Bitcoin Script opcodes list

A searchable reference of every Bitcoin Script opcode: its hex and decimal value, what it does on the stack, whether it's active, disabled or reserved, and the BIPs that introduced or changed it, including the tapscript rules from BIP 342.

Updated 2026-10-20 · 5 min read

Free, and runs entirely in your browser: nothing you type is sent anywhere.

All opcodes

Opcode	Hex	Group	Description	State	BIPs
OP_0 (OP_FALSE)	0x00	Constants	Pushes an empty byte array, which counts as zero and false. Also the witness version of SegWit v0 outputs: `OP_0 <20 or 32 bytes>` (BIP 141).	active
OP_PUSHBYTES_1-OP_PUSHBYTES_75	0x01-0x4b	Constants	The opcode is itself a length: the next 1 to 75 bytes are pushed onto the stack as one item. Bitcoin Core has no names for these; explorers often show them as OP_PUSHBYTES_N.	active
OP_PUSHDATA1	0x4c	Constants	The next byte gives the number of bytes to push (0 to 255). The shortest way to push 76 to 255 bytes.	active
OP_PUSHDATA2	0x4d	Constants	The next two bytes (little-endian) give the number of bytes to push. Stack items are limited to 520 bytes.	active
OP_PUSHDATA4	0x4e	Constants	The next four bytes (little-endian) give the number of bytes to push. Rarely useful, because stack items are limited to 520 bytes.	active
OP_1NEGATE	0x4f	Constants	Pushes the number -1 onto the stack.	active
OP_RESERVED	0x50	Reserved	Fails the script if executed; harmless in a branch that isn't executed. In tapscript it is OP_SUCCESS80 (BIP 342).	reserved	BIP 342
OP_1 (OP_TRUE)	0x51	Constants	Pushes the number 1 (true). Also the witness version of Taproot outputs: `OP_1 <32 bytes>` (BIP 341).	active
OP_2-OP_16	0x52-0x60	Constants	Push the numbers 2 to 16 (OP_N is 0x50 + N). Used in multisig scripts (`OP_2 <key1> <key2> <key3> OP_3 OP_CHECKMULTISIG`) and as SegWit versions 2 to 16, which BIP 141 keeps free for future upgrades.	active
OP_NOP	0x61	Flow control	Does nothing.	active
OP_VER	0x62	Reserved	Fails the script if executed; harmless in a branch that isn't executed. In tapscript it is OP_SUCCESS98 (BIP 342).	reserved	BIP 342
OP_IF	0x63	Flow control	Pops the top item and runs the following statements only if it is true. In tapscript the item must be exactly empty or `0x01` (the MINIMALIF rule, BIP 342).	active	BIP 342
OP_NOTIF	0x64	Flow control	Pops the top item and runs the following statements only if it is false. Same MINIMALIF rule as OP_IF in tapscript.	active	BIP 342
OP_VERIF	0x65	Reserved	Fails the script whenever it appears, even in a branch that isn't executed, because if/else opcodes are always evaluated. Not an OP_SUCCESS in tapscript.	reserved
OP_VERNOTIF	0x66	Reserved	Like OP_VERIF: fails the script whenever it appears, even in a branch that isn't executed.	reserved
OP_ELSE	0x67	Flow control	Runs the following statements only if the statements after the matching OP_IF, OP_NOTIF or previous OP_ELSE were not run.	active
OP_ENDIF	0x68	Flow control	Ends an if/else block. A script with an unbalanced OP_IF or OP_ENDIF fails.	active
OP_VERIFY	0x69	Flow control	Fails the script unless the top item is true; if it is, the item is removed. Opcodes ending in VERIFY combine a check with this step.	active
OP_RETURN	0x6a	Flow control	Ends the script with failure. An output whose script starts with OP_RETURN can never be spent, so it is used to embed small pieces of data, and Bitcoin Core leaves such outputs out of the UTXO set.	active
