Does 'simplified payment verification' work?

Question

I was reading the original bitcoin paper where they mention a simplified payment verification scheme in section 8. I was wondering whether or not this actually works.

A quick sketch: The scheme requires you to only store all the block headers (instead of the full blocks). When you need to verify a transaction, you simply need the merkle root of the transaction and see whether or not that merkle root appears somewhere in the stored block headers. If so, you know that the transaction was once verified.

But you would not be able to use this for actually verifying new payments, right? Suppose somebody pays, and in the transaction he uses 'ins' from some other transaction. With this simplified scheme I could then check that the transaction actually happened. But I can't check that he has not already spent the money, right?

So basicly this scheme is only useful for re-verifying an old transaction for some reason? (e.g. to confirm that someone has participated in some transaction). But it is not useful for paying.

Is that a correct interpretation of the scheme, or am I missing something?

Answer 1

Simplified payment verification can't help much with 0-confirmation transactions. But once the payment has several confirmations, this fact alone (which the SPV client can verify) implies that the transaction is accepted by the network, so the payment is secure.

SPV can also be used in conjunction with a server node that has the blockchain and can verify against double-spending. The client will still want the block headers and the Merkle branch of the transaction to keep the server node honest. Without this, the server can falsely report that the client received payment; with the simplified verification, the server would have to collude with the sender.