text:
If everyone decided to switch to Bitcoin tomorrow, how much would a Bitcoin be worth?
Hypothetically, if everyone decided to trade in all their money and get Bitcoins for them tomorrow then how much would a single Bitcoin be worth?
My dodgy calculation makes it out to be $3,750,000 per BTC since there is apparently $60 trillion worth of fiat money and there are almost 16 million Bitcoins in circulation however I'm sure the calculation isn't that easy :p

I think besides the value of Bitcoin exploding, it would make fiat money worthless at the same time. Thus it would become kinda meaningless to still express the value of one bitcoin in terms of fiat. Compare this: if suddenly all countries abandon the U.S. Dollar (including the U.S.) and switch to Polish Złotys, how much would one Złoty be worth in USD?

@RocketNuts I knew someone would say this -.- I am only using USD to represent the buying power of a Bitcoin. "If everyone swapped to Bitcoin tomorrow then how much would a BTC be worth tomorrow in USD today"

This question is hard to answer because you are measuring the value of a bitcoin with a unit that is also not fixed (dollars).  Think of this as if you are trying to measure a length of string with a ruler.  Your question would then be phrased "if my string suddenly grew in length and my ruler shrank, how many inches on my ruler would my string measure?"  Perhaps a different unit can be used, like a week's worth of groceries for a family of 4.  It's not precise, but will give you a better result than using dollars.

@Jestin I phrased my question in a way that implied that I was taking the buying power of a USD today and comparing it to the buying power of a BTC tomorrow. If I can buy 10 apples for $1 today but can buy 1,000,000 apples for 1 BTC tomorrow then the 2 can be compared, 1 BTC tomorrow would be worth $100,000 today because I can buy the same amount with them in theory. The price of the USD is fixed right NOW but not over time.

If everybody switches to Bitcoin, one single bitcoin would be worth: a whole truckload of money.

I think the problem comes from thinking that there is an actual value across currency systems. Because the systems are inherently different, and because people value things differently, it's not really a fair or possible calculation. If everyone switched to BTC, 1 BTC would be worth 1 BTC.

@Someone Look at the Brazilian conversion to the real, their currency today. That might help you think about you question differently.

What complicates your calculation is the liquidity aspect.
Although there is about 16 million mined bitcoins, the number of bitcoins available for trade is far less than that.
What is interesting to observe is that the fact there is a ~7bn market on bitcoin right now doesn't necessarily mean the sum of the money spent by the bitcoin holders is even near 7bn. Some people bought if for pennies, some for a couple dollars, some mined it. It just means that the holders of bitcoins are not willing to give them away for the price being offered by buyers right now.
The price is determined by supply and demand market forces, and the supply would respond to the increase in price. I maybe would sell one of mine if the price reached $100k per unit.
Other factor is that fiat money may be created out of thin air, so it has sort of an infinite supply. If an unrestricted government decides to purchase bitcoin, this would strongly push the price up.
In the end of the day, what you can try to grasp is what would be the minimum price it would reach, but estimating the actual price would depend on far too many variables.
Note that non-Bitcoin currencies have the same or extremely similar price mechanism. Dollars, specifically, can lose all their value if people stopped liking them. In a way, cryptocurrency is a huge threat to "free floating" currencies like the US Dollar.


text:
Why do leading ASICs manufacturers sell their chips?
I understand that some people have access to cheaper electricity than others. However why not just open mining facilities in the parts of the world offering the lowest cost structure? If that is not possible, then a joint miner with those miners would seem more profitable than selling the most profitable newly invented ASICs chips to the general public.
In some situations I know people will buy older ASICs miners that are no longer profitable for various reasons including a desire to help the network or speculating on future bitcoin price increases retroactively making the mining profitable. That is not my area of focus. I am more interested in why the newest most profitable ASICs chips are being sold.

I think the simple answer is that a company doesn't have to be a "Bitcoin believer" in order to manufacture Bitcoin mining hardware.  The companies that produce ASIC chips also produce other products for other industries.  They are perfectly profitable just selling their chips to mining equipment manufactures, and probably don't feel the need to enter the world of speculation on a young, digital currency.
At their core, these companies are silicon chip factories, and there is lots of demand for custom silicon chips in the market.  There's no need for them to change up their business model and become Bitcoin mining facilities.
Don't forget that during the California Gold Rush, the wealthiest man in town was the guy selling shovels :)

Not only that. Maintaining a data centre is a hard problem. It's like saying "surely it's more profitable for Bloomberg to do all the trading themselves instead of providing the service they do". There are a lot of complexities that running a mining operation entails.

Some companies have done exactly that, and have come under fire for it. Butterfly Labs was famously outed by US authorities for running customer-purchased hardware to generate profit for themselves, only releasing to the customer after the purchased-hardware was past its peak profit-generating potential.
KnC, another mining hardware maker, announced in 2014 that they would only produce hardware for their own purposes, following numerous customer complaints about their business practices.
BitMain, by far the most successful producer of ASIC hardware, has chosen to sell their products directly to customers and have profited immensely from doing so. Selling directly has a few advantages, most notably that the money is received by BitMain instantly. This capital can now be immediately redirected to developing ever-faster bitcoin hardware, rather than waiting for the hardware to pay for itself. This cycle has allowed BitMain to take a consistent lead in ASIC technology, both in price per kW and price per hash, and reduced the company's exposure to fluctuations in bitcoin price.
With that said, BitMain has no incentive to completely forgo using their hardware for their own gain. It is possible that they mine with in-stock units waiting to be shipped or sold. They also have a cloud-mining service which allows customers to purchase hardware that is operated by BitMain. Any excess capacity from their cloud mining operation could be used to mine for BitMain directly. The difference between them and KnC is they have not made it a cornerstone of their business model.
TLDR: companies that have made profit off their own hardware have done so after using customer pre-orders to fund their R&D, many now face legal repercussions for this practice. BitMain has created a stable and successful mining company choosing to sell directly to customers and reinvesting in new R&D, allowing their technology to surpass that of their competitors. They probably still mine for themselves, but it isn't the core of their business

source: Stack Exchange

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/3.0/

sort: votes


text:
How does the lightning network solve double spending?
This is probably obvious to some of you on here, but I'm a beginner. I recently read the lightning network whitepaper and its very unclear to me how the lightning network addresses the double spend problem without broadcasting transactions to the public blockchain. Can someone explain this to me?
To use the example in the white paper, if Alice and Bob are sending BTC back and forth to each other through a secure payments channel, I agree this provides Byzantine fault tolerance in a two-person economy of just Alice and Bob. Moreover, I agree this solves for scaling issues currently present in Bitcoin. My understanding here is that the net result of Alice and Bob's transactions are posted to the network at some later date, which is what solves the bitcoin scaling issue. That said, if the transactions of Alice and Bob are not immediately broadcasted to the network, then why can't either of Alice and Bob double spend with another party, Cindy? Provided that either of Alice and Bob transact with Cindy before the wallet states of Alice and Bob are broadcast via the blockchain, then there is no way for Cindy's wallet to be "aware" of whether Alice / Bob's wallet state has sufficient bitcoin for a transaction with Cindy. For this reason, I don't understand how double spending is avoided and why Cindy can be sure that Alice / Bob aren't cheating Cindy in a transaction.

To open a channel you have to lock funds in a multisig address. This is with an on-chain transaction. So those funds can't be used to pay Cindy on-chain. They can't be used to pay Cindy on LN either without both Alice and Bob's approval since it's a multisig address that requires both Alice's and Bob's signature.

all_licenses: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/3.0/


text:
What percentage of altcoins are based on Bitcoin?
What percentage of altcoins share the same codebase as Bitcoin?

Map of Coins is a great resource for this.
As of May 2016 they are tracking a total of 710 cryptocurrencies. Of those, 667 are based on Bitcoin's code, which is 94%!


text:
Configuration file is not found for bitcoind
I'm running bitcoind in ubuntu. When I pass password as argument, it shows no configuration file found. Somebody please help

You can see it here,

cd  $HOME/.bitcoin/

That's correct, however it's important to know that the configuration file is not created by default, so it is not particularly astonishing if you don't find it.

yeah, that's true


text:
Schnorr Fiat Shamir Transformation
In the Schnorr identity protocol, we can transform the interactive ZKP into a non-interactive one by replacing the role of the verifier (i.e. providing a random challenge value) with a hash function that uses the prover's encrypted nonce as input.
s = r + e*x

where:
e = H(r*G)

Validation works by ensuring:
sG== R + e*P

where:
R = r*G

Assume that in this non-interactive model, the prover picks an r value in advance, and runs R through the hash function to determine its  corresponding e digest. Assume the prover is malicious, and is looking to trick a verifier into accepting a Schnorr signature without knowing the private key x. If the prover resuses this e value when constructing the signature, while also selecting an arbitrary s value,they could back out sG = rG-eP. Since the prover knows R, e and P, it seems as if they could convince a verifier that the signature is valid, without needing knowledge of the private key. What prevents this from happening?

Two comments: in a Schnorr signature (rather than just an identification attempt), a message is also included in the hash (so e = H(rG||msg)). Second, the uppercase letters in your protocol represent group elements in which the discrete logarithm problem is hard, so you can't solve sG = rG-eP for s (as that would require "dividing" by G, which is computationally infeasible).

So basically it would be impossible to find an s value that balances, b/c sG=rG-eP --->  sG=rG-e*xG. Dividing out G leaves us with s=r+e*x which requires knowledge of x?

Exactly. You can write it as s = r - e*(P/G), but the P/G part can't be computed.

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/


text:
Batching transactions - calculating batch transaction fee
I want to use transaction batching to make BTC payments to multiple recipients.
In order to optimize transaction amount \ size, lets I'm making equal transfers of x BTC to N recipients, and that F(x, N) is the function representing the transaction fees.
How would this function look like?
How can I calculate it in any given time, to optimize transaction fees?

With or without segwit?

