[bitcoin-dev] Trusted merkle tree depth for safe tx inclusion proofs without a soft fork

Peter Todd pete at petertodd.org
Sat Jun 9 13:02:55 UTC 2018

On Sat, Jun 09, 2018 at 02:51:55PM +0200, Sergio Demian Lerner wrote:
> Yo can fool a SPV wallet even if it requires a thousands confirmations
> using this attack, and you don't need a Sybil attack, so yes, it impacts
> SPV wallets also. The protections a SPV node should have to prevent this
> attack are  different, so it must be considered separately.

There's hardly any cases where "thousands of confirmations" change anything.

Anyway, SPV is a discredited concept and we shouldn't be concerning ourselves
with it.

> It should be said that a SPV node can avoid accepting payments if any
> Merkle node is at the same time a valid transaction, and that basically
> almost eliminates the problem.

Indeed it does: between the number of txouts, scriptSig length, scriptPubKey
length, and the upper bits of nValue we have ~32 known bits that we can use to
distinguish between inner nodes and transactions. That's a false positive rate
of under one in a billion, so no issues there.

https://petertodd.org 'peter'[:-1]@petertodd.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180609/3ac37781/attachment.sig>

More information about the bitcoin-dev mailing list