OP_TOALTSTACK	0x6b	Stack	Moves the top item to the alternate stack (the altstack).	active
OP_FROMALTSTACK	0x6c	Stack	Moves the top item of the altstack back to the main stack.	active
OP_2DROP	0x6d	Stack	Removes the top two items.	active
OP_2DUP	0x6e	Stack	Duplicates the top two items: `x1 x2` becomes `x1 x2 x1 x2`.	active
OP_3DUP	0x6f	Stack	Duplicates the top three items.	active
OP_2OVER	0x70	Stack	Copies the pair of items two places down to the top: `x1 x2 x3 x4` becomes `x1 x2 x3 x4 x1 x2`.	active
OP_2ROT	0x71	Stack	Moves the fifth and sixth items to the top: `x1 x2 x3 x4 x5 x6` becomes `x3 x4 x5 x6 x1 x2`.	active
OP_2SWAP	0x72	Stack	Swaps the top two pairs of items: `x1 x2 x3 x4` becomes `x3 x4 x1 x2`.	active
OP_IFDUP	0x73	Stack	Duplicates the top item if it is not zero.	active
OP_DEPTH	0x74	Stack	Pushes the number of items on the stack.	active
OP_DROP	0x75	Stack	Removes the top item. Often follows OP_CHECKLOCKTIMEVERIFY and OP_CHECKSEQUENCEVERIFY, which leave their argument on the stack.	active
OP_DUP	0x76	Stack	Duplicates the top item. The first opcode of every P2PKH output script.	active
OP_NIP	0x77	Stack	Removes the second item from the top: `x1 x2` becomes `x2`.	active
OP_OVER	0x78	Stack	Copies the second item to the top: `x1 x2` becomes `x1 x2 x1`.	active
OP_PICK	0x79	Stack	Pops a number n, then copies the item n places down to the top.	active
OP_ROLL	0x7a	Stack	Pops a number n, then moves the item n places down to the top.	active
OP_ROT	0x7b	Stack	Rotates the top three items to the left: `x1 x2 x3` becomes `x2 x3 x1`.	active
OP_SWAP	0x7c	Stack	Swaps the top two items.	active
OP_TUCK	0x7d	Stack	Copies the top item below the second one: `x1 x2` becomes `x2 x1 x2`.	active
OP_CAT	0x7e	Splice	Concatenates the top two items. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. BIP 347 proposes re-enabling it in tapscript by redefining OP_SUCCESS126, the same opcode value.	disabled	BIP 347, BIP 342
OP_SUBSTR	0x7f	Splice	Returns a section of a byte string. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS127 (BIP 342).	disabled	BIP 342
OP_LEFT	0x80	Splice	Keeps only the bytes to the left of a given point. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS128 (BIP 342).	disabled	BIP 342
OP_RIGHT	0x81	Splice	Keeps only the bytes to the right of a given point. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS129 (BIP 342).	disabled	BIP 342
OP_SIZE	0x82	Splice	Pushes the length in bytes of the top item, leaving the item in place.	active
OP_INVERT	0x83	Bitwise logic	Flips every bit of the top item. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS131 (BIP 342).	disabled	BIP 342
OP_AND	0x84	Bitwise logic	Bitwise AND of the top two items. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS132 (BIP 342).	disabled	BIP 342
OP_OR	0x85	Bitwise logic	Bitwise OR of the top two items. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS133 (BIP 342).	disabled	BIP 342
OP_XOR	0x86	Bitwise logic	Bitwise exclusive OR of the top two items. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS134 (BIP 342).	disabled	BIP 342
OP_EQUAL	0x87	Bitwise logic	Pops two items and pushes 1 if they are byte-for-byte equal, otherwise an empty array (false). Ends every P2SH output script.	active
OP_EQUALVERIFY	0x88	Bitwise logic	OP_EQUAL followed by OP_VERIFY: fails the script unless the two items are equal. Checks the key hash in P2PKH scripts.	active
