Reading this section of BIP144, I noticed the followng statement:

Parsers supporting this BIP will be able to distinguish between the old serialization format (without the witness) and this one. The marker byte is set to zero so that this structure will never parse as a valid transaction in a parser that does not support this BIP. If parsing were to succeed, such a transaction would contain no inputs and a single output.

And this is in fact confirmed by this line in Bitcoin Core which is executed for every transaction found in a block during the CheckBlock call.

As far as I understand, this should mean that old clients that see a block containing a SegWit transaction would consider that transaction invalid and hence discard the whole block. Is that correct? What am I missing?

  • Actually, the line of code you're citing checks whether a transaction has 0 inputs, which is not allowed ever. To see the code that decides whether a witness is present, look at primitives/transaction.h. – Pieter Wuille Mar 16 '17 at 16:04
  • 2
    @PieterWuille Yes, I was citing that line to reinforce the fact that old clients seeing the marker as '0x00' would interpret it as as the varint that specifies the number of inputs and hence refuse the transaction because it has zero inputs – Simone Bronzini Mar 16 '17 at 17:53
  • Yes, I know. But again, you're confusing the abstract object with the serialization. In a transaction, 0 inputs is invalid. But the conversion from bytes to transaction object is elsewhere. A segwit transaction does not have 0 inputs, it just uses an encoding that looks like 0 inputs to old clients. Look in primitives/transaction.h for the deserialization code. – Pieter Wuille Mar 16 '17 at 18:35
  • 2
    That makes no sense, if it looks like 0 inputs to the old client and 0 inputs is never valid, then indeed it will look invalid to the old client, won't it? In any case, that seems to be a minor point. If the transaction now doesn't contain the signatures, how could it possibly look valid to someone not seeing the signatures? – relG May 3 '17 at 10:46
  • @relG SegWit scripts look like ANYONECANSPEND scripts to old clients (i.e. everyone can spend a script which consists only of OP_0 <32-byte push> without needing a signature) so old clients that will see an ANYONECANSPEND output being spent with no signature will consider it a perfectly valid transactions – Simone Bronzini May 3 '17 at 10:57

You're confusing transactions (the abstract object) and their serialization (the bytes on the wire in the P2P protocol or on disk).

Sure, SegWit introduces an extension to the P2P protocol (BIP144), which relays witnesses along with transactions, and old clients wouldn't understand such messages.

But old clients don't see them. Witnesses are only included when the requester asks for them, which old clients don't do. For them, new clients remove the witnesses before relay. Exactly because the witness of a transaction does not contribute to its txid, it is in fact possible to remove them before relay, without invalidating them. That is what makes it a soft fork.

  • 2
    Indeed, it looks like (and is) a totally old style block to them. – Pieter Wuille Mar 15 '17 at 18:42
  • 3
    how can? the old style block contains signature (witness) but the new and stripped one does not. – Nghia Bui Jul 5 '17 at 17:26
  • 2
    The new one contains empty signatures, which are valid according to the old rules, for spending SegWit outputs. SegWit just introduces an extra field to transaction (the witness), which does not contribute to the txid. The old scriptSig field is still there, but just unused for SegWit spends. – Pieter Wuille Jul 5 '17 at 17:31
  • 7
    If a block contains empty signatures, how can the transactions be verified? – Nghia Bui Jul 6 '17 at 0:35
  • 7
    To an old client, all spends from SegWit outputs look like anyone-can-spend outputs, which are valid to spend without signature. Old spends still have signatures, which validate. New clients will also validate SegWit spends, by using the signatures from the witness. – Pieter Wuille Jul 6 '17 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.