In script.h the following limit is set:


I'm wondering:

  • Why is the limit set to 20?
  • How would one would construct a script that allows n more than the current OP_16?

E.g. would this work?

OP_m <pubKey1> ... 1 20 OP_CHECKMULTISIG


1 Answer 1


The number 20 seems to originate from this commit : 8c9479c6bbbc38b897dc97de9d04e4d5a5a36730, also tagged as v0.3.12, which introduced the term 'SigOps". Sadly, I don't see any mention of this change in the commit message itself, or in this version's release note, and there isn't any documentation.

We see that both a limit for a maximum number of sigops in a block was set :

static const int MAX_BLOCK_SIGOPS = MAX_BLOCK_SIZE/50;

and a way of counting them :

int GetSigOpCount() const
    int n = 0;
    const_iterator pc = begin();
    while (pc < end())
        opcodetype opcode;
        if (!GetOp(pc, opcode))
        if (opcode == OP_CHECKSIG || opcode == OP_CHECKSIGVERIFY)
        else if (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY)
            n += 20;
    return n;

And the rules are still the same, specifically for bare multisig scripts (those not nested in p2sh or p2wsh). A bare CHECKMULTISIG operation is always counted as 20 sigops (today 80, with witness scale factor), so allowing anything more than 20 checksigs in CHECKMULTISIG will invalidate this assumption and will make it so creating blocks with more then maximum allowed sigops possible.

The rules are less strict for p2sh\p2wsh scripts. If the opcode just before CHECKMULTISIG is in the range [OP_1, OP_16], then that number is counted as the sigops for the multisig verification, with anything else counted as 20. In practice, 15 is the maximum of pubkeys you can push as a p2sh script because of the 520 bytes push limit, but for p2wsh, an example of 17-of-20 would look like :

0x01 0x11 <pubkey1> <pubkey2> ... <pubkey 20> 0x01 0x14 CHECKMULTISIG
  • The real limit was introduced a few weeks later in v0.3.13: github.com/bitcoin/bitcoin/commit/… The sigops limit is per block so it doesn't preclude an individual multisig transaction with more than 20 signatures. At the time the standard miner limited the block sigops to 100 (and the block size to 10kb). Nodes also wouldn't relay transactions with more than 2 signatures. But someone could have made a block a big multisig until v0.3.13 Mar 22, 2023 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.