Reference
Terminology, sizing and limits
The vocabulary, the constants, the arithmetic, and an honest list of what this protocol does not do.
Glossary
- Drop
- One recorded artifact or Pact Seed. The singular of the protocol name. Identified by the input that revealed it.
- Drops
- The application protocol. Covers media-first artifacts and Drop Pacts.
- Drops leaf
- The Tapscript leaf that carries a Drop: five data pushes, four
OP_DROPs and anOP_CHECKSIG. - Marker
- The first push. A namespace, not a label.
dropsordrops-pactfor this protocol. - Body
- The fourth push. 1 to 256 opaque bytes, interpreted according to the declared content type.
- Dropmark
- The first ten hex characters of the body hash, uppercased. A short human label. Never an identity, because it is not unique.
- Commit transaction
- The transaction that creates the Taproot output committing to the script tree containing the Drops leaf. Reveals nothing.
- Reveal transaction
- The transaction that spends the commit output on the script path, putting the leaf and control block into the witness.
- Control block
- The third witness item: a leaf-version-and-parity byte, the 32-byte internal key, and up to 128 merkle path hashes.
- Custody outpoint
- The output currently holding the artifact. Output 0 of the reveal, then output 0 of each spending transaction.
- Pact Seed
- A 184-byte record that fixes an agreement's identity and the hashes of its ruleset, ABI, genesis state, policy and data-availability policy.
- Enforcement floor
- The Seed field stating how much of the agreement Bitcoin enforces alone:
recorded,co-signedortemplate-enforced. - Pact Cell
- A 176-byte descriptor carried in its own leaf, asserting a Pact's current state, policy and the transition that produced it.
- Transition commitment
- A tagged hash over the 245-byte transition preimage. Appears in the successor Cell and in the DPC1 anchor.
- DPC1 anchor
- A 38-byte
OP_RETURNoutput marking a candidate Pact transition. Marks; does not prove. - Proof pack
- The deterministic CBOR structure holding a transition's supporting evidence.
- Projection
- Anything derived from immutable records, such as custody. Rebuilt after a reorganisation rather than patched.
- Finalized target
- The height an indexer will persist up to:
tip - (N - 1)for confirmation depth N. - OP_DROP
- The neighbouring token protocol, marker
bip110-op-drop. Also the Bitcoin Script opcode this carrier is named after.
Constants
| Constant | Value |
|---|---|
| Leaf chunk count | 10 (5 pushes, 5 opcodes) |
| Tapleaf version | 0xc0, the only accepted value |
| Markers | drops, drops-pact |
| Content type maximum | 80 bytes, ASCII |
| Body hash | 32 bytes, single-pass SHA-256 |
| Body length | 1 to 256 bytes |
| Creator key | 32 bytes, x-only secp256k1 |
| Control block base | 33 bytes |
| Control block merkle path | 0 to 128 hashes of 32 bytes |
| Witness items | Exactly 3 |
| Signature length | 64 or 65 bytes |
| Dropmark | 10 uppercase hex characters |
| Custody successor output index | 0 |
| Custody profile | drops-custody-v1, projection version 1 |
| Custody statuses | active, burned, legacy_unresolved |
| Mainnet confirmation floor | 6 |
| Networks | mainnet, testnet, signet, regtest |
| Pact Seed record | 184 bytes, magic DPSE |
| Pact Cell descriptor | 176 bytes, magic DPCL |
| Pact transition preimage | 245 bytes |
| DPC1 anchor script | 38 bytes |
| Enforcement floors | recorded, co-signed, template-enforced |
| Engine id grammar | ^[a-z][a-z0-9-]{0,15}$ |
| Pacts template grammar | ^[a-z][a-z0-9-]{0,40}$ |
| Hash tags | TapLeaf, TapBranch, TapTweak, Drops/Pact, Drops/PactTransition |
Fee and size considerations
The leaf lives in the witness, so its bytes are discounted to one weight unit each instead of four. Virtual size is weight divided by four, so witness bytes cost roughly a quarter of what the same bytes would cost in an output script.
Leaf size arithmetic
leafBytes = (1 + markerLen) # marker push
+ 1 # OP_DROP
+ (1 + mimeLen) # content type push
+ 1 # OP_DROP
+ 33 # 32-byte hash push
+ 1 # OP_DROP
+ pushOverhead(bodyLen) + bodyLen
+ 1 # OP_DROP
+ 33 # 32-byte key push
+ 1 # OP_CHECKSIG
pushOverhead(n) = 1 for n <= 75, 2 for 76..255, 3 for 256
| Body | Leaf bytes | Witness total | Approximate vbytes |
|---|---|---|---|
| 11 bytes | 100 | 201 | 51 |
| 75 bytes | 164 | 265 | 67 |
| 128 bytes | 218 | 319 | 80 |
| 256 bytes, the maximum | 347 | 450 | 113 |
Witness total assumes a 64-byte signature and a 33-byte control block, plus the witness item count and one compactSize length prefix per item. A leaf of 253 bytes or more needs a three-byte prefix rather than one, which is why the last row gains more than the body alone. Add 32 bytes to the control block for each merkle sibling, which is 8 vbytes each. Add the transaction's own base cost, roughly 42 to 60 vbytes for a one-input, one-output transaction, plus the commit transaction that funded it.
A Drop always costs two transactions: the commit that creates the Taproot output, and the reveal that spends it. Batch where you can. One reveal transaction may carry several Drops on several inputs, and each gets its own identity from its own input index.
Limitations
Stated plainly, because a protocol that hides its limits gets used for things it cannot do.
Structural
- 256 bytes is a hard ceiling. There is no chunking, continuation or multi-part convention, and adding one would be a different protocol.
- No revision or deletion. A confirmed Drop is permanent, mistakes included.
- No on-chain link between an artifact and a creator identity beyond the key that signed the reveal.
- Custody follows output 0 only. A wallet that spends the custody outpoint into a change position destroys custody.
Operational
- No mempool view for artifacts. Nothing exists before the confirmation depth.
- Marketplace actions are feature-gated and off by default;
sellis not supported at all. - Pacts is reference-only. There is no live Cell, no settlement authority and no custody of value.
- Deployment-scoped values such as activation heights and rebuild budgets differ between operators.
- Support outside Bitcoin Universe is not claimed, and other implementations may read records differently.
Implementation checklist, short form
- Parse the leaf structurally before interpreting any field.
- Enforce minimal push encoding and re-serialization equality.
- Reject markers you do not own, including
bip110-op-drop. - Validate the content type grammar, ASCII, and the 80-byte cap.
- Recompute SHA-256 of the body and compare.
- Validate the creator key as a curve point, not just a length.
- Verify the Taproot commitment against the spent output, in full.
- Require a three-item witness and reject an annex.
- Record only at or beyond your confirmation depth; on mainnet at least six.
- Derive identity from the reveal input index.
- Track custody at output 0 with the P2WPKH and P2TR value test.
- Rebuild projections after a reorg; never patch them.
- Serve bodies under the passive-content policy.
- Publish your network, confirmation depth and indexed height with every answer.
The conformance page expands each of these into a testable statement.