Part VI · Protocol Layer Chapter 19

Runes: Fungible Tokens on Bitcoin

"Runes allow Bitcoin transactions to etch, mint, and transfer Bitcoin-native digital commodities."—Ordinal Theory Handbook, Runes

Chapter 18 showed how inscriptions create non-fungible digital artifacts—one inscription per sat, each unique. Runes take the opposite approach: they create fungible tokens on Bitcoin, where every unit of a given rune is identical and interchangeable.

Where inscriptions live in the witness (Taproot script-path envelopes), runes live in OP_RETURN outputs. Where inscriptions exploit the witness discount for cheap storage, runes exploit OP_RETURN's compactness for efficient protocol messages. The two protocols coexist cleanly: a single transaction can contain both an inscription (in the witness) and a runestone (in an OP_RETURN output) without conflict.

The Runes protocol activated at block 840,000—the same block as Bitcoin's fourth halving (April 20, 2024).

19.1The Runestone

A rune protocol message is called a runestone. It is stored in a transaction output whose scriptPubKey begins with:

🔧 Interactive: Runestone Decoder
Runestone Output Prefix

OP_RETURN OP_13

The OP_13 opcode (0x5d) identifies the output as a runestone, distinguishing it from other OP_RETURN protocols. The remaining data pushes in the scriptPubKey are concatenated into a payload buffer, which is decoded as a sequence of 128-bit LEB128 integers and parsed into the runestone's fields.

OP_RETURN, Not Witness

Unlike inscriptions (which use the witness discount via Taproot script-path spends), runestones are OP_RETURN outputs—non-witness data at 4 WU/byte. This is acceptable because runestone payloads are small (typically \(<\)80 bytes), so the absolute weight cost is modest. The OP_RETURN approach has a key advantage: the runestone is visible in the transaction's output list without parsing witness data.

19.1.1LEB128 Encoding

The payload is a sequence of LEB128 (Little-Endian Base 128) variable-length integers, each up to 128 bits. Each byte uses bit 7 as a continuation flag: if set, more bytes follow.

ValueLEB128 Encoding
707
1277f
12880 01
300ac 02

19.1.2Tag/Value Pairs

The decoded integers are interpreted as a sequence of tag/value pairs. Each tag identifies a field:

TagFieldParity
0Body (edicts follow)even
1Divisibilityodd
2Flagseven
3Spacersodd
4Rune (name)even
5Symbolodd
6Premineeven
8Capeven
10Amounteven
12HeightStarteven
14HeightEndeven
20Minteven
22Pointereven
126Cenotapheven

Unrecognized odd tags are safely ignored. Unrecognized even tags produce a cenotaph (malformed runestone)—an upgrade mechanism that ensures old clients do not misinterpret new features.

19.2Etching: Creating a Rune

A rune is etched (created) by a transaction whose runestone has the Etching flag set (bit 0 of the Flags field). Etching defines the rune's immutable properties:

PropertyDescription
Name1–26 letters (A–Z), encoded as modified base-26 integer
SymbolUnicode codepoint displayed after amounts (e.g., $, U+16A0)
DivisibilityDecimal places (0 = indivisible, 2 = 0.01 precision)
SpacersBullet characters (•) between letters for readability
PremineUnits allocated to the etcher at creation
TermsOpen-mint parameters: cap, amount, height/offset limits

19.2.1Rune Names

Names are encoded as modified base-26 integers: A = 0, B = 1, …, Z = 25, AA = 26, AB = 27, and so on. Names are between 1 and 26 letters long. To prevent front-running, etching a non-reserved name requires a commitment: a data push of the name in an input's tapscript, where the committed output has at least six confirmations.

Initially, only names of 13+ characters are unlocked. Shorter names unlock progressively: every 17,500 blocks (4 months), the next shorter length becomes available. One-character names will unlock between blocks 1,032,500 and 1,050,000 (2028).

19.2.2Rune IDs

Each rune is identified by its block height and transaction index within that block, written as BLOCK:TX. For example, the rune etched in the 2nd transaction of block 840,000 has ID 840000:1.

19.3Minting

If an etching includes the Terms flag (bit 1), it creates an open mint. Anyone can mint units of that rune by including a Mint field (tag 20) with the rune's ID in their runestone. Minting is subject to the etcher's terms:

A mint is open when all terms are satisfied and closed when any term is violated.

19.4Transferring: Edicts

Runes are transferred by edicts—instructions within the runestone that assign rune balances to specific outputs. Each edict contains:

FieldDescription
Rune IDBlock height + transaction index (delta-encoded)
AmountNumber of units to transfer
OutputIndex of the destination output

Edicts appear after tag 0 (Body) in the integer sequence and are encoded in groups of four integers: block delta, tx delta, amount, output. The delta encoding compresses rune IDs: sorted by rune ID, each edict stores only the difference from the previous one.

After all edicts are processed, any unallocated runes transfer to the first non-OP_RETURN output (or the output designated by the optional Pointer field).