OP_RESERVED1	0x89	Reserved	Fails the script if executed. In tapscript it is OP_SUCCESS137 (BIP 342).	reserved	BIP 342
OP_RESERVED2	0x8a	Reserved	Fails the script if executed. In tapscript it is OP_SUCCESS138 (BIP 342).	reserved	BIP 342
OP_1ADD	0x8b	Arithmetic	Adds 1 to the top number. Arithmetic inputs are limited to 4-byte signed integers.	active
OP_1SUB	0x8c	Arithmetic	Subtracts 1 from the top number.	active
OP_2MUL	0x8d	Arithmetic	Multiplies the top number by 2. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS141 (BIP 342).	disabled	BIP 342
OP_2DIV	0x8e	Arithmetic	Divides the top number by 2. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS142 (BIP 342).	disabled	BIP 342
OP_NEGATE	0x8f	Arithmetic	Flips the sign of the top number.	active
OP_ABS	0x90	Arithmetic	Replaces the top number with its absolute value.	active
OP_NOT	0x91	Arithmetic	Pushes 1 if the top number is 0, otherwise 0.	active
OP_0NOTEQUAL	0x92	Arithmetic	Pushes 0 if the top number is 0, otherwise 1.	active
OP_ADD	0x93	Arithmetic	Pops a and b and pushes a + b.	active
OP_SUB	0x94	Arithmetic	Pops a and b (b on top) and pushes a - b.	active
OP_MUL	0x95	Arithmetic	Multiplies two numbers. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS149 (BIP 342).	disabled	BIP 342
OP_DIV	0x96	Arithmetic	Divides one number by another. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS150 (BIP 342).	disabled	BIP 342
OP_MOD	0x97	Arithmetic	Returns the remainder of a division. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS151 (BIP 342).	disabled	BIP 342
OP_LSHIFT	0x98	Arithmetic	Shifts a number left by a number of bits. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS152 (BIP 342).	disabled	BIP 342
OP_RSHIFT	0x99	Arithmetic	Shifts a number right by a number of bits. Disabled since 2010: a script that contains it fails, even in a branch that isn't executed. In tapscript it is OP_SUCCESS153 (BIP 342).	disabled	BIP 342
OP_BOOLAND	0x9a	Arithmetic	Pushes 1 if both of the top two numbers are non-zero, otherwise 0.	active
OP_BOOLOR	0x9b	Arithmetic	Pushes 1 if either of the top two numbers is non-zero, otherwise 0.	active
OP_NUMEQUAL	0x9c	Arithmetic	Pushes 1 if the top two numbers are equal, otherwise 0. Tapscript k-of-n multisig scripts end with `k OP_NUMEQUAL`.	active
OP_NUMEQUALVERIFY	0x9d	Arithmetic	OP_NUMEQUAL followed by OP_VERIFY.	active
OP_NUMNOTEQUAL	0x9e	Arithmetic	Pushes 1 if the top two numbers are not equal, otherwise 0.	active
OP_LESSTHAN	0x9f	Arithmetic	Pops a and b (b on top) and pushes 1 if a < b, otherwise 0.	active
OP_GREATERTHAN	0xa0	Arithmetic	Pops a and b and pushes 1 if a > b, otherwise 0.	active
OP_LESSTHANOREQUAL	0xa1	Arithmetic	Pops a and b and pushes 1 if a ≤ b, otherwise 0.	active
OP_GREATERTHANOREQUAL	0xa2	Arithmetic	Pops a and b and pushes 1 if a ≥ b, otherwise 0.	active
OP_MIN	0xa3	Arithmetic	Pushes the smaller of the top two numbers.	active
OP_MAX	0xa4	Arithmetic	Pushes the larger of the top two numbers.	active
OP_WITHIN	0xa5	Arithmetic	Pops x, min and max and pushes 1 if min ≤ x < max, otherwise 0.	active
OP_RIPEMD160	0xa6	Crypto	Replaces the top item with its RIPEMD-160 hash (20 bytes).	active
OP_SHA1	0xa7	Crypto	Replaces the top item with its SHA-1 hash (20 bytes).	active
OP_SHA256	0xa8	Crypto	Replaces the top item with its SHA-256 hash (32 bytes). Used for hash locks, where spending requires revealing a secret preimage.	active
