Ethereum Whitepaper

The concept of decentralized digital currency, as well as alternative applications like property registries, has been around for decades. The anonymous e-cash protocols of the 1980s and the 1990s, mostly reliant on a cryptographic primitive known as Chaumian blinding, provided a currency with a high degree of privacy, but the protocols largely failed to gain traction because of their reliance on a centralized intermediary. In 1998, Wei Dai's b-money (opens in a new tab) became the first proposal to introduce the idea of creating money through solving computational puzzles as well as decentralized consensus, but the proposal was scant on details as to how decentralized consensus could actually be implemented. In 2005, Hal Finney introduced a concept of " reusable proofs of work (opens in a new tab) ", a system which uses ideas from b-money together with Adam Back's computationally difficult Hashcash puzzles to create a concept for a cryptocurrency, but once again fell short of the ideal by relying on trusted computing as a backend. In 2009, a decentralized currency was for the first time implemented in practice by Satoshi Nakamoto, combining established primitives for managing ownership through public key cryptography with a consensus algorithm for keeping track of who owns coins, known as "proof-of-work".

去中心化数字货币以及财产登记等替代应用的概念已经存在了几十年。20 世纪 80 年代和 90 年代的匿名电子现金协议，主要依赖于一种被称为乔姆盲签（Chaumian blinding）的密码学原语，提供了一种具有高度隐私性的货币，但这些协议由于依赖中心化中介而大多未能获得关注。1998 年，戴伟的 b-money （在新标签页中打开） 成为第一个提出通过解决计算难题和去中心化共识来创造货币的想法的提案，但该提案在如何实际实施去中心化共识方面缺乏细节。2005 年，哈尔·芬尼（Hal Finney）引入了“ 可复用的工作量证明 （在新标签页中打开） ”概念，该系统结合了 b-money 的思想和亚当·巴克（Adam Back）计算困难的 Hashcash 难题来创建一个加密货币概念，但由于依赖可信计算作为后端，再次未能达到理想状态。2009 年，中本聪（Satoshi Nakamoto）首次在实践中实现了一种去中心化货币，将通过公钥密码学管理所有权的既定原语与一种用于跟踪谁拥有硬币的共识算法（被称为“工作量证明 (PoW)”）结合起来。

The mechanism behind proof-of-work was a breakthrough in the space because it simultaneously solved two problems. First, it provided a simple and moderately effective consensus algorithm, allowing nodes in the network to collectively agree on a set of canonical updates to the state of the Bitcoin ledger. Second, it provided a mechanism for allowing free entry into the consensus process, solving the political problem of deciding who gets to influence the consensus, while simultaneously preventing sybil attacks. It does this by substituting a formal barrier to participation, such as the requirement to be registered as a unique entity on a particular list, with an economic barrier - the weight of a single node in the consensus voting process is directly proportional to the computing power that the node brings. Since then, an alternative approach has been proposed called proof-of-stake , calculating the weight of a node as being proportional to its currency holdings and not computational resources; the discussion of the relative merits of the two approaches is beyond the scope of this paper but it should be noted that both approaches can be used to serve as the backbone of a cryptocurrency.

工作量证明 (PoW) 背后的机制是该领域的一项突破，因为它同时解决了两个问题。首先，它提供了一种简单且适度有效的共识算法，允许网络中的节点共同就比特币账本状态的一组规范更新达成一致。其次，它提供了一种允许自由进入共识过程的机制，解决了决定谁能影响共识的政治问题，同时防止了女巫攻击。它通过用经济壁垒取代参与的正式壁垒（例如要求在特定列表中注册为唯一实体）来实现这一点——单个节点在共识投票过程中的权重与其带来的计算能力成正比。从那时起，人们提出了一种称为_权益证明 (PoS)_的替代方法，计算节点的权重与其持有的货币成正比，而不是计算资源；讨论这两种方法的相对优缺点超出了本文的范围，但应该注意的是，这两种方法都可以用作加密货币的骨干。

From a technical standpoint, the ledger of a cryptocurrency such as Bitcoin can be thought of as a state transition system, where there is a "state" consisting of the ownership status of all existing bitcoins and a "state transition function" that takes a state and a transaction and outputs a new state which is the result. In a standard banking system, for example, the state is a balance sheet, a transaction is a request to move $X from A to B, and the state transition function reduces the value in A's account by $X and increases the value in B's account by $X. If A's account has less than $X in the first place, the state transition function returns an error. Hence, one can formally define:

从技术角度来看，诸如比特币之类的加密货币账本可以被认为是一个状态转换系统，其中存在一个由所有现有比特币的所有权状态组成的“状态”，以及一个接收状态和交易并输出作为结果的新状态的“状态转换函数”。例如，在标准银行系统中，状态是资产负债表，交易是将 $X 从 A 转移到 B 的请求，状态转换函数将 A 账户中的价值减少 $X，并将 B 账户中的价值增加 $X。如果 A 的账户一开始少于 $X，则状态转换函数返回错误。因此，可以正式定义：

The "state" in Bitcoin is the collection of all coins (technically, "unspent transaction outputs" or UTXO) that have been minted and not yet spent, with each UTXO having a denomination and an owner (defined by a 20-byte address which is essentially a cryptographic public key fn1 ). A transaction contains one or more inputs, with each input containing a reference to an existing UTXO and a cryptographic signature produced by the private key associated with the owner's address, and one or more outputs, with each output containing a new UTXO to be added to the state.

比特币中的“状态”是所有已铸造且尚未花费的硬币（技术上称为“未花费的交易输出”或 UTXO）的集合，每个 UTXO 都有一个面额和一个所有者（由一个 20 字节的地址定义，该地址本质上是一个密码学公钥 fn1 ）。一笔交易包含一个或多个输入，每个输入包含对现有 UTXO 的引用以及由与所有者地址关联的私钥生成的密码学签名，以及一个或多个输出，每个输出包含要添加到状态中的新 UTXO。

The state transition function APPLY(S,TX) -> S' can be defined roughly as follows:

第一步的前半部分防止交易发送者花费不存在的硬币，第一步的后半部分防止交易发送者花费他人的硬币，第二步强制执行价值守恒。为了将其用于支付，协议如下。假设 Alice 想向 Bob 发送 11.7 BTC。首先，Alice 将寻找一组她拥有的可用 UTXO，总计至少为 11.7 BTC。实际上，Alice 将无法获得恰好 11.7 BTC；假设她能获得的最小组合是 6+4+2=12。然后，她使用这三个输入和两个输出创建一笔交易。第一个输出将是 11.7 BTC，其所有者为 Bob 的地址，第二个输出将是剩余的 0.3 BTC“找零”，所有者是 Alice 自己。

The first half of the first step prevents transaction senders from spending coins that do not exist, the second half of the first step prevents transaction senders from spending other people's coins, and the second step enforces conservation of value. In order to use this for payment, the protocol is as follows. Suppose Alice wants to send 11.7 BTC to Bob. First, Alice will look for a set of available UTXO that she owns that totals up to at least 11.7 BTC. Realistically, Alice will not be able to get exactly 11.7 BTC; say that the smallest she can get is 6+4+2=12. She then creates a transaction with those three inputs and two outputs. The first output will be 11.7 BTC with Bob's address as its owner, and the second output will be the remaining 0.3 BTC "change", with the owner being Alice herself.

第一步的前半部分防止交易发送者花费不存在的硬币，第一步的后半部分防止交易发送者花费其他人的硬币，第二步强制价值守恒。为了使用它进行支付，协议如下。假设 Alice 想发送 11.7 BTC 给 Bob。首先，Alice 将寻找她拥有的一组可用的 UTXO，总计至少为 11.7 BTC。实际上，Alice 无法准确获得 11.7 BTC；假设她能得到的最小数是 6+4+2=12。然后，她使用这三个输入和两个输出创建一个交易。第一个输出将是 11.7 BTC，Bob 的地址是其所有者，第二个输出将是剩余的 0.3 BTC“零钱”，所有者是 Alice 本人。

If we had access to a trustworthy centralized service, this system would be trivial to implement; it could simply be coded exactly as described, using a centralized server's hard drive to keep track of the state. However, with Bitcoin we are trying to build a decentralized currency system, so we will need to combine the state transaction system with a consensus system in order to ensure that everyone agrees on the order of transactions. Bitcoin's decentralized consensus process requires nodes in the network to continuously attempt to produce packages of transactions called "blocks". The network is intended to produce roughly one block every ten minutes, with each block containing a timestamp, a nonce, a reference to (i.e., hash of) the previous block and a list of all of the transactions that have taken place since the previous block. Over time, this creates a persistent, ever-growing, "blockchain" that constantly updates to represent the latest state of the Bitcoin ledger.

如果我们能够访问值得信赖的中心化服务，这个系统将很容易实现；它可以完全按照描述进行编码，使用中心化服务器的硬盘来跟踪状态。然而，对于比特币，我们试图建立一个去中心化的货币系统，因此我们需要将状态转换系统与共识系统结合起来，以确保每个人都对交易顺序达成一致。比特币的去中心化共识过程要求网络中的节点不断尝试生成称为“区块”的交易包。网络旨在每十分钟左右生成一个区块，每个区块包含一个时间戳、一个随机数、对前一个区块的引用（即哈希）以及自前一个区块以来发生的所有交易的列表。随着时间的推移，这创建了一个持久的、不断增长的“区块链”，它不断更新以代表比特币账本的最新状态。

The algorithm for checking if a block is valid, expressed in this paradigm, is as follows:

本质上，区块中的每笔交易都必须提供一个有效的状态转换，从执行交易前的规范状态转换到某个新状态。请注意，状态并未以任何方式编码在区块中；它纯粹是验证节点要记住的抽象概念，并且只能通过从创世状态开始并按顺序应用每个区块中的每笔交易来（安全地）计算任何区块的状态。此外，请注意矿工将交易包含在区块中的顺序很重要；如果区块中有两笔交易 A 和 B，使得 B 花费了 A 创建的 UTXO，那么如果 A 在 B 之前，该区块将是有效的，否则无效。

Essentially, each transaction in the block must provide a valid state transition from what was the canonical state before the transaction was executed to some new state. Note that the state is not encoded in the block in any way; it is purely an abstraction to be remembered by the validating node and can only be (securely) computed for any block by starting from the genesis state and sequentially applying every transaction in every block. Additionally, note that the order in which the miner includes transactions into the block matters; if there are two transactions A and B in a block such that B spends a UTXO created by A, then the block will be valid if A comes before B but not otherwise.

上述列表中存在的一个在其他系统中找不到的有效性条件是“工作量证明 (PoW)”的要求。确切的条件是，每个区块的双重 SHA-256 哈希（被视为 256 位数字）必须小于动态调整的目标值，在撰写本文时，该目标值约为 2 187 。这样做的目的是使区块创建在计算上变得“困难”，从而防止女巫攻击者为了自己的利益而重构整个区块链。因为 SHA-256 被设计为完全不可预测的伪随机函数，所以创建有效区块的唯一方法就是反复试验，不断增加随机数并查看新哈希是否匹配。

The one validity condition present in the above list that is not found in other systems is the requirement for "proof-of-work". The precise condition is that the double-SHA256 hash of every block, treated as a 256-bit number, must be less than a dynamically adjusted target, which as of the time of this writing is approximately 2 187 . The purpose of this is to make block creation computationally "hard", thereby preventing sybil attackers from remaking the entire blockchain in their favor. Because SHA256 is designed to be a completely unpredictable pseudo-random function, the only way to create a valid block is simply trial and error, repeatedly incrementing the nonce and seeing if the new hash matches.

在当前约 2 187 的目标下，网络平均必须尝试约 2 69 次才能找到一个有效的区块；通常，网络每 2016 个区块重新校准一次目标，以便网络中的某个节点平均每十分钟生成一个新区块。为了补偿矿工的这项计算工作，每个区块的矿工都有权包含一笔凭空给自己 25 BTC 的交易。此外，如果任何交易的输入总面额高于输出总面额，差额也将作为“交易费”归矿工所有。顺便说一句，这也是发行 BTC 的唯一机制；创世状态根本不包含任何硬币。

At the current target of ~2 187 , the network must make an average of ~2 69 tries before a valid block is found; in general, the target is recalibrated by the network every 2016 blocks so that on average a new block is produced by some node in the network every ten minutes. In order to compensate miners for this computational work, the miner of every block is entitled to include a transaction giving themselves 25 BTC out of nowhere. Additionally, if any transaction has a higher total denomination in its inputs than in its outputs, the difference also goes to the miner as a "transaction fee". Incidentally, this is also the only mechanism by which BTC are issued; the genesis state contained no coins at all.

