#32247 BIP-348 (OP_CHECKSIGFROMSTACK) (regtest only)

Implements BIP-348 (OP_CHECKSIGFROMSTACK) in Tapscript by repurposing OP_SUCCESS204 (0xcc). The opcode enables verifying 64-byte Schnorr signatures against arbitrary messages supplied on the stack rather than transaction sighashes. Activation is restricted to regtest via an always-active BIP9 deployment, leaving consensus and policy behavior on mainnet and other networks unchanged.

Problem: Tapscript cannot verify signatures over arbitrary data on the stack, preventing smart contract developers from testing covenant designs, oracle attestations, and delegated signature schemes against Bitcoin Core node consensus logic.

Evidence of importance:

• PR description notes that the opcode implementation allows experimentation and composition with other proposals: 'This change can be composed with other opcode specifications (e.g. CTV, see #31989) and bundled into the same deployment (yet to be specified).' Reference is made to the Delving Bitcoin thread 'ctv-csfs-can-we-reach-consensus-on-a-first-step-towards-covenants'.

Scope: Touches consensus interpreter code to execute OP_CHECKSIGFROMSTACK and update validation weight accounting. Modifies XOnlyPubKey::VerifySchnorr to accept arbitrary-length message spans instead of fixed 32-byte hashes.

Paused · Waiting on author

Open objection from 1440000bytes with no author reply for 459 days; review would repeat what has been asked.

Mild

objection that needs an answer has none yet (1440000bytes)

Thread notes: JeremyRubin withdrew his own concerns regarding pubkey ARGCHECK and NULL signature handling. 1440000bytes raised an open scope objection arguing CSFS should not be tapscript-only, which has not received an author reply.

Objections, suggestions, and questions:

Support:

• jonatack (member) (Concept ACK, 2025-04-11): Concept ACK [not substantive]
• shahsb (none) (Concept ACK, 2025-04-17): Concept ACK [not substantive]
• JeremyRubin (contributor) (ACK, 2025-04-17): Matches BIP semantics, implementation is reasonable
• instagibbs (member) (none, 2025-04-17): Wrote comprehensive tests covering edge cases and sigops budget, implementation matches BIP
• yuvicc (contributor) (Concept ACK, 2025-05-22): Concept ACK [not substantive]
• delta1 (none) (Concept ACK, 2025-06-09): Concept ACK [not substantive]

Participants:

• jonatack (member, support, 1 statements 2025-04-11 to 2025-04-11): Concept ACK
• JeremyRubin (contributor, support, 14 statements 2025-04-16 to 2025-04-17): cr ACK on cb0c9f6; reviewed script interpreter and pubkey APIs
• instagibbs (member, support, 2 statements 2025-04-16 to 2025-04-17): contributed functional tests for edge cases and sigops
• shahsb (none, support, 2 statements 2025-04-17 to 2025-04-17): Concept ACK and agreed with JeremyRubin's review
• yuvicc (contributor, support, 1 statements 2025-05-22 to 2025-05-22): Concept ACK
• delta1 (none, support, 1 statements 2025-06-09 to 2025-06-09): Concept ACK
• pinheadmz (member, neutral, 1 statements 2025-06-10 to 2025-06-10): suggested moving concept review and discussion to meta repo
• 1440000bytes (none, objection, 2 statements 2025-06-22 to 2025-06-22): argued OP_CHECKSIGFROMSTACK should not be restricted to tapscript only
• benthecarman (contributor, neutral, 2 statements 2025-06-22 to 2025-07-30): referenced BIP-348 and left a code organization nit

165 lines under test/bench/ci.

• src/script/interpreter.cpp +92/-3
• test/functional/feature_taproot.py +85/-1
• src/test/data/tx_valid.json +29/-0
• test/functional/test_framework/script.py +18/-2
• src/validation.cpp +12/-1
• test/functional/rpc_blockchain.py +13/-0
• src/test/data/tx_invalid.json +8/-0
• src/script/interpreter.h +6/-0
• src/test/versionbits_tests.cpp +6/-0
• src/kernel/chainparams.cpp +5/-0
• src/pubkey.cpp +3/-2
• src/deploymentinfo.cpp +4/-0
• src/rpc/blockchain.cpp +4/-0
• src/policy/policy.h +2/-1
• src/pubkey.h +2/-1
• src/script/script.cpp +3/-0
• src/test/transaction_tests.cpp +2/-0
• src/consensus/params.h +1/-0
• src/script/script.h +1/-0
• test/functional/test_framework/key.py +0/-1

The short text the ranking pass compares across PRs.

Implements the BIP-348 OP_CHECKSIGFROMSTACK opcode in Tapscript for regtest only. Bitcoin scripts cannot currently verify Schnorr signatures over arbitrary data on the stack, limiting prototyping for oracle protocols and covenants. The PR author highlights that providing a regtest implementation allows testing and composing CSFS alongside other covenant opcodes like CTV ahead of potential soft fork bundling. No mainnet or testnet activation is included.

P2 · new feature (ranking pass: Grouped with the other regtest-only opcode proposals)

Implements the BIP-348 OP_CHECKSIGFROMSTACK consensus opcode in Tapscript for regtest experimentation. Proposed soft forks and new opcodes represent strategic consensus decisions requiring rigorous validation and interpreter review even when restricted to regtest.

Membership: Tagged Consensus and implements new Tapscript opcode BIP-348 in `src/script/interpreter.cpp` and consensus deployment logic.

Factors: security/stability 1, bug 0, performance 0, user value 2, leverage 2