Updated: 2/23/2026

Covenants++

A collection of notes on Covenants++, Kaspa's advanced UTXO-based covenant environment.

Covenants++ is a broad term referring to the advanced UTXO-based covenants enabled by covenant primitives/building blocks on Kaspa. Covenants are (soon to be) first-class citizens on the Kaspa network. From a technical perspective, these building blocks can be grouped into two approximate (but related) categories:

  • Covenant IDs
  • Opcodes

These building blocks are in various statuses - some are active on mainnet while others are currently on testnet.

Use Cases

Kaspa’s covenant building blocks enable many use cases, including (but certainly not limited to):

  • Tokens (fungible & non-fungible). See CAT Protocol for reference though a standard for covenant based tokens on Kaspa is WIP.
  • Vaults (reference)
  • Congestion control (reference)
  • Whitelisting
  • Escrow
  • Time-delayed spending

Credit KIP-17 for many of these.

KIPs

  • KIP-10 - New Transaction Opcodes for Enhanced Script Functionality
  • KIP-17 - Covenants and Improved Scripting Capabilities
  • KIP-20 - Covenant IDs

Covenant IDs (& Covenant Bindings)

Introduced by KIP-20, covenant IDs are a consensus mechanism that stores, tracks, and enforces covenant lineage. Covenant IDs greatly simplify lineage related transaction scripting logic.

A Covenant ID is a optional 32 byte hash stored on a UTXO in the field covenant_id. When Some(covenant_id), the UTXO belongs to the given covenant’s lineage. It can be thought of as a member UTXO of the given covenant.

A Covenant Binding is an optional field on a transaction output. Covenant bindings contain two pieces of data:

  1. authorizing_input - the index of transaction input that “authorizes” the output’s creation
  2. covenant_id - the covenant that the output belongs to

Covenant bindings are only allowed on transaction versions >= 1.

Covenant UTXOs can be created in two ways:

  1. Genesis: The creation of a covenant ID. The authorizing input does not have the same covenant ID as the output. Covenant ID is computed via blake2b hash of select data in a manner that ensures uniqueness.
  2. Continuation: The output inherits the covenant ID of the UTXO spent by the authorizing input.

Genesis

The genesis process requires that the transaction creator compute the same covenant ID as the consensus engine. So, the creator must create a blake2b hash (in a manner commensurate with consensus), store it in the covenant_id. field of the transaction output’s covenant binding, and submit the transaction. If the consensus engine calculates the same covenant ID hash, it is valid. The authorizing_input field can be any valid input index.

The genesis process guarantees covenant id uniqueness and prevents forgery. More detail is available in KIP-20.

covenant_id = BLAKE2b("CovenantID",
    outpoint.tx_id
    || le_u32(outpoint.index)
    || le_u64(len(auth_outputs))
    || for each output:
        le_u32(output_index)
        || le_u64(output.value)
        || le_u16(spk.version)
        || le_u64(len(spk.script))
        || spk.script
)

Continuation

The output’s covenant binding ties the output back to an input with the same covenant ID. The output inherits the covenant ID from the input. This is referred to as authorization - the authorizing input for the given output. Consensus validates that the covenant IDs match and the transaction’s script validates transition.

The output’s covenant binding looks like:

  • authorizing_input: the index of the input from the same covenant lineage (with the same covenant ID).
  • covenant_id: the covenant ID

Opcodes

Kaspa’s covenant related opcodes enable introspection and other necessary script features. These have been added through the KIPs mentioned above.

