Revision — Why Ethereum Exists

You have now read the whole why of Ethereum. Not a line of it required you to know an opcode, a gas cost, or how a block gets finalized — and that was the point. This part built one argument, in four moves, and every part that follows is machinery that pays for it. Before you meet that machinery, it is worth holding the four moves in your head at once, because once you can recite them from first principles, “smart contract” and “world computer” stop being slogans and become the only reasonable thing to build.

So this page re-tells the argument as a single story, with no new claims. If a step feels shaky, the page it came from is linked inline — go re-read it before moving on, because the rest of the book leans hard on all four.

The one question, restated

Everything in this book answers a single question, and this part exists to make you feel it:

How do untrusting strangers agree on the state of a shared world computer — and what does it cost to run one?

Each clause is load-bearing, and each of this part’s pages defends one of them. Untrusting strangers forbids a trusted server. Agree demands that every participant compute the identical result. A shared world computer — not merely a ledger of coins — is the leap. And what does it cost is the thread that runs from here straight to the gas schedule, because a public machine that runs anyone’s code cannot run it for free.

Move 1 — a ledger is already a state machine

The frame came first, on A Ledger Is Already a State Machine. Strip a blockchain of its mystique and what remains is a plain, familiar object: a state machine. There is a current state — the world as it stands — and a transition function that takes that state and a transaction and returns the next state.

    stateₙ ──apply(tx)──▶ stateₙ₊₁
      │                      │
  state_root            state_root'   (a fingerprint that changes iff the state did)

Three properties of that function do all the work, and they are worth naming precisely because the entire book depends on them:

• Shared state. Every participant is talking about one world, not their own private copy. When Alice pays Bob, both of them — and every stranger watching — must agree afterwards on both balances.
• A deterministic transition function. Feed the same state and the same transaction to the function and you get the same next state, every time, on every machine, forever. No randomness, no wall-clock, no “it depends on the node.” This is the non-negotiable core: determinism is what lets strangers agree without trusting each other, because each can re-run the function and check.
• Strangers computing the same next state. Because the function is deterministic and the inputs are public, anyone can independently reach the identical result. Nobody has to trust an authority’s word for the new balances; they recompute and see for themselves.

The companion crate makes this literal. Its entire chain is one function — WorldState::apply — and everything else (accounts, the VM, the hash of the world) exists only to feed and fingerprint it:

// The state-transition function, in one signature.
// Given the world and a transaction, produce the next world (or reject the tx).
pub fn apply(&mut self, tx: &Transaction) -> Result<Receipt>;

Once you see a ledger this way, “run a program on the ledger” is no longer exotic. A program is just a more expressive transition function. That reframing is the hinge the other three moves swing on.

Move 2 — Bitcoin’s limits are deliberate, and they cost something

Bitcoin’s Deliberate Limits took the frame and asked: how expressive can the transition function be before it becomes unaffordable to verify? Bitcoin’s answer is a scripting language, Script, that is deliberately not Turing-complete. It has no unbounded loops and no way to jump backwards; every script runs a bounded number of steps and then stops.

That is not a bug or an oversight — it is a design decision, and it buys a very specific property: every verifier can always afford to check every transaction. Because a Bitcoin script provably halts (you can see it will terminate just by reading it), no honest node can be tricked into an infinite loop by a hostile transaction. The public verifier is safe by construction.

The trade is exactly as sharp. What Bitcoin buys in guaranteed-cheap verification, it pays for in expressiveness:

   Turing-completeness           what you GAIN               what you LOSE
   ────────────────────────────────────────────────────────────────────
   Bitcoin: NO      (Script)     verifier always affords     can't express
                                 to check; provable halting   arbitrary logic
   Ethereum: YES    (the EVM)    arbitrary programs           halting is now
                                                              unprovable in advance

The lesson to carry forward: you cannot get arbitrary programmability for free. Bitcoin bought safety by giving up expressiveness. Ethereum will want the expressiveness back — and that decision creates a bill that the next two moves are entirely about paying.

Move 3 — generalize the ledger into a world computer

Generalizing the Ledger into a World Computer took the leap that Vitalik Buterin’s 2013 whitepaper made: keep move 1’s deterministic transition function exactly as it is, but let the “program” it runs be arbitrary code against mutable, shared storage.

