Verifying Bitcoin ownership

Question

Suppose Alice has 30 bitcoins from David. Now Alice wants to transfer amount 20 bitcoins to Bob.

Now, Alice creates a transaction with Bob's bitcoin address.
To prove authenticity and integrity, Alice digitally signs the current transaction.
To prove that Alice owns the money, the current transaction includes hash from David's transaction which can be verified by the recipient and other nodes on the network.

As per my understanding, transactions are collected in blocks which are linked to form a block chain. Every node on the network stores the block chain. To verify whether Alice owns the money, one has to verify the bitcoin address of Alice in David's transaction. Now David's transaction can be very old, in older blocks. How this check is done? Is the hash of David's transaction for Alice's ownership checked in every block in the block chain?

Is the ownership verified by going from block to block?

Also what prevents Alice from using David's transaction again and again?

Answer 1

A bitcoin transaction can have 1 or more inputs and 1 or more outputs. Inputs are previous transaction outputs that sent bitcoins, and outputs are instructions on where to send the bitcoins from the inputs. The total value of the outputs cannot exceed the total value of the inputs, and any leftovers (output is less than input) will be taken as a transaction fee by the miner who created the block that verifies the transaction. Also, an output can only ever be used as an input once.

So, in your example, David's 30BTC transaction is the only input, and you need an output of 20BTC to Bob's address. That leaves 10BTC in change. Typically, you would create another output back to yourself. This is called 'change'. So there will be two outputs, 20BTC to Bob and 10BTC to Alice (or maybe slightly less, providing a fee for miners and encouraging them to verify the transaction quickly).

The actual verification is complex, but a simple explanation would be that a verify-er can traverse the entire blockchain from start to finish, picking up every output and discarding outputs as soon as they are used as an input. When he's done, he's got a list of unused outputs that could be used in future transactions. To verify transactions included in the next block, he just has to make sure the transaction has inputs that are on the list, and that there are no other transactions in the new block trying to use the same input.

So, if David's transaction was used as input in the past, it wont be on the list. If Alive tries to be sly and create multiple transactions at the same time that use David's transaction, the miners will only include one of them.

Meanwhile, once you have your list, you don't really need to traverse the blockchain from the beginning again, you just have to keep your list up to date by reading each new block and removing used outputs and adding new unused outputs. That way, you always have a list of valid inputs.