The EUTxO Model

The EUTxO Model

An Accounting Model: Distributed Ledgers and Blockchain Consensus Algorithms

“Any fool can know. The point is to understand.” — Albert Einstein

What is EUTxO?

EUTxO abbreviates: "Extended Unspent Transaction Output", but to understand the extended model, we must first examine the unextended model (UTxO, firstly implemented by BitCoin).

UTxO Explained

"If you want to get money, you have to consume an output that is laying around and in turn you get more outputs." — Michael Peyton-Jones

What are unspent transaction outputs? Simply put: They are outputs - which can be thought of as remaining financial change - from previous transactions on the Blockchain that are still currently 'unspent' - Imagine you go to a shop, you buy a drink, you give the shopkeeper a £20 note, and you are given £19 back in change. That £19 is an unspent transaction output from the original transaction of the purchase of a drink.

UTxO is a model of accounting and is used to identify how much money (in this case: a digital 'currency') any 'wallet' on a blockchain data structure has the ability to spend. Each wallet address on a permissionless blockchain such as BTC is associated with a set of cryptographic 'tools' which lock any funds (BTC, Digital Currency) that are tied to the above-mentioned wallet. Spending funds (e.g. sending BTC from one wallet to another) equates to the transfer of ownership of BTC from one private key owner to another. This is accomplished by signing a transaction with the initiator private key, which can only be confirmed by verifying the signature using the initiator's public key.

It is important to note that you can only use complete UTxOs as input. So, if Alice has 100 BTC and wishes to send 10 BTC to Bob, Alice creates a transaction that consumes 100 BTC as input and creates two outputs, 90 BTC (for Alice) and 10 BTC (for Bob). This is similar to the example mentioned above regarding the use of a £20 note.

You would therefore think that the sum of all input for any give Tx must equal the output, such that:

\( \sum_{i=0}^{X} Tx_{i} = \sum_{o=0}^{Y} Tx_{o} \)

However, this is not the case. Firstly, transaction fees must be considered. Furthermore, on Cardano (that implements the EUTxO model, uses ADA and not BTC) native tokens have been rolled out. Thus, minting and burning of native tokens create an imbalance between the cumulative inputs and resulting outputs of a transaction. However, this is content for later lecture (according to Lars).

Note: This is all accomplished through the use of software wallets implementing transaction algorithms. Furthermore, technically BTC does implement basic 'smart contracts', which is to say, the transactional algorithms may utilise BitCoin Script (which includes a validator - the padlock securing the unspent transaction output - and a redeemer to unlock the ability to spend said output). As far as I understand, BitCoin Script is essentially a wrapper for managing a public-private key cryptographic implementation and unlocking funds to spend through the use of digital signatures.

Advanced Transactions Using UTxO

The extended implementation of UTxO as proposed by IOHK (developed and implemented by Cardano) is much more powerful than the standard UTxO model. However, there exist 'advanced' payment system elements implemented by the 'basic' UTxO model. It is important to understand how multiple unspent transaction outputs whose keys reside within different wallets (essentially: different owners of BTC) can combine their UTxOs together to create a transaction output to be sent to an individual address.

Consider the scenario where Bob has 60 BTC (in the form of two UTxOs: 50 BTC and 10 BTC) and Alice has 90 BTC in the form of a single UTxO. However, they wish to send 110 BTC to Tom. Alice must consume her (only) UTxO and Bob must consume both his UTxOs to meet the required amount to be sent to Tom (creating three transaction inputs from two owners with three unspent transaction outputs).

