A deep-dive game theory analysis and code audit of Bitcoin's "Reduced Data Temporary Softfork", examining what the mechanism design reveals and what the code actually does.
BIP-110 proposes a one-year temporary consensus softfork restricting arbitrary data embedding in Bitcoin transactions. It targets the "inscriptions" phenomenon by capping data field sizes across seven transaction components.
| # | Rule | Limit | Rationale |
|---|---|---|---|
| 1 | Output scriptPubKey size | 34 bytes (83 for OP_RETURN) | Prevents UTXO bloat |
| 2 | Data push & witness element size | 256 bytes | Blocks embedded payloads |
| 3 | Undefined witness versions | Cannot be spent | Closes abuse vector |
| 4 | Taproot annex | Prohibited | No legit use, unlimited size |
| 5 | Control block size | 257 bytes (~128 leaves) | Limits deep Taptrees |
| 6 | OP_SUCCESS opcodes | Invalid in Tapscript | Prevents opcode abuse |
| 7 | OP_IF / OP_NOTIF | Invalid in Tapscript | Eliminates branch spam |
Grandfather clause: All UTXOs created before activation are permanently exempt from the new rules. No existing funds can be frozen. The restrictions only apply to new transactions created during the activation window, and they automatically lift after ~52,416 blocks.
BIP-110's activation mechanism is a textbook example of asymmetric incentive design. The mechanism creates a situation where signaling is always rational and holding out is increasingly costly.
Signaling costs nothing. Setting bit 4 in the block version field is a single bit flip with zero operational impact. But the consequences of not signaling, if the threshold is reached, are severe: orphaned blocks during the mandatory signaling window.
This creates a weakly dominant strategy: signaling is never worse than not signaling, and sometimes strictly better. In game theory terms, this is the most powerful incentive alignment you can create. The rational play is identical regardless of what you believe others will do.
Dec 2025 - Aug 2026. Miners signal for free. Pure coordination game with no risk.
~Aug 2026 if not locked in. Non-signaling blocks rejected. Chicken game: capitulate or lose blocks.
2 weeks post lock-in. Consensus rules active. Data restrictions enforced for ~1 year.
Here's the miner's decision matrix during the mandatory signaling period, assuming a clear majority has already signaled:
| BIP-110 Activates (55%+ signal) | BIP-110 Doesn't Activate | |
|---|---|---|
| You Signal | Your blocks are valid on both chains. You keep mining. Potential bonus: competitors' orphaned blocks = your extra revenue. | Nothing changes. You had a bit set. Zero cost. |
| You Don't Signal | Your blocks are rejected by BIP-110 nodes during mandatory signaling. If the BIP-110 chain wins, your blocks are orphaned. ~2 weeks of lost revenue. | Nothing changes. You mined normally. |
During the mandatory signaling period (~2,016 blocks), if 55% of hashrate signals and 45% doesn't:
At ~3.125 BTC per block, the 45% stands to lose up to ~2,835 BTC (~$280M at $100K/BTC) in orphaned block rewards over those two weeks. The 55% captures a proportionally larger share of total rewards during this window.
A common objection is that miners profit from inscription fees and won't want to restrict them. But the numbers don't support this:
The block subsidy is 85-97% of total miner revenue. Inscription fees are a fraction of the remaining fees, a rounding error. A miner who refuses to signal is risking their entire 3.125 BTC subsidy per block to protect maybe 0.05-0.1 BTC of inscription fee income. That's not a rational trade. The financial argument against signaling effectively doesn't exist at current subsidy levels.
The mechanism creates a ratchet effect that accelerates adoption once momentum builds.
Miners ideologically aligned with restricting data spam begin signaling. Zero cost, signals intent.
As signaling approaches ~30-40%, game-theoretic miners join. The probability of activation rises, making non-signaling increasingly risky.
The remaining holdouts face a clear calculation: the mandatory signaling window is approaching. Joining now costs nothing. Holding out risks real money.
Once 55% is crossed, lock-in is immediate and irreversible. There is no un-signal mechanism. The remaining 45% must comply or fork off.