为了更好地理解挖矿的目的，让我们研究一下在发生恶意攻击者时会发生什么。由于已知比特币的底层密码学是安全的，攻击者将瞄准比特币系统中未受密码学直接保护的一个部分：交易顺序。攻击者的策略很简单：

In order to better understand the purpose of mining, let us examine what happens in the event of a malicious attacker. Since Bitcoin's underlying cryptography is known to be secure, the attacker will target the one part of the Bitcoin system that is not protected by cryptography directly: the order of transactions. The attacker's strategy is simple:

一旦步骤 (1) 发生，几分钟后，某个矿工将把该交易包含在一个区块中，假设是第 270000 号区块。大约一小时后，该区块之后的链上将添加五个区块，每个区块都间接指向该交易，从而“确认”它。此时，商家将接受付款为已最终确定并交付产品；因为我们假设这是一种数字商品，所以交付是即时的。现在，攻击者创建另一笔交易，将 100 BTC 发送给自己。如果攻击者只是将其发布到实际网络中，该交易将不会被处理；矿工将尝试运行 APPLY(S,TX) 并注意到 TX 消耗了一个不再处于状态中的 UTXO。因此，攻击者创建了区块链的“分叉”，首先挖掘另一个版本的区块 270000，指向同一个区块 269999 作为父区块，但用新交易代替旧交易。因为区块数据不同，这需要重新进行工作量证明 (PoW)。此外，攻击者的新版本区块 270000 具有不同的哈希，因此原始区块 270001 到 270005 不会“指向”它；因此，原始链和攻击者的新链是完全分开的。规则是，在分叉中，最长的区块链被认为是真实的，因此合法的矿工将在 270005 链上工作，而攻击者独自在 270000 链上工作。为了使攻击者的区块链成为最长的，他需要拥有比网络其余部分总和更多的计算能力才能赶上（因此称为“51%攻击”）。

Once step (1) has taken place, after a few minutes some miner will include the transaction in a block, say block number 270000. After about one hour, five more blocks will have been added to the chain after that block, with each of those blocks indirectly pointing to the transaction and thus "confirming" it. At this point, the merchant will accept the payment as finalized and deliver the product; since we are assuming this is a digital good, delivery is instant. Now, the attacker creates another transaction sending the 100 BTC to himself. If the attacker simply releases it into the wild, the transaction will not be processed; miners will attempt to run APPLY(S,TX) and notice that TX consumes a UTXO which is no longer in the state. So instead, the attacker creates a "fork" of the blockchain, starting by mining another version of block 270000 pointing to the same block 269999 as a parent but with the new transaction in place of the old one. Because the block data is different, this requires redoing the proof-of-work. Furthermore, the attacker's new version of block 270000 has a different hash, so the original blocks 270001 to 270005 do not "point" to it; thus, the original chain and the attacker's new chain are completely separate. The rule is that in a fork the longest blockchain is taken to be the truth, and so legitimate miners will work on the 270005 chain while the attacker alone is working on the 270000 chain. In order for the attacker to make his blockchain the longest, he would need to have more computational power than the rest of the network combined in order to catch up (hence, "51% attack").

一旦步骤（1）发生，几分钟后，一些矿工会将交易包含在一个区块中，比如区块号 270000。大约一小时后，在该区块之后，将另外添加五个区块到链中，每个区块都间接指向该交易，从而“确认”它。此时，商家将接受已确定的付款并发货；由于我们假设这是一种数字商品，因此交付是即时的。现在，攻击者创建另一笔交易，将 100 BTC 发送给自己。如果攻击者只是将其释放到野外，则交易将不会被处理；矿工将尝试运行 APPLY(S,TX) 并注意到 TX 消耗了不再处于该状态的 UTXO。因此，攻击者创建了区块链的“分叉”，首先挖掘区块 270000 的另一个版本，该版本指向同一个区块 269999 作为父区块，但用新交易代替旧交易。因为区块数据不同，这就需要重新做工作量证明。此外，攻击者的新版本块270000具有不同的哈希值，因此原始块270001至270005不会“指向”它；因此，原始链和攻击者的新链是完全分开的。规则是，在分叉中，最长的区块链被视为真相，因此合法矿工将在 270005 链上工作，而攻击者独自在 270000 链上工作。为了使攻击者的区块链最长，他需要拥有比网络其他部分加起来还要多的计算能力才能赶上（因此，“51％攻击”）。

Left: it suffices to present only a small number of nodes in a Merkle tree to give a proof of the validity of a branch.

比特币的一个重要可扩展性特征是区块存储在多级数据结构中。区块的“哈希”实际上只是区块头的哈希，区块头是一段大约 200 字节的数据，包含时间戳、随机数、前一个区块哈希以及称为默克尔树的数据结构的根哈希，该数据结构存储了区块中的所有交易。默克尔树是一种二叉树，由一组节点组成，树底部有大量包含底层数据的叶节点，一组中间节点（每个节点是其两个子节点的哈希），最后是一个单一的根节点（也由其两个子节点的哈希形成），代表树的“顶部”。默克尔树的目的是允许区块中的数据零散地传递：节点可以从一个来源仅下载区块头，从另一个来源下载与它们相关的树的一小部分，并且仍然确信所有数据都是正确的。这样做的原因是哈希向上层传播：如果恶意用户试图将伪造的交易交换到默克尔树的底部，这种更改将导致上方节点的更改，然后导致更上方节点的更改，最终改变树的根，从而改变区块的哈希，导致协议将其注册为完全不同的区块（几乎可以肯定具有无效的工作量证明 (PoW)）。

Right: any attempt to change any part of the Merkle tree will eventually lead to an inconsistency somewhere up the chain.

默克尔树协议可以说是长期可持续性所必不可少的。比特币网络中的“全节点”（存储并处理每个区块的全部内容的节点）截至 2014 年 4 月在比特币网络中占用约 15 GB 的磁盘空间，并且每月增长超过 1 GB。目前，这对于某些台式电脑是可行的，但对于手机则不可行，而在未来，只有企业和爱好者才能参与。一种称为“简化支付验证”（SPV）的协议允许存在另一类节点，称为“轻节点”，它们下载区块头，验证区块头上的工作量证明 (PoW)，然后仅下载与它们相关的交易关联的“分支”。这使得轻节点能够在仅下载整个区块链的一小部分的情况下，以强有力的安全保证确定任何比特币交易的状态及其当前余额。

An important scalability feature of Bitcoin is that the block is stored in a multi-level data structure. The "hash" of a block is actually only the hash of the block header, a roughly 200-byte piece of data that contains the timestamp, nonce, previous block hash and the root hash of a data structure called the Merkle tree storing all transactions in the block. A Merkle tree is a type of binary tree, composed of a set of nodes with a large number of leaf nodes at the bottom of the tree containing the underlying data, a set of intermediate nodes where each node is the hash of its two children, and finally a single root node, also formed from the hash of its two children, representing the "top" of the tree. The purpose of the Merkle tree is to allow the data in a block to be delivered piecemeal: a node can download only the header of a block from one source, the small part of the tree relevant to them from another source, and still be assured that all of the data is correct. The reason why this works is that hashes propagate upward: if a malicious user attempts to swap in a fake transaction into the bottom of a Merkle tree, this change will cause a change in the node above, and then a change in the node above that, finally changing the root of the tree and therefore the hash of the block, causing the protocol to register it as a completely different block (almost certainly with an invalid proof-of-work).

比特币的一个重要的可扩展性特征是区块存储在多级数据结构中。区块的“哈希”实际上只是区块头的哈希，区块头是一段大约 200 字节的数据，其中包含时间戳、随机数、前一个区块哈希以及存储区块中所有交易的数据结构（称为 Merkle 树）的根哈希。 Merkle 树是一种二叉树，由一组节点组成，树底部有大量叶节点，包含底层数据；一组中间节点，其中每个节点都是其两个子节点的哈希值；最后是一个根节点，也是由其两个子节点的哈希值组成，代表树的“顶部”。 Merkle 树的目的是允许块中的数据被分段传送：节点只能从一个源下载块的标头，从另一个源下载与它们相关的树的一小部分，并且仍然可以确保所有数据都是正确的。这样做的原因是哈希值向上传播：如果恶意用户尝试将虚假交易交换到 Merkle 树的底部，这种变化将导致上面的节点发生变化，然后导致上面的节点发生变化，最终改变树的根，从而改变块的哈希值，导致协议将其注册为完全不同的块（几乎肯定带有无效的工作量证明）。

The Merkle tree protocol is arguably essential to long-term sustainability. A "full node" in the Bitcoin network, one that stores and processes the entirety of every block, takes up about 15 GB of disk space in the Bitcoin network as of April 2014, and is growing by over a gigabyte per month. Currently, this is viable for some desktop computers and not phones, and later on in the future only businesses and hobbyists will be able to participate. A protocol known as "simplified payment verification" (SPV) allows for another class of nodes to exist, called "light nodes", which download the block headers, verify the proof-of-work on the block headers, and then download only the "branches" associated with transactions that are relevant to them. This allows light nodes to determine with a strong guarantee of security what the status of any Bitcoin transaction, and their current balance, is while downloading only a very small portion of the entire blockchain.

默克尔树协议可以说对于长期可持续性至关重要。截至 2014 年 4 月，比特币网络中的“完整节点”（存储和处理整个区块）占用比特币网络中约 15 GB 的磁盘空间，并且每月增长超过 1 GB。目前，这对于某些台式电脑而不是手机来说是可行的，将来只有企业和爱好者才能参与。称为“简化支付验证”（SPV）的协议允许存在另一类节点，称为“轻节点”，它们下载块头，验证块头上的工作量证明，然后仅下载与它们相关的交易关联的“分支”。这使得轻节点能够在强有力的安全保证下确定任何比特币交易的状态及其当前余额，同时仅下载整个区块链的一小部分。

The idea of taking the underlying blockchain idea and applying it to other concepts also has a long history. In 2005, Nick Szabo came out with the concept of " secure property titles with owner authority (opens in a new tab) ", a document describing how "new advances in replicated database technology" will allow for a blockchain-based system for storing a registry of who owns what land, creating an elaborate framework including concepts such as homesteading, adverse possession and Georgian land tax. However, there was unfortunately no effective replicated database system available at the time, and so the protocol was never implemented in practice. After 2009, however, once Bitcoin's decentralized consensus was developed a number of alternative applications rapidly began to emerge.

将底层区块链思想应用于其他概念的想法也有着悠久的历史。2005 年，尼克·萨博（Nick Szabo）提出了“ 具有所有者权限的安全产权 （在新标签页中打开） ”的概念，该文件描述了“复制数据库技术的新进展”将如何允许基于区块链的系统存储谁拥有什么土地的登记册，创建了一个精心设计的框架，包括宅基地、逆权占有和乔治亚土地税等概念。然而，不幸的是，当时没有有效的复制数据库系统可用，因此该协议从未在实践中实施。然而，在 2009 年之后，一旦比特币的去中心化共识被开发出来，许多替代应用迅速开始出现。

Thus, in general, there are two approaches toward building a consensus protocol: building an independent network, and building a protocol on top of Bitcoin. The former approach, while reasonably successful in the case of applications like Namecoin, is difficult to implement; each individual implementation needs to bootstrap an independent blockchain, as well as building and testing all of the necessary state transition and networking code. Additionally, we predict that the set of applications for decentralized consensus technology will follow a power law distribution where the vast majority of applications would be too small to warrant their own blockchain, and we note that there exist large classes of decentralized applications, particularly decentralized autonomous organizations, that need to interact with each other.

因此，总的来说，构建共识协议有两种方法：构建独立的网络，以及在比特币之上构建协议。前一种方法虽然在 Namecoin 等应用的情况下相当成功，但很难实现；每个单独的实现都需要引导一个独立的区块链，以及构建和测试所有必要的状态转换和网络代码。此外，我们预测去中心化共识技术的应用集将遵循幂律分布，其中绝大多数应用将太小而无法保证拥有自己的区块链，并且我们注意到存在大量需要相互交互的去中心化应用，特别是去中心化自治组织 (DAO)。

The Bitcoin-based approach, on the other hand, has the flaw that it does not inherit the simplified payment verification features of Bitcoin. SPV works for Bitcoin because it can use blockchain depth as a proxy for validity; at some point, once the ancestors of a transaction go far enough back, it is safe to say that they were legitimately part of the state. Blockchain-based meta-protocols, on the other hand, cannot force the blockchain not to include transactions that are not valid within the context of their own protocols. Hence, a fully secure SPV meta-protocol implementation would need to backward scan all the way to the beginning of the Bitcoin blockchain to determine whether or not certain transactions are valid. Currently, all "light" implementations of Bitcoin-based meta-protocols rely on a trusted server to provide the data, arguably a highly suboptimal result especially when one of the primary purposes of a cryptocurrency is to eliminate the need for trust.

另一方面，基于比特币的方法存在一个缺陷，即它没有继承比特币的简化支付验证功能。SPV 适用于比特币，因为它可以使用区块链深度作为有效性的代理；在某个时候，一旦交易的祖先追溯得足够远，就可以安全地说它们合法地是状态的一部分。另一方面，基于区块链的元协议无法强制区块链不包含在其自身协议上下文中无效的交易。因此，一个完全安全的 SPV 元协议实现需要一直向后扫描到比特币区块链的开头，以确定某些交易是否有效。目前，基于比特币的元协议的所有“轻量级”实现都依赖于可信服务器来提供数据，这可以说是一个非常次优的结果，特别是当加密货币的主要目的之一是消除对信任的需求时。

Even without any extensions, the Bitcoin protocol actually does facilitate a weak version of a concept of "smart contracts". UTXO in Bitcoin can be owned not just by a public key, but also by a more complicated script expressed in a simple stack-based programming language. In this paradigm, a transaction spending that UTXO must provide data that satisfies the script. Indeed, even the basic public key ownership mechanism is implemented via a script: the script takes an elliptic curve signature as input, verifies it against the transaction and the address that owns the UTXO, and returns 1 if the verification is successful and 0 otherwise. Other, more complicated, scripts exist for various additional use cases. For example, one can construct a script that requires signatures from two out of a given three private keys to validate ("multisig"), a setup useful for corporate accounts, secure savings accounts and some merchant escrow situations. Scripts can also be used to pay bounties for solutions to computational problems, and one can even construct a script that says something like "this Bitcoin UTXO is yours if you can provide an SPV proof that you sent a Dogecoin transaction of this denomination to me", essentially allowing decentralized cross-cryptocurrency exchange.

