<p>I've managed to build a P2SH 2-of-3 multisig contract that works, ie I can create addresses, send coins to them, and spend the outputs. Now I'd like to transition that solution to a P2SH-P2WSH, but I'm hitting a snag.</p>

<p>Here's the HEX of a transaction:</p>

<pre><code>01000000000102a34c065d1e389dbcb3edc34f611b719b7d3b691438dc915622f9e91652fd33b001000000220020384e512d8897924df63814aa332ee71a3600635268ecb3d984acf87a9e6141ecffffffff6fa82857ccb85ee4b48c00c11cfd59442a612cd8733741b11a70823301a2bf7e0000000022002095032074938de75c626ce882f6bf8ef48eec88d621772eee2de4996662ce9baeffffffff0300b4c4040000000017a9142a702b38c86db7d3bddf61f233af88aa2f0482b887801d2c040000000017a91428fe391e1ea27877bed496146a990bfcbbf0f50987df69f9020000000017a9145caf8cd6b560c11f6801e370333ed693764c8e4f8704004730440220491dcd2ef56238c45caace982bb6a8546172d622f5b9565fc6d4b044b96536e5022069ca7dae081c515d53cbf2366f258b224618a1e13921769686a26e070e3c4b4e01473044022039f3fda390f73f00c9f5d2ae358c915d291a239d13c84c1fcbd2f5fc9f3b0916022051e83a3d0154255907153d76888e977510821640258f39fe87282dc54a34a893016952210245c1385d4870baee4d5597654019e89930d9e8f42783fe5c57e1551bf81456442102cb3be5420ea834bce0b4e71ca717c199b315eb97c8e60a32f368e0d10af1023a21034abc8a0a8f62e8201f67796a2da3dc616609b82b246a1db4daba237354ce407e53ae0400483045022100e9184b1d52edec1e46162093406bcb73510254b222cb1ee04e20756c870b58e1022078127ec954ada7bf65403abac670b36dbdbba784ccde3a38ea435766f8c9c08d0147304402200678d5e35a599d73b15becba0935c60237a0b0a052736e3becf8ee975f15689d0220374b84b7842d698ba4379d12f98f10fd3141d4a4983ee136ad04cc527d35e1f9016952210208f65530fed9457996ac9bf6c3747fad3f1a362a64685378b81b4d1fa45653c62102fd0bcce6190272fd49a28b585ebec2b9fe02b5905c69260edfaaec098908ea4e2103f14ff5e9415a56e2249ef28902f0fbfd03d969f42dfdcc2f7f58adb45dbc62b453ae00000000
</code></pre>

<p>The error I'm getting when trying to use the RPC client's sendrawtransaction is this:</p>

<pre><code>{"result":null,"error":{"code":-26,"message":"bad-witness-nonstandard (code 64)"},"id":"1"}
</code></pre>

<p>What I tried to do was:</p>

<ul>
<li><p>In the address generation, I generated a P2SWH output script by putting an OP_0 + Sha256/Ripe160 of the multisig &lt;2 pubkey1 pubkey2 pubkey3 3 OP_CHECKMULTISIG>. This seems to work as the address that comes out looks right and can be sent to. (Might still be wrong but I'm guessing not).</p></li>
<li><p>When it comes to spending this output, I'm putting that OP_0 &lt; sha256ripe160 > in the scriptSig</p></li>
<li><p>The signatures are signing slightly differently to P2SH, they are modified to have the coin amounts signed over.</p></li>
<li><p>For the witness part, I'm putting the data parts of what would have been the old P2SH sig into the witness. Basically a 4 to say how many witness parts to expect, then a 0 for the baked in multisig bug, then the two signatures, then the &lt;2 pubkey1 pubkey2 pubkey3 3 OP_CHECKMULTISIG> as a big piece of data. I think it looks like the one in this example: <a href="https://github.com/libbitcoin/libbitcoin-system/wiki/P2SH(P2WSH)-Transactions" rel="nofollow noreferrer">https://github.com/libbitcoin/libbitcoin-system/wiki/P2SH(P2WSH)-Transactions</a>. And I can at least see in the output that there's a 040047 and then the first sig.</p></li>
</ul>

