1

Reading the BIP:

https://github.com/bitcoin/bips/blob/master/bip-0142.mediawiki

I see that the scriptPubKey in a transaction that funds a segwit redemption is the same as a normal P2PKH but merely prepended with OP_0.

Is this opcode what tells older clients that the Tx is "anyone can spend" meaning that there will be no signature data in the redemption Tx?

Of course upgraded nodes will know to look for the actual scriptSig in the witness data to verify the Tx. But how does this OP_0 fool old nodes into ignoring the scriptSig on the redemption Tx?

5

It's not prepending a script with OP_0. It's a data push that contains the witness program hash, prepended by OP_0.

Old nodes will evaluate this as a script that just pushes two data items onto the stack (a 0 and a hash). That's obviously spendable by all, as the requirement is having a non-zero item as last element on the stack.

  • Thanks. Does 'OP0 hash' evaluate to true automatically to release the coins? And why is the hash of the witness needed? Doesn't that reintroduce malleability back into the txid? – pinhead Jan 18 '16 at 0:01
  • Any non-zero item left on the stack is interpreted as successful execution. And it's not the hash of the witness, but the hash of the witness program. – Pieter Wuille Jan 18 '16 at 0:02
  • Then why is OP_0 needed at all? And what is the witness program? The usual 'dup hash equalverify checksig'? – pinhead Jan 18 '16 at 0:28
  • 1
    @PieterWuille I thought this check meant that successful execution happens only if a non-zero item is on top of the stack AND is the only element on the stack: github.com/bitcoin/bitcoin/blob/… So in the case of the witness program the final stack would be [0, <hash>], how would this be interpreted as ANYONECANSPEND by old nodes? – Simone Bronzini Mar 15 '17 at 16:40
  • 1
    @SimoneBronzini The line of code you're referring to is enclosed within a ` (flags & SCRIPT_VERIFY_CLEANSTACK) != 0 conditional, which is only set for checking standardness, not consensus. So while old clients wouldn't relay such transactions, they are absolutely valid within a block. – Pieter Wuille Mar 15 '17 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.