即使没有任何扩展，比特币协议实际上也促进了“智能合约”概念的弱版本。比特币中的 UTXO 不仅可以由公钥拥有，还可以由用简单的基于堆栈的编程语言表达的更复杂的脚本拥有。在这种范式中，花费该 UTXO 的交易必须提供满足脚本的数据。实际上，即使是基本的公钥所有权机制也是通过脚本实现的：该脚本将椭圆曲线签名作为输入，根据交易和拥有 UTXO 的地址对其进行验证，如果验证成功则返回 1，否则返回 0。对于各种其他用例，存在其他更复杂的脚本。例如，可以构建一个脚本，要求给定的三个私钥中的两个签名才能验证（“多重签名”），这种设置对于公司账户、安全储蓄账户和某些商家托管情况很有用。脚本还可以用于为计算问题的解决方案支付赏金，甚至可以构建一个脚本，内容类似于“如果你能提供 SPV 证明，证明你向我发送了这种面额的狗狗币交易，那么这个比特币 UTXO 就是你的”，这本质上允许去中心化的跨加密货币兑换。

However, the scripting language as implemented in Bitcoin has several important limitations:

因此，我们看到了在加密货币之上构建高级应用的三种方法：构建新的区块链、在比特币之上使用脚本以及在比特币之上构建元协议。构建新的区块链允许在构建功能集方面拥有无限的自由，但代价是开发时间、引导工作和安全性。使用脚本很容易实现和标准化，但其功能非常有限，而元协议虽然简单，但在可扩展性方面存在缺陷。借助以太坊，我们打算构建一个替代框架，在易于开发以及更强大的轻客户端属性方面提供更大的收益，同时允许应用共享经济环境和区块链安全性。

Thus, we see three approaches to building advanced applications on top of cryptocurrency: building a new blockchain, using scripting on top of Bitcoin, and building a meta-protocol on top of Bitcoin. Building a new blockchain allows for unlimited freedom in building a feature set, but at the cost of development time, bootstrapping effort and security. Using scripting is easy to implement and standardize, but is very limited in its capabilities, and meta-protocols, while easy, suffer from faults in scalability. With Ethereum, we intend to build an alternative framework that provides even larger gains in ease of development as well as even stronger light client properties, while at the same time allowing applications to share an economic environment and blockchain security.

因此，我们看到了在加密货币之上构建高级应用程序的三种方法：构建新的区块链、在比特币之上使用脚本以及在比特币之上构建元协议。构建新的区块链可以在构建功能集方面提供无限的自由，但代价是开发时间、引导工作和安全性。使用脚本很容易实现和标准化，但其功能非常有限，而且元协议虽然简单，但在可扩展性方面存在缺陷。通过以太坊，我们打算构建一个替代框架，在开发便利性方面提供更大的收益以及更强大的轻客户端属性，同时允许应用程序共享经济环境和区块链安全性。

The intent of Ethereum is to create an alternative protocol for building decentralized applications, providing a different set of tradeoffs that we believe will be very useful for a large class of decentralized applications, with particular emphasis on situations where rapid development time, security for small and rarely used applications, and the ability of different applications to very efficiently interact, are important. Ethereum does this by building what is essentially the ultimate abstract foundational layer: a blockchain with a built-in Turing-complete programming language, allowing anyone to write smart contracts and decentralized applications where they can create their own arbitrary rules for ownership, transaction formats and state transition functions. A bare-bones version of Namecoin can be written in two lines of code, and other protocols like currencies and reputation systems can be built in under twenty. Smart contracts, cryptographic "boxes" that contain value and only unlock it if certain conditions are met, can also be built on top of the platform, with vastly more power than that offered by Bitcoin scripting because of the added powers of Turing-completeness, value-awareness, blockchain-awareness and state.

以太坊的意图是创建一个用于构建去中心化应用 (dapp) 的替代协议，提供一组不同的权衡，我们认为这对于一大类去中心化应用将非常有用，特别强调快速开发时间、小型和极少使用的应用的安全性以及不同应用之间非常高效交互的能力。以太坊通过构建本质上是终极抽象基础层来实现这一点：一个内置图灵完备编程语言的区块链，允许任何人编写智能合约和去中心化应用，在其中他们可以创建自己任意的所有权规则、交易格式和状态转换函数。一个准系统版本的 Namecoin 可以用两行代码编写，而其他协议（如货币和声誉系统）可以在不到二十行代码内构建。智能合约，即包含价值且仅在满足特定条件时才解锁的密码学“盒子”，也可以在该平台之上构建，由于增加了图灵完备性、价值感知、区块链感知和状态的能力，其功能比比特币脚本提供的功能强大得多。

In Ethereum, the state is made up of objects called "accounts", with each account having a 20-byte address and state transitions being direct transfers of value and information between accounts. An Ethereum account contains four fields:

在以太坊中，状态由称为“账户”的对象组成，每个账户都有一个 20 字节的地址，状态转换是账户之间价值和信息的直接转移。一个以太坊账户包含四个字段：

"Ether" is the main internal crypto-fuel of Ethereum, and is used to pay transaction fees. In general, there are two types of accounts: externally owned accounts , controlled by private keys, and contract accounts , controlled by their contract code. An externally owned account has no code, and one can send messages from an externally owned account by creating and signing a transaction; in a contract account, every time the contract account receives a message its code activates, allowing it to read and write to internal storage and send other messages or create contracts in turn.

“以太币”是以太坊主要的内部加密燃料，用于支付交易费。通常，有两种类型的账户：由私钥控制的 外部拥有账户 ，以及由其合约代码控制的 合约账户 。外部拥有账户没有代码，人们可以通过创建和签名交易从外部拥有账户发送消息；在合约账户中，每次合约账户收到消息时，其代码就会激活，允许它读取和写入内部存储，并依次发送其他消息或创建合约。

Note that "contracts" in Ethereum should not be seen as something that should be "fulfilled" or "complied with"; rather, they are more like "autonomous agents" that live inside of the Ethereum execution environment, always executing a specific piece of code when "poked" by a message or transaction, and having direct control over their own ether balance and their own key/value store to keep track of persistent variables.

请注意，以太坊中的“合约”不应被视为应该被“履行”或“遵守”的东西；相反，它们更像是生活在以太坊执行环境中的“自治代理”，当被消息或交易“戳中”时，总是执行一段特定的代码，并直接控制它们自己的以太币余额和它们自己的键/值存储，以跟踪持久变量。

The term "transaction" is used in Ethereum to refer to the signed data package that stores a message to be sent from an externally owned account. Transactions contain:

在以太坊中，“交易”一词用于指代存储要从外部拥有账户发送的消息的签名数据包。交易包含：

The first three are standard fields expected in any cryptocurrency. The data field has no function by default, but the virtual machine has an opcode using which a contract can access the data; as an example use case, if a contract is functioning as an on-blockchain domain registration service, then it may wish to interpret the data being passed to it as containing two "fields", the first field being a domain to register and the second field being the IP address to register it to. The contract would read these values from the message data and appropriately place them in storage.

前三个是任何加密货币中预期的标准字段。数据字段默认情况下没有功能，但虚拟机有一个操作码，合约可以使用它来访问数据；作为一个示例用例，如果一个合约充当链上域名注册服务，那么它可能希望将传递给它的数据解释为包含两个“字段”，第一个字段是要注册的域名，第二个字段是要将其注册到的 IP 地址。合约将从消息数据中读取这些值，并将它们适当地放入存储中。

The STARTGAS and GASPRICE fields are crucial for Ethereum's anti-denial of service model. In order to prevent accidental or hostile infinite loops or other computational wastage in code, each transaction is required to set a limit to how many computational steps of code execution it can use. The fundamental unit of computation is "gas"; usually, a computational step costs 1 gas, but some operations cost higher amounts of gas because they are more computationally expensive, or increase the amount of data that must be stored as part of the state. There is also a fee of 5 gas for every byte in the transaction data. The intent of the fee system is to require an attacker to pay proportionately for every resource that they consume, including computation, bandwidth and storage; hence, any transaction that leads to the network consuming a greater amount of any of these resources must have a gas fee roughly proportional to the increment.

STARTGAS 和 GASPRICE 字段对于以太坊的反拒绝服务模型至关重要。为了防止代码中出现意外或恶意的无限循环或其他计算浪费，每笔交易都被要求设置一个限制，规定它可以使用的代码执行计算步骤的数量。计算的基本单位是“Gas”；通常，一个计算步骤花费 1 Gas，但某些操作会花费更高数量的 Gas，因为它们的计算成本更高，或者增加了必须作为状态一部分存储的数据量。交易数据中的每个字节还需要支付 5 Gas 的费用。费用系统的意图是要求攻击者为他们消耗的每种资源（包括计算、带宽和存储）按比例付费；因此，任何导致网络消耗更多这些资源的交易，都必须具有与增量大致成比例的 gas 费。

Contracts have the ability to send "messages" to other contracts. Messages are virtual objects that are never serialized and exist only in the Ethereum execution environment. A message contains:

合约有能力向其他合约发送“消息”。消息是永远不会被序列化的虚拟对象，仅存在于以太坊执行环境中。一条消息包含：

Essentially, a message is like a transaction, except it is produced by a contract and not an external actor. A message is produced when a contract currently executing code executes the CALL opcode, which produces and executes a message. Like a transaction, a message leads to the recipient account running its code. Thus, contracts can have relationships with other contracts in exactly the same way that external actors can.

本质上，消息就像一笔交易，只不过它是由合约而不是外部参与者产生的。当当前正在执行代码的合约执行 CALL 操作码时，就会产生一条消息，该操作码会产生并执行一条消息。像交易一样，消息会导致接收账户运行其代码。因此，合约可以以与外部参与者完全相同的方式与其他合约建立关系。

Note that the gas allowance assigned by a transaction or contract applies to the total gas consumed by that transaction and all sub-executions. For example, if an external actor A sends a transaction to B with 1000 gas, and B consumes 600 gas before sending a message to C, and the internal execution of C consumes 300 gas before returning, then B can spend another 100 gas before running out of gas.

请注意，由交易或合约分配的 Gas 授权额度适用于该交易和所有子执行消耗的总 Gas。例如，如果外部参与者 A 向 B 发送了一笔带有 1000 Gas 的交易，并且 B 在向 C 发送消息之前消耗了 600 Gas，而 C 的内部执行在返回之前消耗了 300 Gas，那么 B 在耗尽 Gas 之前还可以再花费 100 Gas。

The Ethereum state transition function, APPLY(S,TX) -> S' can be defined as follows:

请注意，在现实中，合约代码是用低级 EVM 代码编写的；为了清晰起见，此示例是用我们的一种高级语言 Serpent 编写的，并且可以编译为 EVM 代码。假设合约的存储最初为空，并且发送了一笔交易，其包含 10 以太币的价值、2000 Gas、0.001 以太币的 gasprice（Gas 价格）以及 64 字节的数据，其中字节 0-31 表示数字 2 ，字节 32-63 表示字符串 CHARLIE fn3 。在这种情况下，状态转换函数的过程如下：

For example, suppose that the contract's code is:

如果交易的接收端没有合约，那么总交易费将简单地等于提供的 GASPRICE 乘以交易的字节长度，并且随交易一起发送的数据将是不相关的。

Note that in reality the contract code is written in the low-level EVM code; this example is written in Serpent, one of our high-level languages, for clarity, and can be compiled down to EVM code. Suppose that the contract's storage starts off empty, and a transaction is sent with 10 ether value, 2000 gas, 0.001 ether gasprice, and 64 bytes of data, with bytes 0-31 representing the number 2 and bytes 32-63 representing the string CHARLIE fn3 . The process for the state transition function in this case is as follows:

请注意，在回退方面，消息的工作方式与交易等效：如果消息执行耗尽了 Gas，那么该消息的执行以及由该执行触发的所有其他执行都会回退，但父执行不需要回退。这意味着合约调用另一个合约是“安全的”，因为如果 A 用 G Gas 调用 B，那么 A 的执行保证最多损失 G Gas。最后，请注意有一个操作码 CREATE 用于创建合约；它的执行机制通常类似于 CALL ，例外之处在于执行的输出决定了新创建合约的代码。

If there was no contract at the receiving end of the transaction, then the total transaction fee would simply be equal to the provided GASPRICE multiplied by the length of the transaction in bytes, and the data sent alongside the transaction would be irrelevant.

