Witness

The witness is where a transaction proves it is allowed to spend its inputs. Signatures, scripts and the other evidence go here, in a separate section after the outputs.

It’s called “segregated” because it’s kept out of the transaction’s ID and gets a size discount. On Pearl it’s not optional: every spend proves itself in the witness, and the mempool turns away transactions that have none.

Try it

Pick the P2MR spend: its witness has four items, the most of any example.

Where is the witness, and how is it laid out?

After the last output and before the locktime, and only when the transaction starts with the marker and flag 00 01. There is one stack per input, in input order, with no count in front: the number of stacks is the number of inputs.

What’s in a normal spend’s witness?

One item: a 64-byte Schnorr signature. This is a key-path spend of a Taproot output, the way Pearl wallets spend virtually every coin.

A typical payment: 1 input, 2 outputs 205 bytes Copy

01000000 00 01 01 5939557091bae792be66f26cbd83fc78f16a690a854109e8a1d115e253812133 ab020000 00 ffffffff 02 b0359f1100000000 22 5120d7ab02c96a342bdddb5d07b9f3ebd6c04e077ff41418110b9a1e5997439416b2 00c2eb0b00000000 22 512062e9da3682aab288392cf7218bafc36287288abb3ce200c5d1a50aa234073b2b 01 40 4686c7014749649b25555874c7772ecb7a44e85454893ed5888db11ebcdc82a22d74ce1a1671d02810f5ba1dca3277409e95a653ba9644099f7da26be7a86ba2 00000000

Hover or focus the bytes to name each field Version bytes 0–3 1 Marker bytes 4 0x00 Flag bytes 5 0x01 Input count bytes 6 1 Previous txid bytes 7–38 33218153e215d1a1e80941850a696af178fc83bd6cf266be92e7ba9170553959 Output index bytes 39–42 683 scriptSig length bytes 43 0 Sequence bytes 44–47 0xffffffff Output count bytes 48 2 Amount bytes 49–56 295,646,640 grains (2.95646640 PRL) Script length bytes 57 34 Locking script bytes 58–91 prl1p674s9jt2xs4amk6aq7ul867kcp8qwll5zsvpzzu6revewsu5z6eqv9d5z4 Amount bytes 92–99 200,000,000 grains (2.00000000 PRL) Script length bytes 100 34 Locking script bytes 101–134 prl1pvt5a5d5z42egswfv7uscht7rv2rj3z4m8n3qp3w35592ydq88v4seuhn70 Witness items bytes 135 1 Schnorr signature length bytes 136 64 Schnorr signature bytes 137–200 4686c7014749649b25555874c7772ecb7a44e85454893ed5888db11ebcdc82a22d74ce1a1671d02810f5ba1dca3277409e95a653ba9644099f7da26be7a86ba2 Locktime bytes 201–204 0

Field	Bytes	Value
Version version	4 @0	1 int32 little-endian. Pearl wallets and pearld coinbases use version 1; relay policy accepts 1-2.
Marker marker	1 @4	0x00 Segwit marker (BIP-144): says witness data follows the outputs.
Flag flag	1 @5	0x01 Witness flag; 0x01 is the only value Pearl accepts.
Input count vin.length	1 @6	1 CompactSize number of inputs.
Previous txid vin[0].txid	32 @7	33218153e215d1a1e80941850a696af178fc83bd6cf266be92e7ba9170553959 The transaction being spent, stored byte-reversed (internal order); shown here in normal display order.
Output index vin[0].vout	4 @39	683 Which output of that transaction is spent (uint32 LE).
scriptSig length vin[0].scriptSig.length	1 @43	0 Always 0 for non-coinbase inputs in Pearl: every spend uses the witness instead.
Sequence vin[0].sequence	4 @44	0xffffffff Final (0xffffffff): no RBF signal, no relative locktime, and locktime is ignored for this input. Pearl wallets use this.
Output count vout.length	1 @48	2 CompactSize number of outputs.
Amount vout[0].value	8 @49	295,646,640 grains (2.95646640 PRL) int64 little-endian, in grains (1 PRL = 100,000,000 grains).
Script length vout[0].scriptPubKey.length	1 @57	34 CompactSize length of the locking script.
Locking script vout[0].scriptPubKey	34 @58	prl1p674s9jt2xs4amk6aq7ul867kcp8qwll5zsvpzzu6revewsu5z6eqv9d5z4 OP_1 OP_PUSHBYTES_32 <output key Q>: a Taproot output.
Amount vout[1].value	8 @92	200,000,000 grains (2.00000000 PRL) int64 little-endian, in grains (1 PRL = 100,000,000 grains).
Script length vout[1].scriptPubKey.length	1 @100	34 CompactSize length of the locking script.
Locking script vout[1].scriptPubKey	34 @101	prl1pvt5a5d5z42egswfv7uscht7rv2rj3z4m8n3qp3w35592ydq88v4seuhn70 OP_1 OP_PUSHBYTES_32 <output key Q>: a Taproot output.
Witness items witness[0].length	1 @135	1 Number of witness stack items for input 0.
Schnorr signature length witness[0][0].length	1 @136	64 CompactSize length of this witness item.
Schnorr signature witness[0][0]	64 @137	4686c7014749649b25555874c7772ecb7a44e85454893ed5888db11ebcdc82a22d74ce1a1671d02810f5ba1dca3277409e95a653ba9644099f7da26be7a86ba2 64-byte BIP-340 signature (R.x ‖ s) with SIGHASH_DEFAULT: a Taproot key-path spend.
Locktime locktime	4 @201	0 0: no time lock.

