跳到主要内容

TVM instructions

advanced level

This information is very low-level and could be hard to understand for newcomers. So feel free to read about it later.

Introduction

This document provides a list of TVM instructions along with their opcodes and mnemonics.

信息
  • TVM.pdf concept document for TON Virtual Machine (may include outdated information).
  • TVM Retracer

Fift is a stack-based programming language designed to manage TON smart contracts. The Fift assembler is a Fift library that converts mnemonics of TVM instructions into their binary representation.

A description of Fift, including an introduction to the Fift assembler, can be found here.

This document specifies the corresponding mnemonic for each instruction.

Note the following:

  1. Fift is a stack-based language, therefore all the arguments of any instruction are written before it (e.g. 5 PUSHINT, s0 s4 XCHG).
  2. Stack registers are denoted by s0, s1, ..., s15. Other stack registers (up to 255) are denoted by i s() (e.g. 100 s()).
  3. Control registers are denoted by c0, c1, ..., c15.

Gas prices

The gas price of each instruction is specified in this document. The basic gas price of an instruction is 10 + b, where b is the instruction length in bits. Some operations have additional fees:

  1. Parsing cells: Transforming a cell into a slice costs 100 gas units if the cell is loading for the first time and 25 for subsequent loads during the same transaction. For such instructions, two gas prices are specified (e.g. CTOS: 118/43).
  2. Cell creation: 500 gas units.
  3. Throwing exceptions: 50 gas units. In this document the exception fee is only specified for an instruction if its primary purpose is to throw (e.g. THROWIF, FITS). If the instruction only throws in some cases, two gas prices are specified (e.g. FITS: 26/76).
  4. Tuple creation: 1 gas unit for every tuple element.
  5. Implicit jumps: 10 gas units for an implicit jump, 5 gas units for an implicit back jump. This fee is not a part of any instruction.
  6. Moving stack elements between continuations: 1 gas unit per element, however moving the first 32 elements is free.
信息

A full machine-readable list of TVM instructions is available here.

Each section of TVM Instructions includes a built-in search component for finding opcodes specific to that section as well.

On this page, however, the search covers all existing opcodes, providing a comprehensive search option across the entire opcode range.

Feel free to use the search field below to find a specific instruction:

OpcodeFift syntaxStackDescriptionGas
0is[i] XCHG0Interchanges s0 with s[i], 1 <= i <= 15.18
2is[i] PUSHPushes a copy of the old s[i] into the stack.18
D3cc[cc+1] LDUs - x s'Loads an unsigned cc+1-bit integer x from Slice s.26
82lxxx[xxx] PUSHINT [xxx] INT- xxx

Pushes integer xxx. Details: 5-bit 0 <= l <= 30 determines the length n=8l+19 of signed big-endian integer xxx. The total length of this instruction is l+4 bytes or n+13=8l+32 bits.

23
BAEQUALx y - x=yReturns -1 if x=y, 0 otherwise.18
F2E4_n[n] THROWIFNOTf - For 0 <= n < 2^11, an encoding of [n] THROWIFNOT for larger values of n.34/84
81xxxx[xxxx] PUSHINT [xxxx] INT- xxxxPushes integer xxxx. -2^15 <= xx < 2^15.34
3is[i] POPPops the old s0 value into the old s[i].18
9xccc[builder] PUSHCONT [builder] CONT- c

Pushes a continuation made from builder. Details: Pushes an x-byte continuation for 0 <= x <= 15.

18
CBcc[cc+1] STUx b - b'Stores an unsigned cc+1-bit integer x into Builder b. In all other respects it is similar to STI.26
7i[x] PUSHINT [x] INT- x

Pushes integer x into the stack. -5 <= x <= 10. Here i equals four lower-order bits of x (i=x mod 16).

18
E0IFJMPf c - Jumps to c (similarly to JMPX), but only if f is non-zero.18
D0CTOSc - sConverts a Cell into a Slice. Notice that c must be either an ordinary cell, or an exotic cell which is automatically loaded to yield an ordinary cell c', converted into a Slice afterwards.118/43
FA40LDMSGADDRs - s' s''Loads from Slice s the only prefix that is a valid MsgAddress, and returns both this prefix s' and the remainder s'' of s as slices.26
C8NEWC- bCreates a new empty Builder.18
1is1 s[i] XCHGInterchanges s1 with s[i], 2 <= i <= 15.18
C9ENDCb - cConverts a Builder into an ordinary Cell.518
DB3C[ref] CALLREFEquivalent to PUSHREFCONT CALLX.126/51
F85_k[k] GETGLOB - x

Returns the k-th global variable for 1 <= k <= 31. Equivalent to c7 PUSHCTR [k] INDEXQ.

26
ED5ic[i] POPCTR c[i] POPx - Pops a value x from the stack and stores it into control register c(i), if supported in the current codepage. Notice that if a control register accepts only values of a specific type, a type-checking exception may occur.26
CF16STSLICERb s - b'Equivalent to SWAP STSLICE.26
F82i[i] GETPARAM - x

Returns the i-th parameter from the Tuple provided at c7 for 0 <= i <= 15. Equivalent to c7 PUSHCTR FIRST [i] INDEX. If one of these internal operations fails, throws an appropriate type checking or range checking exception.

26
F87_k[k] SETGLOBx -

Assigns x to the k-th global variable for 1 <= k <= 31. Equivalent to c7 PUSHCTR SWAP k SETINDEXQ c7 POPCTR.

26+|c7'|
11iis0 [ii] s() XCHGInterchanges s0 with s[ii], 0 <= ii <= 255.26
D4LDREFs - c s'Loads a cell reference c from s.18
F2A_n[n] THROWIFNOTf - Throws exception 0 <= n <= 63 with parameter zero only if integer f=0.26/76
59ROTREV -ROTa b c - c a bEquivalent to 2 1 BLKSWAP or to s2 s2 XCHG2.18
A4INCx - x+1Equivalent to 1 ADDCONST.18
F26_n[n] THROWIFf - Throws exception 0 <= n <= 63 with parameter zero only if integer f!=0.26/76
F901HASHSUs - xComputes the hash of a Slice s and returns it as a 256-bit unsigned integer x. The result is the same as if an ordinary cell containing only data and references from s had been created and its hash computed by HASHCU.526
BEGEQx y - x>=yEquivalent to LESS NOT.18
D718LDSLICEXs l - s'' s'Loads the first 0 <= l <= 1023 bits from Slice s into a separate Slice s'', returning the remainder of s as s'.26
F800ACCEPT-

Sets current gas limit g_l to its maximal allowed value g_m, and resets the gas credit g_c to zero, decreasing the value of g_r by g_c in the process. In other words, the current smart contract agrees to buy some gas to finish the current transaction. This action is required to process external messages, which bring no value (hence no gas) with themselves.

26
F910CHKSIGNUh s k - ?

Checks the Ed25519-signature s of a hash h (a 256-bit unsigned integer, usually computed as the hash of some data) using public key k (also represented by a 256-bit unsigned integer). The signature s must be a Slice containing at least 512 data bits; only the first 512 bits are used. The result is -1 if the signature is valid, 0 otherwise. Notice that CHKSIGNU is equivalent to ROT NEWC 256 STU ENDC ROTREV CHKSIGNS, i.e., to CHKSIGNS with the first argument d set to 256-bit Slice containing h. Therefore, if h is computed as the hash of some data, these data are hashed twice, the second hashing occurring inside CHKSIGNS.

26
50ijs[i] s[j] XCHG2Equivalent to s1 s[i] XCHG s[j] XCHG0.26
D74E_n[n] PLDREFIDXs - cReturns the n-th cell reference of Slice s, where 0 <= n <= 3.26
FFnn[nn] SETCP-Selects TVM codepage 0 <= nn < 240. If the codepage is not supported, throws an invalid opcode exception.26
DDIFNOTRET IF:f - Performs a RET, but only if integer f is zero.18
FA00LDGRAMS LDVARUINT16s - x s'

Loads (deserializes) a Gram or VarUInteger 16 amount from Slice s, and returns the amount as Integer x along with the remainder s' of s. The expected serialization of x consists of a 4-bit unsigned big-endian integer l, followed by an 8l-bit unsigned big-endian representation of x. The net effect is approximately equivalent to 4 LDU SWAP 3 LSHIFT# LDUX.

26
ED4ic[i] PUSHCTR c[i] PUSH- xPushes the current value of control register c(i). If the control register is not supported in the current codepage, or if it does not have a value, an exception is triggered.26
CCSTREFc b - b'Stores a reference to Cell c into Builder b.18
F0nn[nn] CALL [nn] CALLDICT- nn

Calls the continuation in c3, pushing integer 0 <= nn <= 255 into its stack as an argument. Approximately equivalent to [nn] PUSHINT c3 PUSHCTR EXECUTE.

FA02STGRAMS STVARUINT16b x - b'Stores (serializes) an Integer x in the range 0...2^120-1 into Builder b, and returns the resulting Builder b'. The serialization of x consists of a 4-bit unsigned big-endian integer l, which is the smallest integer l>=0, such that x<2^(8l), followed by an 8l-bit unsigned big-endian representation of x. If x does not belong to the supported range, a range check exception is thrown.26
10ijs[i] s[j] XCHGInterchanges s[i] with s[j], 1 <= i < j <= 15.26
8F_rxxcccc[builder] PUSHCONT [builder] CONT- c

Pushes a continuation made from builder. Details: Pushes the simple ordinary continuation cccc made from the first 0 <= r <= 3 references and the first 0 <= xx <= 127 bytes of cc.code.

26
6Cij[i] [j] BLKDROP2

Drops i stack elements under the top j elements. 1 <= i <= 15, 0 <= j <= 15 Equivalent to [i+j] 0 REVERSE [i] BLKDROP [j] 0 REVERSE.

26
83xx[xx+1] PUSHPOW2- 2^(xx+1)

(Quietly) pushes 2^(xx+1) for 0 <= xx <= 255. 2^256 is a NaN.

26
80xx[xx] PUSHINT [xx] INT- xxPushes integer xx. -128 <= xx <= 127.26
F400STDICT STOPTREFD b - b'

Stores dictionary D into Builder b, returning the resulting Builder b'. In other words, if D is a cell, performs STONE and STREF; if D is Null, performs NIP and STZERO; otherwise throws a type checking exception.

26
C0yy[yy] EQINTx - x=yy

Returns -1 if x=yy, 0 otherwise. -2^7 <= yy < 2^7.

26
5F0i[i] BLKDROPEquivalent to DROP performed i times.26
F404LDDICT LDOPTREFs - D s'Loads (parses) a dictionary D from Slice s, and returns the remainder of s as s'. May be applied to dictionaries or to values of arbitrary (^Y)? types.26
58ROTa b c - b c aEquivalent to 1 2 BLKSWAP or to s2 s1 XCHG2.18
D749SBITSs - lReturns the number of data bits in Slice s.26
52ijs[i] s[j-1] PUXCEquivalent to s[i] PUSH SWAP s[j] XCHG0.26
B0ANDx y - x&yBitwise and of two signed integers x and y, sign-extended to infinity.18
D70Bcc[cc+1] PLDUs - xPreloads an unsigned cc+1-bit integer from s.34
E2IFELSEf c c' - If integer f is non-zero, executes c, otherwise executes c'. Equivalent to CONDSELCHK EXECUTE.18
CAcc[cc+1] STIx b - b'Stores a signed cc+1-bit integer x into Builder b for 0 <= cc <= 255, throws a range check exception if x does not fit into cc+1 bits.26
A0ADDx y - x+y18
55ij[i+1] [j+1] BLKSWAP

Permutes two blocks s[j+i+1] ... s[j+1] and s[j] ... s0. 0 <= i,j <= 15 Equivalent to [i+1] [j+1] REVERSE [j+1] 0 REVERSE [i+j+2] 0 REVERSE.

