Pieter Wuille · 1. Timewarp fix rules
BIP-54 proposes (among other things) two rules to curb undesirable tricks that can be played with block header timestamps:
- The timestamp of the first block of a retarget period must not be more than 7200 seconds before the timestamp of the preceding block (to prevent the ArtForz timewarp attack).
- The timestamp of the last block of a retarget period must not be before the timestamp of the first block of the same period (to prevent the Murch-Zawy alternating attack).
It is worth asking whether these two rules are sufficient, or whether other attacks remain undiscovered. The short answer is that these rules indeed suffice to bound chain growth.
2. Results
Specifically, it can be shown that any chain in which no block timestamp exceeds the genesis timestamp by more than t + 7200 seconds (7200 seconds being how far in the future a block timestamp may be), with no more than w chain work, has at most u(t,w) blocks where
This formula is proven in Lean to hold for all t \geq 0 and w \leq 2^{208} (far beyond the point where proof-of-work security breaks down), see Section 4. The decimal approximation additionally requires w \geq 2^{57}. The bound holds under all of Bitcoin’s consensus rules, including the integer rounding in Bitcoin’s chain work and difficulty adjustment computations.
If we limit w \leq 2^{128} (the amount of work at which security assumptions break down anyway) we get u(t,w) \leq t/596.4285 + 121746.97. In other words, the long-term block rate is bounded to about one block per 9m56s, plus a bounded number of extra blocks that must be paid for with difficulty increases.
As of 2026-Sep-09 21:30 UTC, with t = 557982895 seconds after genesis, and a real chain at height 966,270 with total work w = 2^{96.349377}, this formula gives a limit of 1,012,794 blocks. That is a 3300x improvement over what would be possible without the timewarp fixes. Both rules are needed: with either one missing, the limit remains over 3.34 billion blocks. This shows that both rules are necessary and together sufficient to get a tight bound.
Note that the formula only provides a conservative upper bound, and not the actual maximum number of blocks. For the values above, the longest known chain is 1,007,326 blocks long, but it is not proven to be the longest.
3. Derivation
In what follows, we derive the formula above from Bitcoin’s consensus rules, showing it is a true upper bound.
First, some constants so we can reason about everything symbolically:
- R = 4, the factor to which the retarget clamps the ideal difficulty adjustment ratio, in both directions
- R_\text{max} = 4 + 3\cdot2^{-15}, the maximum ratio by which the difficulty can actually increase per period (slightly more than R due to rounding; see the note below)
- N_\text{period} = 2016, the number of blocks per period
- T_\text{period} = 1209600 = 600\cdot N_\text{period}, the intended time for one period (2 weeks)
- T_\text{future} = 7200, how far in the future a block timestamp can be
- T_\text{grace} = 7200, the grace period permitted by rule (1): how long before the end of the previous period the next one may start
- W_\text{unit} = 2^{32} + 2^{16} = 4295032832, a lower bound on the ratio of any block’s chain work to its difficulty: slightly below the unrounded work-per-difficulty ratio 2^{48}/65535, to allow for rounding effects (see the note below)
A note on rounding. Two integer-rounding effects in Bitcoin’s consensus rules matter here, and the constants above account for both.
- Chain work. A block’s chain work is computed as c = \lfloor 2^{256}/(g+1)\rfloor for its target g, while its difficulty is d = 65535\cdot2^{208}/g. Writing 2^{256} = c\,(g+1) + r with 0 \leq r \leq g gives cg = 2^{256} - c - r. Every target is at most 65535\cdot2^{208}, and c \leq 2^{208} for every block of a chain with at most w \leq 2^{208} total work, so cg \geq 2^{256} - 65535\cdot2^{208} - 2^{208} = 2^{256} - 2^{224}, i.e., c \geq \frac{2^{256} - 2^{224}}{65535\cdot2^{208}}\,d = (2^{32} + 2^{16})\,d = W_\text{unit}\,d: the per-block bound used below. The choice of W_\text{unit} therefore accounts for all possible effects of the actual chain work calculation if we require w \leq 2^{208}.
