Are pool provided merkle branches trustable?

Question

I'm a beginner is this field. Can someone explain to me how mining pool provided merkle branches are valid? Normally, when we make the root, it starts from top to bottom, a single change in order can lead to a different hash.

But in pools miner get merkle branches, with coinbasetx left for the miner to tweak. Is this process correct? Usually coinbasetx should be calculated first, shouldn't this lead to different root, or may be I'm wrong, can someone explain?

Answer 1

A Merkle tree is calculated by concatenating the two children of a node and hashing the result. We repeat this on each pair of nodes on the same level until we are left with a single node that we call the Merkle Root.

^{via Mastering Bitcoin Ch7}

As seen in our example Merkle tree with four transactions {Tx A, Tx B, Tx C, Tx D}, e.g. the right node on the second level H_CD is calculated by concatenating H_C and H_D and hashing that (although the graphic uses a plus to express the concatenation):

H_CD = Hash(H_C || H_D)

The coinbase transaction is required to be the first transaction in a block. In this example, Tx A is our coinbase transaction. The other transactions {Tx B, Tx C, Tx D} would have been picked by the mining pool leaving the miner only the ability to change Tx A. To calculate a valid Merkle root, the miner only needs to recalculate the left flank of the tree. They need to be informed about H_B in order to calculate H_AB and informed about H_CD in order to calculate the Merkle root H_ABCD. This allows the mining pool to communicate the remaining content of the block in compressed form by only providing log(n) hashing partners instead of the whole remaining list of n-1 transactions in the block template. Granted, the mining pool could have picked an invalid set of transactions and the miner would be unable to catch that. However, that would be against the interest of the mining pool as the work of the miner would be useless.

It is therefore perfectly fine for the miner to pick the coinbase transaction last and recalculate only the left flank of the Merkle tree. In fact, there is another reason why the coinbase transaction must be picked after all other transactions in the template. If there is at least one segwit transaction included in the block, the coinbase transaction must include a witness commitment as a nulldata output (or OP_RETURN output). This output stores the Merkle root of the witness txids of all transactions in the block (with a placeholder for the coinbase transaction as it cannot know its own witness txid to commit to itself in its own output). This commitment can only be calculated after all other transactions have been picked. Therefore, it is not just possible, but always required that the coinbase transaction be picked last when constructing a block template.