<p>You can fake an entire history of transactions and blocks perfectly, but unless you can get a majority of clients approved it's useless.</p>

<p>I'm not sure majority is defined as 51%, because there crypto is more complicated then that.</p>

<p>But look up how transactions get verified</p>

<p><a href="https://en.bitcoin.it/wiki/Transactions" rel="nofollow">https://en.bitcoin.it/wiki/Transactions</a></p>

<p>So, basically it depends on the lower level procedures which decide which clients to confirm against and you'd need to get majority of those just to fool your client.</p>

<p>Because when an error is detected they all start communicating it</p>

CC BY-SA 3.0
2013-12-26T06:35:20.593Z
I don't think this answers my question.  As far as I know, the steps described in the Wiki page on Transactions are *not* all done for transactions found in bootstrap.dat.
Nate Eldredge
CC BY-SA 3.0
2013-12-04T20:06:39.837Z
2013-12-04T20:06:39.837Z
Meterbuchus
<p>The standard Bitcoin client normally needs to download the entire blockchain from the p2p network when first installed, but a shortcut is to provide it with a snapshot of the blockchain (at some point in time) in a file called <code>bootstrap.dat</code>.  One can get this file from various sites and file sharing mechanisms such as BitTorrent.</p>

<p>My understanding is that the blocks taken from <code>bootstrap.dat</code> are not subjected to all the same checks as those downloaded from the p2p network (see <a href="https://bitcoin.stackexchange.com/questions/17365/what-exactly-is-checked-at-various-checklevels">this question</a>).  Therefore, an attacker might be able to get you to accept some invalid blocks by giving you a malicious <code>bootstrap.dat</code>.  What, if anything, could they accomplish in this way?</p>

<p>For instance, if signatures are not verified for transactions coming from <code>bootstrap.dat</code>, the attacker might include a bogus transaction appearing to send a bunch of coins to one of their addresses.  They could then convince you that they hold more coins than they actually do.  But it's not clear how useful that would be; if they actually try to send you those nonexistent coins in payment for something, your client might believe the transaction is valid, but miners won't be fooled and the transaction will never confirm.</p>

<p>Are there other attacks I have not thought of?</p>

<blockchain><bitcoin-core><attack><bootstrap.dat>
What attacks are possible with a malicious bootstrap.dat?
Nate Eldredge
# What attacks are possible with a malicious bootstrap.dat?

(Asked by: username_0 on 2013-12-04)

The standard Bitcoin client normally needs to download the entire blockchain from the p2p network when first installed, but a shortcut is to provide it with a snapshot of the blockchain (at some point in time) in a file called `bootstrap.dat`. One can get this file from various sites and file sharing mechanisms such as BitTorrent.

My understanding is that the blocks taken from `bootstrap.dat` are not subjected to all the same checks as those downloaded from the p2p network (see [this question](https://bitcoin.stackexchange.com/questions/17365/what-exactly-is-checked-at-various-checklevels)). Therefore, an attacker might be able to get you to accept some invalid blocks by giving you a malicious `bootstrap.dat`. What, if anything, could they accomplish in this way?

For instance, if signatures are not verified for transactions coming from `bootstrap.dat`, the attacker might include a bogus transaction appearing to send a bunch of coins to one of their addresses. They could then convince you that they hold more coins than they actually do. But it's not clear how useful that would be; if they actually try to send you those nonexistent coins in payment for something, your client might believe the transaction is valid, but miners won't be fooled and the transaction will never confirm.

Are there other attacks I have not thought of?

**Tags:** blockchain, bitcoin-core, attack, bootstrap.dat


---

## 1 answers

### Answer by username_1 on 2013-12-04. Score: 1

You can fake an entire history of transactions and blocks perfectly, but unless you can get a majority of clients approved it's useless.

I'm not sure majority is defined as 51%, because there crypto is more complicated then that.

But look up how transactions get verified

<https://en.bitcoin.it/wiki/Transactions>

So, basically it depends on the lower level procedures which decide which clients to confirm against and you'd need to get majority of those just to fool your client.

Because when an error is detected they all start communicating it

> **Comments:**
> **username_0**: I don't think this answers my question.  As far as I know, the steps described in the Wiki page on Transactions are *not* all done for transactions found in bootstrap.dat.  

---