19.5Specimen: Block 840,000

The Runes protocol activated alongside Bitcoin's fourth halving at block 840,000 (April 20, 2024). The competition to etch the first runes was fierce: transactions paid extraordinary fees to secure inclusion in this historic block.

FieldValue
txid2bb85f4b… c69e
Block840,000 (April 20, 2024 00:09 UTC)
Version2
nLockTime0
Input1 (P2TR, 2,471,128,002 sats)
Output 0P2TR, 1,797,928,002 sats
Output 1OP_RETURN (runestone), 0 sats
Fee673,200,000 sats (6.732 BTC)
Size / Weight / vsize330 B / 747 WU / 187 vB
Feerate3,600,000 sat/vB

A fee of 6.732 BTC (3.6 million sat/vB) reflects the extreme competition for inclusion in the runes activation block. Block 840,000 collected over 37.6 BTC in total fees—more than the 3.125 BTC subsidy by a factor of twelve. This was a one-time event; typical rune transactions pay normal market feerates.

19.5.1The Runestone Output

Output 1's scriptPubKey in hex:

6a OP_RETURN

5d OP_13 (Runes protocol tag)

21 OP_PUSHBYTES_33

02 07 04 b5 e1 d8 e1 c8 ee b7 88 a3 07 05 a0 2d

03 9f 3e 01 02 06 80 dc 9a fd 28 08 c7 e8 43 0a 64 33-byte payload

The 33-byte payload decodes as LEB128 tag/value pairs:

TagFieldValueMeaning
2Flags7Etching + Terms + Turbo
4Rune(128-bit int)Rune name (modified base-26)
5Symbol5,792Runic letter fehu (U+16A0)
3Spacers7,967Bullet placement bitmap
1Divisibility2Two decimal places
6Premine11,000,000,000110,000,000.00 units (div. 2)
8Cap1,111,111Max 1,111,111 mints
10Amount1001.00 unit per mint (div. 2)

19.5.2Dual Protocol: Inscription + Rune

This transaction also contains an inscription in its witness—the "ord" envelope with a delegate field (tag 0x0b). The two protocols coexist without conflict:

This separation is by design: inscriptions and runes occupy different parts of the transaction, enabling a single transaction to perform both operations simultaneously.

19.6Cenotaphs: Burn on Error

A malformed runestone is called a cenotaph (an empty tomb). A cenotaph is produced when the runestone contains:

The consequences are severe:

  1. All rune balances entering the transaction are burned (permanently destroyed).
  2. Any etching in the cenotaph creates an unmintable rune with zero supply.
  3. Mints in a cenotaph count toward the mint cap, but the minted runes are burned.
Cenotaphs as an Upgrade Mechanism

The burn-on-error design is intentional. When the protocol evolves (new tags, new flags), old clients cannot correctly interpret the new semantics. Rather than silently misrouting runes, old clients treat the unknown fields as a cenotaph and burn everything. This ensures users are never misled about where their runes are: either the client understands the transaction fully, or all runes are visibly destroyed. It is a strong incentive to keep software updated.

19.7What We Learned

Exercises

Litmus (L)

  1. How is a runestone output identified in a transaction?
  2. What encoding is used for integers in the runestone payload?
  3. What is a cenotaph, and what happens to runes entering a transaction with one?
  4. How are rune names encoded?
  5. What block activated the Runes protocol?

Hands-On (H)

  1. Encode the integer 300 in LEB128 format. Show your work.
  2. A rune has divisibility 3, symbol #, and an amount of 12,345 atomic units. How is this displayed to the user?
  3. In the specimen transaction, the fee is 673,200,000 sats for 187 vB. Compare this to the feerate of Inscription #0 (Chapter 18: 322 sats for 322 vB). What accounts for the difference?

Proofs and Reasoning (P)

  1. Explain why the Runes protocol uses OP_RETURN instead of witness data for its protocol messages. What are the tradeoffs compared to the inscription approach?
  2. Why does the Runes protocol burn all runes on cenotaph rather than falling back to a default behavior (e.g., returning runes to the sender)? Analyze the game-theoretic implications.
  3. Why does etching a non-reserved rune name require a commitment in a tapscript with six confirmations? What attack does this prevent?

Connections (C)

  1. OP_RETURN evolution. Compare the OP_RETURN usage in Runes (Chapter 19) with the simple data embedding in Chapter 14. How does adding OP_13 and LEB128 encoding transform OP_RETURN from a raw data field into a structured protocol layer?
  2. Weight comparison. A rune mint transaction has a 40-byte runestone in an OP_RETURN output plus a standard P2TR input and output. Estimate its weight. Compare to a minimal inscription (Ch. 18) with 40 bytes of content.

Bridge (B)

  1. The Runes protocol and the Lightning Network (Chapter 17) both build complex functionality from Bitcoin's existing transaction primitives—without any consensus changes. Compare their approaches: what parts of the transaction anatomy does each protocol exploit?
  2. If Bitcoin's OP_RETURN size limit were reduced to 40 bytes (as some proposals have suggested), how would this affect the Runes protocol? Could runestones still function?

