The standard Bitcoin client normally needs to download the entire blockchain from the p2p network when first installed, but a shortcut is to provide it with a snapshot of the blockchain (at some point in time) in a file called bootstrap.dat
. One can get this file from various sites and file sharing mechanisms such as BitTorrent.
My understanding is that the blocks taken from bootstrap.dat
are not subjected to all the same checks as those downloaded from the p2p network (see this question). Therefore, an attacker might be able to get you to accept some invalid blocks by giving you a malicious bootstrap.dat
. What, if anything, could they accomplish in this way?
For instance, if signatures are not verified for transactions coming from bootstrap.dat
, the attacker might include a bogus transaction appearing to send a bunch of coins to one of their addresses. They could then convince you that they hold more coins than they actually do. But it's not clear how useful that would be; if they actually try to send you those nonexistent coins in payment for something, your client might believe the transaction is valid, but miners won't be fooled and the transaction will never confirm.
Are there other attacks I have not thought of?