# Remove BEGIN bytes from the front of A (all bytes if BEGIN is greater than length of A).
# If length(A) is greater than value(LEN), truncate A to length value(LEN).
# Push A onto the stack.
|(length(LEN) + length(BEGIN)) * 2 + MIN(Value of LEN, MAX(length(A) - Value of BEGIN, 0)) * 3
|LENGTHCONV + COPYING
|-
|OP_LEFT
|128
|<nowiki>[AOFFSET]</nowiki>
|Extract the left OFFSET bytes of A
|
# Pop operands off the stack.
# If length(A) is greater than value(OFFSET), truncate A to length value(OFFSET).
# Push A onto the stack.
|length(OFFSET) * 2
|LENGTHCONV
|-
|OP_RIGHT
|129
|<nowiki>[AOFFSET]</nowiki>
|Extract the right bytes of A, from OFFSET onwards
|
# Pop operands off the stack.
# If value(OFFSET) is less than length(A), copy value(OFFSET) bytes from offset value(OFFSET) to offset 0 in A, and truncate A to length(A) - value(OFFSET). Otherwise truncate A to length 0.
# Push A onto the stack.
|length(OFFSET) * 2 + value of OFFSET * 3
|LENGTHCONV + COPYING
|}
=====Rationale=====
OP_CAT may require a reallocation of A (hence, COPYING A) before appending B.
OP_SUBSTR may have to copy LEN bytes, but also needs to read its two numeric
operands. LEN is limited to the length of the operand minus BEGIN.
OP_LEFT only needs to read its OFFSET operand (truncation is free), whereas
OP_RIGHT must copy the bytes, which depends on the OFFSET value.
====Bit Operation Opcodes====
{|
! Mnemonic
! Opcode
! InputStack
! Description
! Definition
! Varops Cost
! Varops Reason
|-
|OP_INVERT
|131
|<nowiki>[A]</nowiki>
|Bitwise invert A
|
# Pop operands off the stack.
# For each byte in A, replace it with that byte bitwise XOR 0xFF (i.e. invert the bits)
# Push A onto the stack.
|length(A) * 4
|OTHER
|-
|OP_AND
|132
|<nowiki>[AB]</nowiki>
|Binary AND of A and B
|
# Pop operands off the stack.
# If B is longer than A, swap B and A.
# For each byte in A (the longer operand): bitwise AND it with the equivalent byte in B (or 0 if past end of B)
# Push A onto the stack.
|(length(A) + length(B)) * 2
|OTHER + ZEROING
|-
|OP_OR
|133
|<nowiki>[AB]</nowiki>
|Binary OR of A and B
|
# Pop operands off the stack.
# If B is longer than A, swap B and A.
# For each byte in B (the shorter operand): bitwise OR it into the equivalent byte in A (altering A).
# Push A onto the stack.
|MIN(length(A), length(B)) * 4
|OTHER
|-
|OP_XOR
|134
|<nowiki>[AB]</nowiki>
|Binary exclusive-OR of A and B
|
# Pop operands off the stack.
# If B is longer than A, swap B and A.
# For each byte in B (the shorter operand): exclusive OR it into the equivalent byte in A (altering A).
# Push A onto the stack.
|MIN(length(A), length(B)) * 4
|OTHER
|}
=====Rationale=====
OP_AND, OP_OR and OP_XOR are assumed to fold the results into the longer of
the two operands. This is an OTHER operation (i.e. cost is 4 per byte), but
OP_AND needs to do this until one operand is exhausted, and then zero the rest
(ZEROING, cost 2 per byte). OP_OR and OP_XOR can stop processing the operands
as soon as the shorter operand is exhausted.
====Bitshift Opcodes====
Note that these are raw bitshifts, unlike the sign-preserving arithmetic
shifts in Bitcoin v0.3.0, and as such they also do not truncate trailing
zeroes from results: they are renamed OP_UPSHIFT (née OP_LSHIFT) and
OP_DOWNSHIFT (née OP_RSHIFT).
{|
! Mnemonic
! Opcode
! InputStack
! Description
! Definition
! Varops Cost
! Varops Reason
|-
|OP_UPSHIFT
|152
|<nowiki>[ABITS]</nowiki>
|Move bits of A right by BITS (numerically increase)
|
# Pop operands off the stack.
# If A shifted by value(BITS) would exceed the individual stack limit, fail.
# If value(BITS) % 8 == 0: simply prepend value(BITS) / 8 zeroes to A.
# Otherwise: prepend (value(BITS) / 8) + 1 zeroes to A, then shift A *down* (8 - (value(BITS) % 8)) bits.
DOWNSHIFT needs to read the value of the second operand BITS. It then needs
to move the remainder of A (the part after offset BITS/8 bytes). In practice
this should be implemented in word-size chunks, not bit-by-bit!
UPSHIFT also needs to read BITS. In general, it may need to reallocate
(copying A and zeroing out remaining words). If not moving an exact number of
bytes (BITS % 8 != 0), another pass is needed to perform the bitshift.
OP_UPSHIFT can produce huge results, and so must be checked for limits prior
to evaluation. It is also carefully defined to avoid reallocating twice
(reallocating to prepend bytes, then again to append a single byte) which has
the practical advantage of being able to share the same downward bitshift
routine as OP_DOWNSHIFT.
