视频链接：【北京大学肖臻老师《区块链技术与应用》公开课】 https://www.bilibili.com/video/BV1Vt411X7JF?p=6&;;;share_source=copy_web&vd_source=33abd457d9415a4317112e8206e5360e
Video link: ; share_source=copy_web&vd=33abd457d9415a4317112e8206e5360e>
【笔记的内容也结合了评论区里其他同学的笔记】?
"The contents of the notes are integrated with the notes of the other classmates in the review section"?
11-BTC-问答
1.转账交易如果接收者不在线，怎么办？
What if the recipient of the transfer transaction is not online?
转账交易只不过需要在区块链上记录一下，把A账户上的比特币转到B的账户上，与接收者是否连在比特币网络中无关。
Transfer transactions simply need to be recorded on the block chain, and the transfer of bitcoin from account A to account B has nothing to do with whether the recipient is connected to the Bitcoin network.
?
2.假设某个全节点收到了转账交易，有没有可能转账交易中接收者的收款地址是这个全节点以前从未听说过的？
2. Assuming that a transfer transaction is received at a full node, is it possible that the recipient's receiving address in the transfer transaction was not known before this whole node?
有可能的。比特币系统中，账户创建的时候是不需要通知其他人的，只需要在本地产生一个公私钥对就可以了。只有在以后，该账户产生的收款地址收到钱的时候，其他节点才会知道该账户的存在。
In the Bitcoin system, an account is created without the need to notify others, but only by creating a public-private pair locally. Only later, when the collection address generated by the account receives the money, will the other nodes know about the account.
?
3.如果账户的私钥丢失了，该怎么办？
What should be done if the private key to the account is lost?
没有办法，账户上的钱就变成了死钱，是没有办法取出来的。比特币系统是去中心化的系统，是没有人可以帮你重置密码的。
There's no way that the money on the account becomes dead money, and there's no way to get it out. The bitcoin system is a decentralised system, and no one can change your password.
?
有些加密货币是有交易所的，交易所是一个中心化的机构，一般来说，在交易所注册账户时，需要提供身份证。这种情况下，将比特币保存在交易所里，私钥实际上是由交易所保管的。登录交易所跟登录银行账户的操作类似，一般需要用户名、口令和二次验证消息（如Google身份验证器生成的一次性密码），在这种情况下，如果登录口令丢失，可以联系交易所，通过身份验证后重置密码。
Some of the encrypted currencies are exchange-based, and the exchange is, in general, a central institution that needs to provide identity cards when the exchange registers its accounts. In such cases, the currency is kept in the exchange, and the private key is in fact held by the exchange. Log-in transactions are similar to the operation of log-in bank accounts and typically require user names, passwords and secondary authentication messages (e.g., a one-time password generated by Google Identification), in which case, if the log-in password is lost, the exchange can be contacted to replace the password through identification.
?
上述这种丢失口令的情况跟比特币系统中丢失私钥的情况是很不一样的。比特币系统中虽然也存在一些能够帮忙保管私钥的应用，如比特币钱包等。但是，并不能说明这些应用保管私钥会比私人保存更安全。相比之下，有些冷钱包或者说硬件钱包是比较安全的。
This loss of passwords is quite different from the loss of a private key in a bitcoin system. There are also applications in a bitcoin system that can help to keep a private key, such as a bitcoin wallet.
私钥丢失之后，那么这些比特币将会永远花不出去，但矿工并不知道这个账户的私钥已经丢失了，这些比特币是取不出来的，所以他需要永远把交易的输出保存在UTXO中，这个操作对全节点是不友好的。
When the strong's private key is lost, the bitcoin will never be spent, but the miners don't know that the key to the account has been lost, and the bitcoin cannot be removed, so he needs to keep the output of the transaction in the UTXO forever. This operation is unfriendly for the whole node.
?
4.如果私钥泄露了，怎么办？
What if the private key is leaked?
尽快把这个账户上的钱转到其他安全账户上。账户创建的时候会在本地创建一对公私钥对，私钥就是这个时候产生的，公私钥对一旦生成无法修改。可以生成新账户，但是原账户的私钥无法修改，账户的持有者也没办法阻止他人发布从该账户转账的交易，任何有私钥的人都可以发布转账交易，把账户里的比特币转走。
The money on this account is transferred to other secure accounts as soon as possible. accounts are created locally with a pair of private and public key pairs that cannot be modified once they are generated. can generate a new account, but the private key of the original account cannot be modified, and the holder of the account cannot prevent another person from issuing a transaction that is transferred from the account. Any person with a private key can issue a transfer transaction and transfer the bitcoin from the account.
?
问：用户持有者如何知道自己的私钥泄露了，是否看见从该账户上转出的非本人发起的交易才能知道？
?
5.如果转账时写错了地址，该怎么办？
What should be done if the transfer is made at the wrong address?
在比特币系统中没有提供一些能取消已经发布交易的机制。如果转账转到错误的地址，若知道地址归属于某账户（如B）的话，联系对方看是否愿意把比特币还给你，没有办法强迫。
There are no mechanisms available in the Bitcoin system to cancel transactions that have been issued.
地址一般是该账户公钥取哈希值得到的，但是有些地址其实并不是取公钥的哈希得到的，如Digital Commitment。如果想要把某项内容发布在区块上，证明在某个时间知道某个事情，这里有一种比较经典的方法就是Proof of Burn，就是将需要发布的内容的哈希值存放在OP_RETURN后面。但是有的人不这么做，他用哈希值生成一个像是比特币地址的东西，来代替比特币的转账交易接收方的地址的内容。就比如说正常实现转账交易A→B，这里B表示账户公钥取哈希值得到的地址，但是如果用其他哈希值来代替接收方的地址的内容，比特币系统并不知道这个地址是真的还是假的，这样转账的比特币就成了死钱，是取不出来的。这种虽然也达到了牺牲一点比特币，往比特币中写入一点东西的效果，类似于Proof of Burn，但是这种做法是很不提倡的，因为这样的交易的输出将会永远被写在UTXO集合中，全节点收到这样的转账交易，并不能判断这个交易的地址是否为真，不知道这个转账交易是花不出去的，这个操作对全节点是不友好的。
If you want to publish something on a block, prove that at some point you know something, there is a classic method of Proof of Burn, which is that the Hashi value of the contents that you will have to publish is behind OP_RETURN. But if you do not, produces something like a bitcoin address to replace the address of the recipient of a bitcoin's transfer. If you want to publish it on a block, you know, there is a classic way to find out about something, that's Proof of Burn, that's what's needed to replace the address of the receiver. But if you use other hashi values to replace the address of the recipient, the bitcoin system is not real, and it's not true that the money that you transfer is dead, it's money.
在Proof of Burn的情况下，OP_RETURN后的结果是无条件返回错误，不满足合法区块才会被写入区块中的条件，那么为什么还会用这种方式来向区块链中写入内容呢？验证的时候是将这个交易的输入脚本与前一个交易的输出脚本拼在一起运行，顺利执行就是合法交易。而在Proof of Burn的情况下OP_RETURN是写在输出脚本中的，所以验证这个交易合法性的时候并不会执行到OP_RETURN，也就不会返回错误。如果后面再有一笔交易想要花这笔交易里的钱的时候，才需要验证这个交易的输出脚本。所以判断交易是否合法，能否写入区块的时候，并不会执行到OP_RETURN部分。
In the case of Proof of Burn, the result of OP_RETURN is an unconditional return of errors, which does not satisfy the conditions for legal blocks to be included in a block, so why do you use this method to write content into the chain of blocks? Validation is when the input script of the transaction is combined with the output script of the previous transaction, and smooth execution is legal. and in the case of Proof of Burn, OP_RETURN is written in the output script, so that the legitimacy of the transaction will not be enforced to OP_RETURN, nor will it be returned to error. only needs to verify the output script of the transaction if there is another transaction after it wants to spend money on the transaction.
?
6.比特币挖矿的实质是在找合适的Nonce。会不会有矿工“偷答案”，如何辨别是哪个矿工最前找到的这个Nonce？
The essence of Bitcoin mining is to look for the right Nonce.
发布的区块里面有个CoinBase Transaction，里面有个收款人地址，是挖到矿的矿工的地址。如果要“偷答案”，需要将收款人的地址改为自己的地址，那么这个CoinBase Transaction的内容将会发生改变，这样会导致Merkel Tree的根哈希值会发生变化。Nonce在块头中，根哈希值也在块头中，Block Header的值发生变化之后，原来找到的Nonce就作废了。
The published block contains a CoinBase Transport, with a payee address, the address of the miner who dug up the mine. If the answer is to be “stealed”, the address of the payee needs to be changed to his own, the content of the CoinBase Transport will change, which will lead to a change in Merkel Tre’s root-hash value. Nonce is in the block, and the root-hash value is in the block.
问：如果要是挖到矿的矿工与偷答案的矿工同属于一个矿场呢？
?
7.交易费可以看作是发布一个交易的时候给矿工的一点小费，那么如何知道这个交易费给哪个矿工？
7. The transaction fee can be seen as a small tip for a miner at the time of issuing a transaction, so how do you know which miner the transaction fee is for?
交易费的计算是total inputs - total outputs，即总输入与总输出的差值，哪个矿工先挖到矿了不需要事先知道，挖到矿的矿工可以将区块中所包含交易发输入与输出的差额收集起来，作为他自己的交易费。
The transaction fee is calculated as the difference between the total input and the total output, which miner first digs into the mine without prior knowledge, and the difference between the transaction input and the output contained in the block can be collected by the miner as his own transaction fee.
?
