27
votes
Accepted
What is the script assembly and execution in P2TR spend (spend from Taproot)
Before we start
I realize your question is only about single-sig scenarios, and you want an answer focused on how validation works. I will address these things, but I think I need to elaborate a bit ...
- 102k
17
votes
Accepted
Is sha-1 used in Bitcoin?
SHA1 was never commonly used in Bitcoin, but it there is at least one notable use of it, a P2SH script created by Peter Todd to allow anyone to pay to an address that could be spent by anyone proving ...
- 11.8k
15
votes
Accepted
Why is OP_SUBSTR disabled? (and OP_LEFT, OP_RIGHT)
I'm afraid that my answer here can't be better than "Ask Satoshi".
There was a series of bugs found in Bitcoin's early life, and the response by its creator was to disable a number of scripting ...
- 102k
15
votes
What is Bitcoin locking and unlocking script?
There are quite a lot of things going on there, so let's break it down bit by bit.
Transaction structure
A transaction can be seen as a collection of inputs and outputs. Inputs refer to previously ...
- 3,192
15
votes
Accepted
What does Bitcoin policy language offer the developer that Miniscript doesn't? What is the difference between Bitcoin policy language and Miniscript?
Both answers by James C. and sanket1729 are very good, but I wanted to give a very high-level answer:
Miniscript is an intermediate more structured representation for actual Bitcoin Scripts. It is ...
- 102k
14
votes
Accepted
CHECKMULTISIG a worked out example
I expect that CHECKMULTISIG will call the CHECKSIG function and manipulate the stack to run CHECKSIG in a loop until it terminates and either has its M-out-of-N valid sigs or not?
That's not really ...
- 29.3k
14
votes
Accepted
Full list of "special cases" during Bitcoin Script execution (p2sh, p2wsh, etc.)?
As of September 2023, "high-level" script validation with all active consensus rules on the network is approximately this:
Top level evaluation
Execute the scriptSig, and call the resulting ...
- 102k
14
votes
Accepted
What are the downsides to enabling potentially suboptimal or unused opcodes in a future soft fork?
Every piece of additional consensus logic has implementation and ongoing maintenance cost which is perpetual and can never be removed without potentially confiscating some user's assets.
When Satoshi ...
- 7,696
13
votes
Accepted
OP_SHA256 mismatch!
Your conflict is caused because you are hashing different values in the two situations.
>>> import hashlib
>>> hashlib.sha256("1").hexdigest()
'...
- 15.4k
13
votes
Accepted
Bitcoin and Smart Contracts
Bitcoin has a scripting language built into it, which allows the creation of many kinds of smart contracts. Examples are atomic swaps, Lightning payment channels and zero-knowledge contingent payments ...
- 1,210
12
votes
What is relation between scriptSig and scriptPubKey?
I had the same question as well and spent forever trying to understand it and finally cracked it.
"The sender (A) only has the Bitcoin Address of the recipient (B), so how does he get the pubKeyHash ...
- 437
12
votes
Accepted
How are sigops calculated?
Each OP_CHECKSIG and OP_CHECKSIGVERIFY is counted as 1 sigop.
Each OP_CHECKMULTISIG or OP_CHECKMULTISIGVERIFY, is counted as 20 sigops if they are found in an output or scriptSig and not part of a ...
- 68.5k
12
votes
Is it correct to say that Bitcoin has a virtual machine in the same way as Ethereum does?
"Virtual machine" in this context is really just a fancy word for bytecode interpreter. Bitcoin's script language is certainly far simpler than Ethereum's EVM, and its functionalities are in ...
- 102k
11
votes
Explanation of what an OP_RETURN transaction looks like
If you want to write OP_RETURNs to the blockchain without getting into the internals of how transactions are built, an easy way is to use our libraries for PHP and Python:
https://github.com/...
- 364
11
votes
What does Bitcoin policy language offer the developer that Miniscript doesn't? What is the difference between Bitcoin policy language and Miniscript?
Miniscript doesn't compile down to script. It encodes a subset of all Bitcoin script. It is a (very crafty) template language which reduces the Bitcoin script language to specific script expressions ...
