<p>I'll answer the middle question from the <a href="https://github.com/ethereum/wiki/wiki/White-Paper" rel="nofollow">White Paper</a>. Bitcoin can allow simple scripting and a weak version of smart contracts. The scripting that you can do has these limitations (quoting from the white paper, where UTXO means "unspent transaction outputs")</p>

<blockquote>
  <p><strong>Lack of <a href="https://en.wikipedia.org/wiki/Turing_completeness" rel="nofollow">Turing-completeness</a></strong> - that is to say, while there is a large subset of computation that the Bitcoin scripting language
  supports, it does not nearly support everything. The main category
  that is missing is loops. This is done to avoid infinite loops during
  transaction verification; theoretically it is a surmountable obstacle
  for script programmers, since any loop can be simulated by simply
  repeating the underlying code many times with an if statement, but it
  does lead to scripts that are very space-inefficient. For example,
  implementing an alternative elliptic curve signature algorithm would
  likely require 256 repeated multiplication rounds all individually
  included in the code.</p>
  
  <p><strong>Value-blindness</strong> - there is no way for a UTXO script to provide fine-grained control over the amount that can be withdrawn. For
  example, one powerful use case of an oracle contract would be a
  hedging contract, where A and B put in $1000 worth of BTC and after 30
  days the script sends $1000 worth of BTC to A and the rest to B. This
  would require an oracle to determine the value of 1 BTC in USD, but
  even then it is a massive improvement in terms of trust and
  infrastructure requirement over the fully centralized solutions that
  are available now. However, because UTXO are all-or-nothing, the only
  way to achieve this is through the very inefficient hack of having
  many UTXO of varying denominations (eg. one UTXO of 2k for every k up
  to 30) and having O pick which UTXO to send to A and which to B.</p>
  
  <p><strong>Lack of state</strong> - UTXO can either be spent or unspent; there is no opportunity for multi-stage contracts or scripts which keep any other
  internal state beyond that. This makes it hard to make multi-stage
  options contracts, decentralized exchange offers or two-stage
  cryptographic commitment protocols (necessary for secure computational
  bounties). It also means that UTXO can only be used to build simple,
  one-off contracts and not more complex "stateful" contracts such as
  decentralized organizations, and makes meta-protocols difficult to
  implement. Binary state combined with value-blindness also mean that
  another important application, withdrawal limits, is impossible.</p>
  
  <p><strong>Blockchain-blindness</strong> - UTXO are blind to blockchain data such as the nonce, the timestamp and previous block hash. This severely limits
  applications in gambling, and several other categories, by depriving
  the scripting language of a potentially valuable source of randomness.</p>
</blockquote>

<p>Ethereum is designed for contracts and in fact implements a Turing-complete virtual machine on the blockchain.</p>

CC BY-SA 3.0
2015-10-28T06:54:08.503Z
Could you please elaborate on that? What does it mean to be "a Turing-complete virtual machine on the blockchain"? What does "Value Blindness" mean? What does "Blockchain blindness" mean? Where does the state lack (I mean, obviously the system as a whole has the state which bitcoin belongs to whom, doesn't it)?
Martin Thoma
CC BY-SA 3.0
2015-10-28T10:44:15.737Z
I've quoted from the white paper. Is there anything still unclear?
paulmorriss
CC BY-SA 3.0
2015-11-03T23:36:52.500Z
This is helpful, however I was hoping for a more abstract (hopefully balanced) assessment of the two. This post only answers part of my question and is somewhat biased due to mostly quoting one of the white papers. E.g. it would be interesting to read an assessment whether Turing Completeness is an advantage when including the security implications.
Murch
CC BY-SA 4.0
2018-07-12T08:46:09.523Z
Actually there are primitive loops. They achieve safety by the inefficiency of the code size: https://files.acrobat.com/a/preview/0981025b-60e3-4bb3-bd2b-c0d5241e181d
MCCCS
CC BY-SA 3.0
2015-10-02T12:41:24.683Z
2015-10-28T10:43:41.933Z
2015-10-28T10:43:41.933Z
paulmorriss
<p>What advantages and disadvantages does Ethereum have over Bitcoin? What can you do with Ethereum that you simply cannot with Bitcoin? What price do you pay for these additional functionalities? </p>

<ethereum>
What advantages and disadvantages does Ethereum have over Bitcoin?
Murch
# What advantages and disadvantages does Ethereum have over Bitcoin?