12-BTC-匿名信
一、?比特币的匿名性
I. The anonymity of Bitcoin
1.什么是比特币系统的匿名性
1. What is the anonymity of the Bitcoin system?
? ? ?比特币系统中不要求用真实姓名，可以使用公钥产生的地址。一个用户可以产生任意多的地址，然后用不同的地址做不同的事情。但是比特币系统也并不是说完全没有名字，它用的是化名，所以有人认为，比特币系统中的匿名性叫做Pseudonymity（假名字）。
♪ ♪ The Bitcoin system does not require real names, but addresses generated by public keys. ? 2.比特币系统的匿名性可以提供哪些隐私保护 2. What privacy protections can the anonymity of the Bitcoin system provide? ? ? 比特币系统的匿名性没有现金好，现金是完全匿名的，其缺点是不方便保管和运输。比特币系统的匿名性显然比银行存款要好，因为现在的银行账户是实名制的。如果银行用化名的话（存钱提供化名即可，取钱的时候拿着存折取钱），其匿名性会优于比特币，因为比特币账本是公开的，所有人都可以查到，而银行的账本是受控制的，一般只有银行工作人员和一些司法机关可以查到银行的账本。 The anonymity of the bitcoin system is not good, the cash is completely anonymous, and the disadvantage is that it is not easy to keep and transport. The bitcoin system is obviously better anonymous than bank deposits, because bank accounts are now real. If banks use an alias (the deposit provides an alias, when the money is collected with the deposit), it is better anonymous than the bitcoin, because the bitcoin book is public, accessible to all, and the bank's books are controlled and usually only bank staff and some judicial authorities have access to the bank's books. （1）一个人可能生成很多个地址账户，但是这些地址账户是有可能被关联起来的。 (1) A person may generate many address accounts, but these address accounts may be linked. 假设存在如图，该交易存在两个输入和两个输出，那么addr1和addr2很可能是同一个人所持有的账户，此人同时拥有这两个私钥的地址，这种情况可能是此人持有的一个账户中的比特币可能不够支付这次交易而导致的。而在输出中，很有可能有一个地址是属于找零钱的地址，即花掉之后剩余的钱。在某些情况下，也是可以分析出来的。 Assuming that there are two inputs and two outputs to the transaction, then Addr1 and Addr2 are likely to be accounts held by the same person, who also has the addresses of the two private keys, a situation that may result from the fact that bitcoins in an account held by that person may not be sufficient to pay for the transaction. In the case of exports, it is likely that one address is a change-seeking address, that is, the money remaining after it has been spent. ? ? ? ? ? ? ? 从理论上讨论，如果想要加强隐私保护，可以人为产生很多没必要的输出，迷惑敌人。但是这些交易都是用钱包软件生成的，常用的比特币钱包就那么几种，所以如果将比特币钱包生成交易的原理，那么区块链上很大一部分转账交易都可以分析出来，常用钱包目前为止不会生成没必要的输出地址。 Theoretically, if you want to strengthen privacy protection, you can produce many unnecessary outputs and confuse the enemy. But these transactions are made from wallet software, and the usual bitcoin wallets are a few, so if you generate a bitcoin wallet to generate the logic of the transaction, a large part of the transfer transactions on the block chain can be analysed, and the usual wallets do not produce the necessary output address so far. ? （2）比特币系统中的地址账户与账户持有者在现实社会中的真实身份也可能产生关联。 (2) The address account in the Bitcoin system may also be linked to the true identity of the account holder in the real society. ? ? ? ? 任何让虚拟货币跟实体世界发生联系的操作，都可能跟真实身份产生关联。 Any operation that connects virtual money to the real world may have a connection to real identity. ? ? ? ?在很多国家，都有防洗钱法。如何防范不法分子采用比特币进行洗钱呢？其实很简单，只需要盯住资金转入转出链即可。对于大额资金转入比特币或将大量比特币转为现实货币，很难逃避司法金融机构的监管。这也是比特币匿名性被破坏的很重要的例子。 There are laws against money-laundering in many countries. How to prevent outlaws from using bitcoin for money-laundering? ? （3）在实体世界中，用比特币做支付的时候。 (3) In the real world, when payments are made in bitcoin. ? ? ? ? 国外有的商家接收比特币支付，如咖啡厅、餐厅等。但是这可能不是一个good idea，因为用比特币交易延迟高，交易费贵。在这种情况下，也是可能对比特币的匿名性造成破坏的。因为这就相当于一个账户会参与很多交易，比较容易把这些交易信息关联起来，从而破坏匿名性。其实不光接受支付的商家会知道，其他人也会知道。 There are businesses abroad that receive bitcoin payments, such as cafes, restaurants, etc.. But it may not be a good idea because of the high delays in dealing with bitcoin and the high transaction costs. In this case, it may also be detrimental to Bitcoin’s anonymity. This is the equivalent of an account that will be involved in many transactions, and it will be easier to link these transactions, thereby undermining anonymity. ? ? ? ? 4.实际当中比特币的匿名性 4. In practice, the anonymity of Bitcoin ? ? ? ? 比特币系统的匿名性是相对的。在实际中，也有很多人保持有较好的匿名性。保持最好的当属其开发者中本聪，其参与比特币时间最长，但是全世界都不知道他是谁。但实际上，中本聪的比特币并非有花出去，这也使得我们难以发现他具体是谁。 The bitcoin system is relatively anonymous. In practice, there are a lot of people who maintain a better level of anonymity. Keeping the best of their developers, Benz has been involved with bitcoin for the longest time, but the world doesn't know who he is. ? ? ? ? 曾经美国有一个skil road网站，被称为eBay for illegal drugs，主要用于匿名支付售卖违禁品，为了逃离网络监管，其支付手段就是比特币，底层的网络层是洋葱路由TOR。但运行没有几年就被查封，其老板当时赚取了十几万比特币，从纸面上看，已经非常有钱了。但由于其担心身份暴露，这些钱一个都不敢花，在美国仍然过的是非常简朴的生活。最终据说由于疏忽，在同一电脑上登录现实社会账户和非法网站上账户，从而被抓(具体原因未公开)。 There was once a skil road site in the United States, known as eBay for illigal drugs, which was used mainly to pay anonymously for the sale of contraband, in order to escape cyber surveillance, by Bitcoin, the bottom of which was the onion road by Tor. But it was seized in a few years, and its owner earned a hundred thousand bits of bitcoins, which, according to the paper, was very rich. None of this money was spent, and it was still a very simple life in the United States, owing to his fear of identity exposure. Eventually, it was said to have been caught (for specific reasons, it was not made public) by negligently entering real social accounts and illegal website accounts on the same computer. ? ? ? ? 5.比特币匿名性有多好？ How good is Bitcoin's anonymity? ? ? ? 匿名的本质是不想要暴露身份，但是它区别于你是想对谁隐瞒身份。而对于普通人来说，比特币的现有机制已经足够保持个人隐私了。但如果涉及违法，行政机关想要获得真实身份，其实很容易。 The nature of anonymity is that it does not want to reveal identity, but it is different from who you want to hide it from. For ordinary people, the existing mechanism of Bitcoin is enough to maintain personal privacy. ? 6.如何提高匿名性？ 6. How can anonymity be improved? ? ? ? ? 比特币协议实际上是运行在应用层的，其底层实际上是P2P Overlay Network。提高匿名性就要从这两个层面来提高。如果不保证网络层的匿名性，其他结点发现这个交易都是单一路径（同一个IP地址）发布，其他结点很可能通过这一路径推测其在物理世界中的真实身份。 The Bitcoin deal is actually running on the application level , and the bottom level is actually P2P Overlay Network. Increased anonymity requires both levels. If the network layer is not made anonymous, the other nodes find that the transaction is issued as a single path (the same IP address), and the other nodes are likely to extrapolate their true identity in the physical world. ? ? ? ? 网络层的匿名性学术界已经有了很好的解决方法：采用多路径转发的方法，数据不直接发送出去，而是经过很多跳（中间结点只知道它的上一层结点是谁，并不知道最开始发送消息的人是谁）这也是洋葱路由的基本思想。 Anonymized academics at the web level have found a good solution: using multi-trail transmission methods, data are not sent directly, but rather through many jumps (the middle node knows only who its upper node is and does not know who was the first to send the message). This is also the basic idea of onion routers. ? ? ? ? 应用层的匿名性，可以将各个不同用户的比特币混合在一起，使追查变得混乱，这种方法就是Coin Mixing。 ♪ The anonymity of the application layer can mix the bitcoin of different users and make tracing confusing, which is Coin Mixing. ? ? ? 实际上，暴露用户隐私正是由于区块链的公开性和不可篡改性。实际上，不可篡改性对于隐私保护，是灾难性的，因为一旦某一个交易不小心把身份暴露出去了，这个交易永久的写在区块链里，想抹掉都不能，所以说账户之间的关联性是需要小心的。 Indeed, exposure to user privacy is due to the openness and inflexibleness of the block chain. In fact, non-frozen protection of privacy is disastrous, because once a transaction accidentally exposes an identity, it is permanently written in the block chain and cannot be erased, so the connection between the accounts needs to be careful. ? 二、零知识证明 two, zero proof of knowledge 1.什么是零知识证明 1. What's a zero-knowledge proof ? ? ? ? 零知识证明是指一方（证明者）向另一方（验证者）证明某一个陈述是正确的，而不需要透露除该陈述是正确的之外的任何信息。 ♪ The proof of zero knowledge means that one party (certificator) proves to the other party (certifier) that a particular statement is correct and does not need to disclose any information other than that statement. ? 2.同态隐藏 2. Same hide ? ? ? ? 同态隐藏是零知识证明的数学基础，其三个性质如下： Consistency is the mathematical basis for proof of zero knowledge, three of which are as follows: （1）如果x，y不同，那么它们的加密函数值 E(x) 和 E(y) 也不相同。（说明这个加密函数值E不会发生碰撞，与哈希函数不同。若 x ≠ y，那么E(x) ≠?E(y)。如果E(x) ＝?E(y)，则x=y。） (1) If x, y is different, the encryption function values E(x) and E(y) are different. (Note that this encryption function value E does not collide, unlike the Hashi function. If x y, then E(x)E(y). If E(x)=E(y), x=y. （2）给定 E(x) 的值，很难反推出x的值。（说明加密函数是不可逆的） (2) The value given to E(x) is difficult to reverse. (Notes that the encryption function is irreversible.) （3）给定 E(x) 和 E(y) 的值，我们可以很容易计算出某些关于x，y的加密函数值。