Bitcoin & Blockchain: Consensus Without Authority

How Bitcoin solves Byzantine consensus in an open, anonymous network. The 5-component framework, Nakamoto consensus steps, UTXO model, PoW vs PoS, and comparisons across Bitcoin, Ethereum, Hyperledger Sawtooth, Fabric, and Ripple.

Traditional consensus (Paxos, Raft, PBFT) works among a fixed, known set of participants who already trust the system. Blockchain solves a harder problem: reaching consensus on a shared transaction history among a large, open, pseudonymous set of participants where some may be actively adversarial — without any central authority.

Classical SMR (Paxos / Raft / PBFT)

  • • Fixed, known participants
  • • Identity always known
  • • Incentive to participate = job / contract
  • • Deterministic finality
  • • O(N²) messages (PBFT) → limited N
  • • Trusted admin manages membership

Blockchain Consensus

  • • Open: anyone can join/leave
  • • Pseudonymous (public key hash)
  • • Incentive = block reward / tx fees
  • • Probabilistic (PoW) or deterministic (BFT)
  • • O(N) gossip → scales to thousands
  • • Sybil resistance via proof-of-X

The 5-Component Framework

Xiao et al. (IEEE 2020) identified exactly 5 key components that every blockchain consensus protocol must implement. Understanding these lets you systematically compare any two blockchain systems and explain design trade-offs.

Classical SMR equivalent:
Leader election
Broadcast primitive
Log consistency check
Commit phase
N/A — unique 🔑

💡 Key Insight: The Unique 5th Component

The incentive mechanism has no counterpart in classical SMR. Paxos, Raft, and PBFT assume servers are operated by a single organization that already has reason to be honest. Blockchain operates in open, zero-trust environments where rational participation must be made financially dominant over defection.

Component 1: Block Proposal

The proposal mechanism determines who gets to build the next block. It must be Sybil-resistant: creating fake identities should not give an attacker proportionally more proposals.

Proof of Work (PoW)
Burn CPU / energy
Bitcoin, Litecoin
Fault tol: 50% hash | Energy: very high
Proof of Stake (PoS)
Lock up tokens as collateral
Ethereum (Casper), Cardano
Fault tol: 33–50% | Energy: low
Proof of Authority (PoA)
Stake real-world identity
Ethereum testnets, POA Network
Fault tol: BFT | Energy: very low
Proof of Elapsed Time (PoET)
Intel SGX timer race
Hyperledger Sawtooth
Fault tol: 50% | Trust: Intel SGX
Round Robin / Lottery
Take turns (known participants)
Hyperledger Fabric orderer
Needs trusted participant set
Committee-Based
Randomly chosen sub-group
Algorand, EOSIO
Needs identity management

Component 2: Information Propagation

Once a block is proposed, it must reach all nodes efficiently and reliably. Bitcoin uses an advertisement-based gossip protocol (INV → GETDATA → BLOCK) to avoid redundant transmissions of the full block.

Bitcoin Gossip Protocol — Advertisement-Based Propagation

INV → GETDATA → BLOCK (avoids redundant transmissions)

t = 0.0s
MINERhop 0N1N2N3N4N5N6N7
Phase 0: Node 0 mines block #831,743

Why 10-minute block intervals?

# Block interval analysis (Croman et al. 2016)
Bitcoin propagation delay: ~40 seconds average
Block interval: 10 minutes → fork rate ≈ 1%
If interval ≈ propagation delay:
• Two miners extend different chains simultaneously → FORK
• Higher fork rate → honest mining power wasted on orphans
• Attacker needs LESS than 50% hash power to double-spend
Max safe throughput at 10-min intervals: ~27 TPS
VISA processes ~2,500 TPS average

Component 3: Block Validation

Each node independently validates every block it receives before accepting it or re-broadcasting it. Validation is stateless per block but stateful across the chain.

Node Validation Process
BLOCK HEADER CHECKS
Block header hash satisfies PoW difficulty: SHA256²(header) < T
Previous block hash matches a known block in local chain
Timestamp within acceptable range (±2 hours)
Merkle root correctly commits to the transaction list
Block size ≤ max block size (1MB in Bitcoin)
TRANSACTION CHECKS
All input UTXOs exist and are unspent (UTXO set lookup)
Sum of inputs ≥ sum of outputs (no coins created from thin air)
Each input carries a valid ECDSA signature from UTXO owner
No double-spend conflict within this block

📋 Stateless Block, Stateful Chain

Block validation is stateless per-block but stateful across the chain: checking that a UTXO is unspent requires the node to maintain the full UTXO set — a database of all currently unspent transaction outputs. Bitcoin nodes keep ~5 GB of UTXO data in memory as of 2024.

