<blockquote>
<p>Can Alice still &quot;send spendable funds&quot; to Bob?</p>
</blockquote>
<p>If she recovers the witness version before converting the address to the scriptPubKey she puts in the transaction, yes. Otherwise, no.</p>
<p>All witness transaction outputs in Bitcoin (see <a href="https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki" rel="nofollow noreferrer">BIP141</a>) are of the form <code>OP_n &lt;program&gt;</code> where n is a number between 0 and 16 inclusive, and program is a push of 2 to 40 data bytes. The meaning of that program depends on the version (for version 0 they are a public key or script hash, but that's not necessarily the case for later/future versions).</p>
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki" rel="nofollow noreferrer">BIP173</a>/<a href="https://github.com/bitcoin/bips/blob/master/bip-0350.mediawiki" rel="nofollow noreferrer">BIP150</a> witness addresses are just a way to encode that witness version n and program, to communicate it to the sender. In order to construct a valid transaction that the receiver can spend, both the OP_n and the program push must be exactly right.</p>
<blockquote>
<p>Can Alice determine the original <code>witness version</code> — e.g. by length of hash bytes? Could Alice determine the original witness version if she knew the address type P2WPKH/P2WSH?</p>
</blockquote>
<p>In theory, no. In practice, sometimes.</p>
<p>There are currently 3 types of witness outputs defined:</p>
<ul>
<li>P2WPKH has witness version 0, and a witness program of 20 bytes (which is the SHA256+RIPEMD160 of the public key).</li>
<li>P2WSH has witness version 0, and a witness program of 32 bytes (which is the SHA256 of the script)</li>
<li>P2TR has witness version 1, and a witness program of 32 bytes (which is an x-only potentially-tweaked public key, <strong>not a hash</strong>), see <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki" rel="nofollow noreferrer">BIP341</a>.</li>
</ul>
<p>Furthermore, there is a rule that witness version 0 outputs <strong>must</strong> have a program length of either exactly 20, or exactly 32 bytes. There are no such rules for version 1 and up. Future extensions may define meaning for witness version 1 with sizes other than 32, or may define meaning for witness versions 2 through 16.</p>
<p>So right now, a program length of 20 bytes will almost certainly mean a witness version 0 (anything else will be spendable by anyone, as no conditions are defined). But that's a bad assumption going forward, considering future consensus rule changes that assign meaning.</p>

CC BY-SA 4.0
2022-09-12T16:00:14.443Z
The OP_n is part of the `scriptPubKey`; but is that `scriptPubKey` already in the tx from Alice to Bob OR does Bob only need the `scriptPubKey` later when he wants to spend the funds?

Also, am I correct in saying the BIPs would somewhat constrain a new witness version to new type of address (P2xx), i.e. a new witness version (e.g. 9) would NOT re-use an existing type (e.g. P2WPKH) with some other constraints?
janniks
CC BY-SA 4.0
2022-09-12T16:24:56.803Z
The scriptPubKey is what the sender needs to construct a payment to the receiver. The receiver needs very different information to spend the coins (including the private key(s) involved, the scripts, ...).
Pieter Wuille
CC BY-SA 4.0
2022-09-12T16:41:50.607Z
Re P2WPKH... "P2WPKH" is just a human-readable name we give to "witness v0 outputs with 20 byte programs". So yes, by definition, new output types will be something else.
Pieter Wuille
CC BY-SA 4.0
2022-09-12T15:04:53.643Z
2022-09-12T15:22:44.077Z
2022-09-12T15:22:44.077Z
Pieter Wuille
<p>Generally if Alice wants to send Bitcoin to Bob it is best practice to ask for his address directly before sending Bitcoin to it rather than storing his address for a long period of time and assuming he still wants Bitcoin sent to that address later on.</p>
<p>Ignoring that, you cannot directly imply the witness version from the <a href="https://bitcoin.stackexchange.com/questions/100508/can-you-break-down-what-data-is-encoded-into-a-bech32-address">witness program</a>. However, so far the only SegWit witness versions that have been defined are 0 and 1. Witness version 1 is defined to be 32 bytes so if you had a 20 byte witness program you would know it wasn't a witness version 1 and hence by elimination must be a witness version 0. Of course it is possible in future that new witness versions may be introduced that have 20 byte witness programs like SegWit version 0 but currently they do not exist.</p>

CC BY-SA 4.0
2022-09-12T14:59:30.320Z
2022-09-12T14:59:30.320Z
Michael Folkson
<p>Let's assume Alice has Bob's bech32 address (BC1QW508D6QEJXTDG4Y5R3ZARVARY0C5XW7KV8F3T4).
After <a href="https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki#segwit-address-format" rel="nofollow noreferrer">decoding the address</a> Alice knows that the address has a <code>witness version</code> of <code>0</code> AND <code>20</code> bytes of a hash (<em><code>32</code> bytes would also be considered valid bytes</em>).</p>
<p>Let's say Alice writes down the <code>20</code> hash bytes, but forgets what the <code>witness version</code> was.</p>
<p>Can Alice still &quot;send spendable funds&quot; to Bob? Can Alice determine the original <code>witness version</code> — e.g. by length of hash bytes? Could Alice determine the original <code>witness version</code> if she knew the address type P2WPKH/P2WSH?</p>
<hr />
<p>In <a href="https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki#segwit-address-format" rel="nofollow noreferrer">BIP-173</a> the authors highlight the importance of the witness version:</p>
<blockquote>
<p>Implementations should take special care when converting the address to a scriptPubkey, where witness version n is stored as OP_n. OP_0 is encoded as 0x00, but OP_1 through OP_16 are encoded as 0x51 though 0x60 (81 to 96 in decimal). If a bech32 address is converted to an incorrect scriptPubKey the result will likely be either unspendable or insecure.</p>
</blockquote>
<hr />
<p>Is my understanding of the bech32 address data correct here?</p>

<address><segregated-witness><bech32-address><p2wsh><p2sh-p2wpkh>
Is the witness `version` of a bech32 address required to "send spendable funds" to the address?
janniks
# Is the witness `version` of a bech32 address required to "send spendable funds" to the address?

