Skip to main content
29 votes
Accepted

What is the script assembly and execution in P2TR spend (spend from Taproot)

Before we start I realize your question is only about single-sig scenarios, and you want an answer focused on how validation works. I will address these things, but I think I need to elaborate a bit ...
Pieter Wuille's user avatar
17 votes
Accepted

Is sha-1 used in Bitcoin?

SHA1 was never commonly used in Bitcoin, but it there is at least one notable use of it, a P2SH script created by Peter Todd to allow anyone to pay to an address that could be spent by anyone proving ...
David A. Harding's user avatar
15 votes
Accepted

Why is OP_SUBSTR disabled? (and OP_LEFT, OP_RIGHT)

I'm afraid that my answer here can't be better than "Ask Satoshi". There was a series of bugs found in Bitcoin's early life, and the response by its creator was to disable a number of scripting ...
Pieter Wuille's user avatar
15 votes

What is Bitcoin locking and unlocking script?

There are quite a lot of things going on there, so let's break it down bit by bit. Transaction structure A transaction can be seen as a collection of inputs and outputs. Inputs refer to previously ...
sr_gi's user avatar
  • 3,220
15 votes
Accepted

What does Bitcoin policy language offer the developer that Miniscript doesn't? What is the difference between Bitcoin policy language and Miniscript?

Both answers by James C. and sanket1729 are very good, but I wanted to give a very high-level answer: Miniscript is an intermediate more structured representation for actual Bitcoin Scripts. It is ...
Pieter Wuille's user avatar
15 votes
Accepted

Full list of "special cases" during Bitcoin Script execution (p2sh, p2wsh, etc.)?

As of September 2023, "high-level" script validation with all active consensus rules on the network is approximately this: Top level evaluation Execute the scriptSig, and call the resulting ...
Pieter Wuille's user avatar
14 votes
Accepted

What are the downsides to enabling potentially suboptimal or unused opcodes in a future soft fork?

Every piece of additional consensus logic has implementation and ongoing maintenance cost which is perpetual and can never be removed without potentially confiscating some user's assets. When Satoshi ...
G. Maxwell's user avatar
  • 7,727
13 votes
Accepted

Bitcoin and Smart Contracts

Bitcoin has a scripting language built into it, which allows the creation of many kinds of smart contracts. Examples are atomic swaps, Lightning payment channels and zero-knowledge contingent payments ...
Andrew Poelstra's user avatar
13 votes
Accepted

How are sigops calculated?

Each OP_CHECKSIG and OP_CHECKSIGVERIFY is counted as 1 sigop. Each OP_CHECKMULTISIG or OP_CHECKMULTISIGVERIFY, is counted as 20 sigops if they are found in an output or scriptSig and not part of a ...
Ava Chow's user avatar
  • 70.5k
12 votes

What is relation between scriptSig and scriptPubKey?

I had the same question as well and spent forever trying to understand it and finally cracked it. "The sender (A) only has the Bitcoin Address of the recipient (B), so how does he get the pubKeyHash ...
cloudnthings's user avatar
12 votes

Is it correct to say that Bitcoin has a virtual machine in the same way as Ethereum does?

"Virtual machine" in this context is really just a fancy word for bytecode interpreter. Bitcoin's script language is certainly far simpler than Ethereum's EVM, and its functionalities are in ...
Pieter Wuille's user avatar
12 votes
Accepted

How does OP_RETURN burn coins?

What does exactly cause the output containing OP_RETURN to be unspendable? Simply the fact that no input can possibly unlock coins which are encumbered with such an OP_RETURN-containing script. ...
Pieter Wuille's user avatar
11 votes

What does Bitcoin policy language offer the developer that Miniscript doesn't? What is the difference between Bitcoin policy language and Miniscript?

Miniscript doesn't compile down to script. It encodes a subset of all Bitcoin script. It is a (very crafty) template language which reduces the Bitcoin script language to specific script expressions ...
James C.'s user avatar
  • 2,511
11 votes

What does Bitcoin policy language offer the developer that Miniscript doesn't? What is the difference between Bitcoin policy language and Miniscript?

At a high level: The policy is compiled to Miniscript. Miniscript is encoded to Bitcoin Script. (One to One Mapping) Bitcoin Script is decoded back to Miniscript. (One to One Mapping) Policy and ...
sanket1729's user avatar
  • 1,402
11 votes
Accepted

Redeem script. script hash, witness script and witness program

The scriptPubKey is the script as it is placed in the transaction output. The redeemScript (P2SH only) is the script pushed as the last scriptSig item. In P2SH scripts, the scriptPubKey is equal to ...
Pieter Wuille's user avatar
10 votes

Online Bitcoin Script simulator or debugger?

