Save transaction space with economic Scripts

Question

I have some questions regarding the programming of economic Scripts, so Scripts that save some transaction space compared to functionally the same Scripts but with redundancy by e.g. using the same public keys twice. One example comes from the Script used for the atomic swap in the wiki: https://en.bitcoin.it/wiki/Contract#Example_5:_Trading_across_chains

OP_IF 2 <key A> <key B> 2 OP_CHECKMULTISIGVERIFY OP_ELSE <key B> OP_CHECKSIGVERIFY OP_SHA256 <hash of secret x> OP_EQUALVERIFY OP_ENDIF

In the script above the public key for B is referenced twice. But it can be rewritten to:

OP_SHA256 <hash of secret x> OP_EQUAL OP_NOTIF <key A> OP_CHECKSIGVERIFY OP_ENDIF <key B> OP_CHECKSIG

Functionally it is the same script, but does not use the public key of B twice and thus saves space in the transaction. The difference is the way the scriptSig must now be provided with the signatures or secret.

Other than that, is there anything against using the script above instead of the one from the wiki?

And what about the following example:

OP_SHA256 <hash of secret x> OP_EQUAL OP_IF <K2> OP_CHECKSIG OP_ELSE 2 <K1> <K2> <K3> 3 OP_CHECKMULTISIG OP_ENDIF

It is similar to the atomic swap above, but now there is a mediator involved. Again the public key is used twice. But it can be rewritten to:

OP_SHA256 <hash of secret x> OP_EQUAL 2 <K2> OP_ROT OP_IF OP_NIP OP_CHECKSIG OP_ELSE <K1> OP_SWAP <K3> OP_CHECKMULTISIG OP_ENDIF

This script accepts the exact same scriptSigs as the one before. It involves two more opcodes (OP_SWAP and OP_NIP), which are two bytes in total. But it saves 31 bytes in total by only using the public key K2 once. It may not be so readable, but is there anything against using this script compared to the first one?

There are many similar cases I can come up with using the exotic opcodes like OP_SWAP, OP_ROLL, and so on. But I want to know if this does actually make sense when creating Scripts to use them to save transaction space?

Answer 1

Yes, that would save space. However, there are two ways in which your scripts are different.

1. It checks if there is a value that hashes to the hash of x at the beginning,
2. It performs the operation in step 1 whether we're executing branch 1 or 2.

Your first script can be rewritten like so to fix that:

OP_NOTIF
  <key A> OP_CHECKSIGVERIFY
  OP_0
OP_ELSE
  OP_1
OP_ENDIF
OP_SWAP
<key B> OP_CHECKSIG
OP_IF
  OP_SHA256 <hash of secret x> OP_EQUAL
OP_ENDIF

Space savings

Each public key is 34 bytes (33 bytes for compressed key plus 1 for data push). Blocks are about 617k at the moment, and the total fees for a block are about 0.223 BTC. Each public key therefore costs:

34 / 617000 * 0.223 * 1e8 = 1228 satoshis

A small amount, but it would add up over time.

Answer 2

But I want to know if this does actually make sense when creating Scripts to use them to save transaction space?

How much money are you saving with shorter scripts? 0.01 cent per tx?

So, the answer is: yes, there is some sense. But the economy is too low to think about it