@pebwindkraft both? :)

maybe this: https://bitcoin.stackexchange.com/questions/7537/calculator-for-estimated-tx-fees?rq=1 or also this: https://bitcoin.stackexchange.com/questions/22870/createrawtransaction-and-sendrawtransaction-how-to-specify-transaction-fee?rq=1 this is all without segwit. Segwit changes things, generally it goes cheaper...

The function would not work because the transaction fee is based upon the size of the transaction in bytes (well really its weight, which is based on the bytes). While the number of outputs is a factor in this, the other factor is the number of inputs, and what type of inputs they are. So given just the outputs (the value of the outputs doesn't even matter), you still cannot determine how much in transaction fees that you will need to pay. Thus your function F(x, N) would not work.

Can you please clarify what additional information is required?

The number of inputs and the type of those inputs. If you want to optimize the transaction fee, then your function needs to also be selecting those inputs, and it will get very complicated if you want to do that.

Going to google what input types are out there :)


text:
Help With Gitian-Builder - Failed to load "rcfile"
I' having hard time building the Bitcoin using gitian-builder. I'm getting closer but i'm stuck at this error and I dont know what it really means or why is it even there. I'm using the gitian-build.sh.. I posted a screen shot...
It says Failed to Load rcfile... How do I fix this issue?
Thanks!
]2

This question is a bit old now but the solution(s) are still valid. I have found that the most difficult part of getting gitian builder working is the setup of LXC. Apparently it is still valid to use the KVM method but I have never done this and from what I understand, KVM is the old method. Be sure to carefully read over the entire build instructions at https://github.com/bitcoin-core/docs/blob/master/gitian-building.md and any pages it links to for a full understanding of how this all can be done.
Assuming that you have LXC setup correctly, there are also a  couple problems with your build cmd. Here is what you were using:
sudo ./gitian-build.sh --build achow101

and if using the gitian-build.sh script, you should be using this syntax instead:
./gitian-build.sh --detach-sign --no-commit -b achow101 0.17.1

Root access is not required or desired for the build procedure so remove the sudo keyword.
achow101 is the github username you wish to create sigs for. if you aren't planning to upload or do anything with your sigs then it doesn't matter what you enter here as long as it has a value.
0.17.1 is the version tag that you would like to build. You can use gitian-builder to build wallets for older versions of bitcoin so you need to specify which version you want. 0.17.1 happens to be the most current bitcoin wallet tag version as of this writing. You can find the tag versions here: https://github.com/bitcoin/bitcoin/tags. You must always be sure to omit the v prefix since for some silly reason the script wants to automatically add the prefix itself, so if you tried to run ./gitian-build.sh --detach-sign --no-commit -b achow101 v0.17.1 it would error out on trying to download the tag vv0.17.1.

The other big thing to note here is that the gitian-build.sh bash script was replaced by a python script gitian-build.py right around the same time that you posted this question. Therefore, if you are using one of the newer builds of bitcoin core with the new python script you will have to change the build cmd ever so slightly:
./gitian-build.py --detach-sign --no-commit -b achow101 0.17.1

Final note: I don't have a proper list of error msgs, but in my experience there are 2-3 errors that you can intermittently get during gitian building that will stop the build process even when everything is correct. This can be very frustrating when you are trying to learn to build wallets and I have not yet found the reason for this. The workaround is easy, just run the exact same cmd again and 99% of the time it works fine the 2nd time even though it gave an error before.

all_licenses: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/


text:
Need Help with Gitian-Builder - Missing Signer Error
I'm having a hard time finishing this project. I'm very frustrated and I really need your help.
I'm trying to create the QT wallet for Windows & Linux.
I have already cloned a masternode and I'm stuck dealing with this error.
I have already installed the KVM virtual machine and the LXC.
So when I tried running the gitian-build.sh, I get the missing signer error. I have read that I dont need the signer unless is wrong info.
How do I fix this problem.
Thank You.

When you run the gitian-build.sh script, you need to specify additional arguments for it to build and produce gitian signatures. You need to specify the version (or commit or branch) that you want to build. You must also specify an identifier for the GPG key that you want to use to sign the gitian output. That identifier is the signer.
For example, for me, I use the command
./gitian-build.sh -B --kvm 0.16.1 achow101

to build Linux, Windows, and MacOS binaries for 0.16.1 using kvm and signing the gitian output with the key achow101.


text:
Largest Bitcoin transaction fee ever paid?
What was the largest transaction fee ever paid? Assuming that payment was an accident was the sender able to contact the miner who mined that block and negotiate a full or partial refund?

This transaction (2016-04-26) has even higher fees (291.2409 BTC).
This plot shows transaction fees higher than 1000USD from the past 3 years. From the plot, the April 2016 transaction seems to be the one paying the highest fee.
BitClub offered to refund the transaction, but the whole episode was a bit controversial.

I think this one: http://btc.blockr.io/tx/info/4ed20e0768124bc67dc684d57941be1482ccdaa45dadb64be12afba8c8554537 - 200 BTC fee!
It was an accidental fee scooped up by ASICMiner, but they refunded the guy.

There are honest people in the world. Happy to hear about that huge refund!


text:
What % of bitcoin transactions involve addresses of known charitable organizations
Blockchain analysis can come a lot way. Are we at the point where we can identify what percentage of transactions related to certain industries?
What percentage of transactions involve a receiving address than can be tied to a charitable organization with blockchain analysis?
If that question can be answered please also list any bitcoin transaction size data that is available.

Are we at the point where we can identify what percentage of transactions related to certain industries?

Not really! The percentage of addresses that are tied to known organizations is quite small. You also have to consider that many transfers occur without any change in ownership, that is, a person sends bitcoin from one address they control to another.
Consider the mining industry: we know the address of every mining pool that finds blocks, because their address becomes known at the time of the block being minted. Even then, if the coins are transferred to other addresses within the mining organization, we lose clarity on whether these coins are still being held 'within' that industry, and are left to IP analysis, which is far from conclusive in many situations.
If you made a list of known addresses tied to charitable organizations, you could easily come up with a percentage of total transactions associated with those organizations, but it wouldn't be that meaningful of a statistic.

authors: Диана Киреенко


text:
Why do most alt coin developers choose to remain anonymous?
Is having a known public identity not helpful in building reputation for a project? Are the privacy and security concessions associated with revealing your identity not worth the perceived benefit?

Which coins? The major ones have clear creators Litecoin = Charlie Lee, Ethereum = Vitalik Buterin, etc.

Good point. There are hundreds (or thousands?) of alt coins. Your comment correctly points most of the largest (by market cap) do have some known developers. However the majority (of much smaller projects) of developers still remain anonymous. It will be interesting to see if this changes.

I honestly don't know of any coins that have an anonymous creator other than bitcoin. You can at least look up the bitcointalk username from the altcoin forum of most altcoins.

Well, it depends what you mean by "anonymous". Satoshi has an account on bitcointalk too :) To the original question, there are two main reasons: one is because a lot of those coins are scams, and many of them started by the same few people. Second, is that people who like privacy are attracted by cryptocurrencies, and their choice to remain anonymous follows readily. How to tell between the two is left as an exercise for the reader :)


text:
What is the age of the oldest known Bitcoin core developer?
I am trying to compile some demographic data on who has contributed to Bitcoin so far and track how the demographics are changing over time.
Since GitHut does not show me demographic data I have attempted to use Google with limited success.
What is the age of the oldest known Bitcoin person to submit a pull request to Bitcoin core? I asked the same question about the youngest person the other day and the answers were helpful to me.
Eventually I want to try to compare the mean and median ages (and sex) of users and developers and track the changing demographic trends of each group.

This is somehow impossible to do empirical correct. A real person could have multiple github accounts and could create a virtual identity which age is not tied to a real world persons age.

I am unsure of how old these core developers, but 2 that come to mind are Gavin Andresen and Mike Hearn. Hearn left recently  due to personal conflicts. (story here)

The article says that Hearn is 31.  According to https://www.technologyreview.com/s/527051/the-man-who-really-built-bitcoin/, Andresen was 48 in 2014, so 50 or 51 this year.

Thank you for finding Andresens's age.  I agree that such a question may never be able to be answered.


text:
Proof of Identity Sidechain Proposals
I have seen various Proof of Identity Proposal that all required some degree of trust (to verify the person in physical possession of a Passport is also the owner of it for example).
Have their been any proposals that are completely trustless? Is so what methods have been suggested to cryptographically tie real life identities to identities on a Bitcoin sidechain in a trustless manner?
For example could we use multi sig to require a sufficient percentage of randomly selected scientists to verify that a DNA sample, video recording with face and Passport, certified birth certificate and PGP message received from a specific person matches the person trying to verify their identity on the blockchain?

Sounds to me like you are describing Web-of-trust. No need for a blockchain.

"randomly selected scientists" - randomly selected by whom? And will you have scientists in every city across the world? And how will they get paid?
Ideas like that are practically impossible, and if you remember how PGP key signing parties ended up you'll understand why nobody is pursuing it.
The way Identifi is doing trust and reputation is one way to solve this. The other way is BIP75, which could be used to present a certificate signed by some certificate authority mutually accepted between you and the other parties. This article goes into some detail about that.


text:
Is it safer to use one type of hardware wallet of several?
I know that there are several brands of hardware wallets with open source firmware that are considered safe. Is it better to just one that is safe and you are most familiar with? Or would hedging by storing coins in multiple wallets make sense just in case some exploit is found in the future?