Highly recommend btcdeb by kallewoof. Among other things, you can step through scripts including verify signatures. It is written in c++ and compiles using autotools. btcdeb Bitcoin Script debugging ...
JBaczuk's user avatar
  • 7,408
9 votes
Accepted

PUSHDATA4 unnecessary?

There is currently no real need for an OP_PUSHDATA4, which would allow pushing up to 4GB onto the stack. It was in the original script definition and simply was not disabled when the 520 byte limit ...
cdecker's user avatar
  • 9,508
9 votes
Accepted

How to get address from scriptSig?

The scriptSig needed for spending a P2PKH output (that is, an output of a standard address starting with '1...') consists of two parts, namely the signature and the public key. Looking at your example ...
theStack's user avatar
  • 106
9 votes
Accepted

How to tell which part of the previous tx I need to make the hash to sign for an old given tx?

Disclaimer: I am going to assume that you are not completely clueless and that you know what an array is, how to count from 0, and how to match brackets, quotes, and colons so that you can read JSON ...
Ava Chow's user avatar
  • 70.5k
9 votes

nLockTime in Bitcoin Core

I believe you are correct, both about the fact that height-based logic came first and time was added later, and the fact that this is a hard-forking change. A transaction with a locktime > 500000000 ...
Pieter Wuille's user avatar
9 votes
Accepted

Will BTC script be Turing complete in future?

Turing completeness includes the capability to run programs that might not terminate or that might terminate after a very long time. This would cause the blockchain to stall, hence it is a must to ...
MCCCS's user avatar
  • 10.2k
9 votes
Accepted

Is bitcoin script necessary?

was it necessary to have another language for these operations? isn't it possible to write the whole runtime in one language? To be clear: the goal of the scripting language isn't for defining the ...
Pieter Wuille's user avatar
8 votes

Where the P2SH script gets written?

The script is maintained by the intended recipient; he is the one responsible to keep it and not to lose it. The nodes do not store any database of the scripts. The script is provided by the spender ...
dionyziz's user avatar
  • 1,012
8 votes
Accepted

How is a "standard" Bitcoin transaction defined?

This is easier said than done, IMO. There are plenty of little fact sheet web pages (e.g. https://www.cryptocompare.com/coins/guides/what-are-the-bitcoin-transaction-types/) lying around that give a ...
Nathan Basanese's user avatar
8 votes
Accepted

What's the use of not relaying non-standard transactions if anyone can still use them using P2SH?

As you say, there are two separate concerns here: There are some scripts that might cause harm to the network. There are some scripts that might make future upgrades harder. For the case of harm to ...
David A. Harding's user avatar
8 votes

Non-standard transaction scripts broadcasting

Standard output scripts are defined by IsStandard() (which calls Solver() to perform the actual script matching). The standard output scripts are as follows: P2PKH P2PK P2SH P2WPKH P2WSH A script ...
Ava Chow's user avatar
  • 70.5k
8 votes
Accepted

What are the scriptPubKey, scriptSig, redeem script and witness for the various output types?

This was answered during the Bitcoin Core PR review club on July 7th 2021 hosted by Gloria Zhao (who also provided this table). The <public key> in the P2TR (key path) and P2TR (script path) ...
Michael Folkson's user avatar
8 votes
Accepted

Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?

TL;DR: depending on what you mean, there is probably no published scheme with a security proof, but there is hope for such a scheme. First, a few clarifications Aggregation is just a concept, not an ...
Pieter Wuille's user avatar
8 votes
Accepted

Why are OP_MUL and OP_DIV disabled in Bitcoin?

OP_MUL and OP_DIV were removed by Satoshi Nakamoto in commit 4bd188c4383d6e614e18f79dc337fbabe8464c82. As with most changes in early days of the development, little rationale was explicitly given by ...
Antoine Poinsot's user avatar
7 votes

Why does script need to be purged from transactions for mimblewimble to work?

The incompatibility comes down to 2 main factors: Pruning: an important addition of the mimblewimble proposal is the ability to merge transactions across blocks. If transactions include scripts, ...
Matthieu's user avatar
  • 921

Only top scored, non community-wiki answers of a minimum length are eligible