As I understand the SVP protocol, a client can be reasonably certain that a transaction has been accepted on the blockchain if they know it is a member of a certain block, via the Merkle path, and a reasonable number of blocks have been mined on top of that block.

How much total data would that be, roughly? I guess if you were beginning with 0 knowledge, you would need all of the block headers, beginning from the genesis block? But once you are convinced you are looking at the head of the right chain, you could discard all of the ancient block headers, and just save a recent one as a trusted starting point to evaluate subsequent transactions?

I guess the premise of my question is faulty, as a fake transaction could always be embedded in a fake chain, if enough computing resources were available. So, there is no amount of data that insures a transaction is valid, without access to other information, e.g., what is the longest chain currently in existence.

A better question for my purposes would be how much would the electricity cost to create one fake block header at today's difficulty level? Figuring that blockchain currently pays around $60K to mine one block, I would guess it must be in that order of magnitude, though smaller since we are removing the race condition.


In theory, you would only need the data from the block of the transaction, and the ability to prove it the transaction still exists after at least 6 confirmations.

The more confirmations (blocks mined beyond a transaction) the lower probability it becomes possible to reverse. Generally speaking, 6 confirmations is enough to identify a transaction is irreversible.

Here's a quote from Mastering Bitcoin by Andreas Antonopoulos:


Block vary in size, but in SegWit transactions, the entire block can be a maximum ~2 MB.

These days there are many online tools that can verify this without needing the entire blockchain. The bitcoind JSON RPC API also works fairly well in providing transaction data. (Cannot be manipulated like with an online API)

  • I thought I could be certain a transaction belongs to a block, just by looking at the Merkle root and Merkle path. But, if the Merkle root is made up, then it would be easy to make up phony path. So, must have header chain, or at least a subset of it, to know Merkle root is not made up. – user1055568 Sep 15 '18 at 15:52

Assuming the SPV client has the block header and the transaction hash; proof for only one transaction

ceil(log_2 (number_of_tx_in_that_block)) * 32 bytes

You can see the structure of the merkle tree here (the 2nd one)

For example, for TX 4, you need to give the hash of TX 3, hash D, hash C.

  • Thanks, but how to be certain the block header is not phony? I guess can prove Merkle Root is valid with full chain of block headers, but that is still a lot of data. Do I have to go back to genesis block? Or, would I just need to see enough block headers chained after my block to be certain header is not fake? – user1055568 Sep 15 '18 at 16:53
  • SPV wallets should (must with little exceptions) store the block headers. That's what most of the SPV wallets do, and that's useful @user1055568 – MCCCS Sep 15 '18 at 16:55
  • Seems like I only need a few block header preceding the block that contains my transaction, and then 6 or so that follow. I can make up fake Merkle root, and all the Hash that follow, but to fake a preceding header, I need to solve reverse hash, and repeatedly for each preceding header. – user1055568 Sep 15 '18 at 17:21

Your Answer

