<p>Because they're not <em>known</em>.</p>
<p>This may sound surprising, but you have to realize that Bitcoin's consensus rules are defined by what (economically relevant) full nodes actually enforce. We can assume at this point that that is mostly various versions of Bitcoin Core, and derived projects, but that may change over time.</p>
<p>However, they are certainly not defined by some document that people blessed into being the rules. Even if we would somehow create such a document, and everyone would agree to it, what would happen if we realized that there was a bug in actual implementations? In that case, you could call the implementation buggy, but you can't just change it. Any (uncoordinated) change to implementations could result in them ending up in their own fork, resulting in all preexisting coins being spendable twice on each side (the precise thing the blockchain was designed to prevent). Thus, in such a situation there would be no choice but to change the document. Essentially, Bitcoin's consensus rules can be <em>described</em>, but not <em>prescribed</em>.</p>
<p>All of the above is to illustrate that it is not sufficient to replicate any specific <em>intended</em> behaviour; you must mimic the <em>exact</em> behaviour of existing software. You must:</p>
<ul>
<li>Accept every valid block, but also reject every edge case exactly that causes rejection.</li>
<li>Guarantee that nodes can find each other.</li>
<li>Guarantee that nodes continue to download blocks from each other in various circumstances.</li>
<li>Prevent transitive disconnects/bans (A should not be able to relay a block to B – which possibly runs different software – in such a way that when B relays it to C, C disconnects or bans B).</li>
<li>Take performance considerations into account. If a block or transaction can be constructed that takes a significant amount of time to validate, you simplify selfish mining attacks. If validation time can be caused to take close to the block interval time (10 minutes), convergence across the network may fail entirely.</li>
</ul>
<p>Even worse, all of these properties must be maintained under adversarial circumstances. Blocks may not only contain randomly stumbled-upon edge cases; people may actively try to trigger them.</p>
<p>Mimicking the behaviour of software exactly is a very hard problem. While there is some progress in the field of provably correct software (which includes proving equivalence between two programs), it is nowhere near advanced enough to apply to something like Bitcoin's consensus rules. As a result, the only approach for replication is reimplementing the rules as you believe they are implemented already, without strong methods to guarantee you're right.</p>
<p>In short, in order to replicate the behaviour, you must know the existing behaviour. And history has shown that in many cases, the existing behaviour is not exactly known:</p>
<ul>
<li><p><strong>The OP_CHECKMULTISIG redundant stack pop.</strong> This one has been known for a long time, but it probably was not known in the first months or even years of Bitcoin's history. The OP_CHECKMULTISIG opcode pops one more element off the stack than needed. People have worked around it by pushing an extra OP_0 when spending a multisig output. <a href="https://github.com/bitcoin/bips/blob/master/bip-0147.mediawiki" rel="nofollow noreferrer">BIP 147</a> has been proposed to require that to be an OP_0 even. In Bitcoin's early days, a reimplementer would likely have incorrectly replicated this.</p>
</li>
<li><p><strong>Compressed and hybrid public keys.</strong> According to various specifications, secp256k1 public keys can be encoded in uncompressed, compressed or hybrid formats. Bitcoin initially only used uncompressed keys (comments in the source code indicate that the original author of the software was not aware of compressed keys), but as every node at the time was using OpenSSL for validation, people were able to just start using compressed keys and the network accepted them. In this case, an unknown part of the rules was 'abused' for an improvement.</p>
</li>
<li><p><strong>OP_SIZE does not pop the stack.</strong> All opcodes that inspect a stack element also pop that element. There is one exception to this (OP_SIZE), which at least one reimplementation got wrong.</p>
</li>
<li><p><strong>The distinction between signature validation failure and script execution failure.</strong> Some reimplementations have initially treated signature failures as script failures (which is a correct assumption for almost all scripts, but not all). Consider a script of the form <code>&lt;pubkey&gt; OP_CHECKSIG OP_NOT</code>. This is a script that consumes one signature from the stack, and requires a signature that is <em>invalid</em> in order to pass.</p>
</li>
<li><p><strong>Serialized size vs. normative size.</strong> Various resource limitations exist on the size of blocks, transactions, scripts, ... However, these sizes are defined in terms of the number of bytes that would be produced by serializing the data structure. Sometimes, multiple valid serializations used to exist. At least one reimplementation for a period of time used the size of a block – as sent on the wire – to check against the block size limit. However, a 999999 byte block could have been sent using a longer-than-necessary serialization of the number of transactions in it, resulting in perhaps 1000001 bytes. This is a valid block, but the reimplementation would reject it.</p>
</li>
<li><p><strong>OpenSSL's inconsistent DER parser.</strong> OpenSSL used to support signatures encoded using various deviations from the DER standard, often with arbitrary restrictions and weird differences (an integer could be encoded as a struct containing an integer), implemented in thousands of lines of hard to read C code. At the time, every reimplementation that did not use OpenSSL could have been trivially forked off by creating a transaction that abused one of those weird deviations. This is a very good example, as it is likely that nobody ever exactly knew what OpenSSL accepted and didn't. This was eventually fixed by BIP66 which made signature parsing much more restrictive, and allowed us to move away from OpenSSL after it became a network rule.</p>
</li>
<li><p><strong>OpenSSL signature parser inconsistency.</strong> The OpenSSL signature parsing story goes further: it was discovered that one of its permitted DER deviations was platform dependent. A particular length descriptor was allowed to be up to 4 bytes on 32-bit systems and 64-bit Windows, and up to 8 bytes on others. This resulted in Bitcoin Core instances on different platforms to be inconsistent with each other even, much less be consistent with reimplementations at the time. This discovery was indirectly fixed by BIP66 as well, by requiring that the shortest possible length descriptor be used. The full timeline is in <a href="https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-July/009697.html" rel="nofollow noreferrer">this disclosure</a>.</p>
</li>
<li><p><strong>The BDB lock limit.</strong> Early versions of Bitcoin Core (before it was called that way), up to version 0.7.x, used a chainstate database implemented in BDB. BDB is a multi-process database environment (something we don't need) that needs a preallocated number of locks to prevent concurrent access to records and deadlock detection. Turns out that the number of locks chosen was mostly enough for processing Bitcoin blocks, until one unfortunate block on March 11th 2013. This was a block with a remarkably large number of inputs (and few outputs), resulting in way more transaction records in the database model of that time being affected. The preconfigured number of locks was exceeded, the database operation failed, and Bitcoin was unable to process that block. As a result, a fork appeared. It was compounded by the fact that many miners had already upgraded to version 0.8.0 (which used LevelDB and no longer had this lock limitation), while many other nodes had not. More information can be found in the post mortem document <a href="https://github.com/bitcoin/bips/blob/master/bip-0050.mediawiki" rel="nofollow noreferrer">BIP50</a>.</p>
</li>
<li><p>... Who knows which things we don't know about yet?</p>
</li>
</ul>