（同态运算，说明对加密后的函数值进行某些代数运算，等价于对输入直接进行代数运算再加密。） (3) The values given for E(x) and E(y) can easily be calculated for some encryption functions for x,y. (Synonyms, which indicate certain algebraic operations for encrypted function values, are equal to direct algebra operations for input re-encryption.) ①同态加法：通过 E(x) 和 E(y) 计算出 E(x+y)? 的值。 1 Same add: E(x) and E(y) calculate E(x+y)? ②同态乘法：通过 E(x) 和 E(y) 计算出 E(xy) 的值。 2-Same Multiplication: E(x) and E(y) calculate E(xy) values. ③扩展到多项式。 3 Extended to multiple models. 例：Alice想要向Bob证明她知道一组数x 和 y 使得x + y=7，同时不让Bob知道x 和 y 的具体数值。 Example: Alice wanted to prove to Bob that she knew a group of x and y that made x + y = 7, and that Bob was not allowed to know the exact values of x and y. ①Alice把 E(x) 和 E(y) 的数值发给Bob 1 Alice sends E(x) and E(y) values to Bob ②Bob通过收到的 E(x) 和 E(y) ，计算出 E(x+y)? 的值 2Bob calculates the value of E(x+y) by receiving E(x) and E(y)? ③Bob同时计算 E(7)?的值，如果 E(x+y)?=E(7)，说明x+y=7，那么验证通过，否则验证失败。 3Bob calculates the value of E(7)? If E(x+y)?=E(7), expository x+y=7, then the validation is passed, otherwise the validation fails. ? 3.盲签方法 3. Blindmark method （1）用户A提供SerialNum（货币编号），银行在不知道SerialNum的情况下返回签名Token（银行签名的时候看不见序号的内容），减少A的存款； (1) User A provides SerialNum (currency number) and the bank returns to sign Token without knowing SerialNum (the contents of the serial number were not visible at the time of the bank's signature), reducing A's deposits; （2）用户A把SerialNum和Token交给B完成交易； (2) User A hands SerialNum and Token over to B to complete the transaction; （3）用户B拿SerialNum（明文）和Token给银行验证，银行验证通过，增加B的存款；（银行要记录该序号是否存在Double Spending） (3) User B certifies the bank with SerialNum and Token, and the bank certifies the pass and increases the B deposit; (bank records whether the serial number is Double Spending) ? ? ? ? 这样做的好处是银行无法把A和B联系起来；而且实现了中心化。 ♪ The advantage of doing so is that banks can't link A to B; and it's centralized. ? 4.零币和零钞——专门为匿名性设计的加密货币 4. Hundred and zero notes - encrypted currency specially designed for anonymity （1）零币和零钞在协议层就融合了匿名化处理，其匿名属性来自密码学保证。 (1) At the agreement level, coins and coins are combined with anonymous treatments, whose anonymous properties are derived from cryptological guarantees. （2）零币(zerocoin)系统中存在基础币（如比特币）和零币，通过基础币和零币的来回转换，消除就地址和新地址的关联性，其原理类似于混币服务。 (2) In the zero currency (Zerocoin) system, where base currency (e.g. bitcoin) and zero currency exist, removes the correlation between the address and the new address by converting base currency and zero currency, which is based on principles similar to monetization services. （3）零钞(zerocash)系统使用zk-SNARKs协议，不依赖一种基础币，区块链中只记录交易的存在性和矿工用来验证系统正常运行所需要关键属性的证明。区块链上既不显示交易地址也不显示交易金额，所有交易通过零知识验证的方式进行。 (3) The zero-cash system uses zk-Snarks and does not rely on a base currency. Only the existence of the transaction and evidence of the key attributes required by the miners to verify the normal operation of the system are recorded in the block chain. Neither the transaction address nor the transaction amount is shown on the block chain. ? ? ?零币和零钞在花费的时候，只需要用零知识证明来证明所花掉的币是系统中存在的某一个合法的币，但不用透露具体花掉的是系统中哪一个币。这样就破坏了关联性。但这类货币并非主流加密货币，原因如下： ♪ ? When coins and coins are spent, only little knowledge is needed to prove that the money spent is a legitimate currency that exists in the system, without disclosing which currency is actually spent in the system. undermines relevance. But such currency is not a mainstream encrypted currency for the following reasons: ①其为了设计匿名性，付出了一定代价； It has paid a price for the design of anonymity; ②在数学原理上对初始化有比较严格的要求（即初始时候用的随机元要能销毁掉，如果不能销毁则会出现安全漏洞）； 2 There are more stringent mathematical requirements for initialization (i.e., the random element to be used at the initial stage can be destroyed or, if it cannot be destroyed, there will be a safety gap); ③需要强匿名性的用户并不多； (c) The number of users requiring strong anonymity is low; ④虽然从数学上看，零币和零钞是安全的，但其并不是百分之百的匿名，并未解决与系统外部实体发生交互时对匿名性的破坏。 Although mathematically safe, zeros and zeros are not 100 per cent anonymous and do not address the damage to anonymity when interacting with outside entities of the system. ? 13-思考 1.比特币在设计的过程中很多地方用到了哈希指针，如块头就包含指向前一个区块的哈希指针，指针保存的是本地内存的地址，只在这台计算机上才有意义，发送到其他计算机上就没有意义了，那么在发布区块的时候哈希指针是如何通过网络传输的呢？ Bitcoin, in its design process, uses Hashzi's pointers in many places, such as the block containing the Hash's pointer pointing to the front block, the location of the local memory, which is meaningful only on this computer, and which has no meaning in sending to other computers, how did the Hash's pointer be transmitted through the network at the time of the `strong' release of the block? 实际上，在比特币系统中，所谓哈希指针只是一种形象的说法，实际在用的时候，其实只有哈希，没有指针。回顾之前学习过的Block Header的数据结构，如下所示，我们可以得知， uint256 hashPrevBlock;这里表示的就是前一个区块的哈希，实际上是没有指针的。 In fact, in the Bitcoin system, the so-called Hashian pointer is just an image, and when `strong' is actually in use, it's just Hash, there's no pointer. recalls the data structure of Block Header, which we can see as follows: uint256 hashPrevBlock; here it is the Hash of the previous block, and there is actually no pointer. class CBlockHeader { public: //header int32_t nVersion;//当前使用的比特币协议的版本号，没法修改（4字节） int32_t nVersion;// currently in use version number of the Bitcoin agreement, could not be modified (4 bytes) uint256 hashPrevBlock;//前一个区块块头哈希值（32字节），不能修改 uint256 hashPrevBlock;/ / previous block head Hashi value (32 bytes) cannot be modified uint256 hashMerkleRoot;//Merkle Tree的根哈希值（32字节）； uint256 hash MerkleRoot;//Merkle Tree Ghenhash (32 bytes); //通过修改Merkle Tree中铸币交易的CoinBase域当作ExtraNonce来调整其根哈希值 // Adjust the root-hash value by modifying the CoinBase field in Merkle Tre as ExtraNonce uint32_t nTime;//区块产生时间，有一定调整余地（4字节）； uint32_t nTime;/ / Block generation time with some scope for adjustment (4 bytes); //比特币系统并不要求非常精确的时间，这个时间可以在一定范围内调整 // Bitcoin does not require very precise time, which can be adjusted within a certain range uint32_t nBits;//挖矿后的目标阈值编码后的版本（4字节）; uint32_t nBits;//Additional version of the target threshold code after mining (4 bytes); //只能按照协议中的要求定期进行调整，不能随便改 // Regular adjustments can only be made in accordance with the requirements of the agreement and cannot be made casually uint32_t nNonce;//（4字节）单纯靠调整nonce的值很大概率找不到符合难度要求的 uint32_t nNonce;//(4 bytes) simply by adjusting nónce's value is unlikely to meet the challenge requirement } ? 那么，如何找到前一个区块的内容呢？ 全结点一般是将这些区块存储在一个 (Key,Value) 数据库中，Key表示哈希值，Value表示区块的内容，有一个比较常用的 (Key,Value) 数据库——LevelDB。所谓的区块链是一个链表结构，实际上是在 LevelDB 里面，用哈希值串起来的。只要掌握最后一个区块的哈希值，用 LevelDB 查找 (Key,Value) ，就可以通过哈希值Key得到Value，就可以把最后一个区块的内容取出来。然后这个区块的Block Header里面又有指向前一个区块的哈希值，然后再去用 LevelDB 查找 (Key,Value) ，就可以找到前一个区块的内容，以此类推，就可以把整条区块链都找出来。 So, how do you find the contents of the previous block? The whole node is usually stored in a (Key, Value) database, where Key indicates the Hashi value, Value indicates the content of the block, and there is a more commonly used (Key, Value) database, LevelDB. The so-called block chain is a chain structure, actually chained with the Hashi value in LevelDB. If you have the Hashi value in the last block, you can find the content of the last block (Key, Value) and you can get the content of the last block through the Hay, then you can find the whole block. 所以，在实际系统之中，所谓的哈希指针是只有哈希没有指针的，或者也可以认为哈希值本身就是指针。有些结点没有保存区块链整条链上的全部信息，只保存了最近的几千个区块的信息，如果需要用到前面区块的信息，可以问其他全结点要，哈希指针的性质保证整个区块链是不可篡改的。 So, in the actual system, what ? 2.区块恋可能造成的问题 2. Problems that may arise from block love 情侣两个人合在一起买比特币，然后将私钥从中间截断，分成两部分，每人保存其中的一段，如果两个人分手了，当初买的比特币就被永久地所在区块链上，谁也取不出来。 The couple buys bitcoin together, then breaks the private key from the middle and divides it into two parts, each keeping a portion of it, and if the two break up, the bitcoin that was bought is permanently on the chain of blocks, and no one can take it out. ? 可能造成的问题： Possible problems: （1）如果有一个人把私钥丢失（或遗忘），都会导致比特币无法取出。 (1) If a person loses a private key (or forgets it) it results in Bitcoin being unable to remove it. （2）降低账户的安全性。 (2) To reduce the security of the accounts. 比特币系统中账户的安全性跟用户所用的私钥的长度是相关的，用256位的私钥就是因为这个长度的私钥用暴力破解的方式是不可行的，但是如果从中截断，就会大大降低其安全性。 The security of the accounts in the Bitcoin system is related to the length of the private key used by the user, which is not feasible because the private key of that length is broken by violence, but if cut off from it, it significantly reduces its security. 