- 2,501
11
votes
What does Bitcoin policy language offer the developer that Miniscript doesn't? What is the difference between Bitcoin policy language and Miniscript?
At a high level:
The policy is compiled to Miniscript.
Miniscript is encoded to Bitcoin Script. (One to One Mapping)
Bitcoin Script is decoded back to Miniscript. (One to One Mapping)
Policy and ...
- 1,296
10
votes
Online Bitcoin Script simulator or debugger?
Highly recommend btcdeb by kallewoof. Among other things, you can step through scripts including verify signatures. It is written in c++ and compiles using autotools.
btcdeb
Bitcoin Script debugging ...
- 7,318
10
votes
Accepted
Redeem script. script hash, witness script and witness program
The scriptPubKey is the script as it is placed in the transaction output.
The redeemScript (P2SH only) is the script pushed as the last scriptSig item. In P2SH scripts, the scriptPubKey is equal to ...
- 102k
10
votes
Accepted
How does OP_RETURN burn coins?
What does exactly cause the output containing OP_RETURN to be unspendable?
Simply the fact that no input can possibly unlock coins which are encumbered with such an OP_RETURN-containing script. ...
- 102k
9
votes
Accepted
Why is OP_CHECKLOCKTIMEVERIFY disabled by maximum sequence number?
the purpose of OP_CHECKLOCKTIMEVERIFY is kind of the opposite to the purpose of tx.nLockTime. tx.nLockTime prevents transactions with future dates from entering the blockchain, whereas ...
- 1,713
9
votes
Accepted
PUSHDATA4 unnecessary?
There is currently no real need for an OP_PUSHDATA4, which would allow pushing up to 4GB onto the stack. It was in the original script definition and simply was not disabled when the 520 byte limit ...
- 9,309
9
votes
Accepted
How to get address from scriptSig?
The scriptSig needed for spending a P2PKH output (that is, an output of a standard address starting with '1...') consists of two parts, namely the signature and the public key. Looking at your example ...
- 106
9
votes
Accepted
How to tell which part of the previous tx I need to make the hash to sign for an old given tx?
Disclaimer: I am going to assume that you are not completely clueless and that you know what an array is, how to count from 0, and how to match brackets, quotes, and colons so that you can read JSON ...
- 68.5k
9
votes
nLockTime in Bitcoin Core
I believe you are correct, both about the fact that height-based logic came first and time was added later, and the fact that this is a hard-forking change. A transaction with a locktime > 500000000 ...
- 102k
9
votes
Accepted
Will BTC script be Turing complete in future?
Turing completeness includes the capability to run programs that might not terminate or that might terminate after a very long time. This would cause the blockchain to stall, hence it is a must to ...
- 10.1k
8
votes
Where the P2SH script gets written?
The script is maintained by the intended recipient; he is the one responsible to keep it and not to lose it. The nodes do not store any database of the scripts.
The script is provided by the spender ...
- 1,012
8
votes
Accepted
How is a "standard" Bitcoin transaction defined?
This is easier said than done, IMO. There are plenty of little fact sheet web pages (e.g. https://www.cryptocompare.com/coins/guides/what-are-the-bitcoin-transaction-types/) lying around that give a ...
- 368
8
votes
Accepted
What's the use of not relaying non-standard transactions if anyone can still use them using P2SH?
As you say, there are two separate concerns here:
There are some scripts that might cause harm to the network.
There are some scripts that might make future upgrades harder.
For the case of harm to ...
- 11.8k
8
votes
Non-standard transaction scripts broadcasting
Standard output scripts are defined by IsStandard() (which calls Solver() to perform the actual script matching). The standard output scripts are as follows:
P2PKH
P2PK
P2SH
P2WPKH
P2WSH
A script ...
- 68.5k
8
votes
Accepted
Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?
TL;DR: depending on what you mean, there is probably no published scheme with a security proof, but there is hope for such a scheme.
First, a few clarifications
Aggregation is just a concept, not an ...
- 102k
Only top scored, non community-wiki answers of a minimum length are eligible