Within this 'advanced' transaction, the outputs generated by the initiated transaction ensures Tom receives 110 BTC and all other parties (Alice and Bob) receive their change by splitting the resulting output such that they receive the following:

\[ Given: Tx^{Alice} = \ 90 \ BTC\ \ and \ \sum_{i=0}^{X} Tx_{i}^{Bob} = 60 \ BTC \] \[ Alice \ And \ Bob \ Pay \ Tom \ 110 \ BTC \ | \ Thus \ Change \ Recieved \ By \ Alice \ and \ Bob \] \[ = \] \[ \big(Alice \ | \ Tx^{Alice} - (110 \div 2) \ \big) = 35 \ BTC \] \[ \big(Bob \ | \ \Big[ \sum_{i=0}^{X} Tx_{i}^{Bob} \Big] \ - (110 \div 2) \ \big) = 5 \ BTC \]

And God Said Let There Be EUTxO

As you may have guessed, I am currently spending a lot of time learning about Cardano, which implements an extended model of UTxO. The fundamentals remain the same. Thus, transactions are made up of numerous inputs, which themselves are unspent transaction outputs. However, there are some modifications to the model which are important. These modifications allow for more sophisticated transactions through the use of executing arbitrary logic instead of simply transferring ownership of native funds.

Firstly, Cardano implements addresses differently from other cryptocurrencies (blockchains and distributed ledger technologies). Instead of using a simple hash-based derived address (using a public key as input), addresses in Cardano are generated using a derivation scheme outlined here. These addresses are referential in nature and point to scripts containing more complex logic than what you may find in a BTC validator. These scripts are programmes that are (ideally) deterministic, pure, replayable state-machines. They are, however, still used to determine whether a given UTxO may be consumed based on: the redeemer, something called datum and something else called context (read more about that here).

As mentioned, transaction outputs contain a component called 'datum'. Being able to implement state in a series of transactions, which contain arbitrary logic means that the EUTxO model has been proven to be at least as powerful as the ETH accounting model.

EUTxO Advantage: Validation of UTxO Off-Chain

It is possible to check that a transaction will validate within your wallet before ever sending it to the chain.

However, Simultaneous UTxO Consumption Is Possible

Unspent transaction outputs can be consumed by others before your transaction has the opportunity to reach the chain (after being verified by your wallet software). In this instance, your transaction will simply be dropped back into the pool of transactions to be verified (so long as all the inputs are still there) and attempts to verify your transaction will continue.

Scope: EUTxO Model Scripts, Redeemers and Datum

The implementation of scripts within the EUTxO model ensures that the scope is limited to the transaction (or a small chain of transactions) that are attempting to be facilitated by a user. This means the state of the entire blockchain does not need to be known (as is the case with ETH). Furthermore, there is an appropriate degree of scope that enables to ability to create smart contracts which are (ideally) deterministic in nature, meaning: the output is predictable. This makes it much easier to test and a lot more difficult to introduce bugs into the software.

As I learn more about Cardano, and other similar technologies, I'll continue writing about it/them and posting.


Simmons, G.F., 2003.
Precalculus mathematics in a nutshell: geometry, algebra, trigonometry.
Wipf and Stock Publishers.

Antonopoulos, A.M., 2014.
Mastering Bitcoin: unlocking digital cryptocurrencies.
O'Reilly Media, Inc.

Nakamoto, S., 2008.
Bitcoin: A peer-to-peer electronic cash system.
Decentralized Business Review, p.21260.

Pardalos, P., Kotsireas, I., Guo, Y. and Knottenbelt, W., 2020.
Mathematical Research for Blockchain Economy.
Springer International Publishing.

Zahnentferner, J. and HK, I.O., 2018.
An Abstract Model of UTxO-based Cryptocurrencies with Scripts.
IACR Cryptol. ePrint Arch., 2018, p.469.

Pérez-Solà, C., Delgado-Segura, S., Navarro-Arribas, G. and Herrera-Joancomartí, J., 2019.
Double-spending prevention for bitcoin zero-confirmation transactions.
International Journal of Information Security, 18(4), pp.451-463.

Antonopoulos, A.M., 2017.
Mastering Bitcoin: Programming the open blockchain.
O'Reilly Media, Inc.

Show Comments