Ethereum has a simpler model by not having UTXOs (Unspent Transaction Outputs) like Bitcoin. What does Ethereum "give up" by not having UTXOs, and what does it gain?

  • 3
    The answer to this important questions are, sadly, totally slanted towards Ethereum, straight cup & paste coming from the Ethereum documentation. For example with UTXOs there's no need to come up with nonce and whatnots to fix transaction ordering issues: the recent Ledger Nano S SNAFU where many tx were broadcast several times or ppl eventually sending ETH many times instead of once to crowdfund ICOs during blockchain congestion cannot be nearly as bad when UTXOs are used. There are also 0-conf systems that are used with UTXOs that simply aren't as secure with Ethereum (you must wait blocks) Feb 2 '18 at 18:30
  • Basically the accepted answer here is of very poor quality and totally lacks objectivity. It's the Ethereum documentation which present the only advantage as "potential scalability paradigms" (notice the "potential"). Re the privacy we all know now that it's incorrect: there are companies whose sole purpose is de-anonymizing UTXOs / the Bitcoin blockchains. I'm sorry but there's much more to UTXOs than "potential scalability paradigms". I gave two examples. There are more (I'm not an expert on the matter but now enough to see that the answers here are totally biased). Feb 2 '18 at 18:33
  • +1 and favorite to the question asked. -1 to all the answers (so far). Feb 2 '18 at 18:33
  • @CedricMartin I've unaccepted the Jan 22 answer because we do want as much factual and unslanted answers as possible. If you find an expert who can answer, please encourage them. If this question is too broad for an expert, they may post their own questions (trying to avoid slant) to help explain important parts, and we can link them here. Thank you for your comments.
    – eth
    Feb 18 '18 at 7:47

The main validation constraints in a Bitcoin UTXO system are:

  • every referenced input must be valid and not yet spent
  • the transaction must have a signature matching the owner of the input for every input
  • the total value of the inputs must equal or exceed the total value of the outputs

By contrast functionality in an Ethereum account-based system are:

  • a global state stores a list of accounts with balances, code, and internal storage
  • a transaction is valid if the sending account has enough balance to pay for it, in which case the sending account is debited and the receiving account is credited with the value
  • if the receiving account has code, the code runs, and internal storage may also be changed, or the code may even create additional messages to other accounts which lead to further debits and credits

These systems indeed have various tradeoffs. For example, while Ethereum maintains the account balance as part of the global state, a Bitcoin user's "balance" is the total value for which the user has a private key capable of producing a valid signature.

In general, the benefits of UTXOs are:

  • Higher degree of privacy: if a user uses a new address for each transaction that they receive then it can be difficult to link accounts to each other
  • Potential scalability paradigms: UTXOs are more theoretically compatible with certain kinds of scalability paradigms

The benefits of accounts are:

  • Large space savings: because every transaction need only make one reference and one signature and produces one output
  • Greater fungibility: because there is no blockchain-level concept of the source of a specific set of coins, it becomes less practical to institute a redlist/blacklisting scheme
  • Simplicity: easier to code and understand, especially once more complex scripts become involved
  • Constant light client reference: light clients can at any point access all data related to an account by scanning down the state tree in a specific direction

One weakness of the account paradigm is that in order to prevent replay attacks, every transaction must have a "nonce" and the account must keep track of the nonces used.

  • 1
    I do not understand the 'higher degree of privacy' argument for UTXO. Why should Ethereum not be able to do exactly the same, creating a new address for each transaction? Jul 10 '16 at 16:08
  • @RolandKofler, Indeed Ethereum can have a new address for each transaction. I believe that JAXX already does this and also uses a seed similar to Electrum. This concept hasn't been brought over to the Ethereum official wallet yet. As it's only a dapp perhaps someone will make a seed based wallet for Ethereum in the future as a dapp?
    – Joseph
    Sep 23 '16 at 13:41
  • They have now introduced chainId in the raw transaction object to prevent replay attacks, why is the nonce still there?
    – James
    Nov 7 '17 at 4:50
  • 1
    @James chain ID is to prevent cross-chain replay attacks. Nonce is to prevent the obvious in-chain replay attack which would otherwise be possible because the transaction does not reference particular UTXOs but rather just specifies the amount to be debited - which could otherwise be easily included in multiple blocks, debiting the account multiple times.
    – knaperek
    Dec 12 '18 at 13:38
  • 2
    @RolandKofler it is possible to use a separate address/account for each transaction, but then it's harder to regroup your coins and send them to the destination all in a single transaction. It is a fundamental limitation of Ethereum.
    – knaperek
    Dec 12 '18 at 13:40

The accepted answer is a very good summary of the following wiki:


See it for further details, including Ethereum's rationale:

We have decided that, particularly because we are dealing with dapps containing arbitrary state and code, the benefits of accounts massively outweigh the alternatives. Additionally, in the spirit of the We Have No Features principle, we note that if people really do care about privacy then mixers and coinjoin can be built via signed-data-packet protocols inside of contracts.


With bitcoins UTXO model a single wallet can spend multiple outputs asynchronously whereas with ETHs nonce model you must wait for a previous transaction to get mined before your next transaction may process.

  • Upvoting and you're right about the ETH nonce, but a miner could choose more than one transaction you have in the mempool and include them all in the block. The miner does have to order your transactions according to nonce. Your point about UTXO is an aspect of what the accepted answer calls "potential scalability paradigms".
    – eth
    May 2 at 9:50

There is complete answer in Ethereum Wiki

  • 1
    Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – Afr
    Jan 6 '17 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.