2

Related question: What opcodes are supported on Liquid but not yet on Bitcoin?

I had seen few opcodes in the slides shared by notgrubles on Twitter. They are:

OP_INSPECTCURRENTINPUT
OP_INSPECTINPUT
OP_INSPECTOUTPUT
OP_TAPTWEAK
OP_MUL64
OP_DIV64
OP_SCALARADD
OP_SCALARMUL

Couldn't find any of these in Bitcoin Core's source code. What does each of these opcodes do and are OP_MUL64 OP_DIV64 the same as OP_MUL OP_DIV?

2 Answers 2

1

You can find a taxonomy and details about the opcodes added in Element's Tapscript in this document. The list is longer than what you have in the OP.

As a usage example, this document details how Elements-Miniscript makes use of some of those opcodes.

0

First 3 opcodes are transaction introspection opcodes:

Define OP_SUCCESS205 as OP_PUSHCURRENTINPUTINDEX that pushes the current input index as CScriptNum. This can be used in conjunction with input introspection opcodes for inspecting current input.

Define OP_SUCCESS212 as OP_INSPECTNUMINPUTS: Push the number of inputs as CScriptNum

Define OP_SUCCESS213 as OP_INSPECTNUMOUTPUTS: Push the number of outputs as CScriptNum

OP_TAPTWEAK was renamed to OP_TWEAKVERIFY in https://github.com/ElementsProject/elements/commit/3055e8504262246c8d0e349c92b250b0daffacb9

Define OP_SUCCESS228 as OP_TWEAKVERIFY with the following semantics: Pop the three elements as: 1) 32 byte X-only internal key P, 2) a 32 byte big endian, unsigned scalar k, and 3) 33 byte compressed point Q. Abort if P, Q is invalid or k is not 32 bytes and outside of secp256k1 curve order. Abort if Q != P + k*G where G is the generator for secp256k1.

Next 2 are arithmetic opcodes:

Define OP_SUCCESS218 as OP_DIV64: pop the first number(8 byte LE) as b followed another pop for a(8 byte LE). First push remainder a%b(must be non-negative and less than |b|) onto the stack followed by quotient(a//b) onto the stack. If b==0 or a = -263 && b = -1, treat as overflow as defined above. Push 1 CScriptNum if there is no overflow.

Define OP_SUCCESS217 as OP_MUL64: pop the first number(8 byte LE) as b followed another pop for a(8 byte LE). Push a*b onto the stack. Push 1 CScriptNum if there is no overflow. Overflow behavior defined above.

These are not same as OP_MUL and OP_DIV used in Bitcoin Core.

Couldn't find OP_SCALARMUL, there is one crypto opcode with SCALAR in it: OP_ECMULSCALARVERIFY

Define OP_SUCCESS227 as OP_ECMULSCALARVERIFY which pops three elements from stack as described below: 1) a 32 byte big endian, unsigned scalar k. 2) Compressed EC point P, and 3) compressed EC point Q. Abort if P, Q is invalid or k is not 32 bytes and outside of secp256k1 curve order. Abort if Q != k*P

Source: https://github.com/ElementsProject/elements/blob/master/doc/tapscript_opcodes.md

1
  • 2
    OP_MUL64 and OP_DIV64 are certainly different from OP_MUL and OP_DIV, as the latter two don't exist (there used to be opcodes like that, but they were removed in 2010). Sep 22, 2021 at 1:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.