假设其中一个人想要把比特币取出来，那么只需要破解另外一半就可以，破解长度为256的私钥需要尝试的可能性为2256，而破解128位的私钥需要尝试的可能性为2128，是指数级的减小。 Assuming that one of them wants to take out the bitcoin, only the other half will be able to crack it. The probability of trying to break a private key of 256 is 2256, while the probability of trying to break a 128-digit private key is 2128, which is a reduction in the index level. ??所以说对于多个人共同持有的账户，不能用私钥截断的方式，而应该使用多重签名的方式来保障安全性。?在多重签名（MULITISIG）中，每个人用到的私钥都是独立产生的，而且多重签名还具有很多灵活性，如N个人中只给出M个人的签名就可以验证通过。 ? So, for accounts held by multiple individuals, it is not possible to cut off private keys, but rather to use multiple signatures to ensure security. ? In multi-signatures, everyone uses private keys that independently produces , and multiple signatures have a lot of flexibility, for example, when one of the N individuals gives only M's signatures to verify their passage. ? （3）取不出来的钱将会永久被存在UTXO集合中，对矿工是不友好的。 (3) The money that cannot be removed will remain permanently in the UTXO collection, which is unfriendly to the miners. 假设“区块恋”的例子中的两个情侣分手，不存在其中有人有使用暴力手段破解私钥的情况，那么这些比特币将会永远花不出去，矿工并不知道这对情侣已经分手了，这些比特币是取不出来的，所以他需要永远把钱保存在UTXO中，这个操作对全结点是不友好的。 Assuming that the two couples in the case of “block love” break up and that there is no use of violence to break their private keys, these bitcoins will never be spent, the miners will never know that the couple has broken up, the bitcoins will not be removed, so he needs to keep the money forever in UTXO, an operation that is unfriendly to the whole node. ? 3.分布式系统比较著名的不可能结论，从理论上证明，分布式系统中取得共识是不可能的，那么既然理论上已经证明了是不可能的，实际上为什么又变得可能了呢？就是说比特币系统为什么能取得共识，为什么它能绕过分布式系统理论上证明的那些不可能结论？ 3. It is impossible to conclude that the distribution system is well known and theoretically proves that it is impossible to achieve consensus in the distribution system, so why is it actually possible now that the theory has proved impossible? That is, why can the bitcoin system achieve consensus, and why can it bypass the impossible conclusions that the distribution system theoretically proves? 严格意义上说，比特币系统并没有真正意义上的共识，因为取得的共识随时都有可能被推翻，如出现分叉攻击（本来你以为已经取得某项共识，分叉攻击之后，系统会回滚到前一个状态，从理论上说甚至有可能一直回滚到创世纪块），按照分布式系统理论上的要求，共识一旦达成就不应该再修改。从这个意义上说，比特币系统并没有绕过分布式系统那些不可能的结论，因为它并没有达到真正意义上的共识。理论和实际往往是有距离的，理论上的不可能只是在某种特定的模型下是不可能的，实际上把模型稍微改一改，这个不可能结论就不成立了。 In the strict sense of the term, there is no real consensus in the Bitcoin system, because the consensus that has been achieved can be reversed at any time. 如何判断远程数据中心的一台服务器是不是已经死机了。专家的看法是：分布式系统的理论已经证明了，在异步环境中，不可能区分某个远程服务器到底是死机还是运行缓慢。（所谓的异步环境是指通讯传播的延迟是没有上限的）但是实际上，我们可以给远程服务器的工作人员打个电话，让他们看看这个服务器是不是死机了，如果死机帮忙重启一下，这样下来，这个理论上不可行的案例，实际上就变成可行的了。或者给服务器加一根电话线，进行拨号上网，如果发现Internet执行缓慢可以试一下电话线，两根线一般不会出现同时拥堵的情况，这样就可以确认远程服务器是否死机。 How to determine whether a remote data centre server is dead? The expert’s view is that the theory of distributed systems has shown that it is not possible to distinguish between a remote server in a step-by-step environment, whether it is dead or slow. (The so-called asymptomatic environment means that there is no limit to the delay in communication dissemination.) In practice, however, we can call the remote server’s staff to see if the server is dead. ? 4.比特币的稀缺性 4. Scarcity of Bitcoin 为了获得收益，挖矿的收益大于挖矿的开销，才是有利可图的。所以，想要吸引到更多人来挖矿，要么增加挖矿的预期收益，要么降低挖矿的开销。 In order to reap the benefits, the profits from mining are greater than the costs of mining. So, in order to attract more people to mining, either the expected benefits of mining will be increased or the costs of mining will be reduced. 比特币的设计是非常巧妙的，我们之前计算过，每过大约四年时间，出块奖励会减半一次，也就是说比特币的总数是恒定的。有些人说这种总量恒定的东西是不适合作为货币的，以太坊就没有出块奖励定期减半的做法，有些加密货币甚至每过一段时间会自行通胀一次，因为稀缺的东西是不适合做货币的。 Bitcoin is a very clever design, and we have calculated that, every four years or so, a lump of reward will be halved, meaning that the total number of bitcoins is constant. Some say that this constant amount of money is not suitable for currency, that there is no incentive to cut it by half on a regular basis, and that some encrypted money will even inflate itself every once in a while, because what is scarce is not suitable for currency. 5.量子计算 5. Quantum calculations 最近几年量子计算发展很快，有人产生这样一种担心：比特币这种加密货币是建立在密码学的基础上的，将来量子计算技术发展起来以后，这些加密货币会不会变得不安全？ The rapid development of quantum computing in recent years has raised the concern that the encoded currency of Bitcoin, which is based on cryptography, will not become unsafe in the future with the development of quantum computing technology? 传说中的量子计算机是非常强大的，可以破解现存的各种加密算法，但是这个担心是不必要的。首先，量子计算机距离使用还有很长一段时间，在比特币的有生之年不一定能产生实质性的威胁。而且，如果将来有一天量子计算真正强大到可以破坏现有的加密体系的话，首先受到冲击的是传统金融业，像网银、网上支付等等都会变得不安全。所以，与其担心量子计算对比特币的冲击还不如担心量子计算对传统金融业的冲击，因为大多数的钱都是存放在传统金融体系中的，加密货币的总市值现代金融体系的很少一部分，而且将来还会有量子加密算法。 The legendary quantum computer is powerful enough to decipher existing encryption algorithms, but this fear is unnecessary. First, the quantum computer has a long time to use, and the lifetime of Bitcoin does not necessarily pose a substantial threat. 第二，比特币系统中并没有把账户的公钥直接暴露出来，而是用公钥取哈希之后得到一个地址。比特币中用的是非对称加密体系，从私钥可以推导出公钥，所以只要将私钥保管好，公钥即使丢了也没有关系，公钥显然不能推出私钥。假设以后，量子技术发达了，可以通过公钥推到得到私钥，那么在比特币系统中，还需要突破另一层保护机制，就是需要能够从公钥的哈希推算出公钥，而这一点即使使用量子计算机也是无法完成的。加密跟取哈希是两种不同性质的操作，加密的目的是保证信息的安全性，以后还要解密，所以加密需要保证信息的完整性，加密过程不能丢失信息。而取哈希不一样，取哈希一般情况下会造成信息的损失，哈希函数一般都是不可逆的，从哈希值是无法得到原来的输入的。 Second, the 比特币系统中哈希函数用的是SHA-256，即无论输入有多大，输出的都是256位的，这种情况如果可逆就会变成一个超级无敌的压缩算法。所以，如果仅用来收钱的情况下，不建议把公钥暴露在比特币系统上，收钱的时候只需要提供公钥的哈希提供的地址就可以，取钱的时候才需要提供公钥，取钱的交易中需要公钥和由私钥产生的签名。如果一个人想要偷A账户上的钱，他需要在A发布交易时实时破解从A的公钥推导出A的私钥，再实时产生一个跟A的交易竞争的交易。即使这个人具有量子计算技术也很难在几分钟之内就将私钥破解，而且他发布的交易还需要抢在A发布交易的前面，因为如果在A发布交易之后，就会产生Double Spending。所以从比特币安全的角度来看，比特币系统中每个账户只取一次钱，花不完的钱转给自己的其他账户，这样做既提升了安全性，也提高了隐私保护的程度。 The Hashi function in the Bitcoin system uses SHA-256, or 256-digit output, regardless of the size of the input. If it is reversible, it becomes a super-invincible compression algorithm. So, if it is used only to collect money, it is not recommended that the public key be exposed to the Bitcoin system, that it be collected only at the address provided by Hashi, who provides the public key, that the public key be provided at the time the money is collected, and that the public key and the signature generated by the private key be taken from the transaction. If a person wants to steal money from the A account, he needs to decipher the private key from the A key in real time at the time that the A is issued, and then produce a transaction that competes with A in real time. 14-ETH-以太坊概述 14-ETH-Ethio Overview 1.以太坊相较比特币做出的改进 1. Improvements made in Taiwan vs. Bitcoin 比特币称为区块链1.0，以太坊称为区块链2.0。 Bitcoin is known as block chain 1.0 and as block chain 2.0. （1）出块时间： (1) Departure time: 比特币的出块时间是十分钟，以太坊的出块时间是十几秒，而且为了适应新的出块时间，以太坊还设计了一套基于GHOST协议的共识机制； Bitcoin's time is ten minutes, the time of time of time of time of time of time is ten seconds, and in order to adapt to the new time of time of time, （2）Mining Puzzle： 比特币的Mining Puzzle是计算密集型，比拼计算哈希值的算力，这样造成的结果是挖矿设备的专业化，现在大家用的是ASIC芯片，很多人认为这与区块链去中心化的理念相悖， Bitcoin's Mining Puzzle is arithmetic-intensive measure, compared to the amount of Hash, which results in the specialization of mining equipment, which is now being used with the ASIC chip, which many consider to be contrary to the idea of decentralizing the block chain. 以太坊设计的Mining Puzzle对内存要求高，在一定程度上限ASIC芯片（ASIC Resistance）的使用； (a) Mining Puzzle, which is designed by the Taiku, has high RAM requirements, limiting to some extent the use of the ASIC chip ; （3）用权益证明来替代工作量证明： (3) Substitution of proof of entitlement to proof of workload: 以太坊中改成了权益证明（Proof of Stake），不挖矿了，改成了类似股份投票的方法，决定下一个区块怎么产生。 It's changed from Proof of Stock to a share vote. It's decided how the next block is to be created. ? 2.以太坊增加的新功能 2. New features added by the Etherm 智能合约（Smart Contract）。以太坊的一个特性就是增加了对去中心化的合约的支持。比特币（BTC）最小计量单位是Satoshi（聪），以太坊（ETH）中的货币称为以太（Ether），最小计量单位是Wei。 Smart Contract. One of the characteristics of Tai Lok is to increase support for decentralised contracts. The smallest unit of measure for bitcoin (BTC) is Satoshi (Hear), referred to as Ethel in the ETH currency, and the smallest unit of measure is Wei. ? 3.