The Subtil Genius of Casey’s Ordinals

Bitcoin has NFTs Non-Fungible Tokens, effectively tradeable digital assets or tokens where each is unique. now. They’re called Ordinal Inscriptions, but what the heck is an Ordinal and what’s an Inscription? And why should you care? The arrival of NFTs in the Bitcoin universe has caused a fair amount of drama. Ordinal enjoyers welcome the shiny new hotness, while many others see a serious attack on Bitcoin – guzzling up blockspace that should have been used by normal financial transactions, miners ripping massive four-meg’er blocks full of spam; and an attack on the very fungibility In economics, fungibility is the property of a good or a commodity whose individual units are essentially interchangeable, and each of whose parts is indistinguishable from any other part. of Bitcoin.

Ord, wallet software that runs alongside Bitcoin Core was released to the world in January 2023. Its creator, Casey Rodarmor, the inventor of Inscriptions and Ordinal theory has conceived of a way to use, or perhaps exploit Bitcoin’s Taproot script, enabling co-conspirators to store a large amount of arbitrary data within otherwise normal transactions created using ord. It uses a clever construction he’s called an envelope – a piece of code within the Taproot witness part of a Bitcoin transaction that all the nodes of the network will skip over when running the script to validate the transaction, but which contains stuff include the un-runnable bit – arbitrary data that can be extracted by anyone who knows where to look. As this simply uses existing opcodes and an otherwise standard Taproot transaction, Inscriptions have debuted onto the Bitcoin mainnet with zero code changes to Bitcoin Core required. No developer consensus nor permission was needed nor asked to unleash ord.

Ordinal theory does not require a sidechain or token aside from Bitcoin, and can be used without any changes to the Bitcoin network. It works right now.

This is the first piece of genius The envelope construct is really simple, one of those things that in hindsight should have been obvious. There’s nothing really new or hard to wrap your head-around about it. And there’s not really anything that can be done to stop it. The consensus rules allow it, so it is.

// Envelope Script:
OP_FALSE
OP_IF
  OP_PUSH "ord"
  OP_1
  OP_PUSH "image/jpeg"
  OP_0
  // Arbitrary data:
  OP_PUSH 5468652054696d65732030332f4a616e2f32303039
          204368616e63656c6c6f72206f6e206272696e6b20
          6f66207365636f6e64206261696c6f757420666f72
          2062616e6b73
OP_ENDIF

While there are many things one could use near-arbitrary, permanent, globally distributed & censorship-resistant storage for, it probably isn’t shocking to hear that much of the content already inscribed on-chain are the same endearing monkey JPEGs and dickbutts we’ve know and love from the shitcoin NFT craze. Inscriptions №1 and № 286, a dickbutt and a monkey.

See Also ⇝ Ordinal Theory Handbook for an explainer of what the heck Ordinal theory is, how Inscriptions work and how the two are related.

Storing stuff on the Bitcoin blockchain that isn’t merely a financial transaction is nothing new. Famously, the Bitcoin Genesis block carries the headline The Times 03/Jan/2009 Chancellor on brink of second bailout for banks in its coinbase transaction. Since the inclusion of that piece of text in the very first transaction in the very first block, thousands upon thousands of other non-financial pieces of data have been permanently stored on the chain.

The methods for achieving this have evolved over the years, and some of them really weren’t great – causing problems for nodes by consuming precious UTXO set storage, The UTXO Set is the set of all currently unspent transaction outputs - i.e. bitcoins that can be spent.
This has to be kept in fast and readily-available storage on Bitcoin Nodes, as it is required to validate that all newly-seen transactions are spending coins that exist and haven’t already been spent – unlike the rest of the chain history (full blocks, spent outputs) which can just be stored on-disk as they don’t need to be accessed as quickly.
Creating UTXOs that can never be spent leads to permanent growth of the UTXO set, which we’d like to avoid. and some using fake unspendable addresses as the storage mechanism, resulting in permanently burned coins. This mess was addressed by Bitcoin-Core begrudgingly introducing the OP_RETURN construction, The OP_RETURN change creates a provably-prunable output, to avoid data storage schemes – some of which were already deployed – that were storing arbitrary data such as images as forever-unspendable TX outputs, bloating bitcoin’s UTXO database.
Bitcoin Core v0.9.0 Release Notes, 19^{th March 2014}
and that seemingly resolved the question of storage on chain. Prior to the conception of Ordinal Inscriptions, using OP_RETURN has been by-far the most common way to store stuff – at times, contributing a significant share of all transaction volume and fees, though in recent years usage has steadily declined as the main volume drivers Omni and Veriblock have lost adoption. Above: OP_RETURN usage statistics by block, showing sharp peak then decline.
Via opreturn.org