I recommend reading this earlier answer to a similar question:  http://bitcoin.stackexchange.com/questions/43875/what-options-does-one-have-to-manage-bitcoins/43882#43882

Personal, I would use multiple wallets just in case some exploit is found in the future. For the more paranoid/safety conscious person, I would also place the hardware wallet in a mini faraday cage, until needed. The reason behind the faraday cage is that electromagnetic radiation of WIRED or even hardwired devices can be picked up from up to 65 feet away; you could turn off the device to combat that possible risk (instead of a mini faraday cage)... Don't take my word for it... here is a short youtube clip of this in action. I would also use only a external hardware wallet which only connects to the internet by Ethernet cable for the same reasons described above. When not in use, simply disconnect it from the internet... this further improves the security of the store private key.


text:
How to upgrade my node with bitcoin wallet GUI from 0.11.2 to 0.12.1? Install qt V5.5?
i want update my RaspNode (rPi 2 B+) to the 0.12.1 but i want to use Bitcoin wallet GUI. So, it's necessary to install QT V 5.5...
V 0.11.2 use QT 4.8, but 0.12.1 uses QT V 5.5
How to install QT V 5.5 for raspberry ??


text:
How could a bot purchase bitcoins without paying for them?
An article titled "Researchers find that one person caused bitcoin to spike from $150 to $1,000 in 2013" (here) at CNBC discusses a paper titled "Price Manipulation in the Bitcoin Ecosystem" (here).
This article says about the paper that

They found that a majority of the price manipulation happened due to
  two bots with "??" listed as the name of the user country. They named
  these bots "Markus" and "Willy."
Markus bought and sold bitcoin at seemingly random prices and did not pay transaction fees. Upon further review, they found reason to
  believe that Markus was not actually paying for the bitcoins he was
  receiving. Markus acquired a total of 335,898 bitcoins and was
  active from February 14th, 2013 until September 27th, 2013.

On p.7 of that paper the authors wrote that

In the end, we have concluded that Markus did not actually pay for the
  bitcoins he acquired; rather, his account was fraudulently credited
  with claimed bitcoins that almost certainly were not backed by real
  coins. Furthermore, because transactions were duplicated, no
  legitimate Mt. Gox customer received the at currency Markus supposedly
  paid to acquire the coins.
Markus began buying bitcoin on 2013-02-14 and was active until
  2013-09-27. He did not pay for the bitcoins he acquired nor did he pay
  fees for the transactions.

I am mainly interested in how a duplication of transaction would lead to the seller not getting paid.
This is not explained in the paper as it mainly focuses on how the activity by the bots drove up the price of BTC at Mt. Gox and elsewhere.
Questions:

Isn't the purpose of the blockchain to avoid issues with transaction
integrity, such as duplicate transactions?
How would duplication of a transaction lead to the seller not
getting paid?

Isn't the purpose of the blockchain to avoid issues with transaction integrity, such as duplicate transactions?

Trades on an exchange do not happen on the blockchain. Those transactions are not Bitcoin transactions; they are internal to the exchange and are just updates to the exchange's internal database. Because of this, duplicate transactions could happen without anyone really knowing.

How would duplication of a transaction lead to the seller not getting paid?

The balance in an exchange account is just a number in a database and is not necessarily backed by that amount of actual currency. I believe what the authors are saying here is that the buyers and sellers would have their balances updated to say that they had X amount of money, but if they tried to withdraw, the funds wouldn't actually be there so that they could withdraw.


text:
I have unspent bitcoin in the blockchain
I made a transaction from a multibit wallet. It arrived in the blockchain and was confirmed thousands of times. However, the transaction is set to 'unspent'.
Can I retreive this from the blockchain when I have the private key of multibit, or is it lost?
This is the transaction:
https://blockchain.info/tx-index/b2a861b053125b5be9e7ba1b88e655b0e1184973038e3a528b8deb446336ec24
Can anyone help with this?

this tx transfers funds to 1CUz94ynWJoor93wJG9PuVo3jtoJDGeahy and
14UozGqkrb5RsE1MqQVP8i9va8nAsubc4V. If you have the private keys for these addresses, then you are ok. I see multibit is discontinued, so you might search a bit in the forum, and look here at their webpage: https://multibit.org/blog/2017/07/26/multibit-shutdown.html

It is not the transaction that is unspend, but rather bitcoins that belong to a certain wallet. Please be more specific in your question.

In short, bitcoin transactions are made up of inputs and outputs. When you sent funds, an input was spent, and the output went to the receiving bitcoin wallet. The unspent tag simply means that the funds that you sent have not yet been used as an input, and the funds are therefore still at the address to which you sent them.

No, you can't retrieve it.  You sent the transaction and it was confirmed, so the funds belong to the recipient now.  They have apparently chosen to leave them in that address without spending them so far, which is why the transaction is "unspent".  But the recipient is the only one who can spend those funds.


text:
What are layer 2 protocols?
People often talk about building a protocol “on top of” the bitcoin blockchain. Those same people often call this building a layer 2 protocol.
To be clear, “on top of” is clearly metaphorical language here (this is a visuospatial metaphor for what is a technical abstraction). Can someone explain what is actually happening when someone says that? Feel free to use the example of a well known application.

This layer 2 wording is an analogy/comparison to the network TCP/IP stack. Basically the TCP/IP stack allowed for networking machines as the foundational layer (or the layer 1 infrastructure). And on top of this infrastructure came the protocols, which are commonly used today (http, mail, ...). When comparing to the bitcoin world, the idea is that bitcoin as per today is the "payment infrastructure", and on top of it there will be protocols for lightning (micro transactions), schnorr sigs, smart contracts, ... So the underlying bitcoin network has proven to be reliable, and serves as a utility for future setups on top.
There is also a certain euphoria when people talk like this, hoping the future will reduce/avoid today's limitations with these "layer 2" protocols. Exciting times ahead!


text:
Stuck transactions
I tried to send some bitcoins 2 days ago and they have sat there 0 confirmations - I guess because of 'dust' from faucets included in there.
I think I specified default transaction fee but obviously this wasn't enough.
How long will it take for transaction to be removed and balance to return to my wallet? or is there a way I can force it to cancel?
Any ideas how I can work out how much transaction fee to use to let this through?
The Transaction ID is 78e50449f91454fb33dfc0986b4e2efa909a4b19ba47569f22de11fad98eccad-000
Any help appreciated!
LCS

Blockchain.info has this message when I search that TXID: Transaction rejected by our node. Reason: The Maximum number of inputs in a single transaction is 250. That's not a network defined limit, probably just to prevent them from handling too much spam.

related: Why is my transaction not getting confirmed and what can I do about it?

To check the recommended transaction fees for a specific time period you are willing to wait. You can refer to BlockCypher. It will tell you the recommended fee to pay on a per kB basis for high priority process and etc..
So lets say, you really want to accelerate the whole process, what you could do is perform a Child pays for Parent transaction using the unconfirmed output of the transaction that is currently stuck and basically compensate for the fees you're missing out on the "stuck" transaction.
You can do this by creating a raw transaction using Bitcoin Core or some wallet software, then broadcast this to a well-connected peer and theoretically it would then eventually be committed to the Blockchain by Miners.
As it is right now, my full node mempool has approximately 4000+ Transactions, so it will be unlikely for your transaction to ever get committed to the Blockchain and eventually your stuck transaction will be removed from Mempools within the network.


text:
General-Purpose Hardware Wallet
Fundamentally, crypto-currency hardware wallets are just devices that securely generate public/private key pairs, and sign input data when approved using a password and physical approval mechanism, right?
This seems like a generally useful capability, though as far as I can tell, the only devices available are purpose-built for a specific set of crypto-currency protocols, or some other protocol like U2F on the YubiKey.  I don't want my $100 Ledger wallet to become useless if its supported currencies (or the entire market) fall into disuse.  So is there any way to either:

Use (or modify to use) the Ledger to perform general key generation and signing?
Buy a general-purpose keygen + signing device that supports crypto-currency signature methods?

Use (or modify to use) the Ledger to perform general key generation and signing?

Yes. The things that the Ledger support are not specific to cryptocurrencies. You can write applications for the Ledger that do other things, so long as the firmware supports the cryptographic operations that are necessary.

: Buy a general-purpose keygen + signing device that supports crypto-currency signature methods?

Yes. The cryptocurrency stuff happens externally to the cryptography. You can write an application that offloads the cryptography to a general purpose keygen and signing device (usually HSMs) and handles the remaining cryptocurrency stuff (transaction construction, node, etc.) on a general purpose computer.

Hardware wallets are really generic HSMs (although the Trezor does not contain a secure element like Ledger Nano S's do) that have had specific cryptocurrency applications built into them. They can be used for general cryptography things too, you just need to write software for that, and possibly modify firmware.

HSM was the term I was missing - thanks!  I also didn't think to check for an SDK or anything for the Ledger but it looks like there's a ton you can do with it even if the entire crypto-currency market dies out.

The Ledger's API does provide some commonly use cryptographic utilities. You can create keys for AES, RSA, ECDSA (with multiple curves), and DES. You can then use those keys for encryption and signing. So it is actually useful outside of cryptocurrencies. They even have apps for GPG and SSH key management, which is notably not cryptocurrency related.


text:
Bittrex API OpenBuyOrders OpenSellOrders - what do they actually show?
e.g. https://bittrex.com/api/v1.1/public/getmarketsummary?market=btc-bcc
shows:
{..."OpenBuyOrders":1557,"OpenSellOrders":13944,...}
What do these numbers refer to since they do not match the BTC or BCC bid and ask volume values on the bittrex screen when looking at this pair.
Any ideas what these two values are showing? I need to know the total number of bid and ask BTC volumes via the API calls? Thanks

The Bittrex API documentation doesn't divulge many details but I expect those two values would be all outstanding (open) buy and sell offers, not just for that day.
You may need to contact Bittrex for further clarification.

Thanks for getting back, Willtech. Do you specifically mean the number of outstanding (open) buy and sell orders rather than referring to the currency value?

What would be useful is the OpenBuyOrders_Base value i.e. the BTC or other CCY amount! The number of orders is not useful and doesnt give the right indication of volume

This Q & A may help further: https://bitcoin.stackexchange.com/questions/57512/what-is-the-volume-and-basevolume-reported-from-bittrex-api


text:
How can a 24 word seed know when I added or removed wallets at a later point?
Since I do not have 50 Rep points I had to post my question this way!
This is an answer by "https://bitcoin.stackexchange.com/users/56917/rstack" to the question "How do Ledger Backups get stored?"
"Using words to back up wallets is a process described in BIP 39.
Basically, the mnemonic is converted into a seed. This seed is then used as the seed to a Heirarchical Deterministic (HD) wallet, as laid out in BIP 32. The seed is used to generate a Master Extended Private Key, from which all other private keys can be generated. The child key generation follows the standard of BIP 44 so it is compatible with other wallets too.
Thus, by backing up your mnemonic words, any time you enter them in a wallet, it can recreate the seed, then the master private key, then all your other keys, so your wallet is back."

