P2MS Bare Multisig - Full Anatomy

4. P2MS Bare Multisig — Full Anatomy

Overview

Bare multisig (Pay-to-Multisig, P2MS) is a native multisig construction that places the entire multisig logic directly in the locking script — no P2SH wrapper required. It was introduced with OP_CHECKMULTISIG and was used in some early Bitcoin transactions. Today it is considered non-standard for configurations larger than 1-of-3, meaning most miners won't relay transactions with larger bare multisig outputs.

Script Structure

Locking script:

OP_<m> <pubkey1> <pubkey2> ... <pubkeyN> OP_<n> OP_CHECKMULTISIG

Unlocking script:

OP_0 <sig1> <sig2> ... <sigM>

Where m is the required signatures and n is the total keys. The leading OP_0 is required due to a known off-by-one bug in the original OP_CHECKMULTISIG implementation that pops one extra item from the stack.

The OP_CHECKMULTISIG Bug

The implementation of OP_CHECKMULTISIG has a well-known off-by-one error: it pops m+1 signature items instead of m. The extra pop consumes whatever is below the signatures on the stack. The convention is to place OP_0 (null bytes) there as a dummy value. BIP 147 (low-S rule) mandates that this dummy element must be exactly OP_0 (empty byte vector).

Stack before OP_CHECKMULTISIG (2-of-3 example):
[OP_0, <sig1>, <sig2>, <pk1>, <pk2>, <pk3>, 3, 2]

OP_CHECKMULTISIG behavior:

1. Pop m (=2) from stack

2. Pop n (=3) from stack

3. Pop n public keys: pk1, pk2, pk3

4. Pop m signatures: sig1, sig2

5. Pop one extra item (the dummy OP_0) ← BUG

6. Match signatures to keys in order

7. Push 1 if >= m sigs verify, else 0

Script Size Comparison

1-of-1 bare multisig locking script:
OP_1 <33-byte pk> OP_1 OP_CHECKMULTISIG = 37 bytes

2-of-3 bare multisig locking script:
OP_2 <pk1> <pk2> <pk3> OP_3 OP_CHECKMULTISIG = 105 bytes

vs P2SH wrapper for same 2-of-3:
OP_HASH160 <20-byte hash> OP_EQUAL = 23 bytes (sender pays less)

This size difference is why P2SH-wrapped multisig became dominant: the sender only needs to store 23 bytes in their output, while the redeemer provides the full script when spending.

Standardness Limits

Bitcoin Core enforces the following standardness rules for bare multisig:

MAX_OP_RETURN_RELAY = 83 bytes
Bare multisig standard limits:
  - m-of-n where n <= 3
  - Keys must be compressed or uncompressed (valid EC points)
  - Total script size within limits

Transactions spending or creating bare multisig beyond 1-of-3 will not be relayed by default nodes, though miners can include them in blocks.