When signing a P2WPKH input, the P2WPKH locking script is converted to the pattern of a legacy P2PKH when creating the scriptCode.

From BIP 143:

For P2WPKH witness program, the scriptCode is 0x1976a914{20-byte-pubkey-hash}88ac.

What's the reason for this?

Why not just use the original P2WPKH as the scriptCode?

1 Answer 1


Maybe one of the authors of BIP143 will correct me, but I think this was done to simplify the implementation in Bitcoin Core.

If you look at the code for P2WPKH validation, you can see it actually builds and executes a P2PKH script. This is just one way you could implement P2WPKH validation, and indeed BIP141 doesn't say anything about executing a script, however this simple 5-line implementation is only possible if the scriptCode for P2WPKH is the corresponding P2PKH script.

  • 1
    I believe the design decision was just to treat P2WPKH as a "special short notation" for a specific single-key P2WSH. That resulted in both the current code, and the effect that the scriptCode equals this specific form. In retrospect, this was a bad decision, because it means P2WPKH spends can be malleated into equivalent P2WSH spends by third parties, which slightly reduces the feerate of the transaction even. Commented May 16 at 12:13
  • @PieterWuille How can it be malleated when the signature commits to the outpoint(s)? Commented May 16 at 14:51
  • 2
    I misremembered; it's a somewhat different setting. The issue is with hardware signing devices: a malicious software wallet could create a P2WSH signature, present it as a P2WPKH spend to the signer, which would present a higher fee to the user. Commented May 16 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.