Fermat's Library | Ethereum: A Next-Generation Smart Contract and Decentralized Application Platform annotated/explained version.

Ethereum White Paper

A NEXT GENERATION SMART CONTRACT & DECENTRALIZED APPLICATION PLATFORM

By Vitalik Buterin

When Satoshi Nakamoto first set the Bitcoin blockchain into motion in January 2009, he was

simultaneously introducing two radical and untested concepts. The first is the "bitcoin", a decentralized

peer-to-peer online currency that maintains a value without any backing, intrinsic value or central issuer. So

far, the "bitcoin" as a currency unit has taken up the bulk of the public attention, both in terms of the political

aspects of a currency without a central bank and its extreme upward and downward volatility in price.

However, there is also another, equally important, part to Satoshi's grand experiment: the concept of a proof of

work-based blockchain to allow for public agreement on the order of transactions. Bitcoin as an application can

be described as a first-to-file system: if one entity has 50 BTC, and simultaneously sends the same 50 BTC to

A and to B, only the transaction that gets confirmed first will process. There is no intrinsic way of determining

from two transactions which came earlier, and for decades this stymied the development of decentralized

digital currency. Satoshi's blockchain was the first credible decentralized solution. And now, attention is

rapidly starting to shift toward this second part of Bitcoin's technology, and how the blockchain concept can be

used for more than just money.

Commonly cited applications include using on-blockchain digital assets to represent custom currencies and

financial instruments ("colored coins"), the ownership of an underlying physical device ("smart property"),

non-fungible assets such as domain names ("Namecoin") as well as more advanced applications such as

decentralized exchange, financial derivatives, peer-to-peer gambling and on-blockchain identity and

reputation systems. Another important area of inquiry is "smart contracts" - systems which automatically

move digital assets according to arbitrary pre-specified rules. For example, one might have a treasury contract

of the form "A can withdraw up to X currency units per day, B can withdraw up to Y per day, A and B together

can withdraw anything, and A can shut off B's ability to withdraw". The logical extension of this is

decentralized autonomous organizations (DAOs) - long-term smart contracts that contain the assets and

encode the bylaws of an entire organization. What Ethereum intends to provide is a blockchain with a built-in

fully fledged Turing-complete programming language that can be used to create "contracts" that can be used

to encode arbitrary state transition functions, allowing users to create any of the systems described above, as

well as many others that we have not yet imagined, simply by writing up the logic in a few lines of code.

Page 1

ethereum.org

History

The concept of decentralized digital currency, as well as alternative applications like property registries,

has been around for decades. The anonymous e-cash protocols of the 1980s and the 1990s, mostly

reliant on a cryptographic primitive known as Chaumian blinding, provided a currency with a high degree

of privacy, but the protocols largely failed to gain traction because of their reliance on a centralized

intermediary. In 1998, Wei Dai's b-money became the first proposal to introduce the idea of creating

money through solving computational puzzles as well as decentralized consensus, but the proposal

was scant on details as to how decentralized consensus could actually be implemented. In 2005, Hal

Finney introduced a concept of "reusable proofs of work", a system which uses ideas from b-money

together with Adam Back's computationally difficult Hashcash puzzles to create a concept for a

cryptocurrency, but once again fell short of the ideal by relying on trusted computing as a backend.

Because currency is a first-to-file application, where the order of transactions is often of critical

importance, decentralized currencies require a solution to decentralized consensus. The main roadblock

that all pre-Bitcoin currency protocols faced is the fact that, while there had been plenty of research on

creating secure Byzantine-fault-tolerant multiparty consensus systems for many years, all of the

protocols described were solving only half of the problem. The protocols assumed that all participants in

the system were known, and produced security margins of the form "if N parties participate, then the

system can tolerate up to N/4 malicious actors". The problem is, however, that in an anonymous setting

such security margins are vulnerable to sybil attacks, where a single attacker creates thousands of

simulated nodes on a server or botnet and uses these nodes to unilaterally secure a majority share.

