57

Ethereum has a simpler model by not having UTXOs (Unspent Transaction Outputs) like Bitcoin. What does Ethereum "give up" by not having UTXOs, and what does it gain?

1
  • 5
    The answer to this important questions are, sadly, totally slanted towards Ethereum, straight cup & paste coming from the Ethereum documentation. For example with UTXOs there's no need to come up with nonce and whatnots to fix transaction ordering issues: the recent Ledger Nano S SNAFU where many tx were broadcast several times or ppl eventually sending ETH many times instead of once to crowdfund ICOs during blockchain congestion cannot be nearly as bad when UTXOs are used. There are also 0-conf systems that are used with UTXOs that simply aren't as secure with Ethereum (you must wait blocks) Feb 2, 2018 at 18:30

3 Answers 3

41

The main validation constraints in a Bitcoin UTXO system are:

  • every referenced input must be valid and not yet spent
  • the transaction must have a signature matching the owner of the input for every input
  • the total value of the inputs must equal or exceed the total value of the outputs

By contrast functionality in an Ethereum account-based system are:

  • a global state stores a list of accounts with balances, code, and internal storage
  • a transaction is valid if the sending account has enough balance to pay for it, in which case the sending account is debited and the receiving account is credited with the value
  • if the receiving account has code, the code runs, and internal storage may also be changed, or the code may even create additional messages to other accounts which lead to further debits and credits

These systems indeed have various tradeoffs. For example, while Ethereum maintains the account balance as part of the global state, a Bitcoin user's "balance" is the total value for which the user has a private key capable of producing a valid signature.

In general, the benefits of UTXOs are:

  • Higher degree of privacy: if a user uses a new address for each transaction that they receive then it can be difficult to link accounts to each other
  • Potential scalability paradigms: UTXOs are more theoretically compatible with certain kinds of scalability paradigms

The benefits of accounts are:

  • Large space savings: because every transaction need only make one reference and one signature and produces one output
  • Greater fungibility: because there is no blockchain-level concept of the source of a specific set of coins, it becomes less practical to institute a redlist/blacklisting scheme
  • Simplicity: easier to code and understand, especially once more complex scripts become involved
  • Constant light client reference: light clients can at any point access all data related to an account by scanning down the state tree in a specific direction

One weakness of the account paradigm is that in order to prevent replay attacks, every transaction must have a "nonce" and the account must keep track of the nonces used.

8
  • 1
    I do not understand the 'higher degree of privacy' argument for UTXO. Why should Ethereum not be able to do exactly the same, creating a new address for each transaction? Jul 10, 2016 at 16:08
  • @RolandKofler, Indeed Ethereum can have a new address for each transaction. I believe that JAXX already does this and also uses a seed similar to Electrum. This concept hasn't been brought over to the Ethereum official wallet yet. As it's only a dapp perhaps someone will make a seed based wallet for Ethereum in the future as a dapp?
    – Joseph
    Sep 23, 2016 at 13:41
  • They have now introduced chainId in the raw transaction object to prevent replay attacks, why is the nonce still there?
    – James
    Nov 7, 2017 at 4:50
  • 2
    @James chain ID is to prevent cross-chain replay attacks. Nonce is to prevent the obvious in-chain replay attack which would otherwise be possible because the transaction does not reference particular UTXOs but rather just specifies the amount to be debited - which could otherwise be easily included in multiple blocks, debiting the account multiple times.
    – knaperek
    Dec 12, 2018 at 13:38
  • 3
    @RolandKofler it is possible to use a separate address/account for each transaction, but then it's harder to regroup your coins and send them to the destination all in a single transaction. It is a fundamental limitation of Ethereum.
    – knaperek
    Dec 12, 2018 at 13:40
12

The accepted answer is a very good summary of the following wiki:

https://eth.wiki/en/fundamentals/design-rationale#accounts-and-not-utxos

See it for further details, including Ethereum's rationale:

We have decided that, particularly because we are dealing with dapps containing arbitrary state and code, the benefits of accounts massively outweigh the alternatives. Additionally, in the spirit of the We Have No Features principle, we note that if people really do care about privacy then mixers and coinjoin can be built via signed-data-packet protocols inside of contracts.

3

With bitcoins UTXO model a single wallet can spend multiple outputs asynchronously whereas with ETHs nonce model you must wait for a previous transaction to get mined before your next transaction may process.

1
  • Upvoting and you're right about the ETH nonce, but a miner could choose more than one transaction you have in the mempool and include them all in the block. The miner does have to order your transactions according to nonce. Your point about UTXO is an aspect of what the accepted answer calls "potential scalability paradigms".
    – eth
    May 2, 2021 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.