If 55% is reached before the mandatory signaling period (~August 2026), lock-in happens immediately. Non-signaling miners don't even get the mandatory period as a warning shot. They're caught flat-footed. This creates an incentive to signal early, compressing the coordination timeline.
In plain terms: catch your competitors sleeping and you inherit their block rewards during the transition.
A common mistake is reading current signaling data as a prediction of outcome. It isn't. Miners have zero incentive to signal early, and every incentive to wait.
The activation threshold is checked per retarget period, not cumulatively. Signaling in January doesn't help you if the threshold isn't met until August. Early signaling only:
The rational play is: prepare privately, watch and wait, flip at the deadline.
Low visible signaling. Pool operators download the software, test it internally, have it staged. Public signaling stays in the single digits. Observers conclude "it won't activate."
Behind-the-scenes coordination among pool operators. Private conversations about who's flipping when. The game of chicken intensifies: nobody wants to be first, but nobody wants to be last.
One major pool flips. Then another. Once signaling crosses ~30-40%, the remaining holdouts face a clear calculation: mandatory signaling is days away, and the cost of being on the wrong side is 3.125 BTC per block. The flip completes within one or two retarget periods.
55% reached. Immediate, irreversible lock-in. The 45% who didn't signal have two weeks to upgrade before activation. Most do.
This is exactly what happened with SegWit activation in 2017. Months of political deadlock. Low signaling. Observers declared it dead. Then BIP91 created a deadline, and miners flipped from ~30% to lock-in within a single retarget period. The entire drama resolved in roughly two weeks once the deadline forced action.
BIP-110 has the same structure: a long signaling window where nothing appears to happen, followed by a mandatory deadline that compresses all the coordination into a narrow window.
Node adoption at ~7.5% in February 2026 tells you almost nothing about whether BIP-110 will activate by September 2026. The relevant question isn't "how many are signaling now?" but rather: "how many pool operators have the software staged and ready to flip?" That number is invisible to outside observers.
Pool operator concentration makes this even more volatile: the top 5 mining pools control roughly 70%+ of hashrate. If three or four pool operators decide to flip, it's over in an afternoon.
The financial argument against signaling is essentially zero. Inscription fees are a rounding error compared to the 3.125 BTC subsidy. The remaining barriers to activation are coordination and politics, not economics.
A miner can set bit 4 (signal) without running BIP-110 software. During mandatory signaling, this distinction matters critically: a "fake signaler" sets the bit but may build on top of non-signaling blocks. Their block is then invalid to BIP-110 nodes despite having the signal bit.
The 55% needs to be 55% of hashrate actually running the software, not just 55% flipping a bit. This is a coordination problem, not a financial one.
Individual miners don't set the signal bit. Pool operators do. A pool operator must decide to upgrade their node software and signal on behalf of all their hashrate. This concentrates the decision among a small number of actors. A handful of pool operators representing 55%+ of hashrate could activate BIP-110 regardless of what individual miners prefer.
Conversely, if pool operators are indifferent or hostile, individual miners have limited recourse short of switching pools.
Some miners and developers oppose BIP-110 not on financial grounds but on principle: a 55% UASF with mandatory signaling sets a precedent for low-threshold forced softforks. Even miners who dislike inscriptions may resist the mechanism itself. "If 55% can force this change, what gets forced at 55% next?"
The chain split dynamics only favor the 55% if the economic majority follows them. If exchanges, wallets, and users treat the non-BIP-110 chain as "Bitcoin," then mining on the BIP-110 chain means mining coins that trade at a discount. This is the one barrier that could override the game theory entirely, but it cuts both ways, as we explore in the next section.
Strip away the financial objections (subsidy dominance kills them) and you're left with: inertia, politics, and coordination. Those are real barriers, but they're exactly what the mandatory signaling mechanism is designed to overcome. And as we saw in the previous section, coordination can compress into a single retarget period when the deadline forces action.
The game theory doesn't stop at miners. Exchanges, custodians, and payment processors face the same asymmetric payoff, and their rational response creates a feedback loop that amplifies the activation pressure.
| BIP-110 Activates | BIP-110 Doesn't Activate | |
|---|---|---|
| Run BIP-110 Nodes | You follow the correct chain. No risk of accepting deposits from a losing fork. Zero downtime. | You ran slightly different node software. Zero cost. |
| Don't Run BIP-110 Nodes | You might follow the wrong chain during a split. Accept deposits that get reorged away. Potential catastrophic losses. | Nothing changes. |
The cost of upgrading is trivial: swap a node binary, restart. The cost of being on the wrong side of a chain split is existential for an exchange. This is the same dominant strategy miners face: prepare or risk ruin.