The innovation provided by Satoshi is the idea of combining a very simple decentralized consensus

protocol, based on nodes combining transactions into a "block" every ten minutes creating an

ever-growing blockchain, with proof of work as a mechanism through which nodes gain the right to

participate in the system. While nodes with a large amount of computational power do have

proportionately greater influence, coming up with more computational power than the entire network

combined is much harder than simulating a million nodes. Despite the Bitcoin blockchain model's

crudeness and simplicity, it has proven to be good enough, and would over the next five years become

the bedrock of over two hundred currencies and protocols around the world.

Page 4

ethereum.org

Bitcoin As A State Transition System

From a technical standpoint, the Bitcoin ledger can be thought of as a state transition system, where there is

a "state" consisting of the ownership status of all existing bitcoins and a "state transition function" that takes

a state and a transaction and outputs a new state which is the result. In a standard banking system, for

example, the state is a balance sheet, a transaction is a request to move $X from A to B, and the state

transition function reduces the value in A's account by $X and increases the value in B's account by $X. If A's

account has less than $X in the first place, the state transition function returns an error. Hence, one can

formally define:

APPLY(S,TX)>S'orERROR

In the banking system defined above:

APPLY({ Alice: $50, Bob: $50 },"send $20 from Alice to Bob") = { Alice: $30,              

Bob:$70}

But:

APPLY({Alice:$50,Bob:$50},"send$70fromAlicetoBob")=ERROR



The "state" in Bitcoin is the collection of all coins (technically, "unspent transaction outputs" or UTXO) that

have been minted and not yet spent, with each UTXO having a denomination and an owner (defined by a

20-byte address which is essentially a cryptographic public key

[1]

). A transaction contains one or more inputs,

with each input containing a reference to an existing UTXO and a cryptographic signature produced by the

private key associated with the owner's address, and one or more outputs, with each output containing a new

UTXO to be added to the state.

Page 5

ethereum.org

The state transition function APPLY(S,TX)>S'can be defined roughly as follows:

1. For each input in TX:

i. If the referenced UTXO is not in S, return an error.

ii. If the provided signature does not match the owner of the UTXO, return an error.

2. If the sum of the denominations of all input UTXO is less than the sum of the denominations of

all output UTXO, return an error.

3. Return S with all input UTXO removed and all output UTXO added.

The first half of the first step prevents transaction senders from spending coins that do not exist, the second

half of the first step prevents transaction senders from spending other people's coins, and the second step

enforces conservation of value. In order to use this for payment, the protocol is as follows. Suppose Alice wants

to send 11.7 BTC to Bob. First, Alice will look for a set of available UTXO that she owns that totals up to at least

11.7 BTC. Realistically, Alice will not be able to get exactly 11.7 BTC; say that the smallest she can get is

6+4+2=12. She then creates a transaction with those three inputs and two outputs. The first output will be 11.7

BTC with Bob's address as its owner, and the second output will be the remaining 0.3 BTC "change", with the

owner being Alice herself.

Mining

If we had access to a trustworthy centralized service, this system would be trivial to implement; it

could simply be coded exactly as described. However, with Bitcoin we are trying to build a

decentralized currency system, so we will need to combine the state transition system with a

consensus system in order to ensure that everyone agrees on the order of transactions. Bitcoin's

decentralized consensus process requires nodes in the network to continuously attempt to produce

packages of transactions called "blocks". The network is intended to produce roughly one block every

ten minutes, with each block containing a timestamp, a nonce, a reference to (ie. hash of) the

Page 6

ethereum.org

previous block and a list of all of the transactions that have taken place since the previous block.

Over time, this creates a persistent, ever-growing, "blockchain" that constantly updates to represent

the latest state of the Bitcoin ledger.

The algorithm for checking if a block is valid, expressed in this paradigm, is as follows:

1. Check if the previous block referenced by the block exists and is valid

2. Check that the timestamp of the block is greater than that of the previous block

[2]

and less than 2

hours into the future.

3. Check that the proof of work on the block is valid.

4. Let S[0] be the state at the end of the previous block.

5. Suppose TX is the block's transaction list with n transactions. For all i in 0...n-1, setS[i+1] =

APPLY(S[i],TX[i]) If any application returns an error, exit and return false.

6. Return true, and register S[n] as the state at the end of this block

Essentially, each transaction in the block must provide a state transition that is valid. Note that the state is

not encoded in the block in any way; it is purely an abstraction to be remembered by the validating node and

can only be (securely) computed for any block by starting from the genesis state and sequentially applying

every transaction in every block. Additionally, note that the order in which the miner includes transactions into

the block matters; if there are two transactions A and B in a block such that B spends a UTXO created by A,

then the block will be valid if A comes before B but not otherwise.

