<p>What you need to understand is that, fundamentally, miners - and other nodes on the network - can broadcast whatever the heck they want. What matters is not what they broadcast, but what other nodes accept.</p>

<p>Full nodes verify that all transactions on the network are valid according to the protocol rules. And one of those protocol rules is that coins can't materialize arbitrarily. For a tx to be valid, its inputs must total at least as much as the outputs; and the inputs are either unspent outputs of previous transactions, or newly minted coins in the block's coinbase.</p>

<p>If the coins come from previous outputs, the transaction must be signed with the private keys corresponding to the owner public key hash. The miner can include as many "fake transactions" as it wants in the block, but without the appropriate digital signatures, no node will accept the block as valid, and no merchant will recognize that they have received coins for the purposes of offering a service.</p>

CC BY-SA 4.0
2018-06-11T16:15:52.983Z
2018-06-11T16:15:52.983Z
Meni Rosenfeld
<p>One of the concepts that is fundamental to bitcoin is the concept "one-way functions", which allow the creation of a problem for which finding a solution takes massively more resources than checking whether a proposed solution is valid.</p>

<p>It's a bit unclear as to what you mean by "fake transaction". Transactions on the bitcoin network can be categorized into two groups. First, there are "reward" transactions, in which a miner simply declares that they have received a certain amount of bitcoin, out of nowhere, as a reward for completing a block. For this to be accepted by the network, they have to prove that they actually complete a valid block. The only interpretation I can think of for a "fake" reward transaction is for Alice to simply declare that she has been given a reward, without creating a valid block. She can then try to spend that reward by providing it to other people in exchange for goods and services. The recipient will then, presumably, check to see whether the transaction is valid. This is where one-way functions come in: anyone accepting bitcoin can efficiently check whether Alice's reward transaction satisfies bitcoin's validity conditions. Whether Alice's alleged "bitcoins" are worth anything depends on whether she can get anyone to exchange goods and services for them. If she can find someone who isn't bothering to check whether she has valid bitcoin, or is willing to accept whatever validity criterion she is proposing, then she will be able to "spend" her "bitcoin". But that isn't really an issue for the bitcoin network, any more than a casino getting people to accept their casino chips as "money" is an issue for the US dollar. Alice's "bitcoin" will be clearly distinguishable from "real" bitcoin by anyone running standard bitcoin software. What miners say is a valid bitcoin transaction is irrelevant: if you want someone to take your bitcoin, what matters is what <em>they</em> say is valid.</p>

<p>The other type of transaction is where the output a reward transaction is then transferred to another person, (or the output of a chain of transactions is transferred). So let's say Bob has perfectly valid bitcoins, and Alice wants to claim that Bob has transferred them to her. There are two main ways she can do this. One is she can just declare that Bob has done so, without any verification. This then puts her in the same situation as above. The other strategy is to fake the verification. This is where one-way functions come in again. Bob has a secret key that he uses to sign his transactions. Signing a transaction, if you know that key, can be done in polynomial time. Checking that a transaction has been signed can be done in polynomial time. But signing the transaction without the key cannot be done in polynomial time. So Alice is going to have to use an astronomically large amount of resources to fake the transaction. Even if she had all the computing power in the world, the probability of her finding a solution would for all practical purposes will be zero. She would be better off applying that computing power to mining <em>real</em> bitcoin.</p>

CC BY-SA 4.0
2018-06-11T15:46:20.130Z
Mining in Bitcoin is hard but not NP-complete.  While mining in Bitcoin is indeed a situation where it's easier to check the solution than to find it from scratch, NP-complete has a specific technical meaning, and Bitcoin mining doesn't qualify.
D.W.
CC BY-SA 4.0
2018-06-12T00:19:13.583Z
Just one question: say a miner adds a fake transaction between 2 persons. I understand know that the validation of this transaction will fail due it's wrong signature (we are supposing obviously that the sender wasn't the one signing the transaction). When does the validation get triggered? Is it that all nodes validate all transactions within a block when they receive one?
jscherman
CC BY-SA 4.0
2018-06-11T15:37:43.520Z
2018-06-11T15:57:01.377Z
2018-06-11T15:57:01.377Z
Acccumulation
<blockquote>
  <p>Suppose Alice wants to add a fake transaction where she receives X ammount of BTC. I understand that in order to add that transaction to the blockchain she would have to compete against all the other miners to generate the next block, which makes it improbable to happen as an individual against them.</p>
</blockquote>

<p>No, that isn't correct.  No matter how much mining power she has, or how many miners she cooperates with, she can't add a fake transaction to the blockchain.</p>