26
F2D4_n[n] THROWIFf - For 0 <= n < 2^11, an encoding of [n] THROWIF for larger values of n.34/84
E302[ref] IFJMPREFf - Equivalent to PUSHREFCONT IFJMP.26/126/51
A1SUBx y - x-y18
4ijks[i] s[j] s[k] XCHG3Equivalent to s2 s[i] XCHG s1 s[j] XCHG s[k] XCHG0.26
D2cc[cc+1] LDIs - x s'Loads (i.e., parses) a signed cc+1-bit integer x from Slice s, and returns the remainder of s as s'.26
FB00SENDRAWMSGc x - Sends a raw message contained in Cell c, which should contain a correctly serialized object Message X, with the only exception that the source address is allowed to have dummy value addr_none (to be automatically replaced with the current smart-contract address), and ihr_fee, fwd_fee, created_lt and created_at fields can have arbitrary values (to be rewritten with correct values during the action phase of the current transaction). Integer parameter x contains the flags. Currently x=0 is used for ordinary messages; x=128 is used for messages that are to carry all the remaining balance of the current smart contract (instead of the value originally indicated in the message); x=64 is used for messages that carry all the remaining value of the inbound message in addition to the value initially indicated in the new message (if bit 0 is not set, the gas fees are deducted from this amount); x'=x+1 means that the sender wants to pay transfer fees separately; x'=x+2 means that any errors arising while processing this message during the action phase should be ignored. Finally, x'=x+32 means that the current account must be destroyed if its resulting balance is zero. This flag is usually employed together with +128.526
C705SDEQs s' - ?Checks whether the data parts of s and s' coincide, equivalent to SDLEXCMP ISZERO.26
53ijs[i] s[j] PUSH2Equivalent to s[i] PUSH s[j+1] PUSH.26
D1ENDSs - Removes a Slice s from the stack, and throws an exception if it is not empty.18/68
57ii[ii] s() POP

Pops the old s0 value into the old s[ii]. 0 <= ii <= 255

26
51ijs[i] s[j] XCPUEquivalent to s[i] XCHG0 s[j] PUSH.26
C2yy[yy] GTINT [yy+1] GEQINTx - x>yy

Returns -1 if x>yy, 0 otherwise. -2^7 <= yy < 2^7.

26
C700SEMPTYs - ?Checks whether a Slice s is empty (i.e., contains no bits of data and no cell references).26
6F0n[n] TUPLEx_1 ... x_n - t

Creates a new Tuple t=(x_1, ... ,x_n) containing n values x_1,..., x_n. 0 <= n <= 15

26+n
8Drxxsssss[slice] PUSHSLICE [slice] SLICE- s

Pushes the slice slice into the stack. Details: Pushes the subslice of cc.code consisting of 0 <= r <= 4 references and up to 8xx+6 bits of data, with 0 <= xx <= 127. A completion tag is assumed.

28
D721SDSKIPFIRSTs l - s'Returns all but the first 0 <= l <= 1023 bits of s. It is equivalent to LDSLICEX NIP.26
6FA1NULLSWAPIFNOTx - x or null xPushes a Null under the topmost Integer x, but only if x=0. May be used for stack alignment after quiet primitives such as PLDUXQ.26
DEIFf c - Performs EXECUTE for c (i.e., executes c), but only if integer f is non-zero. Otherwise simply discards both values.18
F900HASHCUc - xComputes the representation hash of a Cell c and returns it as a 256-bit unsigned integer x. Useful for signing and checking signatures of arbitrary entities represented by a tree of cells.26
6DNULL PUSHNULL - nullPushes the only value of type Null.18
84xx[xx+1] PUSHPOW2DEC- 2^(xx+1)-1Pushes 2^(xx+1)-1 for 0 <= xx <= 255.26
545ijks[i] s[j-1] s[k-1] PUXCPUEquivalent to s[i] s[j-1] PUXC s[k] PUSH.34
A3NEGATEx - -x

Equivalent to -1 MULCONST or to ZERO SUBR. Notice that it triggers an integer overflow exception if x=-2^256.

18
A8MULx y - x*y18
F2F0THROWANYn - 0 n

Throws exception 0 <= n < 2^16 with parameter zero. Approximately equivalent to ZERO SWAP THROWARGANY.

76
541ijks[i] s[j] s[k] XC2PUEquivalent to s[i] s[j] XCHG2 s[k] PUSH.34
6EISNULLx - ?Checks whether x is a Null, and returns -1 or 0 accordingly.18
B1ORx y - x|yBitwise or of two integers.18
F40EDICTUGETi D n - x -1 or 0Similar to DICTIGET, but with unsigned (big-endian) n-bit Integer i used as a key.
FA44REWRITESTDADDRs - x yParses Slice s containing a valid MsgAddressInt (usually a msg_addr_std), applies rewriting from the anycast (if present) to the same-length prefix of the address, and returns both the workchain x and the 256-bit address y as integers. If the address is not 256-bit, or if s is not a valid serialization of MsgAddressInt, throws a cell deserialization exception.26
BCGREATERx y - x>y18
5BDROP2 2DROPa b - Equivalent to DROP DROP.18
542ijks[i] s[j] s[k-1] XCPUXCEquivalent to s1 s[i] XCHG s[j] s[k-1] PUXC.34
E30D[ref] IFREFELSEf c -Equivalent to PUSHREFCONT SWAP IFELSE, with the optimization that the cell reference is not actually loaded into a Slice and then converted into an ordinary Continuation if f=0. Similar remarks apply to the next two primitives: cells are converted into continuations only when necessary.26/126/51
A904DIVx y - qq=floor(x/y), r=x-y*q26
56ii[ii] s() PUSH

Pushes a copy of the old s[ii] into the stack. 0 <= ii <= 255

26
8Bxsss[slice] PUSHSLICE [slice] SLICE- s

Pushes the slice slice into the stack. Details: Pushes the (prefix) subslice of cc.code consisting of its first 8x+4 bits and no references (i.e., essentially a bitstring), where 0 <= x <= 15. A completion tag is assumed, meaning that all trailing zeroes and the last binary one (if present) are removed from this bitstring. If the original bitstring consists only of zeroes, an empty slice will be pushed.

22
B9LESSx y - x<yReturns -1 if x<y, 0 otherwise.18
547ijks[i] s[j] s[k] PUSH3Equivalent to s[i] PUSH s[j+1] s[k+1] PUSH2.34
B3NOTx - ~xBitwise not of an integer.26
E6UNTILc - Executes continuation c, then pops an integer x from the resulting stack. If x is zero, performs another iteration of this loop. The actual implementation of this primitive involves an extraordinary continuation ec_until with its arguments set to the body of the loop (continuation c) and the original current continuation cc. This extraordinary continuation is then saved into the savelist of c as c.c0 and the modified c is then executed. The other loop primitives are implemented similarly with the aid of suitable extraordinary continuations.18
F2F4THROWANYIFNOTn f - Throws exception 0 <= n<2^16 with parameter zero only if f=0.26/76
C1yy[yy] LESSINT [yy-1] LEQINTx - x<yy

Returns -1 if x<yy, 0 otherwise. -2^7 <= yy < 2^7.

26
C3yy[yy] NEQINTx - x!=yy

Returns -1 if x!=yy, 0 otherwise. -2^7 <= yy < 2^7.

26
EDFBSAMEALTSAVE-

Sets c1 to c0, but first saves the old value of c1 into the savelist of c0. Equivalent to c1 SAVE SAMEALT.

26
CF00STIXx b l - b'Stores a signed l-bit integer x into b for 0 <= l <= 257.26
BBLEQx y - x<=y18
AAcc[cc+1] LSHIFT#x - x*2^(cc+1)0 <= cc <= 25526
E8WHILEc' c - Executes c' and pops an integer x from the resulting stack. If x is zero, exists the loop and transfers control to the original cc. If x is non-zero, executes c, and then begins a new iteration.18
EDAic[i] SAVE c[i] SAVECTRSaves the current value of c(i) into the savelist of continuation c0. If an entry for c[i] is already present in the savelist of c0, nothing is done. Equivalent to c[i] PUSHCTR c[i] SETRETCTR.26
5ASWAP2 2SWAPa b c d - c d a bEquivalent to 2 2 BLKSWAP or to s3 s2 XCHG2.18
D8EXECUTE CALLXc - Calls, or executes, continuation c.18
6F2n[n] UNTUPLEt - x_1 ... x_n

Unpacks a Tuple t=(x_1,...,x_n) of length equal to 0 <= n <= 15. If t is not a Tuple, or if |t| != n, a type check exception is thrown.

26+n
A9B4tt[tt+1] MULRSHIFT#x y - floor(x*y/2^(tt+1))34
FEij{i*16+j} DEBUG-26
E300[ref] IFREFf -

Equivalent to PUSHREFCONT IF, with the optimization that the cell reference is not actually loaded into a Slice and then converted into an ordinary Continuation if f=0. Gas consumption of this primitive depends on whether f=0 and whether the reference was loaded before. Similar remarks apply other primitives that accept a continuation as a reference.

26/126/51
8A[ref] PUSHREFCONT- contSimilar to PUSHREFSLICE, but makes a simple ordinary Continuation out of the cell.118/43
6F1k[k] INDEXt - x

Returns the k-th element of a Tuple t. 0 <= k <= 15.

26
A984MULDIVx y z - qq=floor(x*y/z)26
89[ref] PUSHREFSLICE- sSimilar to PUSHREF, but converts the cell into a Slice.118/43
BDNEQx y - x!=yEquivalent to EQUAL NOT.18
ABcc[cc+1] RSHIFT#x - floor(x/2^(cc+1))0 <= cc <= 25518
F417DICTUSETREFc i D n - D'Similar to DICTISETREF, but with i unsigned.
CF01STUXx b l - b'Stores an unsigned l-bit integer x into b for 0 <= l <= 256.26
A6cc[cc] ADDCONST [cc] ADDINT [-cc] SUBCONST [-cc] SUBINTx - x+cc-128 <= cc <= 127.26
F443DICTUSETBb i D n - D'
B608MINx y - x or yComputes the minimum of two integers x and y.26
66TUCKa b - b a bEquivalent to SWAP OVER or to s1 s1 XCPU.18
5CDUP2 2DUPa b - a b a bEquivalent to s1 s0 PUSH2.18
E1IFNOTJMPf c - Jumps to c (similarly to JMPX), but only if f is zero.18
F40ADICTGETk D n - x -1 or 0

Looks up key k (represented by a Slice, the first 0 <= n <= 1023 data bits of which are used as a key) in dictionary D of type HashmapE(n,X) with n-bit keys. On success, returns the value found as a Slice x.

E30F[ref] [ref] IFREFELSEREFf -Equivalent to PUSHREFCONT PUSHREFCONT IFELSE.126/51
546ijks[i] s[j-1] s[k-2] PU2XCEquivalent to s[i] PUSH SWAP s[j] s[k-1] PUXC.34
F40FDICTUGETREFi D n - c -1 or 0Similar to DICTIGETREF, but with an unsigned n-bit Integer key i.
543ijks[i] s[j] s[k] XCPU2Equivalent to s[i] XCHG0 s[j] s[k] PUSH2.34
6FA5NULLSWAPIFNOT2x - x or null null x

Pushes two nulls under the topmost Integer x, but only if x=0. Equivalent to NULLSWAPIFNOT NULLSWAPIFNOT.

26
A985MULDIVRx y z - q'q'=round(x*y/z)26
E30E[ref] IFELSEREFf c -Equivalent to PUSHREFCONT IFELSE.26/126/51
DCIFRET IFNOT:f - Performs a RET, but only if integer f is non-zero. If f is a NaN, throws an integer overflow exception.18
DFIFNOTf c - Executes continuation c, but only if integer f is zero. Otherwise simply discards both values.18
F836GETGASFEEgas_used is_mc - priceCalculates gas fee
E4REPEATn c -

Executes continuation c n times, if integer n is non-negative. If n>=2^31 or n<-2^31, generates a range check exception. Notice that a RET inside the code of c works as a continue, not as a break. One should use either alternative (experimental) loops or alternative RETALT (along with a SETEXITALT before the loop) to break out of a loop.

18
CF31BBITSb - xReturns the number of data bits already stored in Builder b.26
FB02RAWRESERVEx y - Creates an output action which would reserve exactly x nanograms (if y=0), at most x nanograms (if y=2), or all but x nanograms (if y=1 or y=3), from the remaining balance of the account. It is roughly equivalent to creating an outbound message carrying x nanograms (or b-x nanograms, where b is the remaining balance) to oneself, so that the subsequent output actions would not be able to spend more money than the remainder. Bit +2 in y means that the external action does not fail if the specified amount cannot be reserved; instead, all remaining balance is reserved. Bit +8 in y means x:=-x before performing any further actions. Bit +4 in y means that x is increased by the original balance of the current account (before the compute phase), including all extra currencies, before performing any other checks and actions. Currently x must be a non-negative integer, and y must be in the range 0...15.526
544ijks[i] s[j-1] s[k-1] PUXC2Equivalent to s[i] PUSH s2 XCHG0 s[j] s[k] XCHG2.34
ED6ic[i] SETCONT c[i] SETCONTCTRx c - c'Stores x into the savelist of continuation c as c(i), and returns the resulting continuation c'. Almost all operations with continuations may be expressed in terms of SETCONTCTR, POPCTR, and PUSHCTR.26
CF17STBR BCONCATb b' - b''

Concatenates two builders. Equivalent to SWAP STB.