When I start my Ledger for the first time I get a generated 24 word seed. At this point my Ledger has the default wallets (BTC, ETH, LTC) if any. From Rstack's answer I get how this works or could work so far, BUT how does my 24 word seed know the future when I add or remove wallets? The 24 word seed does not change after I add or remove wallets. Randomly generated public and private keys that are created in the future can no way have ties to a previously generated 24 word seed. Does not make sense!
Unless this can be explained I am going to have to assume that my public and private keys are stored somewhere and retrieved by the 24 word seed.
Can anyone shed light on this?
Thanks in advance and cheers everyone.

I don't know about Ledger specifically, but for HD wallets in general, private and public keys are not generated randomly.  Rather, they are generated by a deterministic algorithm from the seed (in this case, the 24 words).  So they are absolutely "tied" to the seed.
When you add a wallet for another coin, keys for that wallet would presumably be generated from the same seed (using different parameters so that you don't end up with the same keys in all your wallets).    The seed itself stays the same and doesn't have to change to reflect the creation of the new wallet.
Should you ever need to restore, I assume you would need to tell the device which coins you had wallets for.  It will then regenerate all the keys for those wallets from the master seed, using the same algorithm as it used originally, and you'll have all the same keys you had before.  (If you try to restore some wallets that you weren't using or had removed, all that will happen is you'll find no coins in that wallet.)
Your public and private keys are not stored anywhere except within the device itself.

Yes, this makes total sense now! I always thought the seed is generated for the ledger and not to create keys. Cool, thanks Nate.

The short answer is the entire process from words to derived private keys and addresses is entirely deterministic. See below steps for more details.
Entropy-to-Mnemonic
The process for a BIP39-compliant 12-word mnemonic, for example, is that first a random binary number 128 bits long is (ideally) generated with a cryptographically-secure process, then a deterministic checksum is computed by taking the first 4-bits of a SHA256 hash digest of the 128 bits formatted as a byte-array.
Then we have 132 bits which are split into 12 groups, with each group pointing to a word on an index of 2^11 words (2048 total).
Mnemonic-to-seed:
Those 12 words represent the root seed, which is then fed into an HMAC-SHA512 hash function (with 2048 rounds) and left-most 256 bits of the 512-bit hash digest is the Master Private Key, whereas the right-most 256 bits of the 512-bit hash digest is the Master Chain Code, as per BIP32 for Hierarchical Deterministic (HD) Wallets.
Extended keys (xPub/xPrv):
The Master Private key is used as an elliptic curve private key to compute the Master Public Key which is 264 bits.
The chaincode, together with an index value starting at 0, is what lets you iterate on the derivation process to produce (and thus extend) a different child private-public key pair each time, as the index value changes, while the chaincode is constant (as entropy).
Derived child private-public keys:
The way this process works, is the parent public key is concatenated with the parent chaincode along with the index value, and again fed into the HMAC-SHA512 function, where the 512-bit output represents the concatenation of child private key, and child chain code (where the private key is used to compute the child public key).
HMAC-SHA512(xPub+Chaincode+index0) = (512bits= child_privatekey_0 || childchaincode0)
childprivatekey_0 * Secp256k1 Generator point = childpublickey_0
HMAC-SHA512(xPub+Chaincode+index2) = (512bits= child_privatekey_1 || childchaincode1)
childprivatekey_1 * Secp256k1 Generator point = childpublickey_1
This process can be repeated to derive nearly 2 billion child keys form the extended private key (in terms of the maximum possible index value).
Thus, mnemonics are incredibly convenient, compared to having to store so many different private keys, as the mnemonic allows you to recreate all derived keys, and can even support multiple cryptocurrencies with the use of BIP44. I like to refer to mnemonics as Cryptovaults, and not wallets, as they house multiple wallets and potentially for multiple accounts (cryptocurrencies). The security tradeoff though is that all your assets can be tied to one potential point of failure if the mnemonic is not secured/derived properly. Thus it is common for users to have several mnemonics, such as for hot wallets and others for cold storage.

So, it doesn't initially have a way to know if you created a, say, LTC wallet or not. But it uses the seed, the derivation path and the gap limit to see if there are any addresses down the public key curve that have been used. If there are, then it will mark the wallet as active.
Each cryptocurrency has their derivation path. You can play with this tool to look at a few of them.
Once you restore the seed the wallet software will start iterating over the public key + derivation path to find the all transactions in that cryptocyrrency's wallet. This will probably leak some of your address data to the explorer/full node they are using because you're simply going address by address and asking for the balance of it. BUT IT DOES NOT SHARE YOUR PRIVATE KEY and gives you the impression that the wallet knew all along which  cryptos you had there.
But keep in mind that the limitation of this method is that addresses in each currency need to have been used for the wallet to detect. Otherwise it will not be able to distinguish if you activated a currency or not.

The gap limit is not exactly related to your particular question but is how many iterations the software will make ahead of the last known to be used address. Otherwise it could stay in an infinite loop trying to generate all addresses belonging to your key.


text:
Sign raw transaction with key
I'm upgrading my application from bitcoin core 21.0 to 23.0.
In core 21.0 I created a raw transaction and sign it with my private key after I called dumpprivkey RPC. At core 23.0 I received this error when I Called dumpprivkey:
This type of wallet does not support this command
How can I sign my transaction with my private key?

It's currently not possible to export private keys from descriptor wallets.
I don't think you needed to dump the key first in the first place, though. As far as I can tell, signrawtransactionwithwallet should do exactly what you're looking for.


text:
cpuminer: Running two nodes -The requested URL returned error: 500 Internal Server Error, json_rpc_call failed, retry after 30 seconds
I'm trying to mine new blocks using cpuminer. My blockchain network runs on localhost on the testnet network with two nodes. When I'm trying to mine the blocks I'm receiving the following error:
* TCP_NODELAY set
[2020-08-19 10:46:01] Binding thread 6 to cpu 6
[2020-08-19 10:46:01] Binding thread 4 to cpu 4
* Connected to 127.0.0.1 (127.0.0.1) port 18001 (#0)
* Server auth using Basic with user 'liork'
[2020-08-19 10:46:01] Binding thread 2 to cpu 2
> POST / HTTP/1.1
Host: 127.0.0.1:18001
Authorization: Basic bGlvcms6aXJvY2s=
Accept-Encoding: deflate, gzip, br
Content-Type: application/json
User-Agent: cpuminer/2.5.1
X-Mining-Extensions: midstate
Content-Length: 147

* upload completely sent off: 147 out of 147 bytes
[2020-08-19 10:46:01] Binding thread 0 to cpu 0
* Mark bundle as not supporting multiuse
* The requested URL returned error: 500 Internal Server Error
* Closing connection 0
[2020-08-19 10:46:01] HTTP request failed: The requested URL returned error: 500 Internal Server Error
[2020-08-19 10:46:01] json_rpc_call failed, retry after 30 seconds

My nodes configuration:
Node1:
...
# Options only for testnet
[test]
connect=127.0.0.1:17002
rpcport=18001
listen=1
port=17001
rpcuser=myuser
rpcpassword=mypassword
...

Node2:
...
# Options only for testnet
[test]
connect=127.0.0.1:17001
rpcport=18002
listen=1
port=17002
rpcuser=myuser
rpcpassword=mypassword
...

I'm running the cpuminer using the command: ./minerd --url=http://127.0.0.1:18001 --user=myuser --pass=mypassword --coinbase-addr=my_address --protocol-dump

Because new blocks are not generated few days, I got this error.
To solve this I generate a new block using the bitcoin cli:
./bitcoin-cli --datadir=<dir_to_wallet> generatetoaddress 1 <wallet_address>


text:
Cannot compile depends library- bitcoin v0.21.0
I'm trying to compile the depends library of bitcoin v0.21.0 on Ubuntu 20.04.
When I'm running the make command, I'm receiving this error:
funcs.mk:265: *** empty variable name.  Stop.
What is the meaning of the error and how can I resolve it?

Can you give the exact commands you're running, and the full output (or at least, the last few lines of it). It's very hard to say based on just what you're giving here. Also note that v22.0 was just released; maybe you want to try that instead.

@PieterWuille the exact command is make -C ./deploy.

funcs.mk:265: *** empty variable name.  Stop.

What is the meaning of the error ...

It means that line 265 of funcs.mk contains an equals sign but the item to its left is not a valid variable name. Stop means make was unable to continue due to this error.

... and how can I resolve it?

By studying line 265.
Likely there is something earlier or externally that causes some construction here to not contain what it should.
You may need to ensure you have the latest versions of make and other resources using something like sudo apt-get update && sudo apt-get dist-upgrade

the exact command is make -C ./deploy

Maybe your intention is to run make -C ./depends ?


text:
BTC Lightning Network
Can someone please give me some insight as to when LN will be fully operational on the bitcoin network.
Additionally, as outlined in the 2008 Nakamoto whitepaper, the solution to the double-spend problem is clearly addressed and solved, however, given that with LN supposedly 'Billions of transactions per second' may happen off-chain, then what are the implications for how the double-spend problem is addressed?.
This is presumably handled in the software layer, under the knowledge that people must firstly stake a quantity of bitcoin in order to support the electronic IOU's.
If the above is correct, which it may not be (please correct me if I am wrong), then doesn't LN essentially become almost in a sense a 'Bitcoin backed' new cryptocurrency?

what are the implications for how the double-spend problem is addressed?

The solution to the double spend problem does not change.  Participants of the lighting network hold valid transactions for actual bitcoin.  Because bitcoin cannot be double spent, the lightning network doesn't have to solve this problem.

This is presumably handled in the software layer, under the knowledge that people must firstly stake a quantity of bitcoin in order to support the electronic IOU's.

