BIP141: New commitment structure #316

  75 | -  
  76 | -and the coinbase's input's witness must consist of a single 32-byte array for the witness nonce.
  77 | +For each stack item in the coinbase witness, a double SHA256 is calculated. The "witness commitment" is the root of a Merkle tree, whose leaves are all these hashes.
  78 |  
  79 | -If there are more than one scriptPubKey matching the pattern, the one with highest output index is assumed to be the commitment.
  80 | +Item 0 of the coinbase witness stack is the "wtxid commitment". The "wtxid commitment" must be exactly 32 bytes. It is the root of a Merkle tree, whose leaves are all those <code>wtxid</code> in the block, calculated in a way similar to the hashMerkleRoot in the block header. The <code>wtxid</code> of coinbase transaction is assumed to be <code>0x0000....0000</code>.

---

 178 | +Any contents or commitments that are not consensus-critical to Bitcoin, such as merge-mining, MUST NOT use the coinbase witness stack to preserve the ability to do upgrades of the Bitcoin consensus protocol.
 179 | +
 180 | +=== Location of the witness commitment ===
 181 |  
 182 | -  Double-SHA256(Witness root hash|Hash(new commitment|witness nonce))
 183 | +Theorectically, the witness commitment could be placed in any location within the coinbase transaction. In practice, most miners should place it in either the scriptSig or as one of the output scriptPubKey. The following discussion assumes that the BIP34 block size push occupies 4 bytes, which is true for the following 300 years with 10 minutes block interval.

---