<p>It's a common misconception that miners are solely responsible for determining whether or not a transaction is valid, and if they say it is, then everyone else accepts it.  In fact, anyone who runs a Bitcoin full node (e.g. Bitcoin Core) is automatically checking whether each transaction is valid (spends money from a previous valid and unspent transaction, properly signed, etc).  If a miner attempts to include an invalid transaction in a block, this will be detected and their entire block will be ignored by everybody, effectively meaning that they don't get their mining reward.</p>

<p>With enough mining power, or the cooperation of a pool, Alice could create a block with her fake transaction.  But nobody in the world will consider it as valid or accept it as part of the blockchain.  If she tries to spend the proceeds of that transaction, say by sending those coins to Bob in exchange for some goods, Bob's software will simply ignore it.  He'll think that Alice just hasn't paid at all, and won't send her any goods.  So the whole exercise would be a giant waste of Alice's time and resources, without gaining her anything or harming anyone else.</p>

<p>The only special authority that miners have is this: if there are two or more <em>otherwise valid</em> transactions which are in conflict with one another, then miners get to decide which one (or none) goes into the blockchain, thus <em>confirming</em> it.  But they can't confirm a transaction that was never valid in the first place.</p>

<p>A large amount of mining power, or a pool, could help Alice perform a <em>double spend attack</em>, where a <em>valid and confirmed</em> transaction is later replaced in the blockchain with a different <em>valid</em> transaction.  The first one might have gone to Bob, who would have sent some goods, and the second one could effectively take the money back from Bob and return it from Alice, who now has the money and the goods.  But the second transaction is one that Alice could have created all along (of course she can send her own money to herself); it isn't "fake".</p>

CC BY-SA 4.0
2018-06-11T04:38:13.277Z
What do you mean by "if there are two or more otherwise valid transactions which are in conflict with one another". Also, i understand it know that the fake transaction would be invalid if they come from another account but, would that apply to altering the reward too? What would be the invalid part of this last transaction?
jscherman
CC BY-SA 4.0
2018-06-11T05:07:46.030Z
@jscherman: For example, say Alice has received 1 bitcoin.  She could create a transaction which sends it to Bob (spending the specific [unspent output](https://bitcoin.stackexchange.com/questions/4301/what-is-an-unspent-output) from the transaction sent to her).  Or she could create a transaction that sends it to Charlie.  Either of these by itself would be fine.  She could also create both, but only one of them can go in the blockchain, since the blockchain is forbidden to contain two transactions spending the same output.
Nate Eldredge
CC BY-SA 4.0
2018-06-11T05:08:22.900Z
If she puts both transactions on the peer-to-peer network, more or less simultaneously, then miners will decide which of the two gets confirmed; whether Bob gets paid or Charlie does.
Nate Eldredge
CC BY-SA 4.0
2018-06-11T05:10:53.270Z
@jscherman: Re your second question, in the case of a "coinbase" transaction which pays out a miner's rewards, one of the checks done by every full node is that the amount of the reward is appropriate given the reward schedule specified by the protocol.  If not, they consider the block invalid and ignore it.
Nate Eldredge
CC BY-SA 4.0
2018-06-11T05:12:00.653Z
If you mean to take an existing block and alter who the reward is paid to, this will be noticed because a hash of the transaction is (indirectly) in the block header. And if you change the header then the proof-of-work doesn't match and you'll have to redo the work to mine the block, so you don't gain anything.
Nate Eldredge
CC BY-SA 4.0
2018-06-11T20:10:34.477Z
This answer seems to reaffirm that btc.com cannot create fake transactions, but it begins with "everybody detects fakes immediately, hence none can be inserted". I think it would be very much improved if the mechanism by which fakes are detectable was explained.
AnoE
CC BY-SA 4.0
2018-06-11T21:40:41.767Z
@AnoE: I added some links where you can read more about the exact checks that are done.
Nate Eldredge
CC BY-SA 4.0
2018-06-11T04:13:12.303Z
2018-06-11T04:19:58.107Z
2018-06-11T04:19:58.107Z
Nate Eldredge
<p>Suppose Alice wants to add a fake transaction where she receives <em>X</em> ammount of <em>BTC</em>. I understand that in order to add that transaction to the blockchain she would have to compete against all the other miners to generate the next block, which makes it improbable to happen as an individual against them.</p>

<p>Now, if we take a look at the next figure (taken from <a href="https://blockchain.info/es/pools" rel="noreferrer">blockchain.info</a>) which shows the mining pools with highest hash rate at the network:</p>