去中心化的合约 3. Centralization contracts 现实社会中合约的有效性也是通过政府采取司法手段来维护的，使用技术手段把这些司法手段取代，就是智能合约的目的，如果合约中的内容是可以通过代码实现的，就可以将这样的代码放在区块链上，通过合约的不可篡改性保证代码正常运行。 The validity of contracts in the real society of `strung' is also maintained through the use of judicial means by Governments, which are replaced by technical means, which are the purpose of smart contracts , which, if the content of the contract is achievable by code, can be placed on the block chain and guaranteed by the contract's non-frozen guarantee that the code is functioning properly. 并非所有合同都能通过代码实现的，也不是所有合同条款都可以量化的，但是有些逻辑比较清晰的合同是可以写成智能合约的形式的。 Not all contracts can be performed by code or all contract terms can be quantified, but some of the more logical contracts can be written in the form of smart contracts. ? 4.去中心化的合约有什么好处？ 4. What are the benefits of a centralised contract? 去中心化的货币有什么好处？比如跨国转账，传统的方式交易费非常昂贵而且转账时间非常长，用加密货币（如BTC）则方便很多。 What are the benefits of decentralized currencies? For example, cross-border transfers, traditional forms of transaction costs are very expensive and time-consuming, and the use of encrypted currencies (e.g. BTC) is much easier. 那么，智能合约也有类似的应用场景，若合同签署方并非一个国家，来自世界各个国家，没有统一的司法部门，若此时想要利用司法手段来维护合同的有效性会比较麻烦。用技术手段编写无法修改的合约，所有人只能按照相关参与方执行，无法违约，这是最好的。 There are similar applications to smart contracts. If the signatories are not one country, come from every country in the world, and there is no unified judiciary, it would be more difficult to use judicial means to preserve the validity of contracts at this time. ? 15-ETH-帐户 1.比特币的账户模式 1. Bitcoin account model 比特币系统是基于交易的账本（Transaction Based Ledger），系统中并未显示记录每个账户上有多少钱，只能通过UTXO进行推算（即在UTXO中查找该账户公钥有多少输入即可）。 The 假设A转给B钱的时候，需要说明币的来源。比特币账户中，在前面一笔交易中收到的比特币，在花的时候必须一次性全部花出去，不能只花一部分。 Assuming that A transfers to B money, it is necessary to indicate the origin of the currency. In the Bitcoin account, the bitcoin received by ? 假设B收到A的5个比特币，他只给C转账2个比特币，若按上图方式，其余3个比特币会以交易费（Transaction Fee）的形式给挖出区块的矿工。 Assuming that B receives five bitcoins from A, he transfers only two bitcoins to C. If you follow the above pattern, the remaining three bitcoins will be given to miners who dig up blocks in the form of a transaction fee. 采用下图的方式，将3个BTC转给C，将剩余7个BTC转到B的另一账户D上面。很多比特币钱包就采用这种方式，每次转账就生成一个自己的新的地址，有利于隐私保护，但是仍然与日常生活有所不同。这是因为比特币系统中没有显示的基于账户的交易的概念，在比特币系统中，每个交易是单独进行处理的。 Three BTCs are transferred to C, and the remaining seven BTCs are transferred to another account D of B. Many Bitcoin wallets are used in this way, 2.以太坊的账户模式 2. In the Taiwan account mode 以太坊系统则采用了基于账户的模型。系统中显示记录每个账户中以太币的数量，转账是否合法只需要查看转账者账户中以太币是否足够即可，不用确切指出转出的钱属于哪一部分，同时也不需要每次全部转账。同时，也天然地防范了双花攻击。若出现Double Spending，无需说明币的来源，只需要扣两次钱就好了。 uses an account-based model . shows the amount of money in each account that is recorded. ? ? ? 但这种模式存在重放攻击（Reply Attack）的缺陷。A向B转账10个ETH，过一段时间，B将A的交易重新发布，从而导致A账户被扣钱两次。 But this pattern is flawed by re-launching attacks . A transfers 10 ETHs to B. In a period of time, B reissues A's transactions, resulting in A's accounts being withheld twice. 在比特币中会有重放攻击吗？不会，因为收到过的交易信息再广播一次是很显然的Double Spending。 Is there going to be another attack in Bitcoin? No, because it's obvious that the information received about the transaction was broadcast again. 解决重放攻击的方法：在每笔交易中添加一个Nonce（计数器），记录该账户有史以来一共发布多少交易，转账时，Nonce作为交易的一部分，同时受到签名的保护，从而防止本地篡改余额或进行重放攻击。 Ways to address re-launching attacks: 3.以太坊的账户类型 3. Type of account in Taiwan ①外部账户：外部账户中有账户余额Balance和计数器Nonce（≠挖矿调整的Nonce）。 1 External account: external account contains account balance Balance and counter Nonce (Nonce, readjusted for mining). ②合约账户：并非通过公私钥对控制。合约账户不能主动发起交易，若外部账户发起交易调动了一个合约账户，该合约账户可以发起一个Message调用另外一个合约，但是不能自己主动发起交易。合约账户除了Balance和Nonce之外还有代码(Code)、相关状态-存储(Storage)，包括每个变量的取值。 Contract accounts: are not controlled by public-private key pairs. Contract accounts cannot initiate transactions on their own initiative. If an external account initiates a transaction, the contract account can launch a Message call for another contract, but cannot initiate the transaction on its own initiative. contract accounts have codes (Code), associated status-storage (Storage) in addition to Balance and Nonce, including the extraction value of each variable . 创建合约时候会返回一个地址，知道这个地址就可以调用这个合约。调用过程中，代码不变但状态会发生改变，存储也会发生变化。 When you create a contract, you return an address where you know you can call the contract. The code changes but the status of changes and the storage changes during the call. ? 4.为什么创建以太坊，更换为基于账户的模型而不是沿袭比特币系统？ 4. Why create a tatai chamber and replace it with an account-based model instead of following the Bitcoin system? 比特币基于交易的模型隐私保护比较好，每次交易支持更换账户。 Bitcoin is better protected by model privacy based on transactions , with each transaction supporting the replacement of accounts. 以太坊是为了支持智能合约，对于合约来说，要求参与方的身份较为稳定。如果地址变了，那投入到原来合约的钱也就找不见了。 In order to support an intelligent contract, is required to be a more stable participant for the contract. If the address changes, the money invested in the original contract is lost. ? 16-ETH-状态树 一、什么是以太坊中的状态树 I. What's the status tree in the courtyard? ? ? ? ? 以太坊中采用的是一种基于账户的模式，想要实现这种模式需要完成从账户地址（Address）到账户状态（State）的映射。以太坊中的账户地址是160位的，也就是20字节，一般将其表示为40个十六进制的数。状态是指外部账户和合约账户的状态，包括余额，交易次数Nonce，对于合约账户还包括代码和存储。 ♪ ♪ An account-based model used in Etheria, which would require to complete the mapping from the account address (Address) to the account status (State). ? 二、实现从账户地址到账户状态的映射 II. Realizing mapping from account address to account status 方案一、哈希表+Merkle tree 用哈希表实现，系统中的全节点维护一个哈希表，每次有一个新的账户，插入到哈希表里面，查询账户的余额，就直接在哈希表中查询，如果不考虑哈希碰撞的话，基本上查询的效率是在常数时间内完成的，更新也是很容易在哈希表中更新的。 This is achieved by using the Hashi scale, which maintains a Hashi watch at all nodes of the system, with each time a new account is inserted into the Hashi table, the balance of the account is checked directly in the Hashi table, and the efficiency of the basic search is achieved within a constant number of hours if the Hashi collision is not taken into account, and the update is easily updated in the Hashi table. ? 问题： Question: 1.?如果用这个哈希表要提供merkle proof怎么提供？比如说你要跟一个人签合同，希望他能证明一下他有多少钱，怎么提供证明呢？ 1. How can you provide merkele proof with this Hash watch? For example, you're going to sign a contract with a man who can prove how much money he has, and how can you prove it? 类似比特币系统中的做法，把哈希表中的元素组织成一个Merkle Tree，然后算出一个根哈希值，这个根哈希值存在Block Header里，只要根哈希值是正确的，就能保证底下的树不会被篡改。 Like in the bitcoin system, the elements in the Hashi table are organized into a Merkele Tree, and then a root Hashi value is calculated that exists in Block Headerri, which guarantees that the trees below will not be tampered with as long as they are correct. 2.?比特币系统中也是每出现一个区块都要重新构造一个Merkle tree，这为什么没有问题？ 2. Why is there no problem with re-constructing a Merkle Tree for every block appearing in the Bitcoin system? 比特币系统中的Merkle tree是把区块里包含的交易组织成一个Merkle tree，那区块中的交易每次发布一个新的区块又有一系列新的交易，比特币中的Merkle tree是不变（immutable）的。每次发布一个新的区块对应一个Merkle tree，然后这棵Merkle tree构建完之后是不会再改的，下次再发布一个新的区块再构建一个新的Merkle tree。 The Merkle Tree in the Bitcoin system organizes the 那区块里有多少个交易呢？最多差不多4000个（按照1M字节，每个交易大概是250M字节左右），其实是一个上限。所以每次发布一个区块，比特币里要把这几百个到几千个交易构成一个Merkle tree。 How many transactions are there in the block? At most 4,000 (about 250 m by 1 M), which is actually a ceiling. So every time you issue a block, the bitcoin makes up a Merkle Tree of hundreds to thousands of transactions. ? 若以太坊中想要采取类似方法，需要把所有的以太坊账户一起构成一个Merkle tree，量要高出好几个数量级，相当于每次发布一个区块要把所有的账户遍历一遍构建出一个Merkle tree。 If a similar approach is to be taken in Tai Hwan, all Ether accounts need to be formed together as a Merkle Tree with 除了提供Merkle proof证明账户有多少钱之外，这个Merkle tree还有另外一个很重要的作用，就是维护各个全节点之间状态的一致性，如果没有根哈希值发布出来，每个节点就是在本地维护一个数据结构，那怎么知道你的数据结构的状态跟别人的数据结构的状态是不是一致呢，要各个全节点保持状态的一致才行，这也是为什么比特币中把根哈希值写在块头里的原因，就是对于当前区块中包含哪些交易，所有的全节点要有一个共识。 In addition to providing Merkle Proof with proof of how much money the account has, this Merkle Tree has a very important role to play, namely, to maintain consistency of status between the various nodes . If there is no Guernsey, each node is to maintain a data structure locally. How then do you know that your data structure is consistent with that of others? ? ? ? ? 综上所述，哈希表本身的效率是挺好的，插入、更改效率都很好。但实际操作中，账户状态发生变化的只是一小部分，大多数是不变的，所以每次都重新构造一次Merkle tree的代价太大了。 But in practice, the account state changes only a small fraction, mostly constant, so it costs too much to recreate Merkle Tree once at a time. 