The βitcoin βook Contents ·
Bookmarks
Notation

Common script patterns

UTXOValidatorSTXOWitness P2PK p⁶⁵ ∇ s p ∇ s — P2PKH ⧉ ⌖ h²⁰ ≡ ∇ s p ⧉ ⌖ h ≡ ∇ s p — Multisig ② p1³³ p2³³ p3³³ ③ ◇ ⓪ s1 s2 ② p1 p2 p3 ③ ◇ ⓪ s1 s2 — P2SH ⌖ h²⁰ = r ⌖ h = (r) (r) — P2SH · 2-of-3 ⌖ h²⁰ = ② p1 p2 p3 ③ ◇ ⌖ h = (② p1 p2 p3 ③ ◇) ⓪ s1 s2 ② p1 p2 p3 ③ ◇ — P2WPKH ⓪ h²⁰ s p ⧉ ⌖ h ≡ ∇ ∅ s p P2WSH ⓪ h³² w Σ h = (w) ∅ (w) P2TR key ① p³² s ∇ ∅ s P2TR script ① p³² t ⋔ p = (t) ∅ s t c Data ⁿ — — —

Lightning — commitment & channel scripts

Party 1Party 2UTXOValidatorSTXOWitness Channel open · 2-of-2 p1 = k1G · p0 = k0G · s1f · Σ w = h p2 = k2G · s2f · Σ w = h ⓪ h ② p1 p2 ② ◇ Σ h = (② p1 p2 ② ◇) ∅ ⓪ s1f s2f · ⓪ s1i s2i Channel update pi+1 = ki+1G · ki kri = k2Σ(p2⧺pi) + kiΣ(pi⧺p2) · sri — — — — Force close · to_local pi = kiG · k1i = k1 + Σ(pi⧺p1) · p1i = k1iG · pri · s1i · Σ wi = hi p1i = p1 + Σ(pi⧺p1)G · pri = p2Σ(p2⧺pi) + piΣ(pi⧺p2) · Σ wi = hi ⓪ hi ⟨ pri │ ■ Δ ⌄ p1i ⟩ ∇ Σ hi = (⟨ pri │ ■ Δ ⌄ p1i ⟩ ∇) ∅ s1i ⓪ · sri ① Force close · to_remote Σ w = h p2 = k2G · s2 · Σ w = h ⓪ h p2 ▼ ① Δ Σ h = (p2 ▼ ① Δ) ∅ s2 Force close · anchor p = kG · s · Σ w = h Σ w = h · ∅ ⓪ h p ∇ ⧉? ¬⟨ ⑯ Δ ⟩ Σ h = (p ∇ ⧉? ¬⟨ ⑯ Δ ⟩) ∅ s · ∅ Force close · HTLC k1i = k1 + Σ(pi⧺p1) · p1i = k1iG · p2i = p2 + Σ(pi⧺p2)G · pri · s1i · Σ wi = hi k2i = k2 + Σ(pi⧺p2) · p2i = k2iG · p1i = p1 + Σ(pi⧺p1)G · pri · s2i · Σ wi = hi ⓪ hi ⟨ pri │ ⟨ Σ h ≡ p1i │ τ ⌄ p2i ⟩ ⟩ ∇ Σ hi = (⟨ pri │ ⟨ Σ h ≡ p1i │ τ ⌄ p2i ⟩ ⟩ ∇) ∅ s1i h ① ⓪ · s2i ⓪ ⓪ · sri ①

The first two columns are off chain: what each party computes for itself — party 1 is the side whose force close this is. Secrets stay in their own column until an update surrenders ki across; everything else a party writes without deriving came from the other column's public points.