OP_HASH160	0xa9	Crypto	Replaces the top item with RIPEMD-160(SHA-256(x)), 20 bytes. Used by P2PKH and P2SH output scripts.	active
OP_HASH256	0xaa	Crypto	Replaces the top item with SHA-256(SHA-256(x)), 32 bytes.	active
OP_CODESEPARATOR	0xab	Crypto	Changes what later signature checks commit to: in legacy and SegWit v0 scripts, only the script after the last executed OP_CODESEPARATOR is signed; in tapscript, its position is included in the signature message (BIP 342).	active	BIP 143, BIP 342
OP_CHECKSIG	0xac	Crypto	Pops a public key and a signature and pushes 1 if the signature is valid for this transaction, or false if the signature is empty. ECDSA in legacy and SegWit v0 scripts; Schnorr (BIP 340) in tapscript, where any other invalid signature fails the script (BIP 342).	active	BIP 66, BIP 143, BIP 340, BIP 342
OP_CHECKSIGVERIFY	0xad	Crypto	OP_CHECKSIG followed by OP_VERIFY: fails the script unless the signature is valid.	active	BIP 66, BIP 143, BIP 342
OP_CHECKMULTISIG	0xae	Crypto	Checks m signatures against n public keys (at most 20 keys). An old bug makes it pop one extra item, which must be empty (BIP 147). Disabled in tapscript (BIP 342), where OP_CHECKSIGADD replaces it.	active	BIP 66, BIP 147, BIP 342
OP_CHECKMULTISIGVERIFY	0xaf	Crypto	OP_CHECKMULTISIG followed by OP_VERIFY. Also disabled in tapscript (BIP 342).	active	BIP 147, BIP 342
OP_NOP1	0xb0	Reserved	Does nothing; kept for soft-fork upgrades, and scripts that use it are non-standard. BIP 12 (OP_EVAL) proposed redefining it.	nop	BIP 12
OP_CHECKLOCKTIMEVERIFY (OP_CLTV, OP_NOP2)	0xb1	Locktime	Fails unless the transaction's nLockTime has reached the value on top of the stack (a block height or a time), so the output can't be spent before then. Redefined OP_NOP2 in a soft fork (BIP 65); leaves its argument on the stack.	active	BIP 65
OP_CHECKSEQUENCEVERIFY (OP_CSV, OP_NOP3)	0xb2	Locktime	Fails unless the input's relative lock-time (its nSequence, BIP 68) is at least the value on top of the stack, so the output must age a number of blocks or a period of time first. Redefined OP_NOP3 (BIP 112); leaves its argument on the stack.	active	BIP 112, BIP 68
OP_NOP4	0xb3	Reserved	Does nothing today. BIP 119 proposes redefining it as OP_CHECKTEMPLATEVERIFY (CTV), and BIP 116 proposed it for MERKLEBRANCHVERIFY.	nop	BIP 119, BIP 116
OP_NOP5-OP_NOP10	0xb4-0xb9	Reserved	Do nothing; kept so a soft fork can redefine them, as BIP 65 and BIP 112 did with OP_NOP2 and OP_NOP3. Scripts that use them are non-standard.	nop
OP_CHECKSIGADD	0xba	Tapscript	Tapscript only: pops a public key, a number n and a signature, and pushes n + 1 if the signature is valid or n if it is empty. Replaces OP_CHECKMULTISIG: `<key1> OP_CHECKSIG <key2> OP_CHECKSIGADD <key3> OP_CHECKSIGADD 2 OP_NUMEQUAL` is a 2-of-3.	active	BIP 342
OP_SUCCESSx	0xbb-0xfe	Tapscript	In tapscript, opcodes 80, 98, 126-129, 131-134, 137-138, 141-142, 149-153 and 187-254 (decimal) are renamed OP_SUCCESS80 to OP_SUCCESS254: their mere presence makes the script succeed, so a soft fork can give any of them new rules (BIP 342). Outside tapscript, 0xbb-0xfe are unassigned and fail if executed.	reserved	BIP 342, BIP 347, BIP 348, BIP 349, BIP 442, BIP 443, BIP 446
OP_INVALIDOPCODE	0xff	Reserved	Not a real opcode: the name Bitcoin Core uses for byte 0xff. The script fails if it is executed, in tapscript too.	reserved

