First, the nodes don't have hardcoded trusted nodes. There are DNS seeds that can be used when a new node is bootstrapping and needs a way to find running nodes to connect to.
Each block is composed of a
header and a list of transactions. The transactions are hashed together in a Merkle Tree and the root of that tree is included in the header in such a way that none of the transactions can be changed without changing the hash in the header. The header also includes the hash of the previous header, proving that it came after the previous block, and also ensuring that the previous block can't be changed without changing the current header.
The nonce field is allowed to be anything at all, provided that it leads to a valid hash. This means that each miner iterates through all 2
32 possible nonces for the block candidate they are working on hoping that one of them works out. If none works, they ask for a new candidate, which means changing the timestamp or Merkle root hash. Changing the Merkle root means that at least one transaction needs to change (or a new transaction can be added). The generate transaction is allowed to contain arbitrary data, giving nodes the ability to generate new trees as needed.
The header is then fed into hash=SHA256(SHA256(header)). SHA256 is expected to have essentially a random distribution, meaning that the output is similar to getting a random number. The network tracks a target value, and only accepts blocks that are less than the target. There is no way to design a block header in advance that will have a hash that is below the target value, so miners have to check each one hoping to get lucky. The current target gives each hash about a 1 in 15 quadrillion chance of being below the target, so miners are checking (in aggregate) about 25 trillion hashes per second.
When a new block is found, every transaction is checked to make sure it is well formed and valid, and that each redeemed output is valid and not previously spent. The Merkle tree is created and checked to make sure that it matches the root hash in the header. The timestamp is checked to make sure it is within the allowable range, the difficulty is checked to make sure it agrees with the network, and the header hash is checked to make sure it is below the target value. If all of the checks are true, and the previous block hash in the header belongs to the block that was the previously highest block, the chain is extended.
When doing the initial download, some checks are abbreviated or skipped on old blocks, but the 2500 most recent blocks always get full verification.