26
D74ASREFSs - rReturns the number of references in Slice s.26
F416DICTUSETx i D n - D'Similar to DICTISET, but with i an unsigned n-bit integer.
F80FCOMMIT-Commits the current state of registers c4 (''persistent data'') and c5 (''actions'') so that the current execution is considered ''successful'' with the saved values even if an exception is thrown later.26
A7cc[cc] MULCONST [cc] MULINTx - x*cc-128 <= cc <= 127.26
F2F2THROWANYIFn f - Throws exception 0 <= n < 2^16 with parameter zero only if f!=0.26/76
F815ADDRAND RANDOMIZEx - Mixes unsigned 256-bit Integer x into the random seed r by setting the random seed to Sha of the concatenation of two 32-byte strings: the first with the big-endian representation of the old seed r, and the second with the big-endian representation of x.26
88[ref] PUSHREF- c

Pushes the reference ref into the stack. Details: Pushes the first reference of cc.code into the stack as a Cell (and removes this reference from the current continuation).

18
F405PLDDICT PLDOPTREFs - D

Preloads a dictionary D from Slice s. Approximately equivalent to LDDICT DROP.

26
F833CONFIGOPTPARAMi - c^?

Returns the value of the global configuration parameter with integer index i as a Maybe Cell c^?. Equivalent to CONFIGDICT DICTIGETOPTREF.

A5DECx - x-1Equivalent to -1 ADDCONST.18
F2C4_n[n] THROW- 0 nnFor 0 <= n < 2^11, an encoding of [n] THROW for larger values of n.84
6F8CTPUSH COMMAt x - t'Appends a value x to a Tuple t=(x_1,...,x_n), but only if the resulting Tuple t'=(x_1,...,x_n,x) is of length at most 255. Otherwise throws a type check exception.26+|t'|
F838GETFORWARDFEEcells bits is_mc - priceCalculates forward fee.
5Eij[i+2] [j] REVERSEReverses the order of s[j+i+1] ... s[j].26
F486DICTUMIND n - x i -1 or 0Similar to DICTMIN, but returns the key as an unsigned n-bit Integer i.
6F88TLENt - nReturns the length of a Tuple.26
F46BDICTUGETOPTREFi D n - c^?DICTGETOPTREF, but with i an unsigned n-bit integer. If the key i is out of range, also returns Null.
F45BDICTUDELi D n - D' ?Similar to DICTIDEL, but with i an unsigned n-bit integer.
A908MODx y - r26
C701SDEMPTYs - ?Checks whether Slice s has no bits of data.26
A938tt[tt+1] MODPOW2#x - x mod 2^(tt+1)34
F466DICTUDELGETi D n - D' x -1 or D 0DICTDELGET, but with i an unsigned n-bit integer.
F811RANDy - z

Generates a new pseudo-random integer z in the range 0...y-1 (or y...-1, if y<0). More precisely, an unsigned random value x is generated as in RAND256U; then z:=floor(x*y/2^256) is computed. Equivalent to RANDU256 256 MULRSHIFT.

26+|c7|+|c1_1|
B609MAXx y - x or yComputes the maximum of two integers x and y.26
D6cc[cc+1] LDSLICEs - s'' s'Cuts the next cc+1 bits of s into a separate Slice s''.26
F401SKIPDICT SKIPOPTREFs - s'Equivalent to LDDICT NIP.26
F810RANDU256- xGenerates a new pseudo-random unsigned 256-bit Integer x. The algorithm is as follows: if r is the old value of the random seed, considered as a 32-byte array (by constructing the big-endian representation of an unsigned 256-bit integer), then its sha512(r) is computed; the first 32 bytes of this hash are stored as the new value r' of the random seed, and the remaining 32 bytes are returned as the next random value x.26+|c7|+|c1_1|
EDF1COMPOSALT BOOLORc c' - c''Computes the alternative composition compose1(c, c'), which has the meaning of ''perform c, and, if not successful, perform c''' (if c is a boolean circuit). Equivalent to SWAP c1 SETCONT.26
F2FFTRYc c' - Sets c2 to c', first saving the old value of c2 both into the savelist of c' and into the savelist of the current continuation, which is stored into c.c0 and c'.c0. Then runs c similarly to EXECUTE. If c does not throw any exceptions, the original value of c2 is automatically restored on return from c. If an exception occurs, the execution is transferred to c', but the original value of c2 is restored in the process, so that c' can re-throw the exception by THROWANY if it cannot handle it by itself.26
F22_n[n] THROW - 0 n

Throws exception 0 <= n <= 63 with parameter zero. In other words, it transfers control to the continuation in c2, pushing 0 and n into its stack, and discarding the old stack altogether.

76
D70Acc[cc+1] PLDIs - xPreloads a signed cc+1-bit integer from Slice s.34
F441DICTSETBb k D n - D'
F902SHA256Us - xComputes Sha of the data bits of Slice s. If the bit length of s is not divisible by eight, throws a cell underflow exception. The hash value is returned as a 256-bit unsigned integer x.26
5DOVER2 2OVERa b c d - a b c d a bEquivalent to s3 s2 PUSH2.18
FA03STVARINT16b x - b'Similar to STVARUINT16, but serializes a signed Integer x in the range -2^119...2^119-1.26
AEPOW2y - 2^y

0 <= y <= 1023 Equivalent to ONE SWAP LSHIFT.

18
F47CDICTUGETNEXTi D n - x' i' -1 or 0Similar to DICTGETNEXT, but interprets all keys in dictionary D as big-endian unsigned n-bit integers, and computes the minimal key i' that is larger than Integer i (which does not necessarily fit into n bits, and is not necessarily non-negative).
ED11SETCONTVARARGSx_1 x_2...x_r c r n - c'Similar to SETCONTARGS, but with 0 <= r <= 255 and -1 <= n <= 255 taken from the stack.26+s''
FB04SETCODEc - Creates an output action that would change this smart contract code to that given by Cell c. Notice that this change will take effect only after the successful termination of the current run of the smart contract.526
F83AGETORIGINALFWDFEEfwd_fee is_mc - orig_fwd_feeCalculate fwd_fee * 2^16 / first_frac. Can be used to get the original fwd_fee of the message.
C702SREMPTYs - ?Checks whether Slice s has no references.26
DB0p[p] -1 CALLXARGSc - Calls continuation c with 0 <= p <= 15 parameters, expecting an arbitrary number of return values.26
E303[ref] IFNOTJMPREFf - Equivalent to PUSHREFCONT IFNOTJMP.26/126/51
D719PLDSLICEXs l - s''Returns the first 0 <= l <= 1023 bits of s as s''.26
F801SETGASLIMITg - Sets current gas limit g_l to the minimum of g and g_m, and resets the gas credit g_c to zero. If the gas consumed so far (including the present instruction) exceeds the resulting value of g_l, an (unhandled) out of gas exception is thrown before setting new gas limits. Notice that SETGASLIMIT with an argument g >= 2^63-1 is equivalent to ACCEPT.26
6F81INDEXVARt k - xSimilar to k INDEX, but with 0 <= k <= 254 taken from the stack.26
CF40STZEROESb n - b'Stores n binary zeroes into Builder b.26
D701LDUXs l - x s'Loads an unsigned l-bit integer x from (the first l bits of) s, with 0 <= l <= 256.26
A906DIVCx y - q''q''=ceil(x/y), r''=x-y*q''26
CESTSLICEs b - b'Stores Slice s into Builder b.18
F12_n[n] CALL [n] CALLDICT- nFor 0 <= n < 2^14, an encoding of [n] CALL for larger values of n.
D736SPLITs l r - s' s''Splits the first 0 <= l <= 1023 data bits and first 0 <= r <= 4 references from s into s', returning the remainder of s as s''.26
FA46REWRITEVARADDRs - x s'A variant of REWRITESTDADDR that returns the (rewritten) address as a Slice s, even if it is not exactly 256 bit long (represented by a msg_addr_var).26
F911CHKSIGNSd s k - ?Checks whether s is a valid Ed25519-signature of the data portion of Slice d using public key k, similarly to CHKSIGNU. If the bit length of Slice d is not divisible by eight, throws a cell underflow exception. The verification of Ed25519 signatures is the standard one, with Sha used to reduce d to the 256-bit number that is actually signed.26
F941CDATASIZEc n - x y zA non-quiet version of CDATASIZEQ that throws a cell overflow exception (8) on failure.
B60BABSx - |x|Computes the absolute value of an integer x.26
FA01LDVARINT16s - x s'

Similar to LDVARUINT16, but loads a signed Integer x. Approximately equivalent to 4 LDU SWAP 3 LSHIFT# LDIX.

26
D700LDIXs l - x s'Loads a signed l-bit (0 <= l <= 257) integer x from Slice s, and returns the remainder of s as s'.26
A986MULDIVCx y z - q'q'=ceil(x*y/z)26
F48EDICTUMAXD n - x i -1 or 0Similar to DICTMAX, but returns the key as an unsigned n-bit Integer i.
F93010BLS_G1_ADDx y - x+yAddition on G1.3934
F93013BLS_G1_MULx s - x*sMultiplies G1 point x by scalar s. Any s is valid, including negative.5234
F48FDICTUMAXREFD n - c i -1 or 0Similar to DICTUMAX, but returns the only reference in the value.
C70BSDPPFXREVs s' - ?Checks whether s' is a proper prefix of s.26
F837GETSTORAGEFEEcells bits seconds is_mc - priceCalculates storage fees (only current StoragePrices entry is used).
D723SDSKIPLASTs l - s'Returns all but the last 0 <= l <= 1023 bits of s.26
F90403HASHEXT_KECCAK256s_1 ... s_n n - hCalculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/11 gas per byte
D722SDCUTLASTs l - s'Returns the last 0 <= l <= 1023 bits of s.26
A90CDIVMODx y - q r26
F453DICTUADDBb i D n - D' -1 or D 0
F4A6_n[ref] [n] DICTPUSHCONST - D nPushes a non-empty constant dictionary D (as a Cell^?) along with its key length 0 <= n <= 1023, stored as a part of the instruction. The dictionary itself is created from the first of remaining references of the current continuation. In this way, the complete DICTPUSHCONST instruction can be obtained by first serializing xF4A4_, then the non-empty dictionary itself (one 1 bit and a cell reference), and then the unsigned 10-bit integer n (as if by a STU 10 instruction). An empty dictionary can be pushed by a NEWDICT primitive instead.34
ED1EBLESSs - cTransforms a Slice s into a simple ordinary continuation c, with c.code=s and an empty stack and savelist.26
F940CDATASIZEQc n - x y z -1 or 0Recursively computes the count of distinct cells x, data bits y, and cell references z in the dag rooted at Cell c, effectively returning the total storage used by this dag taking into account the identification of equal cells. The values of x, y, and z are computed by a depth-first traversal of this dag, with a hash table of visited cell hashes used to prevent visits of already-visited cells. The total count of visited cells x cannot exceed non-negative Integer n; otherwise the computation is aborted before visiting the (n+1)-st cell and a zero is returned to indicate failure. If c is Null, returns x=y=z=0.
D74BSBITREFSs - l rReturns both the number of data bits and the number of references in s.26
D5LDREFRTOSs - s' s''Equivalent to LDREF SWAP CTOS.118/43
F839GETPRECOMPILEDGAS- xReturns gas usage for the current contract if it is precompiled, null otherwise.
D724SDSUBSTRs l l' - s'Returns 0 <= l' <= 1023 bits of s starting from offset 0 <= l <= 1023, thus extracting a bit substring out of the data of s.26
CF13STBb' b - b''Appends all data from Builder b' to Builder b.26
F487DICTUMINREFD n - c i -1 or 0Similar to DICTUMIN, but returns the only reference in the value.
F83CGETFORWARDFEESIMPLEcells bits is_mc - priceSame as GETFORWARDFEE, but without lump price (just (bits*bit_price + cells*cell_price) / 2^16).
F4A1DICTUGETJMPi D n - Similar to DICTIGETJMP, but performs DICTUGET instead of DICTIGET.
D739XCTOSc - s ?Transforms an ordinary or exotic cell into a Slice, as if it were an ordinary cell. A flag is returned indicating whether c is exotic. If that be the case, its type can later be deserialized from the first eight bits of s.
F40DDICTIGETREFi D n - c -1 or 0Combines DICTIGET with DICTGETREF: it uses signed n-bit Integer i as a key and returns a Cell instead of a Slice on success.
F807GASCONSUMED- g_cReturns gas consumed by VM so far (including this instruction).26
DApr[p] [r] CALLXARGSc -

Calls continuation c with p parameters and expecting r return values 0 <= p <= 15, 0 <= r <= 15

26
F40CDICTIGETi D n - x -1 or 0Similar to DICTGET, but with a signed (big-endian) n-bit Integer i as a key. If i does not fit into n bits, returns 0. If i is a NaN, throws an integer overflow exception.
F4A8PFXDICTGETQs D n - s' x s'' -1 or s 0Looks up the unique prefix of Slice s present in the prefix code dictionary represented by Cell^? D and 0 <= n <= 1023. If found, the prefix of s is returned as s', and the corresponding value (also a Slice) as x. The remainder of s is returned as a Slice s''. If no prefix of s is a key in prefix code dictionary D, returns the unchanged s and a zero flag to indicate failure.
F814SETRANDx - Sets the random seed to unsigned 256-bit Integer x.26+|c7|+|c1_1|
F47FDICTUGETPREVEQi D n - x' i' -1 or 0Similar to DICTGETPREVEQ, but interprets keys a unsigned n-bit integers.
B2XORx y - x xor yBitwise xor of two integers.18
F912ECRECOVERhash v r s - 0 or h x1 x2 -1Recovers the public key from a secp256k1 signature, identical to Bitcoin/Ethereum operations. Takes a 32-byte hash as uint256 hash and a 65-byte signature as uint8 v, uint256 r, and uint256 s. In TON, the v value is strictly 0 or 1; no extra flags or extended values are supported. If the public key cannot be recovered, the instruction returns 0. On success, it returns the recovered 65-byte public key as uint8 h, uint256 x1, and uint256 x2, followed by -1.1526
E301[ref] IFNOTREFf - Equivalent to PUSHREFCONT IFNOT.26/126/51
F46ADICTIGETOPTREFi D n - c^?DICTGETOPTREF, but with i a signed n-bit integer. If the key i is out of range, also returns Null.
F482DICTMIND n - x k -1 or 0Computes the minimal key k (represented by a Slice with n data bits) in dictionary D, and returns k along with the associated value x.
F40BDICTGETREFk D n - c -1 or 0

Similar to DICTGET, but with a LDREF ENDS applied to x on success. This operation is useful for dictionaries of type HashmapE(n,^Y).

