Yes so the btc node -> server path is resistant to sybil. (Nodes cant fool the electrum server)
But what about the server -> client path, what if the electrum server itself is lying? (Server could fool electrum client?)
I do not understand what you are talking about, and it looks like you really don't know what you are talking about.
SPV is a verification of the transactions sent by the server.
That verification is performed by the client, independently of the server.
That verification involves fetching block headers from various nodes and verifiying miners proof-of-work.
"nodes cant fool the server" is completely pointless here (and meaningless).
the point is that the server cannot fool the client.
What I am talking about is that the client is connected to 1 server at a time. While the 1 server may be connected to 8 bitcoin nodes.
So the server acts as a gateway between the electrum client and the btc network.
The server is connected to 8 nodes so the server knows that he is resistant to sybil attack.
But the electrum client knows only what the server tells him, so the server could send fake data to the electrum client.
For example: Server fetches TX data from 8 nodes, maliciously modifies it, and sends a fake version through to the client. If the client is connected to only 1 server, then it doesnt matter how many nodes the server is connected, he cant tell the difference, he has to trust the electrum server 100%.
What I am telling is that the electrum server is a central point of failure.
