Script

Script is a mini programming language used as a locking mechanism for outputs in bitcoin transactions.

• A locking script (ScriptPubKey) is placed on every transaction output.
• An unlocking script (ScriptSig or Witness) must be provided to unlock an output (i.e. when used as an input to a transaction).

If a full script (unlocking + locking) is valid, the output is "unlocked" and can be spent.

Script Language

What is Script?

Script is a very basic programming language. It consists of two things:

1. Opcodes – Simple functions that operate on data.
2. Data – Such as public keys and signatures.

Here's a simple diagram of a typical P2PKH script used in Bitcoin:

tool-66a44778b7650

Script

Decode and encode a script.

Random ScriptPubKey Random ScriptSig

 

Hex

0 bytes ASM

Type Non-Standard P2PK (Pay To Pubkey) P2PKH (Pay To Pubkey Hash) P2MS (Multisig) P2SH (Pay To Script Hash) P2WPKH (Pay To Witness Pubkey Hash) P2WSH (Pay To Witness Script Hash) P2TR (Pay To Taproot) OP_RETURN (Data)

Address

0 characters

0 secs

1. Opcodes

Here's a quick list of all the opcodes available in the Script language (along with the corresponding hexadecimal byte used to represent each one).

2. Data

The data elements inside a Script (e.g. public keys, signatures) have to be manually pushed on to the stack using an opcode.

There are a few specific opcodes you can choose from to do this, and the one you use depends on how many bytes you want to push on to the stack.

OP_1

51

OP_PUSHBYTES_20 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

14aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

OP_PUSHDATA1 4c aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

4c4caaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

OP_PUSHDATA2 0001 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

4d0001aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

OP_PUSHDATA4 00000100 [65536 bytes]

4e00000100[65536 bytes]

For simplicity, the diagrams on this page do not show the OP_PUSHBYTES_X opcodes. However, these push operations are required to push data on to the stack.

OP_8
OP_PUSHBYTES_1 08
OP_PUSHDATA1 01 08
OP_PUSHDATA2 0100 08
OP_PUSHDATA4 01000000 08

OP_PUSHBYTES_2 aaaa
OP_PUSHDATA1 02 aaaa
OP_PUSHDATA2 0200 aaaa
OP_PUSHDATA4 02000000 aaaa

Execution

How is Script executed?

A complete script is run from left-to-right. As it runs, it makes use of a data structure called a stack.

Data is pushed on to the stack.

Opcodes pop elements off the stack, do something with them, then optionally push new elements back on to the stack.

Validity

A complete script is determined to be valid or invalid after it has finished executing.

Here's an example of the execution of a complete P2PKH script:

Location

Where is Script used in Bitcoin?

A locking script (ScriptPubKey) is placed on every output you create in a transaction:

An unlocking script (ScriptSig or Witness) must be provided for every input you want to spend in a transaction:

Every node will then combine and run these two scripts for each input in each transaction they receive to make sure they validate.

If the unlocking scripts on inputs do not successfully unlock the locking scripts on the outputs being spent, then the transaction is considered invalid and will not be relayed (or mined in to a block).

The unlocking script goes first.

Even though the unlocking script is provided after the initial locking script (in terms of how transactions work), we actually put the unlocking script first when we execute the full script.

Usage

Why do we use Script in Bitcoin?

Why do we use a mini programming language for locking up bitcoins? Why not just use a simple public key and signature comparison and do away with all of these opcodes and stacks?

Well, because by using Script you can create different types of locks by using different combinations of OP_CODES.

For example, here are some cool locking scripts you can create:

1. Math Puzzle

To spend this output, you need to provide two numbers that add up to 8.

This may not be the most secure locking script in the world, as anyone can figure it out and unlock it.

2. Hash Puzzle

Here you just need something that hashes to the same result as what's inside the locking script.

3. Hash Collision Puzzle

This is a cool one. You can unlock it by providing two different strings of data that produce the same hash result.

In other words, it acts as an incentive to find a "hash collision".

This particular locking script can be found on this output. However, the script has been wrapped in a P2SH locking script, so you can't actually see the original locking script (until someone unlocks them).

All of the above locking scripts are non-standard. Whilst these scripts are valid (and can be mined on to the blockchain), typical Bitcoin Core nodes will not relay them from their memory pools, which makes it difficult for them to get mined in the first place.