- Difficulty adjustment. The retarget computes the next target as \lfloor g\cdot\text{clamp}(s)/T_\text{period}\rfloor, with the timespan ratio clamped to [1/R,\,R], and then rounds it down to the compact form v\cdot256^{e} with 2^{15} \leq v < 2^{23}. Rounding a target down raises the difficulty, so ignoring the rounding at worst underestimates difficulty (which is fine for our length overestimate, see Section 3.3). The rounding does however raise the maximum difficulty adjustment factor R_\text{max} above 4. If the target g has mantissa 4i+3 for i \geq 2^{15}, and the period span s is (clamped to) its minimum value (3.5 days), the adjustment will divide the target’s mantissa by R = 4, yielding i, without changing the exponent. That ratio \frac{4i+3}{i} is at most 4 + 3\cdot2^{-15}. This is the worst case overall: mantissas below 2^{17} divide exactly (the exponent decreasese), and for any longer span the value being rounded is at least g/4, so by monotonicity of the rounding the resulting target is at least the one obtained here. Hence R_\text{max} = 4 + 3\cdot2^{-15}.
We model the chain with the following variables:
- The chain has n blocks, consisting of k+1 difficulty adjustment periods: k complete ones with N_\text{period} blocks each, and a possibly-incomplete tail period with m blocks (m \in [1,\ N_\text{period}]). Thus, k = \lfloor (n-1)/N_\text{period}\rfloor, and n = k\cdot N_\text{period} + m.
- Each block in period j has difficulty d_j (the maximum target divided by the block’s target), and thus chain work at least W_\text{unit}\,d_j (see the note above), where d_0 = 1 and d_{j+1} \in [d_j/R,\ R_\text{max}\cdot d_j].
- The “span” of period j is s_j, the difference between the timestamps of its last and its first block. Timewarp rule (2) implies s_j \geq 0 for all complete periods, i.e., for j < k. If the tail period is complete, s_k does exist and is subject to it as well, but plays no role in what follows.
- The “net duration” of period j is p_j, the difference between the first-block timestamps of the next period and of this one. This is defined for j < k only, as the tail period has no successor (there is no p_k). Timewarp rule (1) implies p_j \geq s_j - T_\text{grace} for all j < k.
Finding the exact longest chain that satisfies the time and work bounds is a complicated optimization problem, and does not lead to a simple formula. To obtain a closed-form expression, we make a number of conservative overestimation steps.
The strategy will be as follows, where each numbered step corresponds to a subsection below.
- Bound on tail difficulty. For every possible tail period length m we derive an upper bound q_m(w) on the difficulty of the tail block(s). Then we simplify the problem by looking for an upper bound on the length of any chain that has at most that tail difficulty, rather than bounding the total amount of work. Because q_m(w) is an overestimate, this means computing an upper bound on the length of a superset of the set of chains we were considering before, meaning it remains a valid (even if less tight) upper bound.
- Ignoring interior timestamps. Only a few rules have any bearing on the interior timestamps in each period. We ignore these rules, simplifying our problem. Removing rules gives more freedom on allowed chains, and can thus only increase the maximum chain length.
- Weakening the difficulty adjustment. The difficulty adjustment rule is complicated, so we replace it with an approximation that never results in higher difficulties than the real one. This again can only increase our eventual upper bound.
- Avoiding span variables. Next we avoid having s_j variables separate from the p_j variables, by showing how assuming s_j = p_j + T_\text{grace} cannot change the length of the longest chains.
- Constructing the longest chain. After all earlier simplifications, we construct an actual longest chain satisfying all remaining requirements, with a tail period of m blocks, and compute its length u_m(t,w).
- Maximizing over tail length. Finally we get rid of the m variable by taking the maximum over all u_m(t,w) to obtain the overall bound u(t,w).
3.1 Bound on the tail difficulty
There exists a simple upper bound on the tail difficulty. The tail period contains m blocks of difficulty d_k, each with chain work at least W_\text{unit}\,d_k, so w \geq m\,W_\text{unit}\,d_k, and d_k \leq w/(m\,W_\text{unit}) would be a valid upper bound, but we can do better.
Start by stating the work limit in terms of a sum of per-period difficulties, using the per-block work bound from the rounding note, and dividing by W_\text{unit}:
Since d_k \leq R_\text{max}^{k-j}\,d_j, i.e. d_j \geq R_\text{max}^{j-k}\,d_k,
Applying R_\text{max}^{-k}\,d_k \leq d_0 = 1, we get
Solving for d_k gives d_k \leq q_m(w), with
From now on, we will look for an upper bound on the length of chains that satisfy the time limit t and have tail difficulty \leq q_m(w), instead of staying below chain work w. All chains that stay below chain work w have a tail limit \leq q_m, so this is a superset of the earlier set of chains, and the upper bound can only go up.
