区块链揭秘

概念： What Is a Block, Hash Function, Chain: prevHash, Merkle Tree, Why Unfakeable, Nodes, New Block Birth

:::section{mins=2} What Is a Block :::

:::lead A [[gloss:block|block]] is a page in a ledger. It records [[gloss:transaction|transactions]] from a specific time period. :::

:::p{html} Each [[gloss:block|block]] contains three things: [[gloss:transaction|Transactions]] — a list of operations: who, to whom, how much. One [[gloss:ethereum|Ethereum]] [[gloss:block|block]]: usually 100-200 [[gloss:transaction|transactions]]. Previous [[gloss:block|block]] [[gloss:hash|hash]] (prevHash) — the "fingerprint" of the previous page. Links [[gloss:block|blocks]] in a chain. Metadata — [[gloss:block|block]] number, time, who created it, auxiliary information. :::

:::callout A [[gloss:block|block]] is an envelope. Inside — checks ([[gloss:transaction|transactions]]). On the envelope — a number and fingerprint of the previous one. Envelopes in a row — [[gloss:blockchain|blockchain]]. :::

:::keypoints{label="Key points"}

  • [[gloss:block|Block]] contains [[gloss:transaction|transactions]], previous [[gloss:block|block]] [[gloss:hash|hash]], and metadata
  • prevHash links [[gloss:block|blocks]] into an unbreakable chain
  • One [[gloss:ethereum|Ethereum]] [[gloss:block|block]] typically holds 100-200 [[gloss:transaction|transactions]]
  • Metadata includes [[gloss:block|block]] number, creation time, and creator information :::

:::details{badge=Advanced title="Ethereum Block Structure & UTXO vs Account Model"} :::p{html} [[gloss:bitcoin|Bitcoin]]: UTXO model. No "account with balance." There are unspent [[gloss:transaction|transaction]] outputs (UTXOs). Balance = sum of all UTXOs for an address. A [[gloss:transaction|transaction]] consumes (inputs) some UTXOs and creates (outputs) new ones. Like cash: paid $50, got $30 change. :::

:::p{html} [[gloss:ethereum|Ethereum]]: Account model. Two types of accounts: EOA (regular [[gloss:wallet|wallet]], [[gloss:private key|private key]]) and Contract Account ([[gloss:smart contract|smart contract]], code). Each account: nonce, balance, storageRoot, codeHash. A [[gloss:transaction|transaction]] modifies state directly: balance[from] -= value, balance[to] += value. :::

:::p Consequence: [[gloss:bitcoin|Bitcoin]] — scan ~90M UTXOs for balance. [[gloss:ethereum|Ethereum]] — one field in state trie. But state trie grows: full [[gloss:node|node]] 1TB+. :::

:::p [[gloss:block|Block]] size: [[gloss:bitcoin|Bitcoin]] ~1-4 MB (after SegWit). [[gloss:ethereum|Ethereum]] — limited by [[gloss:gas|gas]] (30M gas limit), not size. [[gloss:block|Block]] time: [[gloss:bitcoin|Bitcoin]] ~10 min (difficulty). [[gloss:ethereum|Ethereum]] — 12 sec (fixed, slot-based). Solana ~400 ms. ::: :::

:::further{label="Further reading"}

:::quiz{id=q-1-2-s1 correct=2 explanation="Correct. Blockchain addresses are pseudonymous — they don't contain real-world identities. A block holds transactions, the previous block's hash (the chain link), timestamp, and other metadata."} What does a block NOT contain?

  • Transactions
  • The hash of the previous block
  • The identity of every transaction sender
  • A timestamp and metadata :::

:::section{mins=2} Hash Function :::

:::lead A [[gloss:hash|hash]] turns any data into a short string of fixed length. Like a fingerprint — unique. :::

:::p{html} Three properties: Determinism: same data → always the same [[gloss:hash|hash]]. "Hello" → always the same fingerprint. Avalanche effect: one character changed → the [[gloss:hash|hash]] is completely different. Unpredictable. Irreversibility: cannot recover data from the [[gloss:hash|hash]]. Meat grinder: cannot turn mince back into meat. :::

:::callout A meat grinder for data. Put in anything — get a string of fixed length. Cannot un-grind. :::

