<p>If your suggestion is to automatically treat any block that has N blocks on top of it as assume-valid, that would be a very fundamental change in the trust model.</p>
<p>Right now, blocks don't become assume-valid unless they're <em>actually</em> valid. It's assessed by the contributors, reviewers, and maintainers of the Bitcoin Core software (assuming that's the assume-valid you're talking about), but you're already trusting that group collectively to provide you with software that correctly implements the Bitcoin protocol any time you update. It's also auditable (and audited) by anyone who wants, by running the software with assumevalid disabled and verifying history.</p>
<p>If instead your local node would automatically treat any block with a sufficient number of blocks on top (without actually validating it) as assume-valid, it would imply that a cabal of dishonest miners could make you accept invalid blocks. Note that while an honest majority of miners is part of Bitcoin's assumptions, this is only the case for consensus, not validity. There is no way today that even 99% of miners today could make your full node accept a block that contains a transaction which steals your coins without valid signature. In a world where sufficiently-buried blocks are considered assume-valid this <em>does</em> become theoretically possible.</p>

CC BY-SA 4.0
2023-01-09T21:14:49.510Z
I think you mean that "most worked chain" and "most worked valid chain" are completely different. However wouldn't it be practically irrelevant? If we set the assume-valid block deep enough it's hard to see how these blocks aren't valid.
Son Kaos999
CC BY-SA 4.0
2023-01-09T21:25:15.707Z
Right, that is my point. And of course, in practice it's hard to see how a very deeply buried block could be invalid. But the reason why we can make that assumption that is exactly because full nodes don't ever accept invalid blocks (making it wasted effort to make invalid blocks). If you're suggesting in some cases not doing that validation anymore, we need to re-evaluate whether this isn't introducing an incentive for miners to try to build a very long secret chain with invalid spends? Full nodes are full nodes, and I don't think Bitcoin Core is likely to accept deviating from that.
Pieter Wuille
CC BY-SA 4.0
2023-01-09T21:38:47.337Z
I understand much better the difference now, thanks!
Son Kaos999
CC BY-SA 4.0
2023-01-09T20:38:58.913Z
2023-01-09T20:38:58.913Z
Pieter Wuille
<p>Couldn't we just define an AssumeValid block each N blocks, instead of adding it manually?</p>
<p>What is the difference from just periodically picking sufficiently confirmed blocks? Anyway those blocks have been verified by the whole network</p>

<bitcoin-core-development><verification><assume-valid>
Why are AssumeValid blocks manually added?
Son Kaos999
# Why are AssumeValid blocks manually added?

(Asked by: username_0 on 2023-01-09)

Couldn't we just define an AssumeValid block each N blocks, instead of adding it manually?

What is the difference from just periodically picking sufficiently confirmed blocks? Anyway those blocks have been verified by the whole network

**Tags:** bitcoin-core-development, verification, assume-valid


---

## 1 answers

### Answer by username_1 on 2023-01-09. Score: 4 | Accepted answer

If your suggestion is to automatically treat any block that has N blocks on top of it as assume-valid, that would be a very fundamental change in the trust model.

Right now, blocks don't become assume-valid unless they're *actually* valid. It's assessed by the contributors, reviewers, and maintainers of the Bitcoin Core software (assuming that's the assume-valid you're talking about), but you're already trusting that group collectively to provide you with software that correctly implements the Bitcoin protocol any time you update. It's also auditable (and audited) by anyone who wants, by running the software with assumevalid disabled and verifying history.

If instead your local node would automatically treat any block with a sufficient number of blocks on top (without actually validating it) as assume-valid, it would imply that a cabal of dishonest miners could make you accept invalid blocks. Note that while an honest majority of miners is part of Bitcoin's assumptions, this is only the case for consensus, not validity. There is no way today that even 99% of miners today could make your full node accept a block that contains a transaction which steals your coins without valid signature. In a world where sufficiently-buried blocks are considered assume-valid this *does* become theoretically possible.

> **Comments:**
> **username_0**: I think you mean that "most worked chain" and "most worked valid chain" are completely different. However wouldn't it be practically irrelevant? If we set the assume-valid block deep enough it's hard to see how these blocks aren't valid.  
> **username_1**: Right, that is my point. And of course, in practice it's hard to see how a very deeply buried block could be invalid. But the reason why we can make that assumption that is exactly because full nodes don't ever accept invalid blocks (making it wasted effort to make invalid blocks). If you're suggesting in some cases not doing that validation anymore, we need to re-evaluate whether this isn't introducing an incentive for miners to try to build a very long secret chain with invalid spends? Full nodes are full nodes, and I don't think Bitcoin Core is likely to accept deviating from that.  
> **username_0**: I understand much better the difference now, thanks!  

---