F470PFXDICTSETx k D n - D' -1 or D 0
A98CMULDIVMODx y z - q rq=floor(x*y/z), r=x*y-z*q26
D703PLDUXs l - xPreloads an unsigned l-bit integer from s, for 0 <= l <= 256.26
6F8DTPOPt - t' xDetaches the last element x=x_n from a non-empty Tuple t=(x_1,...,x_n), and returns both the resulting Tuple t'=(x_1,...,x_{n-1}) and the original last element x.26+|t'|
F93012BLS_G1_NEGx - -xNegation on G1.784
F93030BLS_PAIRINGx_1 y_1 ... x_n y_n n - boolGiven G1 points x_i and G2 points y_i, calculates and multiply pairings of x_i,y_i. Returns true if the result is the multiplicative identity in FP12, false otherwise. Returns false if n=0.20034+n*11800
B603UBITSIZEx - cComputes smallest c >= 0 such that x fits into a c-bit unsigned integer (0 <= x < 2^c), or throws a range check exception.26
D9JMPXc -

Jumps, or transfers control, to continuation c. The remainder of the previous current continuation cc is discarded.

18
F4A0DICTIGETJMPi D n - Similar to DICTIGET, but with x BLESSed into a continuation with a subsequent JMPX to it on success. On failure, does nothing. This is useful for implementing switch/case constructions.
F44BDICTUREPLACEBb i D n - D' -1 or D 0
F1A_n[n] PREPARE [n] PREPAREDICT - n c

Equivalent to n PUSHINT c3 PUSHCTR, for 0 <= n < 2^14. In this way, [n] CALL is approximately equivalent to [n] PREPARE EXECUTE, and [n] JMP is approximately equivalent to [n] PREPARE JMPX. One might use, for instance, CALLXARGS or CALLCC instead of EXECUTE here.

F415DICTISETREFc i D n - D'Similar to DICTSETREF, but with the key a signed n-bit integer as in DICTISET.
C704SDLEXCMPs s' - xCompares the data of s lexicographically with the data of s', returning -1, 0, or 1 depending on the result.26
F90400HASHEXT_SHA256s_1 ... s_n n - hCalculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/33 gas per byte
F496DICTUREMMIND n - D' x i -1 or D 0Similar to DICTREMMIN, but returns the key as an unsigned n-bit Integer i.
F41EDICTUSETGETx i D n - D' y -1 or D' 0DICTISETGET, but with i an unsigned n-bit integer.
F497DICTUREMMINREFD n - D' c i -1 or D 0Similar to DICTUREMMIN, but returns the only reference in the value.
FA42PARSEMSGADDRs - tDecomposes Slice s containing a valid MsgAddress into a Tuple t with separate fields of this MsgAddress. If s is not a valid MsgAddress, a cell deserialization exception is thrown.26
6F85SETINDEXVARt x k - t'Similar to k SETINDEX, but with 0 <= k <= 254 taken from the stack.26+|t'|
00NOP-Does nothing.18
6F84EXPLODEVARt n - x_1 ... x_m mSimilar to n EXPLODE, but with 0 <= n <= 255 taken from the stack.26+m
D765CDEPTHc - xReturns the depth of Cell c. If c has no references, then x=0; otherwise x is one plus the maximum of depths of cells referred to from c. If c is a Null instead of a Cell, returns zero.26
FA41LDMSGADDRQs - s' s'' -1 or s 0A quiet version of LDMSGADDR: on success, pushes an extra -1; on failure, pushes the original s and a zero.26
B601UFITSXx c - xChecks whether x is a c-bit unsigned integer for 0 <= c <= 1023.26/76
ACLSHIFTx y - x*2^y0 <= y <= 102318
F943SDATASIZEs n - x y zA non-quiet version of SDATASIZEQ that throws a cell overflow exception (8) on failure.
A935tt[tt+1] RSHIFTR#x - round(x/2^(tt+1))34
CFC0_xysss[slice] STSLICECONSTb - b'

Stores a constant subslice sss. Details: sss consists of 0 <= x <= 3 references and up to 8y+2 data bits, with 0 <= y <= 7. Completion bit is assumed. Note that the assembler can replace STSLICECONST with PUSHSLICE STSLICER if the slice is too big.

24
FB06SETLIBCODEc x - Creates an output action that would modify the collection of this smart contract libraries by adding or removing library with code given in Cell c. If x=0, the library is actually removed if it was previously present in the collection (if not, this action does nothing). If x=1, the library is added as a private library, and if x=2, the library is added as a public library (and becomes available to all smart contracts if the current smart contract resides in the masterchain); if the library was present in the collection before, its public/private status is changed according to x. Values of x other than 0...2 are invalid.526
C4ISNANx - x=NaNChecks whether x is a NaN.18
F83400PREVMCBLOCKS- tRetrives last_mc_blocks part of PrevBlocksInfo from c7 (parameter 13).
83FFPUSHNAN- NaNPushes a NaN.26
6F5k[k] SETINDEXt x - t'

Computes Tuple t' that differs from t only at position t'_{k+1}, which is set to x. 0 <= k <= 15 If k >= |t|, throws a range check exception.

26+|t|
F47EDICTUGETPREVi D n - x' i' -1 or 0Similar to DICTGETPREV, but interprets keys as unsigned n-bit integers.
F484DICTIMIND n - x i -1 or 0Similar to DICTMIN, but computes the minimal key i under the assumption that all keys are big-endian signed n-bit integers. Notice that the key and value returned may differ from those computed by DICTMIN and DICTUMIN.
6F89QTLENt - n or -1Similar to TLEN, but returns -1 if t is not a Tuple.26
FB08SENDMSGc x - feeCreates an output action and returns a fee for creating a message. Mode has the same effect as in the case of SENDRAWMSG. Additionally +1024 means - do not create an action, only estimate fee. Other modes affect the fee calculation as follows: +64 substitutes the entire balance of the incoming message as an outcoming value (slightly inaccurate, gas expenses that cannot be estimated before the computation is completed are not taken into account), +128 substitutes the value of the entire balance of the contract before the start of the computation phase (slightly inaccurate, since gas expenses that cannot be estimated before the completion of the computation phase are not taken into account).526
F436DICTUADDx i D n - D' -1 or D 0DICTADD, but with i an unsigned n-bit integer.
E308IFRETALTf -Performs RETALT if integer f!=0.26
F83401PREVKEYBLOCK- tRetrives prev_key_block part of PrevBlocksInfo from c7 (parameter 13).
A9B5tt[tt+1] MULRSHIFTR#x y - round(x*y/2^(tt+1))34
F414DICTISETx i D n - D'Similar to DICTSET, but with the key represented by a (big-endian) signed n-bit integer i. If i does not fit into n bits, a range check exception is generated.
F469DICTGETOPTREFk D n - c^?A variant of DICTGETREF that returns Null instead of the value c^? if the key k is absent from dictionary D.
BFCMPx y - sgn(x-y)

Computes the sign of x-y: -1 if x<y, 0 if x=y, 1 if x>y. No integer overflow can occur here unless x or y is a NaN.

18
F924RIST255_MULx n - x*nMultiplies point x by a scalar n. Any n is valid, including negative.2026
D720SDCUTFIRSTs l - s'Returns the first 0 <= l <= 1023 bits of s. It is equivalent to PLDSLICEX.26
D764SDEPTHs - xReturns the depth of Slice s. If s has no references, then x=0; otherwise x is one plus the maximum of depths of cells referred to from s.26
CF41STONESb n - b'Stores n binary ones into Builder b.26
F90600HASHEXTA_SHA256b s_1 ... s_n n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/33 gas per byte
F925RIST255_MULBASEn - g*nMultiplies the generator point g by a scalar n. Any n is valid, including negative.776
F840GETGLOBVARk - x

Returns the k-th global variable for 0 <= k < 255. Equivalent to c7 PUSHCTR SWAP INDEXVARQ.

26
F45ADICTIDELi D n - D' ?A version of DICTDEL with the key represented by a signed n-bit Integer i. If i does not fit into n bits, simply returns D 0 (''key not found, dictionary unmodified'').
D72E_xsss[slice] SDBEGINSQs - s'' -1 or s 0A quiet version of SDBEGINS.31
D732SCUTLASTs l r - s'Returns the last 0 <= l <= 1023 data bits and last 0 <= r <= 4 references of s.26
F467DICTUDELGETREFi D n - D' c -1 or D 0DICTDELGETREF, but with i an unsigned n-bit integer.
F407PLDDICTQs - D -1 or 0A quiet version of PLDDICT.26
F462DICTDELGETk D n - D' x -1 or D 0Deletes n-bit key, represented by a Slice k, from dictionary D. If the key is present, returns the modified dictionary D', the original value x associated with the key k (represented by a Slice), and the success flag -1. Otherwise, returns the original dictionary D and 0.
F83BGETGASFEESIMPLEgas_used is_mc - priceSame as GETGASFEE, but without flat price (just (gas_used * price) / 2^16).
A936tt[tt+1] RSHIFTC#x - ceil(x/2^(tt+1))34
C709SDPFXREVs s' - ?Checks whether s' is a prefix of s, equivalent to SWAP SDPFX.26
B7A8QMULx y - x*y26
B7A98CQMULDIVMODx y z - q r34
F478DICTIGETNEXTi D n - x' i' -1 or 0Similar to DICTGETNEXT, but interprets all keys in dictionary D as big-endian signed n-bit integers, and computes the minimal key i' that is larger than Integer i (which does not necessarily fit into n bits).
F412DICTSETx k D n - D'Sets the value associated with n-bit key k (represented by a Slice as in DICTGET) in dictionary D (also represented by a Slice) to value x (again a Slice), and returns the resulting dictionary as D'.
D751LDULE4s - x s'Loads a little-endian unsigned 32-bit integer.26
F413DICTSETREFc k D n - D'Similar to DICTSET, but with the value set to a reference to Cell c.
F437DICTUADDREFc i D n - D' -1 or D 0DICTADDREF, but with i an unsigned n-bit integer.
F835GLOBALID- iRetrieves global_id from 19 network config.
C713SDCNTTRAIL1s - nReturns the number of trailing ones in s.26
CF11STBREFb' b - b''Equivalent to SWAP STBREFR.526
DB35JMPXDATAc - Similar to CALLCC, but the remainder of the current continuation (the old value of cc) is converted into a Slice before pushing it into the stack of c.26
CF23ENDXCb x - c

If x!=0, creates a special or exotic cell from Builder b. The type of the exotic cell must be stored in the first 8 bits of b. If x=0, it is equivalent to ENDC. Otherwise some validity checks on the data and references of b are performed before creating the exotic cell.