如果交易接收端没有合约，那么总交易费用将简单地等于所提供的 GASPRICE 乘以交易长度（以字节为单位），并且与交易一起发送的数据将无关紧要。

Note that messages work equivalently to transactions in terms of reverts: if a message execution runs out of gas, then that message's execution, and all other executions triggered by that execution, revert, but parent executions do not need to revert. This means that it is "safe" for a contract to call another contract, as if A calls B with G gas then A's execution is guaranteed to lose at most G gas. Finally, note that there is an opcode, CREATE , that creates a contract; its execution mechanics are generally similar to CALL , with the exception that the output of the execution determines the code of a newly created contract.

请注意，消息在恢复方面与事务的工作方式相同：如果消息执行耗尽了 Gas，则该消息的执行以及由该执行触发的所有其他执行都会恢复，但父执行不需要恢复。这意味着一个合约调用另一个合约是“安全”的，就好像 A 用 G Gas 调用 B 一样，那么 A 的执行保证最多损失 G Gas。最后，请注意，有一个操作码 CREATE 用于创建合约；它的执行机制通常与 CALL 类似，不同之处在于执行的输出决定了新创建合约的代码。

The code in Ethereum contracts is written in a low-level, stack-based bytecode language, referred to as "Ethereum virtual machine code" or "EVM code". The code consists of a series of bytes, where each byte represents an operation. In general, code execution is an infinite loop that consists of repeatedly carrying out the operation at the current program counter (which begins at zero) and then incrementing the program counter by one, until the end of the code is reached or an error or STOP or RETURN instruction is detected. The operations have access to three types of space in which to store data:

以太坊合约中的代码是用一种低级的、基于堆栈的字节码语言编写的，被称为“以太坊虚拟机 (EVM) 代码”或“EVM 代码”。该代码由一系列字节组成，其中每个字节代表一个操作。通常，代码执行是一个无限循环，包括在当前程序计数器（从零开始）处重复执行操作，然后将程序计数器加一，直到到达代码末尾，或者检测到错误、 STOP 或 RETURN 指令。这些操作可以访问三种类型的空间来存储数据：

The code can also access the value, sender and data of the incoming message, as well as block header data, and the code can also return a byte array of data as an output.

代码还可以访问传入消息的价值、发送者和数据，以及区块头数据，并且代码还可以返回一个字节数组数据作为输出。

The formal execution model of EVM code is surprisingly simple. While the Ethereum virtual machine is running, its full computational state can be defined by the tuple (block_state, transaction, message, code, memory, stack, pc, gas) , where block_state is the global state containing all accounts and includes balances and storage. At the start of every round of execution, the current instruction is found by taking the pc th byte of code (or 0 if pc >= len(code) ), and each instruction has its own definition in terms of how it affects the tuple. For example, ADD pops two items off the stack and pushes their sum, reduces gas by 1 and increments pc by 1, and SSTORE pops the top two items off the stack and inserts the second item into the contract's storage at the index specified by the first item. Although there are many ways to optimize Ethereum virtual machine execution via just-in-time compilation, a basic implementation of Ethereum can be done in a few hundred lines of code.

EVM 代码的正式执行模型出奇地简单。当以太坊虚拟机运行时，其完整的计算状态可以由元组 (block_state, transaction, message, code, memory, stack, pc, gas) 定义，其中 block_state 是包含所有账户并包括余额和存储的全局状态。在每一轮执行开始时，通过获取 code 的第 pc 个字节（如果 pc >= len(code) 则为 0）来找到当前指令，并且每条指令在如何影响该元组方面都有自己的定义。例如， ADD 从堆栈中弹出两个项目并推入它们的总和，将 gas 减 1 并将 pc 加 1，而 SSTORE 从堆栈中弹出顶部两个项目，并将第二个项目插入到合约存储中由第一个项目指定的索引处。尽管有许多方法可以通过即时编译来优化以太坊虚拟机的执行，但以太坊的基本实现可以用几百行代码完成。

The Ethereum blockchain is in many ways similar to the Bitcoin blockchain, although it does have some differences. The main difference between Ethereum and Bitcoin with regard to the blockchain architecture is that, unlike Bitcoin, Ethereum blocks contain a copy of both the transaction list and the most recent state. Aside from that, two other values, the block number and the difficulty, are also stored in the block. The basic block validation algorithm in Ethereum is as follows:

以太坊区块链在许多方面类似于比特币区块链，尽管它确实有一些不同之处。在区块链架构方面，以太坊和比特币之间的主要区别在于，与比特币不同，以太坊区块包含交易列表和最新状态的副本。除此之外，区块中还存储了另外两个值：区块号和难度。以太坊中的基本区块验证算法如下：

The approach may seem highly inefficient at first glance, because it needs to store the entire state with each block, but in reality efficiency should be comparable to that of Bitcoin. The reason is that the state is stored in the tree structure, and after every block only a small part of the tree needs to be changed. Thus, in general, between two adjacent blocks the vast majority of the tree should be the same, and therefore the data can be stored once and referenced twice using pointers (i.e., hashes of subtrees). A special kind of tree known as a "Patricia tree" is used to accomplish this, including a modification to the Merkle tree concept that allows for nodes to be inserted and deleted, and not just changed, efficiently. Additionally, because all of the state information is part of the last block, there is no need to store the entire blockchain history - a strategy which, if it could be applied to Bitcoin, can be calculated to provide 5-20x savings in space.

乍一看，这种方法似乎效率极低，因为它需要将整个状态与每个区块一起存储，但实际上效率应该与比特币相当。原因是状态存储在树结构中，并且在每个区块之后，只需要更改树的一小部分。因此，通常在两个相邻区块之间，树的绝大部分应该是相同的，因此数据可以存储一次，并使用指针（即子树的哈希）引用两次。一种被称为“帕特里夏树 (Patricia tree)”的特殊树被用来实现这一点，包括对默克尔树概念的修改，允许高效地插入和删除节点，而不仅仅是更改节点。此外，由于所有状态信息都是最后一个区块的一部分，因此无需存储整个区块链历史记录——如果将这种策略应用于比特币，经计算可以节省 5-20 倍的空间。

A commonly asked question is "where" contract code is executed, in terms of physical hardware. This has a simple answer: the process of executing contract code is part of the definition of the state transition function, which is part of the block validation algorithm, so if a transaction is added into block B the code execution spawned by that transaction will be executed by all nodes, now and in the future, that download and validate block B .

一个常见的问题是，就物理硬件而言，合约代码在“哪里”执行。这有一个简单的答案：执行合约代码的过程是状态转换函数定义的一部分，而状态转换函数是区块验证算法的一部分，因此，如果一笔交易被添加到区块 B 中，由该交易产生的代码执行将由现在和将来下载并验证区块 B 的所有节点执行。

In general, there are three types of applications on top of Ethereum. The first category is financial applications, providing users with more powerful ways of managing and entering into contracts using their money. This includes sub-currencies, financial derivatives, hedging contracts, savings wallets, wills, and ultimately even some classes of full-scale employment contracts. The second category is semi-financial applications, where money is involved but there is also a heavy non-monetary side to what is being done; a perfect example is self-enforcing bounties for solutions to computational problems. Finally, there are applications such as online voting and decentralized governance that are not financial at all.

总的来说，以太坊之上有三种类型的应用。第一类是金融应用，为用户提供更强大的方式来管理和使用他们的资金参与合约。这包括子货币、金融衍生品、对冲合约、储蓄钱包、遗嘱，甚至最终包括一些类别的全面雇佣合约。第二类是半金融应用，这里涉及资金，但所做的事情也有很重的非金钱方面；一个完美的例子是为解决计算问题而设立的自动执行悬赏。最后，还有一些完全非金融的应用，例如在线投票和去中心化治理。

On-blockchain token systems have many applications ranging from sub-currencies representing assets such as USD or gold to company stocks, individual tokens representing smart property, secure unforgeable coupons, and even token systems with no ties to conventional value at all, used as point systems for incentivization. Token systems are surprisingly easy to implement in Ethereum. The key point to understand is that all a currency, or token system, fundamentally is, is a database with one operation: subtract X units from A and give X units to B, with the proviso that (i) A had at least X units before the transaction and (2) the transaction is approved by A. All that it takes to implement a token system is to implement this logic into a contract.

链上代币系统有许多应用，从代表美元或黄金等资产的子货币到公司股票、代表智能财产的个人代币、安全的不可伪造优惠券，甚至完全与传统价值无关、用作激励积分系统的代币系统。在以太坊中实现代币系统出奇地容易。需要理解的关键点是，所有的货币或代币系统，从根本上说，就是一个只有一种操作的数据库：从 A 减去 X 个单位并给 B 增加 X 个单位，条件是 (1) A 在交易前至少有 X 个单位，以及 (2) 该交易得到 A 的批准。实现一个代币系统所需要做的就是将这种逻辑实现到一个合约中。

The basic code for implementing a token system in Serpent looks as follows:

这本质上是本文档上文进一步描述的“银行系统”状态转换函数的字面实现。需要添加几行额外的代码来提供最初分配货币单位的初始步骤以及其他一些边缘情况，理想情况下，还会添加一个函数以让其他合约查询某个地址的余额。但仅此而已。理论上，作为子货币的基于以太坊的代币系统可能包含基于比特币的链上元货币所缺乏的另一个重要功能：直接用该货币支付交易费的能力。实现这一点的方法是，合约将维持一个以太币余额，用它向发送者退还用于支付费用的以太币，并且它将通过收集其作为费用收取的内部货币单位并在持续运行的拍卖中转售它们来补充这个余额。因此，用户需要用以太币“激活”他们的账户，但一旦有了以太币，它就可以重复使用，因为合约每次都会退还它。

This is essentially a literal implementation of the "banking system" state transition function described further above in this document. A few extra lines of code need to be added to provide for the initial step of distributing the currency units in the first place and a few other edge cases, and ideally a function would be added to let other contracts query for the balance of an address. But that's all there is to it. Theoretically, Ethereum-based token systems acting as sub-currencies can potentially include another important feature that onchain Bitcoin-based meta-currencies lack: the ability to pay transaction fees directly in that currency. The way this would be implemented is that the contract would maintain an ether balance with which it would refund ether used to pay fees to the sender, and it would refill this balance by collecting the internal currency units that it takes in fees and reselling them in a constant running auction. Users would thus need to "activate" their accounts with ether, but once the ether is there it would be reusable because the contract would refund it each time.

这本质上是本文档上面进一步描述的“银行系统”状态转换函数的字面实现。需要添加几行额外的代码，以提供首先分配货币单位的初始步骤和一些其他边缘情况，并且理想情况下会添加一个函数来让其他合约查询地址的余额。但这就是全部了。从理论上讲，作为子货币的基于以太坊的代币系统可能包含基于比特币的链上元货币所缺乏的另一个重要功能：直接以该货币支付交易费用的能力。实现这一点的方式是，合约将维持一个以太币余额，用该余额将用于向发送者支付费用的以太币退还，并且通过收集收取费用的内部货币单位并在持续运行的拍卖中转售它们来重新填充该余额。因此，用户需要用以太币“激活”他们的账户，但一旦以太币存在，它就可以重复使用，因为合约每次都会退款。

Financial derivatives are the most common application of a "smart contract", and one of the simplest to implement in code. The main challenge in implementing financial contracts is that the majority of them require reference to an external price ticker; for example, a very desirable application is a smart contract that hedges against the volatility of ether (or another cryptocurrency) with respect to the US dollar, but doing this requires the contract to know what the value of ETH/USD is. The simplest way to do this is through a "data feed" contract maintained by a specific party (e.g., NASDAQ) designed so that that party has the ability to update the contract as needed, and providing an interface that allows other contracts to send a message to that contract and get back a response that provides the price.

金融衍生品是“智能合约”最常见的应用，也是在代码中最容易实现的之一。实现金融合约的主要挑战在于，它们中的大多数需要参考外部价格行情；例如，一个非常理想的应用是一个智能合约，它可以对冲以太币（或其他加密货币）相对于美元的波动性，但要做到这一点，需要合约知道 ETH/USD 的价值是多少。最简单的方法是通过由特定方（例如纳斯达克）维护的“数据源”合约，其设计使得该方有能力根据需要更新合约，并提供一个接口，允许其他合约向该合约发送消息并获得提供价格的响应。

Given that critical ingredient, the hedging contract would look as follows:

这样的合约在加密商业中将具有巨大的潜力。关于加密货币被提及的主要问题之一是其波动性；尽管许多用户和商家可能希望获得处理加密资产的安全性和便利性，但他们可能不希望面临在一天内损失其资金 23% 价值的前景。到目前为止，最常被提出的解决方案是发行方支持的资产；其理念是，发行方创建一种子货币，他们有权发行和撤销单位，并向任何（在链下）向他们提供一个单位指定标的资产（例如黄金、美元）的人提供一个单位的该货币。然后，发行方承诺向任何退回一个单位加密资产的人提供一个单位的标的资产。这种机制允许任何非加密资产被“提升”为加密资产，前提是发行方是可信的。

Such a contract would have significant potential in crypto-commerce. One of the main problems cited about cryptocurrency is the fact that it's volatile; although many users and merchants may want the security and convenience of dealing with cryptographic assets, they many not wish to face that prospect of losing 23% of the value of their funds in a single day. Up until now, the most commonly proposed solution has been issuer-backed assets; the idea is that an issuer creates a sub-currency in which they have the right to issue and revoke units, and provide one unit of the currency to anyone who provides them (offline) with one unit of a specified underlying asset (e.g., gold, USD). The issuer then promises to provide one unit of the underlying asset to anyone who sends back one unit of the crypto-asset. This mechanism allows any non-cryptographic asset to be "uplifted" into a cryptographic asset, provided that the issuer can be trusted.