But, OP_RETURN is limited to 80 bytes of data. This is a Standardness rule, not a Consensus rule. Almost all Nodes will refuse to relay unconfirmed transactions they see that have OP_RETURN outputs with more than 80 bytes of data, but these do rarely appear in blocks. Similarly, the Standardness rules also prevent burning of bitcoins via OP_RETURN. That’s workable for short snippets of text, but you can’t cram much else in there. That limit also gives a pretty clear indication of the core dev’s feelings about storing data on chain – don’t. Alas, because of a minor rule change introduced without much fanfare as part of the Taproot upgrade, the limit to script sizes that applied to SegWit was removed. This means Inscriptions are only capped in size by the blocksize limit of 4MB itself (or 4 million weight units, to be exact). An Inscription can be the only non-coinbase transaction in a block, filling the entire thing up itself. That’s a big deal – and yes, this has already happened (well, nearly). Block 774628 mined on the 1^st of February 2023 weighs in at a sweaty 3.96MB with only 63 transactions, the biggest of which was of course an Inscription that accounted for a whopping 3.94MB on its own.
If you’re wondering, the Inscription № 652 was this:

Average blocks in an Ordinal world are indeed bigger than the ~1.4MB we’d grown accustomed to since the SegWit upgrade raised the limit from a hard 1MB. Bigger blocks increase the rate at which network nodes fill up their storage, and the fallout of the 2017 blocksize wars A fall-out between different factions within Bitcoin over whether to increase the block size from 1MB to something more. This eventually led to Bitcoin Cash splitting off from the Bitcoin chain as a separate coin, and Bitcoin adopting SegWit with a 4MB (vByte) limit.
See The Blocksize War: The battle over who controls Bitcoin’s protocol rules, Jonathan Bier, March 2021, ISBN 979-8721895609 should be all that was needed to demonstrate how thermonuclear the question of block size is. Nevertheless, those mad at Ordinals for increasing the blockchain’s growth rate are in truth angry that the possible-in-theory since SegWit and Taproot activated has now become reality. The block-size limit was increased to 4MB back then, not in January 2023 when Casey released ord to the world. Blocks are meant to be full. If you hate Ordinals because they are filling juicy 4MB blocks, look to Taproot and SegWit for original sin. In a weird quirk, Inscriptions actually make blocks smaller for anyone running a pre-SegWit node, as the non-witness portion of the block is much smaller.

What’s more, in many ways it doesn’t matter what anyone thinks about Inscriptions. These are valid Bitcoin transactions so there’s next to nothing that can be done to stop them – that is after-all the point of Bitcoin. You can run a node with core-dev Luke Dashjr’s ‘ordisrespector’ patch that will filter unconfirmed Inscriptions out of your mempool, but unless the vast majority of Bitcoin node runners do this (spoiler: they haven’t), it’s a pointless exercise as Inscription transactions will still find their way to willing miners.

