Six reasons why EUTXO wins

Cardano features some of the most innovative elements of blockchain technology: Hydra and Mithril, for example – layer 2 solutions designed to enhance scalability. Or Cardano’s proof-of-stake consensus protocol, Ouroboros, whose various 'flavors' (Genesis, Praos, Peras, etc) ensure that the blockchain remains efficient and secure even under adversarial conditions.

But there's one particular element that sets Cardano apart from contemporaneous chains – the extended unspent transaction output (EUTXO) accounting model. Introduced during the Alonzo upgrade in September 2021, EUTXO combines the relative semantic simplicity of the 'basic' UTXO pioneered by Bitcoin with enhanced expressiveness through smart contracts. This combination enables Cardano to achieve certain things that blockchains using account-based models simply cannot match due to constraints in their design. 'UTXO-based programmability enables functionalities and use cases not feasible on account-based ledgers. For example, multi-threaded order book trading engines, horizontal scaling via state channels layer 2s, and efficient ZKP interoperability and oracle solutions,' says Marvin Bertin, CEO at Maestro, a blockchain infrastructure provider tailored for UTXO chains.

Here’s an analogy to help illustrate the difference in the models. Think of the UTXO model (like Bitcoin or Cardano) as managing money with a jar of individual coins. Each coin in your jar represents a specific value. When you want to spend, you pick the right coins to cover that amount. So if you’re paying $8, for example, and you have coins worth $5, $3, and $1, you could choose the $5 and $3 coins to cover it. If you go over, you get change back in smaller denomination coins, which goes back into your jar as new coins. So, your total balance is just the sum of all the coins in your jar, each tracked separately.

On the other hand, the account-based model is more like a regular bank account. Here, you don’t worry about individual coins; you just have a single balance. It’s one number that goes up or down. If you have $50 in your account and spend $8, your balance just drops to $42. There’s no need to match specific coins or worry about change – it’s all just one total.

EUTXO differs in many ways from the account-based model, but the two main differences are:

• Locality: Transactions in the EUTXO model depend exclusively on the inputs and outputs consumed and generated by that transaction. In contrast, transactions in the account-based model can be affected by other things going on on the blockchain.
• Determinism: Transactions in the EUTXO model are fully deterministic. That means we know what a transaction is going to do before submission, and nothing can change it. In contrast, transactions in the account-based model can yield unexpected results.

So why do these differences matter? What does EUTXO do for Cardano, and why do we think it’s better than the account-based model?

1. Predictable transactions

‘Users know precisely what the transaction will do on the blockchain before submitting it. This is a fantastic property for both smart contract developers and end users because everyone can submit transactions without fear of being charged for a failed transaction or resulting in unexpected outcomes on the blockchain (ie loss of funds). This means that the outcome of a successful transaction is always exactly what the user expects and consented to via their signature. As long as a transaction succeeds, its outcome cannot be affected by any other transactions on the network, and if the transaction fails, no fees are paid,’ says Anastasia Labs’ Philip DiSarro. ‘An added benefit of this property is that Cardano is not subject to issues arising from Maximal Extractable Value (MEV) and so-called 'sandwich attacks', something that it's all too common in account-based chains.’

The worst that can happen is that two users try to consume the same input simultaneously. In that case, the second transaction would have a different effect than the one described (it wouldn't consume one of the specified inputs because it's not there anymore), so it'd be instantly rejected without any cost, and the user can try again with a different input.

2. Predictable transaction costs and resource usage

EUTXO's deterministic design represents a marked advantage over other accounting models since transaction fees for a valid transaction can be accurately calculated. That means end users will know exactly how much the transaction will cost before submitting it to the blockchain. This is in stark contrast with other chains, where transaction fees can change quite dramatically before the transaction is posted. The same applies to resource (CPU time and memory, for example) usage, which can be predicted prior to executing the transaction.