然而，在实践中，发行方并不总是值得信赖的，而且在某些情况下，银行基础设施太薄弱或太不友好，导致此类服务无法存在。金融衍生品提供了一种替代方案。在这里，不是由单一发行方提供资金来支持资产，而是由一个去中心化的投机者市场来扮演这个角色，他们押注加密参考资产（例如 ETH）的价格会上涨。与发行方不同，投机者无法选择在交易中违约，因为对冲合约将他们的资金托管在其中。请注意，这种方法并非完全去中心化的，因为仍然需要一个可信的来源来提供价格行情，尽管可以说这在降低基础设施要求（与作为发行方不同，发布喂价不需要许可证，并且很可能被归类为言论自由）和减少欺诈可能性方面仍然是一个巨大的进步。

In practice, however, issuers are not always trustworthy, and in some cases the banking infrastructure is too weak, or too hostile, for such services to exist. Financial derivatives provide an alternative. Here, instead of a single issuer providing the funds to back up an asset, a decentralized market of speculators, betting that the price of a cryptographic reference asset (e.g., ETH) will go up, plays that role. Unlike issuers, speculators have no option to default on their side of the bargain because the hedging contract holds their funds in escrow. Note that this approach is not fully decentralized, because a trusted source is still needed to provide the price ticker, although arguably even still this is a massive improvement in terms of reducing infrastructure requirements (unlike being an issuer, issuing a price feed requires no licenses and can likely be categorized as free speech) and reducing the potential for fraud.

然而，在实践中，发行人并不总是值得信赖的，在某些情况下，银行基础设施太薄弱或太敌对，无法提供此类服务。金融衍生品提供了另一种选择。在这里，扮演这一角色的不是单一发行人提供资金来支持资产，而是由押注加密参考资产（例如 ETH）价格将会上涨的投机者组成的去中心化市场。与发行人不同，投机者没有选择在交易中违约，因为对冲合约将他们的资金托管。请注意，这种方法并不是完全去中心化的，因为仍然需要可信来源来提供价格行情，尽管可以说这在减少基础设施要求（与发行人不同，发行价格信息不需要许可证，并且可能被归类为言论自由）和减少欺诈的可能性方面仍然是一个巨大的改进。

The earliest alternative cryptocurrency of all, Namecoin (opens in a new tab) , attempted to use a Bitcoin-like blockchain to provide a name registration system, where users can register their names in a public database alongside other data. The major cited use case is for a DNS (opens in a new tab) system, mapping domain names like "bitcoin.org" (or, in Namecoin's case, "bitcoin.bit") to an IP address. Other use cases include email authentication and potentially more advanced reputation systems. Here is the basic contract to provide a Namecoin-like name registration system on Ethereum:

最早的替代加密货币 Namecoin （在新标签页中打开） 试图使用类似比特币的区块链来提供名称注册系统，用户可以在公共数据库中注册他们的名称以及其他数据。被引用最多的主要用例是 DNS （在新标签页中打开） 系统，将诸如“bitcoin.org”（或者在 Namecoin 的情况下是“bitcoin.bit”）之类的域名映射到 IP 地址。其他用例包括电子邮件身份验证和可能更高级的声誉系统。以下是在以太坊上提供类似 Namecoin 的名称注册系统的基本合约：

The contract is very simple; all it is a database inside the Ethereum network that can be added to, but not modified or removed from. Anyone can register a name with some value, and that registration then sticks forever. A more sophisticated name registration contract will also have a "function clause" allowing other contracts to query it, as well as a mechanism for the "owner" (i.e., the first registerer) of a name to change the data or transfer ownership. One can even add reputation and web-of-trust functionality on top.

该合约非常简单；它只是以太坊网络内部的一个数据库，可以向其中添加内容，但不能修改或删除。任何人都可以注册一个带有某个值的名称，然后该注册将永远保留。更复杂的名称注册合约还将具有允许其他合约查询它的“函数子句”，以及允许名称的“所有者”（即第一个注册者）更改数据或转移所有权的机制。人们甚至可以在此基础上添加声誉和信任网功能。

Over the past few years, there have emerged a number of popular online file storage startups, the most prominent being Dropbox, seeking to allow users to upload a backup of their hard drive and have the service store the backup and allow the user to access it in exchange for a monthly fee. However, at this point the file storage market is at times relatively inefficient; a cursory look at various existing solutions shows that, particularly at the "uncanny valley" 20-200 GB level at which neither free quotas nor enterprise-level discounts kick in, monthly prices for mainstream file storage costs are such that you are paying for more than the cost of the entire hard drive in a single month. Ethereum contracts can allow for the development of a decentralized file storage ecosystem, where individual users can earn small quantities of money by renting out their own hard drives and unused space can be used to further drive down the costs of file storage.

在过去几年中，出现了许多受欢迎的在线文件存储初创公司，最著名的是 Dropbox，它们试图允许用户上传其硬盘的备份，并由服务存储该备份并允许用户访问，以换取月费。然而，在目前，文件存储市场有时相对低效；粗略地看一下各种现有的解决方案就会发现，特别是在 20-200 GB 的“恐怖谷”级别，既没有免费配额，也没有企业级折扣，主流文件存储成本的月度价格使得你在单个月内支付的费用超过了整个硬盘的成本。以太坊合约可以允许开发去中心化文件存储生态系统，个人用户可以通过出租自己的硬盘来赚取少量资金，未使用的空间可用于进一步降低文件存储的成本。

The key underpinning piece of such a device would be what we have termed the "decentralized Dropbox contract". This contract works as follows. First, one splits the desired data up into blocks, encrypting each block for privacy, and builds a Merkle tree out of it. One then makes a contract with the rule that, every N blocks, the contract would pick a random index in the Merkle tree (using the previous block hash, accessible from contract code, as a source of randomness), and give X ether to the first entity to supply a transaction with a simplified payment verification-like proof of ownership of the block at that particular index in the tree. When a user wants to re-download their file, they can use a micropayment channel protocol (e.g., pay 1 szabo per 32 kilobytes) to recover the file; the most fee-efficient approach is for the payer not to publish the transaction until the end, instead replacing the transaction with a slightly more lucrative one with the same nonce after every 32 kilobytes.

这种设备的关键基础部分将是我们所称的“去中心化 Dropbox 合约”。该合约的工作原理如下。首先，将所需数据分成多个区块，为了隐私对每个区块进行加密，并从中构建一棵默克尔树。然后制定一个合约，规则是：每 N 个区块，合约将在默克尔树中选择一个随机索引（使用可从合约代码访问的前一个区块哈希作为随机性来源），并将 X 个以太币给第一个提供交易的实体，该交易带有类似简化支付验证的证明，证明其拥有树中该特定索引处的区块。当用户想要重新下载他们的文件时，他们可以使用微支付通道协议（例如，每 32 KB 支付 1 萨博）来恢复文件；最节省费用的方法是付款人直到最后才发布交易，而是在每 32 KB 之后用具有相同随机数但稍微更丰厚奖励的交易替换该交易。

An important feature of the protocol is that, although it may seem like one is trusting many random nodes not to decide to forget the file, one can reduce that risk down to near-zero by splitting the file into many pieces via secret sharing, and watching the contracts to see each piece is still in some node's possession. If a contract is still paying out money, that provides a cryptographic proof that someone out there is still storing the file.

该协议的一个重要特征是，尽管看起来像是在信任许多随机节点不会决定忘记该文件，但可以通过秘密共享将文件分成许多片段，并观察合约以查看每个片段是否仍在某个节点的占有中，从而将该风险降低到接近于零。如果合约仍在支付资金，这就提供了一个密码学证明，证明外面仍然有人在存储该文件。

The general concept of a "decentralized autonomous organization" is that of a virtual entity that has a certain set of members or shareholders which, perhaps with a 67% majority, have the right to spend the entity's funds and modify its code. The members would collectively decide on how the organization should allocate its funds. Methods for allocating a DAO's funds could range from bounties, salaries to even more exotic mechanisms such as an internal currency to reward work. This essentially replicates the legal trappings of a traditional company or nonprofit but using only cryptographic blockchain technology for enforcement. So far much of the talk around DAOs has been around the "capitalist" model of a "decentralized autonomous corporation" (DAC) with dividend-receiving shareholders and tradable shares; an alternative, perhaps described as a "decentralized autonomous community", would have all members have an equal share in the decision making and require 67% of existing members to agree to add or remove a member. The requirement that one person can only have one membership would then need to be enforced collectively by the group.

“去中心化自治组织 (DAO)”的一般概念是一个虚拟实体，它拥有一定数量的成员或股东，他们（也许以 67% 的多数票）有权花费实体的资金并修改其代码。成员将集体决定组织应如何分配其资金。分配 DAO 资金的方法可以从悬赏、工资到甚至更奇特的机制，例如用于奖励工作的内部货币。这本质上复制了传统公司或非营利组织的法律框架，但仅使用密码学区块链技术来执行。到目前为止，围绕 DAO 的许多讨论都集中在“去中心化自治公司 (DAC)”的“资本主义”模型上，该模型具有收取股息的股东和可交易的股票；另一种选择，也许可以描述为“去中心化自治社区”，将使所有成员在决策中拥有平等的份额，并要求 67% 的现有成员同意添加或删除成员。一个人只能拥有一个成员资格的要求将需要由该群体集体执行。

A general outline for how to code a DAO is as follows. The simplest design is simply a piece of self-modifying code that changes if two thirds of members agree on a change. Although code is theoretically immutable, one can easily get around this and have de-facto mutability by having chunks of the code in separate contracts, and having the address of which contracts to call stored in the modifiable storage. In a simple implementation of such a DAO contract, there would be three transaction types, distinguished by the data provided in the transaction:

如何编写 DAO 代码的一般大纲如下。最简单的设计就是一段自我修改的代码，如果三分之二的成员同意更改，它就会改变。尽管代码在理论上是不可变的，但人们可以轻松绕过这一点，通过将代码块放在单独的合约中，并将要调用的合约地址存储在可修改的存储中，从而实现事实上的可变性。在这样一个 DAO 合约的简单实现中，将有三种交易类型，通过交易中提供的数据来区分：

The contract would then have clauses for each of these. It would maintain a record of all open storage changes, along with a list of who voted for them. It would also have a list of all members. When any storage change gets to two thirds of members voting for it, a finalizing transaction could execute the change. A more sophisticated skeleton would also have built-in voting ability for features like sending a transaction, adding members and removing members, and may even provide for Liquid Democracy (opens in a new tab) -style vote delegation (i.e., anyone can assign someone to vote for them, and assignment is transitive so if A assigns B and B assigns C then C determines A's vote). This design would allow the DAO to grow organically as a decentralized community, allowing people to eventually delegate the task of filtering out who is a member to specialists, although unlike in the "current system" specialists can easily pop in and out of existence over time as individual community members change their alignments.

然后，合约将为其中每一个提供子句。它将维护所有未决存储更改的记录，以及投票支持这些更改的人员列表。它还将拥有所有成员的列表。当任何存储更改获得三分之二成员的投票支持时，最终确定交易就可以执行该更改。更复杂的骨架还将具有内置的投票能力，用于发送交易、添加成员和删除成员等功能，甚至可能提供 流动民主 (Liquid Democracy) （在新标签页中打开） 风格的投票委托（即，任何人都可以指定某人代其投票，并且指定是传递的，因此如果 A 指定 B，B 指定 C，那么 C 决定 A 的投票）。这种设计将允许 DAO 作为一个去中心化社区有机地发展，允许人们最终将筛选谁是成员的任务委托给专家，尽管与“当前系统”不同，随着各个社区成员改变他们的立场，专家可以随着时间的推移轻松地出现和消失。

An alternative model is for a decentralized corporation, where any account can have zero or more shares, and two thirds of the shares are required to make a decision. A complete skeleton would involve asset management functionality, the ability to make an offer to buy or sell shares, and the ability to accept offers (preferably with an order-matching mechanism inside the contract). Delegation would also exist Liquid Democracy-style, generalizing the concept of a "board of directors".

另一种模型是去中心化公司，其中任何账户都可以拥有零股或多股，并且需要三分之二的股份才能做出决定。一个完整的骨架将涉及资产管理功能、提出买卖股票报价的能力以及接受报价的能力（最好在合约内部具有订单匹配机制）。委托也将以流动民主的风格存在，从而泛化“董事会”的概念。

1. Savings wallets . Suppose that Alice wants to keep her funds safe, but is worried that she will lose or someone will hack her private key. She puts ether into a contract with Bob, a bank, as follows:

1. 储蓄钱包 。假设 Alice 想要保证她的资金安全，但担心她会丢失私钥或有人会黑入她的私钥。她将以太币放入与银行 Bob 签订的合约中，如下所示：

Normally, 1% per day is enough for Alice, and if Alice wants to withdraw more she can contact Bob for help. If Alice's key gets hacked, she runs to Bob to move the funds to a new contract. If she loses her key, Bob will get the funds out eventually. If Bob turns out to be malicious, then she can turn off his ability to withdraw.