CC BY-SA 4.0
2023-01-03T14:39:03.703Z
For additional reading/listening Pieter discussed this on the Chaincode Labs podcast: https://btctranscripts.com/chaincode-labs/chaincode-podcast/2020-01-28-pieter-wuille/ And Christopher Jeffrey discussed it at SF Bitcoin Devs: https://btctranscripts.com/sf-bitcoin-meetup/2016-09-28-christopher-jeffrey-bcoin/
Michael Folkson
CC BY-SA 4.0
2023-01-03T23:52:34.317Z
As in many computer science problems, you can solve 99% of the problem and yet only have expended 1% of the necessary effort to solve the entire problem.
David Schwartz
CC BY-SA 4.0
2023-10-05T10:05:56.377Z
Maybe worth for someone to update this answer with the other reimplementation failures we've seen in the wild since it was written? For instance the BTCD witness deserialization bug (https://bitcoinops.org/en/newsletters/2022/10/19/?ref=nobsbitcoin.com) which led it to refuse a perfectly valid Bitcoin block.
Antoine Poinsot
CC BY-SA 4.0
2024-12-12T23:08:22.163Z
Another one. Self plug but figured it was worth sharing. Btcd did not reimplement `FindAndDelete` correctly. https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug
Antoine Poinsot
CC BY-SA 4.0
2024-12-12T23:10:20.910Z
Niklas Goegge also found a few bugs in the in-development libbitcoin v4 codebase where they decided to reimplement the Script interpreter from scratch: https://github.com/libbitcoin/libbitcoin-system/issues/1523 and https://github.com/libbitcoin/libbitcoin-system/issues/1526 .
Antoine Poinsot
CC BY-SA 4.0
2024-12-12T23:11:29.013Z
Another old one is a reimplementation bug in bitcoin-ruby discovered by Peter Todd: https://bitcointalk.org/index.php?topic=260595.0 .
Antoine Poinsot
CC BY-SA 4.0
2017-06-24T20:32:45.503Z
2023-11-06T09:57:44.863Z
2023-11-06T09:57:44.863Z
Pieter Wuille
<p>I understand that one can never be certain that an alt Bitcoin client is fully in consensus, but what is it about the consensus rules that makes them so hard to implement in other clients?</p>