The interesting part of the block validation algorithm is the concept of "proof of work": the condition is that the

SHA256 hash of every block, treated as a 256-bit number, must be less than a dynamically adjusted target,

which as of the time of this writing is approximately 2

190

. The purpose of this is to make block creation

computationally "hard", thereby preventing sybil attackers from remaking the entire blockchain in their favor.

Because SHA256 is designed to be a completely unpredictable pseudorandom function, the only way to create

a valid block is simply trial and error, repeatedly incrementing the nonce and seeing if the new hash matches.

At the current target of 2192, this means an average of 264 tries; in general, the target is recalibrated by the

network every 2016 blocks so that on average a new block is produced by some node in the network every ten

minutes. In order to compensate miners for this computational work, the miner of every block is entitled to

include a transaction giving themselves 25 BTC out of nowhere. Additionally, if any transaction has a higher

total denomination in its inputs than in its outputs, the difference also goes to the miner as a "transaction

fee". Incidentally, this is also the only mechanism by which BTC are issued; the genesis state contained no

coins at all.

Page 7

ethereum.org

In order to better understand the purpose of mining, let us examine what happens in the event of a malicious

attacker. Since Bitcoin's underlying cryptography is known to be secure, the attacker will target the one part of

the Bitcoin system that is not protected by cryptography directly: the order of transactions. The attacker's

strategy is simple:

1. Send 100 BTC to a merchant in exchange for some product (preferably a rapid-delivery digital

good)

2. Wait for the delivery of the product

3. Produce another transaction sending the same 100 BTC to himself

4. Try to convince the network that his transaction to himself was the one that came first.

Once step (1) has taken place, after a few minutes some miner will include the transaction in a block, say

block number 270000. After about one hour, five more blocks will have been added to the chain after that block,

with each of those blocks indirectly pointing to the transaction and thus "confirming" it. At this point, the

merchant will accept the payment as finalized and deliver the product; since we are assuming this is a digital

good, delivery is instant. Now, the attacker creates another transaction sending the 100 BTC to himself. If the

attacker simply releases it into the wild, the transaction will not be processed; miners will attempt to run

APPLY(S,TX) and notice that TX consumes a UTXO which is no longer in the state. So instead, the attacker

creates a "fork" of the blockchain, starting by mining another version of block 270000 pointing to the same

block 269999 as a parent but with the new transaction in place of the old one. Because the block data is

different, this requires redoing the proof of work. Furthermore, the attacker's new version of block 270000 has a

different hash, so the original blocks 270001 to 270005 do not "point" to it; thus, the original chain and the

attacker's new chain are completely separate. The rule is that in a fork the longest blockchain (ie. the one

backed by the largest quantity of proof of work) is taken to be the truth, and so legitimate miners will work on

the 270005 chain while the attacker alone is working on the 270000 chain. In order for the attacker to make

his blockchain the longest, he would need to have more computational power than the rest of the network

combined in order to catch up (hence, "51% attack").

Page 8

ethereum.org

Merkle Trees

Left: it suffices to present only a small number of nodes in a Merkle tree to give a proof of the validity of a branch.

Right: any attempt to change any part of the Merkle tree will eventually lead to an inconsistency somewhere up the

chain.

An important scalability feature of Bitcoin is that the block is stored in a multi-level data structure. The "hash"

of a block is actually only the hash of the block header, a roughly 200-byte piece of data that contains the

timestamp, nonce, previous block hash and the root hash of a data structure called the Merkle tree storing all

transactions in the block.

A Merkle tree is a type of binary tree, composed of a set of nodes with a large number of leaf nodes at the

bottom of the tree containing the underlying data, a set of intermediate nodes where each node is the hash of

its two children, and finally a single root node, also formed from the hash of its two children, representing the

"top" of the tree. The purpose of the Merkle tree is to allow the data in a block to be delivered piecemeal: a node

can download only the header of a block from one source, the small part of the tree relevant to them from

Page 9

ethereum.org

another source, and still be assured that all of the data is correct. The reason why this works is that hashes

propagate upward: if a malicious user attempts to swap in a fake transaction into the bottom of a Merkle tree,

this change will cause a change in the node above, and then a change in the node above that, finally

changing the root of the tree and therefore the hash of the block, causing the protocol to register it as a

completely different block (almost certainly with an invalid proof of work).