<p>What have I missed here? How is the witness malformed? Are there other changes needed to turn a working P2SH to a P2SH-P2WSH?</p>

CC BY-SA 4.0
2020-04-11T21:18:43.740Z
The redeemScript should be OP_0 + SHA256(script). No RIPEMD160, and the result is a 32-byte hash.
Pieter Wuille
CC BY-SA 4.0
2020-04-12T11:16:50.323Z
Thanks Pieter, I will have a look at that. Is the witness otherwise correct?
Carlos
CC BY-SA 4.0
2020-04-12T11:32:57.133Z
@PieterWuille actually I just checked, the scriptSig is in fact just OP_0 and the SHA256 of the unsigned multisig script
Carlos
CC BY-SA 4.0
2020-04-12T14:28:02.057Z
The _RedeemScript_ should be `OP_0+<32byte>` but the _SignatureScript_ should be `<34bytes>` (anything between <> is a data push). 
That makes your SignatureScript  `220020384e512d8897924df63814aa332ee71a3600635268ecb3d984acf87a9e6141ec`.
Coding Enthusiast
CC BY-SA 4.0
2020-04-12T14:40:31.343Z
Aaaah, the 34 bytes of the sig are not the 32 plus 2?
Carlos
CC BY-SA 4.0
2020-04-12T14:49:45.700Z
@CodingEnthusiast is anything wrong with the witness script? Is it nonstandard somehow? Or is this a red herring error caused by the SigScript being wrong?
Carlos
CC BY-SA 4.0
2020-04-12T14:55:58.857Z
Most probably the later since the witness is not empty the interpreter fails to find the type of the `RedeemScript` among the ones it knows about (ie. version 0 witness program).
Coding Enthusiast
CC BY-SA 4.0
2020-04-12T15:05:03.307Z
Ok so the sig needs to be the redeem as a single data push?
Carlos
CC BY-SA 4.0
2020-04-12T15:13:55.517Z
Ah I guess you mean it's 34 bytes because the data push is preceded by a length
Carlos
<bitcoin-core><transactions><segregated-witness><bitcoinj><p2wsh>
Bad witness error in P2SH-P2WSH
Carlos
# Bad witness error in P2SH-P2WSH

(Asked by: username_0 on 2020-04-11)

I've managed to build a P2SH 2-of-3 multisig contract that works, ie I can create addresses, send coins to them, and spend the outputs. Now I'd like to transition that solution to a P2SH-P2WSH, but I'm hitting a snag.

Here's the HEX of a transaction:

```
01000000000102a34c065d1e389dbcb3edc34f611b719b7d3b691438dc915622f9e91652fd33b001000000220020384e512d8897924df63814aa332ee71a3600635268ecb3d984acf87a9e6141ecffffffff6fa82857ccb85ee4b48c00c11cfd59442a612cd8733741b11a70823301a2bf7e0000000022002095032074938de75c626ce882f6bf8ef48eec88d621772eee2de4996662ce9baeffffffff0300b4c4040000000017a9142a702b38c86db7d3bddf61f233af88aa2f0482b887801d2c040000000017a91428fe391e1ea27877bed496146a990bfcbbf0f50987df69f9020000000017a9145caf8cd6b560c11f6801e370333ed693764c8e4f8704004730440220491dcd2ef56238c45caace982bb6a8546172d622f5b9565fc6d4b044b96536e5022069ca7dae081c515d53cbf2366f258b224618a1e13921769686a26e070e3c4b4e01473044022039f3fda390f73f00c9f5d2ae358c915d291a239d13c84c1fcbd2f5fc9f3b0916022051e83a3d0154255907153d76888e977510821640258f39fe87282dc54a34a893016952210245c1385d4870baee4d5597654019e89930d9e8f42783fe5c57e1551bf81456442102cb3be5420ea834bce0b4e71ca717c199b315eb97c8e60a32f368e0d10af1023a21034abc8a0a8f62e8201f67796a2da3dc616609b82b246a1db4daba237354ce407e53ae0400483045022100e9184b1d52edec1e46162093406bcb73510254b222cb1ee04e20756c870b58e1022078127ec954ada7bf65403abac670b36dbdbba784ccde3a38ea435766f8c9c08d0147304402200678d5e35a599d73b15becba0935c60237a0b0a052736e3becf8ee975f15689d0220374b84b7842d698ba4379d12f98f10fd3141d4a4983ee136ad04cc527d35e1f9016952210208f65530fed9457996ac9bf6c3747fad3f1a362a64685378b81b4d1fa45653c62102fd0bcce6190272fd49a28b585ebec2b9fe02b5905c69260edfaaec098908ea4e2103f14ff5e9415a56e2249ef28902f0fbfd03d969f42dfdcc2f7f58adb45dbc62b453ae00000000