The whitepaper’s claim, stripped to its core, is startling in its simplicity: build one computer that everyone shares and no one owns. Not a computer in a company’s data center that you rent. Not a distributed system with an admin who can push an update. A single logical machine whose state is agreed by mutually distrusting parties, whose code — once deployed — no one can quietly change or switch off, precisely because changing it would require every stranger to agree to a different next state, which the deterministic function will not allow.

That change in ambition drags a completely different substrate behind it:

   BITCOIN                              ETHEREUM
   a ledger that moves value            a ledger that runs programs

   state = the set of unspent coins     state = every account + its storage
   spending conditions (Script)         arbitrary code (the EVM)
   provably halts                       may loop forever
   finished when the coin moves         remembers and evolves forever

“Ownerless” is the word that carries the weight. A world computer is not fast, cheap, or private — it is something stranger and more specific: a machine whose state no single party controls. That is the whole source of its value (no one can censor or rewrite it) and, as move 4 shows, the whole source of its cost.

Move 4 — ether must exist as fuel

Move 3 handed us a problem it could not solve on its own, and Ether as Fuel is the answer. The moment you allow arbitrary code, you inherit the halting problem: in general, no one can prove in advance whether a given program will ever stop. Bitcoin dodged this by forbidding the loops that cause it. Ethereum allows the loops — so a hostile contract could, in principle, spin forever and freeze every node on Earth that tried to execute it.

You cannot prove termination for arbitrary code. But you can make non-termination unaffordable. That is what gas does. Every operation the machine performs costs a small amount of gas; the sender puts up a finite budget; when the meter hits zero, the machine halts, whether or not the program was “done.”

   the halting problem            gas's answer
   ───────────────────────────────────────────────────────────
   "will this program stop?"      don't ask. Give it a finite
   (undecidable in general)       budget; when the fuel runs
                                  out, it stops. Always.

This turns an unsolvable logic question into a solved economic one. You never prove a program terminates — you simply guarantee that an infinite loop bankrupts its sender long before it exhausts anyone else’s patience. The companion crate’s mini-EVM does exactly this: the meter can never go negative, and an out-of-gas run is a hard, deterministic halt.

// Every op pays before it acts, so the meter can never go negative.
// When the budget can't cover the next op, the machine halts — always.
let charge = |gas: &mut u64, cost: u64| -> Result<(), VmError> {
    if *gas < cost {
        Err(VmError::OutOfGas { used: gas_limit, limit: gas_limit })
    } else {
        *gas -= cost;
        Ok(())
    }
};

But taming the halting problem is only half of why ether must exist. The other half is rationing an ownerless resource. A world computer that no one owns is also a world computer whose CPU, memory, and permanent storage belong to everyone and no one. Without a price, there is nothing to stop a single actor from consuming all of it — a tragedy of the commons at planetary scale. Gas, priced in ether, is the meter that rations the shared machine: you pay for exactly the work you impose on every other participant, so the scarce, collectively-owned resource is allocated by willingness to pay rather than by whoever spams hardest.

By the numbers — why “remember” is the dearest verb

This part quotes almost no figures on purpose — a why page that leans on volatile numbers ages badly — but one durable contrast captures the whole cost story. Gas amounts are protocol constants and stable across recent forks as of 2024 (the fee in dollars is not, which is exactly why we quote gas, not price).

   plain value transfer       :  21,000 gas   (the floor for including any tx)
   write a NEW storage slot    :  ~20,000 gas   (every node persists it forever)
   a simple arithmetic op      :  ~3 gas

   lesson: the costliest thing a world computer does is REMEMBER,
           because remembering is a burden it imposes on every stranger,
           essentially forever.

Cost tracks the burden an operation dumps on every participant. Arithmetic is fleeting and nearly free; a new permanent storage slot is dear because it enlarges the world that every node must carry from now on. That single pattern is the seed of the entire fee model — planted here, harvested in Gas & Fees.

