatively follow the valid chain with the greatest cumulative proof—not simply the most blocks—and miners extend the tip they currently consider best. When one branch gains more work, rational miners converge on it because work on the losing branch does not earn canonical rewards.

flowchart LR
  A["block h"] --> B1["candidate h+1"]
  A --> B2["candidate h+1′"]
  B1 --> C1["more cumulative work"]
  B2 --> C2["stale branch"]
  C1 --> D["nodes reorganize to winning branch"]

“Longest chain” is shorthand that can mislead: Bitcoin Core compares chainwork. A sequence of easier blocks must not beat fewer blocks representing more expected hashing.

Confirmations are a risk decision #

A transaction has one confirmation when it is in the current tip, two when one block follows, and so on. An attacker trying to replace it races from behind. If the attacker controls fraction $q<1/2$ of hash rate and honest miners control $p=1-q$, the catch-up probability falls rapidly with depth but is never exactly zero in the idealized model.

Operational confirmation policy therefore depends on value, the possibility of eclipse or network attacks, observed replacement behavior, and how quickly the receiver can react—not a magic universal number.

The adversary model #

The usual honest-majority statement is about effective hash power under assumptions about propagation and incentives. Attacks below 50% can still censor intermittently, exploit network position, or probabilistically reorganize short histories; above 50%, an attacker can reliably outpace honest work but still cannot forge signatures or spend coins whose keys it lacks.

Mining pools complicate interpretation because pool coordination and physical hash ownership are not identical. The security variable is the work an adversary can direct during the attack window.

BFT finality is different #

This distinction is why “Bitcoin solves Byzantine agreement” is directionally useful but technically incomplete: it changes membership, timing, decision, and finality assumptions rather than implementing PBFT on anonymous peers.