```

The error I'm getting when trying to use the RPC client's sendrawtransaction is this:

```
{"result":null,"error":{"code":-26,"message":"bad-witness-nonstandard (code 64)"},"id":"1"}

```

What I tried to do was:

* In the address generation, I generated a P2SWH output script by putting an OP\_0 + Sha256/Ripe160 of the multisig <2 pubkey1 pubkey2 pubkey3 3 OP\_CHECKMULTISIG>. This seems to work as the address that comes out looks right and can be sent to. (Might still be wrong but I'm guessing not).
* When it comes to spending this output, I'm putting that OP\_0 < sha256ripe160 > in the scriptSig
* The signatures are signing slightly differently to P2SH, they are modified to have the coin amounts signed over.
* For the witness part, I'm putting the data parts of what would have been the old P2SH sig into the witness. Basically a 4 to say how many witness parts to expect, then a 0 for the baked in multisig bug, then the two signatures, then the <2 pubkey1 pubkey2 pubkey3 3 OP\_CHECKMULTISIG> as a big piece of data. I think it looks like the one in this example: <https://github.com/libbitcoin/libbitcoin-system/wiki/P2SH(P2WSH)-Transactions>. And I can at least see in the output that there's a 040047 and then the first sig.

What have I missed here? How is the witness malformed? Are there other changes needed to turn a working P2SH to a P2SH-P2WSH?

**Tags:** bitcoin-core, transactions, segregated-witness, bitcoinj, p2wsh

> **Comments:**
> **username_1**: The redeemScript should be OP_0 + SHA256(script). No RIPEMD160, and the result is a 32-byte hash.  
> **username_0**: Thanks username_1, I will have a look at that. Is the witness otherwise correct?  
> **username_0**: @username_1 actually I just checked, the scriptSig is in fact just OP_0 and the SHA256 of the unsigned multisig script  
> **username_2**: The _RedeemScript_ should be `OP_0+<32byte>` but the _SignatureScript_ should be `<34bytes>` (anything between <> is a data push).  That makes your SignatureScript  `220020384e512d8897924df63814aa332ee71a3600635268ecb3d984acf87a9e6141ec`.  
> **username_0**: Aaaah, the 34 bytes of the sig are not the 32 plus 2?  
> **username_0**: @username_2 is anything wrong with the witness script? Is it nonstandard somehow? Or is this a red herring error caused by the SigScript being wrong?  
> **username_2**: Most probably the later since the witness is not empty the interpreter fails to find the type of the `RedeemScript` among the ones it knows about (ie. version 0 witness program).  
> **username_0**: Ok so the sig needs to be the redeem as a single data push?  
> **username_0**: Ah I guess you mean it's 34 bytes because the data push is preceded by a length  

---

## 0 answers

