1

I understand what a merkle root is and how merkle proofs work.

It's all about thin nodes checking whether a specific transaction ID is in a specific block. So, thin node says: I have a transaction ID - 12345 and I want to know if this transaction is present in 259,291th block.

Why would a thin node want to know information like this ?

3

Why would a thin node want to know information like this ?

They quite possibly don't care about exactly which block the transaction was included in, but they most certainly care about knowing the transaction was included in the blockchain at all. It just so happens that there is no easy way to prove the latter without proving which block it is included in.

To illustrate a more concrete interaction (as used in BIP37, but other protocols like Electrum's client-server protocol are similar). F = full node (the server), L = light client. This is obviously not an actual protocol dump, but conceptually it's close.

L: Hi F, I'm a light client and am interested in transactions involving addresses A, B, and C. [filteradd]

F: Okay. [nothing]

L: I have synchronized blocks up to block hash H. [getheaders]

F: Oh dear, you're behind, there is also block I and J. Here are their headers! [headers]

L: Those headers look great, and their proof of work is valid. So eh... does I contain any transactions I care about? [getdata with MSG_FILTERED_BLOCK]

F: Nope. [empty merkleblock]

L: Okay... what about block J [getdata with MSG_FILTERED_BLOCK]

F: Oh yes, here is transaction T that involves one of your addresses! [merkleblock]

L: That looks like a transaction that indeed pays me... but can you prove it's actually been included in the chain? You know, I don't trust you really and you could be giving me an invalid transaction, or one that spends money that has already moved in the chain. [nothing]

F: Fine, here is a Merkle path that proves T is in fact included in block J. [part of the earlier merkleblock message, actually].

So the point is that without the proof, F could be claiming that L got paid, while the transaction is invalid. Having it included in the chain makes that very expensive, assuming other nodes in the network actually enforce validity of transactions in the chain.

There is a caveat of course. There is no way that F can prove to L that block I didn't include any interesting transactions. The solution to that is either trusting the server, or trying multiple - neither is very satisfying.

| improve this answer | |
  • So, it seems like that thin nodes at first have the transactionId. then they ask this to full nodes. full nodes search the transactionId in the entire blockchain presumably. if found, they say: yes, we got it, but light node doesn't believe it and that's where full node gives the path of the merkle root of the block it found to the thin node to check it out.. correct ? – Nika Kurashvili Sep 22 at 8:30
  • 1
    The full node does not have to search the full blockchain. The thin client first only has the addresses they're interested in. The thin client only learns about the transaction from the full node when the full node looks at a specific block with the filter provided by the thin client. – Murch Sep 22 at 14:16
  • Hi @Murch, sorry for the late follow up. Just to sum up. A light node has addresses of the users. It at first doesn't have transactions. Now it gives the addresses to full nodes and want to get transactions. A full node gives transactions to a thin node and thin node shows that on UI website. but problem is how a thin node can trust full node in this case and that's why merkle roots are for. I guess, that's what a thin node is interested and not if the transaction is included in the block or not, but at the end of the day, both options intersect and they mean the same thing. am I right?thanks – Nika Kurashvili Sep 25 at 18:07
  • Right, the thin client is mostly interested to be sure that he got paid, and the certainty of having been paid increases with confirmations. A confirmation is achieved when the transaction is included in a block. The easiest way to show evidence it is in some block is by showing in which block exactly. This in turn tells the thin client how many blocks were found since then, and the additional confirmations will make the thin client more confident it isn't being tricked. – Murch Sep 26 at 1:05
1

TL;DR: A Merkle branch provides costly-to-fake indicator that a transaction is actually part of the blockchain. The cost of forging a Merkle branch is sufficiently high to deter some attacks on low-value transactions, but trivial to validate by the thin client.

Full nodes and thin clients are distinguished by whether they independently process the whole blockchain. While full nodes verify the complete blockchain from the Genesis block to the chain-tip, thin clients usually keep only copies of transactions they are interested in, and sometimes the headers of the blockchain. Hereby, the headers of the blockchain are already a huge security boost, because the block headers by themselves already are subject to a number of consensus rules including the difficulty requirement. Creating fake block headers that pass even a cursory validation is very costly.

One of the fields included in the 80-byte block header is the Merkle root. The Merkle root is a cryptographic commitment to all transactions included in the block. So, providing the Merkle branch that connects the transaction's leaf to the root is a strong indicator that the transaction existed in a block. Especially, if the block is checked to pass the difficulty requirement which is computationally expensive to find. If the thin client tracks the chain of block headers, the headers tie together by linking to their predecessors, which means that an attacker not only needs to find a block with sufficient proof-of-work, but also do so in a limited time.

If the transaction were not in a block, it would be computationally infeasible to find hashing partners that tie the transaction's hash to a specific Merkle root. Unfortunately, the thin client could still be lied to; either with the claim that the transaction is not included in a block (it's impossible to proof absence except by parsing all blocks), or if the transaction was part of a stale chain-tip that got superseded by a chain-tip where the transaction was not included. Thin clients usually protect against these by asking multiple peers for information, and by waiting for multiple confirmations to make attacks more costly.

| improve this answer | |
  • My question still stays the following: Why would thin client need to know if xxx transaction is found in yyyth block ? I'd much appreciate if you could bring a scenario with names so i can easily understand. Thank you – Nika Kurashvili Sep 21 at 21:12
  • Let me turn the question around: how would someone prove that your transaction is included in the blockchain without showing you where it is included? Also, thin clients want to know when the transaction got confirmed, so that they can know when they got paid. – Murch Sep 21 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.