Why can't mining pools provide fake transactions within the generated blocks?

Question

Suppose Alice wants to add a fake transaction where she receives X ammount of BTC. I understand that in order to add that transaction to the blockchain she would have to compete against all the other miners to generate the next block, which makes it improbable to happen as an individual against them.

Now, if we take a look at the next figure (taken from blockchain.info) which shows the mining pools with highest hash rate at the network:

we see that, for instance, the mining pool BTC.com has 26.4% hash rate of the network, and thus comes my question: Why can't all the miners at this pool make an agreement by adding fake transactions to all the blocks they generate? Differently than the previous case, where Alice was an individual with almost no chance to generate a an altered block, the pool could make it very likely.

Answer 1

Suppose Alice wants to add a fake transaction where she receives X ammount of BTC. I understand that in order to add that transaction to the blockchain she would have to compete against all the other miners to generate the next block, which makes it improbable to happen as an individual against them.

No, that isn't correct. No matter how much mining power she has, or how many miners she cooperates with, she can't add a fake transaction to the blockchain.

It's a common misconception that miners are solely responsible for determining whether or not a transaction is valid, and if they say it is, then everyone else accepts it. In fact, anyone who runs a Bitcoin full node (e.g. Bitcoin Core) is automatically checking whether each transaction is valid (spends money from a previous valid and unspent transaction, properly signed, etc). If a miner attempts to include an invalid transaction in a block, this will be detected and their entire block will be ignored by everybody, effectively meaning that they don't get their mining reward.

With enough mining power, or the cooperation of a pool, Alice could create a block with her fake transaction. But nobody in the world will consider it as valid or accept it as part of the blockchain. If she tries to spend the proceeds of that transaction, say by sending those coins to Bob in exchange for some goods, Bob's software will simply ignore it. He'll think that Alice just hasn't paid at all, and won't send her any goods. So the whole exercise would be a giant waste of Alice's time and resources, without gaining her anything or harming anyone else.

The only special authority that miners have is this: if there are two or more otherwise valid transactions which are in conflict with one another, then miners get to decide which one (or none) goes into the blockchain, thus confirming it. But they can't confirm a transaction that was never valid in the first place.

A large amount of mining power, or a pool, could help Alice perform a double spend attack, where a valid and confirmed transaction is later replaced in the blockchain with a different valid transaction. The first one might have gone to Bob, who would have sent some goods, and the second one could effectively take the money back from Bob and return it from Alice, who now has the money and the goods. But the second transaction is one that Alice could have created all along (of course she can send her own money to herself); it isn't "fake".

Answer 2

What you need to understand is that, fundamentally, miners - and other nodes on the network - can broadcast whatever the heck they want. What matters is not what they broadcast, but what other nodes accept.

Full nodes verify that all transactions on the network are valid according to the protocol rules. And one of those protocol rules is that coins can't materialize arbitrarily. For a tx to be valid, its inputs must total at least as much as the outputs; and the inputs are either unspent outputs of previous transactions, or newly minted coins in the block's coinbase.

If the coins come from previous outputs, the transaction must be signed with the private keys corresponding to the owner public key hash. The miner can include as many "fake transactions" as it wants in the block, but without the appropriate digital signatures, no node will accept the block as valid, and no merchant will recognize that they have received coins for the purposes of offering a service.

Answer 3

One of the concepts that is fundamental to bitcoin is the concept "one-way functions", which allow the creation of a problem for which finding a solution takes massively more resources than checking whether a proposed solution is valid.

It's a bit unclear as to what you mean by "fake transaction". Transactions on the bitcoin network can be categorized into two groups. First, there are "reward" transactions, in which a miner simply declares that they have received a certain amount of bitcoin, out of nowhere, as a reward for completing a block. For this to be accepted by the network, they have to prove that they actually complete a valid block. The only interpretation I can think of for a "fake" reward transaction is for Alice to simply declare that she has been given a reward, without creating a valid block. She can then try to spend that reward by providing it to other people in exchange for goods and services. The recipient will then, presumably, check to see whether the transaction is valid. This is where one-way functions come in: anyone accepting bitcoin can efficiently check whether Alice's reward transaction satisfies bitcoin's validity conditions. Whether Alice's alleged "bitcoins" are worth anything depends on whether she can get anyone to exchange goods and services for them. If she can find someone who isn't bothering to check whether she has valid bitcoin, or is willing to accept whatever validity criterion she is proposing, then she will be able to "spend" her "bitcoin". But that isn't really an issue for the bitcoin network, any more than a casino getting people to accept their casino chips as "money" is an issue for the US dollar. Alice's "bitcoin" will be clearly distinguishable from "real" bitcoin by anyone running standard bitcoin software. What miners say is a valid bitcoin transaction is irrelevant: if you want someone to take your bitcoin, what matters is what they say is valid.

The other type of transaction is where the output a reward transaction is then transferred to another person, (or the output of a chain of transactions is transferred). So let's say Bob has perfectly valid bitcoins, and Alice wants to claim that Bob has transferred them to her. There are two main ways she can do this. One is she can just declare that Bob has done so, without any verification. This then puts her in the same situation as above. The other strategy is to fake the verification. This is where one-way functions come in again. Bob has a secret key that he uses to sign his transactions. Signing a transaction, if you know that key, can be done in polynomial time. Checking that a transaction has been signed can be done in polynomial time. But signing the transaction without the key cannot be done in polynomial time. So Alice is going to have to use an astronomically large amount of resources to fake the transaction. Even if she had all the computing power in the world, the probability of her finding a solution would for all practical purposes will be zero. She would be better off applying that computing power to mining real bitcoin.