BIP16 gives the following example to explain "Pay to Script Hash":

scriptSig:    [signature] {[pubkey] OP_CHECKSIG}
scriptPubKey: OP_HASH160 [20-byte-hash of {[pubkey] OP_CHECKSIG} ] OP_EQUAL

But I don't get what's happening here. I've tried executing the script on paper (and assumed the parts in squared/curly brackets are treated as constants):

  1. [signature] and {[pubkey] OP_CHECKSIG} are pushed onto the stack
  2. OP_HASH160 hashes {[pubkey] OP_CHECKSIG}
  3. The same hash comes from the scriptPubKey onto the stack
  4. Consequently OP_EQUAL gives True
  5. The [signature] is not checked at all!

If the {[pubkey] OP_CHECKSIG} is executed, the scriptSig would only give True, which makes even less sense.

To frame a clear question: How do "Pay to Script Hash" scripts work, especially this example case?

1 Answer 1


You're correct so far, you just stopped before you were finished. As BIP16 says, it "defines additional validation rules that apply only to the new transactions" -- specifically, "{serialized script} is popped off the initial stack, and the transaction is validated again using the popped stack and the deserialized script as the scriptPubKey."


1) The script is popped off the stack, leaving only [signature] on the stack.

2) The deserialized script is added, leaving [signature] [pubkey] OP_CHECKSIG.

2) The transaction is validated again, that is, a normal signature verification occurs against the specified public key.

  • 4
    i'd like a more comprehensive walkthrough, or a link to one. i still don't get it. Aug 19, 2015 at 14:05
  • 4
    This doesn't really answer the question at all as to how the pushed script bytes get executed. I assume BIP16 defies somewhere in it's complex language a definition for how the network identifies a "serialized script", since it is just data. Why would signatures, public keys, etc not be attempted to be interpreted as scripts as well given this definition?
    – Earlz
    Nov 18, 2016 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.