Hey looking at this transaction I'm confused why there are two outputs and why one of them is labelled with OP_RETURN

  • Are you asking about what OP_RETURN is in general (explained in detail here) or why a miner decided to put one in a coinbase transaction (only the miner knows for sure)? Apr 20 '18 at 2:27
  • Possible reasons why a miner decided to put one in a coinbase transaction. An explanation perhaps, I've never seen this before.
    – arshbot
    Apr 20 '18 at 13:06

Every segwit block has one such OP_RETURN in the coinbase transaction: It's the Merkle root of the witness tree.

When the segwit softfork was activated, this included a fix to the third-party transaction malleability issue that was present on the network before. The issue was that the signature of a transaction could be changed by any other person by inverting the S-value used in the signature. This resulted in another valid (non-standard) transaction spending the same coins to the same recipients, but a different txid.

Segwit prevented this source of transaction malleability by moving the witness program out of the input script to a separate "witness field" in the transaction ("segregated the witness") which is ignored when the txid is calculated. This means that even when signatures are changed for segwit transactions, their txid remains the same. Making the txid independent from the signature also makes it easier to build on top of unsigned transactions (since their txid doesn't change with the signature) which is e.g. useful for smart contracts employed in Lightning Network payment channels.

A block commits to all of its transactions by including the root of the Merkle tree over their txids. However, this would mean that this commitment wouldn't cover the signatures of segwit transactions as they don't contribute to the txid. To commit to the signatures, segwit introduced the a second parallel Merkle tree, built from the witness txids, i.e. a transaction id calculated over the complete transaction data including the witness program. Since the blockheader can't be extended without a hardfork, segwit blocks commit to this witness tree by including the root in an OP_RETURN in the coinbase transaction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.