3.2 Ignoring interior timestamps
There are only two constraints in the current optimization problem that involve the timestamps of interior blocks (all blocks of a period except its first and last):
- The “median-time past” (MTP) rule, which states that each block timestamp must be strictly larger (expressed in integer seconds) than the median of the 11 blocks preceding it. On its own this rule limits chain growth to 6 blocks per second, but combined with the BIP-54 timewarp fixes it no longer affects the longest possible chain, except in extreme cases.
- The upper bound of t + T_\text{future} on all timestamps (relative to genesis).
We simplify both. The MTP rule is dropped entirely, and the timestamp bound will only be applied to the last block in the penultimate period k-1. This gives more freedom for chains and may thus increase the length of the longest chain, which is fine for an overestimate. In practice, this increase is minor.
A corollary of this is that all interior timestamps in the chain become irrelevant. They are not constrained by any rule, and do not constrain any other timestamps. This means we can leave them out of consideration entirely, and only care about the first and last timestamps in each period. Assigning timestamp 0 to the genesis block, all relevant timestamps are then determined by the s_j and p_j variables:
- The timestamp of the first block of period j is \sum_{i=0}^{j-1} p_i.
- The timestamp of the last block of period j is s_j + \sum_{i=0}^{j-1} p_i.
Another corollary is that timestamps may now go below the genesis block’s timestamp (0). In real chains the MTP rule prevents that, since every block’s timestamp must exceed a median that ultimately traces back to genesis.
3.3 Weakening the difficulty adjustment
Bitcoin’s difficulty adjustment rule, in our variables, gives
with equality except for the rounding of targets, which can only increase d_{j+1} (see the note in the constants list). It is possible to work with this rule directly (see Section 5), but it is complicated. In what follows, we will instead use the conservative approximation:
The plot below compares the real adjustment factor (\text{adjust}) with the approximation (f) as functions of the span s_j; note the logarithmic Y axis.
The approximation never exceeds the real multiplier for any s_j \geq 0, and touches it at s_j = T_\text{period}, so it is accurate for small adjustments and a (possibly significant) underestimate for large ones.
This makes it an acceptable change, because its only effect is reducing difficulties. As a result, given any chain that satisfies all constraints (timestamp of last block in penultimate period is \leq t + T_\text{future}, last block difficulty is \leq q_m(w)), applying the approximation instead of the real rule yields a chain that still satisfies them. So the longest chains under the real rule remain within the set our formula bounds.
Note that this requires R \geq \mathrm{e}. If R were lower, the approximation at the s_j=0 point would be above the real adjustment factor (R), so it would no longer be an underestimate. Indeed, if R were so low, we would need a different approach, and a different eventual formula. See Section 5 for more about that.
Many approximations are possible; this one is chosen because its logarithm is linear in s_j (a straight line in the plot above), which will prove very useful below.
With all the changes made so far, our problem statement has turned into: find the maximum number k of (p_j, s_j) pairs satisfying the following constraints:
3.4 Avoiding span variables
Next we show why we can assume s_j = p_j + T_\text{grace}, \forall j \in [0,\,k-1], which will allow us to get rid of the s_j variables.
Consider any chain satisfying the constraints above, given as its sequence of (p_j, s_j) pairs, and make the following changes:
- Move the tail period backward as much as possible, without changing any spans. Set p_{k-1} = s_{k-1} - T_\text{grace}. This is the minimum timewarp rule (1) allows.
- Grow the spans of all earlier periods as much as possible, without moving any starting time. Set s_j = p_j + T_\text{grace}, \forall j \in [0, k-2]. This is the maximum timewarp rule (1) allows.
The result will still satisfy all constraints above. The first change only affects p_{k-1}, which only appears in the timewarp rule (1). The second only affects the s_j with j < k-1, which appear in both timewarp rules and in the difficulty bound; in the latter, increasing s_j can only reduce the difficulty.
So for every chain in the solution set there is a corresponding chain, with the changes applied, that is also in the set and has the same length. We can therefore restrict attention to chains of that form, since (one of) the longest chains must be among them.
Substituting s_j = p_j + T_\text{grace}, \forall j \in [0,\,k-1] in the problem definition, the problem becomes: find the maximum number k of values p_j \in [-T_\text{grace},\, \infty) satisfying:
Timewarp rule (1) has become trivial, and timewarp rule (2) is now the lower end of the range of p_j. From here on we write h = t + T_\text{future} - T_\text{grace} for the right-hand side of the time bound: the available time budget, i.e. the timestamp window minus one grace period. We will also require h > 0 (or t > T_\text{future} - T_\text{grace}); we only care about long-term behavior and this will simplify things further on.