(Asked by: username_0 on 2022-09-12)

Let's assume Alice has Bob's bech32 address (BC1QW508D6QEJXTDG4Y5R3ZARVARY0C5XW7KV8F3T4).
After [decoding the address](https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki#segwit-address-format) Alice knows that the address has a `witness version` of `0` AND `20` bytes of a hash (*`32` bytes would also be considered valid bytes*).

Let's say Alice writes down the `20` hash bytes, but forgets what the `witness version` was.

Can Alice still "send spendable funds" to Bob? Can Alice determine the original `witness version` — e.g. by length of hash bytes? Could Alice determine the original `witness version` if she knew the address type P2WPKH/P2WSH?

---

In [BIP-173](https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki#segwit-address-format) the authors highlight the importance of the witness version:

> Implementations should take special care when converting the address to a scriptPubkey, where witness version n is stored as OP\_n. OP\_0 is encoded as 0x00, but OP\_1 through OP\_16 are encoded as 0x51 though 0x60 (81 to 96 in decimal). If a bech32 address is converted to an incorrect scriptPubKey the result will likely be either unspendable or insecure.

---

Is my understanding of the bech32 address data correct here?

**Tags:** address, segregated-witness, bech32-address, p2wsh, p2sh-p2wpkh


---

## 2 answers

### Answer by username_1 on 2022-09-12. Score: 2 | Accepted answer

> Can Alice still "send spendable funds" to Bob?

If she recovers the witness version before converting the address to the scriptPubKey she puts in the transaction, yes. Otherwise, no.

All witness transaction outputs in Bitcoin (see [BIP141](https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki)) are of the form `OP_n <program>` where n is a number between 0 and 16 inclusive, and program is a push of 2 to 40 data bytes. The meaning of that program depends on the version (for version 0 they are a public key or script hash, but that's not necessarily the case for later/future versions).

[BIP173](https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki)/[BIP150](https://github.com/bitcoin/bips/blob/master/bip-0350.mediawiki) witness addresses are just a way to encode that witness version n and program, to communicate it to the sender. In order to construct a valid transaction that the receiver can spend, both the OP\_n and the program push must be exactly right.

> Can Alice determine the original `witness version` — e.g. by length of hash bytes? Could Alice determine the original witness version if she knew the address type P2WPKH/P2WSH?

In theory, no. In practice, sometimes.

There are currently 3 types of witness outputs defined:

* P2WPKH has witness version 0, and a witness program of 20 bytes (which is the SHA256+RIPEMD160 of the public key).
* P2WSH has witness version 0, and a witness program of 32 bytes (which is the SHA256 of the script)
* P2TR has witness version 1, and a witness program of 32 bytes (which is an x-only potentially-tweaked public key, **not a hash**), see [BIP341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki).

Furthermore, there is a rule that witness version 0 outputs **must** have a program length of either exactly 20, or exactly 32 bytes. There are no such rules for version 1 and up. Future extensions may define meaning for witness version 1 with sizes other than 32, or may define meaning for witness versions 2 through 16.

So right now, a program length of 20 bytes will almost certainly mean a witness version 0 (anything else will be spendable by anyone, as no conditions are defined). But that's a bad assumption going forward, considering future consensus rule changes that assign meaning.

> **Comments:**
> **username_0**: The OP_n is part of the `scriptPubKey`; but is that `scriptPubKey` already in the tx from Alice to Bob OR does Bob only need the `scriptPubKey` later when he wants to spend the funds?  Also, am I correct in saying the BIPs would somewhat constrain a new witness version to new type of address (P2xx), i.e. a new witness version (e.g. 9) would NOT re-use an existing type (e.g. P2WPKH) with some other constraints?  
> **username_1**: The scriptPubKey is what the sender needs to construct a payment to the receiver. The receiver needs very different information to spend the coins (including the private key(s) involved, the scripts, ...).  
> **username_1**: Re P2WPKH... "P2WPKH" is just a human-readable name we give to "witness v0 outputs with 20 byte programs". So yes, by definition, new output types will be something else.  

---

### Answer by username_2 on 2022-09-12. Score: 0

Generally if Alice wants to send Bitcoin to Bob it is best practice to ask for his address directly before sending Bitcoin to it rather than storing his address for a long period of time and assuming he still wants Bitcoin sent to that address later on.

Ignoring that, you cannot directly imply the witness version from the [witness program](https://bitcoin.stackexchange.com/questions/100508/can-you-break-down-what-data-is-encoded-into-a-bech32-address). However, so far the only SegWit witness versions that have been defined are 0 and 1. Witness version 1 is defined to be 32 bytes so if you had a 20 byte witness program you would know it wasn't a witness version 1 and hence by elimination must be a witness version 0. Of course it is possible in future that new witness versions may be introduced that have 20 byte witness programs like SegWit version 0 but currently they do not exist.


---