txid

d919e02a4adfd739ceef31d98803f0ddd24e1b1fa67b0fe572cdec42c1b384c9

Size

205 bytes · 154 vbytes

Block

130,825

Fee

7,915 grains

01 (one item), 40 (64 bytes), then the signature: the first 32 bytes are the x-coordinate of the nonce point R, the last 32 are s.

Size

64 or 65 bytes

Type

BIP-340 Schnorr signature

Format

R.x ‖ s [‖ sighash type]

• 64 bytes means the default sighash, which signs the whole transaction. It’s what Pearl’s wallet always makes.
• 65 bytes means the last byte is an explicit sighash type (01, 02, 03, 81, 82 or 83). An explicit 00 is invalid; any other length fails too.

What’s in a script-path witness?

More items. To spend through a script, you show the script, satisfy it, and prove it was committed to:

1. The script’s inputs: whatever the script expects to find on its stack, for example signatures.
2. The script itself (the leaf script).
3. The control block: the leaf version plus the Merkle path that links this script to the output.

Here is a real one from block 130,822, spending a P2MR output whose script is a 2-of-2 multisig:

Spends a P2MR output through a 2-of-2 script leaf 387 bytes Copy

01000000 00 01 01 12e24ff3c24019e7e27b48551647738dd1f8cfc68288d214fe1336fb2ae49129 01000000 00 ffffffff 03 005441d116000000 22 5120d22158c2414983b0177f0aa5c9f6b5598d47f52d187245b75050de3f5b111eff 0cc89a3b00000000 22 5120e68d4cd05e8317c7c4cbe8851694c376ea042437ead85aa5a55c5c4f15b03806 0cc89a3b00000000 22 512004773544fc453128ab1a5a4f721794a1d4141faf5a919b9412f56cbfa4013f7f 04 40 fca1da7d031d5096e68ac4501b30b907a35a379ce9aac05fa337cff0bd5ebecaf8a9ff45acdb2738e54937e8f56652f357328995ea567af6648151c510619960 40 4122bbf2d9ce57758ae7a15c6c7096a4401439630bbb45b7268eefef05f5f4128d9b04872ac61925ec231298c463d1102fa24f674dcd7a698873302d3873790a 47 0020b5b010c0e14cb57cecaba3484b962e6a7f92a9f2cb7bf66d9f0fbc0ced4d307dba2003b77fbc5b8c2f9c5e544c744b0a49e11cde9e6c32035cbba093774f57c7ae89ba529c 01 c1 00000000

