How Cryptocurrency Works

Write the ledger

Go: open a terminal in a folder you can write to, e.g. cd ~/Desktop (Windows: cd %USERPROFILE%\Desktop).

Do: save this as ledger.py. It prints nothing yet. Read the three checks in apply: a valid signature, a transaction number not used before, and enough coins.

from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.exceptions import InvalidSignature

class Ledger:
    def __init__(self, balances):
        self.balances = dict(balances)
        self.used_numbers = set()

    def apply(self, tx, signature, public_key):
        message = f"{tx['from']}->{tx['to']}:{tx['amount']}#{tx['number']}".encode()
        try:
            Ed25519PublicKey.from_public_bytes(public_key).verify(signature, message)
        except InvalidSignature:
            return "REJECTED: signature does not match"
        if (tx["from"], tx["number"]) in self.used_numbers:
            return "REJECTED: this transaction number was already used"
        if self.balances.get(tx["from"], 0) < tx["amount"]:
            return "REJECTED: not enough coins"
        self.balances[tx["from"]] -= tx["amount"]
        self.balances[tx["to"]] = self.balances.get(tx["to"], 0) + tx["amount"]
        self.used_numbers.add((tx["from"], tx["number"]))
        return "ACCEPTED"

You should see: nothing. python3 ledger.py should return to the prompt in silence.

If not: ModuleNotFoundError: No module named 'cryptography' means the library is missing — run pip install cryptography and read its last line if it fails.

Make one honest payment

Go: same folder.

Do: save this as pay.py and run python3 pay.py.

import hashlib
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives import serialization
from ledger import Ledger

key = Ed25519PrivateKey.from_private_bytes(hashlib.sha256(b"alice").digest())
pub = key.public_key().public_bytes(serialization.Encoding.Raw,
                                    serialization.PublicFormat.Raw)

book = Ledger({"alice": 100, "bob": 0})
tx = {"from": "alice", "to": "bob", "amount": 30, "number": 1}
sig = key.sign(f"{tx['from']}->{tx['to']}:{tx['amount']}#{tx['number']}".encode())

print("result :", book.apply(tx, sig, pub))
print("alice  :", book.balances["alice"])
print("bob    :", book.balances["bob"])

You should see: thirty coins move:

result : ACCEPTED
alice  : 70
bob    : 30

Nothing was “sent” anywhere. A payment is an instruction, signed by the payer, that every node applies to its own copy of the balances. That is the entire mechanism — and it is why the network needs no bank to move value between strangers.

If not: REJECTED: signature does not match means the message built for signing differs from the one apply rebuilds — the two f-strings must be identical, including the arrow and the hash sign.

Attack it four ways

Go: same folder. Replay a payment, overspend, and impersonate.

Do: save this as attack.py and run it.

import hashlib
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives import serialization
from ledger import Ledger

def keypair(name):
    k = Ed25519PrivateKey.from_private_bytes(hashlib.sha256(name.encode()).digest())
    return k, k.public_key().public_bytes(serialization.Encoding.Raw,
                                          serialization.PublicFormat.Raw)

alice, alice_pub = keypair("alice")
mallory, mallory_pub = keypair("mallory")

book = Ledger({"alice": 100, "bob": 0, "carol": 0})

def send(sender_key, sender_pub, tx):
    sig = sender_key.sign(f"{tx['from']}->{tx['to']}:{tx['amount']}#{tx['number']}".encode())
    return book.apply(tx, sig, sender_pub)

print("1 alice sends 30 to bob      :",
      send(alice, alice_pub, {"from": "alice", "to": "bob", "amount": 30, "number": 1}))
print("2 the same transaction again :",
      send(alice, alice_pub, {"from": "alice", "to": "bob", "amount": 30, "number": 1}))
print("3 alice spends 90 she no longer has:",
      send(alice, alice_pub, {"from": "alice", "to": "carol", "amount": 90, "number": 2}))
print("4 mallory spends alice's coins:",
      send(mallory, mallory_pub, {"from": "alice", "to": "mallory", "amount": 50, "number": 3}))
print()
print("balances:", book.balances)

You should see: three attacks stopped and, if you read to the end, one that was not:

1 alice sends 30 to bob      : ACCEPTED
2 the same transaction again : REJECTED: this transaction number was already used
3 alice spends 90 she no longer has: REJECTED: not enough coins
4 mallory spends alice's coins: ACCEPTED

balances: {'alice': 20, 'bob': 30, 'carol': 0, 'mallory': 50}

Lines 2 and 3 are the two attacks people expect a cryptocurrency to stop, and the ledger stops them: the transaction number is why the same signed payment cannot be broadcast twice, and the balance check is the double-spend defence. Line 4 is the problem.

