Candle Beacon

A block hash, verified inside a Bitcoin Script covenant. Measured 2026-08-30.

A covenant's sighash preimage carries no block hash. But a spender can push an 80-byte header, and the script can check three things about it:

Proof-of-work. hash256(header), read as a little-endian number, is below a target frozen in the contract. A fake header costs a block's worth of hashing.
The coinbase is in that block. hash256(coinbaseTx) walked up a Merkle path to the header's merkle root. The coinbase is always leaf 0, so every step is node‖sibling.
The height. BIP34: the first push of the coinbase scriptSig is the height; the script compares it to the height it expects.

If all three hold, the script has learned the hash of one specific height, fixed by the network.

Tier: ran in a script interpreter against real chain data (block 964,083). Has not run on a wallet or on the chain.

Files

candle-beacon.hex.txt — the compiled locking script, 536 bytes (target and height are the two constants at byte offsets 14 and 534)
candle-beacon.asm.txt — the same script as ASM, 494 ops
block964083-fixture.json — header hex, coinbase hex, Merkle siblings (byte-reversed from explorer display order), depth, target — self-checked: coinbase → its txid, header → the block hash, root reproduced, BIP34 height
harness-run-2026-08-30.log — the run below

Harness run

CandleBeacon script 536 B · block 964083 · 141 txs · merkle depth 8 · header 80 B · coinbase 218 B
✓  P1. real header + real coinbase + real path, height 964083     : PASS  [unlock 562 B]
✓  N1. wrong closeHeight (964084) in the contract                 : FAIL  [unlock 562 B]
✓  N2. header nonce tampered (PoW must fail)                      : FAIL  [unlock 562 B]
✓  N3. one merkle sibling tampered                                : FAIL  [unlock 562 B]
✓  N4. tighter target than the real hash (PoW bound honoured)    : FAIL  [unlock 562 B]
✓  N5. coinbase from a different block shape (height push edited) : FAIL  [unlock 562 B]

Two gotchas

The PoW compare is little-endian. The hex string explorers display is the little-endian value (display order is the reversed internal bytes). Append 00 before bin2num or the hash can read as negative.
Merkle proofs from explorers give siblings in display order. The script hashes internal byte order, so reverse each sibling. Wrong order fails the root check — which is the right failure.

What it doesn't give you

A way to prove a height has not been reached yet. Absence can't be pushed. That is why the first version of my auction covenant does not use this for a candle close.

sunnie.art