方案二、不排序的Merkle tree 1.?直接用一个Merkle tree把所有的账户都放进去，要修改账户状态的时候直接在Merkle tree里改？ 1.? Put all accounts directly in a Merkle Tree and change them directly in Merkle Tree when you want to change the account status? 问题①：Merkle tree没有提供一个高效的查找、更新的方法。 Question 1: Merkle Tree does not provide an efficient search and update method. 问题②：直接把账户放到Merkle tree里，如果不排序，查找速度会慢，比特币中如果证明一个交易在这个区块中是不需要排序的，如果证明一个交易不在这个区块中，是需要排序的，否则证明的代价就非常大了。 Question 2: To place the account directly in Merkle Tree, if not sorted, the search speed will be slow, and the price of proving that a transaction does not need to be sorted in this block in bitcoin is very high if it is not in this block. 如果不排序还有一个问题③：叶节点是这些账户的信息，如果不规定这些账户在叶节点出现的顺序，那么这样构建出来的Merkle tree不是唯一的。 If one more question is not sorted: the leaves dot is the information on these accounts, and if the order in which the accounts appear at the leaves dot is not specified, the Merkle Tree so constructed is not the only one. ? 2.?比特币中的节点也是不排序的，那为什么比特币就没有问题呢？ Why is Bitcoin not a problem? 比特币中的每个全节点收到的交易的顺序也是不一样的，理论上说构建的Merkle tree的根哈希值也是不一样的。 The order of transactions received at each full node in Bitcoin is also different, and theoretically the built Merkle Tree's GHH value is different. 但比特币中，每个节点在本地组装一个候选区块，这个节点自己决定哪些交易、以什么顺序打包进这个区块里，然后通过挖矿去竞争记账权。只有他有记账权，且发布区块后最终成为被大家接受的区块，这个顺序是唯一的，是发布这个区块的节点确定的。 In bitcoin, however, each node assembles a candidate block locally, which determines the transaction, the order in which it is packaged into the block, and then competes for rights of account through mining. Only he has the right to record the block, and when he issues the block, he becomes the accepted block, the order of which is the node of the node of the node of the block is the only one, the node of the node of the node of the node of the block . ? 3.?为什么以太坊不能这样做？ 3. Why can't Etheria do this? 因为如果也要这么做的话，需要把所有账户的状态发布到区块里，不是交易，个数差了很多个数量级。 Because if this were to be done, all accounts would need to be posted in blocks, not in transactions, with many different orders of magnitude. 账户状态可以维护在本地，而且大部分账户状态是不变的，一个区块里的交易只能改很少的账户，且重复发布，每隔十几秒发布一个新的区块，把所有状态都打包发布一遍，这个是不可行，刚才说明了不排序的Merkle tree是不行的。 It is not feasible to maintain the account status locally, and most of the account status is constant, and transactions in a block can only be changed to a very small number of accounts and published repeatedly, and a new block can be issued every 10 seconds, all of which are packaged. It has just been shown that Merkle Tree, which is not sequenced by , is not an option. ? 方案三、Sorted Merkle tree Programme III, Sorted Merkle Tree 也有问题。如新增一个账户时，产生一个账户的地址是随机的，他的叶节点的位置很可能是插在中间的，那后面这些树的结构都得变，插入，删除代价都很大，每次更新都需要新产生一遍Merkle tree。 There is also a problem. When an account is added, the address at which an account is created is random, his leaves node is likely to be inserted in the middle, and the structure of these trees will change, and they will be inserted and deleted at great cost, requiring a new Merkle Tree for each update. 区块链是不可篡改的，是说添东西容易，删东西难，其实以太坊中没有显式地删除账户的操作，有的账户上就一点钱，就一两个Wei，也不能把他删掉。? ? ? ? The chain of blocks is non-manufactured, that it is easy to add, that it is difficult to delete. In fact, there is no obvious operation to delete an account in Ethio, that there is only a little money on the account, that there is only one or two Wei, and that there is no way to delete him. ? 上面的方案都不行。那么以太坊中采用的方法是用一个叫MPT的结构，在此之前先学习一个简单的数据结构——trie。 None of the programs above. So the method used in the courthouse is to use a structure called MPT, before learning a simple data structure -- trie. ? ? 三、MPT结构 III. 1.Trie：字典树（前缀树） 1. Trie: The dictionary tree (/strong > ) 也是一种(key,value)的树，一般来说key用字符串用的比较多，如将一些单词排成一个trie的数据结构。比如将general,genesis,god,go,good排列成trie的数据结构如下图。 It's also a tree (key, value), which generally uses more string than a string, e.g. by sorting words into a trie data structure. For example, by arranging the data structure of a genesis, god, go, goood into the chart below. 2.Trie结构的特点 2. Characteristics of the Trie structure ①每个节点的分支数目取决于key值里每个元素的取值范围。 1 在以太坊中，地址是表示成40个十六进制的数，所以分叉数目（有时也叫做Branching Factor）是17，因为是十六进制的0~f，再加上结束标志位，所以是17。 In Etheria, the address is a 40-digit hexadecimal number, so the number of forks (sometimes also called Branching Factor) is 17, because the hexadecimal 0-f, plus the end signpost, is 17. ? ②trie的查找速率取决于key的长度，键值越长，查找需要访问的次数就越多。 The search rate for 2 以太坊中，所有键值都是40，因为地址都是40位十六进制的数。 In Etheria, all keys are 40, as the address is 40-digit hexadecimal. 比特币和以太坊的地址是不通用的，长度不同（比特币中的地址是用公钥取哈希得到的256位的哈希值），以太坊中的地址是公钥取哈希，只要后面这部分，就得到一个160bit的地址。 The addresses of Bitcoin and Etheria are not common, they are different in length (the address in Bitcoin is the 256-digit Hashi value obtained by the public key) and the address in the district is the public key, so long as the latter part is the address of 160bit. ? ③trie是不会出现碰撞的：只要两个地址不一样，最后肯定映射到树中的不同分支。 3 ④trie构造的树不受输入排序影响。 4 trees are constructed without input sorting . Merkle tree，如果不排序的话，一账户插入到Merkle tree 的顺序不一样，得到的树的结构也不一样。 Merkle tree, if not sorted, an account is inserted into Merkle tree in a different order and the structure of the tree is different. 而trie，只要给定的输入不变，无论输入怎么打乱重排，得到的树是一样的。不同的节点，不论你怎么按照顺序去插入这些账户，最后构造出来的树是一样的。 And trie, as long as the given input remains the same, gets the same tree regardless of how the input breaks the rehearsing. Different nodes, no matter how you insert these accounts in the order in which you do it, end up with the same tree. ? ⑤更新操作的局部性很好：每次发布一个区块，系统中绝大多数账户的状态是不变的，只有个别受到影响的账户才会变。 5 updates are local in nature ? 缺点：存储浪费。 Shortcomings: Waste in storage . 比如在上图中，左边分支都只有一个子节点，如果能把节点进行合并，可减小存储的开销，同时提高查找的效率，不用一个个往下找。由此引入了Patricia tree。 In the above figure, for example, there is only one sub-node on the left side, which, if combined, reduces the cost of storage while improving the efficiency of searching without looking down one by one. This introduces Patricia Tree. ? 3.Patricia tree（Patricia trie），经过路径压缩的前缀树，即压缩前缀树 将上图的trie进行路径压缩，结果如下图。 The path is compressed from the above map's trie, and the results are shown in the following graph. 压缩后，缩短了树的高度，访问内存的次数则会大大减少，效率会明显提高。 As a result of this compression, tree heights have been reduced, the number of visits to memory has been significantly reduced and efficiency has been significantly improved. 对于Patricia tree来说，新插入一个单词，原来压缩的路径可能需要扩展开。 For Patricia Tree, the original compressed path may need to be expanded by inserting a new word. ? 路径压缩在什么情况下效果比较好？ Under what circumstances is the path compressed better? 如英文单词，每个单词很长，但是一共没有几个单词。misunderstanding，decentralization（去中心化），disintermediation（非中间化）。用Patricia tree的话，参考下图 As in the English word, each word is long, but there are not a few words at all. ? 这样的结构效率是比较低的，用Patricia tree的结果如下图，这个树的高度明显改善。键值分布比较稀疏的时候，路径压缩效果比较好。如果应用在以太坊中，键值则为地址，地址是160位的，所以地址空间有，这是一个非常非常大的数，如果设计一个计算机程序的算法，需要进行运算的次数是2^160，那这个在我们的有生之年都不可能算出来，全世界的以太坊的账户数目加在一起也远远没有这么大，跟这个数比，是微乎其微的，所以以太坊的账户是非常非常稀疏的。 This is a less efficient structure, and the height of this tree is significantly improved by the results of Patricia Tree. The path compression is better when the 为什么设计地这么稀疏，不把地址长度缩短一点，这样访问效率也快，也没必要那么稀疏了？ ?以太坊中普通账户的创建方法跟比特币账户的创建方法是一样的，没有中央的节点，每个用户独立创建账户，在本地产生一个公私钥对，就是一个账户。为了防止两个人的账户碰撞（即产生的账户一样），特将地址设计得足够长，分布足够稀疏。这个可能看上去有点浪费，但是这是去中心化的系统防止账户冲突的唯一办法，所以在数据结构中，要用Patricia tree。 Why is it so thinly designed not to shorten the length of the address, so that access is efficient and unnecessary? The way that ordinary accounts are created in the courthouse is the same way that bitcoin accounts are created, there is no central node, each user creates an account independently, creating a public-private pair locally, is an account. ? 4.MPT（Merkle Patricia tree） （1）什么是Merkle Patricia tree (1) What's Merkle Patricia Tree? 区块链与普通链表的区别：把普通指针换成了哈希指针。 The distinction between a block chain and a normal chain table: replaces a normal pointer with a Hashi pointer. Merkel tree和Binary tree的区别：把普通指针换成了哈希指针。 The difference between Merkel Tree and Binary Tree: replace the ordinary pointer with the Hashi pointer. 在以太坊系统中，将所有账户组织成一个Patricia tree（用路径压缩提高效率），然后把普通指针换成哈希指针，计算出根哈希值，写在Block Header里。 