buildUnlockScript

Builds the default staker unlock subscript, <pubkey> OP_CHECKSIG, from a compressed public key. Pure computation: no network call.

---

Usage

import { buildUnlockScript } from '@stacks/bitcoin-staking';

const unlockBytes = buildUnlockScript(
  '0316e35d38b52d4886e40065e4952a49535ce914e02294be58e252d1998f129b19'
);
// 35 bytes: 0x21 (push 33 bytes), the key, 0xac (OP_CHECKSIG)

Notes

• Throws an Error if the key is not 33 bytes, does not start with 0x02 or 0x03, or is not a point on secp256k1. The on-curve check matters because an off-curve key still yields a fundable lockup address whose OP_CHECKSIG can never pass.

• Pass the result as unlockBytes to buildLockScript, buildLockOutputScript or buildLockAddress, and as lockup.unlockBytes to buildRegisterForBond. buildRegisterMetadata calls it for you.

• pox-5 splices these bytes raw at the end of the lockup script, so they run in both spend branches (construct-lockup-script). register-for-bond takes them as staker-unlock-bytes, capped at 683 bytes (L664).

• finalizeReclaim expects exactly one staker public key in this subscript, which this format provides.

Reference Link

---

Signature

function buildUnlockScript(publicKey: Uint8Array | string): Uint8Array;

---

Returns

Uint8Array

The encoded subscript: a 33-byte push of the key followed by OP_CHECKSIG.

---

Parameters

publicKey (required)

• Type: Uint8Array | string

The staker's 33-byte compressed secp256k1 public key, as bytes or hex. This is the key that signs the lockup reclaim.