1

Let's assume Alice has Bob's bech32 address (BC1QW508D6QEJXTDG4Y5R3ZARVARY0C5XW7KV8F3T4). After decoding the address Alice knows that the address has a witness version of 0 AND 20 bytes of a hash (32 bytes would also be considered valid bytes).

Let's say Alice writes down the 20 hash bytes, but forgets what the witness version was.

Can Alice still "send spendable funds" to Bob? Can Alice determine the original witness version — e.g. by length of hash bytes? Could Alice determine the original witness version if she knew the address type P2WPKH/P2WSH?

In BIP-173 the authors highlight the importance of the witness version:

Implementations should take special care when converting the address to a scriptPubkey, where witness version n is stored as OP_n. OP_0 is encoded as 0x00, but OP_1 through OP_16 are encoded as 0x51 though 0x60 (81 to 96 in decimal). If a bech32 address is converted to an incorrect scriptPubKey the result will likely be either unspendable or insecure.

Is my understanding of the bech32 address data correct here?

Improve this question

2 Answers 2

Reset to default
2

Can Alice still "send spendable funds" to Bob?

If she recovers the witness version before converting the address to the scriptPubKey she puts in the transaction, yes. Otherwise, no.

All witness transaction outputs in Bitcoin (see BIP141) are of the form OP_n <program> where n is a number between 0 and 16 inclusive, and program is a push of 2 to 40 data bytes. The meaning of that program depends on the version (for version 0 they are a public key or script hash, but that's not necessarily the case for later/future versions).

BIP173/BIP150 witness addresses are just a way to encode that witness version n and program, to communicate it to the sender. In order to construct a valid transaction that the receiver can spend, both the OP_n and the program push must be exactly right.

Can Alice determine the original witness version — e.g. by length of hash bytes? Could Alice determine the original witness version if she knew the address type P2WPKH/P2WSH?

In theory, no. In practice, sometimes.

There are currently 3 types of witness outputs defined:

  • P2WPKH has witness version 0, and a witness program of 20 bytes (which is the SHA256+RIPEMD160 of the public key).
  • P2WSH has witness version 0, and a witness program of 32 bytes (which is the SHA256 of the script)
  • P2TR has witness version 1, and a witness program of 32 bytes (which is an x-only potentially-tweaked public key, not a hash), see BIP341.

Furthermore, there is a rule that witness version 0 outputs must have a program length of either exactly 20, or exactly 32 bytes. There are no such rules for version 1 and up. Future extensions may define meaning for witness version 1 with sizes other than 32, or may define meaning for witness versions 2 through 16.

So right now, a program length of 20 bytes will almost certainly mean a witness version 0 (anything else will be spendable by anyone, as no conditions are defined). But that's a bad assumption going forward, considering future consensus rule changes that assign meaning.

Improve this answer
3
  • The OP_n is part of the scriptPubKey; but is that scriptPubKey already in the tx from Alice to Bob OR does Bob only need the scriptPubKey later when he wants to spend the funds? Also, am I correct in saying the BIPs would somewhat constrain a new witness version to new type of address (P2xx), i.e. a new witness version (e.g. 9) would NOT re-use an existing type (e.g. P2WPKH) with some other constraints?
    – janniks
    Commented Sep 12, 2022 at 16:00
  • 1
    The scriptPubKey is what the sender needs to construct a payment to the receiver. The receiver needs very different information to spend the coins (including the private key(s) involved, the scripts, ...).
    – Pieter Wuille
    Commented Sep 12, 2022 at 16:24
  • 1
    Re P2WPKH... "P2WPKH" is just a human-readable name we give to "witness v0 outputs with 20 byte programs". So yes, by definition, new output types will be something else.
    – Pieter Wuille
    Commented Sep 12, 2022 at 16:41
0

Generally if Alice wants to send Bitcoin to Bob it is best practice to ask for his address directly before sending Bitcoin to it rather than storing his address for a long period of time and assuming he still wants Bitcoin sent to that address later on.

Ignoring that, you cannot directly imply the witness version from the witness program. However, so far the only SegWit witness versions that have been defined are 0 and 1. Witness version 1 is defined to be 32 bytes so if you had a 20 byte witness program you would know it wasn't a witness version 1 and hence by elimination must be a witness version 0. Of course it is possible in future that new witness versions may be introduced that have 20 byte witness programs like SegWit version 0 but currently they do not exist.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.