I understand that Bitcoin uses unspent tx output and Ethereum account balance based. However, recently there are lots of discussions on that Bitcoin's UTXO database has become too big. Does this mean account balance based transactions are better in scaling than UTXO based?


The choice between the UTXO model and the balance model is primarily one between privacy incentives and apparent intuitiveness.

If one follows the standard advice of not reusing addresses/outputs/scripts, as to not gratuitously reveal which coins belong to the sender and which belong to the receiver, the two models are actually equivalent. In this case balances would be single use anyway, and there would be as many balances as there would otherwise be UTXOs, removing both the apparent size advantage and convenience.

However, the balance model effectively incentivizes reuse. As the cost to the system (possibly in fees, but certainly in node operation costs) for a balance update is lower than the creation of a new balance, such a system inherently incentives revelation of transaction sources.

And even though balances are more intuitive, they do complicate reasoning about the security of the system. One issue is the problem of replay attacks. Assume X paid Y, and Y pays Z. Now W pays Y again. In a naive implementation, Z can rebroadcast his earlier transaction from Y, and could take the money from W's payment to Y. One solution is by putting sequence numbers on balances, and requiring transactions to list the sequence number of the transactions they take money of. Unfortunately, this requires maintaining the sequence number even for balances that went to zero, meaning that the balance database needs to maintain some data for every balance that was ever nonzero; a result that's far less scalable than the UTXO model was in the first place (which can forget outputs as soon as they're spent).

In short, my view is that the balance model reduces the fungibility of the currency as a whole for a short term gain that disappears.

  • The balance database doesn't need to maintain the sequence number for balances that went to zero. Among other solutions, you can assign an account a pseudo-random sequence number when it's created that has to go in each transaction. There are other solutions to this problem too. – David Schwartz Apr 30 '18 at 20:20
  • That's fair; I was only explaining how the account model introduces additional complications - several solutions are possible to it. The primary issue in my view is how accounts inherently encourage revealing linkage of transactions, which IMHO is a no-go for any currency that aims for fungibility. – Pieter Wuille Apr 30 '18 at 20:52
  • @DavidSchwartz could you please explain a little more details of how "assign an account a pseudo-random sequence number" would prevent replay attacks? – Helin Wang May 26 '18 at 23:39
  • If the account is re-created, it will have a new sequence number. This will make every previous transaction invalid for that account since the sequence number won't match. – David Schwartz May 27 '18 at 8:25
  • This is a highly biased answer. Not that it's bad, but I'd encourage people to also read the reason Ethereum went with their model: github.com/ethereum/wiki/wiki/… They also say UTXOs support more scaling paradigms, but I've yet to find any more info on that. – sudo Jun 13 '18 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.