Bitcoin state, in a handful of hashes.
Utreexo represents the entire UTXO set as a small forest of Merkle trees. Nodes validate every block against a few root hashes instead of gigabytes of coins, small enough for a phone or a single-board computer, without giving up full validation.
3 roots commit to 11 leaves. The tree sizes (8, 2, 1) follow the binary form of the leaf count. A compact node stores only the green roots and the branches are reconstructed from proofs when a coin is spent.
The problem it solves
Every Bitcoin node keeps a full copy of the UTXO set (the set of unspent coins) to check that a spend is valid. That shared state grows as the network grows, and its size raises the hardware cost of running a node for everyone. Utreexo decouples the network’s state from each machine’s storage: the accumulator is logarithmic in the size of the set, so it stays tiny even as the UTXO set expands.
How it works
Four ideas, and that’s most of it.
UTXOs are leaves in perfect binary Merkle trees. A node keeps only the root hash of each tree: a few dozen 32-byte hashes for the whole set.
To spend a coin, its owner presents a Merkle proof. Anyone can check it against the roots, then discard it. The proof is only needed at spend time.
New outputs are appended and spent ones removed by recomputing only the roots along the affected branches. The rest of the forest is untouched.
A prover (bridge) holds the full forest and generates proofs. A verifier holds only the roots. It validates everything but can’t prove on its own.
Node roles
The same consensus rules, different amounts of state. Every role below fully validates blocks and scripts.
| role | state kept | serves proofs | good for |
|---|---|---|---|
| Compact State Node (verifier) | accumulator roots only | no | full validation on phones and single-board computers |
| Bridge (prover) | the full Merkle forest | yes | serving proofs to compact nodes; wallet and app backends |
| Archive | full chain + forest | yes | historical queries and bootstrapping new peers |
Floresta runs as a Compact State Node; utreexod can run as either a compact or an archival node.
The trade-off
Utreexo moves cost from storage to bandwidth. You stop holding the UTXO set, and in exchange proofs travel with the data. The exchange is heavily in your favour on constrained hardware.
Bars are illustrative, not linearly to scale. Transaction-relay overhead is higher in the worst case but drops sharply with proof caching. A practical compact node (with pruning and PoW fraud proofs) keeps on-disk state under a gigabyte.
Implementations
Open-source software you can run and build on today.
| project | language | what it is | repo |
|---|---|---|---|
| Floresta | Rust | lightweight full node (CSN) with an Electrum server | getfloresta/Floresta |
| utreexod | Go | fully validating node with Utreexo support | utreexo/utreexod |
| utreexo | Go | the reference accumulator library | utreexo/utreexo |
| rustreexo | Rust | accumulator library (prover + Stump verifier) | mit-dci/rustreexo |
Peers advertise Utreexo support with the NODE_UTREEXO service bit (0x1000). Node roles and wire messaging are being specified in the Utreexo BIPs, which are still a work in progress.
Resources
Start with the paper; follow the network on the status page.