Hover or focus the bytes to name each field Version bytes 0–3 1 Marker bytes 4 0x00 Flag bytes 5 0x01 Input count bytes 6 1 Previous txid bytes 7–38 2991e42afb3613fe14d28882c6cff8d18d73471655487be2e71940c2f34fe212 Output index bytes 39–42 1 scriptSig length bytes 43 0 Sequence bytes 44–47 0xffffffff Output count bytes 48 3 Amount bytes 49–56 98,000,000,000 grains (980.00000000 PRL) Script length bytes 57 34 Locking script bytes 58–91 prl1p6gs43sjpfxpmq9mlp2juna44txx50afdrpeytd6s2r0r7kc3rmlscf8dpl Amount bytes 92–99 999,999,500 grains (9.99999500 PRL) Script length bytes 100 34 Locking script bytes 101–134 prl1pu6x5e5z7svtu03xtazz3d9xrwm4qgfphatv94fd9t3wy79ds8qrq8x6km9 Amount bytes 135–142 999,999,500 grains (9.99999500 PRL) Script length bytes 143 34 Locking script bytes 144–177 prl1pq3mn238ug5cj32c6tf8hy9u5582pg8a0t2geh9qj74ktlfqp8alsddygmv Witness items bytes 178 4 Signature length bytes 179 64 Signature bytes 180–243 fca1da7d031d5096e68ac4501b30b907a35a379ce9aac05fa337cff0bd5ebecaf8a9ff45acdb2738e54937e8f56652f357328995ea567af6648151c510619960 Signature length bytes 244 64 Signature bytes 245–308 4122bbf2d9ce57758ae7a15c6c7096a4401439630bbb45b7268eefef05f5f4128d9b04872ac61925ec231298c463d1102fa24f674dcd7a698873302d3873790a Leaf script length bytes 309 71 Leaf script bytes 310–380 0020b5b010c0e14cb57cecaba3484b962e6a7f92a9f2cb7bf66d9f0fbc0ced4d307dba2003b77fbc5b8c2f9c5e544c744b0a49e11cde9e6c32035cbba093774f57c7ae89ba529c Control block length bytes 381 1 Control block bytes 382 c1 Locktime bytes 383–386 0

Field	Bytes	Value
Version version	4 @0	1 int32 little-endian. Pearl wallets and pearld coinbases use version 1; relay policy accepts 1-2.
Marker marker	1 @4	0x00 Segwit marker (BIP-144): says witness data follows the outputs.
Flag flag	1 @5	0x01 Witness flag; 0x01 is the only value Pearl accepts.
Input count vin.length	1 @6	1 CompactSize number of inputs.
Previous txid vin[0].txid	32 @7	2991e42afb3613fe14d28882c6cff8d18d73471655487be2e71940c2f34fe212 The transaction being spent, stored byte-reversed (internal order); shown here in normal display order.
Output index vin[0].vout	4 @39	1 Which output of that transaction is spent (uint32 LE).
scriptSig length vin[0].scriptSig.length	1 @43	0 Always 0 for non-coinbase inputs in Pearl: every spend uses the witness instead.
Sequence vin[0].sequence	4 @44	0xffffffff Final (0xffffffff): no RBF signal, no relative locktime, and locktime is ignored for this input. Pearl wallets use this.
Output count vout.length	1 @48	3 CompactSize number of outputs.
Amount vout[0].value	8 @49	98,000,000,000 grains (980.00000000 PRL) int64 little-endian, in grains (1 PRL = 100,000,000 grains).
Script length vout[0].scriptPubKey.length	1 @57	34 CompactSize length of the locking script.
Locking script vout[0].scriptPubKey	34 @58	prl1p6gs43sjpfxpmq9mlp2juna44txx50afdrpeytd6s2r0r7kc3rmlscf8dpl OP_1 OP_PUSHBYTES_32 <output key Q>: a Taproot output.
Amount vout[1].value	8 @92	999,999,500 grains (9.99999500 PRL) int64 little-endian, in grains (1 PRL = 100,000,000 grains).
Script length vout[1].scriptPubKey.length	1 @100	34 CompactSize length of the locking script.
Locking script vout[1].scriptPubKey	34 @101	prl1pu6x5e5z7svtu03xtazz3d9xrwm4qgfphatv94fd9t3wy79ds8qrq8x6km9 OP_1 OP_PUSHBYTES_32 <output key Q>: a Taproot output.
Amount vout[2].value	8 @135	999,999,500 grains (9.99999500 PRL) int64 little-endian, in grains (1 PRL = 100,000,000 grains).
Script length vout[2].scriptPubKey.length	1 @143	34 CompactSize length of the locking script.
Locking script vout[2].scriptPubKey	34 @144	prl1pq3mn238ug5cj32c6tf8hy9u5582pg8a0t2geh9qj74ktlfqp8alsddygmv OP_1 OP_PUSHBYTES_32 <output key Q>: a Taproot output.
Witness items witness[0].length	1 @178	4 Number of witness stack items for input 0.
Signature length witness[0][0].length	1 @179	64 CompactSize length of this witness item.
Signature witness[0][0]	64 @180	fca1da7d031d5096e68ac4501b30b907a35a379ce9aac05fa337cff0bd5ebecaf8a9ff45acdb2738e54937e8f56652f357328995ea567af6648151c510619960 64-byte BIP-340 Schnorr signature (SIGHASH_DEFAULT) consumed by the leaf script.
Signature length witness[0][1].length	1 @244	64 CompactSize length of this witness item.
Signature witness[0][1]	64 @245	4122bbf2d9ce57758ae7a15c6c7096a4401439630bbb45b7268eefef05f5f4128d9b04872ac61925ec231298c463d1102fa24f674dcd7a698873302d3873790a 64-byte BIP-340 Schnorr signature (SIGHASH_DEFAULT) consumed by the leaf script.
Leaf script length witness[0][2].length	1 @309	71 CompactSize length of this witness item.
Leaf script witness[0][2]	71 @310	0020b5b010c0e14cb57cecaba3484b962e6a7f92a9f2cb7bf66d9f0fbc0ced4d307dba2003b77fbc5b8c2f9c5e544c744b0a49e11cde9e6c32035cbba093774f57c7ae89ba529c The tapscript being executed; its TapLeaf hash is proven against the output by the control block.
Control block length witness[0][3].length	1 @381	1 CompactSize length of this witness item.
Control block witness[0][3]	1 @382	c1 P2MR control block: 0xc1 = leaf version 0xc0 with the parity bit forced to 1, no internal key, no proof hashes (single-leaf tree).
Locktime locktime	4 @383	0 0: no time lock.