Component 4: Block Finalization

Finalization determines when a block is considered irreversibly part of the canonical chain. There are two fundamentally different approaches.

Probabilistic Finality (Nakamoto)

  • • Longest-chain rule
  • • Pr[reverted at depth m] = (α/(1-α))^m
  • • Wait 6 confirmations (~1 hour in Bitcoin)
  • • Fork resolution: implicit (honest majority eventually wins)
  • • Scales to thousands of nodes (O(N) gossip)
  • • Examples: Bitcoin, Litecoin, pre-Merge Ethereum

Deterministic Finality (BFT-style)

  • • PBFT / Tendermint / HoneyBadgerBFT
  • • Once 2f+1 nodes commit → FINAL, cannot be reverted
  • • Confirmation: 1–2 rounds (seconds to minutes)
  • • No forks — consensus is explicit
  • • Limited to ~100 nodes (O(N²) messages)
  • • Examples: Hyperledger Fabric, Tendermint, Casper FFG
Blockchain Fork Animation

Longest-chain rule: honest miners always extend the heaviest chain.

Stage 1: Normal chain growth

Three blocks have been mined in sequence. All nodes agree on this chain.

B1
0000a1f3
B2
0000b2e9
B3
0000c4d7
Stage 1 of 4
Advanced: The GHOST Rule (Ethereum pre-Merge)
# GHOST (Greedy Heaviest Observed SubTree)
Problem: longest-chain rule wastes honest mining power (orphaned blocks)
GHOST: use heaviest subtree (most accumulated work), not longest chain
How uncle blocks work:
→ Orphaned blocks ("uncles") count toward chain weight
→ Miners get partial reward for uncle blocks (1.75 ETH pre-Merge)
→ Allows shorter block interval (12s) without sacrificing security
Result: Ethereum had ~10% uncle rate with 12-second blocks
vs Bitcoin's 1% uncle rate with 10-minute blocks

Component 5: Incentive Mechanism

🔑 Why classical SMR has no incentive mechanism

In Paxos/Raft, servers participate because they are operated by the same organization — a bank's data centers, a company's cloud VMs. There is no question of whether they will behave honestly; they have operational motivation (contracts, employment) to do so. Blockchain's open environment requires explicit economic incentives.

# Bitcoin Incentive Structure
Block reward (subsidy):
2009: 50 BTC/block
2012: 25 BTC/block (1st halving)
2016: 12.5 BTC/block (2nd halving)
2020: 6.25 BTC/block (3rd halving)
2024: 3.125 BTC/block (4th halving — April 2024)
~2140: 0 BTC/block (all 21M BTC mined)
Transaction fees (persist forever):
Miners keep all tx fees in the blocks they mine
High-load periods: fees can exceed block subsidy

⚠️ Mining Pool Centralization

# Gencer et al. 2018 measurement
> 50% of Bitcoin hash power: 8 mining pools
> 50% of Ethereum hash power: 5 mining pools
This de-facto centralizes PoW despite the decentralized design.
A colluding set of large pools could execute 51% attacks.

The Nakamoto Process: 6 Steps

Bitcoin's consensus protocol can be described as exactly six steps, originally specified in Satoshi Nakamoto's 2008 whitepaper.

Step 1: New transactions broadcast to all nodes

Alice creates a transaction: she wants to send 5 BTC to Bob. She signs it with her private key and broadcasts it to the P2P network. Every node that receives it adds it to their local mempool — a pool of unconfirmed transactions waiting to be included in a block.

AliceTX senderNode BMEMPOOLNode CMEMPOOLNode DMEMPOOLNode EMEMPOOLNode FMEMPOOLsigned TX
Step 1 of 6

💡 The Elegance of Implicit Consensus

Unlike PBFT where nodes exchange explicit COMMIT messages, in Nakamoto consensus nodes "vote" by extending the chain. The chain itself IS the consensus record. There is no separate "agreement" phase — mining the next block on top of a block IS the vote for that block.