(Asked by: username_0 on 2015-09-04)

What advantages and disadvantages does Ethereum have over Bitcoin? What can you do with Ethereum that you simply cannot with Bitcoin? What price do you pay for these additional functionalities?

**Tags:** ethereum


---

## 1 answers

### Answer by username_1 on 2015-10-02. Score: 4

I'll answer the middle question from the [White Paper](https://github.com/ethereum/wiki/wiki/White-Paper). Bitcoin can allow simple scripting and a weak version of smart contracts. The scripting that you can do has these limitations (quoting from the white paper, where UTXO means "unspent transaction outputs")

> **Lack of [Turing-completeness](https://en.wikipedia.org/wiki/Turing_completeness)** - that is to say, while there is a large subset of computation that the Bitcoin scripting language
> supports, it does not nearly support everything. The main category
> that is missing is loops. This is done to avoid infinite loops during
> transaction verification; theoretically it is a surmountable obstacle
> for script programmers, since any loop can be simulated by simply
> repeating the underlying code many times with an if statement, but it
> does lead to scripts that are very space-inefficient. For example,
> implementing an alternative elliptic curve signature algorithm would
> likely require 256 repeated multiplication rounds all individually
> included in the code.
>
> **Value-blindness** - there is no way for a UTXO script to provide fine-grained control over the amount that can be withdrawn. For
> example, one powerful use case of an oracle contract would be a
> hedging contract, where A and B put in $1000 worth of BTC and after 30
> days the script sends $1000 worth of BTC to A and the rest to B. This
> would require an oracle to determine the value of 1 BTC in USD, but
> even then it is a massive improvement in terms of trust and
> infrastructure requirement over the fully centralized solutions that
> are available now. However, because UTXO are all-or-nothing, the only
> way to achieve this is through the very inefficient hack of having
> many UTXO of varying denominations (eg. one UTXO of 2k for every k up
> to 30) and having O pick which UTXO to send to A and which to B.
>
> **Lack of state** - UTXO can either be spent or unspent; there is no opportunity for multi-stage contracts or scripts which keep any other
> internal state beyond that. This makes it hard to make multi-stage
> options contracts, decentralized exchange offers or two-stage
> cryptographic commitment protocols (necessary for secure computational
> bounties). It also means that UTXO can only be used to build simple,
> one-off contracts and not more complex "stateful" contracts such as
> decentralized organizations, and makes meta-protocols difficult to
> implement. Binary state combined with value-blindness also mean that
> another important application, withdrawal limits, is impossible.
>
> **Blockchain-blindness** - UTXO are blind to blockchain data such as the nonce, the timestamp and previous block hash. This severely limits
> applications in gambling, and several other categories, by depriving
> the scripting language of a potentially valuable source of randomness.

Ethereum is designed for contracts and in fact implements a Turing-complete virtual machine on the blockchain.

> **Comments:**
> **username_2**: Could you please elaborate on that? What does it mean to be "a Turing-complete virtual machine on the blockchain"? What does "Value Blindness" mean? What does "Blockchain blindness" mean? Where does the state lack (I mean, obviously the system as a whole has the state which bitcoin belongs to whom, doesn't it)?  
> **username_1**: I've quoted from the white paper. Is there anything still unclear?  
> **username_0**: This is helpful, however I was hoping for a more abstract (hopefully balanced) assessment of the two. This post only answers part of my question and is somewhat biased due to mostly quoting one of the white papers. E.g. it would be interesting to read an assessment whether Turing Completeness is an advantage when including the security implications.  
> **username_3**: Actually there are primitive loops. They achieve safety by the inefficiency of the code size: https://files.acrobat.com/a/preview/0981025b-60e3-4bb3-bd2b-c0d5241e181d  

---