526
A9D6tt[tt+1] LSHIFT#DIVCx y - ceil(2^(tt+1)*x/y)26
F90401HASHEXT_SHA512s_1 ... s_n n - h1 h2Calculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/16 gas per byte
F920RIST255_FROMHASHh1 h2 - xDeterministically generates a valid point x from a 512-bit hash (given as two 256-bit integers).626
F926RIST255_PUSHL- lPushes integer l=2^252+27742317777372353535851937790883648493, which is the order of the group.26
F923RIST255_SUBx y - x-ySubtraction of two points on curve.626
F485DICTIMINREFD n - c i -1 or 0Similar to DICTIMIN, but returns the only reference in the value.
D714_c[32(c+1)] PLDUZs - s xPreloads the first 32(c+1) bits of Slice s into an unsigned integer x, for 0 <= c <= 7. If s is shorter than necessary, missing bits are assumed to be zero. This operation is intended to be used along with IFBITJMP and similar instructions.26
F4BCDICTIGETJMPZi D n - i or nothingA variant of DICTIGETJMP that returns index i on failure.
F2CC_n[n] THROWARGx - x nnThrows exception 0 <= n < 2^11 with parameter x, by copying x and n into the stack of c2 and transferring control to c2.84
F435DICTIADDREFc i D n - D' -1 or D 0DICTADDREF, but with i a signed n-bit integer.
8Crxxssss[slice] PUSHSLICE [slice] SLICE- s

Pushes the slice slice into the stack. Details: Pushes the (prefix) subslice of cc.code consisting of its first 1 <= r+1 <= 4 references and up to first 8xx+1 bits of data, with 0 <= xx <= 31. A completion tag is also assumed.

25
F47BDICTIGETPREVEQi D n - x' i' -1 or 0Similar to DICTGETPREVEQ, but interprets keys as signed n-bit integers.
D71Dcc[cc+1] PLDSLICEs - s''Returns the first 0 < cc+1 <= 256 bits of s as s''.34
F451DICTADDBb k D n - D' -1 or D 0
A9D5tt[tt+1] LSHIFT#DIVRx y - round(2^(tt+1)*x/y)34
DB4fffflags RUNVMx_1 ... x_n n code [r] [c4] [c7] [g_l] [g_m] - x'_1 ... x'_m exitcode [data'] [c4'] [c5] [g_c]Runs child VM with code code and stack x_1...x_n. Returns the resulting stack x'_1...x'_m and exitcode. Other arguments and return values are enabled by flags.
A9BDMULRSHIFTR#MODx y - q=round(x*y/2^(tt+1)) r=xy-q*2^(tt+1)34
A9CDLSHIFTDIVMODRx y z - q=round(2^z*x/y) r=2^z*x-q*y26
A925RSHIFTRx y - round(x/2^y)26
B5cc[cc+1] UFITSx - xChecks whether x is a cc+1-bit unsigned integer for 0 <= cc <= 255 (i.e., whether 0 <= x < 2^(cc+1)).26/76
A905DIVRx y - q'q'=round(x/y), r'=x-y*q'26
B8SGNx - sgn(x)

Computes the sign of an integer x: -1 if x<0, 0 if x=0, 1 if x>0.

18
CF0Bcc[cc+1] STURb x - b'Equivalent to SWAP [cc+1] STU.34
D72A_xsss[slice] SDBEGINSs - s''Checks whether s begins with constant bitstring sss of length 8x+3 (with continuation bit assumed), where 0 <= x <= 127, and removes sss from s on success.31
C703SDFIRSTs - ?Checks whether the first bit of Slice s is a one.26
F921RIST255_VALIDATEx -Checks that integer x is a valid representation of some curve point. Throws range_chk on error.226
CF3DBCHKBITSQb x - ?Checks whether x bits can be stored into b, 0 <= x <= 1023.26
F475DICTGETNEXTEQk D n - x' k' -1 or 0Similar to DICTGETNEXT, but computes the minimal key k' that is lexicographically greater than or equal to k.
CF29STULE4x b - b'Stores a little-endian unsigned 32-bit integer.26
F459DICTDELk D n - D' -1 or D 0Deletes n-bit key, represented by a Slice k, from dictionary D. If the key is present, returns the modified dictionary D' and the success flag -1. Otherwise, returns the original dictionary D and 0.
F47DDICTUGETNEXTEQi D n - x' i' -1 or 0Similar to DICTGETNEXTEQ, but interprets keys as unsigned n-bit integers.
E309IFNOTRETALTf -Performs RETALT if integer f=0.26
D705LDUXQs l - x s' -1 or s 0Quiet version of LDUX.26
F48ADICTMAXD n - x k -1 or 0Computes the maximal key k (represented by a Slice with n data bits) in dictionary D, and returns k along with the associated value x.
CF0Acc[cc+1] STIRb x - b'Equivalent to SWAP [cc+1] STI.34
C710SDCNTLEAD0s - nReturns the number of leading zeroes in s.26
EBAGAINEND AGAIN:-Similar to AGAIN, but performed with respect to the current continuation cc.18
F442DICTISETBb i D n - D'
F424DICTIREPLACEx i D n - D' -1 or D 0DICTREPLACE, but with i a signed n-bit integer.
85xx[xx+1] PUSHNEGPOW2- -2^(xx+1)Pushes -2^(xx+1) for 0 <= xx <= 255.26
CF14STREFRb c - b'Equivalent to SWAP STREF.26
F93014BLS_G1_MULTIEXPx_1 s_1 ... x_n s_n n - x_1*s_1+...+x_n*s_nCalculates x_1*s_1+...+x_n*s_n for G1 points x_i and scalars s_i. Returns zero point if n=0. Any s_i is valid, including negative.11409+n*630+n/floor(max(log2(n),4))*8820
FA45REWRITESTDADDRQs - x y -1 or 0A quiet version of primitive REWRITESTDADDR.26
F914P256_CHKSIGNUh sig k - ?Checks seck256r1-signature sig of a number h (a 256-bit unsigned integer, usually computed as the hash of some data) and public key k. Returns -1 on success, 0 on failure. Public key is a 33-byte slice (encoded according to Sec. 2.3.4 point 2 of SECG SEC 1). Signature sig is a 64-byte slice (two 256-bit unsigned integers r and s).3526
ECrn[r] [n] SETCONTARGSx_1 x_2...x_r c - c'Pushes 0 <= r <= 15 values x_1...x_r into the stack of (a copy of) the continuation c, starting with x_1. When n is 15 (-1 in Fift notation), does nothing with c.nargs. For 0 <= n <= 14, sets c.nargs to the final size of the stack of c' plus n. In other words, transforms c into a closure or a partially applied function, with 0 <= n <= 14 arguments missing.26+s''
63BLKSWXPops integers i,j from the stack, then performs [i] [j] BLKSWAP.18
6F6k[k] INDEXQt - xReturns the k-th element of a Tuple t, where 0 <= k <= 15. In other words, returns x_{k+1} if t=(x_1,...,x_n). If k>=n, or if t is Null, returns a Null instead of x.26
D73AXLOADc - c'Loads an exotic cell c and returns an ordinary cell c'. If c is already ordinary, does nothing. If c cannot be loaded, throws an exception.
60PICK PUSHXPops integer i from the stack, then performs s[i] PUSH.18
61ROLLXPops integer i from the stack, then performs 1 [i] BLKSWAP.18
62-ROLLX ROLLREVXPops integer i from the stack, then performs [i] 1 BLKSWAP.18
5Fij[i] [j] BLKPUSH

Equivalent to PUSH s(j) performed i times. 1 <= i <= 15, 0 <= j <= 15.

26
64REVXPops integers i,j from the stack, then performs [i] [j] REVERSE.18
65DROPXPops integer i from the stack, then performs [i] BLKDROP.18
67XCHGXPops integer i from the stack, then performs s[i] XCHG.18
68DEPTH- depthPushes the current depth of the stack.18
69CHKDEPTHi -Pops integer i from the stack, then checks whether there are at least i elements, generating a stack underflow exception otherwise.18/58
6AONLYTOPXPops integer i from the stack, then removes all but the top i elements.18
6BONLYXPops integer i from the stack, then leaves only the bottom i elements. Approximately equivalent to DEPTH SWAP SUB DROPX.18
EAAGAINc - Similar to REPEAT, but executes c infinitely many times. A RET only begins a new iteration of the infinite loop, which can be exited only by an exception, or a RETALT (or an explicit JMPX).18
E31AAGAINBRKc -Similar to AGAIN, but also modifies c1 in the same way as REPEATBRK.26
E31BAGAINENDBRK AGAINBRK:-Equivalent to SAMEALTSAVE AGAINEND.26
A900ADDDIVMODx w z - q=floor((x+w)/z) r=(x+w)-zq26
A901ADDDIVMODRx w z - q=round((x+w)/z) r=(x+w)-zq26
A902ADDDIVMODCx w y - q=ceil((x+w)/z) r=(x+w)-zq26
A930tt[tt+1] ADDRSHIFT#MODx w - q=floor((x+w)/2^(tt+1)) r=(x+w)-q*2^(tt+1)34
A921ADDRSHIFTMODRx w z - q=round((x+w)/2^z) r=(x+w)-q*2^z26
A922ADDRSHIFTMODCx w z - q=ceil((x+w)/2^z) r=(x+w)-q*2^z26
A90DDIVMODRx y - q' r'26
A90EDIVMODCx y - q'' r''26
6FBij[i] [j] INDEX2t - x

Recovers x=(t_{i+1})_{j+1} for 0 <= i,j <= 3. Equivalent to [i] INDEX [j] INDEX.

26
6FE_ijk[i] [j] [k] INDEX3t - x

Recovers x=t_{i+1}_{j+1}_{k+1}. 0 <= i,j,k <= 3 Equivalent to [i] [j] INDEX2 [k] INDEX.

26
6F8AISTUPLEt - ?Returns -1 or 0 depending on whether t is a Tuple.26
540ijks[i] s[j] s[k] XCHG3_lLong form of XCHG3.34
6F3k[k] UNPACKFIRSTt - x_1 ... x_k

Unpacks first 0 <= k <= 15 elements of a Tuple t. If |t|<k, throws a type check exception.

26+k
6F4n[n] EXPLODEt - x_1 ... x_m mUnpacks a Tuple t=(x_1,...,x_m) and returns its length m, but only if m <= n <= 15. Otherwise throws a type check exception.26+m
6F7k[k] SETINDEXQt x - t'

Sets the k-th component of Tuple t to x, where 0 <= k < 16, and returns the resulting Tuple t'. If |t| <= k, first extends the original Tuple to length n'=k+1 by setting all new components to Null. If the original value of t is Null, treats it as an empty Tuple. If t is not Null or Tuple, throws an exception. If x is Null and either |t| <= k or t is Null, then always returns t'=t (and does not consume tuple creation gas).

26+|t'|
6F80TUPLEVARx_1 ... x_n n - tCreates a new Tuple t of length n similarly to TUPLE, but with 0 <= n <= 255 taken from the stack.26+n
6F82UNTUPLEVARt n - x_1 ... x_nSimilar to n UNTUPLE, but with 0 <= n <= 255 taken from the stack.26+n
6F83UNPACKFIRSTVARt n - x_1 ... x_nSimilar to n UNPACKFIRST, but with 0 <= n <= 255 taken from the stack.26+n
6F86INDEXVARQt k - xSimilar to n INDEXQ, but with 0 <= k <= 254 taken from the stack.26
6F87SETINDEXVARQt x k - t'Similar to k SETINDEXQ, but with 0 <= k <= 254 taken from the stack.26+|t'|
6F8BLASTt - xReturns the last element of a non-empty Tuple t.26
6FA0NULLSWAPIFx - x or null xPushes a Null under the topmost Integer x, but only if x!=0.26
6FA2NULLROTRIFx y - x y or null x yPushes a Null under the second stack entry from the top, but only if the topmost Integer y is non-zero.26
6FA3NULLROTRIFNOTx y - x y or null x yPushes a Null under the second stack entry from the top, but only if the topmost Integer y is zero. May be used for stack alignment after quiet primitives such as LDUXQ.26
6FA4NULLSWAPIF2x - x or null null x

Pushes two nulls under the topmost Integer x, but only if x!=0. Equivalent to NULLSWAPIF NULLSWAPIF.

26
6FA6NULLROTRIF2x y - x y or null null x y

Pushes two nulls under the second stack entry from the top, but only if the topmost Integer y is non-zero. Equivalent to NULLROTRIF NULLROTRIF.

26
6FA7NULLROTRIFNOT2x y - x y or null null x y

Pushes two nulls under the second stack entry from the top, but only if the topmost Integer y is zero. Equivalent to NULLROTRIFNOT NULLROTRIFNOT.