Despite the fact that the transactions haven't been broadcast, I wouldn't consider money on the lightning network to be just an IOU.  While it is still unsettled, it's more complete of a transaction than what we typically think of as an IOU.  The smart contacts, themselves, make the exchange on the lightning network effectively irreversible.

doesn't LN essentially become almost in a sense a 'Bitcoin backed' new cryptocurrency?

No.  If that was true, then credit card transactions would be a separate dollar-backed currency.  Lightning is a method of exchanging bitcoin.  That doesn't mean it's a new currency, just a means of moving money.


text:
Transaction net gain/loss
I have a TXid in my wallet that contains multiple transactions (multiple sends and receives). From what I read these are transactions the network creates facilitate splitting/combining multiple inputs/outputs etc. When I gettransaction in the wallet I have I see
gettransaction 3dda59bf9801f88...5498dd7fd1c3f9577963b94
{
  "amount": -17.00000000,
  "fee": 20.00000000,

  "details": [
    {
      "account": "",
      "category": "send",
      "amount": 0.00000000,
      "vout": 0,
      "fee": 20.00000000
    },
    {
      "account": "",
      "address": "GPP7ic67...9TgitCB21r",
      "category": "send",
      "amount": -20.00000000,
      "vout": 1,
      "fee": 20.00000000
    },
    {
      "account": "",
      "address": "GPP7ic67...9TgitCB21r",
      "category": "send",
      "amount": -17.00000000,
      "vout": 2,
      "fee": 20.00000000
    },
    {
      "account": "TestWallet",
      "address": "GPP7ic67...9TgitCB21r",
      "category": "receive",
      "amount": 20.00000000,
      "vout": 1
    }
  ],

So, I'm trying to figure out what the net result of this transaction is. I received -17 and I had 20 fee. Does that mean I net loss 37?

hmmm, yes, this accounting system within bitcoin :-) bitcoin.SE is full of questions according to the balance on accounts.
The "-17" would indicate, that funds left from a known address in your wallet to an "external" target address. And if fees is 20, then yes, you have "outgoing" 37 coins. Btw: what system are you playing on? Addresses starting with "GPP"...?
When I was playing with the regtest env, I discovered that only "gettxout" provides reliable info, which tx might have funds. See also the thread here.
Here a short linux shell script, to fetch the idea. It needs to get updated to cope with many inputs, so one would need to iterate through the VINs...
  b_cli="bitcoind -regtest"
  FUNDING_TXID=3dda59bf9801f88...5498dd7fd1c3f9577963b94

  TX_PREV_VOUT=$( $b_cli gettransaction $FUNDING_TXID | \
                  awk '/vout/ {  print $2; exit }'    | tr -d "," )

  $b_cli gettxout $FUNDING_TXID $TX_PREV_VOUT

  # as per Pieter's comment, spendable VINs return "something"...
  if [ ${#ret_val} -gt 0 ]; then
    echo " ## This tx has spendable funds"
  else
    echo " ## no spendable funds on $FUNDING_TXID"
  fi

Adding up all the parts, which have spendable funds, would then be "your" balance. And you could check "in" and "out" going funds in your wallet.

So this is not from bitcoin it is a wallet from an alternative POS coin but the CLI is almost identical to the bitcoin-cli. Either way, I looked into other transactions where I sent out money and the "fee" value was negative. Knowing that I ran the number and my net is actually "amount" + "fee" so this tx was a net gain of 3. After some reading I realized this was a staking reward.


text:
Verifying old blocks
I have a question about an implementation detail - when are old blocks verified by each full node? I.e. when will I be "caught" if I change the contents of an old block (and thus break the hash chain)
From what I've seen, the possible answers include: when it's downloaded and when you do a -rescan.
However, does a full node regularly verify the integrity of the chain from start to finish?
(I'm aware that changing the history on my node doesn't do any good, as those verifying my future transactions will have the correct chain and thus refuse any attempts to double spend)

Full nodes verify the complete blockchain history on the initial block download (IBD) or on a reindex. As the node is synchronizing with the network, they keep updating the overview of spendable balances, the Unspent Transaction Output Set.
When a node gets disconnected or turned off, they can pick up from their last known state and continue updating the UTXO Set with the changes from the new blocks that have since been published.
The history only needs to be checked once. If another node changes the content of an old block, this will not change the state of any other nodes. Other nodes will only ever discard information that they have already validated when they learn about and reorganize to a heavier chain.
If you change a block in the past, you will still not be able to get your node to accept that new information, unless you additionally manipulate your own node's UTXO Set or the software you're running on your node to accept it.
However, this would be a pointless exercise, as nobody else would accept your changed block unless it is backed by being part of a heavier chaintip.

Thanks.
Does it mean that it's theoretically possible for https://blockchain.info/ to show you incorrect block data if someone internally has modified an old block? It won't change anything for the network of course, but if someline is relying on a service to display the true state of the blockchain, internarl modifications to the old blocks may be left undetected for a while?

Yes, it would be theoretically possible, if someone had manipulated blockchain.info's database that they would show incorrect information.

when are old blocks verified by each full node?

never unless rescan=1 command-line option passed to

From what I've seen, the possible answers include: when it's downloaded and when you do a -rescan.

yes, on downloading also of course
one of my .dat files is broken (some garbage in contents) but bitcoin-qt works well because it uses UTXO, not blocks themselves

if I change the contents of an old block (and thus break the hash chain)

this depends what do you mean.

Rescan doesn't re-validate blocks.

oups. reindex=1

You can't change an old block without changing everyred hot chili peppers jorge subsequent block. You would have to mine again and rebroadcast every single block starting with the one you changed.
The nodes would then reject them because the blocks they have saved have more proof-of-work.
I don't know if a full node regularly verify the integrity of the chain from start to finish. But if they doesn't, that is unimportant for the attack you're describing.

This is wrong, changing an old block would change every subsequent block. Each block’s hash includes the previous block’s hash as input, so changing one will change the hash of every single block following it. Also, if a single block could be changed, that would not affect the total proof of work of the chain (all else held constant). So the nodes would not reject the block for the reason you cited, rather they would reject it because the new block would not have any other valid blocks built on it, and thus not be as long as the honest chain

It was a typo, I tried to say "can't"


text:
How does Bitcoin verifies signature if addresses are one way hashed
I'm stuck at understanding Bitcoin's transactions. So, the owner must sign the transaction with his private key, then miners can verify whether this signature matches his public key. However the public key is hashed with three functions (RIPEMD160, SHA256 and Base58) and it's impossible to get the original ECDSA public key from the address. So how does the transaction verification actually work?

Possible duplicate of If addresses are hashes of public keys, how are signatures verified?

The ECDSA public key is "included" in the new transaction (part of the scriptSig).
Details
This is an example output of a transaction (only hash of the pubkey is available):
"scriptPubKey": {
    "asm": "OP_DUP OP_HASH160 059be22aadc3bef6b673cb7a16247a0b7403d943 OP_EQUALVERIFY OP_CHECKSIG",
    "hex": "76a914059be22aadc3bef6b673cb7a16247a0b7403d94388ac",
    "reqSigs": 1,
    "type": "pubkeyhash",
    "addresses": [
      "mg2cQz9Y3ugyjfq8b2wTcW4veemgTBKxkX"
    ]
  }

The pubkey from the address above is
03788e5414ebec4a38032be706ae0c13870e320d916bb087ab7258fcf8c0111cbf
(but it's not visible in the blockchain until the output gets spent. Only the recipient of the output above knows it.)
Using that output as an input in a later transaction will result in:
"scriptSig": {
            "asm": "304402203b47249bfe6528dcf297c5888ad608a5c7227ea9f878df09a265c3318c1482e202204e8a8f17da505a6d20ceb4eb63fba2d8e2c5d0a792a0e280dcb18adeec68a05d[ALL]03788e5414ebec4a38032be706ae0c13870e320d916bb087ab7258fcf8c0111cbf",
            "hex": "47304402203b47249bfe6528dcf297c5888ad608a5c7227ea9f878df09a265c3318c1482e202204e8a8f17da505a6d20ceb4eb63fba2d8e2c5d0a792a0e280dcb18adeec68a05d012103788e5414ebec4a38032be706ae0c13870e320d916bb087ab7258fcf8c0111cbf"
          },

(3044... is the DER encoded ECDSA signature)
(03788... is the pubkey)

How is it decoded? Isn't SHA256 one way only?

SHA256 is a oneway hash function. Yes. You can't decode a public-key-hash into a public-key. Only the recipient of the coins has the according public key (in his wallet). There is no need to "decode".

So, does this mean the recipient possesses the public key? But this doesn't explain how other people can't imitate sender's signature if his public key is unknown...

I think I understand now. So, for the input, the ScriptSig contains both sender's unhashed pubkey and signature, and the output contains receiver'a address, correct?

Right. Input = expose pubkey (no longer relevant)

Output = hash(pubkey) (no-one knows the pubkey expect the recipient)


text:
How does Bitcoin coordinate time between nodes
I'm curious about how Bitcoin nodes sync their time. There are delays within data transmission so if a node mines a block, how does the network determine whether it is the first?

Nodes determine which block is "first" based on whichever block they receive first.
Or in other words, the timestamp on a block is not used to determine which block a node will add to their blockchain; nodes simply add the first valid block they receive to their blockchain.
As a result, if two blocks are mined at the same time, it's possible that different nodes on the network will have different blocks at the top of their blockchain. To illustrate:
Node1    Node2
-----    -----

 [x]      [y]
 [c]      [c]
 [b]      [b]
 [a]      [a]

block [x] was mined "first"
block [y] was mined just after block [x]
Due to network delays, Node2 ends up receiving block [y] first
Therefore, Node2 adds [y] to the top of their chain (but they also keep a copy of block |x|)

So at this point in time, there is a disagreement about the state of the blockchain on the network. This happens.