:::keypoints{label="Key points"}

  • A [[gloss:hash|hash]] function always returns a fixed-length string, regardless of input size
  • Determinism guarantees identical results for identical data
  • Avalanche effect: the smallest input change completely changes the [[gloss:hash|hash]]
  • Irreversibility: cannot recover original data from the [[gloss:hash|hash]]
  • In [[gloss:blockchain|blockchain]], [[gloss:hash|hashes]] link [[gloss:block|blocks]], derive addresses, build Merkle trees, and identify [[gloss:transaction|transactions]] (txHash) :::

:::details{badge=Advanced title="SHA-256, Keccak-256 & Hash Space"} :::p{html} [[gloss:bitcoin|Bitcoin]]: SHA-256 (double hashing: SHA-256(SHA-256(data))). Double — protection from length extension attacks of Merkle-Damgård construction. :::

:::p{html} [[gloss:ethereum|Ethereum]]: Keccak-256. Chosen before SHA-3 finalization. NIST changed padding in final version → Keccak-256 ≠ SHA-3-256. Sometimes causes confusion in code. :::

:::p [[gloss:hash|Hash]] space: 2^256 ≈ 1.16 × 10^77. Atoms in Universe ≈ 10^80. At 10 billion [[gloss:hash|hashes]]/sec, full brute force: ~3.67 × 10^60 years. Age of Universe: 1.38 × 10^10 years. :::

:::p{html} Birthday problem: collision possible after ~2^128 attempts (not 2^256). This is 3.4 × 10^38 — impractical. Therefore "128-bit security" for SHA-256. :::

:::p [[gloss:bitcoin|Bitcoin]] [[gloss:mining|mining]]: brute-force nonce search to make the [[gloss:hash|hash]] start with N zeros. Current difficulty: ~71 leading zeros in binary. Probability: 1 in 2^71 ≈ 1 in 2.36 × 10^21. ::: :::

:::further{label="Further reading"}

:::quiz{id=q-1-2-s2 correct=2 explanation="Correct. This is the avalanche effect. Even a single bit change produces a completely different hash. That's why hashes act as fingerprints — any tampering is immediately detectable."} You change one character in a file and compute its SHA-256 hash. What happens?

  • The hash changes by exactly one character
  • The hash changes slightly, proportional to the edit
  • The hash changes completely — a totally different string
  • The hash stays the same unless you change more than 10% :::

:::section{mins=2} Chain: prevHash :::

:::lead Every [[gloss:block|block]] contains the [[gloss:hash|hash]] of the previous one. This creates an unbreakable chain. :::

:::p{html} Change a [[gloss:transaction|transaction]] in [[gloss:block|block]] #1 → its [[gloss:hash|hash]] changes → prevHash in #2 will not match → #2 invalid → #3 invalid → the entire chain after the change is broken. Cascading effect: changing [[gloss:block|block]] #100 = recalculating #100 → #101 → #102 → ... → all to the present. [[gloss:ethereum|Ethereum]]: ~19M+ [[gloss:block|blocks]]. Recalculating faster than the network adds new ones — impossible. :::

:::callout A wall of bricks where each one "remembers" the shape below. Pull one — everything above collapses. :::

:::keypoints{label="Key points"}

  • Each [[gloss:block|block]] stores the [[gloss:hash|hash]] of the previous [[gloss:block|block]] (prevHash), forming a chain
  • Changing one [[gloss:block|block]] cascades and breaks all subsequent [[gloss:block|blocks]]
  • Recalculating millions of [[gloss:block|blocks]] faster than the network is practically impossible
  • Distribution: thousands of [[gloss:node|nodes]] hold the original copy of the chain :::

:::details{badge=Advanced title="Genesis Block & Finality"} :::p{html} [[gloss:genesis block|Genesis Block]] ([[gloss:block|block]] #0): prevHash = 0x0000...0000. [[gloss:bitcoin|Bitcoin]] [[gloss:genesis block|genesis]]: text "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks". [[gloss:ethereum|Ethereum]] [[gloss:genesis block|genesis]]: July 30, 2015, initial ETH distribution. View: etherscan.io/block/0 :::

:::p{html} [[gloss:finality|Finality]]: [[gloss:bitcoin|Bitcoin]]: ~6 confirmations (~60 min). Probabilistic. [[gloss:ethereum|Ethereum]] [[gloss:proof of stake|PoS]]: 2 epochs (~12.8 min). Casper FFG: checkpoint with 2/3 votes → justified → next justified → previous finalized. Reversing finalized = [[gloss:slashing|slashing]] ≥1/3 [[gloss:validator|validators]] = $10+ billion. :::

