So light SPV clients give the user the ability to obtain merkle proofs (from a full node) that a given transaction is included in a block. Is there some cryptographic mechanism by which an SPV client could obtain proof that a transaction (or type of transaction) is not included in a block, while still being relatively "light" (O(log(n), say)?

Asking for a layer 2 solution ;)

  • You could check if it's in the mempool (this means it hasn't been confirmed yet). But, are you talking about any arbitrary transaction that may or may not have been submitted to the network?
    – JBaczuk
    Commented Jul 30, 2018 at 19:38
  • I'm talking about transactions included in a block - I want my SPV to be able to ask a full node to prove that no blocks contain, say, a transaction that has a given address in its inputs or outputs.
    – DZack
    Commented Jul 30, 2018 at 20:01

2 Answers 2


There is no known way to do this with the current consensus rules nor does it seem likely except via computationally expensive general ZKP.

The normal way to make compact proofs of non-membership is to have a hash tree which is ordered by the key you're looking to prove non-membership on. The proof is just the two neighbors that are greater and lesser than the key in question.

To show non-membership in a block this with a general ZKP (like bulletproofs) you would have to write an arithmetic circuit that computes the hash root of a block, and also scans over transactions looking for the thing-of-interest. If done using a bulletproof the proofs would be log in the size of the circuit, and take time to prove and verify linear in size... so they'd be somewhat slow but bandwidth efficient.


Client side filters (neutrino) allow you to check whether a certain transaction is included in a block. This can act as a proof of non-inclusion.

https://github.com/bitcoin/bips/blob/master/bip-0157.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0158.mediawiki

Note that this is not part of consensus, so nodes could lie to you. There won't be an SPV merkle proof connected to PoW, so perhaps it's not good enough for what you have in mind.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.