Luke Dashjr @LukeDashjr

#Bitcoin node patch (HACKY, UNTESTED) to filter out "ord" spam. NOT a protocol change or softfork/hardfork, just a harmless (if it works right) spam filter.
(Also a quick hack and NOT suitable for opening a PR to Core -- please write a proper fix for that)

08:09 PM · Feb 1, 2023

More drastic action than changing nodes’ mempool policy could be taken, such as a fork that tightened the rules back down again to limit the max script size for Taproot. Or, make any script that contains unreachable code (as envelopes do) invalid. But forking Bitcoin just to censor a specific use of it would be an act of self-defeat nearly as stupid and catastrophically damaging to Bitcoin’s core tenets as Ethereum’s DAO fork The DAO fork was in response to the 2016 DAO attack where an insecure DAO contract was drained of over 3.6 million ETH in a hack. The fork moved the funds from the faulty contract to a new contract with a single function: withdraw. Anyone who lost funds could withdraw 1 ETH for every 100 DAO tokens in their wallets.

This course of action was voted on by the Ethereum community. Any ETH holder was able to vote via a transaction on a voting platform. The decision to fork reached over 85% of the votes.

Some miners refused to fork because the DAO incident wasn’t a defect in the protocol. They went on to form Ethereum Classic.

Via Ethereum.org and bailout of 2016. It would betray the fundamental ideals that underpin Bitcoin and make a mockery of its philosophy. Mostly for this reason, because such an effort would likely meet fierce resistance and result in a permanent chain split; and presumably also because someone had a ‘sanctioned’ use of large tapscripts in mind, there have been no serious proposals to do this.

This is a second piece of perhaps unwitting genius – Ordinal Inscriptions are again proof that no single group, including the core developers, control the protocol. They prove that Bitcoin is nearly impossible to censor; that it is money for enemies. Miners are incentivised to mine blocks containing Inscriptions given they pay a fee just as any other transaction does. Users make these transactions. So, Inscriptions continue to make it into blocks. This is nice little lesson on one of the strengths of Bitcoin – incentive-aligned systems are stable and resist attack.

It goes without saying that Inscription transactions are big – that’s kinda the whole point. This also means that they’re not economically dense at all. A normal SegWit transaction can move hundreds of bitcoin worth billions of dollars in under 200 bytes, paying a fairly small fee. For Inscriptions, the value moving through transactions is much less contained in the quantity of sats moving, and more in the subjective and speculative value of the artwork in the kilobyte or megabyte sized witness data – but the Bitcoin network doesn’t care, and so artists and buyers must pay fees for what they use and can only hope to later make a return on their investment.

So it follows that the criticism of Inscriptions claiming that they are crowding other economic activity out of blocks is unfounded. Put it this way – a Lightning channel open transaction between two large nodes is the on chain footprint of a fast payments network that is expected to scale to processing thousands of transactions per second and moving mountains of value every minute. That kind of economic actor can afford a fee of hundreds or thousands of sats per byte and out-compete practically everyone else in the fee market, a rate still way higher than current next-block rates. Rates that high would make even a modestly sized Inscription cost more than a whole bitcoin in fees. Inscriptions are setting a fee floor and avoiding unfilled blocks, but by no means are they crowding everyone else out – and when Lightning really takes off, the opposite will be true.

I don’t subscribe to the argument that Inscriptions will particularly help to solve the long-term Bitcoin security budget – that miners will need to make the entirely of their profit from fees once the block subsidy reduces to zero. Yes, any kind of adoption helps, but Inscriptions probably don’t help any more than that. What really matters for the security budget is that the sum total of the fees paid to miners can purchase a large amount of energy, not that the fee rate needs to rise. There are only ever going to be 2.1 quadrillion satoshis in existence, which in a hyperbitcoinised world could mean a fee of 1 sat/vByte is not nothing in monetary terms. By comparison, there are currently around 2.1 quadrillion US¢ in existence. Current M3 Money Supply for the United States is 21.2 trillion USD
St. Louis Fed data via FRED (MABMM301USM189S), Feb 2023 But that’s a tangent for another time.

I think we’re going to see things like Inscriptions and Ordinals be the next biggest thing that happens in Bitcoin, there is a massive amount of demand for that stuff. Me liking or not liking it is irrelevant. The shitcoiners are running now Bitcoin nodes and full nodes cos they want their Inscriptions there. That’s an interesting funnel for Bitcoin.

Adam Back @adam3us

"you can't stop them" well ofc! bitcoin is designed to be censor resistant. doesn't stop us mildly commenting on the sheer waste and stupidity of an encoding. at least do something efficient. otherwise it's another proof of consumption of block-space thingy.

