I'm implementing my own Cryptocurrency similar to Bitcoin from scratch in C++ (just for learning and deeper understanding) and had an interesting design question.

My understanding is that the Merkle tree is only for nodes that do not want to download the entire blockchain ("lite nodes") ... so they can be sent a single transaction and verify it by getting the hashes of all previous blocks and a number of hashes logarithmic in the number of transactions within a particular block.

It seems to me you could accomplish something with similar functionality by instead computing the Merkle tree over the entire ledger state. Even with 1 billion accounts, this comes down to 30 hashes to verify a portion of the ledger. You would write the merkle root of the ledger state to the root of each block node. To verify a transaction you just download the new account value, along with the 30 or so hashes.

Assuming a 20byte wallet address + 8byte double for value ... we get ~28GB of data for a billion addresses... doable in memory on beefy modern server hardware.

This is how I am thinking of approaching it in my design -- am I missing something critical in the security model here?

  • It’s off topic here, but your understanding of the basics here is pretty lacking, I’d do a lot more research on the fundamentals before trying to design something better. You would be absolutely nuts to store monetary values as a float for example.
    – Claris
    Nov 4, 2021 at 21:34
  • That's not super helpful. I'm trying to understand why this design wouldn't work. I'm not trying to design something better, just make something functional ... but I feel like I'm missing something.
    – user491880
    Nov 4, 2021 at 22:54
  • 1
    Hashing the whole UTXO for Bitcoin takes many minutes, we expect the network to be able to synchronize in less than a second.
    – Claris
    Nov 5, 2021 at 0:01
  • So if I understand correctly this design is infeasable due to performance rather than the security of the construction? Do you need to hash the UTXO entirely each time though? You don't need to re-construct the entire MerkleTree of the UTXO per block... you just need to re-compute log(N)*k nodes where k is the number of wallets that changed their value or were inserted. The main problem I see is that you will likely be only able to keep a Merkle tree for the current block due to memory limitations...so you would not be able to answer an arbitrary balance query for any block.
    – user491880
    Nov 5, 2021 at 0:36
  • You are confusing a UTXO model and an account model, they are distinct architectural approaches. See: bitcoin.stackexchange.com/questions/49853/…
    – chytrik
    Nov 5, 2021 at 4:59

1 Answer 1


It seems to me that this would be a performance hit with no real benefits.

Committing a Merkle root of the UTXO set to each block would certainly be possible (of course you would need to devise an algorithm to build the Merkle tree deterministically, as each client would have to do that by itself), and with some clever performance optimizations (as you mentioned in the comments, you might not need to rebuild the entire Merkle tree for each block) it might be somewhat manageable.

However, SPV clients (who use the Merkle tree of transactions) can already "prove" (to the extent that non-full nodes can prove anything) that a UTXO has been created by a transaction. Using the Merkle root of the UTXO set would only add the ability to prove that the specific UTXO hasn't yet been spent by another transaction.

If the UTXO belongs to you then you probably don't need to ask other nodes if you've already spent it. If the UTXO doesn't belong to you then you probably don't need to know anything about it. In short, I don't see a use case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.