How can SPV nodes trust received Open Assets?

Question

I was reading over the specification for the Open Assets (colored coins) protocol. It seems that keeping track of Asset ownership requires looking up the scriptPubKey for each input in a transaction, and possibly even recursively looking up the prevouts for inputs, in order to verify the chain of ownership. Full nodes can do this, as they process all blockchain data.

However, it's possible to make a transaction that looks like a valid Open Assets transaction, but that breaks the link in ownership somewhere along the way. More confirmations won't help convince SPV nodes that the transaction is a valid OA transaction, as miners do not enforce that all transactions structured as OA transactions are actually valid.

Can SPV nodes participate in the Open Asset protocol with any reasonable security?

Answer 1

You can't trust pure SPV for any Bitcoin 2.0 protocols, because of the 'metadata faking' issue that you outline. You have a few options:

• Accept you need to run a full node to backtrack through transactions. (Though note that this will not scale well anyway for popular assets.)
• Use a blockchain that has native support for assets, like Sidechain Elements or MultiChain.
• Use some kind of external service to track assets, like the CoinPrism API for Open Assets or CoinSpark's federated asset tracking model.