<p>You can't trust pure SPV for any Bitcoin 2.0 protocols, because of the 'metadata faking' issue that you outline. You have a few options:</p>

<ul>
<li>Accept you need to run a full node to backtrack through transactions. (Though note that this will not scale well anyway for popular assets.)</li>
<li>Use a blockchain that has native support for assets, like <a href="https://github.com/ElementsProject/elementsproject.github.io" rel="nofollow">Sidechain Elements</a> or <a href="http://www.multichain.com/" rel="nofollow">MultiChain</a>.</li>
<li>Use some kind of external service to track assets, like the <a href="http://docs.coinprism.apiary.io/" rel="nofollow">CoinPrism API</a> for Open Assets or CoinSpark's <a href="http://coinspark.org/create-asset/asset-tracking-server/" rel="nofollow">federated asset tracking</a> model.</li>
</ul>

CC BY-SA 3.0
2015-07-16T07:08:58.880Z
2015-07-16T07:08:58.880Z
Gideon Greenspan
<p>I was reading over the specification for the <a href="https://github.com/OpenAssets/open-assets-protocol/blob/master/specification.mediawiki" rel="nofollow">Open Assets</a> (colored coins) protocol. It seems that keeping track of Asset ownership requires looking up the <code>scriptPubKey</code> for each input in a transaction, and possibly even recursively looking up the prevouts for inputs, in order to verify the chain of ownership. Full nodes can do this, as they process all blockchain data.</p>

<p>However, it's possible to make a transaction that looks like a valid Open Assets transaction, but that breaks the link in ownership somewhere along the way. More confirmations won't help convince SPV nodes that the transaction is a valid OA transaction, as miners do not enforce that all transactions structured as OA transactions are actually valid.</p>

<p>Can SPV nodes participate in the Open Asset protocol with any reasonable security?</p>

<colored-coins><open-assets>
How can SPV nodes trust received Open Assets?
morsecoder
# How can SPV nodes trust received Open Assets?

(Asked by: username_0 on 2015-07-13)

I was reading over the specification for the [Open Assets](https://github.com/OpenAssets/open-assets-protocol/blob/master/specification.mediawiki) (colored coins) protocol. It seems that keeping track of Asset ownership requires looking up the `scriptPubKey` for each input in a transaction, and possibly even recursively looking up the prevouts for inputs, in order to verify the chain of ownership. Full nodes can do this, as they process all blockchain data.

However, it's possible to make a transaction that looks like a valid Open Assets transaction, but that breaks the link in ownership somewhere along the way. More confirmations won't help convince SPV nodes that the transaction is a valid OA transaction, as miners do not enforce that all transactions structured as OA transactions are actually valid.

Can SPV nodes participate in the Open Asset protocol with any reasonable security?

**Tags:** colored-coins, open-assets


---

## 1 answers

### Answer by username_1 on 2015-07-16. Score: 3 | Accepted answer

You can't trust pure SPV for any Bitcoin 2.0 protocols, because of the 'metadata faking' issue that you outline. You have a few options:

* Accept you need to run a full node to backtrack through transactions. (Though note that this will not scale well anyway for popular assets.)
* Use a blockchain that has native support for assets, like [Sidechain Elements](https://github.com/ElementsProject/elementsproject.github.io) or [MultiChain](http://www.multichain.com/).
* Use some kind of external service to track assets, like the [CoinPrism API](http://docs.coinprism.apiary.io/) for Open Assets or CoinSpark's [federated asset tracking](http://coinspark.org/create-asset/asset-tracking-server/) model.


---