Each participant preparing "just in case" makes activation more likely, which justifies more preparation:
This is a positive feedback loop. The game theory doesn't just apply to miners. It cascades through the entire economic stack. Every rational actor preparing for the possibility of activation makes that possibility more real.
| Actor | Cost of Preparing | Cost of Not Preparing (if activated) |
|---|---|---|
| Exchanges | Node software update | Wrong chain, reorged deposits, potential insolvency |
| Custodians | Node software update | Stuck on minority fork, frozen withdrawals |
| Payment processors | Node software update | Accepting invalid transactions, merchant disputes |
| Wallet providers | Template/SDK update | Users creating non-relayable transactions |
| Mining pools | Set signal bit + run software | Orphaned blocks, lost revenue for pool members |
| Block explorers | Node software update | Displaying wrong chain data |
In every case, the cost of preparation is trivial and the cost of being wrong is severe. The rational move is always to prepare.
Exchanges that run BIP-110 nodes will inherit policy-level restrictions (mempool filtering, wallet depth limits, datacarrier cap) from the current release. These are relaxed in a future update after expiry.
We performed a comprehensive audit of the BIP-110 implementation across 70 commits, 80+ modified files in the dathonohm/bitcoin repository (branch 29.3.knots20260210+UASF-BIP110), comparing against the Bitcoin Knots 29.x-knots base.
The core consensus changes are clean and well-structured. A new SCRIPT_VERIFY_REDUCED_DATA flag (bit 21) gates all rule enforcement in the script interpreter:
// src/script/interpreter.h
+ SCRIPT_VERIFY_REDUCED_DATA = (1U << 21),
// Combined mandatory flags when deployment is active:
+ static constexpr unsigned int REDUCED_DATA_MANDATORY_VERIFY_FLAGS{0
+ | SCRIPT_VERIFY_REDUCED_DATA
+ | SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM
+ | SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION
+ | SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS
+ };
Per-input flag overriding exempts pre-activation UTXOs. This is the most complex part of the implementation:
// src/validation.cpp - ConnectBlock()
+ for (size_t j = 0; j < tx.vin.size(); j++) {
+ prevheights[j] = view.AccessCoin(tx.vin[j].prevout).nHeight;
+ if (prevheights[j] < reduced_data_start_height) {
+ flags_per_input.resize(tx.vin.size(), flags);
+ flags_per_input[j] = flags & ~REDUCED_DATA_MANDATORY_VERIFY_FLAGS;
+ }
+ }
The per-input flags created a subtle caching bug: if a transaction's validation result was cached with mixed flags (some inputs exempt, some not), a reorg that moved a UTXO across the activation boundary could serve a stale cache entry. The v0.3 release correctly disables caching when flags_per_input is non-empty:
+ if (cacheFullScriptStore && (!pvChecks) && flags_per_input.empty()) {
// Only cache if flags are uniform across all inputs
The modified BIP9 state machine adds three new parameters to BIP9Deployment:
| Parameter | Value | Purpose |
|---|---|---|
max_activation_height | 965,664 | Forced lock-in if threshold not met |
active_duration | 52,416 blocks | Auto-expiry after ~1 year |
threshold | 1,109 / 2,016 | 55% per-deployment threshold |
The state machine is modified so there is no FAILED state:
// src/versionbits.cpp
if (count >= nThreshold) {
stateNext = ThresholdState::LOCKED_IN;
+ } else if (max_activation_height < INT_MAX &&
+ pindexPrev->nHeight + 1 >= max_activation_height - nPeriod) {
+ stateNext = ThresholdState::LOCKED_IN; // Force lock-in
} else if (pindexPrev->GetMedianTimePast() >= nTimeTimeout) {
stateNext = ThresholdState::FAILED;
}
Combined with NO_TIMEOUT, the deployment always activates, either via organic 55% signaling or forced lock-in at max_activation_height.
