How can I recognize an OP_RETURN transaction looking only at the hex?

Question

Looking at these two transactions for example: tx1 and tx2. tx1 is an OP_RETURN trasaction, tx2 is a normal transaction.

raw hex from tx1 (OP_RETURN): 0100000000010173a9eafb38a83662d28a5c885165c7aa3f27694e39f0ba4e4fc86d98ff3dd2d60000000000ffffffff0200000000000000004b6a494575726f7065206973207469726564206f66206265696e67207375627365727669656e7420746f207468652055532e204c6f6e67206c6976652052757373696120f09f87b7f09f87ba2a940600000000002251203e4c971ecd3ad020833cbd4b2ecdf1f229d430dfa48adc3203f5f79c801dfb9901407ac1f8560a33867cdfa3ad136488ed7f4f5d1f4fc6a32822d8dd6c5e47e9317f0f2a4381349a803d223773711d6df8303e9c23e60782633450c735b2275d9a2100000000

raw hex from tx2: 0200000000010191fd88fc50bd8932c8da649e0c54b42ab3598a89c420c28bf6fad2d443711dbd2e00000000ffffffff016bef0c000000000017a9140afdb9b53981bfac9c53d01f6389b5ebecf8499f8702483045022100f0d0944b835095b5fcad86df999831ae3eade37c0eb68649b83a55ca5f1854af0220231561ec647b7bd9179c5f809e878a4cfd09818514b42ca8a274b11dfaa3a3ed012103e5d3e103615a36046dfbe880d6fb4c47e5227d8176635310c5dd08d5aa43f99c00000000

What am I looking for?

Answer 1

You can use bitcoin-cli to decode the transaction and get a sense of what is going on:

bitcoin-cli decoderawtransaction 0100000000010173...275d9a2100000000

That returns:

{
  "txid": "00fddd900b735a88ab0ef5eeaa3efbc869d4e52493da8a9467ec782355cb39ff",
  "hash": "b4c4817e908d9ba317e9b1a08180b51c0ce77adca946e7f894560fb07447acf8",
  "version": 1,
  "size": 246,
  "vsize": 195,
  "weight": 780,
  "locktime": 0,
  "vin": [
    {
      "txid": "d6d23dff986dc84f4ebaf0394e69273faac76551885c8ad26236a838fbeaa973",
      "vout": 0,
      "scriptSig": {
        "asm": "",
        "hex": ""
      },
      "txinwitness": [
        "7ac1f8560a33867cdfa3ad136488ed7f4f5d1f4fc6a32822d8dd6c5e47e9317f0f2a4381349a803d223773711d6df8303e9c23e60782633450c735b2275d9a21"
      ],
      "sequence": 4294967295
    }
  ],
  "vout": [
    {
      "value": 0.00000000,
      "n": 0,
      "scriptPubKey": {
        "asm": "OP_RETURN 4575726f7065206973207469726564206f66206265696e67207375627365727669656e7420746f207468652055532e204c6f6e67206c6976652052757373696120f09f87b7f09f87ba",
        "desc": "raw(6a494575726f7065206973207469726564206f66206265696e67207375627365727669656e7420746f207468652055532e204c6f6e67206c6976652052757373696120f09f87b7f09f87ba)#vxme4rep",
        "hex": "6a494575726f7065206973207469726564206f66206265696e67207375627365727669656e7420746f207468652055532e204c6f6e67206c6976652052757373696120f09f87b7f09f87ba",
        "type": "nulldata"
      }
    },
    {
      "value": 0.00431146,
      "n": 1,
      "scriptPubKey": {
        "asm": "1 3e4c971ecd3ad020833cbd4b2ecdf1f229d430dfa48adc3203f5f79c801dfb99",
        "desc": "rawtr(3e4c971ecd3ad020833cbd4b2ecdf1f229d430dfa48adc3203f5f79c801dfb99)#nkpjq33l",
        "hex": "51203e4c971ecd3ad020833cbd4b2ecdf1f229d430dfa48adc3203f5f79c801dfb99",
        "address": "bcrt1p8exfw8kd8tgzpqeuh49jan037g5agvxl5j9dcvsr7hmeeqqalwvs884ffw",
        "type": "witness_v1_taproot"
      }
    }
  ]
}

You can see how, in the output section of the transaction, the first output is an OP_RETURN output, and that the data associated to it is:

4575726f7065206973207469726564206f66206265696e67207375627365727669656e7420746f207468652055532e204c6f6e67206c6976652052757373696120f09f87b7f09f87ba

Also, notice how the OP_RETURN opcode is 0x6a (you can check the bitcoin wiki for that).

Therefore, the piece you're looking for inside the hex transaction is:

6a494575726f7065206973207469726564206f66206265696e67207375627365727669656e7420746f207468652055532e204c6f6e67206c6976652052757373696120f09f87b7f09f87ba

You may also notice there is an additional byte of information between the OP_RETURN opocode and the data: 0x49. That's the size of the associated data in bytes (encoded in hex). 49 hex equals 73 dec, so the length is 73 bytes or 146 hex characters.