Kaspa CheckSigFromStack opcodes were implemented in Rusty Kaspa PR #926 to let covenant-enabled scripts verify Schnorr or ECDSA signatures against a 32-byte message hash supplied on the stack. The merge landed in the covpp-reset2 development branch on April 6, 2026; it was code integration, not a mainnet activation announcement.
Key takeaways
OP_CHECKSIGFROMSTACKverifies a 64-byte Schnorr signature with a 32-byte x-only public key.OP_CHECKSIGFROMSTACKECDSAverifies a compact 64-byte ECDSA signature with a 33-byte compressed public key.- Both opcodes consume an explicit 32-byte message hash instead of calculating a transaction signature hash for the caller.
- The implementation enabled opcode bytes
0xd7and0xd8only when covenant engine flags were active. - PR #926 merged into a feature branch, so the merge did not establish testnet or mainnet availability.
What did Kaspa PR #926 implement?
The official Rusty Kaspa PR #926 replaced two previously unknown opcode slots with OpCheckSigFromStack and OpCheckSigFromStackECDSA. Each operation removes three values from the data stack: a signature, a message hash, and a public key. It validates the encodings, performs the secp256k1 check, and pushes the Boolean result when execution can continue.
The seven-commit pull request changed six files and added covenant-specific script vectors as well as Rust unit tests. Those tests compared the new operations with ordinary Schnorr and ECDSA checks for equivalent signatures, and exercised malformed hashes, keys, signatures, and short stacks. Eight repository checks passed before the merge.
How is CheckSigFromStack different from ordinary CheckSig?
An ordinary transaction signature operation derives the message from the transaction and its signature-hash rules. CheckSigFromStack instead verifies a signature over a digest that the script supplies. That makes the operation useful when a covenant needs to authenticate a statement other than the current input’s standard transaction digest.
The opcode does not hash human-readable text, fetch an oracle value, identify a signer, or decide what a message means. The contract and off-chain signer must agree on the preimage, hash function, field order, network context, and domain tag. Passing the same 32 bytes produces the same verification question regardless of the story an application attaches to them.
Which encodings and failure rules apply?
For the Schnorr variant, the implementation expects a 64-byte signature, exactly 32 bytes of message hash, and a 32-byte x-only public key. The ECDSA variant expects a compact 64-byte signature, a 32-byte hash, and a 33-byte compressed public key. Wrong sizes or invalid key material return script errors rather than being silently reinterpreted.
PR #926 also refined NULLFAIL. A nonzero signature that fails verification raises NULLFAIL; a 64-byte all-zero signature can represent a deliberate false result. This distinction lets scripts branch on a soft-failure placeholder without allowing arbitrary invalid signatures to become harmless false values. The test vectors cover both algorithms and both paths.
What can developers build with these opcodes?
The primitive can support delegated authorization, signed attestations, cross-system commitments, or covenant rules that verify a previously constructed digest. It is a verification component, not a complete application protocol. A secure design still needs replay rules, signer rotation, expiry or sequence semantics, data-availability assumptions, and an unambiguous serialization format.
Developers also need predictable resource accounting. The related guide to Kaspa script pricing and version-1 compute budgets explains how later development work placed script execution under per-input limits. Portable build tooling is a separate concern covered in the Rusty Kaspa musl toolchain overview.
What security assumptions remain outside the opcode?
Applications should domain-separate signed messages so a signature created for one protocol, network, or purpose cannot be replayed as another. Include a protocol identifier, version, network identifier, relevant object IDs, and freshness data in a canonical preimage before hashing. Never sign an unexplained hash presented by an untrusted interface.
The opcode proves only that a key validated a particular digest. It does not prove that the signer controlled an account at a different time, that external data was true, or that a website displayed the same preimage. Contract authors should publish test vectors and independently reproduce the exact digest before funds depend on it.
Was CheckSigFromStack live on Kaspa mainnet on April 6?
No conclusion of that kind follows from PR #926. GitHub records the base branch as covpp-reset2, not master or a stable release branch. The code also gates both operations behind covenant flags. A feature-branch merge is evidence of implementation and review, while network availability requires an integrating release, activation parameters, and an announced testnet or mainnet event.
The merge therefore carried no direct KAS price implication. It expanded the candidate scripting toolkit; it did not change supply, guarantee adoption, or justify a market forecast.
Frequently asked questions
Does CheckSigFromStack verify arbitrary text?
No. It verifies a signature over exactly 32 bytes. An application must define how text or structured data is encoded and hashed into that digest.
Can the opcode call an external oracle?
No. It can verify a signature already supplied to the script, but it has no built-in network request or external data feed.
Are Schnorr and ECDSA inputs interchangeable?
No. They use different opcode variants and public-key encodings. A script must select the intended algorithm and supply the required format.
Did the merge activate covenants?
No. It merged implementation code into a covenant development branch. Activation is a separate network-governed event.
Source and verification note
This article is based on merged kaspanet/rusty-kaspa PR #926, its merge commit, and the covenant script test vectors. These records establish the opcode numbers, algorithms, encodings, failure behavior, tests, merge time, and covpp-reset2 target. They do not establish mainnet activation, oracle correctness, application security, user adoption, or a KAS price effect.