Solutions

L1. A runestone output is identified by a scriptPubKey beginning with OP_RETURN OP_13 (bytes 6a 5d). The OP_13 distinguishes it from other OP_RETURN protocols.

L2. LEB128 (Little-Endian Base 128). Each byte uses 7 bits for data and bit 7 as a continuation flag. Values up to 128 bits (the width of rune amounts) can be encoded.

L3. A cenotaph is a malformed runestone—one containing unrecognized even tags, invalid varints, out-of-range outputs, or other errors. All runes entering the transaction are burned (permanently destroyed). This ensures old clients never silently misroute runes when the protocol evolves.

L4. As modified base-26 integers: A = 0, B = 1, …, Z = 25, AA = 26, AB = 27, and so on. The 128-bit encoding allows names up to 26 characters.

L5. Block 840,000 (April 20, 2024)—the same block as Bitcoin's fourth halving.

H1. \(300 = 256 + 44 = 2 \times 128 + 44\).

LEB128 encoding: take 7 bits at a time from the least significant end.

Result: ac 02.

H2. Divisibility 3 means three decimal places. \(12,345\) atomic units \(= 12,345 / 10^3 = 12.345\). With symbol #: displayed as 12.345 #.

H3. Inscription #0 paid 1 sat/vB (322 sats for 322 vB, block 767,430, December 2022). The rune specimen paid 3,600,000 sat/vB (6.732 BTC for 187 vB, block 840,000, April 2024). The difference is not a protocol cost—it reflects the extreme competition for inclusion in block 840,000, which simultaneously activated the Runes protocol and the fourth halving. Both events attracted massive demand for block space. Normal rune transactions pay market feerates comparable to any other Bitcoin transaction.

P1. Runestone payloads are small (\(<\)80 bytes for typical operations), so the 4\(\times\) weight penalty of non-witness data is modest in absolute terms (\(<\)320 WU). Using OP_RETURN makes the protocol message visible in the transaction's output list without parsing witness data—simpler for indexers and light clients. Inscriptions use the witness because their payloads are large (images, media), where the 4\(\times\) discount matters enormously. Runes are optimized for compact protocol messages; inscriptions are optimized for bulk data storage.

P2. "Returning to sender" requires knowing which input owns which runes—a complex, potentially ambiguous operation. A default fallback would create situations where old clients think runes went to one place while new clients know they went to another, breaking consensus on rune state. Burning is unambiguous: all parties agree the runes are destroyed. This creates a strong incentive for users to keep software updated (protecting their runes) while ensuring the protocol can safely evolve by adding new even tags. The harshness of the penalty is the mechanism's strength—it eliminates ambiguity entirely.

P3. Without a commitment requirement, an attacker could observe a pending etching transaction in the mempool, extract the desired rune name, and submit a competing etching at higher feerate to claim the name first (front-running). The six-confirmation tapscript commitment means the name must be committed to a confirmed UTXO before the etching transaction appears. Six confirmations (60 minutes) make it impractical to front-run because the commitment must be buried deep enough that reorganizing it out would require significant hashrate.

C1. Chapter 15's OP_RETURN is raw data embedding—arbitrary bytes with no structure beyond what the application imposes. Runes adds the OP_13 prefix as a protocol discriminator, LEB128 encoding for compact 128-bit integer representation, and a defined tag/value schema that gives the data semantics (etching, minting, transferring). This transforms OP_RETURN from a "write arbitrary bytes" mechanism into a structured protocol layer with versioning (even/odd tag parity) and error handling (cenotaphs).

C2. Rune mint (P2TR 1-in-2-out with 40-byte runestone):

Minimal inscription with 40 bytes of content:

The inscription is slightly lighter (151 vB vs. 163 vB) because the 40-byte payload benefits from the witness discount. For small payloads, the difference is modest. As payload size grows, the witness discount favors inscriptions increasingly.

B1. Lightning exploits P2WSH (funding output), multisig (2-of-2 control), timelocks (CSV, CLTV for revocation and HTLC timeouts), and SegWit (malleability fix for the commitment chain). Runes exploit OP_RETURN (protocol messages), Taproot script commitments (name front-running protection), and the output ordering rules of standard transactions. Lightning builds a persistent off-chain state machine; Runes builds a token ledger. Both are purely interpretive—no consensus changes required—but they interpret different transaction fields for different purposes.

B2. Most runestone payloads are \(<\)40 bytes for simple mints and transfers, so a 40-byte limit would still accommodate basic operations. However, complex etchings with multiple fields (name, symbol, divisibility, terms, premine) can exceed 40 bytes, and transactions with many edicts certainly would. The protocol could adapt by splitting operations across multiple transactions, but this would increase complexity and cost. More critically, the 40-byte limit would constrain future protocol evolution by limiting the number of tag/value pairs per runestone.

← Ch. 18 Appendix A →