====Multiply and Divide Opcodes====
{|
! Mnemonic
! Opcode
! InputStack
! Description
! Definition
! Varops Cost
! Varops Reason
|-
|OP_2MUL
|141
|<nowiki>[A]</nowiki>
|Multiply A by 2
|
# Pop operands off the stack.
# Shift each byte in A 1 bit to the left (increasing values, equivalent to C's << operator), overflowing into the next byte.
# If the final byte overflows, append a single 1 byte.
# Otherwise, truncate A at the last non-zero byte.
# Push A onto the stack.
|length(A) * 7
|OTHER + COPYING
|-
|OP_2DIV
|142
|<nowiki>[A]</nowiki>
|Divide A by 2
|
# Pop operands off the stack.
# Shift each byte in A 1 bit to the right (decreasing values, equivalent to C's >> operator), taking the next byte’s bottom bit as the value of the top bit, and tracking the last non-zero value.
# Truncate A at the last non-zero byte.
# Push A onto the stack.
|length(A) * 4
|OTHER
|-
|OP_MUL
|149
|<nowiki>[AB]</nowiki>
|Multiply A by B
|
# Pop operands off the stack.
# Calculate the varops cost of the operation: if it exceeds the remaining budget, fail.
# Allocate an all-zero vector R of length equal to length(A) + length(B).
# For each word in A, multiply it by B and add it into the vector R, offset by the word offset in A.
These opcodes can be computationally intensive, which is why the varops budget must be checked before operations. OP_2MUL and OP_2DIV are far simpler, equivalent to OP_UPSHIFT and OP_DOWNSHIFT by 1 bit, except truncating the most-significant zero bytes.
The detailed rationale for these costs can be found in Appendix A.
===Limited Hashing Opcodes===
OP_RIPEMD160 and OP_SHA1 are now defined to FAIL validation if their operands exceed 520 bytes.<ref>There seems little reason to allow large hashing with SHA1 and RIPEMD, and they are not as optimized as SHA256, so we restrict their usage to the older byte limit.</ref>
===Extended Opcodes===
The opcodes OP_ADD, OP_SUB, OP_1ADD and OP_1SUB are redefined in 0xC2 Tapscript to operate on variable-length unsigned integers. These always produce minimal values (no trailing zero bytes).
{|
! Mnemonic
! Opcode
! InputStack
! Description
! Definition
! Varops Cost
! Varops Reason
|-
|OP_ADD
|147
|<nowiki>[AB]</nowiki>
|Add A and B
|
# Pop operands off the stack.
# Option 1: trim trailing zeroes off A and B.
# If B is longer than A, swap A and B.
# For each byte in B, add it and previous overflow into the equivalent byte in A, remembering next overflow.
# If there was final overflow, append a 1 byte to A.
# Option 2: If there was no final overflow, remember last non-zero byte written into A, and truncate A after that point.
# Either Option 1 or Option 2 MUST be implemented.
|MAX(length(A), length(B)) * 9
|ARITH + COPYING
|-
|OP_1ADD
|139
|<nowiki>[A]</nowiki>
|Add one to A
|
# Pop operands off the stack.
# Let B = 1, and continue as OP_ADD.
|MAX(1, length(A)) * 9
|ARITH + COPYING
|-
|OP_SUB
|148
|<nowiki>[AB]</nowiki>
|Subtract B from A where B is <= A
|
# Pop operands off the stack.
# For each byte in B, subtract it and previous underflow from the equivalent byte in A, remembering next underflow.
# If there was final underflow, fail validation.
# Remember last non-zero byte written into A, and truncate A after that point.
|MAX(length(A), length(B)) * 6
|ARITH
|-
|OP_1SUB
|140
|<nowiki>[A]</nowiki>
|Subtract 1 from (non-zero) A
|
# Pop operands off the stack.
# Let B = 1, and continue as OP_SUB.
|MAX(1, length(A)) * 6
|ARITH
|}
====Rationale====
Note that the basic cost for ADD is six times the maximum operand length
(ARITH), but then considers the case where a reallocation and copy needs to
occur to append the final carry byte (COPYING, which costs 3 units per byte).
Subtraction is cheaper because underflow does not occur: that is a validation
failure, as mathematicians agree the result would not be natural.
===Misc Operators===
The following opcodes have costs below:
{|
! Opcode
! Varops Budget Cost
! Varops Reason
|-
| OP_CHECKLOCKTIMEVERIFY
| Length of operand * 2
| LENGTHCONV
|-
| OP_CHECKSEQUENCEVERIFY
| Length of operand * 2
| LENGTHCONV
|-
| OP_CHECKSIGADD
| MAX(1, length(number operand)) * 9 + 500,000
| ARITH + COPYING + SIGCHECK
|-
| OP_CHECKSIG
| 500,000
| SIGCHECK
|-
| OP_CHECKSIGVERIFY
| 500,000
| SIGCHECK
|}
====Rationale====
OP_CHECKSIGADD does an OP_1ADD on success, so we use the same cost as that.
For simplicity, this is charged whether the OP_CHECKSIGADD succeeds or not.
===Other Operators===
The varops costs of the following opcodes are defined in