If not: if line 4 says REJECTED, you have already fixed the flaw — compare your apply with step 1, which deliberately contains it.

Work out why the theft succeeded

Go: no new file. Read apply in step 1 and answer before continuing: Mallory signed correctly, so the signature check passed — but signed what, and with whose key?

Do: look at the two places tx["from"] is used. The ledger takes the sender’s name from the transaction, and the key to check against from the same message. Mallory wrote "from": "alice", signed that with her own key, and handed over her own public key — so the signature genuinely matches, and the ledger never asks whether that key has anything to do with Alice.

You should see: the flaw stated in one sentence: the account name was claimed by the sender rather than derived from the key. Anyone can claim to be anyone.

This is not a contrived bug. It is exactly the mistake that appears in home-made authentication of every kind — trusting a name the caller supplied alongside a proof that is valid for a different name entirely.

If not: if the reasoning has not landed, add print(tx["from"]) and a print of public_key.hex()[:16] inside apply, then re-run attack.py. You will see line 4 arrive with Alice’s name and Mallory’s key.

Fix it the way real blockchains do

Go: same folder. The fix is to stop accepting a claimed name: derive the account from the public key, so the two cannot disagree.

Do: save this as ledger2.py.

import hashlib
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.exceptions import InvalidSignature

def address_of(public_key: bytes) -> str:
    """The account name IS derived from the key. It cannot be chosen."""
    return hashlib.sha256(public_key).hexdigest()[:12]

class Ledger:
    def __init__(self, balances):
        self.balances = dict(balances)
        self.used_numbers = set()

    def apply(self, tx, signature, public_key):
        sender = address_of(public_key)              # not tx["from"] -- derived, not claimed
        message = f"{sender}->{tx['to']}:{tx['amount']}#{tx['number']}".encode()
        try:
            Ed25519PublicKey.from_public_bytes(public_key).verify(signature, message)
        except InvalidSignature:
            return "REJECTED: signature does not match"
        if (sender, tx["number"]) in self.used_numbers:
            return "REJECTED: this transaction number was already used"
        if self.balances.get(sender, 0) < tx["amount"]:
            return f"REJECTED: {sender} does not have {tx['amount']} coins"
        self.balances[sender] -= tx["amount"]
        self.balances[tx["to"]] = self.balances.get(tx["to"], 0) + tx["amount"]
        self.used_numbers.add((sender, tx["number"]))
        return f"ACCEPTED (from {sender})"

Now save this second file as fixed.py and run python3 fixed.py:

import hashlib
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives import serialization
from ledger2 import Ledger, address_of

def keypair(name):
    k = Ed25519PrivateKey.from_private_bytes(hashlib.sha256(name.encode()).digest())
    return k, k.public_key().public_bytes(serialization.Encoding.Raw,
                                          serialization.PublicFormat.Raw)

alice, alice_pub = keypair("alice")
mallory, mallory_pub = keypair("mallory")

book = Ledger({address_of(alice_pub): 100})
print("alice's address  :", address_of(alice_pub))
print("mallory's address:", address_of(mallory_pub))

def send(key, pub, tx):
    sender = address_of(pub)
    sig = key.sign(f"{sender}->{tx['to']}:{tx['amount']}#{tx['number']}".encode())
    return book.apply(tx, sig, pub)

print("alice sends 30 to bob   :", send(alice, alice_pub, {"to": "bob", "amount": 30, "number": 1}))
print("mallory spends alice's  :", send(mallory, mallory_pub, {"to": "mallory", "amount": 50, "number": 1}))

You should see: the theft refused, and refused for the right reason:

alice's address  : 1c0c490f1b55
mallory's address: 1972da52ab08
alice sends 30 to bob   : ACCEPTED (from 1c0c490f1b55)
mallory spends alice's  : REJECTED: 1972da52ab08 does not have 50 coins

Notice there is no longer a "from" field at all — there is nothing to lie about. Mallory can still sign anything she likes; she simply signs it as herself, because her key produces her address and no other. This is why a cryptocurrency address is a hash of a public key rather than a username you pick. Identity is not asserted and checked; it is computed.

If not: REJECTED: signature does not match on Alice’s own payment means the message built in send differs from the one rebuilt in apply — both must start with the derived sender, not with a name.