The four moves as one breath

Read the chain end to end and the dependencies are impossible to miss — remove any one link and the argument collapses:

1. A ledger is already a state machine: (world, tx) → world', deterministic, so strangers can agree by recomputing rather than by trusting. (This is the frame.)
2. Bitcoin deliberately caps that machine — no loops, provable halting — so a public verifier can always afford to check every transaction. (This is the ceiling, and its price.)
3. Ethereum raises the ceiling: keep the deterministic function, let the program be arbitrary code against shared storage — one computer everyone shares and no one owns. (This is the leap.)
4. Arbitrary code can loop forever and its halting is unprovable, and its resources belong to no one — so ether is the fuel: metering tames the halting problem and rations an ownerless commons. (This is the bill the leap creates.)

Frame → ceiling → leap → bill. Move 2 is why the leap in move 3 is genuinely hard, and move 4 is the only way to make that leap survivable. That is why the pages are ordered as they are, and why “fuel” must come after “generalize to arbitrary code” — you cannot bill for a loop you have not yet allowed.

Where the mechanics get proven

This part stayed at the why altitude and issued a stack of promissory notes. The rest of the book cashes every one of them — each mechanism you heard named here gets built from first principles, and wherever possible coded against the companion crate:

• Accounts and the world state — the mutable map from address to balance, nonce, storage, and code that replaces Bitcoin’s coin set — is built in Accounts & State. This is move 1’s “shared state” made concrete.
• The state root — how 32 bytes commit to gigabytes of world, so a stranger can verify the whole state without downloading it — is the entire job of State & the Merkle-Patricia Trie.
• The EVM — the metered machine that runs move 3’s arbitrary code — is proven in the EVM part, and you build a tiny one yourself in Build Your Own EVM.
• Gas and fees — the real price list behind move 4, and a worked bill — is Gas & Fees. When this part said “gas meters every opcode,” that part shows the schedule.
• Consensus — how mutually distrusting strangers actually converge on which sequence of transactions to feed the transition function — arrives in Consensus. Move 1 assumed agreement; this is where agreement is earned.
• Scaling — how the network grows past the base layer’s hard limit on how much shared computation it can afford — is Scaling, and it is a direct descendant of the cost story you just met.

So when you turn the page, you are not leaving the four moves behind — you are watching each of them get built. The why is settled. From here on the question shifts to how, and, always, what does it cost.

Check your understanding

1. State the book’s driving question in one sentence, and name which of the four moves defends the clause “a shared world computer.”
2. Move 1 rests on three properties of the transition function: shared state, determinism, and strangers computing the same next state. Which of the three is the reason strangers can agree without trusting each other, and why?
3. Bitcoin’s Script is deliberately not Turing-complete. State precisely what property that buys for a public verifier, and the one thing it costs.
4. Explain, in the language of this part, why “fuel” (move 4) must come after “generalize to arbitrary code” (move 3) and could not come before.
5. Gas does two jobs at once. One is taming the halting problem; what is the other, and why does an ownerless computer specifically need it?

Show answers

1. How do untrusting strangers agree on the state of a shared world computer — and what does it cost to run one? The clause “a shared world computer” is defended by move 3, the generalization of the ledger into a machine that runs arbitrary code against shared storage — one computer everyone shares and no one owns.
2. Determinism is the load-bearing one. Because the transition function returns the identical next state for the same inputs on every machine, each participant can re-run it and check the result for themselves rather than taking an authority’s word. Shared state defines what they must agree on and “strangers computing the same next state” is the outcome, but determinism is the mechanism that makes trustless agreement possible.
3. It buys the guarantee that every verifier can always afford to check every transaction: because a Script program provably halts in a bounded number of steps, no hostile transaction can trap an honest node in an infinite loop. It costs expressiveness — you cannot write arbitrary programs, only bounded spending conditions.
4. Gas exists to tame the halting problem, and the halting problem only arises once the transition function can run arbitrary, possibly-non-terminating code. Bitcoin’s bounded scripts provably halt, so they need no fuel gauge at all. Fuel is therefore the consequence of generalization — there is nothing to meter until you have allowed loops that might never stop, so move 4 must follow move 3.
5. The other job is rationing a shared, ownerless resource. Because the world computer’s CPU, memory, and permanent storage belong to everyone and no one, nothing but a price stops a single actor from consuming all of it — a tragedy of the commons. Gas priced in ether makes each user pay for exactly the work they impose on every other participant, allocating the scarce collective resource by willingness to pay rather than by whoever spams hardest.