:::p Solana: several seconds (optimistic confirmation). ::: :::

:::further{label="Further reading"}

:::section{mins=2} Merkle Tree :::

:::lead Lets you verify a [[gloss:transaction|transaction]] without downloading the entire [[gloss:block|block]]. :::

:::p{html} A [[gloss:block|block]] contains 100-200 [[gloss:transaction|transactions]]. How to quickly verify a specific one is there? Merkle Tree — a tree of [[gloss:hash|hashes]]. Bottom: [[gloss:hash|hash]] of each [[gloss:transaction|transaction]]. Pairs of [[gloss:hash|hashes]] are combined upward. Repeat until the top — Merkle Root. To prove Tx B is in the [[gloss:block|block]]: only need Hash(A) and Hash(CD). Not all [[gloss:transaction|transactions]]. This is Merkle Proof. Light Clients: mobile [[gloss:wallet|wallets]] download only headers (~500 MB instead of 1 TB) and request Merkle Proof for their [[gloss:transaction|transactions]]. :::

:::callout Tournament bracket. To verify a player — trace their path to the final, no need to know every match. :::

:::keypoints{label="Key points"}

  • Merkle Tree organizes [[gloss:transaction|transaction]] [[gloss:hash|hashes]] in a tree with a single root (Merkle Root)
  • Merkle Proof proves [[gloss:transaction|transaction]] presence with only logarithmic number of [[gloss:hash|hashes]]
  • Light Clients use Merkle Proof instead of downloading the full [[gloss:blockchain|blockchain]]
  • [[gloss:ethereum|Ethereum]] stores transactionsRoot and receiptsRoot in each [[gloss:block|block]] header :::

:::details{badge=Advanced title="Merkle Patricia Trie & Verkle Trees"} :::p{html} [[gloss:ethereum|Ethereum]] uses Merkle Patricia Trie — a hybrid of Patricia Trie (key search) + Merkle Tree (verification). :::

:::p Three trees per [[gloss:block|block]]: State Trie (all accounts, key = address), Transaction Trie ([[gloss:transaction|transactions]], key = index), Receipt Trie (results). :::

:::p stateRoot encompasses ~400M+ accounts. One [[gloss:hash|hash]] = entire [[gloss:ethereum|Ethereum]]. :::

:::p{html} Verkle Trees (future, The Verge): Vector commitment + Merkle. Proof ~150 bytes vs ~1 KB for Merkle. Critical for stateless clients — [[gloss:node|nodes]] without state, receiving proof with each [[gloss:block|block]]. EIP-6800. ::: :::

:::further{label="Further reading"}

:::quiz{id=q-1-2-s4 correct=2 explanation="Correct. Each block contains the hash of the previous one. Change block #500 and its hash changes — which invalidates block #501 (which references it), then #502, and so on. You'd need to redo the entire chain from that point, faster than the honest network adds new blocks."} An attacker wants to change a transaction in block #500. What must they do?

  • Re-sign just that one transaction
  • Recompute block #500 only
  • Recompute block #500 and every block that follows it
  • Nothing — old blocks can be freely edited :::

:::section{mins=2} Why Unfakeable :::

:::lead Recalculating millions of [[gloss:block|blocks]] faster than the network — costs more than playing fair. :::

:::p{html} Three layers: [[gloss:cryptography|cryptographic]] (cascade chain breakage), computational (massive resources needed), social (thousands of [[gloss:node|nodes]] with the original). Imagine a book numbered with fingerprints, copies held by thousands of people worldwide. Faking one page means rewriting all that follow and convincing thousands to accept your version. :::

:::howto{label="How to think about this"}

  • [[gloss:blockchain|Blockchain]] is intentionally slow. The cost of adding a [[gloss:block|block]] is the cost of attack. Remove that cost — remove security.
  • A [[gloss:hash|hash]] is a fingerprint. Change one character anywhere — the entire fingerprint changes. That's what makes the chain tamper-proof.
  • Any computer can run a [[gloss:node|node]] and verify every [[gloss:transaction|transaction]] ever made. You don't have to trust anyone — you can check yourself. :::

:::callout Imagine a book numbered with fingerprints, copies held by thousands of people worldwide. Faking one page means rewriting all that follow and convincing thousands to accept your version. :::