26
A2SUBRx y - y-xEquivalent to SWAP SUB.18
A909MODRx y - r26
A90AMODCx y - r26
A926RSHIFTCx y - ceil(x/2^y)26
A928MODPOW2x y - x mod 2^y26
A929MODPOW2Rx y - x mod 2^y26
A92AMODPOW2Cx y - x mod 2^y26
A92CRSHIFTMODx y - q=floor(x/2^y) r=x-q*2^y26
A92DRSHIFTMODRx y - q=round(x/2^y) r=x-q*2^y26
A92ERSHIFTMODCx y - q=ceil(x/2^y) r=x-q*2^y26
A931tt[tt+1] ADDRSHIFTR#MODx w - q=round((x+w)/2^(tt+1)) r=(x+w)-q*2^(tt+1)34
A932tt[tt+1] ADDRSHIFTC#MODx w - q=round((x+w)/2^(tt+1)) r=(x+w)-q*2^(tt+1)34
EDF3ATEXITc - Sets c0 to compose0(c, c0). In other words, c will be executed before exiting current subroutine.26
EDF4ATEXITALTc - Sets c1 to compose1(c, c1). In other words, c will be executed before exiting current subroutine by its alternative return path.26
CF33BBITREFSb - x yReturns the numbers of both data bits and cell references in b.26
CF3BBCHKBITREFSb x y - Checks whether x bits and y references can be stored into b, 0 <= x <= 1023, 0 <= y <= 7.26/76
CF3FBCHKBITREFSQb x y - ?Checks whether x bits and y references can be stored into b, 0 <= x <= 1023, 0 <= y <= 7.26
CF38cc[cc+1] BCHKBITS#b -Checks whether cc+1 bits can be stored into b, where 0 <= cc <= 255.34/84
CF3Ccc[cc+1] BCHKBITSQ#b - ?Checks whether cc+1 bits can be stored into b, where 0 <= cc <= 255.34
CF39BCHKBITSb x - Checks whether x bits can be stored into b, 0 <= x <= 1023. If there is no space for x more bits in b, or if x is not within the range 0...1023, throws an exception.26/76
CF3ABCHKREFSb y - Checks whether y references can be stored into b, 0 <= y <= 7.26/76
CF3EBCHKREFSQb y - ?Checks whether y references can be stored into b, 0 <= y <= 7.26
CF30BDEPTHb - xReturns the depth of Builder b. If no cell references are stored in b, then x=0; otherwise x is one plus the maximum of depths of cells referred to from b.26
B602BITSIZEx - cComputes smallest c >= 0 such that x fits into a c-bit signed integer (-2^(c-1) <= c < 2^(c-1)).26
EErn[r] [n] BLESSARGSx_1...x_r s - c

0 <= r <= 15, -1 <= n <= 14 Equivalent to BLESS [r] [n] SETCONTARGS. The value of n is represented inside the instruction by the 4-bit integer n mod 16.

26
ED1FBLESSVARARGSx_1...x_r s r n - cEquivalent to ROT BLESS ROTREV SETCONTVARARGS.26+s''
F93001BLS_AGGREGATEsig_1 ... sig_n n - sigAggregates signatures. n>0. Throw exception if n=0 or if some sig_i is not a valid signature.n*4350-2616
F93003BLS_AGGREGATEVERIFYpk_1 msg_1 ... pk_n msg_n n sgn - boolChecks aggregated BLS signature for key-message pairs pk_1 msg_1...pk_n msg_n. Return true on success, false otherwise. Return false if n=0.38534+n*22500
F93002BLS_FASTAGGREGATEVERIFYpk_1 ... pk_n n msg sig - boolChecks aggregated BLS signature for keys pk_1...pk_n and message msg. Return true on success, false otherwise. Return false if n=0.58034+n*3000
F93017BLS_G1_INGROUPx - boolChecks that slice x represents a valid element of G1.2984
F93018BLS_G1_ISZEROx - boolChecks that G1 point x is equal to zero.34
F93011BLS_G1_SUBx y - x-ySubtraction on G1.3934
F93015BLS_G1_ZERO- zeroPushes zero point in G1.34
F93020BLS_G2_ADDx y - x+yAddition on G2.6134
F93027BLS_G2_INGROUPx - boolChecks that slice x represents a valid element of G2.4284
F93028BLS_G2_ISZEROx - boolChecks that G2 point x is equal to zero.34
F93023BLS_G2_MULx s - x*sMultiplies G2 point x by scalar s. Any s is valid, including negative.10584
F93024BLS_G2_MULTIEXPx_1 s_1 ... x_n s_n n - x_1*s_1+...+x_n*s_nCalculates x_1*s_1+...+x_n*s_n for G2 points x_i and scalars s_i. Returns zero point if n=0. Any s_i is valid, including negative.30422+n*1280+n/floor(max(log2(n),4))*22840
F93022BLS_G2_NEGx - -xNegation on G2.1584
F93021BLS_G2_SUBx y - x-ySubtraction on G2.6134
F93025BLS_G2_ZERO- zeroPushes zero point in G2.34
F93016BLS_MAP_TO_G1f - xConverts FP element f to a G1 point.2384
F93026BLS_MAP_TO_G2f - xConverts FP2 element f to a G2 point.7984
F93031BLS_PUSHR- rPushes the order of G1 and G2 (approx. 2^255).34
F93000BLS_VERIFYpk msg sgn - boolChecks BLS signature, return true on success, false otherwise.61034
EDF9BOOLEVALc - ?Performs cc:=compose1(compose0(c, compose0(-1 PUSHINT, cc)), compose0(0 PUSHINT, cc)). If c represents a boolean circuit, the net effect is to evaluate it and push either -1 or 0 into the stack before continuing.26
DB32BRANCH RETBOOLf - Performs RETTRUE if integer f!=0, or RETFALSE if f=0.26
CF32BREFSb - yReturns the number of cell references already stored in b.26
CF37BREMBITREFSb - x' y'Returns the numbers of both data bits and references that can still be stored in b.26
CF35BREMBITSb - x'Returns the number of data bits that can still be stored in b.26
CF36BREMREFSb - y'Returns the number of references that can still be stored in b.26
DB34CALLCCc - Call with current continuation, transfers control to c, pushing the old value of cc into c's stack (instead of discarding it or writing it into new c0).26
DB36pr[p] [r] CALLCCARGSc - Similar to CALLXARGS, but pushes the old value of cc (along with the top 0 <= p <= 15 values from the original stack) into the stack of newly-invoked continuation c, setting cc.nargs to -1 <= r <= 14.34
DB3BCALLCCVARARGSc p r - Similar to CALLCCARGS.26
DB38CALLXVARARGSc p r - Similar to CALLXARGS, but takes -1 <= p,r <= 254 from the stack. The next three operations also take p and r from the stack, both in the range -1...254.26
D76E_[i] CDEPTHIcell - depthReturns ith depth of the cell.26
D771CDEPTHIXcell i - depthReturns ith depth of the cell.26
FB07CHANGELIBh x - Creates an output action similarly to SETLIBCODE, but instead of the library code accepts its hash as an unsigned 256-bit integer h. If x!=0 and the library with hash h is absent from the library collection of this smart contract, this output action will fail.526
D76A_[i] CHASHIcell - hashReturns ith hash of the cell.26
D770CHASHIXcell i - hashReturns ith hash of the cell.26
C5CHKNANx - xThrows an arithmetic overflow exception if x is a NaN.18/68
D766CLEVELcell - levelReturns level of the cell.26
D767CLEVELMASKcell - level_maskReturns level mask of the cell.26
EDF0COMPOS BOOLANDc c' - c''Computes the composition compose0(c, c'), which has the meaning of ''perform c, and, if successful, perform c''' (if c is a boolean circuit) or simply ''perform c, then c'''. Equivalent to SWAP c0 SETCONT.26
EDF2COMPOSBOTHc c' - c''Computes composition compose1(compose0(c, c'), c'), which has the meaning of ''compute boolean circuit c, then compute c', regardless of the result of c''.26
E304CONDSELf x y - x or yIf integer f is non-zero, returns x, otherwise returns y. Notice that no type checks are performed on x and y; as such, it is more like a conditional stack operation. Roughly equivalent to ROT ISZERO INC ROLLX NIP.26
E305CONDSELCHKf x y - x or ySame as CONDSEL, but first checks whether x and y have the same type.26
F830CONFIGDICT - D 32

Returns the global configuration dictionary along with its key length (32). Equivalent to CONFIGROOT 32 PUSHINT.

26
F832CONFIGPARAMi - c -1 or 0

Returns the value of the global configuration parameter with integer index i as a Cell c, and a flag to indicate success. Equivalent to CONFIGDICT DICTIGETREF.

FEFnssss{string} DEBUGSTR {string} {x} DEBUGSTRI-

0 <= n < 16. Length of ssss is n+1 bytes. {string} is a string literal. DEBUGSTR: ssss is the given string. DEBUGSTRI: ssss is one-byte integer 0 <= x <= 255 followed by the given string.

