P2SH-P2WSH
The Bitcoin transaction output type known as “nested P2WSH” or P2SH-P2WSH combines two distinct spending mechanisms: Pay-to-Script-Hash (P2SH) and Pay-to-Witness-Script-Hash (P2WSH). In essence, it entails enclosing a contemporary P2WSH script behind an antiquated P2SH framework.
Introduction and Goals
In order to provide compatibility between older wallets or exchanges that had not yet been updated to support native SegWit addresses (which begin with bc1q) and the more recent Segregated Witness (SegWit) features, P2SH-P2WSH was established.
The main objective was to make it possible for consumers to benefit from SegWit, particularly reduced transaction fees, even in cases where the sender was utilising a wallet that only recognized legacy P2SH addresses, which begin with a 3. Without compromising compatibility with older systems, this allowed the user to benefit from the discount provided by unlocking an output via the Witness field.
Also Read About What Is A Desktop Wallet And How Does Desktop Wallets Work
How it Works?
Two layers of unlocking are involved in P2SH-P2WSH transactions:
Sending (Locking)
- Bitcoin is actually sent to a conventional P2SH output when it is sent to a P2SH-P2WSH address.
- The address is obtained using a P2WSH ScriptPubKey’s HASH160.
- Being a typical P2SH locking script, the ScriptPubKey (locking script) is backward compatible with the majority of wallets and exchanges that allow sending to a 3address.
Spending (Unlocking)
The recipient needs to supply two levels of information in order to spend the bitcoins:
- Layer 1 (P2SH Requirement): The transaction input’s scriptSig field needs to contain the redeem script, which is the P2WSH script itself. This redemption script’s HASH160 needs to match the ScriptPubKey’s script hash. It is known as “nested P2WSH” because a P2WSH ScriptPubKey is contained in the scriptSig.
- Layer 2 (P2WSH Requirement): The required data (such as signatures) and the witness script (the original sophisticated script, such as multisig or timelock) must be supplied in a distinct section of the transaction known as the witness field. The 32-byte script hash in the P2WSH ScriptPubKey (which was disclosed in the scriptSig) must match the SHA-256 hash of this witness script.
Address Format
Like any other P2SH address, a P2SH-P2WSH address begins with a 3. This is due to the fact that the ScriptPubKey is P2SH. A P2SH-P2WSH cannot be recognised by its address alone; instead, it must be spent and the P2WSH locking script exposed in the scriptSig.
P2SH-P2WSH Features
| Feature | P2SH-P2WSH |
|---|---|
| Meaning | P2SH-wrapped Pay-to-Witness-Script-Hash |
| Purpose | Complex SegWit scripts + backward compatibility |
| Funds locked to | Hash of a redeem script, which contains a witness program |
| Address format | Starts with 3 |
| Use cases | Multisig, smart contracts, complex scripts with SegWit benefits |
| Benefits | Lower fees, SegWit, compatible with old software |
| Still used? | Yes, but being replaced over time by native SegWit (bc1) |
Advantages And Disadvantages of P2SH-P2WSH
Advantages
- By employing the well-known 3… address format, backward compatibility enables users to access SegWit benefits from wallets and exchanges that have not yet been updated to support native SegWit addresses (the bc1q format).
- Reduced Fees: When compared to a standard P2SH transaction, it offers a notable fee savings. This is due to the fact that the witness field, which contains the majority of the unlocking data, is discounted when determining transaction fees (each byte in the witness field only takes up 0.25 virtual bytes).
- Support for Complex Scripts: It makes it possible to utilise SegWit’s advantages in complex scripts, such as timelocks, multisig, and smart contracts.
- Malleability Fix: It aids in resolving transaction malleability, just like native SegWit.
Also Read About What Is A Bitcoin Address, Types And How Does It Works
Disadvantages
- Less Effective than Native P2WSH: P2SH-P2WSH is widely regarded as less effective than native P2WSH, although being more effective than legacy P2SH. This is because the P2SH wrapper requires more data, which makes it a little more complicated and larger than a P2WSH transaction.
- Complexity: It has two levels of unlocking processes that are difficult to comprehend.
Comparing costs (using the example of 2-of-3 multisig)
When taking into account “virtual bytes,” which are used to calculate transaction fees, the cost reductions become clear:
| Script Type | ScriptSig (virtual bytes) | Witness (virtual bytes) | Total (virtual bytes) |
| P2SH | 252 | 0 | 252 |
| P2SH-P2WSH | 35 | 63 | 98 |
| P2WSH | 0 | 63 | 63 |
The table shows that a P2SH-P2WSH output is less expensive to spend since it produces substantially less virtual bytes (98) than a classic P2SH output (252). At 63 virtual bytes, native P2WSH is still the least expensive choice.
Although P2SH-P2WSH is less prevalent now that the majority of wallets and services support native SegWit addresses, it is still a part of Bitcoin’s history and demonstrates the forward-compatible soft-forking nature of the cryptocurrency.