Just to add to Rob's answer...
I've variously seen this "2 hours" described in different places as different lengths of time, so I'd take it with a pinch of salt. (For example, here it's 900 seconds, which is 15 minutes.)
Note that in the Yellow Paper, this imposed time limit is absent. The only stipulation is that the current timestamp is greater than that of the parent block.
4.4.4. Block Header Validation
(48) Hs > P(H)Hs
Also, from the Geth code, it's not immediately clear that anything near this limit is imposed. (The relevant code is verifyHeader()
in consensus.go
.)
What appears to be imposed is there only to allow for clock drift between different nodes in the network, and here only a 15-second difference is allowed. (Coincidentally similar to the block time? Not sure.)
If a new block has a timestamp greater than 15 seconds from the current time (not the timestamp of the parent - we're not saying anything about the block time here), then it's temporarily marked as invalid. It will be marked as valid (and allowed to be imported) once the current time is within 15 seconds of this future timestamp.
So if a miner deliberately created a block with a false future timestamp which was further into the future than this, it'd be marked as invalid (though only temporarily). This temporary invalidity would give other miners a chance to mine their own version of the block with a true timestamp, making the cheating miner's block (in effect) permanently invalid.
(Relevant: "#15629 Relax requirements when determining future-blocks".)
- Technically, the median of the 11 previous blocks.
Not sure about this bit.