What attacks are possible with a malicious bootstrap.dat?

Question

The standard Bitcoin client normally needs to download the entire blockchain from the p2p network when first installed, but a shortcut is to provide it with a snapshot of the blockchain (at some point in time) in a file called bootstrap.dat. One can get this file from various sites and file sharing mechanisms such as BitTorrent.

My understanding is that the blocks taken from bootstrap.dat are not subjected to all the same checks as those downloaded from the p2p network (see this question). Therefore, an attacker might be able to get you to accept some invalid blocks by giving you a malicious bootstrap.dat. What, if anything, could they accomplish in this way?

For instance, if signatures are not verified for transactions coming from bootstrap.dat, the attacker might include a bogus transaction appearing to send a bunch of coins to one of their addresses. They could then convince you that they hold more coins than they actually do. But it's not clear how useful that would be; if they actually try to send you those nonexistent coins in payment for something, your client might believe the transaction is valid, but miners won't be fooled and the transaction will never confirm.

Are there other attacks I have not thought of?

Answer 1

You can fake an entire history of transactions and blocks perfectly, but unless you can get a majority of clients approved it's useless.

I'm not sure majority is defined as 51%, because there crypto is more complicated then that.

But look up how transactions get verified

https://en.bitcoin.it/wiki/Transactions

So, basically it depends on the lower level procedures which decide which clients to confirm against and you'd need to get majority of those just to fool your client.

Because when an error is detected they all start communicating it