<bitcoin-core><client><bitcoin-core-development><consensus>
Why is it so hard for alt clients to implement Bitcoin Core consensus rules?
murty
# Why is it so hard for alt clients to implement Bitcoin Core consensus rules?

(Asked by: username_0 on 2017-06-24)

I understand that one can never be certain that an alt Bitcoin client is fully in consensus, but what is it about the consensus rules that makes them so hard to implement in other clients?

**Tags:** bitcoin-core, client, bitcoin-core-development, consensus


---

## 1 answers

### Answer by username_1 on 2017-06-24. Score: 13 | Accepted answer

Because they're not *known*.

This may sound surprising, but you have to realize that Bitcoin's consensus rules are defined by what (economically relevant) full nodes actually enforce. We can assume at this point that that is mostly various versions of Bitcoin Core, and derived projects, but that may change over time.

However, they are certainly not defined by some document that people blessed into being the rules. Even if we would somehow create such a document, and everyone would agree to it, what would happen if we realized that there was a bug in actual implementations? In that case, you could call the implementation buggy, but you can't just change it. Any (uncoordinated) change to implementations could result in them ending up in their own fork, resulting in all preexisting coins being spendable twice on each side (the precise thing the blockchain was designed to prevent). Thus, in such a situation there would be no choice but to change the document. Essentially, Bitcoin's consensus rules can be *described*, but not *prescribed*.

All of the above is to illustrate that it is not sufficient to replicate any specific *intended* behaviour; you must mimic the *exact* behaviour of existing software. You must:

* Accept every valid block, but also reject every edge case exactly that causes rejection.
* Guarantee that nodes can find each other.
* Guarantee that nodes continue to download blocks from each other in various circumstances.
* Prevent transitive disconnects/bans (A should not be able to relay a block to B – which possibly runs different software – in such a way that when B relays it to C, C disconnects or bans B).
* Take performance considerations into account. If a block or transaction can be constructed that takes a significant amount of time to validate, you simplify selfish mining attacks. If validation time can be caused to take close to the block interval time (10 minutes), convergence across the network may fail entirely.

Even worse, all of these properties must be maintained under adversarial circumstances. Blocks may not only contain randomly stumbled-upon edge cases; people may actively try to trigger them.

Mimicking the behaviour of software exactly is a very hard problem. While there is some progress in the field of provably correct software (which includes proving equivalence between two programs), it is nowhere near advanced enough to apply to something like Bitcoin's consensus rules. As a result, the only approach for replication is reimplementing the rules as you believe they are implemented already, without strong methods to guarantee you're right.

In short, in order to replicate the behaviour, you must know the existing behaviour. And history has shown that in many cases, the existing behaviour is not exactly known:

