Skip to main content
Share Your Experience: Take the 2024 Developer Survey
8 votes
Accepted

Why are OP_MUL and OP_DIV disabled in Bitcoin?

OP_MUL and OP_DIV were removed by Satoshi Nakamoto in commit 4bd188c4383d6e614e18f79dc337fbabe8464c82. As with most changes in early days of the development, little rationale was explicitly given by ...
Antoine Poinsot's user avatar
6 votes
Accepted

Why is concatenating scriptPubKeys and scriptSigs unsafe?

It was possible (see the infamous "1 RETURN bug") because the RETURN operand used to stop the execution of the Script. So simply pushing 1 in the scriptSig and RETURNing would make the ...
Antoine Poinsot's user avatar
6 votes
Accepted

Why does Miniscript add an extra size check for hash preimage comparisons?

This is to avoid a preimage too large to be claimed by one of the parties in a contract. For instance without this check it would be possible to create a Lightning HTLC that is only claimable by a ...
Antoine Poinsot's user avatar
5 votes

Undefined opcodes in bitcoin core defined as "Synonyms for OP_RETURN" in rust-bitcoin

Bitcoin Core doesn't explicitly define the unused opcodes. The fact that they cause the script to fail when executed is a result of the default branch of the large switch statement in interpreter.cpp. ...
Vojtěch Strnad's user avatar
5 votes

What was the OP_IF opcode used for (except Lightning) before 2023?

Some examples of early uses of OP_IF: d105d570237d5be5476287fb1cfefb660996c054af133995ad7c7a1c2a8054b6 (2014-03-25): This script has two alternative branches, each containing a different 2-of-2 ...
Vojtěch Strnad's user avatar
5 votes
Accepted

What is Tapscript?

Script (uppercase S, also Bitcoin Script) is the scripting language used in Bitcoin. Its programs are called "scripts" (lowercase s), often with an adjective based on the location of the ...
Vojtěch Strnad's user avatar
4 votes
Accepted

How is this transaction valid?

The signature is actually valid. The sighash is 8cc2772af5af61583c5a7ae89f777d3173afa470ce8b1bfa5f8d4b9a54635ccb and you'll find that the signature does indeed validate. So the question is how is this ...
Ava Chow's user avatar
  • 70.8k
4 votes
Accepted

What is an "empty vector" in Bitcoin?

I think we first need to distinguish between the script stack as an abstract concept as it exists during script execution, and the initial stack serialization in the transaction input witness. The ...
Pieter Wuille's user avatar
4 votes
Accepted

What would happen if we provide to OP_CHECKMULTISIG more than threshold number (m) of signatures?

Since the activation of BIP147 (nulldummy softfork) in 2017, the answer is no, this will fail. Before that point it would have been generally non-standard but allowed. An input to OP_CHECKMULISIG ...
Pieter Wuille's user avatar
4 votes
Accepted

Is there a way to push the output value of a UTXO to the stack in Bitcoin script?

No. You can't push the value of the output being spent in Bitcoin Script as of December 2023. It's been explored in some of the covenants proposal however. For instance with the Taproot upgrade on the ...
Antoine Poinsot's user avatar
4 votes
Accepted

What’s going on with this "NULL address input" transaction?

When a receiver asks to be sent money, they specify the conditions under which they want to be able to spend the funds in an output script. Later when the receiver wants to spend their funds, they ...
Murch's user avatar
  • 75.7k
4 votes

How to identify P2TR output type?

I don't see why that scriptPubKey would be incorrectly marked as P2TR as it absolutely does not follow the expected pattern. BIP 341 is very unambiguous as to the script construction - it must be OP_1 ...
Ava Chow's user avatar
  • 70.8k
4 votes
Accepted

Why is my P2WSH OP_IF/NOTIF argument not minimal?

In SegWit (by standardness) and Taproot (by consensus), the arguments to OP_IF and OP_NOTIF must be minimal, i.e. be either the empty vector or the one-byte vector 01. Your transaction uses 00, which ...
Vojtěch Strnad's user avatar
3 votes
Accepted

non-mandatory-script-verify-flag (Invalid Schnorr signature) when trying to reveal a TR output

Your transaction is a key path spend, not a script path spend (it only has one witness item, the signature). Perhaps you've calculated the sighash for a script path spend but then only included the ...
Vojtěch Strnad's user avatar
3 votes
Accepted

Is the signature check performed when the signature is the empty vector?

