Specification of SPV Mode
We now describe the detailed operations undergone by an SPV client.
In the SPV mode, the sending of transactions is performed similarly to the regular Bitcoin protocol (see Chapter 4). Namely, SPV clients are equipped with public/private key pairs that enable them to assert ownership of coins and issue transactions in the system.
Unlike full Bitcoin nodes, SPV clients do not receive all the transactions that are broadcast within the Bitcoin P2P network, but instead receive a subset of transactions filtered for them by the full nodes to which they are connected. Currently, SPV clients connect to a default of four different randomly chosen nodes.
In order to calculate their own balance, SPV clients request full blocks from a given block height on; here, the full Bitcoin nodes can also provide filtered blocks to the SPV client that only contain relevant transactions from each block. The nodes verify the signature of the received transactions, verify the proof-of-work of the blocks, and verify that these transactions were indeed included in the Merkle tree committed in the received blocks. Note that the client can rely on the block depth in order to determine the transactions' validity. For instance, if a transaction has been confirmed in an old block that appears in the blockchain, then it is highly unlikely that the transaction is incorrect.
Recall that each block contains the root of the Merkle tree of all transactions that were confirmed in the block.
To verify that a given transaction was included in a block, an SPV client requests a proof of membership from one of the (full) Bitcoin nodes that he or she connects to. The latter outputs the membership proof, nM. The SPV client then uses nM and the Merkle root committed in the block in order to verify the inclusion of a given transaction x.
Note that lightweight clients are not involved in the mining process. Readers should not confuse the operations of lightweight client with the notion of SPV mining. SPV mining refers to the act of mining blocks without validating the previous block (and the transactions included therein) in the chain. Note that since such miners do not know which transactions have been included in the last block (since they skip the verification of the transactions), they need to mine without including any transaction (except for the coinbase transaction) in order to avoid the risk of including transactions that conflict with the previous block.
As discussed in [2], this strategy allows the adversary to gain an advantage in the mining process (e.g., to be the first in finding the correct PoW). SPV mining recently caused a fork in the blockchain [3] due to the fact that some mining pools continued mining blocks that originally referenced an invalid block header.