OpcodeHexNotes
OpBlake2bWithKey0xa7Pops 2 items off the stack - key and data. Creates a 32 byte keyed hash using blake2b. Pushes the hash onto the stack.
OpTxVersion0xb2Pushes the transaction’s version onto the stack.
OpTxInputCount0xb3Pushes number of transaction inputs onto the stack.
OpTxOutputCount0xb4Pushes number of transaction outputs onto the stack.
OpTxLockTime0xb5Pushes the transaction’s lock time onto the stack.
OpTxSubnetId0xb6Pushes the transaction’s subnetwork ID onto the stack.
OpTxGas0xb7Pushes the transaction’s gas onto the stack.
OpTxPayloadSubstr0xb8Pops 2 items off the stack - start and end. Pushes the substring of payload from start to end onto the stack.
OpTxInputIndex0xb9Pushes this transaction input’s index onto the stack.
OpOutpointTxId0xbaPops 1 item off the stack as idx. Of the input at idx, pushes the previous outpoint’s transaction ID onto the stack.
OpOutpointIndex0xbbPops 1 item off the stack as idx. Of the input at idx, pushes the previous outpoint’s index onto the stack.
OpTxInputScriptSigSubstr0xbcPops 3 items off the stack - idx, start, and end. Of the input at idx, pushes the substring of signature_script from start to end onto the stack.
OpTxInputSeq0xbdPops 1 item off the stack as idx. Of the input at idx, pushes the sequence field as little-endian bytes onto the stack.
OpTxInputAmount0xbePops 1 item off the stack as idx. Of the input at idx, pushes the UTXO’s amount onto the stack.
OpTxInputSpk0xbfPops 1 item off the stack as idx. Of the input at idx, pushes the UTXO’s script public key (including version prefix) onto the stack.
OpTxInputDaaScore0xc0Pops 1 item off the stack as idx. Of the input at idx, pushes the UTXO’s DAA score onto the stack.
OpTxInputIsCoinbase0xc1Pops 1 item off the stack as idx. Of the input at idx, pushes the UTXO’s is coinbase flag onto the stack.
OpTxOutputAmount0xc2Pops 1 item off the stack as idx. Of the output at idx, pushes the output’s value (amount) onto the stack.
OpTxOutputSpk0xc3Pops 1 item off the stack as idx. Of the output at idx, pushes the output’s value script public key (including version prefix) onto the stack.
OpTxPayloadLen0xc4Pushes the transaction’s payload length onto the stack.
OpTxInputSpkLen0xc5Pops 1 item off the stack as idx. Of the input at idx, pushes the script public key’s byte length (including version prefix) onto the stack.
OpTxInputSpkSubstr0xc6Pops 3 items off the stack - idx, start, and end. Of the input at idx, pushes the substring of the UTXO’s script public key from start to end onto the stack.
OpTxOutputSpkLen0xc7Pops 1 item off the stack as idx. Of the output at idx, pushes the script public key’s bytes length (including version prefix) onto the stack.
OpTxOutputSpkSubstr0xc8Pops 3 items off the stack - idx, start, and end. Of the output at idx, pushes the substring of the script public key from start to end onto the stack.
OpTxInputScriptSigLen0xc9Pops 1 item off the stack as idx. Of the input at idx, pushes the signature script’s length onto the stack.
OpAuthOutputCount0xcbPops 1 item off the stack as input_idx. Of the input at input_idx, pushes the number of outputs authorized via covenant binding onto the stack.
OpAuthOutputIdx0xccPops 2 items off the stack - input_idx and k. Finds the k-th output that has a covenant binding pointing to the input at input_idx. Pushes the output’s actual index onto the stack.
OpNum2Bin0xcdPops 2 items off the stack, treating values as size and num. size must be at most 8 bytes. Serializes num into exactly size bytes.
OpBin2Num0xcePops 1 item off the stack, deserializes it as an i64, and pushes it back onto the stack as minimally encoded bytes.
OpInputCovenantId0xcfPops 1 item off the stack as idx. Of the input at idx, pushes the UTXO’s covenant ID onto the stack, or an empty byte vector if the UTXO does not have a covenant ID.
OpCovInputCount0xd0Pops 1 item off the stack as covenant_id. Pushes the number of inputs with this covenant id onto the stack.
OpCovInputIdx0xd1Pops 2 items off the stack - k and covenant_id. Finds the k-th transaction input with covenant_id and pushes the input’s actual index onto the stack.
OpCovOutCount0xd2Pops 1 item off the stack as covenant_id. Pushes the number of outputs with this covenant id onto the stack.
OpCovOutputIdx0xd3Pops 2 items off the stack - k and covenant_id. Finds the k-th transaction output with covenant_id and pushes the output’s actual index onto the stack.
OpChainblockSeqCommit0xd4Pops 1 item off the stack as block (32 byte block hash). Checks if block is a chain block from the POV of the current selected parent. If block has been pruned, is not a chain block, is from pre-covenant activation, or is beyond an allowed depth (currently finality depth), a script error is raised. The block’s accepted ID merkle root is retrieved and pushed onto the stack as the sequence commitment.

Other Resources

Examples