Drops Protocol documentation

Reference

Terminology, sizing and limits

The vocabulary, the constants, the arithmetic, and an honest list of what this protocol does not do.

Glossary

Drop
One recorded artifact or Pact Seed. The singular of the protocol name. Identified by the input that revealed it.
Drops
The application protocol. Covers media-first artifacts and Drop Pacts.
Drops leaf
The Tapscript leaf that carries a Drop: five data pushes, four OP_DROPs and an OP_CHECKSIG.
Marker
The first push. A namespace, not a label. drops or drops-pact for this protocol.
Body
The fourth push. 1 to 256 opaque bytes, interpreted according to the declared content type.
Dropmark
The first ten hex characters of the body hash, uppercased. A short human label. Never an identity, because it is not unique.
Commit transaction
The transaction that creates the Taproot output committing to the script tree containing the Drops leaf. Reveals nothing.
Reveal transaction
The transaction that spends the commit output on the script path, putting the leaf and control block into the witness.
Control block
The third witness item: a leaf-version-and-parity byte, the 32-byte internal key, and up to 128 merkle path hashes.
Custody outpoint
The output currently holding the artifact. Output 0 of the reveal, then output 0 of each spending transaction.
Pact Seed
A 184-byte record that fixes an agreement's identity and the hashes of its ruleset, ABI, genesis state, policy and data-availability policy.
Enforcement floor
The Seed field stating how much of the agreement Bitcoin enforces alone: recorded, co-signed or template-enforced.
Pact Cell
A 176-byte descriptor carried in its own leaf, asserting a Pact's current state, policy and the transition that produced it.
Transition commitment
A tagged hash over the 245-byte transition preimage. Appears in the successor Cell and in the DPC1 anchor.
DPC1 anchor
A 38-byte OP_RETURN output marking a candidate Pact transition. Marks; does not prove.
Proof pack
The deterministic CBOR structure holding a transition's supporting evidence.
Projection
Anything derived from immutable records, such as custody. Rebuilt after a reorganisation rather than patched.
Finalized target
The height an indexer will persist up to: tip - (N - 1) for confirmation depth N.
OP_DROP
The neighbouring token protocol, marker bip110-op-drop. Also the Bitcoin Script opcode this carrier is named after.

Constants

Every fixed value in one place
ConstantValue
Leaf chunk count10 (5 pushes, 5 opcodes)
Tapleaf version0xc0, the only accepted value
Markersdrops, drops-pact
Content type maximum80 bytes, ASCII
Body hash32 bytes, single-pass SHA-256
Body length1 to 256 bytes
Creator key32 bytes, x-only secp256k1
Control block base33 bytes
Control block merkle path0 to 128 hashes of 32 bytes
Witness itemsExactly 3
Signature length64 or 65 bytes
Dropmark10 uppercase hex characters
Custody successor output index0
Custody profiledrops-custody-v1, projection version 1
Custody statusesactive, burned, legacy_unresolved
Mainnet confirmation floor6
Networksmainnet, testnet, signet, regtest
Pact Seed record184 bytes, magic DPSE
Pact Cell descriptor176 bytes, magic DPCL
Pact transition preimage245 bytes
DPC1 anchor script38 bytes
Enforcement floorsrecorded, co-signed, template-enforced
Engine id grammar^[a-z][a-z0-9-]{0,15}$
Pacts template grammar^[a-z][a-z0-9-]{0,40}$
Hash tagsTapLeaf, TapBranch, TapTweak, Drops/Pact, Drops/PactTransition

Fee and size considerations

The leaf lives in the witness, so its bytes are discounted to one weight unit each instead of four. Virtual size is weight divided by four, so witness bytes cost roughly a quarter of what the same bytes would cost in an output script.

Leaf size arithmetic

leafBytes = (1 + markerLen)          # marker push
          + 1                        # OP_DROP
          + (1 + mimeLen)            # content type push
          + 1                        # OP_DROP
          + 33                       # 32-byte hash push
          + 1                        # OP_DROP
          + pushOverhead(bodyLen) + bodyLen
          + 1                        # OP_DROP
          + 33                       # 32-byte key push
          + 1                        # OP_CHECKSIG

pushOverhead(n) = 1 for n <= 75, 2 for 76..255, 3 for 256
Worked sizes, marker drops, content type text/plain
BodyLeaf bytesWitness totalApproximate vbytes
11 bytes10020151
75 bytes16426567
128 bytes21831980
256 bytes, the maximum347450113

Witness total assumes a 64-byte signature and a 33-byte control block, plus the witness item count and one compactSize length prefix per item. A leaf of 253 bytes or more needs a three-byte prefix rather than one, which is why the last row gains more than the body alone. Add 32 bytes to the control block for each merkle sibling, which is 8 vbytes each. Add the transaction's own base cost, roughly 42 to 60 vbytes for a one-input, one-output transaction, plus the commit transaction that funded it.

The two-transaction cost

A Drop always costs two transactions: the commit that creates the Taproot output, and the reveal that spends it. Batch where you can. One reveal transaction may carry several Drops on several inputs, and each gets its own identity from its own input index.

Limitations

Stated plainly, because a protocol that hides its limits gets used for things it cannot do.

Structural

  • 256 bytes is a hard ceiling. There is no chunking, continuation or multi-part convention, and adding one would be a different protocol.
  • No revision or deletion. A confirmed Drop is permanent, mistakes included.
  • No on-chain link between an artifact and a creator identity beyond the key that signed the reveal.
  • Custody follows output 0 only. A wallet that spends the custody outpoint into a change position destroys custody.

Operational

  • No mempool view for artifacts. Nothing exists before the confirmation depth.
  • Marketplace actions are feature-gated and off by default; sell is not supported at all.
  • Pacts is reference-only. There is no live Cell, no settlement authority and no custody of value.
  • Deployment-scoped values such as activation heights and rebuild budgets differ between operators.
  • Support outside Bitcoin Universe is not claimed, and other implementations may read records differently.

Implementation checklist, short form

  • Parse the leaf structurally before interpreting any field.
  • Enforce minimal push encoding and re-serialization equality.
  • Reject markers you do not own, including bip110-op-drop.
  • Validate the content type grammar, ASCII, and the 80-byte cap.
  • Recompute SHA-256 of the body and compare.
  • Validate the creator key as a curve point, not just a length.
  • Verify the Taproot commitment against the spent output, in full.
  • Require a three-item witness and reject an annex.
  • Record only at or beyond your confirmation depth; on mainnet at least six.
  • Derive identity from the reveal input index.
  • Track custody at output 0 with the P2WPKH and P2TR value test.
  • Rebuild projections after a reorg; never patch them.
  • Serve bodies under the passive-content policy.
  • Publish your network, confirmation depth and indexed height with every answer.

The conformance page expands each of these into a testable statement.