26
F432DICTADDx k D n - D' -1 or D 0An Add counterpart of DICTSET: sets the value associated with key k in dictionary D to x, but only if it is not already present in D.
F43ADICTADDGETx k D n - D' -1 or D y 0An Add counterpart of DICTSETGET: sets the value associated with key k in dictionary D to x, but only if key k is not already present in D. Otherwise, just returns the old value y without changing the dictionary.
F455DICTADDGETBb k D n - D' -1 or D y 0
F43BDICTADDGETREFc k D n - D' -1 or D c' 0An Add counterpart of DICTSETGETREF.
F433DICTADDREFc k D n - D' -1 or D 0An Add counterpart of DICTSETREF.
F463DICTDELGETREFk D n - D' c -1 or D 0Similar to DICTDELGET, but with LDREF ENDS applied to x on success, so that the value returned c is a Cell.
F474DICTGETNEXTk D n - x' k' -1 or 0Computes the minimal key k' in dictionary D that is lexicographically greater than k, and returns k' (represented by a Slice) along with associated value x' (also represented by a Slice).
F476DICTGETPREVk D n - x' k' -1 or 0Similar to DICTGETNEXT, but computes the maximal key k' lexicographically smaller than k.
F477DICTGETPREVEQk D n - x' k' -1 or 0Similar to DICTGETPREV, but computes the maximal key k' lexicographically smaller than or equal to k.
F434DICTIADDx i D n - D' -1 or D 0DICTADD, but with i a signed n-bit integer.
F452DICTIADDBb i D n - D' -1 or D 0
F43CDICTIADDGETx i D n - D' -1 or D y 0DICTADDGET, but with i a signed n-bit integer.
F456DICTIADDGETBb i D n - D' -1 or D y 0
F43DDICTIADDGETREFc i D n - D' -1 or D c' 0DICTADDGETREF, but with i a signed n-bit integer.
F464DICTIDELGETi D n - D' x -1 or D 0DICTDELGET, but with i a signed n-bit integer.
F465DICTIDELGETREFi D n - D' c -1 or D 0DICTDELGETREF, but with i a signed n-bit integer.
F4A2DICTIGETEXECi D n - Similar to DICTIGETJMP, but with EXECUTE instead of JMPX.
F4BEDICTIGETEXECZi D n - i or nothingA variant of DICTIGETEXEC that returns index i on failure.
F479DICTIGETNEXTEQi D n - x' i' -1 or 0Similar to DICTGETNEXTEQ, but interprets keys as signed n-bit integers.
F48CDICTIMAXD n - x i -1 or 0Similar to DICTMAX, but computes the maximal key i under the assumption that all keys are big-endian signed n-bit integers. Notice that the key and value returned may differ from those computed by DICTMAX and DICTUMAX.
F48DDICTIMAXREFD n - c i -1 or 0Similar to DICTIMAX, but returns the only reference in the value.
F49CDICTIREMMAXD n - D' x i -1 or D 0Similar to DICTREMMAX, but computes the minimal key i under the assumption that all keys are big-endian signed n-bit integers. Notice that the key and value returned may differ from those computed by DICTREMMAX and DICTUREMMAX.
F49DDICTIREMMAXREFD n - D' c i -1 or D 0Similar to DICTIREMMAX, but returns the only reference in the value.
F494DICTIREMMIND n - D' x i -1 or D 0Similar to DICTREMMIN, but computes the minimal key i under the assumption that all keys are big-endian signed n-bit integers. Notice that the key and value returned may differ from those computed by DICTREMMIN and DICTUREMMIN.
F495DICTIREMMINREFD n - D' c i -1 or D 0Similar to DICTIREMMIN, but returns the only reference in the value.
F44ADICTIREPLACEBb i D n - D' -1 or D 0
F42CDICTIREPLACEGETx i D n - D' y -1 or D 0DICTREPLACEGET, but with i a signed n-bit integer.
F44EDICTIREPLACEGETBb i D n - D' y -1 or D 0
F42DDICTIREPLACEGETREFc i D n - D' c' -1 or D 0DICTREPLACEGETREF, but with i a signed n-bit integer.
F425DICTIREPLACEREFc i D n - D' -1 or D 0DICTREPLACEREF, but with i a signed n-bit integer.
F41CDICTISETGETx i D n - D' y -1 or D' 0DICTISETGET, but with i a signed n-bit integer.
F446DICTISETGETBb i D n - D' y -1 or D' 0
F46EDICTISETGETOPTREFc^? i D n - D' ~c^?Similar to primitive DICTSETGETOPTREF, but using signed n-bit Integer i as a key. If i does not fit into n bits, throws a range checking exception.
F41DDICTISETGETREFc i D n - D' c' -1 or D' 0DICTISETGETREF, but with i a signed n-bit integer.
F48BDICTMAXREFD n - c k -1 or 0Similar to DICTMAX, but returns the only reference in the value.
F483DICTMINREFD n - c k -1 or 0Similar to DICTMIN, but returns the only reference in the value as a Cell c.
F49ADICTREMMAXD n - D' x k -1 or D 0Computes the maximal key k (represented by a Slice with n data bits) in dictionary D, removes k from the dictionary, and returns k along with the associated value x and the modified dictionary D'.
F49BDICTREMMAXREFD n - D' c k -1 or D 0Similar to DICTREMMAX, but returns the only reference in the value as a Cell c.
F492DICTREMMIND n - D' x k -1 or D 0Computes the minimal key k (represented by a Slice with n data bits) in dictionary D, removes k from the dictionary, and returns k along with the associated value x and the modified dictionary D'.
F493DICTREMMINREFD n - D' c k -1 or D 0Similar to DICTREMMIN, but returns the only reference in the value as a Cell c.
F422DICTREPLACEx k D n - D' -1 or D 0A Replace operation, which is similar to DICTSET, but sets the value of key k in dictionary D to x only if the key k was already present in D.
F449DICTREPLACEBb k D n - D' -1 or D 0
F42ADICTREPLACEGETx k D n - D' y -1 or D 0A Replace counterpart of DICTSETGET: on success, also returns the old value associated with the key in question.
F44DDICTREPLACEGETBb k D n - D' y -1 or D 0
F42BDICTREPLACEGETREFc k D n - D' c' -1 or D 0A Replace counterpart of DICTSETGETREF.
F423DICTREPLACEREFc k D n - D' -1 or D 0A Replace counterpart of DICTSETREF.
F41ADICTSETGETx k D n - D' y -1 or D' 0Combines DICTSET with DICTGET: it sets the value corresponding to key k to x, but also returns the old value y associated with the key in question, if present.
F445DICTSETGETBb k D n - D' y -1 or D' 0
F46DDICTSETGETOPTREFc^? k D n - D' ~c^?A variant of both DICTGETOPTREF and DICTSETGETREF that sets the value corresponding to key k in dictionary D to c^? (if c^? is Null, then the key is deleted instead), and returns the old value ~c^? (if the key k was absent before, returns Null instead).
F41BDICTSETGETREFc k D n - D' c' -1 or D' 0Combines DICTSETREF with DICTGETREF similarly to DICTSETGET.
F43EDICTUADDGETx i D n - D' -1 or D y 0DICTADDGET, but with i an unsigned n-bit integer.
F457DICTUADDGETBb i D n - D' -1 or D y 0
F43FDICTUADDGETREFc i D n - D' -1 or D c' 0DICTADDGETREF, but with i an unsigned n-bit integer.
F4A3DICTUGETEXECi D n - Similar to DICTUGETJMP, but with EXECUTE instead of JMPX.
F4BFDICTUGETEXECZi D n - i or nothingA variant of DICTUGETEXEC that returns index i on failure.
F4BDDICTUGETJMPZi D n - i or nothingA variant of DICTUGETJMP that returns index i on failure.
F49EDICTUREMMAXD n - D' x i -1 or D 0Similar to DICTREMMAX, but returns the key as an unsigned n-bit Integer i.
F49FDICTUREMMAXREFD n - D' c i -1 or D 0Similar to DICTUREMMAX, but returns the only reference in the value.
F426DICTUREPLACEx i D n - D' -1 or D 0DICTREPLACE, but with i an unsigned n-bit integer.
F42EDICTUREPLACEGETx i D n - D' y -1 or D 0DICTREPLACEGET, but with i an unsigned n-bit integer.
F44FDICTUREPLACEGETBb i D n - D' y -1 or D 0
F42FDICTUREPLACEGETREFc i D n - D' c' -1 or D 0DICTREPLACEGETREF, but with i an unsigned n-bit integer.
F427DICTUREPLACEREFc i D n - D' -1 or D 0DICTREPLACEREF, but with i an unsigned n-bit integer.
F447DICTUSETGETBb i D n - D' y -1 or D' 0
F46FDICTUSETGETOPTREFc^? i D n - D' ~c^?Similar to primitive DICTSETGETOPTREF, but using unsigned n-bit Integer i as a key.
F41FDICTUSETGETREFc i D n - D' c' -1 or D' 0DICTISETGETREF, but with i an unsigned n-bit integer.
B4cc[cc+1] FITSx - x

Checks whether x is a cc+1-bit signed integer for 0 <= cc <= 255 (i.e., whether -2^cc <= x < 2^cc). If not, either triggers an integer overflow exception, or replaces x with a NaN (quiet version).

26/76
B600FITSXx c - xChecks whether x is a c-bit signed integer for 0 <= c <= 1023.26/76
F90702HASHEXTAR_BLAKE2Bb s_n ... s_1 n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/19 gas per byte
F90703HASHEXTAR_KECCAK256b s_n ... s_1 n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/11 gas per byte
F90704HASHEXTAR_KECCAK512b s_n ... s_1 n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/6 gas per byte
F90700HASHEXTAR_SHA256b s_1 ... s_n n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/33 gas per byte
F90701HASHEXTAR_SHA512b s_n ... s_1 n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/16 gas per byte
F90602HASHEXTA_BLAKE2Bb s_1 ... s_n n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/19 gas per byte
F90603HASHEXTA_KECCAK256b s_1 ... s_n n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/11 gas per byte
F90604HASHEXTA_KECCAK512b s_1 ... s_n n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/6 gas per byte
F90601HASHEXTA_SHA512b s_1 ... s_n n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/16 gas per byte
F90502HASHEXTR_BLAKE2Bs_n ... s_1 n - h1 h2Calculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/19 gas per byte
F90503HASHEXTR_KECCAK256s_n ... s_1 n - hCalculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/11 gas per byte
F90504HASHEXTR_KECCAK512s_n ... s_1 n - h1 h2Calculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/19 gas per byte
F90500HASHEXTR_SHA256s_n ... s_1 n - hCalculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/33 gas per byte
F90501HASHEXTR_SHA512s_n ... s_1 n - h1 h2Calculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/16 gas per byte
F90402HASHEXT_BLAKE2Bs_1 ... s_n n - h1 h2Calculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/19 gas per byte
F90404HASHEXT_KECCAK512s_1 ... s_n n - h1 h2Calculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/19 gas per byte
E39_n[n] IFBITJMPx c - xChecks whether bit 0 <= n <= 31 is set in integer x, and if so, performs JMPX to continuation c. Value x is left in the stack.26
E3D_n[ref] [n] IFBITJMPREFx - xPerforms a JMPREF if bit 0 <= n <= 31 is set in integer x.126/51
E3B_n[n] IFNBITJMPx c - xJumps to c if bit 0 <= n <= 31 is not set in integer x.26
E3F_n[ref] [n] IFNBITJMPREFx - xPerforms a JMPREF if bit 0 <= n <= 31 is not set in integer x.126/51
EDF8INVERT-Interchanges c0 and c1.26
F16_n[n] JMP - n

Jumps to the continuation in c3, pushing integer 0 <= n < 2^14 as its argument. Approximately equivalent to n PUSHINT c3 PUSHCTR JMPX.

DB3D[ref] JMPREFEquivalent to PUSHREFCONT JMPX.126/51
DB3E[ref] JMPREFDATAEquivalent to PUSHREFCONT JMPXDATA.126/51
DB1p[p] JMPXARGSc - Jumps to continuation c, passing only the top 0 <= p <= 15 values from the current stack to it (the remainder of the current stack is discarded).26
DB3AJMPXVARARGSc p r - Similar to JMPXARGS.26
F406LDDICTQs - D s' -1 or s 0A quiet version of LDDICT.26
F402LDDICTSs - s' s''

Loads (parses) a (Slice-represented) dictionary s' from Slice s, and returns the remainder of s as s''. This is a ''split function'' for all HashmapE(n,X) dictionary types.

26
D750LDILE4s - x s'Loads a little-endian signed 32-bit integer.26
D758LDILE4Qs - x s' -1 or s 0Quietly loads a little-endian signed 32-bit integer.26
D752LDILE8s - x s'Loads a little-endian signed 64-bit integer.26
D75ALDILE8Qs - x s' -1 or s 0Quietly loads a little-endian signed 64-bit integer.26
D70Ccc[cc+1] LDIQs - x s' -1 or s 0A quiet version of LDI.34
D704LDIXQs l - x s' -1 or s 0Quiet version of LDIX: loads a signed l-bit integer from s similarly to LDIX, but returns a success flag, equal to -1 on success or to 0 on failure (if s does not have l bits), instead of throwing a cell underflow exception.26
D708cc[cc+1] LDI_ls - x s'A longer encoding for LDI.34
D761LDONESs - n s'Returns the count n of leading one bits in s, and removes these bits from s.26
D762LDSAMEs x - n s'Returns the count n of leading bits equal to 0 <= x <= 1 in s, and removes these bits from s.26
D71Ecc[cc+1] LDSLICEQs - s'' s' -1 or s 0A quiet version of LDSLICE.34
D71ALDSLICEXQs l - s'' s' -1 or s 0A quiet version of LDSLICEX.26
D71Ccc[cc+1] LDSLICE_ls - s'' s'A longer encoding for LDSLICE.34
D759LDULE4Qs - x s' -1 or s 0Quietly loads a little-endian unsigned 32-bit integer.26
D753LDULE8s - x s'Loads a little-endian unsigned 64-bit integer.26
D75BLDULE8Qs - x s' -1 or s 0Quietly loads a little-endian unsigned 64-bit integer.26
D70Dcc[cc+1] LDUQs - x s' -1 or s 0A quiet version of LDU.34
D709cc[cc+1] LDU_ls - x s'A longer encoding for LDU.34
FA05LDVARINT32s - x s'

Similar to LDVARUINT32, but loads a signed Integer x. Approximately equivalent to 5 LDU SWAP 3 LSHIFT# LDIX.

26
FA04LDVARUINT32s - x s'

Loads (deserializes) a VarUInteger 32 amount from Slice s, and returns the amount as Integer x along with the remainder s' of s. The expected serialization of x consists of a 5-bit unsigned big-endian integer l, followed by an 8l-bit unsigned big-endian representation of x. The net effect is approximately equivalent to 4 LDU SWAP 3 LSHIFT# LDUX.