For pre-Tapscript opcodes (CHECKSIG and CHECKMULTISIG), the empty signature is checked against the public key. Note that by standardness if the check fails, the signature is required to be the empty ...
Antoine Poinsot's user avatar
3 votes

What are the scriptPubKey, scriptSig, redeem script and witness for the various output types?

I thought it would be useful to have a text version of the image of a table in Michael Folkson's answer. If only for accessibility reasons. (it initially proved rather too hard to edit into his answer ...
RedGrittyBrick's user avatar
3 votes

Undefined opcodes in bitcoin core defined as "Synonyms for OP_RETURN" in rust-bitcoin

When determining consensus rules, and the opcode set certainly is, the most relevant implementation and the only one to look at is the Bitcoin Core. There are no OP_RETURN_187, OP_RETURN_188, ..., ...
dassd's user avatar
  • 1,099
3 votes

Can the same set of private keys be used multiple times in a multisig wallet?

Yes, nothing stops you from creating such a wallet. However, there are more efficient ways of encoding your desired policy than a 3-of-4 multisig with one key repeated twice. If you use the Miniscript ...
Vojtěch Strnad's user avatar
3 votes
Accepted

When the validity of scriptPubKey is checked?

If the transaction output scripts are only executed at the time they are attempted to spent, does it mean that in scriptPubKey (transaction output script) we can write whatever we want and its ...
Vojtěch Strnad's user avatar
3 votes
Accepted

If no push opcode, how does item still end up on stack (tx verification)

The notation < > implies a push opcode of appropriate length precedes the data item. It's just a convention when writing about Bitcoin scripts.
RedGrittyBrick's user avatar
3 votes
Accepted

Is there any way for a script to depend on blockchain info?

No, by design. Script evaluation gives an unconditional boolean output: valid or invalid. If script validation could depend on context, that would mean script validity would need to be re-evaluated ...
Pieter Wuille's user avatar
3 votes
Accepted

Understanding Script's number encoding, CScriptNum

Numbers in Script are represented as byte vectors of up to 4 bytes and interpreted as signed integers between -2^31+1 and 2^31-1. This is with the exception of OP_0, OP_1NEGATE and OP_1 through OP_16 ...
Antoine Poinsot's user avatar
2 votes
Accepted

Is the Taproot upgrade really essential for BRC-20 tokens on Bitcoin?

As far as I know, in principle, BRC-20, or something equivalent, only really needs to store about 60 bytes in some predictable location in a Bitcoin transaction. Nothing else. There is a very long ...
RedGrittyBrick's user avatar
2 votes
Accepted

What cryptographic guarantees apply to non-disjoint paths in basic MPP?

The wrong assumption is that G needs to collaborate with C to get the refund for routing the payment. After step 4 in the situation described in the question, G tries to settle the HTLC with C, ...
Lagrang3's user avatar
  • 130
2 votes

Is there any workaround exist to restrict spending output address from Bitcoin Script?

Being able to express in a coin's Script conditions about the outputs of a transaction spending this coin is usually referred to as a covenant. This has been a field of active research for the past ...
Antoine Poinsot's user avatar
2 votes
Accepted

Is OP_CODESEPARATOR disabled in Bitcoin and if so why?

So, is the given operator disabled in Bitcoin No. can it still be used? Yes. It is still supported in bare scripts (but non-standard there), in P2SH redeemscripts, and care was taken to keep ...
Pieter Wuille's user avatar
2 votes
Accepted

What prior work influenced the design of the Bitcoin instruction set?

This is an imperfect answer but in the absence of anything else here are a couple of resources. I'm not sure if this is what you are looking for but there is a 2013 research paper "SVFORTH - A ...
Michael Folkson's user avatar
2 votes

The Bitcoin scripting system is purposefully not Turing-complete - why?

Question is, at which level would Turing-completeness be useful? If a single transaction was Turing-complete, then it would have unknowable verification time and could be used as a DoS vector on nodes ...
bca-0353f40e's user avatar
  • 1,025
2 votes
Accepted

Bitcoin Script Puzzle

The hashing opcodes hash the bytes of whatever is on the top of the stack. It doesn't matter if that's a byte vector, some text, or a number - they're all interpreted the same way (as bytes) and ...
Ava Chow's user avatar
  • 70.8k
2 votes
Accepted

Is it possible to create an output locked to a specific mining difficulty target?

No, there are currently no Script opcodes that access information about the difficulty. There has been discussion about a proposal called OP_DIFFICULTY in the past. In a similar direction, I saw some ...
Murch's user avatar
  • 75.7k

Only top scored, non community-wiki answers of a minimum length are eligible