3.5 Constructing the longest chain
The problem is now close to solvable.
Taking the logarithm of both sides of the difficulty bound, the problem becomes:
Defining the logarithmic difficulty adjustment as a function of the net period duration,
this becomes:
Note that the ordering of the p_j values no longer matters. That is a consequence of enforcing only a maximum tail difficulty q_m(w), on the blocks of period k, instead of the total work limit w. For the actual longest chain, the ordering of p_j values absolutely matters: changes in the earlier ones have a compounding effect on all later periods. This makes it clear that replacing the total work limit by a tail difficulty limit leads to an overestimate.
In fact, the constraints can be written purely in terms of the averages \bar{p} of the p_j and \bar{a} of the a(p_j), plus one equation guaranteeing that these averages correspond to actual p_j values. Because a(p) is linear, that equation is simply \bar{a} = a(\bar{p}):
Eliminating \bar{a} and solving for k, assuming for now that 0 < \bar{p} < T_\text{period} - T_\text{grace}:
The count k is bounded by the smaller of the two right-hand sides. One is increasing in \bar{p} while the other is decreasing in it, so the largest attainable bound is found at their intersection.
That intersection satisfies
with solution
In other words, any chain whose net period durations (excluding the tail period) average to this value can reach the maximum length; giving every period exactly this duration is the simplest way.
Substituting into either bound and rounding down to an integer gives:
The division above assumed 0 < \bar{p} < T_\text{period} - T_\text{grace}. Provided that:
- h > 0 (already assumed)
- T_\text{period} > T_\text{grace} (a period that leaves the difficulty unchanged takes positive net time)
- w > m\,W_\text{unit} (more work than the tail alone can carry at minimum difficulty)
the intersection does lie in that range. Nothing is lost by the restriction either: for \bar{p} \leq 0 the time bound holds for every k, and the difficulty bound alone caps k at T_\text{period}\,\ln q_m(w)/(T_\text{period} - T_\text{grace}). For \bar{p} \geq T_\text{period} - T_\text{grace} the difficulty bound holds for every k, and the time bound alone caps k at h/(T_\text{period} - T_\text{grace}). The expression inside the floor above is exactly the sum of these two caps, so under the same three conditions it exceeds both, and the intersection is the maximum over all \bar{p}. The derivation also presumed k \geq 1; chains with no complete period have n = m, and the bound below covers them since \lfloor k\rfloor is at least 0 under these conditions.
Thus our upper bound for chain length becomes n \leq u_m(t,w) where
3.6 Maximizing over tail length
The last step is to eliminate m, the number of blocks in the tail period, which is unknown but which the formula so far requires. The obvious approach is to evaluate u_m(t,w) for every m and take the largest. For our example t and w values, this yields 1,012,339 blocks.
To obtain a closed-form formula instead, we first drop the floor, which can only increase the value:
Its second derivative with respect to m is:
which is strictly positive, so our upper bound is a convex function in m. This means that the maximum over all m is reached at one of the ends of the domain, i.e., either m=1 or m = N_\text{period}.
Solving u_1(t,w) \geq u_{N_\text{period}}(t,w) shows that m=1 wins whenever
which holds for our constants, so u_1(t,w) \geq u_m(t,w) for all m. Setting m=1 gives the final formula:
which holds whenever:
- h = t + T_\text{future} - T_\text{grace} > 0
- w > W_\text{unit} (true for any chain, as the genesis block alone has chain work \lfloor 2^{48}/65535\rfloor = 4295032833)
- w \leq 2^{208} (needed for the per-block work bound; see the rounding note)
- R \geq \mathrm{e}
- \ln\!\bigl(R_\text{max}\,N_\text{period}/(N_\text{period}+R_\text{max}-1)\bigr) \geq (N_\text{period}-1)\,(T_\text{period}-T_\text{grace})/(N_\text{period}\,T_\text{period})
- T_\text{period} > T_\text{grace}
Note that eliminating m relied on removing the floor to make the expression convex, and the floor cannot be reinstated afterwards: m=1 is the maximum only without it. With the floor, the maximum can occur at any m \in [1,\, N_\text{period}], as the plot above shows.