The Merkle tree protocol is arguably essential to long-term sustainability. A "full node" in the Bitcoin network,

one that stores and processes the entirety of every block, takes up about 15 GB of disk space in the Bitcoin

network as of April 2014, and is growing by over a gigabyte per month. Currently, this is viable for some desktop

computers and not phones, and later on in the future only businesses and hobbyists will be able to participate.

A protocol known as "simplified payment verification" (SPV) allows for another class of nodes to exist, called

"light nodes", which download the block headers, verify the proof of work on the block headers, and then

download only the "branches" associated with transactions that are relevant to them. This allows light nodes

to determine with a strong guarantee of security what the status of any Bitcoin transaction, and their current

balance, is while downloading only a very small portion of the entire blockchain.

Alternative Blockchain Applications

The idea of taking the underlying blockchain idea and applying it to other concepts also has a long history. In

2005, Nick Szabo came out with the concept of "secure property titles with owner authority", a document

describing how "new advances in replicated database technology" will allow for a blockchain-based system for

storing a registry of who owns what land, creating an elaborate framework including concepts such as

homesteading, adverse possession and Georgian land tax. However, there was unfortunately no effective

replicated database system available at the time, and so the protocol was never implemented in practice.

After 2009, however, once Bitcoin's decentralized consensus was developed a number of alternative

applications rapidly began to emerge:

● Namecoin - created in 2010, Namecoin is best described as a decentralized name registration

database. In decentralized protocols like Tor, Bitcoin and BitMessage, there needs to be some way

of identifying accounts so that other people can interact with them, but in all existing solutions the

only kind of identifier available is a pseudorandom hash

like1LW79wp5ZBqaHW1jL5TCiBCrhQYtHagUWy. Ideally, one would like to be able to have an

account with a name like "george". However, the problem is that if one person can create an

account named "george" then someone else can use the same process to register "george" for

themselves as well and impersonate them. The only solution is a first-to-file paradigm, where the

first registrant succeeds and the second fails - a problem perfectly suited for the Bitcoin consensus

protocol. Namecoin is the oldest, and most successful, implementation of a name registration

system using such an idea.

● Colored coins - the purpose of colored coins is to serve as a protocol to allow people to create their

own digital currencies - or, in the important trivial case of a currency with one unit, digital tokens,

Page 10

ethereum.org

on the Bitcoin blockchain. In the colored coins protocol, one "issues" a new currency by publicly

assigning a color to a specific Bitcoin UTXO, and the protocol recursively defines the color of other

UTXO to be the same as the color of the inputs that the transaction creating them spent (some

special rules apply in the case of mixed-color inputs). This allows users to maintain wallets

containing only UTXO of a specific color and send them around much like regular bitcoins,

backtracking through the blockchain to determine the color of any UTXO that they receive.

● Metacoins - the idea behind a metacoin is to have a protocol that lives on top of Bitcoin, using

Bitcoin transactions to store metacoin transactions but having a different state transition function,

APPLY'. Because the metacoin protocol cannot prevent invalid metacoin transactions from

appearing in the Bitcoin blockchain, a rule is added that if APPLY'(S,TX) returns an error, the

protocol defaults to APPLY'(S,TX) = S. This provides an easy mechanism for creating an arbitrary

cryptocurrency protocol, potentially with advanced features that cannot be implemented inside of

Bitcoin itself, but with a very low development cost since the complexities of mining and networking

are already handled by the Bitcoin protocol.

Thus, in general, there are two approaches toward building a consensus protocol: building an independent

network, and building a protocol on top of Bitcoin. The former approach, while reasonably successful in the

case of applications like Namecoin, is difficult to implement; each individual implementation needs to

bootstrap an independent blockchain, as well as building and testing all of the necessary state transition and

networking code. Additionally, we predict that the set of applications for decentralized consensus technology

will follow a power law distribution where the vast majority of applications would be too small to warrant their

own blockchain, and we note that there exist large classes of decentralized applications, particularly

decentralized autonomous organizations, that need to interact with each other.