通常，每天 1% 对 Alice 来说就足够了，如果 Alice 想提取更多，她可以联系 Bob 寻求帮助。如果 Alice 的密钥被黑客入侵，她会跑去找 Bob 将资金转移到一个新合约中。如果她丢失了密钥，Bob 最终会将资金取出。如果 Bob 证明是恶意的，那么她可以关闭他提取资金的能力。

2. Crop insurance . One can easily make a financial derivatives contract but using a data feed of the weather instead of any price index. If a farmer in Iowa purchases a derivative that pays out inversely based on the precipitation in Iowa, then if there is a drought, the farmer will automatically receive money and if there is enough rain the farmer will be happy because their crops would do well. This can be expanded to natural disaster insurance generally.

2. 农作物保险 。人们可以轻松制定金融衍生品合约，但使用天气数据源而不是任何价格指数。如果爱荷华州的一位农民购买了一种根据爱荷华州降水量反向支付的衍生品，那么如果发生干旱，该农民将自动收到钱，如果有足够的降雨，该农民会很高兴，因为他们的农作物会长得很好。这可以普遍扩展到自然灾害保险。

3. A decentralized data feed . For financial contracts for difference, it may actually be possible to decentralize the data feed via a protocol called " SchellingCoin (opens in a new tab) ". SchellingCoin basically works as follows: N parties all put into the system the value of a given datum (e.g., the ETH/USD price), the values are sorted, and everyone between the 25th and 75th percentile gets one token as a reward. Everyone has the incentive to provide the answer that everyone else will provide, and the only value that a large number of players can realistically agree on is the obvious default: the truth. This creates a decentralized protocol that can theoretically provide any number of values, including the ETH/USD price, the temperature in Berlin or even the result of a particular hard computation.

3. 去中心化数据源 。对于金融差价合约，实际上可能通过一种名为“ SchellingCoin （在新标签页中打开） ”的协议来去中心化数据源。SchellingCoin 的基本工作原理如下：N 个参与方都将给定数据（例如 ETH/USD 价格）的值输入系统，对这些值进行排序，处于第 25 到第 75 百分位数之间的每个人都会获得一个代币作为奖励。每个人都有动机提供其他人将提供的答案，而大量参与者实际上能够达成一致的唯一值就是显而易见的默认值：真相。这创建了一个去中心化协议，理论上可以提供任何数量的值，包括 ETH/USD 价格、柏林的温度，甚至特定困难计算的结果。

4. Smart multisignature escrow . Bitcoin allows multisignature transaction contracts where, for example, three out of a given five keys can spend the funds. Ethereum allows for more granularity; for example, four out of five can spend everything, three out of five can spend up to 10% per day, and two out of five can spend up to 0.5% per day. Additionally, Ethereum multisig is asynchronous - two parties can register their signatures on the blockchain at different times and the last signature will automatically send the transaction.

4. 智能多重签名托管 。比特币允许使用多重签名交易合约，例如，给定五个密钥中的三个可以花费资金。以太坊允许更细的粒度；例如，五分之四可以花费所有资金，五分之三每天最多可以花费 10%，五分之二每天最多可以花费 0.5%。此外，以太坊多重签名是异步的——两方可以在不同时间在区块链上注册他们的签名，最后一个签名将自动发送交易。

5. Cloud computing . The EVM technology can also be used to create a verifiable computing environment, allowing users to ask others to carry out computations and then optionally ask for proofs that computations at certain randomly selected checkpoints were done correctly. This allows for the creation of a cloud computing market where any user can participate with their desktop, laptop or specialized server, and spot-checking together with security deposits can be used to ensure that the system is trustworthy (i.e., nodes cannot profitably cheat). Although such a system may not be suitable for all tasks; tasks that require a high level of inter-process communication, for example, cannot easily be done on a large cloud of nodes. Other tasks, however, are much easier to parallelize; projects like SETI@home, folding@home and genetic algorithms can easily be implemented on top of such a platform.

5. 云计算 。EVM 技术还可用于创建可验证的计算环境，允许用户要求他人执行计算，然后可选择要求提供证明，证明在某些随机选择的检查点处的计算已正确完成。这允许创建一个云计算市场，任何用户都可以使用他们的台式机、笔记本电脑或专用服务器参与其中，并且抽查连同保证金可用于确保系统是可信的（即，节点无法通过作弊获利）。尽管这样的系统可能并不适合所有任务；例如，需要高水平进程间通信的任务无法轻松地在大型节点云上完成。然而，其他任务更容易并行化；像 SETI@home、folding@home 和遗传算法这样的项目可以很容易地在这样的平台上实现。

6. Peer-to-peer gambling . Any number of peer-to-peer gambling protocols, such as Frank Stajano and Richard Clayton's Cyberdice (opens in a new tab) , can be implemented on the Ethereum blockchain. The simplest gambling protocol is actually simply a contract for difference on the next block hash, and more advanced protocols can be built up from there, creating gambling services with near-zero fees that have no ability to cheat.

6. 点对点赌博 。任何数量的点对点赌博协议，例如 Frank Stajano 和 Richard Clayton 的 Cyberdice （在新标签页中打开） ，都可以在以太坊区块链上实现。最简单的赌博协议实际上只是关于下一个区块哈希的差价合约，并且可以从那里建立更高级的协议，创建费用接近于零且无法作弊的赌博服务。

7. Prediction markets . Provided an oracle or SchellingCoin, prediction markets are also easy to implement, and prediction markets together with SchellingCoin may prove to be the first mainstream application of futarchy (opens in a new tab) as a governance protocol for decentralized organizations.

7. 预测市场 。如果提供预言机或 SchellingCoin，预测市场也很容易实现，并且预测市场与 SchellingCoin 一起可能被证明是 futarchy（未来政体） （在新标签页中打开） 作为去中心化组织治理协议的第一个主流应用。

8. Onchain decentralized marketplaces , using the identity and reputation system as a base.

8. 链上去中心化市场，以身份和声誉系统为基础。

The "Greedy Heaviest Observed Subtree" (GHOST) protocol is an innovation first introduced by Yonatan Sompolinsky and Aviv Zohar in December 2013 (opens in a new tab) . The motivation behind GHOST is that blockchains with fast confirmation times currently suffer from reduced security due to a high stale rate - because blocks take a certain time to propagate through the network, if miner A mines a block and then miner B happens to mine another block before miner A's block propagates to B, miner B's block will end up wasted and will not contribute to network security. Furthermore, there is a centralization issue: if miner A is a mining pool with 30% hashpower and B has 10% hashpower, A will have a risk of producing a stale block 70% of the time (since the other 30% of the time A produced the last block and so will get mining data immediately) whereas B will have a risk of producing a stale block 90% of the time. Thus, if the block interval is short enough for the stale rate to be high, A will be substantially more efficient simply by virtue of its size. With these two effects combined, blockchains which produce blocks quickly are very likely to lead to one mining pool having a large enough percentage of the network hashpower to have de facto control over the mining process.

“贪婪最重观察子树”（Greedy Heaviest Observed Subtree，简称 GHOST）协议是由 Yonatan Sompolinsky 和 Aviv Zohar 在 2013 年 12 月 （在新标签页中打开） 首次引入的一项创新。GHOST 背后的动机是，具有快速确认时间的区块链目前由于高废块率而面临安全性降低的问题——因为区块在网络中传播需要一定的时间，如果矿工 A 挖出一个区块，然后矿工 B 在 A 的区块传播到 B 之前碰巧挖出了另一个区块，那么矿工 B 的区块最终将被浪费，并且不会对网络安全做出贡献。此外，还存在中心化问题：如果矿工 A 是一个拥有 30% 算力的矿池，而 B 拥有 10% 的算力，A 将有 70% 的时间面临产生废块的风险（因为另外 30% 的时间 A 产生了上一个区块，因此会立即获得挖矿数据），而 B 将有 90% 的时间面临产生废块的风险。因此，如果区块间隔足够短以至于废块率很高，A 仅仅凭借其规模就会大幅提高效率。结合这两种效应，快速产生区块的区块链极有可能导致一个矿池拥有足够大比例的网络算力，从而对挖矿过程拥有事实上的控制权。

As described by Sompolinsky and Zohar, GHOST solves the first issue of network security loss by including stale blocks in the calculation of which chain is the "longest"; that is to say, not just the parent and further ancestors of a block, but also the stale descendants of the block's ancestor (in Ethereum jargon, "uncles") are added to the calculation of which block has the largest total proof-of-work backing it. To solve the second issue of centralization bias, we go beyond the protocol described by Sompolinsky and Zohar, and also provide block rewards to stales: a stale block receives 87.5% of its base reward, and the nephew that includes the stale block receives the remaining 12.5%. Transaction fees, however, are not awarded to uncles.

正如 Sompolinsky 和 Zohar 所描述的，GHOST 通过在计算哪条链是“最长”链时包含废块，解决了网络安全损失的第一个问题；也就是说，不仅是区块的父区块和更早的祖先区块，该区块祖先的废弃后代区块（在以太坊术语中称为“叔块”）也被添加到计算哪个区块拥有最大总工作量证明 (PoW) 支持的过程中。为了解决中心化偏差的第二个问题，我们超越了 Sompolinsky 和 Zohar 描述的协议，还向废块提供区块奖励：一个废块获得其基础奖励的 87.5%，而包含该废块的侄子区块获得剩余的 12.5%。然而，交易费不会奖励给叔块。

Ethereum implements a simplified version of GHOST which only goes down seven levels. Specifically, it is defined as follows:

使用这种仅允许包含最多 7 代叔块的受限版 GHOST 有两个原因。首先，无限制的 GHOST 会在计算给定区块的哪些叔块有效时引入太多复杂性。其次，以太坊中使用的带有补偿的无限制 GHOST 会消除矿工在主链上而不是在公共攻击者的链上挖矿的动机。

This limited version of GHOST, with uncles includable only up to 7 generations, was used for two reasons. First, unlimited GHOST would include too many complications into the calculation of which uncles for a given block are valid. Second, unlimited GHOST with compensation as used in Ethereum removes the incentive for a miner to mine on the main chain and not the chain of a public attacker.

使用这款 GHOST 的限量版（叔叔最多只能包含 7 代）有两个原因。首先，无限制的 GHOST 会在计算给定块的哪些叔块有效时包含太多的复杂性。其次，以太坊中使用的带有补偿的无限 GHOST 消除了矿工在主链而不是公共攻击者的链上挖矿的动机。

Because every transaction published into the blockchain imposes on the network the cost of needing to download and verify it, there is a need for some regulatory mechanism, typically involving transaction fees, to prevent abuse. The default approach, used in Bitcoin, is to have purely voluntary fees, relying on miners to act as the gatekeepers and set dynamic minimums. This approach has been received very favorably in the Bitcoin community particularly because it is "market-based", allowing supply and demand between miners and transaction senders determine the price. The problem with this line of reasoning is, however, that transaction processing is not a market; although it is intuitively attractive to construe transaction processing as a service that the miner is offering to the sender, in reality every transaction that a miner includes will need to be processed by every node in the network, so the vast majority of the cost of transaction processing is borne by third parties and not the miner that is making the decision of whether or not to include it. Hence, tragedy-of-the-commons problems are very likely to occur.

因为发布到区块链的每笔交易都会给网络带来需要下载和验证它的成本，所以需要某种监管机制（通常涉及交易费）来防止滥用。比特币中使用的默认方法是采用纯自愿的费用，依靠矿工作为守门人并设置动态最小值。这种方法在比特币社区非常受欢迎，特别是因为它是“基于市场的”，允许矿工和交易发送者之间的供需关系决定价格。然而，这种推理的问题在于，交易处理并不是一个市场；尽管将交易处理解释为矿工向发送者提供的服务在直觉上很有吸引力，但实际上，矿工包含的每笔交易都需要由网络中的每个节点进行处理，因此交易处理的绝大部分成本由第三方承担，而不是由决定是否包含该交易的矿工承担。因此，极有可能发生公地悲剧问题。

However, as it turns out this flaw in the market-based mechanism, when given a particular inaccurate simplifying assumption, magically cancels itself out. The argument is as follows. Suppose that:

然而，事实证明，当给定一个特定的不准确的简化假设时，基于市场机制的这个缺陷会神奇地自我抵消。论证如下。假设：

A miner would be willing to process a transaction if the expected reward is greater than the cost. Thus, the expected reward is kR/N since the miner has a 1/N chance of processing the next block, and the processing cost for the miner is simply kC . Hence, miners will include transactions where kR/N > kC , or R > NC . Note that R is the per-operation fee provided by the sender, and is thus a lower bound on the benefit that the sender derives from the transaction, and NC is the cost to the entire network together of processing an operation. Hence, miners have the incentive to include only those transactions for which the total utilitarian benefit exceeds the cost.