Standard Scripts

What are the most common Script patterns in Bitcoin?

Despite being able to create a variety of different locking scripts with various combinations of OPCODES, most nodes will only relay a handful of "standard scripts":

Legacy

• P2PK (Pay To Public Key)
• P2PKH (Pay To Public Key Hash)
• P2MS (Pay To Multisig)
• P2SH (Pay To Script Hash)
• OP_RETURN

These were the standard scripts available in bitcoin between 2009 and 2016 (before the Segwit upgrade).

They are unlocked via the ScriptSig field.

Although these are not used as much today (in favour of the newer Segwit scripts below), they're still perfectly valid and you can use them for locking up your coins if you want to.

Segwit

• P2WPKH (Pay To Witness Public Key Hash)
• P2WSH (Pay To Witness Script Hash)
• P2TR (Pay To Taproot)

These standard scripts were introduced after the Segwit upgrade in 2016 (and then also the Taproot upgrade in 2021). They were basically introduced to replace the legacy P2PKH and P2SH locking scripts above.

They are unlocked via the Witness field.

These locking scripts do not actually use the fully-fledged Script language.

Instead, each locking script has its own specific pattern, and they are executed in a set way internally when being unlocked. So they have actually done away with the Script language to a degree (except for when you wrap a fully-fledged script inside a P2WSH).

So when I said "why not just use a simple public key and signature comparison and do away with all of these opcodes and stacks?", well, that's what these scripts have done.

Limits

What is the maximum size of a script?

Scripts in bitcoin have certain limits on their size. There are two types of limits:

1. Validity Limits. Any transaction that contains a script that exceeds these limits will be considered invalid. This means it will be rejected by nodes and cannot be mined in to the blockchain.
2. Standardness Limits. A transaction can break these limits and still be mined in to the blockchain, but nodes will consider them non-standard and will refuse to relay them between memory pools.

1. Validity Limits

• The maximum size of a script is 10,000 bytes. A combined ScriptPubKey + ScriptSig cannot be greater than 10,000 bytes.
• The maximum number of OP_CODES is 201. This limit does not include operations that push data on to the stack.
• The maximum size of a single element is 520 bytes. You cannot push any data on to the stack that exceeds 520 bytes. This limit is most relevant when constructing a Redeem Script for a P2SH, as a Redeem Script is a data push of a script.
• The maximum number of stack items is 1,000. A complete script can contain more than 1,000 elements, but you cannot construct a script that will push over 1,000 items on to the stack at any one time.

These limits can be found in script.h.

These limits only apply during script execution. So you could place a ScriptPubKey on an output that exceeds these limits and it would get mined. But when you come to try and spend it as an input (i.e. when the script is being executed), the spending transaction will be considered invalid. In other words, the output would be unspendable.

2. Standardness Limits

• The ScriptSig can be a maximum of 1,650 bytes. So if you need to use more than 1,650 bytes of data and/or OP_CODES to unlock an output, nodes will not relay your transaction.
• The ScriptPubKey has no limit (other than being restricted by the block size limit). So it's perfectly fine to create a ridiculously large ScriptPubKey if you want to, but remember that it's going to be unspendable if it exceeds any of the validity limits above.

So whilst it's valid for a transaction to exceed these limits, it's going to be difficult to get it mined in to the blockchain unless you can mine it yourself or get a miner to add it to the blockchain for you.

These limits can be found in policy.h.

Summary

Script is just a mini programming language used in Bitcoin to provide the locking mechanism for outputs.

• Every output is given a "locking script".
• You must then provide an "unlocking script" in the transaction that wants to spend that output.

When a node receives the spending transaction, it will combine both of these scripts together and run them. If a OP_1 (and nothing else) is left on the top of the stack after the script has finished executing, then the script is valid and the output can be spent.

The newer segwit locking scripts have moved away from using traditional Script slightly, but the Script language is still used for legacy locking scripts, and can also continue to be used within the newer P2WSH locking script.

Resources

• Opcode Explained – A complete guide to opcodes and what each one does.
• bitcoin.it/wiki/Script
• The Bitcoin Script language (pt.1)
• Mastering Bitcoin: Chapter 7 (Authorization and Authentication)
• Is a script spendable if multiple items are left on the stack?
• Why can non-standard transactions be mined but not relayed?
• isStandard()