Imagine Alice owns 10 BTC and wants to send 1 BTC to bob, with a 1 BTC miners fee.

In the blockchain, the transaction is recorded as "Alice spent 10 bitcoins, 1 goes to Bob, 1 goes to the miner, and 8 goes to Alice".

That seems rather unintuitive. Why not just record the payment and miners fee explicitly?


2 Answers 2


I've looked into this before, and I've never been able to find an explicit rationale from Satoshi, but there are a couple of possible reasons.

For: Simplifies SPV verification

Imagine that rather than using the spent/unspent model, you track the balance of each address. You get a zero-confirmation transaction that pays to you from an address.

Now, to figure out what the balance of this address is, you need to get all of the deposits and withdrawals from it. If you miss one, you calculate the wrong balance.

You could fix that by forcing each transaction from an address to reference the last transaction by hash, but that eliminates an important property of Bitcoin - multiple deposits and withdrawals to and from the same address can be processed at the same time, without coordination between them.

For: Improves transaction privacy in theory

The change output (which you referenced as '8 BTC goes to Alice') is sent to an entirely new address, and in theory it is not possible to figure out which output is the change output. In practice, the real output is usually a nice round number, and the change output is something like 0.00019841.

Against: Makes increasing the fee really complicated

If you've used Bitcoin for long enough, you've probably run into a situation where someone sent you some Bitcoins, but didn't attach a fee.

If the change output were explicitly marked, the sender could just resend the transaction with a slightly smaller change output, and a slightly larger fee. Miners would know that they could safely accept the new transaction into their memory pool without helping anyone commit fraud. Then, we wouldn't need stuff like replace-by-fee or child-pays-for-parent.

Against: Makes the UTXO set much larger

If you have 50 outputs that make up your money, that means that you're taking up 50 times more space than you would if you had a single balance.

TL;DR: It could have been done differently, and there are some reasonably compelling arguments, but it's impossible to change now.

  • 1
    You should probably point out that concepts like the UTXO database didn't even exist up until Bitcoin Core 0.8, it confuses a lot of people when they go and read up about "pruning" and wonder why the system we use today seems completely foreign.
    – Claris
    Jun 25, 2015 at 2:16
  • 1
    @Bitcoin They didn't exist because the idea was that the average person would use an SPV wallet. The idea that the average consumer or merchant should run a full node is a relatively recent invention.
    – Nick ODell
    Jun 25, 2015 at 2:23
  • 2
    The UTXO didn't exist because it hadn't been written yet, instead the client used an unwieldy and poorly scaling BerkeleyDB database. The current implementations of SPV are atrocious from a scalability and privacy view, so it's pretty irresponsible to go suggesting them to anyone.
    – Claris
    Jun 25, 2015 at 2:28
  • 1
    @Bitcoin Maybe I should rephrase: the idea of having a database of transactions and marking them spent and unspent existed, but it wasn't considered important to optimize the size of the unspent output set, because you can't serve SPV clients with just a UTXO database. WRT to scalability and privacy... this is probably getting offtopic. Shall we take this discussion to Bitcoin Lounge?
    – Nick ODell
    Jun 25, 2015 at 17:01
  • "Against: Makes the UTXO set much larger" argument is only valid assuming that everyone uses only one address. Which means extremely bad privacy.
    – Jannes
    Jun 27, 2015 at 22:24

Transaction outputs only have two states, spent and unspent, so spending part of one is not possible without the creation of another. With a boolean spent/unspent there is no state to have to store and recall, which allows for simpler states in wallets and makes scaling away from the block chain significantly easier. Imagine if we had a transaction spending a decrementing amount in an output, what's to stop that transaction just being repeated and debiting the amount again? Having atomic outputs means you don't need to worry about things like serial numbers, which alternate systems like Ethereum and NXT do, due to their lack of inherent replay protection.

There's additionally no purpose in stating the fee if it can be inferred, and doing so saves space in the transaction.

  • 3
    Transaction outputs only have two states, spent and unspent, I understand that. I don't understand the reason for designing the protocol that way. Why was this system chosen?
    – Akhil F
    Jun 24, 2015 at 22:25
  • @Bitcoin: Comments are only meant for clarification and minor addendums, please rather edit the answer to put additional information there. :)
    – Murch
    Jun 25, 2015 at 7:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.