BIP 147 NULLDUMMY Explained: Closing a Bitcoin Malleability Vector

BIP 147 NULLDUMMY explained: see why CHECKMULTISIG consumes an extra stack item and how requiring it empty closes a malleability vector.

What the proposal changes

CHECKMULTISIG and CHECKMULTISIGVERIFY historically consume one extra stack item because of an early implementation bug. The item is not used in signature verification. BIP 147 makes consensus require that this dummy element be an empty byte array whenever those opcodes execute. The rule should be read from the primary specification and tested against the exact node release used in production.

Start with the validating node, because the ASIC only hashes the candidate header it receives. Record the node release and the pool component that assembled the block. If those facts are unknown, the operator cannot show which rules were actually applied before electricity was committed to the work.

Fields and encoding

In a legacy scriptSig or witness stack, the multisignature arguments begin with the dummy element, followed by signatures and the redeeming script where applicable. An opcode that pushes an empty vector is acceptable. Any non-empty bytes fail under NULLDUMMY even though the signatures themselves may be valid.

Byte order, length and units matter. A plausible human-readable value can still encode a different consensus or protocol meaning.

Treat status dashboards as observations, not as the source of truth. Compare them with an independently operated node and retain the raw deployment or template response. Period boundaries, chain reorganisations and cached pool pages can otherwise make a correct-looking percentage describe the wrong state.

Validation boundary

Because the unused value was ignored, a third party could change it without invalidating the spend. For SegWit this did not change the TXID when the item was witness data. But it changed the WTXID and could disturb compact-block relay and precomputed references. NULLDUMMY removes that degree of freedom.

ASICs hash work derived from this decision. At the same time, the validating node or pool service remains responsible for accepting the underlying block and transactions.

Build the failure response before the boundary arrives. Define which rejection messages trigger an alert, who can pause a template source and how failover is prevented from returning miners to the same faulty validation stack. A second hostname is not independent when both endpoints share one node.

Why miners care

Mining nodes must reject a transaction or block that executes multisig with a non-empty dummy after activation. Pools gained more stable witness transaction identifiers and less avoidable reconstruction churn. The rule does not eliminate every form of transaction malleability or replace careful protocol design. The practical effects include template correctness, propagation latency, stale-share exposure and whether a solved candidate earns a recognised reward.

Separate readiness, signalling and enforcement in the operating log. Readiness is a claim about software and process, signalling is data carried by blocks, and enforcement is a validation result. Combining them into a single supported or unsupported label hides the point at which revenue is actually at risk.

Failure modes

Libraries sometimes model multisig arguments without exposing the historical placeholder, leading an integrator to omit it or insert a numeric zero with a non-empty encoding. Test the raw stack representation. A logically zero number is not automatically the required empty vector. Monitoring should preserve raw messages and rejection reasons so an operator can distinguish a network delay from malformed work or incompatible policy.

Map responsibility across the full path: validating node, template server, pool protocol, proxy, firmware and ASIC. For each layer, state what it can alter and what it merely relays. This prevents a version-bit setting in firmware from being mistaken for complete consensus-rule support. Relate that responsibility map to the pool and job-control boundary in our Stratum V2 guide.

Deployment and compatibility

The policy had been standard relay behaviour since 2012. So activation was expected to have little impact on ordinary wallets. BIP 147 deployed with SegWit using the same version-bit parameters. Consensus enforcement still matters for blocks even when mempool policy already filters typical violations. Historical assignment dates anchor these articles.

But current deployments may have extra later standards. Pin versions rather than assuming uniform peer support.

Test the primary and failover paths with the same checks. Compare chain tip, chainwork, deployment state, required rules and template age, then save the result with a timestamp. The process should be repeatable by another operator without relying on an undocumented pool conversation.

Operator verification checklist

Construct legacy and witness multisig spends on regtest with empty and non-empty dummy values. Compare TXID and WTXID mutations, mempool rejection and block proposal results. Confirm custom signing and coin-selection systems use empty pushes and retain raw rejection evidence. Repeat the same test across primary and failover paths, retain timestamps and define a pause condition before changing production mining configuration.

Turn the conclusion into a business decision. State which chain and settlement venues the operation intends to serve, the maximum acceptable stale-block exposure and the point at which mining pauses. This connects protocol evidence to electricity cost, pool revenue and payout finality.

Operator decision record

A concise decision record for BIP 147 NULLDUMMY should name the source documents, their dates, the node release tested, the responsible pool or template provider and the exact trigger for action. Include screenshots or machine-readable output for the deployment state. But keep the raw node response as the stronger evidence.

State whether a change affects policy, block construction or consensus validity, because those layers have different failure costs.

Run the check on every production and failover path. Confirm that monitoring alerts on stale templates, unexpected chain tips, rejected proposals and a rise in stale shares. Keep rollback instructions for node and pool configuration. But do not roll back across an active consensus boundary without understanding the rules the older release enforces.

If the evidence conflicts, pause the affected path and investigate before committing more electricity to uncertain work.

For related background, read our plain-English BIP-110 guide and technical BIP-110 review. Those articles use a modern proposal to show why signalling, activation, template construction and accepted chain history must be examined separately.

Conclusion

Bip 147 nulldummy is best understood as a defined interaction between validating software, mining infrastructure and economic acceptance. The safest operator does not infer consensus from a dashboard percentage or a pool slogan. They verify the rule source, the activation boundary, the template fields and the chain their payouts ultimately settle on. That discipline reduces the chance of hashing an invalid or commercially unwanted block.