10:27 PM · Jan 29, 2023

See Also ⇝Bitcoin thought leaders weigh the pros and cons of Ordinals · Cointelegraph.com · 8^th March 2023

In spite of all this controversy and squabbling amongst friendly Bitcoiners, I hope we all can take a moment to appreciate a certain deliciousness here: Bitcoin accidentally has a NFT scheme that’s just better than the incumbent NFTs of the shitcoin world. Do you actually understand how smart-contract based NFTs work? The contract code is highly complex, written in a Turing-complete language that’s much harder to reason about than Bitcoin script’s simple stack, and often unaudited by buyers, with various standards in use across different collections and mints. To boot, you also need to understand the workings of which ever shitcoin chain it transacted on, and what their patron ‘foundation’ and VCs are up to. In truth, I don’t fully understand how it all works despite putting in some effort. In contrast, it took about two minutes to grok how envelopes work, and another two to see how Ordinals facilitate the transfer of Inscriptions between current and new owner. I’m sure someone could argue existing NFTs are fine or even great, but the comparative simplicity of Inscriptions speaks for itself.

Casey Rodarmor @rodarmor

My primary goal is protecting our community. If it has a token that isn’t bitcoin, it is not bitcoin.

Shitcoiners have been trying to rip normal people off with rube goldberg machines that don’t work and nobody understands.

08:28 AM · Feb 13, 2023

Worse still, the majority of NFTs are merely a claim to a small piece of on-chain metadata that contains a URL as an indirect reference to an image that lives elsewhere on the internet, somewhere much less permanent; like IPFS or an Amazon S3 bucket. If your Monkey JPEG isn’t on chain, do you really own it? What do you actually own? Ordinal Inscriptions are permanently burned onto the oldest, most secure chain there is. This is just better.

Ordinals aim to provide a farer, safer system for creating and trading digital artifacts where the system is simple enough to be understood so that all buyers and artists know exactly what they’re doing and dealing with. These are NFTs, but more ethical. No rugpulls with Ordinals. Editor’s Note added May 2024:
That’s a little embarrassing!
Clearly I didn’t anticipate the BRC-20 token scheme and Runes etc.
The point still stands that there aren’t rugpulls with inscriptions themselves disappearing, merely that speculative art and JSON investing is a risky business!

Some of the crypto bros have already realised the big upgrade that Inscriptions present.

I want the shitcoiners to come to us and assimilate into our culture

Enter the “Teleburn”. NFTs from other chains can be inscribed onto Bitcoin, and then destroyed, burned permanently from the old chain. You can see the appeal – an NFT on Bitcoin is better than one on Ethereum or Solana or wherever. Burning a Bored Ape attracts attention and headlines. There’s the allure of being first.

I have to admire the sheer audacity of the Teleburn. The upstart alternative to altcoin NFTs goes straight for the jugular with Teleburns, not seeking to join the NFT ecosystem but supplant it. While fears that Ordinals are an attack on Bitcoin are overblown if not entirely FUD, Teleburns are an attack on the entire shitcoin NFT ecosystem.

“Essentially throwing a Lamborghini into a trash compactor–It’s kind of fun,” Williams told Decrypt. “Whether putting bloated JPEGs on Bitcoin’s base chain is smart or not is a whole ‘nother discussion, but I think it’s going to be a lot of fun seeing how it plays out.”

Casey Rodarmor @rodarmor

eth was testnet
https://etherscan.io/tx/0x675...1788

06:55 PM · Feb 11, 2023

Prima facie, Inscriptions might merely be the new fun thing to mess with for the crypto and web3 inclined, a new goldrush where some of them might make a ton of money while it lasts. But what Casey has done with ord is trick a bunch of crypto bros into running full, synced Bitcoin nodes. You have to, if you want to use ord and inscribe something, a piece of genius design rather than a compromise limitation of some new and unpolished software.

How may of them were already running a full Ethereum node? Given you kinda need a stonking 30TB or more of free disk space to do so, I’d guess literally none of them.

