I'm trying to generate a multisignature, segwit compatible address as a P2WSH nested in BIP16 P2SH as described in BIP141. Basically, I want to construct a P2WSH-nested-in-P2SH address from n public keys and the m required to sign a valid tx.

(m required, n public keys) -> base 58 bitcoin address

I'm trying to follow along with the examples provided in Mastering Bitcoin to check the numbers I'm getting, but I'm definitely missing something. (I'm going to link all of the sections I'm referencing but it shouldn't be necessary to actually go and read them—hopefully the flaw in my process will be evident to someone.)

  1. He defines a standard P2SH 2-of-5 multisig: OP_2 key0 key1 key2 key3 key4 OP_5 OP_CHECKMULTISIG where the keys are


of which the HASH160 is 54c557e07dde5bb6cb791c7a540e0a4796f5e97e. Ok so far so good; I got the same value as the book.

  1. Then he discusses a P2WSH transaction and references the same multisig script

    We saw this type of script in [p2sh]. In that example, P2SH was used by Mohammed’s company to express a multisignature script. Payments to Mohammed’s company were encoded with a locking script like this: Example P2SH output script

    HASH160 54c557e07dde5bb6cb791c7a540e0a4796f5e97e EQUAL

    and then defines the P2WSH output script

    Example P2WSH output script

    0 9592d601848d04b172905e0ddb0adde59f1590f1e553ffc81ddc4b0ed927dd73

    [...] the Segregated Witness program consists of two values pushed to the stack: a witness version (0) and the 32-byte SHA256 hash of the redeem script.

How does he get this P2WSH output script?

If I take the example P2SH script, script.

HASH160(script) = 54c557e07dde5bb6cb791c7a540e0a4796f5e97e
SHA256(script) = a9b7b38d972cabc7961dbfbcb841ad4508d133c47ba87457b4a0e8aae86dbb89
SHA256(HASH160(script)) = 9796557ff06241ca75fdbc09359e9916186cb8398dc01fd58afc72a3ac86ce63

None of which equals the provided:


I also tried compressing the public keys, and still couldn't get that value. I'm pretty sure it's still talking about the same example, because it continues with

Mohammed’s company can spend outputs the P2WSH output [...]

If I can figure out the 32-byte SHA256 hash of the redeem script I think I'm good to go, because at that point the address can be calculated

sha256_value = 9592d601848d04b172905e0ddb0adde59f1590f1e553ffc81ddc4b0ed927dd73
p2wsh_output = OP_0 + OP_32 + sha256_value
address = Base58(05 + HASH160(p2wsh_output))

2 Answers 2


This is indeed an error in the book: https://github.com/bitcoinbook/bitcoinbook/issues/440

See this diff for the correct steps.


Seems to me that

... creating a Pay-to-Witness-Script-Hash (P2WSH) output that would look like this: 0 9592d601848d04b172905e0ddb0adde59f1590f1e553ffc81ddc4b0ed927dd73...

means that this hash is an example not derived from the data above

  • Ok cool, am I doing the rest of the steps right then? / Are there other test vectors I can check against? Would the address then be Base58(05 + HASH160(OP_0 + OP_32 + {sha256 standard p2sh scrit}))? Commented Oct 18, 2017 at 11:34
  • I think you can 'extract' the 'test vectors' from current bitcoin/testnet blockchain rather than checking bogus sources from a book :)
    – amaclin
    Commented Oct 18, 2017 at 12:45
  • Ok. So is the process correct? Commented Oct 19, 2017 at 6:59
  • I did not received 9592d6018... with provided data either, but I did not spend much time for this question. I can say, that there are a lot of such transactions in blockchain. for example you can take testnet pair testnet.smartbit.com.au/tx/… and testnet.smartbit.com.au/tx/… and try to get 1e8dda3... from 5221038e81669c...
    – amaclin
    Commented Oct 19, 2017 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.