The UTXO Model: How Bitcoin Tracks Ownership

Unlike Ethereum's account model (which stores balances), Bitcoin uses Unspent Transaction Outputs (UTXOs). Your "balance" is not stored anywhere — it's the sum of all UTXOs your private key controls.

UTXO Transaction Chain

Each coin is an Unspent Transaction Output. Spending destroys the UTXO and creates new ones.

TX1 — Coinbase
Block #831,741 reward
Inputs
(no inputs — newly minted)
Outputs
Alice: 50 BTCUTXO
creates UTXO A
TX2 — Alice → Bob
spends UTXO A
Inputs
UTXO A (50 BTC)+ Alice sig ✍️SPENT
Outputs
Bob: 30 BTCUTXO
Alice (change): 19 BTCUTXO
Miner fee: 1 BTC(miner)
creates UTXOs B, C
TX3 — Bob → Charlie
spends UTXO B
Inputs
UTXO B (30 BTC)+ Bob sig ✍️SPENT
Outputs
Charlie: 28 BTCUTXO
Miner fee: 2 BTC(miner)
UTXO = coin
Each green "UTXO" label is a spendable coin. Your balance = sum of all UTXOs your key controls.
Spent = destroyed
When a UTXO is used as input, it's removed from the UTXO set. It cannot be spent again.
Change outputs
Inputs must be fully consumed. Leftover value returns to the sender as a "change" UTXO.

No account balances in Bitcoin

To find "Alice's balance," you must scan the entire UTXO set for outputs locked to Alice's public key hash. This is why Bitcoin full nodes maintain the UTXO set in memory: ~5 GB as of 2024, containing ~100 million entries. Each UTXO carries a locking script (scriptPubKey); spending requires a matching unlocking script (scriptSig) — typically a signature.

System Comparison: All 5 Components

Comparing Bitcoin, Ethereum, Hyperledger Sawtooth, Hyperledger Fabric, and Ripple across the 5-component framework.

ComponentBitcoinEthereumH. SawtoothH. FabricRipple
Block ProposalPoW (SHA256²)PoS (Casper)PoET (SGX timer)Round-robin ordererRPCA (UNL voting)
Info PropagationGossip (INV→GETDATA→BLOCK)GossipGossipGossip (per channel)Gossip
Block ValidationPoW + UTXO set + MerklePoS + account state + MerklePoET cert + txn validityEndorsement policy (N-of-M)UNL 80% agree
Block FinalizationProbabilistic (6 conf ≈ 1h)Deterministic (Casper FFG)ProbabilisticDeterministic (PBFT)Prob. (80% UNL)
IncentiveBlock reward + tx feesBlock reward + tx feesNone (enterprise)None (enterprise)None (XRP pre-mined)
Fault Tolerance50% hash power33% staked ETH50% (SGX-attested)33% (PBFT)20% (UNL overlap)
Finality TypeProbabilisticDeterministicProbabilisticDeterministicProbabilistic
Network TypePermissionlessPermissionlessPermissionedPermissionedSemi-permissioned
TPS~7~15–100~1,000~1,000–3,000~1,500

⚡ Ripple's Unique Node List (UNL)

Each validator defines its own UNL = list of validators it trusts
Consensus requires 80% yes-votes in the FINAL round from UNL peers
# Safety requirement:
For global consensus: any two UNL cliques must share ≥ 20% of nodes
|UNL_i ∩ UNL_j| / max(|UNL_i|, |UNL_j|) ≥ 1/5
Fault tolerance: 1/5 (20%) — weaker than PBFT's 1/3
⚠️ "Open" in theory, but Ripple publishes a recommended validator list
→ Functionally permissioned despite formally open design

The Permissioned vs. Permissionless Axis

The choice between permissioned and permissionless blockchain is the most fundamental design decision. It determines which of the 5 components are even applicable.

Blockchain Permission Spectrum

Click any system to see its details. No system is purely "decentralized" or "centralized" — it's a spectrum.