There’s a chance that some of them might get it and catch the Bitcoiner bug.

It really is like a needle exchange program for degens. We bring them over to like a safer place and give them a dime bag of sats to get them hooked. Like, it’s hilarious!

You may notice we’ve spent most of our time so far talking about Inscriptions, but Ordinal sats, or more exactly “Ordinal Theory” has courted its own controversy.

A quick clarification – Inscriptions attach a digital artefact, like a JPEG to a sat, and then Ordinals are how we track ownership. Despite this technicality, the whole thing lumped together is usually just called “Ordinals”.

Part of this backlash might be confusion. Ordinal theory is entirely opt-in, and is literally just a convenient schema, or lens to view Bitcoin through. We socially agree on this theory that allows us to give every satoshi a unique number, just as banknotes have serials. It’s a lens through which you get an interesting and useful view of the Bitcoin system, but nothing more profound than that. If you hate it, cool, just ignore it.

The reason that Ordinal Theory arrived at the same time as Inscriptions is that it answers the follow-up question “how do I transfer ownership of an Inscription?” The answer is straightforward if we agree on Ordinal Theory, which then allows us to track satoshis from their genesis in the block that first produced them, through every transaction they are involved in. Doing this, it is then easy to see who the current owner of a sat that was used in an Inscription transaction – an ‘inscribed sat’ – is.

Ordinal Theory imbues satoshis with numismatic value, allowing them to be collected and traded as curios.

Predictably, the notion that sats can be uniquely identified, tracked through transactions, and made ‘special’ by being Inscribed triggered a hostile reaction from many Bitcoiners. It is critical to the functioning of money that it is fungible. One bitcoin over here needs to have precisely the same exchange value as another over there for Bitcoin to function properly as money – without fungibility, the asset degrades to something that trades closer to barter than a highly-liquid money.

This hostility is probably a healthy response – a concern that fungibility has in some real sense been damaged. But all that Ordinal Theory is doing is following the existing rules of Bitcoin, where everything in the ledger and supply schedule has a strict order, and adding a few conventions to complete the missing pieces of the picture. If that is all it takes to break the fungibility of Bitcoin, then it was never really fungible.

Ordinal Theory does not at-all reduce the privacy of coinjoins. I’m not sure how else to argue against that claim other than to say its proponents have simply misunderstood Ordinal Theory, or misunderstood coinjoins. A chain analysis company or government agency could easily have come up with a similar scheme themselves, and might already have done so – but you still can’t tell who was on the input nor output side of a transaction any more than you previously could.

All this does bring, in addition to the ability to trade Inscriptions like NFTs, is numismatism. Numismatics is the study or collection of currency, including coins, tokens, paper money, medals and related objects.
Via Wikipedia That is, within Ordinal Theory, some sats are ‘more interesting’ than others. Sats from Satoshi blocks, or rare and important events in Bitcoin’s history like halvings, difficulty adjustments, fork activation blocks and Exchange hacks can be all identified and then collected by people that value such things.

Ordinal hunting is difficult but rewarding. The feeling of owning a wallet full of UTXOs, redolent with the scent of rare and exotic sats, is beyond compare.

So now we have numismatism on Bitcoin. However, coin and stamp collectors are yet to threaten the fungibility and utility of Fiat monies, and nor will they now that they’re here. The additional value that collectors may ascribe to a specific sat doesn’t stop someone that doesn’t care from using it to buy coffee, in the some way that your Barista probably won’t notice or care if you pay for coffee with a dollar bill that has a nice round serial number, and certainly won’t offer you a discount!

This also doesn’t mean that ‘bad’ satoshis are any more encumbered than they already were. OFAC and the FBI don’t need Ordinal Theory to track transactions and blacklist addresses and UTXOs. That this was already possible is the reason conjoins and other privacy enhancing tech has been available for many years.