如果预期奖励大于成本，矿工将愿意处理一笔交易。因此，预期奖励为 kR/N ，因为矿工有 1/N 的机会处理下一个区块，而矿工的处理成本仅为 kC 。因此，矿工将包含满足 kR/N > kC 或 R > NC 的交易。请注意， R 是发送者提供的每个操作的费用，因此是发送者从交易中获得收益的下限，而 NC 是整个网络共同处理一个操作的成本。因此，矿工有动机仅包含那些总效用收益超过成本的交易。

However, there are several important deviations from those assumptions in reality:

(1) 使矿工倾向于包含更少的交易，而 (2) 增加了 NC ；因此，这两种效应至少部分地相互抵消了。 如何抵消？ （在新标签页中打开） (3) 和 (4) 是主要问题；为了解决它们，我们只需制定一个浮动上限：任何区块的操作数都不能超过长期指数移动平均值的 BLK_LIMIT_FACTOR 倍。具体来说：

(1) provides a tendency for the miner to include fewer transactions, and (2) increases NC ; hence, these two effects at least partially cancel each other out. How? (opens in a new tab) (3) and (4) are the major issue; to solve them we simply institute a floating cap: no block can have more operations than BLK_LIMIT_FACTOR times the long-term exponential moving average. Specifically:

BLK_LIMIT_FACTOR 和 EMA_FACTOR 是常量，目前将设置为 65536 和 1.5，但在进一步分析后可能会更改。

BLK_LIMIT_FACTOR and EMA_FACTOR are constants that will be set to 65536 and 1.5 for the time being, but will likely be changed after further analysis.

在比特币中，还有另一个因素会抑制大区块大小：大区块需要更长的时间来传播，因此成为废块的可能性更高。在以太坊中，消耗大量 Gas 的区块也可能需要更长的时间来传播，这既因为它们在物理上更大，也因为它们需要更长的时间来处理交易状态转换以进行验证。这种延迟抑制因素在比特币中是一个重要的考虑因素，但在以太坊中由于 GHOST 协议的存在，其重要性较低；因此，依赖受监管的区块限制提供了一个更稳定的基准。

There is another factor disincentivizing large block sizes in Bitcoin: blocks that are large will take longer to propagate, and thus have a higher probability of becoming stales. In Ethereum, highly gas-consuming blocks can also take longer to propagate both because they are physically larger and because they take longer to process the transaction state transitions to validate. This delay disincentive is a significant consideration in Bitcoin, but less so in Ethereum because of the GHOST protocol; hence, relying on regulated block limits provides a more stable baseline.

比特币中还有另一个阻碍大区块大小的因素：大区块需要更长的时间来传播，因此变得过时的可能性更高。在以太坊中，高耗气区块也可能需要更长的时间来传播，因为它们物理上更大，并且因为它们需要更长的时间来处理交易状态转换以进行验证。这种延迟抑制因素在比特币中是一个重要的考虑因素，但在以太坊中则较少，因为 GHOST 协议；因此，依靠受监管的区块限制提供了更稳定的基线。

An important note is that the Ethereum virtual machine is Turing-complete; this means that EVM code can encode any computation that can be conceivably carried out, including infinite loops. EVM code allows looping in two ways. First, there is a JUMP instruction that allows the program to jump back to a previous spot in the code, and a JUMPI instruction to do conditional jumping, allowing for statements like while x < 27: x = x * 2 . Second, contracts can call other contracts, potentially allowing for looping through recursion. This naturally leads to a problem: can malicious users essentially shut miners and full nodes down by forcing them to enter into an infinite loop? The issue arises because of a problem in computer science known as the halting problem: there is no way to tell, in the general case, whether or not a given program will ever halt.

需要注意的重要一点是，以太坊虚拟机 (EVM) 是图灵完备的；这意味着 EVM 代码可以编码任何可以想象到的计算，包括无限循环。EVM 代码允许以两种方式进行循环。首先，有一个 JUMP 指令允许程序跳回到代码中先前的位置，以及一个 JUMPI 指令进行条件跳转，从而允许像 while x < 27: x = x * 2 这样的语句。其次，合约可以调用其他合约，从而可能允许通过递归进行循环。这自然引出了一个问题：恶意用户能否通过迫使矿工和全节点进入无限循环来实质上关闭它们？出现这个问题是因为计算机科学中一个被称为停机问题的难题：在一般情况下，无法判断给定的程序是否会停止。

As described in the state transition section, our solution works by requiring a transaction to set a maximum number of computational steps that it is allowed to take, and if execution takes longer computation is reverted but fees are still paid. Messages work in the same way. To show the motivation behind our solution, consider the following examples:

正如状态转换部分所述，我们的解决方案是通过要求交易设置其允许执行的最大计算步数来工作的，如果执行时间过长，计算将被回退，但仍需支付费用。消息的工作方式相同。为了展示我们解决方案背后的动机，请考虑以下示例：

The alternative to Turing-completeness is Turing-incompleteness, where JUMP and JUMPI do not exist and only one copy of each contract is allowed to exist in the call stack at any given time. With this system, the fee system described and the uncertainties around the effectiveness of our solution might not be necessary, as the cost of executing a contract would be bounded above by its size. Additionally, Turing-incompleteness is not even that big a limitation; out of all the contract examples we have conceived internally, so far only one required a loop, and even that loop could be removed by making 26 repetitions of a one-line piece of code. Given the serious implications of Turing-completeness, and the limited benefit, why not simply have a Turing-incomplete language? In reality, however, Turing-incompleteness is far from a neat solution to the problem. To see why, consider the following contracts:

图灵完备性的替代方案是图灵不完备性，其中不存在 JUMP 和 JUMPI ，并且在任何给定时间，调用栈中只允许存在每个合约的一个副本。在这种系统下，所描述的费用系统以及围绕我们解决方案有效性的不确定性可能就不必要了，因为执行合约的成本将受其大小的上限限制。此外，图灵不完备性甚至不是一个很大的限制；在我们内部构思的所有合约示例中，到目前为止只有一个需要循环，甚至那个循环也可以通过将一行代码重复 26 次来消除。鉴于图灵完备性的严重影响以及有限的好处，为什么不干脆使用一种图灵不完备的语言呢？然而，在现实中，图灵不完备性远非解决该问题的完美方案。要了解原因，请考虑以下合约：

Now, send a transaction to A. Thus, in 51 transactions, we have a contract that takes up 2 50 computational steps. Miners could try to detect such logic bombs ahead of time by maintaining a value alongside each contract specifying the maximum number of computational steps that it can take, and calculating this for contracts calling other contracts recursively, but that would require miners to forbid contracts that create other contracts (since the creation and execution of all 26 contracts above could easily be rolled into a single contract). Another problematic point is that the address field of a message is a variable, so in general it may not even be possible to tell which other contracts a given contract will call ahead of time. Hence, all in all, we have a surprising conclusion: Turing-completeness is surprisingly easy to manage, and the lack of Turing-completeness is equally surprisingly difficult to manage unless the exact same controls are in place - but in that case why not just let the protocol be Turing-complete?

现在，向 A 发送一笔交易。因此，在 51 笔交易中，我们拥有了一个占用 2 50 个计算步骤的合约。矿工可以尝试提前检测此类逻辑炸弹，方法是在每个合约旁边维护一个值，指定它可以采取的最大计算步数，并为递归调用其他合约的合约计算此值，但这将要求矿工禁止创建其他合约的合约（因为上述所有 26 个合约的创建和执行可以很容易地合并到一个合约中）。另一个有问题的地方是，消息的地址字段是一个变量，因此通常甚至可能无法提前判断给定合约将调用哪些其他合约。因此，总而言之，我们得出了一个令人惊讶的结论：图灵完备性出人意料地易于管理，而缺乏图灵完备性同样出人意料地难以管理，除非实施完全相同的控制措施——但在那种情况下，为什么不直接让协议成为图灵完备的呢？

The Ethereum network includes its own built-in currency, ether, which serves the dual purpose of providing a primary liquidity layer to allow for efficient exchange between various types of digital assets and, more importantly, of providing a mechanism for paying transaction fees. For convenience and to avoid future argument (see the current mBTC/uBTC/satoshi debate in Bitcoin), the denominations will be pre-labelled:

以太坊网络包含其内置货币——以太币，它具有双重目的：提供主要的流动性层以允许在各种类型的数字资产之间进行高效兑换，更重要的是，提供一种支付交易费的机制。为了方便起见并避免未来的争论（参见目前比特币中关于 mBTC/uBTC/satoshi 的争论），面额将被预先标记：

This should be taken as an expanded version of the concept of "dollars" and "cents" or "BTC" and "satoshi". In the near future, we expect "ether" to be used for ordinary transactions, "finney" for microtransactions and "szabo" and "wei" for technical discussions around fees and protocol implementation; the remaining denominations may become useful later and should not be included in clients at this point.

这应该被视为“美元”和“美分”或“BTC”和“satoshi”概念的扩展版本。在不久的将来，我们预计“以太币”将用于普通交易，“芬尼”用于微交易，而“萨博”和“Wei”用于围绕费用和协议实现的技术讨论；其余的面额稍后可能会变得有用，目前不应包含在客户端中。

Despite the linear currency issuance, just like with Bitcoin over time the supply growth rate nevertheless tends to zero.

上述模型中的两个主要选择是 (1) 捐赠池的存在和规模，以及 (2) 存在永久增长的线性供应，而不是像比特币那样的上限供应。捐赠池的理由如下。如果捐赠池不存在，并且线性发行减少到 0.217 倍以提供相同的通货膨胀率，那么以太币的总量将减少 16.5%，因此每个单位的价值将增加 19.8%。因此，在均衡状态下，发售中将多购买 19.8% 的以太币，因此每个单位的价值将再次与以前完全一样。那么该组织也将拥有 1.198 倍的 BTC，这可以被认为分为两部分：原始的 BTC 和额外的 0.198 倍。因此，这种情况与捐赠_完全等效_，但有一个重要的区别：该组织纯粹持有 BTC，因此没有动机去支持以太币单位的价值。

The two main choices in the above model are (1) the existence and size of an endowment pool, and (2) the existence of a permanently growing linear supply, as opposed to a capped supply as in Bitcoin. The justification of the endowment pool is as follows. If the endowment pool did not exist, and the linear issuance reduced to 0.217x to provide the same inflation rate, then the total quantity of ether would be 16.5% less and so each unit would be 19.8% more valuable. Hence, in the equilibrium 19.8% more ether would be purchased in the sale, so each unit would once again be exactly as valuable as before. The organization would also then have 1.198x as much BTC, which can be considered to be split into two slices: the original BTC, and the additional 0.198x. Hence, this situation is exactly equivalent to the endowment, but with one important difference: the organization holds purely BTC, and so is not incentivized to support the value of the ether unit.

永久的线性供应增长模型降低了某些人认为的比特币中财富过度集中的风险，并为生活在现在和未来时代的人们提供了获取货币单位的公平机会，同时保留了获取和持有以太币的强烈动机，因为作为百分比的“供应增长率”随着时间的推移仍然趋于零。我们还推论，由于随着时间的推移，代币总是会因为粗心、死亡等原因而丢失，并且代币丢失可以建模为每年总供应量的百分比，因此流通中的总货币供应量实际上最终将稳定在一个等于年发行量除以丢失率的值（例如，在 1% 的丢失率下，一旦供应量达到 26X，那么每年将挖出 0.26X 并丢失 0.26X，从而形成均衡）。

The permanent linear supply growth model reduces the risk of what some see as excessive wealth concentration in Bitcoin, and gives individuals living in present and future eras a fair chance to acquire currency units, while at the same time retaining a strong incentive to obtain and hold ether because the "supply growth rate" as a percentage still tends to zero over time. We also theorize that because coins are always lost over time due to carelessness, death, etc, and coin loss can be modeled as a percentage of the total supply per year, that the total currency supply in circulation will in fact eventually stabilize at a value equal to the annual issuance divided by the loss rate (e.g., at a loss rate of 1%, once the supply reaches 26X then 0.26X will be mined and 0.26X lost every year, creating an equilibrium).

请注意，在未来，以太坊很可能会为了安全性而切换到权益证明 (PoS) 模型，从而将发行需求降低到每年 0 到 0.05X 之间。如果以太坊组织失去资金或因任何其他原因消失，我们留下了一份开放的“社会契约”：任何人都有权创建以太坊的未来候选版本，唯一的条件是以太币的数量最多必须等于 60102216 * (1.198 + 0.26 * n) ，其中 n 是创世区块之后的年数。创建者可以自由地众筹或以其他方式分配 PoS 驱动的供应扩张与最大允许供应扩张之间差额的部分或全部，以支付开发费用。不符合社会契约的候选升级可能会被合理地分叉为合规版本。

Note that in the future, it is likely that Ethereum will switch to a proof-of-stake model for security, reducing the issuance requirement to somewhere between zero and 0.05X per year. In the event that the Ethereum organization loses funding or for any other reason disappears, we leave open a "social contract": anyone has the right to create a future candidate version of Ethereum, with the only condition being that the quantity of ether must be at most equal to 60102216 * (1.198 + 0.26 * n) where n is the number of years after the genesis block. Creators are free to crowd-sell or otherwise assign some or all of the difference between the PoS-driven supply expansion and the maximum allowable supply expansion to pay for development. Candidate upgrades that do not comply with the social contract may justifiably be forked into compliant versions.

