I'm a beginner is this field. Can someone explain to me how mining pool provided merkle branches are valid? Normally, when we make the root, it starts from top to bottom, a single change in order can lead to a different hash.

But in pools miner get merkle branches, with coinbasetx left for the miner to tweak. Is this process correct? Usually coinbasetx should be calculated first, shouldn't this lead to different root, or may be I'm wrong, can someone explain?

1 Answer 1


A Merkle tree is calculated by concatenating the two children of a node and hashing the result. We repeat this on each pair of nodes on the same level until we are left with a single node that we call the Merkle Root.

A merkle tree with four leaves detailing how each branch is combined to reach the root
via Mastering Bitcoin Ch7

As seen in our example Merkle tree with four transactions {Tx A, Tx B, Tx C, Tx D}, e.g. the right node on the second level HCD is calculated by concatenating HC and HD and hashing that (although the graphic uses a plus to express the concatenation):

HCD = Hash(HC || HD)

The coinbase transaction is required to be the first transaction in a block. In this example, Tx A is our coinbase transaction. The other transactions {Tx B, Tx C, Tx D} would have been picked by the mining pool leaving the miner only the ability to change Tx A. To calculate a valid Merkle root, the miner only needs to recalculate the left flank of the tree. They need to be informed about HB in order to calculate HAB and informed about HCD in order to calculate the Merkle root HABCD. This allows the mining pool to communicate the remaining content of the block in compressed form by only providing log(n) hashing partners instead of the whole remaining list of n-1 transactions in the block template. Granted, the mining pool could have picked an invalid set of transactions and the miner would be unable to catch that. However, that would be against the interest of the mining pool as the work of the miner would be useless.

It is therefore perfectly fine for the miner to pick the coinbase transaction last and recalculate only the left flank of the Merkle tree. In fact, there is another reason why the coinbase transaction must be picked after all other transactions in the template. If there is at least one segwit transaction included in the block, the coinbase transaction must include a witness commitment as a nulldata output (or OP_RETURN output). This output stores the Merkle root of the witness txids of all transactions in the block (with a placeholder for the coinbase transaction as it cannot know its own witness txid to commit to itself in its own output). This commitment can only be calculated after all other transactions have been picked. Therefore, it is not just possible, but always required that the coinbase transaction be picked last when constructing a block template.

  • thank you very much. It actually make sense now.
    – chronus
    Dec 31, 2022 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.