← PermissionlessPermissioned →
Open · AnonymousRestricted · Identified
Permissionless Characteristics
  • • Open join/leave — no approval needed
  • • Pseudonymous (public key = identity)
  • • PoW/PoS Sybil resistance
  • • Probabilistic finality
  • • Block rewards essential for participation
  • • 7–30 TPS typical
Permissioned Characteristics
  • • Known, authenticated participants
  • • Real identity required (PKI / MSP)
  • • BFT consensus (PBFT, Raft)
  • • Deterministic finality
  • • No incentive mechanism needed
  • • 1,000–3,000+ TPS
DimensionPermissionlessPermissioned
IdentityPseudonymousKnown, authenticated
Join/leaveFree (no approval)Requires authorization
ConsensusPoW/PoS (Nakamoto or hybrid)BFT (PBFT, Raft)
Throughput7–1,500 TPS1,000–3,000+ TPS
FinalityProbabilisticDeterministic
IncentiveEssential (block rewards)Not needed
Sybil protectionProof-of-X (resource cost)Identity management
ExampleBitcoin, EthereumHyperledger Fabric, Ripple

Interactive Proof-of-Work Demo

This demonstrates Component 1 (Block Proposal) for the Bitcoin/Nakamoto protocol. Find a nonce N such that SHA256(SHA256(block_header + N)) starts with the required leading zeros. Bitcoin adjusts difficulty every 2,016 blocks (~2 weeks) to target a 10-minute average block time.

Interactive Proof-of-Work Demo

Uses browser WebCrypto (double SHA-256). Leading zeros highlighted in green.

1 zero (~instant)4 zeros (~seconds)
How this works: We compute SHA256(SHA256(blockData + nonce)) for nonce = 0, 1, 2, … until finding a hash with 2 leading zeros. Bitcoin requires ~76 leading zero bits, taking ~10 minutes for the entire global network.

# Real Bitcoin context (June 2024)

Current difficulty: ~83 trillion (requires ~76 leading zero bits)

Global network: ~600 EH/s (6 × 10²⁰ hashes/second)

Average time to find valid nonce: ~10 minutes

Your browser demo uses 1–4 zero bits → finds it in milliseconds

Bitcoin Block Explorer: Field Annotations

Each field in a Bitcoin block header maps to one of the 5 consensus components:

Bitcoin Blockchain — Recent Blocks

Each block references its predecessor via prev_hash. Changing any block invalidates all subsequent blocks.

Block #831,742(latest)
000000000000000000025b4c8b9f3a71e2c4d88f1b6
2,847 txns
1.47 MB
Timestamp
2024-01-15 14:23:07 UTC
Miner
Foundry USA Pool
Nonce
2,873,461,293
Merkle Root
7f3a9e2c4b1d8a5e6c3f0d1b2e4a7c9f
Previous Hash (links to block below)
000000000000000000038d2c7b5e9f1a4c6e8b0d3f5
prev_hash
Block #831,741
000000000000000000038d2c7b5e9f1a4c6e8b0d3f5
3,102 txns
1.61 MB
Timestamp
2024-01-15 14:11:52 UTC
Miner
AntPool
Nonce
1,947,283,651
Merkle Root
3a8f1c5e9b2d6a0f4c7e2b5d8a1c4f7b
Previous Hash (links to block below)
000000000000000000041f9e5c8b2d6a3e7c0f4b8d1
prev_hash
Block #831,740
000000000000000000041f9e5c8b2d6a3e7c0f4b8d1
2,654 txns
1.38 MB
Timestamp
2024-01-15 14:00:38 UTC
Miner
Binance Pool
Nonce
3,102,948,572
Merkle Root
9c4e2a7f0b5d8c1e3a6f9b2d5c8e1a4f
Previous Hash (links to block below)
000000000000000000052b8c4e7f1a9d3c5e0b2f6a8
Leading zeros (proof of work)
Previous hash chain link
Latest block
PROPOSALNonce, Bits/Target
VALIDATIONHash, Merkle Root, Timestamp
FINALIZATIONPrevious Hash (chain link)
INCENTIVEBlock Reward (3.125 BTC + fees)

Merkle Tree: Transaction Commitment

The Merkle root in the block header commits to all transactions. O(log n) proof that any single transaction is included — without downloading the full block.

Merkle Tree Visualizer

Edit any transaction to see how the change propagates up the tree (shown in red). Click any node to see its full hash.

Merkle Root
Intermediate / Leaf nodes
Changed (affected path)
Click any node to see full hash

Blockchain Exam Questions

Click any question to reveal the model answer.

New: Blockchain Framework Questions (15)

Core: Bitcoin Mechanics (Q10–Q14)