<p><a href="https://i.sstatic.net/beMGx.png" rel="noreferrer"><img src="https://i.sstatic.net/beMGx.png" alt="enter image description here"></a></p>

<p>we see that, for instance, the mining pool <strong>BTC.com</strong> has 26.4% hash rate of the network, and thus comes my question: <strong>Why can't all the miners at this pool make an agreement by adding fake transactions to all the blocks they generate?</strong> Differently than the previous case, where Alice was an individual with almost no chance to generate a an altered block, the pool could make it very likely.</p>

<bitcoin-core><blockchain><mining-pools><attack>
Why can't mining pools provide fake transactions within the generated blocks?
jscherman
# Why can't mining pools provide fake transactions within the generated blocks?

(Asked by: username_0 on 2018-06-11)

Suppose Alice wants to add a fake transaction where she receives *X* ammount of *BTC*. I understand that in order to add that transaction to the blockchain she would have to compete against all the other miners to generate the next block, which makes it improbable to happen as an individual against them.

Now, if we take a look at the next figure (taken from [blockchain.info](https://blockchain.info/es/pools)) which shows the mining pools with highest hash rate at the network:

[![enter image description here](https://i.sstatic.net/beMGx.png)](https://i.sstatic.net/beMGx.png)

we see that, for instance, the mining pool **BTC.com** has 26.4% hash rate of the network, and thus comes my question: **Why can't all the miners at this pool make an agreement by adding fake transactions to all the blocks they generate?** Differently than the previous case, where Alice was an individual with almost no chance to generate a an altered block, the pool could make it very likely.

**Tags:** bitcoin-core, blockchain, mining-pools, attack


---

## 3 answers

### Answer by username_4 on 2018-06-11. Score: 20 | Accepted answer

> Suppose Alice wants to add a fake transaction where she receives X ammount of BTC. I understand that in order to add that transaction to the blockchain she would have to compete against all the other miners to generate the next block, which makes it improbable to happen as an individual against them.

No, that isn't correct. No matter how much mining power she has, or how many miners she cooperates with, she can't add a fake transaction to the blockchain.

It's a common misconception that miners are solely responsible for determining whether or not a transaction is valid, and if they say it is, then everyone else accepts it. In fact, anyone who runs a Bitcoin full node (e.g. Bitcoin Core) is automatically checking whether each transaction is valid (spends money from a previous valid and unspent transaction, properly signed, etc). If a miner attempts to include an invalid transaction in a block, this will be detected and their entire block will be ignored by everybody, effectively meaning that they don't get their mining reward.

With enough mining power, or the cooperation of a pool, Alice could create a block with her fake transaction. But nobody in the world will consider it as valid or accept it as part of the blockchain. If she tries to spend the proceeds of that transaction, say by sending those coins to Bob in exchange for some goods, Bob's software will simply ignore it. He'll think that Alice just hasn't paid at all, and won't send her any goods. So the whole exercise would be a giant waste of Alice's time and resources, without gaining her anything or harming anyone else.

The only special authority that miners have is this: if there are two or more *otherwise valid* transactions which are in conflict with one another, then miners get to decide which one (or none) goes into the blockchain, thus *confirming* it. But they can't confirm a transaction that was never valid in the first place.

A large amount of mining power, or a pool, could help Alice perform a *double spend attack*, where a *valid and confirmed* transaction is later replaced in the blockchain with a different *valid* transaction. The first one might have gone to Bob, who would have sent some goods, and the second one could effectively take the money back from Bob and return it from Alice, who now has the money and the goods. But the second transaction is one that Alice could have created all along (of course she can send her own money to herself); it isn't "fake".

> **Comments:**
> **username_0**: What do you mean by "if there are two or more otherwise valid transactions which are in conflict with one another". Also, i understand it know that the fake transaction would be invalid if they come from another account but, would that apply to altering the reward too? What would be the invalid part of this last transaction?  
> **username_4**: @username_0: For example, say Alice has received 1 bitcoin.  She could create a transaction which sends it to Bob (spending the specific [unspent output](https://bitcoin.stackexchange.com/questions/4301/what-is-an-unspent-output) from the transaction sent to her).  Or she could create a transaction that sends it to Charlie.  Either of these by itself would be fine.  She could also create both, but only one of them can go in the blockchain, since the blockchain is forbidden to contain two transactions spending the same output.  
> **username_4**: If she puts both transactions on the peer-to-peer network, more or less simultaneously, then miners will decide which of the two gets confirmed; whether Bob gets paid or Charlie does.  
> **username_4**: @username_0: Re your second question, in the case of a "coinbase" transaction which pays out a miner's rewards, one of the checks done by every full node is that the amount of the reward is appropriate given the reward schedule specified by the protocol.  If not, they consider the block invalid and ignore it.  
> **username_4**: If you mean to take an existing block and alter who the reward is paid to, this will be noticed because a hash of the transaction is (indirectly) in the block header. And if you change the header then the proof-of-work doesn't match and you'll have to redo the work to mine the block, so you don't gain anything.  
> **username_5**: This answer seems to reaffirm that btc.com cannot create fake transactions, but it begins with "everybody detects fakes immediately, hence none can be inserted". I think it would be very much improved if the mechanism by which fakes are detectable was explained.  
> **username_4**: @username_5: I added some links where you can read more about the exact checks that are done.  

