Bare multisig

Multisig

Lists several keys and asks for a number of them to sign, such as any two of three.

What it is

A bare multisig output writes every public key into the lock, then the number of signatures it needs. It suits shared funds and escrow, where no single key holder should be able to spend alone. Bare means the keys sit in the lock itself, not behind a hash.

Script pattern

  1. OP_2 How many signatures are needed (m).
  2. <pubkey 1> <pubkey 2> <pubkey 3> Every key that may sign, 33 bytes each.
  3. OP_3 How many keys there are (n).
  4. OP_CHECKMULTISIG Checks the signatures against the keys, in order.

Shown as 2-of-3; m and n can be anything up to 16.

How it is spent

OP_0, then m signatures in the same order as their keys.

Background

OP_CHECKMULTISIG has been part of Bitcoin's script since the start. An off-by-one in it consumes one extra stack item, which is why every unlock starts with OP_0.

First seen and adoption

First seen in block 164,467, on 2012-01-30. Its first transaction is 60a20bd93aa49ab4b28d514ec10b06e1829ce6818ec06cd3aabd013ebcdc4bb1.

Counts cover blocks 0 to 169755, every one verified complete and typed; the highest block we know is 974917. Blocks 169756 to 313024 are complete and not typed yet. A transaction with several types counts once under each. First seen means first seen in that range.

Transactions of this type per 10,000 blocks
From block Transactions
160,000 6

On chain

Transactions with an output of exactly this script shape (2-of-3), by template hash ff13a2361f3a… Transaction pages need sign-in.

Specification