The Bitcoin-based approach, on the other hand, has the flaw that it does not inherit the simplified payment

verification features of Bitcoin. SPV works for Bitcoin because it can use blockchain depth as a proxy for

validity; at some point, once the ancestors of a transaction go far enough back, it is safe to say that they were

legitimately part of the state. Blockchain-based meta-protocols, on the other hand, cannot force the blockchain

not to include transactions that are not valid within the context of their own protocols. Hence, a fully secure

SPV meta-protocol implementation would need to backward scan all the way to the beginning of the Bitcoin

blockchain to determine whether or not certain transactions are valid. Currently, all "light" implementations of

Bitcoin-based meta-protocols rely on a trusted server to provide the data, arguably a highly suboptimal result

especially when one of the primary purposes of a cryptocurrency is to eliminate the need for trust.

Scripting

Even without any extensions, the Bitcoin protocol actually does facilitate a weak version of a concept of "smart

contracts". UTXO in Bitcoin can be owned not just by a public key, but also by a more complicated script

expressed in a simple stack-based programming language. In this paradigm, a transaction spending that

UTXO must provide data that satisfies the script. Indeed, even the basic public key ownership mechanism is

Page 11

ethereum.org

implemented via a script: the script takes an elliptic curve signature as input, verifies it against the

transaction and the address that owns the UTXO, and returns 1 if the verification is successful and 0

otherwise. Other, more complicated, scripts exist for various additional use cases. For example, one can

construct a script that requires signatures from two out of a given three private keys to validate ("multisig"), a

setup useful for corporate accounts, secure savings accounts and some merchant escrow situations. Scripts

can also be used to pay bounties for solutions to computational problems, and one can even construct a script

that says something like "this Bitcoin UTXO is yours if you can provide an SPV proof that you sent a Dogecoin

transaction of this denomination to me", essentially allowing decentralized cross-cryptocurrency exchange.

However, the scripting language as implemented in Bitcoin has several important limitations:

● Lack of Turing-completeness - that is to say, while there is a large subset of computation

that the Bitcoin scripting language supports, it does not nearly support everything. The main

category that is missing is loops. This is done to avoid infinite loops during transaction verification;

theoretically it is a surmountable obstacle for script programmers, since any loop can be simulated

by simply repeating the underlying code many times with an if statement, but it does lead to scripts

that are very space-inefficient. For example, implementing an alternative elliptic curve signature

algorithm would likely require 256 repeated multiplication rounds all individually included in the

code.

● Value-blindness - there is no way for a UTXO script to provide fine-grained control over the

amount that can be withdrawn. For example, one powerful use case of an oracle contract would be a

hedging contract, where A and B put in $1000 worth of BTC and after 30 days the script sends $1000

worth of BTC to A and the rest to B. This would require an oracle to determine the value of 1 BTC in

USD, but even then it is a massive improvement in terms of trust and infrastructure requirement over

the fully centralized solutions that are available now. However, because UTXO are all-or-nothing, the

only way to achieve this is through the very inefficient hack of having many UTXO of varying

denominations (eg. one UTXO of 2

k

for every k up to 30) and having the oracle pick which UTXO to

send to A and which to B.

● Lack of state - UTXO can either be spent or unspent; there is no opportunity for multi-stage

contracts or scripts which keep any other internal state beyond that. This makes it hard to make

multi-stage options contracts, decentralized exchange offers or two-stage cryptographic commitment

protocols (necessary for secure computational bounties). It also means that UTXO can only be used

to build simple, one-off contracts and not more complex "stateful" contracts such as decentralized

organizations, and makes meta-protocols difficult to implement. Binary state combined with

value-blindness also mean that another important application, withdrawal limits, is impossible.

● Blockchain-blindness - UTXO are blind to blockchain data such as the nonce and previous

hash. This severely limits applications in gambling, and several other categories, by depriving the

scripting language of a potentially valuable source of randomness.