This situation is resolved when a new block gets mined.
For example, if Node1 mines a new block on to their chain:
Node1
-----

 [z]
 [x]
 [c]
 [b]
 [a]

This new block [z] creates the new longest chain on the network. So when Node2 receives block [z], they will adopt the new longest chain:
Node1    Node2
-----    -----

 [z]      [z]
 [x]      [x][y]
 [c]      [c]
 [b]      [b]
 [a]      [a]

...and the network is back in agreement about the state of the blockchain.
Summary:
The order of blocks (or which block is "first") is not determined by the timestamp on blocks relative to any network time.
Instead, nodes will add the first block they receive, and are free to disagree on which block is at the top of the chain. The order is resolved when a new block is mined, and all nodes adopt the longest known chain.

So, if I want to get a list of nodes ordered by the time when they mine a block, is this possible?

No block can be mined until the block before it is mined.


text:
How does Bitcoin read from/write to LevelDB
I know that Bitcoin Core uses LevelDB since 0.8 version. However, I couldn't find detailed explanation about how Bitcoin stores and retrieves from LevelDB. E.g. If B transaction uses an output from previous transaction A as input, how does Bitcoin lookup this transaction and see if it's spent? After transaction B is spent, how does this transaction get updated?

have you had a look at this: http://bitcoin.stackexchange.com/questions/28168/what-are-the-keys-used-in-the-blockchain-leveldb-ie-what-are-the-keyvalue-pair?rq=1

I looked it but it only stated the schema of a transaction. So does Bitcoin client remove a transaction from LevelDB once it's spent?

bitcoind uses leveldb to store its utxo database, which is also referred to as chainstate. This can be found in the Bitcoin data directory under chainstate/.
UTXOs are identified by their txid (using their little-endian representation) led by a C. For versions before 0.15, the entries are prefixed with c instead.
Example
Transaction 246c5a81b6ad0dfc0dbc0b2ff5bde65ee1913f75a47d409b8ff8074a27ec1000
is identified in the chainstate by C0010ec274a07f88f9b407da4753f91e15ee6bdf52f0bbc0dfc0dadb6815a6c24 or what is the same 430010ec274a07f88f9b407da4753f91e15ee6bdf52f0bbc0dfc0dadb6815a6c24 (since the hex representation of the uppercase ASCII character 'C' is 43).
Each entry in the leveldb contains two values, the identifier (already explained and used as key in the map) and the value.
The value of each entry (the UTXO itself) is encoded using the following structure (check this comment from the source code for more detail):

Serialized format

VARINT(nVersion)
VARINT(nCode)
unspentness bitvector, for vout[2] and further; least significant byte first
the non-spent CTxOuts (via CTxOutCompressor)
VARINT(nHeight)      * The nCode value consists of:

bit 1: IsCoinBase()
bit 2: vout[0] is not spent
bit 4: vout[1] is not spent
The higher bits encode N, the number of non-zero bytes in the following bitvector.
In case both bit 2 and bit 4 are unset, they encode N-1, as there must be at least one non-spent output).

Notice that, since the database used to trigger anti-virus software(2, 3), an obfuscation key was introduced so the data can be masked. The key is a 64-bit value identified by 0e00obfuscation_key that should be XORed with each data value from the database. Given the entries in the database may be longer than the key, the key is concatenated with itself until it reaches the expected length to de-obfuscate a value.
Example
Let's use the following obfuscation key and entry in the database:
// Obfuscation key
o_k = "27c78118b7316105"

// Entry
{
    "key": "43000002f414665fb03389dd19776732bf90883bcb399d23323747596e98dd1801",
    "value": "26c326d7353661dc7005d274976f458691f24f0f05d141335f4ad5927e41"
}

As you can see, value does not follow the above-introduced format, since it is obfuscated. value is 60 characters long, so we need to extend our obfuscation key to match its size:
27c78118b731610527c78118b731610527c78118b731610527c78118b731

Now, if we perform the XOR between the value and the key, we obtain:
    > 26c326d7353661dc7005d274976f458691f24f0f05d141335f4ad5927e41 XOR 27c78118b731610527c78118b731610527c78118b731610527c78118b731

    0104a7cf820700d957c2536c205e2483b635ce17b2e02036788d548ac970

That matches the previously stated format, and it's indeed the UTXO identified by 43000002f414665fb03389dd19776732bf90883bcb399d23323747596e98dd1801

Thanks. Finally I figured out that Bitcoin uses LevelDB to save the transaction index, which uses the transaction hash as key and file position as value. The actual binary transaction data are stored in the block files.

@Yangrui That used to be how Bitcoin Core worked up to version 0.7.x. As of 0.8.0, there is no transaction index at all anymore, and only a database with a copy of the unspent transaction outputs. This means no disk lookup for the actual transaction is needed anymore, and we're able to support pruning (deleting the actual block data from disk after validation).

Thanks Pieter. So if a transaction is spent, is it just removed from the UTXO db right away?

For future travelers like me, the key for chainstate is not an ascii 0e00obfuscation_key, but a hex \x0e\x00obfuscate_key (as of v0.15.0.1)

\x0e and \x00 indicate 0e and 00 hex respectively.

Can you please explain how you managed to xor two 30-byte numbers and get a 28-byte number, that doesn't appear to be their bitwise xor in any way I can figure out?

@NateEldredge I can't recall how I got that value, but you're completely right. The actual deobfuscated value should be 0104a7cf820700d957c2536c205e2483b635ce17b2e02036788d548ac970

Also, the hex representation of "c" is 0x43, or 67 decimal (not 63 as written above). Just some info if you got confused like me.

Nope, C is 0x43, c is 0x63

You're correct. But I think I was trying to say that the key bytes in the UTXO for a "coin" start with 0x43 (not 0x63). I think they start with a 'C' and not a 'c'.  Am I mistaken?

It is now, but it was not when the answer was posted. The UTXO set format was changed in Bitcoin Core 0.15. For 0.15+ (inclusive) it is 'C', for 0.15- it is 'c'.


text:
Could a 2/3 majority vote be used as a consensus
I understand that Bitcoin currently is using the chain with most proof-of-work as consensus. However could this method be improved, like only allow one block being generated at any given time, and each node verifies this block with its own past data. If there are more than 2/3 nodes prove the block to be valid then the block is added to the chain. If someone wants to create a fake block, then he must control at least 2/3 of the total nodes. What kind of attack is this consensus vulnerable to?

It's easy to make up rules, but much harder to precisely specify a protocol that securely enforces them.  For instance, what evidence could prove that 2/3 of nodes believe the block is valid?  What happens when an attacker spins up several million virtual machines, each running a node which claims their bogus block is valid?

Each node verifies the block with its own records. For the second attack, if an attacker can launch such large scale of an attack, couldn't he also out power the current Bitcoin network?

@Yangrui, no, he couldn't.  That's the point of using proof-of-work.  It doesn't matter how many machines there are, it matters how powerful they are collectively.  VMs won't give you that power; the only way to obtain that level of power would be very, very expensive.  You'd have to purchase more computing power than the rest of the network combined.  Even if you had those resources, you'd have more to gain by playing by the rules than you would by attempting to break them.

I understand that Bitcoin currently is using the chain with most
proof-of-work as consensus.
However could this method be improved,
like only allow one block being generated at any given time, and each
node verifies this block with its own past data.

No, it can't be improved in this way; not in Bitcoin's permissionless or decentralized threat model where any node can join and leave the Bitcoin network at any time. It would be worsened, actually.
To understand why your scheme doesn't work in the permissionless setting, you have to understand how sybil attacks [2] break it. It's very simple actually: an attacker can always win an election, if he can control a majority of fake voters. This is why your scheme won't work in Bitcoin's permissionless setting. In your scheme, the attacker can control a majority of fake voters by adding a bunch of nodes until he controls 2/3 of the nodes in the network. Then, he can dictate consensus.
In fact, Satoshi of course considered using a 2/3 majority vote (1 node = 1 vote) to secure Bitcoin, but soon realized sybil attacks would break any such consensus scheme because it is very cheap to create fake voters: just spawn fake nodes. The Bitcoin whitepaper clearly mentions this as well (see Section 4, pg. 3) [1].
It is crucial to understand that spawning nodes is as simple as generating key-pairs. In other words, a signature from a node is worthless in the permissionless setting. What does a signature really guarantee when any chump can spawn millions of nodes and provide millions of signatures?
Bitcoin prevents sybil attacks by making voting expensive. Again, since any chump can join the Bitcoin network and try to wreak havoc, Bitcoin essentially says "Have at it! But by the way, if you want to vote you'll have to compute a couple of trillion SHA256 hashes." Bitcoin still uses a majority vote to reach consensus but it counts votes not by number of nodes, but by number of CPUs. Why? Because chumps don't have a lot of CPUs. Thus, it'll be harder for them to take over the majority of voting power.
In Bitcoin, if I want to dictate consensus, I have to buy $160 million worth of ASIC miners (by some rough calculations) and then pay a huge electricity bill as well.
Now, you said that:

I understand that Bitcoin currently is using the chain with most proof-of-work as consensus.

...but it doesn't seem like you understand the reason why Bitcoin uses 1 CPU = 1 vote instead of using 1 node = 1 vote. Again, the answer is: to prevent sybil attacks.

If there are more
than 2/3 nodes prove the block to be valid then the block is added to
the chain. If someone wants to create a fake block, then he must
control at least 2/3 of the total nodes.
What kind of attack is this consensus vulnerable to?

Sybil attacks, as mentioned before.
Hope this helps answer your question.
PS: I'd like to point out that your system works fine in a permissioned setting where there's a fixed number of nodes or an admission control process which vets nodes before accepting them into the system. In this setting, sybil attacks are not a problem. However, keep in mind that this setting is the exact opposite of the Bitcoin setting. Bitcoin wants to stay decentralized/open/permissionless (and many other buzzwords Bitcoin fanatics like to use).

Thanks so much for your explaination. I've come up with two potential solutions to the imagined Sybil attack: 1) limit the number of new nodes being added at any round. Because attacker must outnumber existing nodes, the network can limit the new nodes not to exceed 1/3 of total nodes 2) add some proof-of-work mechanism to voting, but each voter are awarded the same way. I don't know which is better

You're welcome! Your first solution doesn't work: By my calculations, an attacker can get 2/3 majority in around 4 rounds if he's the only one adding nodes (each round increases the number of nodes 1.333... times). Your second solution is Bitcoin's proof-of-work consensus. Not sure how voters could be awarded the same way. Recall that if it's 1 CPU = 1 vote, then if I have 2 CPUs, I will be awarded twice as much.