* **The OP\_CHECKMULTISIG redundant stack pop.** This one has been known for a long time, but it probably was not known in the first months or even years of Bitcoin's history. The OP\_CHECKMULTISIG opcode pops one more element off the stack than needed. People have worked around it by pushing an extra OP\_0 when spending a multisig output. [BIP 147](https://github.com/bitcoin/bips/blob/master/bip-0147.mediawiki) has been proposed to require that to be an OP\_0 even. In Bitcoin's early days, a reimplementer would likely have incorrectly replicated this.
* **Compressed and hybrid public keys.** According to various specifications, secp256k1 public keys can be encoded in uncompressed, compressed or hybrid formats. Bitcoin initially only used uncompressed keys (comments in the source code indicate that the original author of the software was not aware of compressed keys), but as every node at the time was using OpenSSL for validation, people were able to just start using compressed keys and the network accepted them. In this case, an unknown part of the rules was 'abused' for an improvement.
* **OP\_SIZE does not pop the stack.** All opcodes that inspect a stack element also pop that element. There is one exception to this (OP\_SIZE), which at least one reimplementation got wrong.
* **The distinction between signature validation failure and script execution failure.** Some reimplementations have initially treated signature failures as script failures (which is a correct assumption for almost all scripts, but not all). Consider a script of the form `<pubkey> OP_CHECKSIG OP_NOT`. This is a script that consumes one signature from the stack, and requires a signature that is *invalid* in order to pass.
* **Serialized size vs. normative size.** Various resource limitations exist on the size of blocks, transactions, scripts, ... However, these sizes are defined in terms of the number of bytes that would be produced by serializing the data structure. Sometimes, multiple valid serializations used to exist. At least one reimplementation for a period of time used the size of a block – as sent on the wire – to check against the block size limit. However, a 999999 byte block could have been sent using a longer-than-necessary serialization of the number of transactions in it, resulting in perhaps 1000001 bytes. This is a valid block, but the reimplementation would reject it.
* **OpenSSL's inconsistent DER parser.** OpenSSL used to support signatures encoded using various deviations from the DER standard, often with arbitrary restrictions and weird differences (an integer could be encoded as a struct containing an integer), implemented in thousands of lines of hard to read C code. At the time, every reimplementation that did not use OpenSSL could have been trivially forked off by creating a transaction that abused one of those weird deviations. This is a very good example, as it is likely that nobody ever exactly knew what OpenSSL accepted and didn't. This was eventually fixed by BIP66 which made signature parsing much more restrictive, and allowed us to move away from OpenSSL after it became a network rule.
* **OpenSSL signature parser inconsistency.** The OpenSSL signature parsing story goes further: it was discovered that one of its permitted DER deviations was platform dependent. A particular length descriptor was allowed to be up to 4 bytes on 32-bit systems and 64-bit Windows, and up to 8 bytes on others. This resulted in Bitcoin Core instances on different platforms to be inconsistent with each other even, much less be consistent with reimplementations at the time. This discovery was indirectly fixed by BIP66 as well, by requiring that the shortest possible length descriptor be used. The full timeline is in [this disclosure](https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-July/009697.html).
* **The BDB lock limit.** Early versions of Bitcoin Core (before it was called that way), up to version 0.7.x, used a chainstate database implemented in BDB. BDB is a multi-process database environment (something we don't need) that needs a preallocated number of locks to prevent concurrent access to records and deadlock detection. Turns out that the number of locks chosen was mostly enough for processing Bitcoin blocks, until one unfortunate block on March 11th 2013. This was a block with a remarkably large number of inputs (and few outputs), resulting in way more transaction records in the database model of that time being affected. The preconfigured number of locks was exceeded, the database operation failed, and Bitcoin was unable to process that block. As a result, a fork appeared. It was compounded by the fact that many miners had already upgraded to version 0.8.0 (which used LevelDB and no longer had this lock limitation), while many other nodes had not. More information can be found in the post mortem document [BIP50](https://github.com/bitcoin/bips/blob/master/bip-0050.mediawiki).
* ... Who knows which things we don't know about yet?

> **Comments:**
> **username_2**: For additional reading/listening username_1 discussed this on the Chaincode Labs podcast: https://btctranscripts.com/chaincode-labs/chaincode-podcast/2020-01-28-username_1-username_1/ And Christopher Jeffrey discussed it at SF Bitcoin Devs: https://btctranscripts.com/sf-bitcoin-meetup/2016-09-28-christopher-jeffrey-bcoin/  
> **username_3**: As in many computer science problems, you can solve 99% of the problem and yet only have expended 1% of the necessary effort to solve the entire problem.  
> **username_4**: Maybe worth for someone to update this answer with the other reimplementation failures we've seen in the wild since it was written? For instance the BTCD witness deserialization bug (https://bitcoinops.org/en/newsletters/2022/10/19/?ref=nobsbitcoin.com) which led it to refuse a perfectly valid Bitcoin block.  
> **username_4**: Another one. Self plug but figured it was worth sharing. Btcd did not reimplement `FindAndDelete` correctly. https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug  
> **username_4**: Niklas Goegge also found a few bugs in the in-development libbitcoin v4 codebase where they decided to reimplement the Script interpreter from scratch: https://github.com/libbitcoin/libbitcoin-system/issues/1523 and https://github.com/libbitcoin/libbitcoin-system/issues/1526 .  
> **username_4**: Another old one is a reimplementation bug in bitcoin-ruby discovered by Peter Todd: https://bitcointalk.org/index.php?topic=260595.0 .  

---