What is Bitcoin Script?

Bitcoin Script is the small programming language that decides who can spend each coin. Every transaction output carries a locking script (the scriptPubKey). To spend it, a transaction supplies unlocking data, in the scriptSig or, since SegWit, in the witness. Every node runs the two together, and the spend is valid only if the script finishes without failing and leaves true on the stack.

A script is a list of opcodes, each one byte, and data pushes. There are no loops and no jumps backwards, so every script runs in a predictable, bounded time. Most outputs use a few standard templates (the address checker shows the script behind any address), but the same opcodes also build multisig, timelocks and Lightning channels.

How opcodes execute on the stack

Script is stack-based: values are piled up, and each opcode takes its inputs from the top of the pile and puts its result back.

Push opcodes put data on the stack. Bytes 0x01 to 0x4b push that many following bytes; OP_PUSHDATA1, 2 and 4 handle longer data; OP_0 and OP_1 to OP_16 push small numbers.
Operations pop values and push results. OP_ADD pops two numbers and pushes their sum; OP_EQUAL pops two items and pushes 1 or false.
VERIFY variants, such as OP_EQUALVERIFY, fail the script at once unless the result is true, instead of pushing it.
OP_IF, OP_NOTIF, OP_ELSE and OP_ENDIF choose which statements run.

Numbers used in arithmetic are limited to 4 bytes. Stack items are limited to 520 bytes and the stack to 1,000 items. Legacy and SegWit v0 scripts are also limited to 10,000 bytes and 201 non-push opcodes; tapscript (BIP 342) drops those two limits and budgets signature checks by witness size instead.

A worked example: P2PKH step by step

A P2PKH output (an address starting with 1) locks coins with OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG, 25 bytes in hex: 76 a9 14 <20 bytes> 88 ac. The spender provides <sig> <pubKey>. Run together (top of the stack on the right):

Step	Item	Stack afterwards
1	`<sig>`	sig
2	`<pubKey>`	sig pubKey
3	OP_DUP	sig pubKey pubKey
4	OP_HASH160	sig pubKey hash
5	`<pubKeyHash>`	sig pubKey hash pubKeyHash
6	OP_EQUALVERIFY	sig pubKey (fails here if the hashes differ)
7	OP_CHECKSIG	1 (true if the signature is valid)

The spender proved they have the public key that hashes to the one in the output, and a signature for this transaction made with its private key.

Disabled opcodes: OP_CAT and the 2010 cleanup

Early Bitcoin had more opcodes. In 2010 a single change disabled OP_CAT and others for splicing, bitwise logic and arithmetic, after worries that scripts could use huge amounts of memory or time (BIP 441 ties this to CVE-2010-5137). Fifteen remain disabled: OP_CAT, OP_SUBSTR, OP_LEFT, OP_RIGHT, OP_INVERT, OP_AND, OP_OR, OP_XOR, OP_2MUL, OP_2DIV, OP_MUL, OP_DIV, OP_MOD, OP_LSHIFT and OP_RSHIFT.

Disabled is stricter than reserved. A script that merely contains a disabled opcode fails, even in a branch that never runs. Reserved opcodes such as OP_RESERVED and OP_VER only fail when executed, except OP_VERIF and OP_VERNOTIF, which fail wherever they appear. In tapscript, OP_CHECKMULTISIG and OP_CHECKMULTISIGVERIFY are disabled too; OP_CHECKSIGADD replaces them with a form that allows batch verification of signatures.

How soft forks add new opcodes

A new opcode must not make any previously invalid transaction valid, or it would be a hard fork. Bitcoin has two ways to add one as a soft fork.

Redefining OP_NOPs

OP_NOP1 and OP_NOP4 to OP_NOP10 do nothing, and nodes treat scripts using them as non-standard. A soft fork can give one a check that either fails the script or does nothing. That is how OP_CHECKLOCKTIMEVERIFY (Peter Todd's BIP 65, active from block 388,381 in December 2015) replaced OP_NOP2, and OP_CHECKSEQUENCEVERIFY (BIP 112, block 419,328 in July 2016) replaced OP_NOP3. Because a NOP can't change the stack, both leave their argument in place, which is why scripts follow them with OP_DROP.