Are there other proof-of-work methods rather than just calculating a hash for a trillion times?

Yes, there's a quite an amount of literature on that. If you'd like to learn more, it's probably best to ask a separate question on that topic.

Your proposal is not sufficiently specified:

How is the authoring node selected?
How does a node prove his authority to author a block?
How do other nodes show support for the published block?
How can the support for a published block be verified by other nodes?

It is not clear how your proposal achieves consensus at all. Additionally, there doesn't seem to be a significant cost associated to vote on blocks, so the proposal is vulnerable to Sybil attacks.

I'm thinking that each node is equally authorized to vote right now. If a node approves a block, then it signs the block header with its private key so in turn other nodes can also verify who signed the block. If an attacker wants to attack the network, he must get the private keys of at least 2/3 of the total nodes first.

Who decides which nodes are authorized?

Signing the header as approval means that not only does every node need to get every signature, but also every node must maintain a list of all other nodes and their public keys to gauge support. If anyone can start a node and start signing this will lead to disagreements in acceptance in a network where nodes drop in and out, as nodes will be calculating with different total signatories. Also when a third of the nodes is offline, no block can be validated... So, it's inefficient with bandwidth, will fork and is trivial to DOS. your proposal needs more work. ;)

@Yangrui, think about Nate's point.  If a node has to be authorized, then whoever is doing the authorizing controls the network.  You've just converted Bitcoin to being a centralized, permissioned system.  That sort of defeats the entire purpose.

The nodes have equal voting power. So they need to vote . As long as a node does not commit fraud, it is allowed to vote.

@Murch good point. However, not all nodes need to be online. Yes the signature is verified against every node's public key, and all public keys need to be stored. However only online nodes are invited to vote at every round. The good point is that you can verify if the past blocks contain valid signatures only


text:
Why are all redeem scripts standard, but only a few pubkey scripts?
As I understand it, only transactions with pubkey scripts conforming to a certain pattern are considered "standard" and are relayed, however a script is also considered standard regardless of its redeem script.
If the limitation on standard transactions is to prevent abuse, wouldn't using it as a redeem script be equally bad?

Due to the nature of of how redeem scripts are used, there is never any reason for a redeem script to contain anything more than simple constant values.  When an output is redeemed, the redeem script is pre-pended to the encumbrance script, and run as a single script.  Consider a transaction output that is encumbered by a script that says (in pseudo code):
+ 3 == 5
This output could be redeemed by by any script that leaves a 2 on the stack after executing.  That means it could be redeemed by scripts like 3 - 1 or 8 / 4.  However, there is no reason for the additional calculation.  Since  a redeem script only need to leave 2 on the stack, we can simply use a script that just puts 2 on the stack.
This means that any redeem script that performs calculations rather than just placing constants on the stack serves no purpose, and was probably broadcast as an attempt at a denial of service.  These scripts can be disallowed without having any negative effect on the utility of the Bitcoin network.
By contrast, limiting the variability of encumbrance scripts limits what the Bitcoin network can be used for.  This is a topic that has been hotly debated, but in general, the community does not wish to limit Bitcoin's usefulness for future applications.

What about a redeem script that wants to do something like check lock time verify, they aren't just pushing data on the stack and are still considered valid?

Let's make sure we have our terms right.  When I say "encumbrance script", I'm referring to scriptPubKey (https://bitcoin.org/en/glossary/pubkey-script), which is the part of a transaction output that locks coins on the blockchain.  When I say "redeem script", I'm referring to scriptSig (https://bitcoin.org/en/glossary/signature-script), which is part of a transaction input.  OP_CHECKLOCKTIMEVERIFY only needs to be used on scriptPubKey, even though the conditions set by it will be evaluated at the time of redemption.

However if OP_CHECKLOCKTIMEVERIFY is used in scriptPubKey, the transaction will be non-standard. But if using p2sh it can be moved to the scriptSig, and then be marked as standard

authors: Юрий Лысенков


text:
How can a block regarded as confirmed in bitcoin?
I am a little confused with confirmation mechanism in bitcoin PoW consensus.
According to bitcoin wiki:

After a transaction is broadcast to the Bitcoin network, it may be
  included in a block that is published to the network. When that
  happens it is said that the transaction has been mined at a depth of 1
  block. With each subsequent block that is found, the number of blocks
  deep is increased by one. To be secure against double spending, a
  transaction should not be considered as confirmed until it is a
  certain number of blocks deep.

Let's say if A has 1 btc, and A sent 1 btc to B as transaction T1 and also sent 1 btc to C as transaction T2. It is possible that these 2 transactions are written into 2 different branches.
In this scenario, if miner M1 keeps mining based on branch with T1 and M2 keeps mining based on branch with T2, finally subsequent block for these 2 branches will more than 6, and in most of apps these 2 transactions will be regarded as legal. I am thinking there might be other verification to make a block regarded as confirmed.
My question is: what makes a transaction confirmed? Thanks in advance.

Let's say if A has 1 btc, and A sent 1 btc to B as transaction T1 and also sent 1 btc to C as transaction T2. It is possible that these 2 transactions are written into 2 different branches.

Yes. That's possible.
But there is still no double-spend because only 1 branch will be the accepted one in the future.
Assume that there are more miners. If miners 3, 4, 5 and 6 start mining on the second branch, it grows faster.
After 2 hours, branch1 has 1200 blocks, but branch2 has maybe 1209 blocks.
The chain/branch with the most block is the relevant chain. So miner 1 does not even want to mine on his branch anymore because he knows that the others will ignore this blocks 1201, 1202, 1203.
So miner 1 also switches to branch2 because otherwise, the only wastes electricity.

Thanks for your answer. Here is my understanding: if I am wallet, I will only consider the longest chain as the valid chain, so only one chain can be regarded as valid chain and it is nearly impossible having 2 chains in the same length. Is that correct?

@Frankie the longest chain (the one with the most proof of work) is the valid chain, any other will be forgotten by the network. The protocol is designed so that miners are incentivized to all mine one chain; any divergence can have a high opportunity cost for the miners. It is not impossible to have two competing chains, but usually the losing chain does not survive more than a couple of blocks. You can look up 'orphan blocks' to learn more.


text:
Withdraw from bitcoin ATM
bitcoin noob but here goes. I have a bitcoin address (obviously) and someone has sent me bitcoins. Now I don't have a wallet just the address (public and private) in order to withdraw from an ATM or maybe even purchase stuff? Do
I have to create a bitcoin wallet as well? Sorry if that is a REALLY dumb question but I don't know too much about this stuff. Thanks guys

Not sure what you think you have. If you have a private key, you a have a wallet, albeit one with a single address. If you don't have a wallet app, you'll need one to import that private key.

By having the private key you can sweep the wallet using a desktop or mobile wallet, I recommend electrum.
If you are new to the bitcoin world, visit https://bitcoin.org that has a lot of information so you can get up to date and get out of duduas

You're just puzzling your self.
If you want to send your Bitcoin to someone or buying some product. You will need a Bitcoin wallet or you can sweep that address funds to the destination address using e.g. electrum..
I don't much about exchange or how to withdraw your bitcoin from an "ATM" but you have to check localbitcoins.com, they can exchange your bitcoins based on your country.

Get a wallet and import your privkey

Welcome to Bitcoin.SE! Short comment style answers are discouraged as they do not adequately inform an answer. Please see how do I write a good answer for more assistance.


text:
binance advanced indicator api
I know how to extract basic info like bid/ask/open/close prices on binance, but on advanced trading charts on binance I see more price indicators like EMA and I dont want to compute them from price log since they wont be 100% accurate. Is there a way to extract all indicators I see in advanced mode? Can't find any reference in APIs

Use https://taapi.io, there's a bunch of indicators (RSI, MACD, MA, EMA, TD Sequential, ATR, ADX, Bollinger Bands, Momentum, CMF etc...) that you can pull from their API. You can pull indicators from 20 different exchanges or so, including Binance.

Hi Emax, please take a look here

Emaix responded very favorably to a similar query on his other question already: https://bitcoin.stackexchange.com/questions/66738/anyone-know-of-an-api-for-rsi-and-other-indicators/87310#87310, let's give him a moment to revise this one a bit more as well.

You can extract closing price using "Export As" feature here https://www.coingecko.com/en/price_charts/bitcoin-cash/usd

unfortunately this method doesnt provide me enough data to compute all indicators I want and even EMA can be only calculated for per-day not per-hour values


text:
Is a mined block invalid as soon as another block is added/accepted?
If all the miners are working on adding to the central blockchain, what happens if a miner (A) submits their valid block just seconds after another miner's block (B) has been accepted and added to the chain?
Since the new hash-value of the last block in the chain changes with the newly accepted block (B), does that make the computed hash (A) invalid?

Blockchains can conceptually easily acquire two or more heads if blocks are solved at the same time. Eventually one of the heads will grow longer than the other, in which case the transactions in the shorter one cease to have ever happened as miners switch to working on the longer one.. This is one reason to wait for a reasonable number of confirmations (blocks on top of your block) before letting the guy drive away in the car he just paid bitcoins for :)
There's another stackexchange thread discussing the longest orphaned chain heads - What is the longest blockchain fork that has been orphaned to date?


text:
Help------ -dumpprivkey gives key connected to different address
So I bought my first bitcoin yesterday and I generated my first address which is the one I used to receive the bitcoins. Now since I am still trying to sync, I have no idea if I received these coins as I cannot access the address using the directory. I checked blockchain and it says the address received the money but I can only view it as a spectator as Bitcoin Core is giving me the wrong private key. When i bounce between commands it always comes back to this random address that it has now added to my list of receiving address'. I find this very odd as the address that received the money is part of the address' connected to my wallet, but its as if the first address was overridden or something. Do you guys think there is any hope? Any insight is much appreciated thanks

-getaccount "address A" gives account A, then -getaccountaddress "account A" gives address B. Then the account name for B is different rhen what it displayed before.