Page 12

ethereum.org

Thus, we see three approaches to building advanced applications on top of cryptocurrency: building a new

blockchain, using scripting on top of Bitcoin, and building a meta-protocol on top of Bitcoin. Building a new

blockchain allows for unlimited freedom in building a feature set, but at the cost of development time and

bootstrapping effort. Using scripting is easy to implement and standardize, but is very limited in its

capabilities, and meta-protocols, while easy, suffer from faults in scalability. With Ethereum, we intend to build

a generalized framework that can provide the advantages of all three paradigms at the same time.

Ethereum

The intent of Ethereum is to merge together and improve upon the concepts of scripting, altcoins and on-chain

meta-protocols, and allow developers to create arbitrary consensus-based applications that have the

scalability, standardization, feature-completeness, ease of development and interoperability offered by these

different paradigms all at the same time. Ethereum does this by building what is essentially the ultimate

abstract foundational layer: a blockchain with a built-in Turing-complete programming language, allowing

anyone to write smart contracts and decentralized applications where they can create their own arbitrary

rules for ownership, transaction formats and state transition functions. A bare-bones version of Namecoin can

be written in two lines of code, and other protocols like currencies and reputation systems can be built in under

twenty. Smart contracts, cryptographic "boxes" that contain value and only unlock it if certain conditions are

met, can also be built on top of our platform, with vastly more power than that offered by Bitcoin scripting

because of the added powers of Turing-completeness, value-awareness, blockchain-awareness and state.

Ethereum Accounts

In Ethereum, the state is made up of objects called "accounts", with each account having a 20-byte address

and state transitions being direct transfers of value and information between accounts. An Ethereum account

contains four fields:

● The nonce, a counter used to make sure each transaction can only be processed once

● The account's current ether balance

● The account's contract code, if present

● The account's storage (empty by default)

"Ether" is the main internal crypto-fuel of Ethereum, and is used to pay transaction fees. In general, there are

two types of accounts: externally owned accounts, controlled by private keys, and contract accounts, controlled

by their contract code. An externally owned account has no code, and one can send messages from an

externally owned account by creating and signing a transaction; in a contract account, every time the

Page 13

ethereum.org

contract account receives a message its code activates, allowing it to read and write to internal storage and

send other messages or create contracts in turn.

Messages and Transactions

"Messages" in Ethereum are somewhat similar to “transactions” in Bitcoin, but with three important

differences. First, an Ethereum message can be created either by an external entity or a contract, whereas a

Bitcoin transaction can only be created externally. Second, there is an explicit option for Ethereum messages

to contain data. Finally, the recipient of an Ethereum message, if it is a contract account, has the option to

return a response; this means that Ethereum messages also encompass the concept of functions.

The term "transaction" is used in Ethereum to refer to the signed data package that stores a message to be

sent from an externally owned account. Transactions contain the recipient of the message, a signature

identifying the sender, the amount of ether and the data to send, as well as two values called STARTGAS and

GASPRICE. In order to prevent exponential blowup and infinite loops in code, each transaction is required to set

a limit to how many computational steps of code execution it can spawn, including both the initial message

and any additional messages that get spawned during execution. STARTGAS is this limit, and GASPRICE is

the fee to pay to the miner per computational step. If transaction execution "runs out of gas", all state changes

revert - except for the payment of the fees, and if transaction execution halts with some gas remaining then

the remaining portion of the fees is refunded to the sender. There is also a separate transaction type, and

corresponding message type, for creating a contract; the address of a contract is calculated based on the

hash of the account nonce and transaction data.

An important consequence of the message mechanism is the "first class citizen" property of Ethereum - the

idea that contracts have equivalent powers to external accounts, including the ability to send message and

create other contracts. This allows contracts to simultaneously serve many different roles: for example, one

might have a member of a decentralized organization (a contract) be an escrow account (another contract)

between an paranoid individual employing custom quantum-proof Lamport signatures (a third contract) and

a co-signing entity which itself uses an account with five keys for security (a fourth contract). The strength of

the Ethereum platform is that the decentralized organization and the escrow contract do not need to care

about what kind of account each party to the contract is.

Page 14

ethereum.org

Ethereum State Transition Function

The Ethereum state transition function, APPLY(S,TX) -> S' can be defined as follows:

1. Check if the transaction is well-formed (ie. has the right number of values), the signature is valid,

and the nonce matches the nonce in the sender's account. If not, return an error.