:::keypoints{label="Key points"}

  • Three layers of protection: [[gloss:cryptography|cryptographic]], computational, and social
  • Changing a [[gloss:block|block]] requires recalculating all subsequent ones — cascading effect
  • Economic cost of attacking major networks is in billions of dollars
  • Network security is proportional to its size and stake/hashrate cost
  • Even successful attack devalues the network itself, making it economically irrational :::

:::details{badge=Advanced title="Attack Costs & Real-World Cases"} :::p{html} [[gloss:ethereum|Ethereum]] attack cost: need ≥1/3 stake to halt, ≥2/3 to fake. Stake: ~30M+ ETH. Cost of 1/3: ~$25+ billion. Buying 10M ETH impossible — would crash the price. Plus [[gloss:slashing|slashing]]. :::

:::p{html} [[gloss:bitcoin|Bitcoin]] 51% attack: >50% hashrate. Current: ~600+ EH/s. Cost: billions $. After attack, [[gloss:bitcoin|Bitcoin]] devalues — attacker loses. :::

:::p Economically irrational for major networks. Real attacks on small networks: Ethereum Classic (2020): 3 attacks in a month, reorg of 3,693 blocks, ~$5.6M [[gloss:double spending|double-spent]]. Cause: tiny hashrate vs ETH mainnet. Conclusion: security proportional to network size. $100K hashrate — cheap to attack. $100B — unrealistic. :::

:::p{html} Long-range attack ([[gloss:proof of stake|PoS]]): old [[gloss:validator|validator]] keys → alternative chain. Defense: weak subjectivity checkpoint (synchronization not older than ~2 weeks). :::

:::p{html} Selfish mining ([[gloss:bitcoin|Bitcoin]]): secret chain, publish when longer. Eyal & Sirer (2013): unprofitable at <25% hashrate. ::: :::

:::further{label="Further reading"}

:::section{mins=2} Nodes :::

:::lead A [[gloss:node|node]] — a computer with a [[gloss:blockchain|blockchain]] copy that verifies [[gloss:transaction|transactions]]. More [[gloss:node|nodes]] = more reliable. :::

:::p{html} Full [[gloss:node|Node]]: current state, verifies every [[gloss:block|block]]. Foundation of [[gloss:decentralization|decentralization]]. Light [[gloss:node|Node]]: only headers. Requests Merkle Proof. Your mobile [[gloss:wallet|wallet]]. Archive [[gloss:node|Node]]: EVERYTHING + full history of every account change. Huge. Etherscan, Dune. RPC providers: MetaMask connected to Infura (ConsenSys) by default — centralized point. Infura outage (Nov 2020) "shut down" MetaMask for millions. [[gloss:blockchain|Blockchain]] worked, users did not see. Alternatives: Alchemy, QuickNode, own [[gloss:node|node]]. :::

:::callout Full [[gloss:node|Node]] — librarian (knows everything current). Light [[gloss:node|Node]] — visitor with a catalog (asks to show a page). Archive [[gloss:node|Node]] — vault of all editions ever. :::

:::keypoints{label="Key points"}

  • Full [[gloss:node|Node]] stores current state and verifies every [[gloss:block|block]] — foundation of [[gloss:decentralization|decentralization]]
  • Light [[gloss:node|Node]] downloads only headers (~500 MB) and uses Merkle Proof
  • Archive [[gloss:node|Node]] stores full history (13+ TB) — needed by Etherscan, Dune, analysts
  • [[gloss:ethereum|Ethereum]] has ~8,000+ [[gloss:node|nodes]], [[gloss:bitcoin|Bitcoin]] — ~15,000+
  • RPC providers (Infura, Alchemy) give [[gloss:blockchain|blockchain]] access without running own [[gloss:node|node]] :::

:::details{badge=Advanced title="Execution & Consensus Clients"} :::p{html} Two clients after The Merge: Execution Client (EL): Geth (~55%), Nethermind (~30%), Besu, Erigon. Consensus Client (CL): Prysm (~35%), Lighthouse (~30%), Teku, Lodestar, Nimbus. :::

:::p{html} Client diversity — critical metric. Bug in client with >66% share → incorrect [[gloss:finality|finalization]] → honest minority [[gloss:slashing|slashed]] (paradox). Geth + Prysm = dominant pair = risk. :::

:::p{html} [[gloss:validator|Validator]]: 32 ETH (~$80K+). Alternatives: Rocket Pool (8 ETH), Lido (any amount via stETH). :::

:::p Hardware: Full [[gloss:node|Node]] (Geth): ~800 GB - 1 TB, 16 GB RAM, SSD. Archive [[gloss:node|Node]]: 13+ TB, 64+ GB RAM, NVMe. Light Client: ~500 MB, smartphone. ::: :::

:::further{label="Further reading"}

:::quiz{id=q-1-2-s6 correct=1 explanation="Correct. Full nodes don't mine — they verify. Every full node independently checks every transaction against the rules. The more independent verifiers, the harder it is to push invalid transactions through the network."} Why does running a full node increase the security of the network?