---

### Answer by username_1 on 2018-06-11. Score: 4

What you need to understand is that, fundamentally, miners - and other nodes on the network - can broadcast whatever the heck they want. What matters is not what they broadcast, but what other nodes accept.

Full nodes verify that all transactions on the network are valid according to the protocol rules. And one of those protocol rules is that coins can't materialize arbitrarily. For a tx to be valid, its inputs must total at least as much as the outputs; and the inputs are either unspent outputs of previous transactions, or newly minted coins in the block's coinbase.

If the coins come from previous outputs, the transaction must be signed with the private keys corresponding to the owner public key hash. The miner can include as many "fake transactions" as it wants in the block, but without the appropriate digital signatures, no node will accept the block as valid, and no merchant will recognize that they have received coins for the purposes of offering a service.


---

### Answer by username_2 on 2018-06-11. Score: 2

One of the concepts that is fundamental to bitcoin is the concept "one-way functions", which allow the creation of a problem for which finding a solution takes massively more resources than checking whether a proposed solution is valid.

It's a bit unclear as to what you mean by "fake transaction". Transactions on the bitcoin network can be categorized into two groups. First, there are "reward" transactions, in which a miner simply declares that they have received a certain amount of bitcoin, out of nowhere, as a reward for completing a block. For this to be accepted by the network, they have to prove that they actually complete a valid block. The only interpretation I can think of for a "fake" reward transaction is for Alice to simply declare that she has been given a reward, without creating a valid block. She can then try to spend that reward by providing it to other people in exchange for goods and services. The recipient will then, presumably, check to see whether the transaction is valid. This is where one-way functions come in: anyone accepting bitcoin can efficiently check whether Alice's reward transaction satisfies bitcoin's validity conditions. Whether Alice's alleged "bitcoins" are worth anything depends on whether she can get anyone to exchange goods and services for them. If she can find someone who isn't bothering to check whether she has valid bitcoin, or is willing to accept whatever validity criterion she is proposing, then she will be able to "spend" her "bitcoin". But that isn't really an issue for the bitcoin network, any more than a casino getting people to accept their casino chips as "money" is an issue for the US dollar. Alice's "bitcoin" will be clearly distinguishable from "real" bitcoin by anyone running standard bitcoin software. What miners say is a valid bitcoin transaction is irrelevant: if you want someone to take your bitcoin, what matters is what *they* say is valid.

The other type of transaction is where the output a reward transaction is then transferred to another person, (or the output of a chain of transactions is transferred). So let's say Bob has perfectly valid bitcoins, and Alice wants to claim that Bob has transferred them to her. There are two main ways she can do this. One is she can just declare that Bob has done so, without any verification. This then puts her in the same situation as above. The other strategy is to fake the verification. This is where one-way functions come in again. Bob has a secret key that he uses to sign his transactions. Signing a transaction, if you know that key, can be done in polynomial time. Checking that a transaction has been signed can be done in polynomial time. But signing the transaction without the key cannot be done in polynomial time. So Alice is going to have to use an astronomically large amount of resources to fake the transaction. Even if she had all the computing power in the world, the probability of her finding a solution would for all practical purposes will be zero. She would be better off applying that computing power to mining *real* bitcoin.

> **Comments:**
> **username_3**: Mining in Bitcoin is hard but not NP-complete.  While mining in Bitcoin is indeed a situation where it's easier to check the solution than to find it from scratch, NP-complete has a specific technical meaning, and Bitcoin mining doesn't qualify.  
> **username_0**: Just one question: say a miner adds a fake transaction between 2 persons. I understand know that the validation of this transaction will fail due it's wrong signature (we are supposing obviously that the sender wasn't the one signing the transaction). When does the validation get triggered? Is it that all nodes validate all transactions within a block when they receive one?  

---

