7

In the past, we had numerous questions about "fake" or "forged" transactions. Such transactions could supposedly be created even without holding any bitcoins, yet would end up in the mempool or even get accepted by the network once they are mined into a block. Other times, the recipient creates a conflicting version of the sender's transaction, or a majority attacking miner would simply redirect all transaction outputs to themselves.

With this topic I mean to create a canonical question for a topic which is described by the following variants of a questions:

  • Why can I not just make up bitcoins?
  • Why will fraudulent transactions not get relayed on the network?
  • Why can only the owner spend their funds?
  • Why can a third party not alter the recipients of a transaction?
  • What prevents a miner from taking the funds of your transaction when creating a block?

In other words, let's comprehensively explain:

What makes a transaction valid, how is a transaction protected against tampering, and how can nodes tell?

Here are some examples of topics that might be redirected here in the future: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 12, 13, 14, 15, 16, 17,…

4

The Bitcoin protocol follows a Unspent Transaction Output system to track the existence and state of all Bitcoin in the system. These are known as UTXOs.

All transactions that transfer Bitcoin do so by consuming one or more UTXOs, and create one or more new UTXOs. The only exception to this is the Coinbase transaction, which is limited to being the first transaction in a block, and is only allowed to create UTXOs that total block reward + block fees or less.

Due to this basic structure of a transaction, it is impossible to create a bitcoin transaction that spends non-existent bitcoin. As the UTXOs being consumed do not exist, the transaction is rendered invalid the moment it is created.

Although this is impossible, why it is impossible is not immediately obvious to people unfamiliar with the details of how Bitcoin works - thus, many people, especially newcomers to the space, seek out such things as a way to quickly get some Bitcoin at no or low cost. Several scammer groups are aware of this, and put out videos showing edited block explorers/wallets that seem to allow them to initiate fake transactions.

These groups then offer to give you access to this software for a small fee, or just let you download it for free - however, not only does it not work as advertised, most of these programs are trojan horses, and contain code to steal Bitcoin wallets on your system, or grant the scammers persistent remote access to your machine.

Answering each point directly:

Why can I not just make up bitcoins?

As all bitcoin in the system are the result of either a coinbase transaction, or the outputs of a transaction that moved previously extant bitcoin, it is not possible to introduce new Bitcoin into the system without being detected. Any UTXO at any point of time must always be traced back to one or more coinbase outputs.

Why will fraudulent transactions not get relayed on the network?

All well behaved nodes on the network validate transactions before accepting them to their mempool, or rebroadcasting them further - part of this validation is checking all utxos in the transaction against the node's own list of valid utxos. If the transaction claims to spend a UTXO that does not exist in the node's list, the transaction is deemed invalid and dropped.

Why can only the owner spend their funds?

Standard Bitcoin addresses rely on one (single key addresses) or more (multisig addresses) private keys. The public keys corresponding to these private keys are encoded into the address itself, inside its locking script (also known as the scriptPubKey). During the evaluation of these scripts, the signature on that input is matched against the embedded public key(s). If the signature does not match, the transaction is deemed invalid.

Note that it is possible to create outputs with no "owner" - The Bitcoin script does not require all locking scripts to include a key check, and it is possible to construct a non-standard script that requires no signatures to spend. However, no consumer wallet does this, and essentially all addresses a normal user will encounter will be backed by one or more private keys.

Why can a third party not alter the recipients of a transaction?

Standard transactions are signed using the SIGHASH_ALL signature flag. This means that the signature for any one input signs all inputs and outputs (in effect, signing all material aspects of the transaction). If any input or output is altered, removed, or otherwise changed, the signature is no longer valid as the data it signs has changed.

It is possible to construct a transaction using other signature flags, as described in my blog post here. However, once again, no consumer wallet uses anything except SIGHASH_ALL.

What prevents a miner from taking the funds of your transaction when creating a block?

Similar to the previous point, a miner is also unable to alter the outputs of your transactions due SIGHASH_ALL signing the entire transaction. If a transaction is intentionally signed with SIGHASH_NONE, a miner could very well take the funds. However, as no sane wallets performs such a signature, this does not happen.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.