  • Full nodes mine new blocks and earn rewards
  • Full nodes verify every transaction independently — more nodes means more independent checks
  • Full nodes encrypt the blockchain so it can't be read by outsiders
  • Full nodes provide liquidity to the network :::

:::section{mins=2} New Block Birth :::

:::lead Every 12 seconds in [[gloss:ethereum|Ethereum]], a [[gloss:validator|validator]] collects [[gloss:transaction|transactions]] from the [[gloss:mempool|mempool]] and creates a [[gloss:block|block]]. :::

:::p{html} [[gloss:transaction|Transaction]] path: "Send" in MetaMask → signed with [[gloss:private key|private key]] → [[gloss:mempool|Mempool]] — waiting room for unconfirmed [[gloss:transaction|transactions]] → [[gloss:validator|Validator]] selects [[gloss:transaction|transactions]] for [[gloss:block|block]] → [[gloss:block|Block]] created, signed, broadcast → Other [[gloss:validator|validators]] verify and vote (attestation) → After 2 epochs (~12.8 min) — [[gloss:finality|finalized]] forever. EIP-1559: part of [[gloss:gas|gas]] is burned, with high load ETH becomes deflationary. :::

:::callout [[gloss:mempool|Mempool]] — airport lounge. [[gloss:gas|Gas]] price — ticket class. Business (high [[gloss:gas|gas]]) — boards first. Economy (low) — waits. :::

:::keypoints{label="Key points"}

  • [[gloss:transaction|Transaction]] path: signature -> [[gloss:mempool|mempool]] -> [[gloss:validator|validator]] selection -> [[gloss:block|block]] -> attestation -> [[gloss:finality|finalization]]
  • [[gloss:mempool|Mempool]] — queue of unconfirmed [[gloss:transaction|transactions]], priority determined by [[gloss:gas|gas]] price
  • [[gloss:block|Block]] time in [[gloss:ethereum|Ethereum]] is fixed: 12 seconds (slot)
  • EIP-1559: part of [[gloss:gas|gas]] burned, with high load ETH becomes deflationary
  • [[gloss:finality|Finalization]] takes ~12.8 minutes (2 epochs) via Casper FFG mechanism :::

:::details{badge=Advanced title="Ethereum PoS: Slots, Epochs & MEV-Boost"} :::p{html} [[gloss:ethereum|Ethereum]] [[gloss:proof of stake|PoS]] — in detail: Time: slots (12 sec) and epochs (32 slots = 6.4 min). Each slot: random proposer from [[gloss:validator|validators]]. In practice: ~90% [[gloss:block|blocks]] through MEV-Boost (Proposer-Builder Separation). Builder optimizes order, proposer selects [[gloss:block|block]] with highest price. Other [[gloss:validator|validators]] — attesters, vote for validity. Checkpoint with 2/3 votes → justified → [[gloss:finality|finalized]]. :::

:::p{html} Reward: base (~0.02-0.05 ETH) + priority fees + [[gloss:mev|MEV]] tips. Base fee (EIP-1559): part of [[gloss:gas|gas]] burned. Busy network = more ETH burned than issued = deflationary ETH. :::

:::p{html} Proposer-Builder Separation (PBS): Searchers → [[gloss:mev|MEV]] opportunities. Builders → optimal [[gloss:block|blocks]]. Proposers → choose [[gloss:block|block]] with best price. Top-3 builders: ~80% [[gloss:block|blocks]]. New centralization. SUAVE ([[gloss:flashbots|Flashbots]]) — attempt to solve. :::

:::p{html} Timing games: proposers delay publication until end of slot for more [[gloss:mev|MEV]]. If too long — missed slot. Blob transactions (EIP-4844, Dencun, 2024): L2 rollups data. Not stored forever (~18 days). Reduced L2 cost by 10-100x. [[gloss:gas|Gas]] on Arbitrum/Base: $0.001-0.01. ::: :::

:::further{label="Further reading"}