txid

982089ac17ca91c7f3234bc7f9d02e8152ed9a6330dd4fad3cad1dd44706945f

Size

387 bytes · 232 vbytes

Block

130,822

Fee

1,000 grains

The last item is the top of the stack when the script starts, which is why the signatures come in reverse order of the keys. The P2MR page runs this script step by step.

What’s in a coinbase’s witness?

One item of 32 bytes, the witness reserved value. pearld fills it with zeros:

Coinbase of block 130,825 216 bytes Copy

02000000 00 01 01 0000000000000000000000000000000000000000000000000000000000000000 ffffffff 27 0309ff01048393d76a2f706f6f6c2e6b7279707465782e636f6d2f1550cad31e016e7bf00f2ecb ffffffff 02 cc84ce1d34000000 22 5120e31e8032a67b9af27dc279f448c003457bae6c5d28de7ee719bc87b6801ede17 0000000000000000 26 6a24aa21a9ed78cc1a61dcfcee9c59ddd9f4d56a98764c071e077bcc36fe9d1cf0aad50ebac3 01 20 0000000000000000000000000000000000000000000000000000000000000000 00000000

Hover or focus the bytes to name each field Version bytes 0–3 2 Marker bytes 4 0x00 Flag bytes 5 0x01 Input count bytes 6 1 Previous txid bytes 7–38 0000000000000000000000000000000000000000000000000000000000000000 Output index bytes 39–42 0xffffffff scriptSig length bytes 43 39 Coinbase script bytes 44–82 0309ff01048393d76a2f706f6f6c2e6b7279707465782e636f6d2f1550cad31e016e7bf00f2ecb Sequence bytes 83–86 0xffffffff Output count bytes 87 2 Amount bytes 88–95 223,838,373,068 grains (2238.38373068 PRL) Script length bytes 96 34 Locking script bytes 97–130 prl1puv0gqv4x0wd0ylwz086y3sqrg4a6umza9r08aecehjrmdqq7mctsmqaqsh Amount bytes 131–138 0 grains (0.00000000 PRL) Script length bytes 139 38 Locking script bytes 140–177 witness commitment 78cc1a61dcfcee9c59ddd9f4d56a98764c071e077bcc36fe9d1cf0aad50ebac3 Witness items bytes 178 1 Witness reserved value length bytes 179 32 Witness reserved value bytes 180–211 0000000000000000000000000000000000000000000000000000000000000000 Locktime bytes 212–215 0

