1

I understand Merkle roots can be used for Merkle inclusion proofs, where a client/validator can quickly check if a transaction is part of the block without requesting all the transactions in the block.

The question I have is this: for this process of performing the Merkle proof, where does the client performing the proof get the merkle root from? And how is the client guaranteed that the merkle root it is given is the correct one?

I am thinking of a scenario where an attacker could convince a client/validator that a transaction is part of a block by sending it a fraudulent Merkle root and corresponding hashes.

What properties of Merkle trees and how it is used in Merkle inclusion proof in bitcoin prevent this from happening?

Improve this question

1 Answer 1

Reset to default
3

Generally, thin-clients at least download, validate, and store the header for each block. Since the Merkle root is part of the header, they already know all the Merkle roots for the whole blockchain. While a block header is insufficient for checking the corresponding block's validity (even the complete block would be insufficient if the validator doesn't know the current UTXO set), just from the header, a thin-client can verify that…

  • the block header is well-formed
  • the block header provides sufficient proof-of-work to pass the difficulty requirement
  • the block header commits to the previous block, and inductively connects to the Genesis Block

Since each header is only 80 B, the whole header chain is just ~57.5 MB. Thin-clients then gain some confidence in the chain-tip they're following by waiting for additional blocks extending it under the assumption that only the best chain would be acquiring significant additional POW over time.

Now, when a thin-client receives a transaction along with its Merkle branch, it can check whether it attaches to the header chain by hashing the transaction, combining it with the corresponding hashing partners that were part of the Merkle branch, and whether that ends up matching a Merkle root in one of the block header's it has.

Improve this answer
5
  • > Now, when a thin-client receives a transaction along with its Merkle branch How is the Merkle branch created? Who creates it?
    – Finlay Weber
    Apr 12, 2022 at 14:55
  • 1
    @FinlayWeber: Full nodes calculate Merkle branches to prove membership of a transaction when they get a request for a "Merkle block". I've described it further here: bitcoin.stackexchange.com/a/50680/5406
    – Murch ♦
    Apr 12, 2022 at 15:06
  • Just to make sure I understand. A client, who has the merkle root, and who wants to check if transaction A is in the block, would make a request for "Merkle blocks" needed for it to confirm the inclusion of transaction A in the set of transactions? So basically the full node, not only provide the merkle root, but it can also provide merkle blocks to clients who needs it to perform inclusion verification? Is this right? If so, what do the client need to pass to the full node when making this request?
    – Finlay Weber
    Apr 12, 2022 at 16:51
  • 1
    The thin client would probably have gotten the block header already previously and thus know the merkle root of the block in advance. After the thin client learns about a transaction it is interested in, it would make a getdata request specifying the data type MSG_MERKLEBLOCK. The full node would respond with a merkleblock message that provides the txid, hashing partners, and header. The full tx is then sent as a tx message right after.
    – Murch ♦
    Apr 12, 2022 at 20:21
  • Thanks for the answer and clarification!
    – Finlay Weber
    Apr 13, 2022 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.