3. Concurrency and scalability

If we have many transactions that consume different inputs (which is the case most of the time), we know—thanks to the locality property—they won't affect each other. That means we can process all of them simultaneously, greatly enhancing throughput and scalability. Parallel processing is especially useful for high-demand DApps like decentralized exchanges (DEXs), which need to handle many transactions quickly. Besides the big boost we get from being able to process transactions concurrently, locality and determinism allow for scalability solutions like Hydra that can't be implemented on account-based systems.

4. Improved security

Determinism and locality properties of EUTXO greatly reduce the number of all possible attack vectors and make it a lot easier for developers to reason about what is happening. That means that it is much easier to ensure the security of smart contracts in Cardano than their counterparts in account-based models. It is very difficult to reason about the correctness of protocols on the account-based model due to the complexity of global state. It also means it's easier to prove the correctness of smart contracts, which is highly appreciated in the context of managing valuable assets.

5. Improved flexibility

The EUTXO model is more flexible than the account-based model. To illustrate this, you could simulate the account model with EUTXO and vice versa. This greater flexibility allows DApp developers to create new architectures and ways of doing things that can't be achieved using the account-based model.

‘The sheer composability of EUTXO style DApps means no DApp is an island - they can be synergistically composed to create possibilities TradFi only dreams about,’ says @__fallen_icarus, who’s currently building a P2P DeFi wallet for Cardano. ‘EUTXO model DeFi is more than the sum of its parts. But to achieve this, DApps and wallets need to be specifically designed for the EUTXO model - no more copying account model DApps and wallets! The P2P-DeFi Wallet and the P2P-DeFi Protocols are a first attempt at bringing these fantasies to life.’

IO Education’s Robertino Martinez adds: ‘for example, DEX users can sign dozens of transactions consuming different UTXOs accepting different trades, and an off-chain algorithm can mix and match them to optimize for any metric the user cares about. Providing dozens (or hundreds, for that matter) of signed transactions bears no risk for the end user because the transactions will always produce the desired result, or the chain will reject them. However, it has the powerful advantage that they can all be executed automatically at optimal times, even if submitting them all simultaneously at 3 am is the best option. This procedure can't be done in account-based blockchains since their transactions aren't fully deterministic, and submitting one transaction could invalidate all others.’

6. Best choice for zero-knowledge proofs

The EUTXO model is perfect for zero-knowledge proofs (ZKPs), as they allow you to perform complex, high-intensity computation off-chain and produce a proof of that computation verifiable on-chain. For instance, you could execute a smart contract off-chain and then provide a proof that the smart contract was executed in a given state. This proof can be verified on the network. Importantly, to utilize this method of zero-knowledge scaling, to construct the proof you need to know in advance the state against which you are executing the computation. Due to EUTXO’s transaction predictability, this is trivial, since the only input required to evaluate the computation is the transaction itself.

In contrast, because transactions on account-based models operate on the global state, while constructing transactions you do not have knowledge of the relevant state required to construct the proof. Also, you don’t know what the state of the smart contract will look like by the time the transaction is processed because other transactions that are processed in the block can impact that state. So for instance, if you create a proof that a smart contract was executed on a given state, when you submit that proof to the network, the proof will likely be invalidated since by the time your transaction is processed the state (that you used to construct the ZKP) would have already changed due to other transactions.

Conclusion

EUTXO’s unique approach of tracking individual ‘coins’ allows for more precise control, predictability, and parallel processing. This design not only boosts security but also supports complex, multi-party transactions with a high degree of reliability and flexibility. Ultimately, each model has its strengths, but we believe EUTXO is particularly well suited for the demands of decentralized applications and multi-asset support. It’s a deliberate design decision that we believe is one of Cardano’s many superpowers.

Further reading

Thanks to Dr Lars Brunjes, Robertino Martinez, Marvin Bertin, Fallen Icarus, and Philip DiSarro for their contributions to this piece. To read more, Input | Output has previously published reference material about EUTXO, including a blog series, a handbook, and the EUTXO whitepaper. You can also check out the UTXO Alliance, an organization of like-minded souls, co-founded by Input | Output. The Alliance has just welcomed a new member, HathorNetwork, a scalable blockchain for digital assets.