Witness Commitment

The witness commitment is the mechanism SegWit (BIP-141) uses to bind a block to its segregated witness data. Because SegWit moved signatures and other witness data out of the part of a transaction covered by the original Merkle root, a second commitment was needed so that witnesses could not be altered after the fact — and it had to be added in a way that older nodes would still accept.

How the commitment is built

Every transaction has both a TXID (a hash of its non-witness data) and a WTXID (a hash that also includes the witness). Nodes build a separate Merkle tree from all the WTXIDs in the block, producing a witness root hash. That root, combined with a witness reserved value, is double-SHA256 hashed and placed inside an output of the coinbase transaction — an OP_RETURN script beginning with the marker bytes 0x6a24aa21a9ed.

Why put it in the coinbase

The block header's Merkle root only commits to TXIDs, and changing the header would have been a hard fork. Embedding the witness commitment in the coinbase — itself already covered by the header's Merkle root — lets the witness data be committed transitively while keeping SegWit a backward-compatible soft fork. Old nodes simply ignore the extra coinbase output.

This design is also what finally fixed transaction malleability, since a transaction's TXID no longer depends on its mutable signature data. For the propagation optimization that builds on these IDs, see D-Central's entry on Compact Blocks, and on inclusion proofs see SPV.