Substituting the constants with their values gives the formula presented at the top. Note that h = t, since T_\text{future} = T_\text{grace}.
4. Lean proof
The formula from Section 2 has been proven in Lean 4 (with Mathlib). The proof was created by an LLM and has not been reviewed by me. It can be verified independently by Lean’s kernel, without sorry, and depends only on the three standard axioms (propext, Classical.choice, Quot.sound). Assuming no bugs in Lean and Mathlib, this means only the statement being proven needs to be reviewed:
chain_length_le : ∀ (n : ℕ) (x : ℕ → ℤ) (g : ℕ → ℕ) (t : ℕ) (w : ℝ),
1 ≤ n →
x 0 = 0 →
(∀ i < n, x i ≤ ↑t + 7200) →
(∀ (j : ℕ), 0 < j → 2016 * j < n → x (2016 * j - 1) - 7200 ≤ x (2016 * j)) →
(∀ (j : ℕ), 2016 * j + 2015 < n → x (2016 * j) ≤ x (2016 * j + 2015)) →
g 0 = powLimit →
(∀ (j : ℕ), 2016 * j + 2015 < n → g (j + 1) = nextTarget (g j) (x (2016 * j + 2015) - x (2016 * j))) →
w ≤ 2 ^ 208 →
∑ i ∈ Finset.range n, ↑(work (g (i / 2016))) ≤ w →
↑n ≤ u t w
def u : ℕ → ℝ → ℝ := fun t w =>
2016 / (2016 * 600 - 7200) *
(↑t + 2016 * 600 * Real.log ((2016 + (3 + 3 / 2 ^ 15) * (w / Wunit)) / (2016 + (3 + 3 / 2 ^ 15)))) + 1
def Wunit : ℝ := 2 ^ 32 + 2 ^ 16
def work : ℕ → ℕ := fun g => 2 ^ 256 / (g + 1)
def nextTarget : ℕ → ℤ → ℕ := fun g s => compactRound (min powLimit (g * clampSpan s / 1209600))
def clampSpan : ℤ → ℕ := fun s => (max (1209600 / 4) (min (4 * 1209600) s)).toNat
def compactRound : ℕ → ℕ := fun x => setCompact (getCompact x)
def getCompact : ℕ → ℕ × ℕ := fun x => if 2 ^ 23 ≤ mant x then (mant x / 2 ^ 8, nSize x + 1) else (mant x, nSize x)
def setCompact : ℕ × ℕ → ℕ := fun p => if p.2 ≤ 3 then p.1 / 2 ^ (8 * (3 - p.2)) else p.1 * 2 ^ (8 * (p.2 - 3))
def mant : ℕ → ℕ := fun x => if nSize x ≤ 3 then x * 2 ^ (8 * (3 - nSize x)) else x / 2 ^ (8 * (nSize x - 3))
def nSize : ℕ → ℕ := fun x => (x.size + 7) / 8
def powLimit : ℕ := 65535 * 2 ^ 208
In which n is the chain length, t is the time bound, w is the work bound, x are the block timestamps, u is the Section 2 formula, and g are the per-period targets. g\,j is the target of blocks 2016j to 2016j+2015, so block i uses g\,(i/2016); g\,0 is the maximum target, and later ones follow from the retarget rule. The arrows ↑ are casts between number types (natural numbers to integers or reals).
The hypotheses, in order, are:
- at least one block
- genesis at timestamp 0
- the timestamp window
- timewarp rule (1), the first block of each period being at most 7200 seconds before the previous block
- timewarp rule (2), the last block of each complete period not being before its first
- the genesis target
- the retarget rule, computing each period’s target from the previous period’s target and the timestamps of that period’s first and last blocks
- the cap w \leq 2^{208} needed for the per-block work bound (see the rounding note)
- the work budget, the total chain work being at most w
Retargeting and the chain work calculation are modelled exactly as in Bitcoin’s consensus rules, including the clamping of the timespan, the truncation of targets to the compact nBits encoding (GetCompact in Bitcoin Core), and the integer divisions.
The theorem is somewhat stronger than the derivation in Section 3: it needs neither h > 0 nor w > W_\text{unit}. The proof follows a slightly different route from the text, one that does not need those conditions.
5. More accuracy
In Section 3.3 we made a conservative approximation to the difficulty adjustment formula. This is not strictly necessary: a tighter bound can be obtained that is still a closed-form expression.
