OP_RETURN - Provably Unspendable Outputs

19. OP_RETURN — Provably Unspendable Outputs

Overview

OP_RETURN is opcode 0x6a and holds a special place in Bitcoin Script as the mechanism for creating outputs that are provably unspendable. Unlike other scripts that might be unspendable in practice (due to unknown preimages or private keys), an output with a scriptPubKey beginning with OP_RETURN is guaranteed by consensus rules to be permanently unspendable — no valid scriptSig can ever satisfy it.

How OP_RETURN Works

When the Script interpreter encounters OP_RETURN during execution, it immediately terminates script evaluation and marks the script as failed:

// From src/script/interpreter.cpp
case OP_RETURN: {
    return set_error(serror, SCRIPT_ERR_OP_RETURN);
}

There is no way to branch around it, no way to skip it, and no way to satisfy it. Any scriptSig combined with a scriptPubKey that begins with OP_RETURN will always fail.

OP_RETURN Output Format

The standard use of OP_RETURN in modern Bitcoin is to embed arbitrary data in the blockchain:

scriptPubKey format:
OP_RETURN [data...]

Example (embedding text "Hello"):
6a 05 48 65 6c 6c 6f

Decoded:
  6a        --> OP_RETURN
  05        --> push 5 bytes
  48656c6c6f --> "Hello" in ASCII

Example (embedding 32-byte hash):
6a 20 <32-byte hash>

Decoded:
  6a        --> OP_RETURN
  20        --> push 32 bytes
  <32 bytes> --> arbitrary data

UTXO Set Pruning

A key economic benefit of OP_RETURN outputs is that they can be immediately removed from the UTXO (Unspent Transaction Output) set. Because they are provably unspendable, Bitcoin Core prunes them from the in-memory UTXO database, saving RAM and disk space:

Standard spendable output --> stored in UTXO set
OP_RETURN output          --> NOT stored in UTXO set (pruned immediately)

This is important because the UTXO set is a performance-critical data structure that must fit in memory for fast validation. Burning UTXOs (creating unspendable outputs with normal scripts) would bloat the UTXO set unnecessarily.

Data Embedding Protocols Built on OP_RETURN

Numerous protocols use OP_RETURN outputs to embed data in the Bitcoin blockchain:

Omni Layer (formerly Mastercoin):
  6a 14 6f6d6e69 <asset data>
  Prefix: "omni" in hex

OpenTimestamps:
  6a 28 4f70656e54696d657374616d7073 <merkle proof>
  Prefix: "OpenTimestamps"

Counterparty:
  6a <data>

Veriblock:
  6a <PoP data>

Ordinals (inscriptions use witness data, not OP_RETURN)

Each protocol defines its own prefix convention to distinguish its OP_RETURN data from others.

Value in OP_RETURN Outputs

Bitcoin consensus allows OP_RETURN outputs to carry any satoshi value (including zero). However, standard practice is to set the value to 0 satoshis, since any satoshis sent to an OP_RETURN output are permanently burned (destroyed). Bitcoin Core's standardness rules allow only 0-value OP_RETURN outputs in the standard template:

Standard OP_RETURN output:
  value: 0 satoshis (0x0000000000000000 in 8-byte little-endian)
  scriptPubKey: OP_RETURN [up to 80 bytes of data]

Sending non-zero satoshis to an OP_RETURN output is technically valid at the consensus level but is rejected by standard mempool policy.