-dumpprivkey is different to -getaccount. I am pretty sure that -getaccountaddress just gives you an address for the account, not necessarily all addresses for the account. There are lots of receiving addresses pre-made by the software. -dumpprivkey {address} should work correctly if you want your priv key to import into Electrum.

I know, but shouldn't -dumpprivkey display the correct private key and not the private key to a different address? I even tried every qr code on bitaddress.org and nothing matches up. This is very odd as no one else seems to have this problem.

You can install a lightweight wallet to your phone, this will work much faster than since it doesn't need to download the full blockchain and verify it.
Then you can import the private key and you will be able to use your bitcoins.
Some options:

electrum.org
exodus.io
Mycelium
GreenAddress

Not all of them support all operating systems but together they cover Windows, Mac, Linux, Android and iOS.

Yes as soon as I figure out what went wrong and if I can access the coins on that address I will use a webwallet


text:
Mining with only 1 GPU
I have a GTX Ttan and plan on getting a GTX 1060. I want to only mine with the 1060. How would I do that. Im using sgminer v5.3.1

If you are talking about mining Bitcoin, you should really read http://bitcoin.stackexchange.com/questions/41125/is-gpu-mining-still-an-option and http://bitcoin.stackexchange.com/questions/41276/in-the-asic-age-is-it-worth-starting-mining-bitcoin-at-home before investing any time or money into this.

Mining almost any crypto-currency, including Ethereum, with just one GPU is not recommended if you are wanting to actually make profit. This segment of miners are viewed as enthusiast with the goal of just contributing to the security of the network. If you do not have these goals, it is advised to avoid mining at large.
Mining requires large amounts of electricity, GPUS, and multiple rigs (aka mining farms). Most residential home-miners will generate some amounts but will never generate enough to even break even, resulting in a negative ROI (return on investment).

Why do you want to do that? Just to learn about how mining works?
Are you interested in mining Bitcoin? According to my understanding mining for Bitcoin with a GPU is perhaps not the best allocation of resources, but maybe it's a good choice for Ethereum or some alt coin.

No not btc. Im talking about ETH.


text:
Are coin minting and difficulty level related?
I am sure this question has been answered somewhere, but most searching comes up with "how blockchain works" and other unrelated results. I am trying to verify my understanding of the theoretical end of minting new coins.
Is my understanding correct that coin minting and difficulty levels are not coupled? In other words, the difficultly level changes according to hash power, while the coin minting schedule decreases in a hard-coded way. Such that, in the end, no new coins can be minted but block difficulty would remain proportionate to hashing power of the network.
I think this is right but need to confirm before educating others about this scenario.

You're basically correct.  The rate at which block reward and thus inflation (or lack there of) is determined is by block height alone.  That is, starting from a maximum of 50 new bitcoins generated per block at height 1, and halving that amount every time 210000 blocks have been generated, the maximum amount of new bitcoins that are allowed to be generated by a generation transaction in a block eventually becomes less than one satoshi, which is the smallest unit of amount of in a coin, at which point generation of new bitcoins stop.
On the other hand, the difficulty, or technically the "Target" that a block header hash must be below (it's just a big number) is only determined by the rate at which blocks were generated during the previous 2016 blocks re-target period, starting from the very first and highest target which is also the lowest difficulty (difficulty 1) onward.
This means that difficulty (or target) can change and does go up and down as hashrate enters and leaves the network.

And because difficulty still goes up and down, but no new coins are minted, the incentive for future miners to keep hashing away would only be the transaction fees. I think this confirms my understanding. Thanks!

Well, block reward will become insignificant relative to fees a lot sooner than before it stops entirely.  At least we hope so.


text:
Has there been any cases of bitcoin being stolen without getting access to the owners private key?
With this question I want to exclude cases where someone is fooled to send BTC to a person (e.g. because social engineering or malware on their PC).
I have seen some arguments in comments to this Seeking Alpha article that claim that bitcoins cannot be stolen if their rightful owner is the only who has access to the private keys.
Has there been any cases of bitcoin being stolen without getting access to the private key?
For example: assuming that there is some exchange somewhere that allows a BTC buyer to manage their private keys outside of the exchange. Could it still be possible for e.g. a hacker to steal the BTC by manipulating the data at the exchange (outside of the blockchain).

https://bitcoin.stackexchange.com/a/115890/106894


text:
Why is it important to manage your own private keys and are there any exchanges that allow you to do that?
I was reading through the comments to this article at Seeking Alpha and a couple of them talk about the importance of choosing an exchange that allows you to manage the private keys for the cryptocurrency you have bought.
For example one comment says that

GTFO of any exchange who claims they will "vault" your assets for you,
  and move your Bitcoin into a personal wallet.

What are the potential/hypothetical consequences if an exchange does not allow you to manage your own private keys?
Are there any exchanges that allow this option?

related: https://bitcoin.stackexchange.com/questions/35702/can-an-exchange-work-which-does-not-have-control-of-the-private-keys

What are the potential/hypothetical consequences if an exchange does not allow you to manage your own private keys?

If an exchange is managing the private keys (i.e. you are not managing your own private keys), it means that the exchange controls your money. They are then like a bank; you deposited money in and got a promise that they will give you the money later when you ask for it. This means that you are trusting them to hold onto your money securely.
Because they control the private keys, they could steal your money by taking it and running away. Or if the exchange were to be hacked, the money could be stolen by hackers. Both of these scenarios have occurred in the past. In either case, your money would be gone and there would not be much that you could do about it.

Are there any exchanges that allow this option?

In the traditional sense of an exchange where you have an account and login (e.g. Bitstamp, kraken, Bitfinex, etc.), no. No exchange allows that  for multiple reasons: controlling your own private keys means that during an actual trade, you may scam the other trader by taking their money and not releasing the amount you were to pay; it also means that the exchange will work less efficiently as instead of doing trades in an internal database, trades must occur on chain.
There are decentralized exchanges which allow you to control your own private keys such as Bisq. But few people use them and there is a bit more risk involved because the other party could scam you.

Managing your own private keys means not having your cryptocurrency assets on the wallet of your exchange but in your own wallet. For example, if you store your bitcoins on some exchange website like coinbase or poloniex you don't control the private keys. Coinbase or poloniex could run away with your coins and you could do nothing about it. This is not just theory, it has happened in the past.
If you store your coins in your own wallet on your own computer with a wallet software program like Bitcoin-core or Electrum, you have full control over your private keys which means nobody except you can do anything with your coins, unless someone else gets access to your private keys by hacking or tricking you. This means you are responsible for your private keys. For example, if you lose them somehow due to a hardware failure or delete them by accident your coins are gone forever. So you have to make sure that this won't happen by taking appropriate measures (backups, secure passwords, etc.).
This is true for all cryptocurrencies alike, not only bitcoin.
So, by storing your coins on an exchange by definition you don't have control over your private keys because you did not create those private keys, that means someone else have seen them before you did.

Also if an exchange begins to deny a particular sell or purchase of any type of currency you still can still attempt to trade via another exchange. Bitconnect consumers suffered this when their exchange stopped accepting bitcoin and then eventually shut down.

1.) next to the reply from ooze, the importance of managing "my own keys" relies on the fact, that you control the funds. If you don't have the keys, then you need to trust someone, that he doesn't abuse your keys/funds. Easy as this. For low values you can easily trust someone, for high values? The history of bitcoin is full of losses due to trust issues (including exchanges going down).
There is a pitfall with managing your own keys: it requires some serious thoughts to secure them. And with high volume funds, you immedeatly come into the cold storage topic, requiring you to spend some time for the  process on it. I just posted a generic answer here.
2.) yes, there are exchanges to give you "your" privkey. Blockchain.info for example. With bitcoin and ethereum. I haven't seen it (yet?) in BitTRex, nor in HitBTC, nor in Binance. Gatehub allows you to export for Ripple wallet. I leave the other options for the audience to contribute.

I really wouldn't classify blockchain.info as an exchange though. Apart from their broken BTC -> Bcash, they don't really allow any form of trading on their platform

Looking for an answer (or additional clarification) to this question in the original post: Do any Bitcoin exchanges work so that the customer is the only one with the private keys?

I have not seen any Bitcoin exchanges that allow you to have exclusive (when compared to them) the private keys of your wallets with them. In the event that a Bitcoin Exchange is objectively honest and honorable, letting you control your private keys could be seen as a liability that you could then blame on them.  The reason is if you claim they mismanaged your private keys when they also gave you copies of them, how can they determine, as an organization whether they have someone in their ranks stealing them or if you are trying to scam them or if the leak was on your side.  They don't know if someone hacked your computer and stole your bitcoin, nor would you necessarily know.
They would also be unable to control your coins for trades due to you having the private keys, so they wouldn't be able to send your coins elsewhere which would defeat the purpose of their platform.  Yes, they could just let you send to a particular address to complete a transaction, but then you have to wait for the bitcoin network for the exchange to complete and then the exchange either can't take their "cut" of the transaction, or it would require you pay a transaction fee to the bitcoin network just to send it to the exchange (which would probably cost you more than transferring on the exchange) and pay the exchange a cut, which isn't really worth it.  That's in addition to taking maybe 1-2 hours for your transaction to the exchange to be confirmed by the Bitcoin network, and the person on the other end of your trade likely is unwilling to wait that long.

No, none. Every bitcoin exchange as of now can see your private keys.
Such an exchange cannot exist for fiat.
Crypto-to-crypto exchanges can possibly do it.

The problem with building such an exchange is that since the exchange is not controlling the money, it is to be controlled by a system of smart contracts that let you atomically swap. Setting up these series of contracts(eg opening a payment channel) takes a lot of time and discovery of bids is slower too.
As a result decentralised exchanges are supposed to be very slow.

I don't know about any Bitcoin exchanges, but for Ethereum you can do this with decentralized exchanges like Idex.market and EtherDelta.