2

Reading the BIP:

https://github.com/bitcoin/bips/blob/master/bip-0142.mediawiki

I see that the scriptPubKey in a transaction that funds a segwit redemption is the same as a normal P2PKH but merely prepended with OP_0.

Is this opcode what tells older clients that the Tx is "anyone can spend" meaning that there will be no signature data in the redemption Tx?

Of course upgraded nodes will know to look for the actual scriptSig in the witness data to verify the Tx. But how does this OP_0 fool old nodes into ignoring the scriptSig on the redemption Tx?

Improve this question

1 Answer 1

Reset to default
6

It's not prepending a script with OP_0. It's a data push that contains the witness program hash, prepended by OP_0.

Old nodes will evaluate this as a script that just pushes two data items onto the stack (a 0 and a hash). That's obviously spendable by all, as the requirement is having a non-zero item as last element on the stack.

Improve this answer
8
  • Thanks. Does 'OP0 hash' evaluate to true automatically to release the coins? And why is the hash of the witness needed? Doesn't that reintroduce malleability back into the txid?
    – pinhead
    Jan 18, 2016 at 0:01
  • Any non-zero item left on the stack is interpreted as successful execution. And it's not the hash of the witness, but the hash of the witness program.
    – Pieter Wuille
    Jan 18, 2016 at 0:02
  • Then why is OP_0 needed at all? And what is the witness program? The usual 'dup hash equalverify checksig'?
    – pinhead
    Jan 18, 2016 at 0:28
  • 1
    @PieterWuille I thought this check meant that successful execution happens only if a non-zero item is on top of the stack AND is the only element on the stack: github.com/bitcoin/bitcoin/blob/… So in the case of the witness program the final stack would be [0, <hash>], how would this be interpreted as ANYONECANSPEND by old nodes?
    – Simone Bronzini
    Mar 15, 2017 at 16:40
  • 1
    @SimoneBronzini The line of code you're referring to is enclosed within a ` (flags & SCRIPT_VERIFY_CLEANSTACK) != 0 conditional, which is only set for checking standardness, not consensus. So while old clients wouldn't relay such transactions, they are absolutely valid within a block.
    – Pieter Wuille
    Mar 15, 2017 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.