2. Calculate the transaction fee as STARTGAS * GASPRICE, and determine the sending address from

the signature. Subtract the fee from the sender's account balance and increment the sender's

nonce. If there is not enough balance to spend, return an error.

3. Initialize GAS = STARTGAS, and take off a certain quantity of gas per byte to pay for the bytes in

the transaction.

4. Transfer the transaction value from the sender's account to the receiving account. If the receiving

account does not yet exist, create it. If the receiving account is a contract, run the contract's code

either to completion or until the execution runs out of gas.

5. If the value transfer failed because the sender did not have enough money, or the code execution

ran out of gas, revert all state changes except the payment of the fees, and add the fees to the

miner's account.

6. Otherwise, refund the fees for all remaining gas to the sender, and send the fees paid for gas

consumed to the miner.

Page 15

ethereum.org

For example, suppose that the contract's code is:

if !contract.storage[msg.data[0]]:

contract.storage[msg.data[0]] = msg.data[1]

Note that in reality the contract code is written in the low-level EVM code; this example is written in Serpent,

our high-level language, for clarity, and can be compiled down to EVM code. Suppose that the contract's

storage starts off empty, and a transaction is sent with 10 ether value, 2000 gas, 0.001 ether gasprice, and

two data fields: [ 2, 'CHARLIE' ]

[3]

. The process for the state transition function in this case is as follows:

1. Check that the transaction is valid and well formed.

2. Check that the transaction sender has at least 2000 * 0.001 = 2 ether. If it is, then subtract 2 ether

from the sender's account.

3. Initialize gas = 2000; assuming the transaction is 170 bytes long and the byte-fee is 5, subtract

850 so that there is 1150 gas left.

4. Subtract 10 more ether from the sender's account, and add it to the contract's account.

5. Run the code. In this case, this is simple: it checks if the contract's storage at index 2 is used,

notices that it is not, and so it sets the storage at index 2 to the value CHARLIE. Suppose this takes

187 gas, so the remaining amount of gas is 1150 - 187 = 963

6. Add 963 * 0.001 = 0.963 ether back to the sender's account, and return the resulting state.

If there was no contract at the receiving end of the transaction, then the total transaction fee would simply be

equal to the provided GASPRICE multiplied by the length of the transaction in bytes, and the data sent

alongside the transaction would be irrelevant. Additionally, note that contract-initiated messages can assign

a gas limit to the computation that they spawn, and if the sub-computation runs out of gas it gets reverted

only to the point of the message call. Hence, just like transactions, contracts can secure their limited

computational resources by setting strict limits on the sub-computations that they spawn.



Page 16

ethereum.org

Code Execution

The code in Ethereum contracts is written in a low-level, stack-based bytecode language, referred to as

"Ethereum virtual machine code" or "EVM code". The code consists of a series of bytes, where each byte

represents an operation. In general, code execution is an infinite loop that consists of repeatedly carrying out

the operation at the current program counter (which begins at zero) and then incrementing the program

counter by one, until the end of the code is reached or an error or STOP or RETURN instruction is detected. The

operations have access to three types of space in which to store data:

● The stack, a last-in-first-out container to which 32-byte values can be pushed and popped

● Memory, an infinitely expandable byte array

● The contract's long-term storage, a key/value store where keys and values are both 32

bytes. Unlike stack and memory, which reset after computation ends, storage persists for the long

term.

The code can also access the value, sender and data of the incoming message, as well as block header data,

and the code can also return a byte array of data as an output.

The formal execution model of EVM code is surprisingly simple. While the Ethereum virtual machine is

running, its full computational state can be defined by the tuple (block_state, transaction, message, code,

memory, stack, pc, gas), where block_state is the global state containing all accounts and includes balances

and storage. Every round of execution, the current instruction is found by taking the pc-th byte of code, and

each instruction has its own definition in terms of how it affects the tuple. For example, ADD pops two items off

the stack and pushes their sum, reduces gas by 1 and increments pc by 1, and SSTORE pushes the top two

items off the stack and inserts the second item into the contract's storage at the index specified by the first

item, as well as reducing gas by up to 200 and incrementing pc by 1. Although there are many ways to

optimize Ethereum via just-in-time compilation, a basic implementation of Ethereum can be done in a few

hundred lines of code.

Page 17

ethereum.org

Comments