The consensus rules auto-expire after ~52,416 blocks. Five categories of policy and wallet changes in the current release are relaxed in a post-expiry software update, as implied by any temporary deployment.
Three wallet components use TAPROOT_CONTROL_MAX_NODE_COUNT_REDUCED (7) instead of the original (128):
src/psbt.h): rejects Taptrees with depth >7src/script/descriptor.cpp): rejects tr() descriptors with >7 nestingsrc/script/signingprovider.cpp): refuses to build Taptrees >128 leavesThese align with consensus during the active period. After expiry, a software update can restore the original limits.
SCRIPT_VERIFY_REDUCED_DATA is included in STANDARD_SCRIPT_VERIFY_FLAGS unconditionally. The mempool rejects transactions with OP_IF in Tapscript, data pushes >256 bytes, and Taproot annexes regardless of deployment state. Additionally:
datacarriersize is capped at 83 bytes at startupDISCOURAGE_UPGRADABLE_WITNESS_PROGRAM, DISCOURAGE_UPGRADABLE_TAPROOT_VERSION, and DISCOURAGE_OP_SUCCESS have been removed from ignore_rejectsThese are sensible policy defaults during the active period. You don't want your mempool accepting transactions that consensus will reject. After expiry, a release can revert these to standard Bitcoin Core defaults.
SeedsServiceFlags() requires NODE_UASF_REDUCED_DATA for DNS seed responses (2 of 7 seeds support this). Non-BIP-110 outbound peers are limited to 2, with GetBIP110FullOutboundConnCount() only counting BIP-110 peers toward connection thresholds.
These are appropriate during the activation period to avoid partition risk between enforcing and non-enforcing nodes. With BIP-110 at ~7.5% of the network, the preferential peering helps ensure enforcing nodes stay connected to each other. After expiry, these preferences become unnecessary and can be removed.
The test suite includes 4 dedicated test files with ~2,000+ lines of Python functional tests. The coverage is broad but has precision issues at critical boundaries.
| Gap | Severity | Impact |
|---|---|---|
OP_RETURN at exactly 83 bytes uses soft if/else instead of assert |
Critical | Off-by-one at the 83-byte boundary goes undetected |
| Only witness v2 tested; v3-v16 claimed "similarly rejected" but never asserted | Medium | A version-specific bug would be missed |
| Temporary deployment expiry test logs but never asserts post-expiry acceptance | High | The "temporary" aspect is not verified to actually work |
| Mandatory signaling window boundaries (287 vs 288, 431 vs 432) not tested | High | Enforcement window off-by-one could exist |
Cache poisoning test only runs single-threaded (par=1) |
Medium | Multi-threaded race conditions untested |
| OP_IF/OP_NOTIF not tested in non-Tapscript contexts (legacy, P2WSH) | Medium | A regression banning OP_IF everywhere would be missed |
BIP-110's activation mechanism is well-designed for its stated goal. The asymmetric payoff (zero cost to signal, real cost if caught not-signaling), the first-mover advantage, the ratchet effect through mandatory signaling, and subsidy dominance over inscription fees create a powerful coordination mechanism where the financial case against signaling effectively doesn't exist. A 55% threshold is aggressive by Bitcoin standards, but defensible for a temporary measure.
The consensus rule implementation is clean, well-tested (with caveats), and follows Bitcoin Core conventions. The cache-poisoning fix in v0.3 shows active bug-hunting. The per-input flag override for the grandfather clause is the most complex piece and it's implemented correctly. The consensus auto-expiry mechanism works as designed.
The consensus rules genuinely auto-expire after ~52,416 blocks. This is the part that matters most: it's what determines which blocks are valid on the network. Policy-level restrictions in the current release are relaxed in a post-expiry update, as implied by the temporary design.
BIP-110 is a well-engineered mechanism for its stated purpose. The game theory strongly favors activation. The code is sound. The consensus rules are genuinely temporary. The remaining barriers are coordination and politics, not economics, and the mechanism is specifically designed to compress coordination into a narrow window at the deadline. Current signaling numbers are not predictive of outcome. The action, if it comes, will come fast.