<p>The number 20 seems to originate from this commit : <a href="https://github.com/bitcoin/bitcoin/commit/8c9479c6bbbc38b897dc97de9d04e4d5a5a36730" rel="nofollow noreferrer"><code>8c9479c6bbbc38b897dc97de9d04e4d5a5a36730</code></a>, also tagged as <code>v0.3.12</code>, which introduced the term 'SigOps".  Sadly, I don't see any mention of this change in the commit message itself, or in this version's release note, and there isn't any documentation.</p>

<p>We see that both a limit for a maximum number of sigops in a block was set :</p>



<pre><code>static const int MAX_BLOCK_SIGOPS = MAX_BLOCK_SIZE/50;
</code></pre>

<p>and a way of counting them :</p>



<pre><code>int GetSigOpCount() const
{
    int n = 0;
    const_iterator pc = begin();
    while (pc &lt; end())
    {
        opcodetype opcode;
        if (!GetOp(pc, opcode))
            break;
        if (opcode == OP_CHECKSIG || opcode == OP_CHECKSIGVERIFY)
            n++;
        else if (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY)
            n += 20;
    }
    return n;
}
</code></pre>

<p>And the rules are still the same, specifically for bare multisig scripts (those not nested in <code>p2sh</code> or <code>p2wsh</code>).  A bare <code>CHECKMULTISIG</code> operation is always counted as 20 sigops (today 80, with witness scale factor), so allowing anything more than 20 checksigs in <code>CHECKMULTISIG</code> will invalidate this assumption and will make it so creating blocks with more then maximum allowed sigops possible.</p>

<p>The rules are less strict for p2sh\p2wsh scripts.  If the opcode just before <code>CHECKMULTISIG</code> is in the range <code>[OP_1, OP_16]</code>, then that number is counted as the sigops for the multisig verification, with anything else counted as 20.  In practice, 15 is the maximum of pubkeys you can push as a p2sh script because of the 520 bytes push limit, but for p2wsh, an example of 17-of-20 would look like :</p>

<pre><code>0x01 0x11 &lt;pubkey1&gt; &lt;pubkey2&gt; ... &lt;pubkey 20&gt; 0x01 0x14 CHECKMULTISIG
</code></pre>

CC BY-SA 4.0
2023-03-22T15:05:12.387Z
The real limit was introduced a few weeks later in v0.3.13: https://github.com/bitcoin/bitcoin/commit/a790fa46f40d751307f86c37a709eb119768ce5b#diff-27496895958ca30c47bbb873299a2ad7a7ea1003a9faa96b317250e3b7aa1fef

The sigops limit is per block so it doesn't preclude an individual multisig transaction with more than 20 signatures. At the time the standard miner limited the block sigops to 100 (and the block size to 10kb). Nodes also wouldn't relay transactions with more than 2 signatures.

But someone could have made a block a big multisig until v0.3.13
Sjors Provoost
CC BY-SA 4.0
2018-11-24T07:52:50.380Z
2018-11-25T06:31:34.447Z
2018-11-25T06:31:34.447Z
arubi
<p>In <code>script.h</code> the following limit is set:</p>

<p><code>MAX_PUBKEYS_PER_MULTISIG = 20</code></p>

<p>I'm wondering:</p>

<ul>
<li>Why is the limit set to 20?</li>
<li>How would one would construct a script that allows <code>n</code> more than the current <code>OP_16</code>?</li>
</ul>

<p>E.g. would this work?</p>

<p><code>OP_m &lt;pubKey1&gt; ... 1 20 OP_CHECKMULTISIG</code></p>

CC BY-SA 4.0
2018-11-20T19:31:54.450Z
Related: https://bitcoin.stackexchange.com/questions/51509/will-segwit-allow-for-m-of-n-multisig-with-very-large-n-and-m/51653#51653
Pieter Wuille
<bitcoin-core><script><multi-signature>
Why is 20 the maximum public keys in a multisig transaction?
JBaczuk
# Why is 20 the maximum public keys in a multisig transaction?

(Asked by: username_0 on 2018-11-20)

In `script.h` the following limit is set:

`MAX_PUBKEYS_PER_MULTISIG = 20`

I'm wondering:

* Why is the limit set to 20?
* How would one would construct a script that allows `n` more than the current `OP_16`?

E.g. would this work?

`OP_m  ... 1 20 OP_CHECKMULTISIG`

**Tags:** bitcoin-core, script, multi-signature

> **Comments:**
> **username_1**: Related: https://bitcoin.stackexchange.com/questions/51509/will-segwit-allow-for-m-of-n-multisig-with-very-large-n-and-m/51653#51653  

---

## 1 answers

### Answer by username_2 on 2018-11-24. Score: 2 | Accepted answer

The number 20 seems to originate from this commit : 8c9479c6bbbc38b897dc97de9d04e4d5a5a36730, also tagged as v0.3.12, which introduced the term 'SigOps".  Sadly, I don't see any mention of this change in the commit message itself, or in this version's release note, and there isn't any documentation.
We see that both a limit for a maximum number of sigops in a block was set :
static const int MAX_BLOCK_SIGOPS = MAX_BLOCK_SIZE/50;

and a way of counting them :
int GetSigOpCount() const
{
    int n = 0;
    const_iterator pc = begin();
    while (pc < end())
    {
        opcodetype opcode;
        if (!GetOp(pc, opcode))
            break;
        if (opcode == OP_CHECKSIG || opcode == OP_CHECKSIGVERIFY)
            n++;
        else if (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY)
            n += 20;
    }
    return n;
}

And the rules are still the same, specifically for bare multisig scripts (those not nested in p2sh or p2wsh).  A bare CHECKMULTISIG operation is always counted as 20 sigops (today 80, with witness scale factor), so allowing anything more than 20 checksigs in CHECKMULTISIG will invalidate this assumption and will make it so creating blocks with more then maximum allowed sigops possible.
The rules are less strict for p2sh\p2wsh scripts.  If the opcode just before CHECKMULTISIG is in the range [OP_1, OP_16], then that number is counted as the sigops for the multisig verification, with anything else counted as 20.  In practice, 15 is the maximum of pubkeys you can push as a p2sh script because of the 520 bytes push limit, but for p2wsh, an example of 17-of-20 would look like :
0x01 0x11   ...  0x01 0x14 CHECKMULTISIG

> **Comments:**
> **username_3**: The real limit was introduced a few weeks later in v0.3.13: https://github.com/bitcoin/bitcoin/commit/a790fa46f40d751307f86c37a709eb119768ce5b#diff-27496895958ca30c47bbb873299a2ad7a7ea1003a9faa96b317250e3b7aa1fef  The sigops limit is per block so it doesn't preclude an individual multisig transaction with more than 20 signatures. At the time the standard miner limited the block sigops to 100 (and the block size to 10kb). Nodes also wouldn't relay transactions with more than 2 signatures.  But someone could have made a block a big multisig until v0.3.13  

---