OP_SUCCESSx in tapscript

BIP 342, by Pieter Wuille, Jonas Nick and Anthony Towns, activated with Taproot at block 709,632 (14 November 2021). It renamed 87 unused, reserved or disabled opcode values to OP_SUCCESSx: a tapscript that contains one succeeds unconditionally. A later soft fork can give any of them real rules, and unlike a NOP upgrade the new opcode may push results onto the stack. Tapscript can also be extended with new leaf versions and new public key types.

Opcode proposals

Several BIPs propose new opcodes, many aimed at covenants, which restrict how coins can be spent next. Each would need a soft fork to take effect.

Opcode	Would redefine	BIP	Authors
OP_CHECKTEMPLATEVERIFY	OP_NOP4 (0xb3)	BIP 119	Jeremy Rubin
OP_CAT	OP_SUCCESS126 (0x7e)	BIP 347	Ethan Heilman, Armin Sabouri
OP_CHECKSIGFROMSTACK	OP_SUCCESS204 (0xcc)	BIP 348	Brandon Black, Jeremy Rubin
OP_INTERNALKEY	OP_SUCCESS203 (0xcb)	BIP 349	Brandon Black, Jeremy Rubin
OP_TXHASH	OP_SUCCESS189 (0xbd)	BIP 346	Steven Roose, Brandon Black
OP_CHECKCONTRACTVERIFY	OP_SUCCESS187 (0xbb)	BIP 443	Salvatore Ingala
OP_PAIRCOMMIT	OP_SUCCESS205 (0xcd)	BIP 442	moonsettler, Brandon Black
OP_TEMPLATEHASH	OP_SUCCESS206 (0xce)	BIP 446	Gregory Sanders, Antoine Poinsot, Steven Roose

BIP 441 takes another route: a new tapscript leaf version (0xc2) that restores the disabled opcodes, limited by the "varops" cost budget of BIP 440. The covenants guide and the BIP 119 vs BIP 347 comparison explain the trade-offs.

Frequently asked questions

What is an opcode in Bitcoin?

An opcode is a one-byte instruction in Bitcoin Script, the language that locks every coin. Each opcode works on a stack of values: OP_DUP copies the top item, OP_HASH160 hashes it, OP_CHECKSIG checks a signature. A transaction can spend an output only if running its script, with the data the spender supplies, ends without failing and leaves true on the stack.

How many opcodes does Bitcoin Script have?

An opcode is one byte, so there are 256 possible values. Values 0x00 to 0xba (187 of them) have a meaning, and 75 of those (0x01 to 0x4b) simply push that many bytes of data. Fifteen are disabled, a handful are reserved or upgrade NOPs, and 0xbb to 0xff are unassigned. In tapscript, 87 values are OP_SUCCESSx upgrade hooks.

What does OP_RETURN do?

OP_RETURN (0x6a) ends the script with failure. An output whose script starts with OP_RETURN can therefore never be spent, which makes it a place to embed a small amount of data in a transaction, such as a commitment or a protocol marker. Bitcoin Core leaves these provably unspendable outputs out of the UTXO set.

What is OP_CHECKSIG?

OP_CHECKSIG (0xac) pops a public key and a signature and pushes true if the signature is valid for the spending transaction. In legacy and SegWit v0 scripts it checks an ECDSA signature; in tapscript (BIP 342) it checks a Schnorr signature (BIP 340). It ends every P2PKH script, and OP_CHECKSIGVERIFY is the version that fails the script instead of pushing false.

Why was OP_CAT disabled?

OP_CAT, which joins two stack items, was disabled in 2010 together with other splice, bitwise and arithmetic opcodes, over concerns that scripts could use excessive memory or computation. BIP 347 notes that repeating OP_DUP OP_CAT could double an item's size each time. It proposes re-enabling OP_CAT in tapscript only, where the 520-byte limit on stack items bounds that growth.

Which opcodes did Taproot add or change?

Tapscript (BIP 342) added OP_CHECKSIGADD (0xba) for multisig, disabled OP_CHECKMULTISIG and OP_CHECKMULTISIGVERIFY, switched OP_CHECKSIG and OP_CHECKSIGVERIFY to Schnorr signatures, and turned 87 unused opcode values into OP_SUCCESSx, so future soft forks can add opcodes cleanly. These rules apply only inside Taproot script paths.