P2SH

P2SH, short for pay to script hash, locks an output to the hash of a script. That script is called the redeem script, and it is revealed only when the coins are spent. The sender sees just a 20-byte hash, which can be shared as an address that starts with 3. P2SH is most often used for multisig. It became standard in April 2012, under BIP 16. It is a legacy type, and P2WSH does the same job for SegWit.

What does a P2SH locking script look like?

The whole lock is 23 bytes:

a914748284390f9e263a4b766a75d0633c50426eb87587

a9 is OP_HASH160, 14 pushes 20 bytes, and 87 is OP_EQUAL. The 20 bytes are the script hash, 748284390f9e263a4b766a75d0633c50426eb875. Output 1 of 450c309b70fb3f71b63b10ce60af17499bd21b1db39aa47b19bf22166ee67144 uses this lock.

What does the unlocking script look like?

The scriptSig holds the items that satisfy the redeem script, and the redeem script itself as its last push. Here is a spend of a lock like the one above:

00473044022100d0ed946330182916da16a6149cd313a4b1a7b41591ee52fb3e79d64e36139d66021f6ccf173040ef24cb45c4db3e9c771c938a1ba2cf8d2404416f70886e360af401475121022afc20bf379bc96a2f4e9e63ffceb8652b2b6a097f63fbee6ecec2a49a48010e2103a767c7221e9f15f870f1ad9311f5ab937d79fcaeee15bb2c722bca515581b4c052ae

00 is the empty dummy item that OP_CHECKMULTISIG needs. 47 pushes a 71-byte signature. The final 47 pushes the 71-byte redeem script. Input 11 of 30c239f3ae062c5f1151476005fd0057adfa6922de1b38d0f11eb657a8157b30 is this spend.

Decoded, the redeem script is OP_1, two 33-byte public keys, OP_2, and OP_CHECKMULTISIG. It is a 1-of-2 P2MS lock.

How does a P2SH script run?

A P2SH script runs in two passes. It is the only script type that does this.

1. The standard run. The scriptSig pushes its items, and the stack is copied. OP_HASH160 hashes the redeem script, and OP_EQUAL compares the result with the script hash in the lock. If they differ, the script fails.
2. The redeem script. The redeem script is taken off the stack and parsed into opcodes and data. It then runs as the lock, with the spender's items still on the stack.

So the redeem script works as a second locking script. In the example above, it is a P2MS lock, so it runs the same way a P2MS spend does.

What is a redeem script?

The redeem script is any valid script, pushed as data in the scriptSig. Since Bitcoin Core 0.10, nodes relay P2SH spends whose redeem scripts are not one of the standard types. The release notes for 0.10.0 explain the change.

The redeem script can be at most 520 bytes. That is enough for a multisig with up to 15 compressed keys. The script must also leave exactly one true item on the stack when it finishes, usually OP_1. Any item left below the top one makes the spend non-standard, so nodes will not relay it, even when the top item is true.

What is the script hash?

The script hash is the HASH160 of the redeem script, which is SHA-256 followed by RIPEMD-160. Hashing the redeem script in the example above gives 748284390f9e263a4b766a75d0633c50426eb875, the same value as the lock.

What address does a P2SH lock have?

A P2SH lock has its own address. It is the Base58Check encoding of the script hash, with a one-byte prefix of 05 on mainnet, so the address starts with 3. On testnet the prefix is c4, and the address starts with 2. The script hash above gives the address 3CK4fEwbMP7heJarmU4eqA3sMbVJyEnU3V. Wallets decode a 3 address to get the hash, then build the P2SH lock.

Why use P2SH?

• The sender pays a short lock. The output carries 23 bytes, however long the redeem script is. The size of the custom script is paid by the person who spends.
• The lock says less. Until the coins are spent, the output shows only a hash, so nobody can tell what kind of script is behind it.
• The UTXO set stays small. Every unspent output sits in the UTXO set, which nodes keep in memory and on disk. A short lock saves them that space.

The trade-off is that the redeem script takes space on chain when the coins are spent.

Which P2SH transactions can you check on our explorer?

• Output 1 of a0f1aaa2fb4582c89e0511df0374a5a2833bf95f7314f4a51b55b7b71e90ce0f is spent by input 2 of 4d8eabfc8e6c266fb0ccd815d37dd69246da634df0effd5a5c922e4ec37880f6. Its redeem script is a 1-of-2 multisig.
• Output 0 of d3adb18d5e118bb856fbea4b1af936602454b44a98fc6c823aedc858b491fc13 is spent by input 0 of cc11ca9e9dc188663c41eb23b15370f68eded56b7ec54dd5bc4f2d2ae93addb2. Its redeem script is a 2-of-3 multisig.
• Output 1 of 7d46745463a28049cb93d2c964320912d9c296c1038cb24cc3716255c397a87f is spent by input 0 of 09afa3b1393f99bb01aa754dd4b89293fd8d6c9741488b537d14f7f81de1450e. Its redeem script is a small puzzle: OP_3DUP OP_ADD OP_9 OP_EQUALVERIFY OP_ADD OP_7 OP_EQUALVERIFY OP_ADD OP_8 OP_EQUALVERIFY OP_1. The spender must push three numbers, a, b and c, with a+b=8, a+c=7 and b+c=9. The values 3, 5 and 4 work.
• Output 0 of 2c6c3a1319c3e42b4801dab62e3d3d59c51c3535b8dad20e9580650f114c7026 is spent by input 4 of 8d31992805518fd62daa3bdd2a5c4fd2cd3054c9b3dca1d78055e9528cff6adc. Its redeem script is a hash collision challenge: the spender must provide two different inputs with the same SHA-1 digest.

Both puzzles are valid, and both spends were mined. Since 0.10, a P2SH redeem script is not limited to the standard types, so these puzzles are unusual, not banned. For the standard script types, see the script overview.