请注意，未来以太坊很可能会转向权益证明模型以确保安全，将每年的发行需求减少到零到 0.05 倍之间。如果以太坊组织失去资金或因任何其他原因消失，我们将保留一个“社会契约”：任何人都有权创建以太坊的未来候选版本，唯一的条件是以太坊的数量必须最多等于 60102216 * (1.198 + 0.26 * n)，其中 n 是创世块之后的年数。创作者可以自由地众售或以其他方式分配 PoS 驱动的供应扩张和最大允许供应扩张之间的部分或全部差额来支付开发费用。不符合社会契约的候选升级可能会合理地被分叉为合规版本。

The Bitcoin mining algorithm works by having miners compute SHA256 on slightly modified versions of the block header millions of times over and over again, until eventually one node comes up with a version whose hash is less than the target (currently around 2 192 ). However, this mining algorithm is vulnerable to two forms of centralization. First, the mining ecosystem has come to be dominated by ASICs (application-specific integrated circuits), computer chips designed for, and therefore thousands of times more efficient at, the specific task of Bitcoin mining. This means that Bitcoin mining is no longer a highly decentralized and egalitarian pursuit, requiring millions of dollars of capital to effectively participate in. Second, most Bitcoin miners do not actually perform block validation locally; instead, they rely on a centralized mining pool to provide the block headers. This problem is arguably worse: as of the time of this writing, the top three mining pools indirectly control roughly 50% of processing power in the Bitcoin network, although this is mitigated by the fact that miners can switch to other mining pools if a pool or coalition attempts a 51% attack.

比特币挖矿算法的工作原理是让矿工对稍微修改过的区块头版本一遍又一遍地计算数百万次 SHA256，直到最终一个节点得出一个哈希小于目标值（目前约为 2 192 ）的版本。然而，这种挖矿算法容易受到两种形式的中心化影响。首先，挖矿生态系统已经由 ASIC（专用集成电路）主导，这是一种专为比特币挖矿特定任务设计的计算机芯片，因此效率高出数千倍。这意味着比特币挖矿不再是一项高度去中心化的和平等主义的追求，而是需要数百万美元的资本才能有效参与。其次，大多数比特币矿工实际上并不在本地执行区块验证；相反，他们依赖中心化的矿池来提供区块头。这个问题可以说更糟：在撰写本文时，排名前三的矿池间接控制了比特币网络中大约 50% 的处理能力，尽管由于如果一个矿池或联盟尝试进行 51%攻击，矿工可以切换到其他矿池，这一事实在一定程度上缓解了这个问题。

The current intent at Ethereum is to use a mining algorithm where miners are required to fetch random data from the state, compute some randomly selected transactions from the last N blocks in the blockchain, and return the hash of the result. This has two important benefits. First, Ethereum contracts can include any kind of computation, so an Ethereum ASIC would essentially be an ASIC for general computation - i.e., a better CPU. Second, mining requires access to the entire blockchain, forcing miners to store the entire blockchain and at least be capable of verifying every transaction. This removes the need for centralized mining pools; although mining pools can still serve the legitimate role of evening out the randomness of reward distribution, this function can be served equally well by peer-to-peer pools with no central control.

以太坊目前的意图是使用一种挖矿算法，要求矿工从状态中获取随机数据，计算区块链中最后 N 个区块中随机选择的一些交易，并返回结果的哈希。这有两个重要的好处。首先，以太坊合约可以包含任何类型的计算，因此以太坊 ASIC 本质上将是用于通用计算的 ASIC——即更好的 CPU。其次，挖矿需要访问整个区块链，迫使矿工存储整个区块链，并且至少能够验证每笔交易。这消除了对中心化矿池的需求；尽管矿池仍然可以发挥平衡奖励分配随机性的合法作用，但没有中央控制的点对点矿池同样可以很好地发挥这一功能。

This model is untested, and there may be difficulties along the way in avoiding certain clever optimizations when using contract execution as a mining algorithm. However, one notably interesting feature of this algorithm is that it allows anyone to "poison the well", by introducing a large number of contracts into the blockchain specifically designed to stymie certain ASICs. The economic incentives exist for ASIC manufacturers to use such a trick to attack each other. Thus, the solution that we are developing is ultimately an adaptive economic human solution rather than purely a technical one.

这种模型尚未经过测试，在使用合约执行作为挖矿算法时，在避免某些巧妙的优化方面可能会遇到困难。然而，该算法一个特别有趣的特征是，它允许任何人“在井里投毒”，通过在区块链中引入大量专门设计用于阻碍某些 ASIC 的合约。ASIC 制造商存在使用这种技巧互相攻击的经济动机。因此，我们正在开发的解决方案最终是一种适应性的经济人类解决方案，而不仅仅是纯粹的技术解决方案。

One common concern about Ethereum is the issue of scalability. Like Bitcoin, Ethereum suffers from the flaw that every transaction needs to be processed by every node in the network. With Bitcoin, the size of the current blockchain rests at about 15 GB, growing by about 1 MB per hour. If the Bitcoin network were to process Visa's 2000 transactions per second, it would grow by 1 MB per three seconds (1 GB per hour, 8 TB per year). Ethereum is likely to suffer a similar growth pattern, worsened by the fact that there will be many applications on top of the Ethereum blockchain instead of just a currency as is the case with Bitcoin, but ameliorated by the fact that Ethereum full nodes need to store just the state instead of the entire blockchain history.

关于以太坊的一个普遍担忧是可扩展性问题。像比特币一样，以太坊也存在每笔交易都需要由网络中的每个节点处理的缺陷。对于比特币，当前区块链的大小约为 15 GB，以每小时约 1 MB 的速度增长。如果比特币网络要处理 Visa 每秒 2000 笔的交易，它将以每三秒 1 MB 的速度增长（每小时 1 GB，每年 8 TB）。以太坊可能会经历类似的增长模式，更糟糕的是，以太坊区块链之上将有许多应用程序，而不仅仅是像比特币那样的货币，但由于以太坊全节点只需要存储状态而不是整个区块链历史，这一点得到了改善。

The problem with such a large blockchain size is centralization risk. If the blockchain size increases to, say, 100 TB, then the likely scenario would be that only a very small number of large businesses would run full nodes, with all regular users using light SPV nodes. In such a situation, there arises the potential concern that the full nodes could band together and all agree to cheat in some profitable fashion (e.g., change the block reward, give themselves BTC). Light nodes would have no way of detecting this immediately. Of course, at least one honest full node would likely exist, and after a few hours information about the fraud would trickle out through channels like Reddit, but at that point it would be too late: it would be up to the ordinary users to organize an effort to blacklist the given blocks, a massive and likely infeasible coordination problem on a similar scale as that of pulling off a successful 51% attack. In the case of Bitcoin, this is currently a problem, but there exists a blockchain modification suggested by Peter Todd (opens in a new tab) which will alleviate this issue.

如此庞大的区块链大小带来的问题是中心化风险。如果区块链大小增加到（比如说）100 TB，那么可能的情况是只有极少数大型企业会运行全节点，而所有普通用户都使用轻量级 SPV 节点。在这种情况下，就会产生潜在的担忧：全节点可能会联合起来，并一致同意以某种有利可图的方式作弊（例如，更改区块奖励，给自己发放 BTC）。轻节点将无法立即检测到这一点。当然，至少可能存在一个诚实的全节点，几个小时后，关于欺诈的信息会通过 Reddit 等渠道泄露出来，但到那时就太晚了：这将取决于普通用户组织起来将给定的区块列入黑名单，这是一个与成功发起 51%攻击规模相似的巨大且可能不可行的协调问题。在比特币的情况下，这目前是一个问题，但存在一个由 Peter Todd 建议的 （在新标签页中打开） 区块链修改方案，它将缓解这个问题。

In the near term, Ethereum will use two additional strategies to cope with this problem. First, because of the blockchain-based mining algorithms, at least every miner will be forced to be a full node, creating a lower bound on the number of full nodes. Second and more importantly, however, we will include an intermediate state tree root in the blockchain after processing each transaction. Even if block validation is centralized, as long as one honest verifying node exists, the centralization problem can be circumvented via a verification protocol. If a miner publishes an invalid block, that block must either be badly formatted, or the state S[n] is incorrect. Since S[0] is known to be correct, there must be some first state S[i] that is incorrect where S[i-1] is correct. The verifying node would provide the index i , along with a "proof of invalidity" consisting of the subset of Patricia tree nodes needing to process APPLY(S[i-1],TX[i]) -> S[i] . Nodes would be able to use those nodes to run that part of the computation, and see that the S[i] generated does not match the S[i] provided.

在短期内，以太坊将使用两种额外的策略来应对这个问题。首先，由于基于区块链的挖矿算法，至少每个矿工都将被迫成为全节点，从而为全节点的数量设定了下限。然而，其次也是更重要的一点，我们将在处理每笔交易后在区块链中包含一个中间状态树根。即使区块验证是中心化的，只要存在一个诚实的验证节点，就可以通过验证协议规避中心化问题。如果矿工发布了一个无效区块，那么该区块要么格式错误，要么状态 S[n] 不正确。由于已知 S[0] 是正确的，因此必然存在某个第一个不正确的状态 S[i] ，而 S[i-1] 是正确的。验证节点将提供索引 i ，以及由需要处理 APPLY(S[i-1],TX[i]) -> S[i] 的帕特里夏树节点子集组成的“无效性证明”。节点将能够使用这些节点来运行该部分计算，并发现生成的 S[i] 与提供的 S[i] 不匹配。

Another, more sophisticated, attack would involve the malicious miners publishing incomplete blocks, so the full information does not even exist to determine whether or not blocks are valid. The solution to this is a challenge-response protocol: verification nodes issue "challenges" in the form of target transaction indices, and upon receiving a node a light node treats the block as untrusted until another node, whether the miner or another verifier, provides a subset of Patricia nodes as a proof of validity.

另一种更复杂的攻击涉及恶意矿工发布不完整的区块，因此甚至不存在完整的信息来确定区块是否有效。对此的解决方案是质询-响应协议：验证节点以目标交易索引的形式发出“质询”，轻节点在收到节点后将该区块视为不可信，直到另一个节点（无论是矿工还是其他验证者）提供帕特里夏节点的子集作为有效性证明。

The Ethereum protocol was originally conceived as an upgraded version of a cryptocurrency, providing advanced features such as on-blockchain escrow, withdrawal limits, financial contracts, gambling markets and the like via a highly generalized programming language. The Ethereum protocol would not "support" any of the applications directly, but the existence of a Turing-complete programming language means that arbitrary contracts can theoretically be created for any transaction type or application. What is more interesting about Ethereum, however, is that the Ethereum protocol moves far beyond just currency. Protocols around decentralized file storage, decentralized computation and decentralized prediction markets, among dozens of other such concepts, have the potential to substantially increase the efficiency of the computational industry, and provide a massive boost to other peer-to-peer protocols by adding for the first time an economic layer. Finally, there is also a substantial array of applications that have nothing to do with money at all.

以太坊协议最初被构想为一种升级版的加密货币，通过一种高度通用的编程语言提供链上托管、提款限制、金融合约、博彩市场等高级功能。以太坊协议不会直接“支持”任何应用，但图灵完备编程语言的存在意味着理论上可以为任何交易类型或应用创建任意合约。然而，以太坊更有趣的地方在于，以太坊协议远远超越了单纯的货币范畴。围绕去中心化文件存储、去中心化计算和去中心化预测市场等数十种概念的协议，有潜力大幅提高计算行业的效率，并通过首次添加经济层，为其他点对点协议提供巨大的推动力。最后，还有大量与金钱完全无关的应用。

The concept of an arbitrary state transition function as implemented by the Ethereum protocol provides for a platform with unique potential; rather than being a closed-ended, single-purpose protocol intended for a specific array of applications in data storage, gambling or finance, Ethereum is open-ended by design, and we believe that it is extremely well-suited to serving as a foundational layer for a very large number of both financial and non-financial protocols in the years to come.

以太坊协议所实现的任意状态转换函数的概念，提供了一个具有独特潜力的平台；以太坊在设计上是开放式的，而不是一个旨在用于数据存储、博彩或金融领域特定应用的封闭式、单一用途的协议。我们相信，在未来的岁月里，它非常适合作为大量金融和非金融协议的基础层。

For history of the whitepaper, see this wiki (opens in a new tab) .

与许多社区驱动的开源软件项目一样，以太坊自最初成立以来也在不断发展。要了解以太坊的最新发展以及协议是如何更改的，我们推荐阅读 本指南 。

Ethereum, like many community-driven, open-source software projects, has evolved since its initial inception. To learn about the latest developments of Ethereum, and how changes to the protocol are made, we recommend this guide .

与许多社区驱动的开源软件项目一样，以太坊自最初诞生以来一直在不断发展。要了解以太坊的最新发展以及协议如何进行更改，我们推荐本指南。