Big and controversial moves in Bitcoin increasingly lead to calls for ‘ossification’ – a growing conservatism against any change to consensus. Very clever upgrades like Taproot always promise great new things and fixes for nagging problems. But that latest upgrade to Bitcoin unintentionally enabled Inscriptions, something many Taproot proponents thoroughly dislike. It’s reasonable to wonder if there are other unanticipated uses for it, or other earlier upgrades that are still lingering and just waiting to be discovered.

Some of these could genuinely be harmful to Bitcoin, and there’s always a risk that making a change that has catastrophic unrecoverable consequences, however unlikely. Once a soft-fork has activated, we can’t just roll the chain back and undo it without massive consequences for what Bitcoin even is and means.

Taproot is very clever, but it is also very complicated and hard to fully understand – the club of people who do is pretty small. What we have now works fairly well, and change can be dangerous. Perhaps it should become increasingly onerous to introduce new consensus rules into Bitcoin, to the point that eventually the only changes to core will be non-consensus changes? That would leave only maintenance, like bug fixes, and performance enhancements that make Bitcoin as currently instantiated stronger.

Calls for ossification now are an over-reaction, though I’ll admit to partaking from time-to-time. Yet, being closer to the ossify now end of the spectrum rather than the hard fork every couple of months (ahem, Eth…) is the better end to be at, when we’re thinking about keeping what may be our only chance at non-governmental global censorship-resistant freedom money alive.

It can take a lot of time to come up with the best solution to an extant problem. Much of the argument in favour of big blocks in the 2015-2017 blocksize war The Bitcoin Block Size Wars Explained
Till Musshoff, Bitrawr
23^rd June 2021 was that there was no other way to scale Bitcoin into a global payments system that would be capable of VISA and Mastercard volumes. Then, Lightning The Bitcoin Lightning Network: Scalable Off-Chain Instant Payments (PDF)
Joseph Poon and Thaddeus Dryja
14^th Jan 2016 happened, presenting a much better alternative to dumb big blocks.

It looks like next thing in the pipeline is going to be Vaults & Covenants. In brief, normal Bitcoin transactions set the conditions for spending the outputs (coins) they create. These conditions are usually ‘just’ cryptographic – if you have the wallet keys that match the UTXO, you can spend it.
Bitcoin’s script language allows creating some more complex conditions, but these can’t really ’look outside the sandbox’ they’re running in - for example, you couldn’t check the date or time.
With Lightning, OP_CHECKLOCKTIMEVERIFY and OP_CHECKSEQUENCEVERIFY were added, providing new conditions that did allow checking times (they’re usually shortened to CLTV and CSV and called timelocks when used). These new opcodes were necessary for Lightning channels to work.
These opcodes are really just a simple Covenant opcodes; the new Covenants/Vault proposals are attempts to add further opcodes to Bitcoin that can enable further scaling layers, improved custody solutions, and theft protections to Bitcoin. In the wake of Taproot’s unintentional enabling of Inscriptions, it would be healthy for us to take our time ensuring these new features behave as intended and don’t bring any surprises.

Not to say that these proposals don’t already receive intense scrutiny and testing, yet Inscriptions gifted us a safe ‘failure’ case for perhaps ’too clever’ changes to consensus that have been merged. It is incredibly difficult to think of something no-one has yet though of. Once we’ve activated a consensus change, it’s nearly impossible to put the cat back in the bag and walk back.

The final piece that Inscriptions bring to Bitcoin is the thing we may come to be most thankful for. There are those that argue code is speech, and thus Bitcoin and its network are protected under the First Amendment of the US Constitution. That argument is perhaps contestable, but that literal art and words are speech is not – and now those are being etched directly into Bitcoin’s blocks.

Bitcoin is how more clearly than ever a venue for freedom of expression as protected by the First Amendment. Attempts to censor or restrict the use of Bitcoin by the US government could be legally challenged as a violation of this right, perhaps leaning on Inscriptions to make this case. Of course other countries have different rights & weaker freedoms of speech, with illiberal codes where the freedom to say what you wish could make Bitcoin more of a pariah not less – but it is perhaps in the United States were Bitcoin’s continuing success is most important, as it is the hegemony of the US dollar that it seeks to supersede.