Field	Bytes	Value
Version version	4 @0	2 int32 little-endian. Pearl wallets and pearld coinbases use version 1; relay policy accepts 1-2.
Marker marker	1 @4	0x00 Segwit marker (BIP-144): says witness data follows the outputs.
Flag flag	1 @5	0x01 Witness flag; 0x01 is the only value Pearl accepts.
Input count vin.length	1 @6	1 CompactSize number of inputs.
Previous txid vin[0].txid	32 @7	0000000000000000000000000000000000000000000000000000000000000000 All zeros: this input creates new coins (coinbase).
Output index vin[0].vout	4 @39	0xffffffff 0xffffffff together with a zero txid marks a coinbase.
scriptSig length vin[0].scriptSig.length	1 @43	39 CompactSize length of the scriptSig.
Coinbase script vin[0].scriptSig	39 @44	0309ff01048393d76a2f706f6f6c2e6b7279707465782e636f6d2f1550cad31e016e7bf00f2ecb Coinbase data. It starts with the block height 130825 (BIP-34, required in every Pearl block), then anything the miner likes.
Sequence vin[0].sequence	4 @83	0xffffffff Final (0xffffffff): no RBF signal, no relative locktime, and locktime is ignored for this input. Pearl wallets use this.
Output count vout.length	1 @87	2 CompactSize number of outputs.
Amount vout[0].value	8 @88	223,838,373,068 grains (2238.38373068 PRL) int64 little-endian, in grains (1 PRL = 100,000,000 grains).
Script length vout[0].scriptPubKey.length	1 @96	34 CompactSize length of the locking script.
Locking script vout[0].scriptPubKey	34 @97	prl1puv0gqv4x0wd0ylwz086y3sqrg4a6umza9r08aecehjrmdqq7mctsmqaqsh OP_1 OP_PUSHBYTES_32 <output key Q>: a Taproot output.
Amount vout[1].value	8 @131	0 grains (0.00000000 PRL) int64 little-endian, in grains (1 PRL = 100,000,000 grains).
Script length vout[1].scriptPubKey.length	1 @139	38 CompactSize length of the locking script.
Locking script vout[1].scriptPubKey	38 @140	witness commitment 78cc1a61dcfcee9c59ddd9f4d56a98764c071e077bcc36fe9d1cf0aad50ebac3 OP_RETURN aa21a9ed ‖ SHA256d(witness Merkle root ‖ nonce): the BIP-141 witness commitment.
Witness items witness[0].length	1 @178	1 Number of witness stack items for input 0.
Witness reserved value length witness[0][0].length	1 @179	32 CompactSize length of this witness item.
Witness reserved value witness[0][0]	32 @180	0000000000000000000000000000000000000000000000000000000000000000 The coinbase witness is one 32-byte value (the witness-commitment nonce); pearld uses zeros.
Locktime locktime	4 @212	0 0: no time lock.

txid

0a2acb6004406b21252d1578585dec84efd7e7547f1bca19c30c17538c51caa0

Size

216 bytes · 189 vbytes

Block

130,825

It’s not a proof of anything. It’s an input to the block’s witness commitment, which the coinbase page explains.

What is the annex?

An optional extra item at the very end of a witness. If a stack has at least two items and the last one starts with the byte 0x50, it’s the annex. Signatures commit to it, but no rule gives it a meaning yet; it’s reserved for future use.

Pearl handles it like Bitcoin at the consensus level. The difference is relay: Bitcoin Core treats annexes as non-standard and won’t relay them, while Pearl’s mempool has no such rule. The research for this site built a test spend with the annex 50706561726c (0x50 then “pearl”) and Pearl’s code accepted it, both by consensus and by policy. Adding it changed the wtxid but not the txid.

Why keep the witness separate?

Two reasons, both from Bitcoin’s segwit upgrade, both kept in Pearl.

• A stable ID. The txid is computed without the witness. A signature can’t change it, so a chain of unconfirmed transactions can refer to each other safely.
• A size discount. Witness bytes count a quarter toward a transaction’s virtual size. The payment above has 68 bytes of marker, flag and witness, which cost ⌈68 ÷ 4⌉ = 17 vbytes instead of 68. See fees and vsize.

What limits apply?

• Items on the stack may be at most 520 bytes each, and a stack at most 1,000 items, while a script runs. That’s why an XMSS signature, 2,340 bytes, travels as five items of 468 bytes.
• Signature work is limited per input by a budget of 50 plus the witness’s size in bytes; each signature check spends 50. Bigger witnesses buy more checks.
• Empty witnesses with the flag set are invalid: if a transaction says it has witness data, at least one stack must have an item.