In the Ethernium system, all accounts are organized into a Patricia Tree (promotion with path compression) and the general pointer is replaced by the Hashian pointer, which calculates the Ghanhashi value, which is written in Block Header. 比特币的Block Header里只有一个根哈希值，就是区块里包含的交易组成的Merkle tree组成的根哈希值；以太坊中有三个，有一个交易组成的交易树、用户状态组成状态树、和收据树，状态树由账户状态组成，他的根哈希值也是写在Block Header里。 Block Header in Bitcoin has only one gen-ha-hi, i.e. a gen-ha-hee made up of Merkle Tree, which consists of the transactions contained in the block; there are three in ? （2）根哈希值的作用 (2) The role of the Ghenhashi value ①防止篡改。根哈希值不发生变化，整个树的任何部分都没有办法被篡改。 1 prevents tampering with . The Ghenhashi value does not change and no part of the tree can be tampered with. ②Merkle Proof：证明账户的余额是多少。该账户所在的分支自己向上作Merkle Proof发给轻节点，轻节点可以验证该账户的余额。 2 Merkle Proof: proves the balance of the account . The branch of the account itself issues a light node to Merkle Proof to verify the balance of the account. ③验证一个交易是不存在的。如果存在的话，把这个分支作为Merkle Proof发过去。 3 verifies that a transaction does not exist . If there is one, send this branch as Merkel Proof. ? （3）以太坊中的MPT——Modified MPT (3) with MPT - Modified MPT ? ? ? ? 以太坊中用到的不是原生的MPT，是Modified MPT，这里对MPT做了一些修改，这些修改并非本质的修改，如图，树中的根节点Root取哈希后得到的根哈希值会被写在块头里，如图左上角所示。另，图中各个节点原本存放地址的位置在这里存放的都是哈希值，具体方式参考BTC-思考。 It's not the original MPT, it's the Modified MPT, and here's some changes to the MPT. These changes are not essential, as in the graph, where the root root of the tree, Root, when you take Hashi, will be written in a block, as shown in the upper left corner of the map. In addition, the original location of the node in the map is the Hashi value, in a way that refers to the BTC-thinking. ? 每次发布一个新的区块的时候，这个状态树中，有一些节点的值会发生变化，这些改变不是在原地修改，而是新建一个分支，所以说原来的状态实际上是保留下来的，如下图所示，以太坊中其实是一个大的MPT里面包含很多小的MPT，每个账户都有一个小的MPT。 Each time a new block is released, there are node values in this state tree that change not in situ, but in the creation of a branch, so that the original state is actually retained, as shown in the figure below, which is a large MPT containing many small MPTs, each account with a small MPT. ? 为什么要保留历史状态，不能在原地直接修改状态树？ Why keep the historical status and not directly modify the status tree in situ? 以太坊将出块时间降低到十几秒，导致临时性分叉成为常态（因为区块在网上传播时间可能也需要十几秒）。假设有个分叉，这两个节点同时获得记账权，上面的分叉胜出，成为最长合法连，下面这个分叉的节点就要回滚（roll back）。也就是说这个节点当前的状态（接受了下面这个节点的状态）要取消，退回到之前的状态，然后沿着上面那条合法链往下推进。为了实现回滚，就要维护这些历史纪录。 If there is one fork, the two forks are given the right to account simultaneously, the top fork wins and becomes the longest legal company, the next fork is to roll back. That means that the current state of the node (which accepts this node below) is to be removed, returned to its previous state, then moved down to the legal chain above it. is to maintain these historical records for to roll back. 比特币系统中，交易类型较简单，有时可通过反向操作推算出前一个状态。 In the bitcoin system, the transaction type is simpler and sometimes the previous state can be extrapolated by reverse operations. 以太坊中为什么不能直接回滚？因为以太坊中有智能合约，是图灵完备的，编程功能是很强的，从理论上说，可以实现很复杂的功能，跟比特币简单的脚本不太一样，所以以太坊中如果不保存前面的状态，智能合约执行完之后，想在推算出前面是什么状态，这是不可能的，所以想支持回滚，必须保存历史状态。 Why can't Ethers just roll back? Because Ethers have smart contracts, Turing is perfect, programming functions are strong, and theoretically, very complex functions can be performed, unlike a simple bitcoin script, so it is impossible for Etheria, if it does not save the pre-existing state, to figure out what the pre-existing state is when it is implemented, and it is not possible to support the rollback, and it is necessary to preserve the historical state. ? ? ?四、以太坊中的数据结构 ♪ Four, Ether's data structure ♪ 1.块头Block Header的定义 1. Definition of Block Block Block Block Header Bloom 布隆过滤器，提供一种高效的查询符合某种条件的交易的执行结果（跟收据树是相关的） Bronn filter to provide an efficient search for the results of the execution of a transaction that meets certain conditions (relevant to the receipts tree) GasLimit 单个区块允许的最多Gas总量（智能合约要消耗汽油费，类似于比特币中的交易费） Maximum amount of Gas allowed in individual blocks (intelligent contract costs petrol, similar to the transaction cost in Bitcoin) GasUsed 该交易消耗的总Gas数量 Total number of Gas consumed by the transaction ? ? ?2.区块Block的定义 ♪ 2. Definition of Block Block 3.External block 一个区块真正在网上发布的时候就是发布这些信息。 This information is published when a block is actually posted online. ? 状态树中保存的是（key,value)，key就是地址，前面主要讲的是键值，这个地址的管理方式。value，即账户的状态，是如何存储在状态树当中的？这需要经过一个序列化（RLP：Recursive?Length Prefix）的过程，然后再存储。 The state tree is saved by (key, value), and the address is the key value, which is the way the address is managed. Value, the account state, is stored in the state tree? This requires a sequenced process (RLP: Recursive? Length Prefix) and then storage. RLP是一种序列化方法，其特点是极简主义，越简单越好。 Protocal buffer：简称Protobuf，是个很有名的做序列化的库。 Protocal buffer: Protobuf is a well-known repository for sequencing. 跟这些库相比，RLP的理念就是越简单越好，只支持一种类型，nested array bytes（字节数组），即一个一个字节组成的数组（可以嵌套）。以太坊里的所有的其他类型，如整数和哈希表等，最后都要变成nested array bytes。所以，实现RLP要比实现Protocal buffer简单很多，因为难的东西都不做，都交给应用层做。 Compared to these libraries, RLP's idea is that the simpler the better, the easier it is, the easier it is to achieve one type, the easier it is to realize the RLP than to achieve Protocal Buffer, because the hard things are not done and are left to the application level. ? ? ? ? 17-ETH-交易树和收据树 1 7 > -ETH- transaction tree and receipt tree >/strong > 一、以太坊中，三种基于树的数据结构——状态树、交易树和收据树。 In Etheria, there are three tree-based data structures - status trees, trading trees and receipts trees. 所有的交易会组成一棵Merkle tree，叫交易树，类似于比特币系统中的Merkle tree。此外，以太坊中还增加了收据树，每个交易执行完之后会形成一个记录这个其相关信息的收据，交易树和收据树上面的节点是一一对应的。增加这个收据树的目的是便于快速查询执行的结果（主要因为以太坊的智能合约执行过程比较复杂）。 All the transactions of ? 从数据结构上来看，交易树和收据树都是MPT（Merkle Patricia tree），BTC中是MT（Merkle tree）。以太坊中的三棵树都用同样的数据结构，这样代码比较统一，便于管理，用MPT的一个好处是支持查找操作，可以通过键值从顶向下沿着这颗树查找。在状态树中，查找的键值就是这个账户的地址，对于交易树和收据树来说，查找的键值就是这个交易在发布的区块里的序号，这个交易的排列顺序是由发布区块的那个节点决定的。 From the data structure, both the transaction tree and the receipt tree are MPT ( Merkle Patricia tree ? 二、状态树、交易树和收据树的区别 II. Distinction between status, transaction and receipt trees （1）交易树和收据树都是只将当前发布的区块里的交易组织起来，状态树需要把系统中所有账户的状态都要包含进去。 (1) Both the transaction tree and the receipt tree organize the transactions in the currently issued block only, and the status tree needs to include the status of all ? （2）从数据结构上来说，多个区块的状态树是共享节点的（新发布一个区块的时候，只有该区块中改变了状态的节点需要新建一个分支，其他节点都是沿用原来状态树上的节点），相比之下，每个区块的交易树和收据树都是独立的，是不会共享节点的（一个区块和另一个区块发布的交易本身也认为是独立的）。 (2) In terms of data structure, the status tree of multiple blocks is a shared node (when a new block is issued, only the node in which the changed status of the block requires the creation of a new branch, while the other nodes follow the node on the original status tree), compared with the transaction tree and receipt tree of each block being independent and not sharing node (the transaction issued by one block and another is itself considered independent). ? 三、交易树和收据树的用途 Use of trading and receipt trees 1.交易树和收据树的用途 1. Use of trading and receipt trees ①向轻节点提供Merkle Proof。 1 Merkle Proof to light nodes. ②支持一些更加复杂的查询操作。 2 Supports a number of more complex query operations. 比如，查询过去十天当中，所有与某个智能合约有关的交易（一种方法是把过去十天产生的所有区块都扫描一遍，缺点：①复杂度较高；②存储要大，保存整个集合的元素；③轻节点没有交易列表，只有一个块头的信息，无法通过扫描所有交易列表来查询）。 For example, in the last 10 days, inquiries have involved all transactions related to an intelligent contract (one method is to scan all blocks that have been generated over the past 10 days, with the disadvantage of: 1 being more complex; 2 storing large and preserving the entire collection of elements; 3 light nodes do not have a list of transactions, and only one block of information cannot be searched by scanning all transaction lists). ? 2.如何实现复杂的查询操作 2. How to achieve complex query operations 以太坊中引入了Bloom Filter布隆过滤器)，这种数据结构可以支持比较高效的查找某个元素是不是在一个比较大的集合里。Bloom Filter给这个包含很多元素的集合计算出一个很紧凑的摘要（如一个128位的向量）。 This data structure supports a more efficient search for whether an element is in a larger collection. Bloom Filter calculates a tight 例：如图，给定一个数据集，含元素a、b、c，通过一个哈希函数H()对其进行计算，将其映射到一个其初始全为0的128位的向量的某个位置，将该位置置为1。将所有元素处理完，就可以得到一个向量，则称该向量为原集合的“摘要”。该“摘要”比原集合是要小很多。 