Coinbase transaction

The coinbase is the transaction a miner writes to pay themselves. It’s always the first transaction in a block, and it’s the only one allowed to create coins out of nothing.

It looks like any other transaction, with three twists: its input points at nothing, its scriptSig carries the block height and whatever else the miner wants, and, in any block with witness data, one of its outputs commits to all the block’s witnesses. Here is a real one, from block 130,825, mined by the Kryptex pool.

Try it

What does a coinbase look like?

216 bytes: one input, two outputs (the reward and the witness commitment), and a one-item witness. Its version is 2; pearld’s own template writes 1, but pools may write either.

How is its input different?

Only one input like this is allowed, in only one transaction per block, and it must come first.

What’s in the scriptSig?

Size

2 to 100 bytes

Type

Free-form, starting with a script-number push

Format

BIP-34 height first

Block 130,825’s 39 bytes, taken apart:

Only the first push is checked. It must be the height, in the shortest possible script-number encoding (heights 1 to 16 use the one-byte opcodes OP_1 to OP_16). After that the miner can write anything. The pool tag and extranonce here aren’t even valid script pushes, which is fine: a coinbase scriptSig is never run.

Pearl’s own node writes <height> <extranonce> "/P2SH/pearld/". Block 1’s coinbase is exactly that: 51 (OP_1, height 1), 00 (an extranonce of zero) and a 13-byte push of “/P2SH/pearld/”, a tag inherited from btcd.

How much does it pay?

At most the block subsidy plus the fees of every other transaction in the block. Block 130,825 claims exactly that:

Pearl’s subsidy shrinks a little with every block on a smooth curve, with no halvings; block 1 paid 3,229.64134063 PRL. The block reward page has the formula. A miner may claim less (the rest is lost forever), never more.

The reward output must follow the same rule as any output: Taproot, P2MR or OP_RETURN. Here it pays the Taproot address prl1puv0gqv4x0wd0ylwz086y3sqrg4a6umza9r08aecehjrmdqq7mctsmqaqsh.

What is the witness commitment?

The block header’s Merkle root covers txids, which leave witnesses out. So witnesses need their own commitment, and it lives in the coinbase, in an OP_RETURN output:

1. Build a Merkle tree of wtxids

   Every transaction’s wtxid, in block order, except the coinbase, whose own entry counts as 32 zero bytes (it can’t include itself).

2. Append the witness reserved value

   The coinbase’s single 32-byte witness item. pearld uses all zeros.

3. Hash twice

   SHA256d of those 64 bytes is the commitment. For block 130,825: 78cc1a61dcfcee9c59ddd9f4d56a98764c071e077bcc36fe9d1cf0aad50ebac3.

Block 1 shows the simplest case. With only the coinbase, the tree is a single zero entry, so the commitment is SHA256d of 64 zero bytes: e2f61c3f71d1defd3fa999dfa36953755c690689799962b48bebd836974e8cf9. That’s exactly what block 1’s coinbase contains.

The rules: the commitment output starts 6a24aa21a9ed and the last such output counts; if present, the coinbase witness must be exactly one 32-byte item; if absent, no transaction in the block may have a witness. Every normal Pearl spend needs a witness, so in practice only coinbase-only blocks can skip it. Some miners do: 8 of 200 recent blocks had a coinbase with no witness and no commitment.

When can the miner spend it?

After 100 blocks. A coinbase output from block 130,825 can first be spent in block 130,925. If a reorganization replaces the block, its coinbase vanishes too; the wait makes it very unlikely anyone has spent those coins by then.

What about the genesis block?

Pearl’s first coinbase is unusual in every way. It’s serialized the old way, with no witness, and its scriptSig is 234 bytes, longer than the 100-byte rule allows (the genesis block is never validated). It starts with 04 ffff001d 01 04, a copy of the start of Bitcoin’s own genesis coinbase (Bitcoin’s difficulty bits, not Pearl’s), then a 225-byte message that ends with the hash of Bitcoin block 946,842. Its only output pays 0 grains to a bare OP_RETURN, and the code marks it unspendable: Pearl had no premine.