We do still ignore the minimum-difficulty rule (difficulty \geq 1), as it is hard to model and has no effect on the longest chain for realistic values; where it does have an effect, ignoring it only underestimates difficulty, and so overestimates length. The adjustment rule is thus:
where, as in Section 3.3, the inequality is an equality up to the rounding of targets. Replacing the actual rule by this lower bound can only enlarge the set of admissible chains, so we use it as the adjustment rule from here on.
Restating the problem of Section 3.5 with this adjustment rule in place of the approximation from Section 3.3: find the maximum number k of values p_j \in [-T_\text{grace}, \infty) satisfying:
Defining
this becomes:
As with a(p) in Section 3.5, this can be stated in terms of the averages \bar{p} of the p_j and \bar{b} of the b(p_j):
We again need a correspondence condition guaranteeing that (\bar{p}, \bar{b}) is the average of actual (p_j, b(p_j)) pairs. Consider what b(p) looks like:
Each (p_j, b(p_j)) is a point on the blue curve. Their average (\bar{p}, \bar{b}), however, can be a combination of multiple such points, and lie beyond the curve itself. The exact set of those combinations is complicated, but it is bounded by the convex hull of the curve (light blue). As a further relaxation of the problem, we accept that the average can lie anywhere in that hull. Note in particular that this includes the area on the far left under the blue curve. The lower border of the hull (dotted orange) is:
with its three pieces (below the curve on the left, on the curve in the middle, on the maximum-adjustment floor on the right) separated by the orange dots. This is correct for R \geq \sqrt{\mathrm{e}}; otherwise the middle section disappears, and the first section needs a different formula.
The correspondence condition is then \bar{b} \geq \underline{b}(\bar{p}), and using it to solve for k gives:
As before, the maximum k is at the intersection of the two right-hand sides, and the solution depends on which of the three pieces of \underline{b} it lands on. Skipping the derivation, the result is:
where
and where W_0 is the principal branch of the Lambert W function, the inverse of x\,\mathrm{e}^x. Note that \lambda \leq 0 is not possible, as we assume h > 0 and w > m\,W_\text{unit} (as in Section 3.5).
Restricting to the 0 < \lambda \leq \lambda_\text{max} case and applying the convexity analysis of Section 3.6 gives:
The convexity is no longer automatic here, but holds whenever the bound allows at least one complete period even at m = N_\text{period}. Also, whether m=1 or m=N_\text{period} wins may now depend on t and w as well, though for our constants m=1 always wins. For our example, this gives 1,009,930 blocks; evaluating the floored form over all m (restricted to m < w/W_\text{unit}, the tail lengths for which a chain can exist at all; for our example that is every m) gives 1,009,199, our tightest formula-based bound.
In the \lambda > \lambda_\text{max} case, (\bar{p},\bar{b}) lies on the leftmost piece of the orange border, below the blue curve. A chain achieving this mixes periods with p_j = -T_\text{grace} (the leftmost point of the curve) with periods at the tangency point p_j = (\mathrm{e}/R)\cdot T_\text{period} - T_\text{grace}. This is exactly the (weak) variant of the Murch-Zawy attack I pointed out here as becoming possible if R < \mathrm{e}. That turns out not to be necessary: it is possible for R=4 too, but only when the affordable difficulty increase per unit of time is several times higher than in the current chain. If R \leq \mathrm{e}, however, this mixing strategy becomes optimal for all inputs.
6. Conclusion
By making a number of conservative simplifications to the problem, we obtained several upper-bound formulas for the length of any possible chain with a specified time limit and work limit. One of those was proven correct in Lean. All of these are within 5% of the real chain’s length, showing that the two timewarp rules together do bound chain growth tightly.
For our running example t and w, we get:
| Description | n | k | m |
|---|---|---|---|
| Section 3, no floor, m=1 (proven formula) | 1,012,794 | 502.38 | 1 |
| Section 3, \lfloor k\rfloor, maximum over m | 1,012,339 | 502 | 307 |
| Section 5, no floor, m=1 | 1,009,930 | 500.96 | 1 |
| Section 5, \lfloor k\rfloor, maximum over m | 1,009,199 | 500 | 1199 |
| Longest known chain | 1,007,326 | 499 | 1342 |
| Real chain (height 966,270) | 966,271 | 479 | 607 |
Acknowledgements
Thanks to @AntoineP for the idea to look into this problem, and reviewing the text.
Zawy · 
