Bitcoin Stack Exchange is a question and answer site for Bitcoin users, developers, and enthusiasts. It only takes a minute to sign up.
Sign up to join this community
I understand that non-segwit nodes interpret segwit txes as Anyone-Can-Spend txes, and they cannot validate txes that spend segwit outputs.
But when an old style miner receives a segwit tx to mine he consideres it invalid, right? (That's because it appears to them as a strange transaction with no input and 1 output.) So, does it follow that segwit txes can only be mined in a block by upgraded miners?
Yes, only segwit nodes can mine valid blocks with segwit transactions.
A non-segwit node cannot process complete segwit transactions. The segwit transaction serialization format puts two new fields in the transaction header, the marker and the flag. The marker indicates that the transaction uses the extended serialization format. The marker is a 0x00 and appears after the version field in the serialization. A non-segwit node would expect the input count in that position of the serialization. Since a transaction is invalid if it has zero inputs, a non-segwit node would discard a segwit transaction due to interpreting the marker as the input count and therefore considering the transaction invalid.
However, a non-segwit node will never see a complete segwit transaction. Segwit nodes use a new peer-to-peer message to request transactions with witness data. When a non-segwit node requests a transaction, they use the original message. This tells their peer that they are asking for the original serialization format. Their peer will then strip the witness data from the transaction and give them only a stripped transaction, i.e. a transaction from which all witness data has been removed. This stripped transaction is valid, but non-standard to the non-segwit node, because one element remains on the stack after resolving the input script.
By default, nodes will not accept non-standard transactions into their mempool. Nodes only relay what they accept into their mempool, and miners build blocks from the content of their mempool. This means that an unconfirmed stripped transaction would neither relay among non-segwit nodes, nor would a non-segwit miner attempt to include a stripped transaction into their block. Further, segwit nodes will not announce segwit transactions to non-segwit nodes. However, non-segwit nodes will accept a stripped transaction in a block because it is valid. Since stripped transactions identify which UTXOs are spent and include all new outputs completely, non-segwit nodes arrive at the same UTXO set by processing the (stripped) blocks. As part of the (stripped) block, the stripped transaction will be relayed even among non-segwit nodes.
When a block includes segwit transactions, the coinbase transaction is required to have an OP_RETURN output that contains the witness commitment. This witness commitment is the Merkle root of the witness transaction ids (WTXIDs) of all transactions in the block. If a non-segwit miner were to modify their node to accept stripped transactions into their mempool and mine blocks including them, they would trip themselves up: they cannot actually validate a segwit transaction completely, because they don’t have the witness data. This would enable another network participant to give them a stripped transaction for which no witness data exists and they’d take it. Further, even if the transaction was valid and a complete version exists, without the witness data they cannot construct the witness commitment and any segwit nodes (98%+ of the nodes on the network) would reject a block without the witness commitment when it contains segwit transactions. Non-segwit miners can continue to mine blocks that only include non-segwit transactions. Between the choice of a rejected block, or a block subsidy and the fees for non-segwit transactions, a non-segwit miner would be better off to mine only non-segwit transactions.
In conclusion, only a segwit-enabled node can create a valid block that includes segwit transactions, but a non-upgraded miner would continue to mine non-segwit nodes without ever seeing unconfirmed segwit transactions.
