Notation
This section fixes the symbols used across the specification. It defines only shared notation and reusable primitive relations; concrete record layouts, script execution, and signature-message construction are defined in their respective sections.
Types and values
| Notation | Meaning |
|---|---|
| $\mathbfBool$ | Truth values $\false,true$. |
| $\mathbfByte$ | The integers $\0,…,255$. |
| $\mathbfBytes$ | Finite byte strings. |
| $\mathbfBytes[n]$ | Byte strings of exactly $n$ bytes. |
| $\mathbfN$, $\mathbfZ$ | Nonnegative integers and integers. |
| $x:T$ | Value $x$ has type $T$. |
| $f:S \to T$ | Total function from $S$ to $T$. |
| $f(x)=false$ | $f$ is undefined, fails, or rejects input $x$. |
Sequences and records
| Notation | Meaning |
|---|---|
| $[x_0,…,x_n-1]$ | Ordered sequence with zero-based indexing. |
| $x[i]$ | Element at index $i$. |
| $ | x |
| $x |
Hex strings are written in display order. Sections that describe serialized fields state whether display order differs from wire order.
Record tables define field order, type, and meaning. Unless explicitly marked as logical state, a record table gives the order used by $E_T$.
Encoding and byte order
For a type or record $T$, $E_T(x)$ is the canonical byte encoding of $x$ as $T$. The partial inverse $E_T^-1(b)$ parses bytes $b$ as $T$ and is undefined for non-canonical or invalid encodings. When parsing succeeds, $E_T^-1(E_T(x))=x$.
$le(b)$ is the unsigned little-endian integer represented by byte string $b$. Fixed-width integer encodings and CompactSize are defined in Section Serialization.
Hashes
Hash values are protocol bytes. Human display strings often reverse the bytes of 256-bit hashes.
$$ \begin{aligned} \mathrm{H}(b) &= \operatorname{SHA256}(\operatorname{SHA256}(b)),\ \operatorname{HASH160}(b) &= \operatorname{RIPEMD160}(\operatorname{SHA256}(b)),\ \operatorname{TagHash}_{tag}(b) &= \operatorname{SHA256}(\operatorname{SHA256}(tag) || \operatorname{SHA256}(tag) || b). \end{aligned} $$
$H$ is hash256 in Bitcoin source material. Taproot and BIP340 Schnorr signatures use $TagHash$ (sources: nakamoto-bitcoin,bip-0340,bip-0341).
For a nonempty list of 32-byte hashes $L$, $MR(L)$ is the Merkle root obtained by repeatedly replacing adjacent pairs $(a,b)$ with $H(a||b)$. If a level has odd length, the final hash is duplicated for that level. $MR([])=false$.
Identifiers
$$ \begin{aligned} txid(tx) &= \mathrm{H}(\mathrm{E}{0}(tx)),\ wtxid(tx) &= \begin{cases} \mathrm{H}(\mathrm{E}{w}(tx)), & \text{witness serialization is used},\ txid(tx), & \text{otherwise}, \end{cases}\ \mathrm{bh}(h) &= \mathrm{H}(\mathrm{E}_{\mathrm{BlockHeader}}(h)). \end{aligned} $$
Chain context
For a chain $C$, $C[k]$ is the block at height $k$, with $C[0]$ as genesis. $height(B)$ is the height of block $B$, and $tip(C)=C[|C|-1]$. $MTP(C,k)$ is the median timestamp of $C[k]$ and its ten nearest ancestors, or all available ancestors when $k<10$.
Cryptographic relations
All public-key signature relations use the secp256k1 group. $ECDSAVerify(Q,m,\sigma)$ is true iff ECDSA signature $\sigma$ verifies digest $m$ under public key $Q$, subject to active script encoding rules. $SchnorrVerify(Q,m,\sigma)$ is the BIP340 verification relation (sources: bip-0066,bip-0340).