Example: If you have a map, give a data set with elements a, b, c, calculated by a Hashi function H(), maps it to a position in a vector of 128 bits, initially zero. Once all elements are processed, you can get a vector, which is called the " summary " of the original collection. The " digest " is much smaller than the original collection. 假定想要查询一个元素d是否在集合中，H(d)映射到向量中的位置处为0，不在；H(d)映射到向量中的位置处为1，有可能d在，有可能因哈希碰撞产生误报。 Assuming that one element d is in a pool, H(d) map is zero in the vector and none; H(d) map is 1 in the vector, d is likely to be misreported as a result of the Hashi collision. 所以使用Bloom Filter要注意，可能出现误报false positive，不会出现漏报false negative。 ? Bloom Filter有各种各样的变种，为解决这样的哈希碰撞，有时候会用一组哈希函数，将某个待证明元素分别通过每个哈希函数映射到向量中的一个位置。一般来说，不会所有的哈希函数都出现哈希碰撞。Bloom Filter的局限性是不支持删除操作。比如把a删掉了，对应的向量1要不要改。若要支持删除操作，则需要将向量中的值改成一个计数器，记录该位置有多少元素映射过来，而且还需要考虑到计数器会不会溢出。 Bloom Filter has a variety of variables, and in order to deal with this type of Hashi collision, sometimes a group of Hashi functions is used to map an element to one of the vectors separately. In general, not all Hashi functions are subject to Hashi collisions. The limitation of Bloom Filter is not to delete the operation . For example, delete aa and the corresponding vector 1 is changed. To support the deletion of the operation, it is necessary to change the value to a meter, to record how many elements of the location are captured, and also to consider whether the meter is likely to overflow. ? 3.以太坊中Bloom Filter的用途 3. Use of Bloom Filter in the Tails 每个交易执行完之后会形成一个包含Bloom Filter的收据，Bloom Filter用于记录交易的类型、地址等信息。发布的区块的块头里也有一个总的Bloom Filter，是这个区块里所有交易的一个Bloom Filter的并集。 After each transaction is executed, a receipt containing Bloom Filter, 比如说要查找过去十天发生的跟智能合约相关的交易，可以找一些有哪些区块的块头的bloom filter有要的交易类型，如果有，再去查找区块里面包含的交易所对应的收据树里面的那些Bloom Filter（就每个收据的bloom filter）看看哪个有，也可能都没有，可能是false positive。如果是有的话，再找到相对应的交易直接进行一下确认，好处是通过Bloom Filter的结构能够快速过滤掉大量无关的区块。 ? 四、以太坊的运行过程 IV. Ether's running process 这三棵树的根哈希值都包括在块头里面，以太坊的运行过程可以看作一个交易驱动的状态机（Transaction-driven State Machine），这个状态机的状态是所有账户的状态，即状态树中包含的那些内容，交易是指每次发布区块里包含的交易，通过执行这些交易会驱动系统从当前状态转移到下一个状态。 The root-hash values of the three trees are included in the block, and the operation of the Taiwan can be seen as a state machine driven by the transaction-driven State Machine , which is the state of all accounts , i.e. those contained in the status tree, that is, the transactions contained in each release block, which will drive the system from the current state to the next state through the implementation of these transactions. 比特币系统也可以认为是一个交易驱动的状态机，比特币中的状态是UTXO（没有被花掉的那些输出），每次新发布一个区块，会从UTXO里用掉一些输出，又会增加一些新的输出，发布的区块会驱动系统从当前状态转移到下一个状态。而且这两个状态机有一个共同的特点，就是状态转移都得是确定的，对一个给定的当前状态，一组给定的区块中包含的交易，能确定性地转移到下一个状态。因为所有的全节点，所有的矿工，都要执行同样的状态转移，所以状态转移必须是确定性的。 The Bitcoin system can also be considered a transaction-driven state machine in which the state in bitcoin is UTXO (which has not been spent on those outputs), where each new release of a block uses some output from UTXO and adds some new output, and the release of blocks will drive the system from the current state to the next state. And the two state machines have a common feature, which is that the state transfer has to be determined, and the transaction in a given current state, which is contained in a given block, can be transferred with certainty to the next state . Because all occurrences are subject to the same state transfer, the status transfer must be determinative. ? 问题： Question: 1、A转账到B，有没有可能收款账户不包含在状态树中？ 1-A transfers to B. Is it possible that the collection account is not included in the status tree? 可能。因为以太坊中账户可以节点自己产生，只有在产生交易时才会被系统知道。 Possible. Because the Etherm accounts can be generated by nodes themselves, they will only be known by the system when a transaction is generated. ? 2、可否将每个区块中状态树更改为只包含和区块中交易相关的账户状态？ 2. Can the status tree in each block be changed to account status relating only to transactions in the block? 不能。①查找账户状态很不方便；②因为需要知道收款账户的状态，才能给其添加金额，要向一个新创建账户转账，所有需要一直找到创世纪块才能知道该账户为新建账户，系统中并未存储，而区块链是不断延长的。 Unable to do so. 1 Account status is not easy to find; 2 Because of the need to know the status of the collection account in order to add an amount to it, and to transfer to a new start-up account, all need to be able to find the start-up block all the time to know that the account is a new account, that it is not stored in the system, and that the chain of blocks is constantly extended. ? 交易树和收据树的创建过程——代码中的具体体现 The process of creating a transaction tree and a receipt tree — actual representation in the code 链接：https://blog.csdn.net/YSL_Lsy_/article/details/126436571?spm=1001.2014.3001.5502 Links: https://blog.csdn.net/YSL_Lsy_/article/details/1264366571?spm=1001.2014.3001.5502 ? 18-ETH-GHOST 一、以太坊的出块时间及可能带来的问题 1.以太坊的出块时间 以太坊将出块时间降到了十几秒，提高了系统的吞吐量（Throughput）、降低了反应时间。比特币和以太坊都是运行在应用层的共识协议，底层是一个P2P的Overlay Network，Overlay Network本身的传输时间比较长（其拓扑协议做flooding的时候没有考虑实际的拓扑结构）。 问题：发布区块时，该区块在网络上传到其他节点可能需要十几秒，那么就有较大可能会有两个节点（甚至多个），同时获得记账权，从而造成临时性分叉。 ? 2.以太坊与比特币系统的平均出块时间对比 对于比特币系统来说，平均出块时间是600秒，足够让新发布的区块传播到网上的其他节点，但挖矿是个概率的过程，仍有两个矿工同时获得记账权、同时发布区块的可能，会带来临时性的分叉。 在以太坊中，这种临时性的分叉会变成常态，而且分叉的数目也会变得更多，这对于共识协议来说，是一个挑战。 ? ? 3.带来的问题 ? 假定中间区块胜出，则上下两个区块叫做Orphan Block或Stale Block，挖到这类区块的矿工在里面有一个铸币交易，得到的出块奖励最后等于作废。对于比特币来说，这种临时性的分叉不是很多，所以这么规定可以接受。 对于以太坊来说，如果也将分叉区块的出块奖励作废的话，则意味着这个矿工挖到的区块有很大概率是白挖，对于个体矿工特别明显。按照常理，矿工的收益应该与算力成正比，矿池的收益也应当与矿池的总算力成正比。但大型矿池会出现Mining Centralization（挖矿集中化），即大型矿池所在的分叉更有可能成为最长合法链，这促使别的矿工沿着最长合法链继续挖。这样会使大型矿池出现恶性循环，越是大型矿池得到的收益越大，Mining Centralization更严重，有时候叫Centralization Bias，即中心化带来的不成比例的优势。如果以太坊按照比特币的共识机制就会有一定的问题。 ? 二、GHOST协议 为解决以太坊如果按照比特币的共识机制产生的问题，采用一个基于GHOST协议的共识机制，这个协议并非以太坊发明的，以太坊只是对该协议做了一些修改。 ? 1.GHOST协议的核心思想 挖到矿的矿工发布一个区块，即便这个区块最后作废了，也能得到一些出块奖励，将作废的区块（Orphan Block或Stale Block）称为Uncle Block。相对于最长合法链的当前区块来说，是他的叔父区块，最长合法链的下一个区块在发布的时候可以把叔父区块包含进来，如下图。 该协议的核心思想是：给予挖到矿但是没有成为最长合法链的那些矿工一种安慰。这样有利于鼓励系统中出现分叉后及时合并，相当于最长合法链上面的区块将另外两个分叉链给招安过来，这是GHOST协议最初的版本。 ? 2.GHOST协议的缺陷 （1）Uncle Block的个数不能超过两个 设计GHOST的目的是给Uncle Block一点好处，把它们合并过来，但是只能招安两个。叔父区块得到八分之七的出块奖励是很高的，要是不限制的话，那么以太币就太不值钱了。 ? （2）区块传播存在延迟 区块D把区块A作为叔父区块的前提是：在挖这个区块D的时候已经知道区块A这个叔父区块的存在。 ? （3）受矿工主观影响 如果这个矿工比较自私的话，有可能故意不包含叔父区块。对叔父区块来说，7/8的出块奖励是得不到的，对于他自己来说，1/32的出块奖励是得不到了，好像是损人不利己，但要从商业竞争的角度讲，这么做对这个矿工的损失是比较小的，对挖出叔父区块的矿工的损失是比较大的。 ? 3.改进后的GHOST协议 决了矿池出于竞争关系故意不把某个叔父区块包含进去的问题。比如区块D故意不包含区块A，但是区块E仍然可以包含区块A。甚至有可能出现一个情况：挖到区块A的矿工发现自己不在最长合法链上，就沿着区块D挖出了区块E，然后就可以把自己的区块A包含进去。 ? 也解决了出现第三个叔父区块的问题。把叔父的定义扩展了，可能是隔着几代的叔父。以太坊规定，叔父区块可以得到7/8的出块奖励。如果往前推一代，叔父区块得到6/8的出块奖励。合法的叔父只有6个辈分。 为什么设定合法的叔父必须在当前区块在七代以内且有共同的祖先？ （1）如果不限制，全节点需要维护非常多的状态（可能要记着隔着100代以前有哪些叔父区块），新发布的区块包含的叔父区块，其他节点同样也需要验证； ? （2）设计最多隔着7代，且出块奖励是逐渐递减的，有利于鼓励出现分叉之后，尽早合并，一出现分叉就马上合并的时候能得到的出块奖励是最多的。 ? 叔父区块的奖励叫做Uncle Reward，当前区块包含一个叔父区块，就会得到1/32的出块奖励，不论包含的是哪一个辈分的叔父。 ? 4.改进后的GHOST协议无法解决的问题 主要是为了解决系统中出现的临时性分叉（State Fork），规定最长合法链的原则的目的是防止篡改，也是为了解决临时性分叉。 如果这个分叉是别的原因造成的，比如由于对运行的区块链协议有不同的意见，那么这种方法是解决不了的，也就是说，改进后的GHOST协议仍然无法解决硬分叉。 ? 例如，比特币系统跟中心化的系统不一样（中心化的系统发布一个新版本很容易），去中心化系统如果修改的话，会出现硬分叉。下图的那两条链如果不是因为对当前状态有意见分歧，而是互相认为对方是非法的，那么用这种方法是合并不了的。如果有矿工将这样的区块包含进来，其他矿工会认为这条链是非法的，还是不会沿着这条链继续挖，因为：即使主链最长，但是包含非法交易。 三、以太坊中的奖励 区块链和以太坊发布一个区块能得到的奖励如下图，叔父区块得到八分之七的奖励只限于Block Reward，即7/8×3ETH。叔父区块是得不到汽油费的，但汽油费所占的比例是非常小的，大部分是出块奖励，跟比特币的情况是类似的。 以太坊中没有规定定期要把出块奖励减半，比特币那么规定是为了人为制造稀缺性，以太坊中五个以太币降为三个以太币，不是为了认为制造稀缺性，实际上跟挖矿难度调整有关，2017年，挖矿难度炸弹被回调了300万个区块，导致挖矿难度大幅度下降，为了维护公平性，也是为了使以太币的供给量不要出现剧烈变化，所以降到了三个以太币，这是一次性的，并没有说以后会不断地下调。 ? 比特币一般当作数字黄金，是用来储值的；以太币被比喻成石油，它是用来花的，用来消耗，然后可以执行智能合约的。这个比喻不是完全的恰当，因为石油花完之后就没了，而以太坊中执行智能合约要消耗的gas，只是从一个账户转移到另外一个账户，发布智能合约的时候，要付出gas费，执行这个智能合约的矿工可以得到这个gas费，所以这个比喻也不完全恰当。 ? 四、思考 1.把叔父区块包含进来的时候，叔父区块的交易要不要执行？ 不应该执行，最长合法链上的父区块和他的叔父区块包含的交易可能是冲突的，如果它们包含不同的交易，不同交易有可能不能都执行。在以太坊中，双花攻击花两次减两次，但是有可能一个交易花了之后，另一个交易就没法花了。叔父区块本身不一定是非法的，但执行完父区块的交易，再去执行叔父区块的交易可能就变成非法的。 以太坊中只执行在最长合法链上的交易。而且根本就不检查叔父区块交易的合法性，只检查叔父区块是不是一个合法发布的区块，即这个区块是不是符合挖矿难度，也就是有没有获得记账权。 ? 2.叔父区块能不能广义化？ 叔父区块都是分叉之后第一个区块。假定，将后面一连串的区块认为是叔父区块，会造成一个后果：分叉攻击的代价过低。正常意义上的分叉攻击需要使分叉链长度大于原来最长合法链长度才算成功，否则这些用来分叉攻击的区块会作废，原本的出块奖励也没有了。如果将分叉链上的区块认为是叔父区块的话，分叉攻击不成还能作为叔父区块获得一些奖励。所以以太坊中规定，只有分叉后的第一个区块可以得到Uncle Reward，后面的都不行。 五、以太坊中的真实情况 Etherscan.io可以实时查看以太坊的当前状态，右边这个曲线显示的是过去两周的交易历史，下面还包含最新挖出的区块和最新的交易。 下图所示为叔父区块的几种情况，这里的每一行对应一个叔父区块，第一列的Block Height就是区块的序号，也就是Block Number，与表中不同辈分的叔父得到的Uncle Reward的数目相对应。 下图是两个区块的具体例子，左边这个区块包含了一个叔父区块，倒数第二行uncle reward是2.25，应该是距离为2的叔父。这个区块得到的奖励，在倒数第三行，有三个部分组成，即3ETH出块奖励、汽油费和包含叔父区块得到的三十二分之一的出块奖励。 ? ?
注册有任何问题请添加 微信：MVIP619 拉你进入群
打开微信扫一扫
添加客服
进入交流群
发表评论