Secrets & the generator

kprivate key — the secret scalar behind a public key; never on chain
Gthe generator — the fixed curve point every key descends from: p = kG
p0 pi pfchannel state — a superscript scopes a datum to a state of the channel: 0 the initial commitment sealed at funding, i any intermediate update, f the final, closing state. Each state the closing party draws a fresh secret ki and shares only its point pi = kiG; scripts and hashes rebuild per state. Advancing to i+1 revokes state i: ki crosses to the other side — and nothing else
p1i p2i pristate-scoped keys — party below, state above: each side's base key folded with pi, and the revocation key; the party columns derive them in full, each side by its own route

Pushes

²⁰push — the bare superscript is the byte count (²⁰ pushes twenty)
↧n ⇊n ⤋nextended push — length in a 1 / 2 / 4-byte prefix

Signatures & keys

∇check a signature
▼check a signature, else fail
◇check m-of-n signatures
◆check m-of-n, else fail
∇₊check a signature, tallying (tapscript multisig)

Hashes

⌖address hash · HASH160
⌘identity hash · HASH256
ΣSHA-256
σSHA-1
ρRIPEMD-160

Timelocks

τabsolute — not before a fixed time or block
Δrelative — a delay after this coin confirmed

Numbers

⓪push zero
①–⑯push a small number (1–16)
⊖push minus one

Coinbase — the mining preamble

βnthe difficulty target — a valid hash opens with n zero bits
ηnextranonce — search space beyond the header's η

Chapter head — the block header

vnblock version
∅no previous block — the genesis chapter
βnthe difficulty target, as in the preamble
ηnthe nonce the miner landed on

Stack

⧉duplicate the top item
⌄drop the top item
⧉?duplicate if nonzero
⇄swap the top two
↻rotate the top three
⇗over — copy the second to the top
⌦nip out the second
⇘tuck the top beneath the second
⇡pick — copy the nth item up
⥀roll — move the nth item up
↕depth of the stack
⇥ ⇤shelve / retrieve via the alt stack

Arithmetic & comparison

+ − × ÷ %arithmetic on numbers
+₁ −₁ ×₂ ÷₂by one · by two
∓negate
|·|absolute value
⊓ ⊔min · max
∈within a range
< > ≤ ≥comparisons
≐ ≑numbers equal? · equal, else fail
≠ ≠₀numbers differ · nonzero?
¬ ∧ ∨not · and · or
« »shift left · right
= ≡bytes equal? · equal, else fail

Bytes

⧺concatenate
⊂substring
↤ ↦keep the left · right part
∼ ∩ ∪ ⊻bitwise invert · and · or · xor
ℓlength of the top item

Control

⟨ │ ⟩if … else … end
¬⟨if not
( )run the revealed script (r w t)
✓assert true
data output — provably unspendable
° °nno-op · numbered no-ops
‖section divider for signature coverage
⊘ ⊘₁ ⊘₂reserved — invalid if executed
⊘ᵛ ⊘⟨ ⊘¬⟨reserved VER family
☒invalid opcode

Data

ppublic key
ssignature
hhash
rredeem script (inside P2SH)
wwitness script (inside P2WSH)
ttapscript (a Taproot leaf)
ccontrol block (a Taproot script-path reveal) — leaf version vn, parity subscript, then the internal key p
⋔merkle proof — the revealed leaf's path in the taptree
aannex (reserved Taproot spend data)

A push of known length carries its byte count as a superscript on the mark — h²⁰, p⁶⁵; a bare, untyped push keeps its count leading (²⁰). Bold where the datum is on chain — a lock, or what a spend writes; plain where a spend introduces it at validation.

Margin — an input's sequence

●final
○respects the locktime
†replaceable (opt-in RBF)
■Nrelative: N blocks after confirmation (a count of chapters)
ΤΔtrelative: a duration after confirmation (d h m s)
(n ₿)the amount spent by this input — value flowing in; an output's amount stands bare (n ₿, no parentheses)

Margin — the transaction's locktime & other marks

□no locktime
v βb ■cnot before the cited chapter (volume, β book, ■ chapter)
Τtnot before a UTC date
∅empty — a coinbase's absent prevout, a segwit input's zero-byte script, an empty witness item
§nsection — the transaction's position