26
D760LDZEROESs - n s'Returns the count n of leading zero bits in s, and removes these bits from s.26
A9D0tt[tt+1] LSHIFT#ADDDIVMODx w z - q=floor((x*2^y+w)/z) r=(x*2^y+w)-zq34
A9D2tt[tt+1] LSHIFT#ADDDIVMODCx w z - q=ceil((x*2^y+w)/z) r=(x*2^y+w)-zq34
A9C2LSHIFTADDDIVMODCx w z y - q=round((x*2^y+w)/z) r=(x*2^y+w)-zq26
A9D1tt[tt+1] LSHIFT#ADDDIVMODRx w z - q=round((x*2^y+w)/z) r=(x*2^y+w)-zq34
A9C1LSHIFTADDDIVMODRx w z y - q=round((x*2^y+w)/z) r=(x*2^y+w)-zq26
A9C0LSHIFTADDDIVMODx w z y - q=floor((x*2^y+w)/z) r=(x*2^y+w)-zq26
A9D4tt[tt+1] LSHIFT#DIVx y - floor(2^(tt+1)*x/y)34
A9C6LSHIFTDIVCx y z - ceil(2^z*x/y)0 <= z <= 25626
A9DCtt[tt+1] LSHIFT#DIVMODx y - q=floor(2^(tt+1)*x/y) r=2^(tt+1)*x-q*y34
A9DEtt[tt+1] LSHIFT#DIVMODCx y - q=ceil(2^(tt+1)*x/y) r=2^(tt+1)*x-q*y34
A9CELSHIFTDIVMODCx y z - q=ceil(2^z*x/y) r=2^z*x-q*y26
A9DDtt[tt+1] LSHIFT#DIVMODRx y - q=round(2^(tt+1)*x/y) r=2^(tt+1)*x-q*y34
A9CCLSHIFTDIVMODx y z - q=floor(2^z*x/y) r=2^z*x-q*y26
A9C5LSHIFTDIVRx y z - round(2^z*x/y)0 <= z <= 25626
A9C4LSHIFTDIVx y z - floor(2^z*x/y)0 <= z <= 25626
A9D8tt[tt+1] LSHIFT#MODx y - 2^(tt+1)*x mod y34
A9DAtt[tt+1] LSHIFT#MODCx y - 2^(tt+1)*x mod y34
A9CALSHIFTMODCx y z - 2^z*x mod y26
A9D9tt[tt+1] LSHIFT#MODRx y - 2^(tt+1)*x mod y34
A9C9LSHIFTMODRx y z - 2^z*x mod y26
A9C8LSHIFTMODx y z - 2^z*x mod y26
B60AMINMAX INTSORT2x y - x y or y xSorts two integers. Quiet version of this operation returns two NaNs if any of the arguments are NaNs.26
A93Att[tt+1] MODPOW2C#x - x mod 2^(tt+1)34
A939tt[tt+1] MODPOW2R#x - x mod 2^(tt+1)34
A980MULADDDIVMODx y w z - q=floor((xy+w)/z) r=(xy+w)-zq26
A982MULADDDIVMODCx y w z - q=ceil((xy+w)/z) r=(xy+w)-zq26
A981MULADDDIVMODRx y w z - q=round((xy+w)/z) r=(xy+w)-zq26
A9B2tt[tt+1] MULADDRSHIFTC#MODx y w - q=ceil((xy+w)/2^z) r=(xy+w)-q*2^z34
A9B0tt[tt+1] MULADDRSHIFT#MODx y w - q=floor((xy+w)/2^z) r=(xy+w)-q*2^z34
A9B1tt[tt+1] MULADDRSHIFTR#MODx y w - q=round((xy+w)/2^z) r=(xy+w)-q*2^z34
A98EMULDIVMODCx y z - q rq=ceil(x*y/z), r=x*y-z*q26
A98DMULDIVMODRx y z - q rq=round(x*y/z), r=x*y-z*q26
A988MULMODx y z - x*y mod z26
A98AMULMODCx y z - x*y mod z26
A9B8tt[tt+1] MULMODPOW2#x y - x*y mod 2^(tt+1)34
A9BAtt[tt+1] MULMODPOW2C#x y - x*y mod 2^(tt+1)34
A9AAMULMODPOW2C_VARx y z - x*y mod 2^z26
A9B9tt[tt+1] MULMODPOW2R#x y - x*y mod 2^(tt+1)34
A9A9MULMODPOW2R_VARx y z - x*y mod 2^z26
A9A8MULMODPOW2_VARx y z - x*y mod 2^z26
A989MULMODRx y z - x*y mod z26
A9B6tt[tt+1] MULRSHIFTC#x y - ceil(x*y/2^(tt+1))34
A9BEMULRSHIFTC#MODx y - q=ceil(x*y/2^(tt+1)) r=xy-q*2^(tt+1)34
A9AEMULRSHIFTCMOD_VARx y z - q=ceil(x*y/2^z) r=xy-q*2^z26
A9A6MULRSHIFTCx y z - ceil(x*y/2^z)0 <= z <= 25626
A9BCMULRSHIFT#MODx y - q=floor(x*y/2^(tt+1)) r=xy-q*2^(tt+1)34
A9ACMULRSHIFTMOD_VARx y z - q=floor(x*y/2^z) r=xy-q*2^z26
A9ADMULRSHIFTRMOD_VARx y z - q=round(x*y/2^z) r=xy-q*2^z26
A9A5MULRSHIFTRx y z - round(x*y/2^z)0 <= z <= 25626
A9A4MULRSHIFTx y z - floor(x*y/2^z)0 <= z <= 25626
F915P256_CHKSIGNSd sig k - ?Checks seck256r1-signature sig of data portion of slice d and public key k. Returns -1 on success, 0 on failure. Public key is a 33-byte slice (encoded according to Sec. 2.3.4 point 2 of SECG SEC 1). Signature sig is a 64-byte slice (two 256-bit unsigned integers r and s).3526
FA43PARSEMSGADDRQs - t -1 or 0A quiet version of PARSEMSGADDR: returns a zero on error instead of throwing an exception.26
F472PFXDICTADDx k D n - D' -1 or D 0
F4AE_n[ref] [n] PFXDICTCONSTGETJMP [ref] [n] PFXDICTSWITCHs - s' s'' or sCombines [n] DICTPUSHCONST for 0 <= n <= 1023 with PFXDICTGETJMP.
F473PFXDICTDELk D n - D' -1 or D 0
F4A9PFXDICTGETs D n - s' x s''Similar to PFXDICTGET, but throws a cell deserialization failure exception on failure.
F4ABPFXDICTGETEXECs D n - s' s''Similar to PFXDICTGETJMP, but EXECutes the continuation found instead of jumping to it. On failure, throws a cell deserialization exception.
F4AAPFXDICTGETJMPs D n - s' s'' or sSimilar to PFXDICTGETQ, but on success BLESSes the value x into a Continuation and transfers control to it as if by a JMPX. On failure, returns s unchanged and continues execution.
F471PFXDICTREPLACEx k D n - D' -1 or D 0
F403PLDDICTSs - s'

Preloads a (Slice-represented) dictionary s' from Slice s. Approximately equivalent to LDDICTS DROP.

26
D754PLDILE4s - xPreloads a little-endian signed 32-bit integer.26
D75CPLDILE4Qs - x -1 or 0Quietly preloads a little-endian signed 32-bit integer.26
D756PLDILE8s - xPreloads a little-endian signed 64-bit integer.26
D75EPLDILE8Qs - x -1 or 0Quietly preloads a little-endian signed 64-bit integer.26
D70Ecc[cc+1] PLDIQs - x -1 or 0A quiet version of PLDI.34
D702PLDIXs l - xPreloads a signed l-bit integer from Slice s, for 0 <= l <= 257.26
D706PLDIXQs l - x -1 or 0Quiet version of PLDIX.26
D748PLDREFVARs n - cReturns the n-th cell reference of Slice s for 0 <= n <= 3.26
D71Fcc[cc+1] PLDSLICEQs - s'' -1 or 0A quiet version of PLDSLICE.34
D71BPLDSLICEXQs l - s' -1 or 0A quiet version of LDSLICEXQ.26
D755PLDULE4s - xPreloads a little-endian unsigned 32-bit integer.26
D75DPLDULE4Qs - x -1 or 0Quietly preloads a little-endian unsigned 32-bit integer.26
D757PLDULE8s - xPreloads a little-endian unsigned 64-bit integer.26
D75FPLDULE8Qs - x -1 or 0Quietly preloads a little-endian unsigned 64-bit integer.26
D70Fcc[cc+1] PLDUQs - x -1 or 0A quiet version of PLDU.34
D707PLDUXQs l - x -1 or 0Quiet version of PLDUX.26
EDE1POPCTRXx i - Similar to c[i] POPCTR, but with 0 <= i <= 255 from the stack.26
ED9ic[i] POPSAVE c[i] POPCTRSAVEx -

Similar to c[i] POPCTR, but also saves the old value of c[i] into continuation c0. Equivalent (up to exceptions) to c[i] SAVECTR c[i] POPCTR.

26
EDE0PUSHCTRXi - x

Similar to c[i] PUSHCTR, but with i, 0 <= i <= 255, taken from the stack. Notice that this primitive is one of the few ''exotic'' primitives, which are not polymorphic like stack manipulation primitives, and at the same time do not have well-defined types of parameters and return values, because the type of x depends on i.

26
B7A0QADDx y - x+y26
B7A900QADDDIVMODx w z - q=floor((x+w)/z) r=(x+w)-zq34
B7A902QADDDIVMODCx w y - q=ceil((x+w)/z) r=(x+w)-zq34
B7A901QADDDIVMODRx w z - q=round((x+w)/z) r=(x+w)-zq34
B7A932tt[tt+1] QADDRSHIFTC#MODx w - q=round((x+w)/2^(tt+1)) r=(x+w)-q*2^(tt+1)42
B7A930tt[tt+1] QADDRSHIFT#MODx w - q=floor((x+w)/2^(tt+1)) r=(x+w)-q*2^(tt+1)42
B7A922QADDRSHIFTMODCx w z - q=ceil((x+w)/2^z) r=(x+w)-q*2^z34
B7A921QADDRSHIFTMODRx w z - q=round((x+w)/2^z) r=(x+w)-q*2^z34
B7A931tt[tt+1] QADDRSHIFTR#MODx w - q=round((x+w)/2^(tt+1)) r=(x+w)-q*2^(tt+1)42
F47ADICTIGETPREVi D n - x' i' -1 or 0Similar to DICTGETPREV, but interprets keys as signed n-bit integers.
B7B0QANDx y - x&y26
B7A5QDECx - x-126
B7A904QDIVx y - qDivision returns NaN if y=0.34
B7A906QDIVCx y - q''34
B7A90CQDIVMODx y - q r34
B7A90EQDIVMODCx y - q'' r''34
B7A90DQDIVMODRx y - q' r'34
B7A905QDIVRx y - q'34
B7B4cc[cc+1] QFITSx - xReplaces x with a NaN if x is not a cc+1-bit signed integer, leaves it intact otherwise.34
B7B600QFITSXx c - xReplaces x with a NaN if x is not a c-bit signed integer, leaves it intact otherwise.34
B7A4QINCx - x+126
B7AAcc[cc+1] QLSHIFT#x - x*2^(cc+1)0 <= cc <= 25534
B7A9D0tt[tt+1] QLSHIFT#ADDDIVMODx w z - q=floor((x*2^(tt+1)+w)/z) r=(x*2^(tt+1)+w)-zq42
B7A9D2tt[tt+1] QLSHIFT#ADDDIVMODCx w z - q=ceil((x*2^(tt+1)+w)/z) r=(x*2^(tt+1)+w)-zq42
B7A9C2QLSHIFTADDDIVMODCx w z y - q=round((x*2^y+w)/z) r=(x*2^y+w)-zq34
B7A9D1tt[tt+1] QLSHIFT#ADDDIVMODRx w z - q=round((x*2^(tt+1)+w)/z) r=(x*2^(tt+1)+w)-zq42
B7A9C1QLSHIFTADDDIVMODRx w z y - q=round((x*2^y+w)/z) r=(x*2^y+w)-zq34
B7A9C0QLSHIFTADDDIVMODx w z y - q=floor((x*2^y+w)/z) r=(x*2^y+w)-zq34
B7A9D4tt[tt+1] QLSHIFT#DIVx y - floor(2^(tt+1)*x/y)42
B7A9D6tt[tt+1] QLSHIFT#DIVCx y - ceil(2^(tt+1)*x/y)34
B7A9C6QLSHIFTDIVCx y z - ceil(2^z*x/y)0 <= z <= 25634
B7A9DCtt[tt+1] QLSHIFT#DIVMODx y - q=floor(2^(tt+1)*x/y) r=2^(tt+1)*x-q*y42
B7A9DEtt[tt+1] QLSHIFT#DIVMODCx y - q=ceil(2^(tt+1)*x/y) r=2^(tt+1)*x-q*y42
B7A9CEQLSHIFTDIVMODCx y z - q=ceil(2^z*x/y) r=2^z*x-q*y34
B7A9DDtt[tt+1] QLSHIFT#DIVMODRx y - q=round(2^(tt+1)*x/y) r=2^(tt+1)*x-q*y42
B7A9CDQLSHIFTDIVMODRx y z - q=round(2^z*x/y) r=2^z*x-q*y34
B7A9CCQLSHIFTDIVMODx y z - q=floor(2^z*x/y) r=2^z*x-q*y34
B7A9D5tt[tt+1] QLSHIFT#DIVRx y - round(2^(tt+1)*x/y)42
B7A9C5QLSHIFTDIVRx y z - round(2^z*x/y)0 <= z <= 25634
B7A9C4QLSHIFTDIVx y z - floor(2^z*x/y)0 <= z <= 25634
B7A9D8tt[tt+1] QLSHIFT#MODx y - 2^(tt+1)*x mod y42
B7A9DAtt[tt+1] QLSHIFT#MODCx y - 2^(tt+1)*x mod y42
B7A9CAQLSHIFTMODCx y z - 2^z*x mod y34
B7A9D9tt[tt+1] LSHIFT#MODRx y - 2^(tt+1)*x mod y42
B7A9C9QLSHIFTMODRx y z - 2^z*x mod y34
B7A9C8QLSHIFTMODx y z - 2^z*x mod y34
B7ACQLSHIFTx y - x*2^y26
B7A908QMODx y - r34
B7A90AQMODCx y - r34
B7A938tt[tt+1] QMODPOW2#x - x mod 2^(tt+1)42
B7A93Att[tt+1] QMODPOW2C#x - x mod 2^(tt+1)42
B7A92AQMODPOW2Cx y - x mod 2^y34
B7A939tt[tt+1] QMODPOW2R#x - x mod 2^(tt+1)42
B7A929QMODPOW2Rx y - x mod 2^y34
B7A928QMODPOW2x y - x mod 2^y34
B7A909QMODRx y - r34
B7A980QMULADDDIVMODx y w z - q=floor((xy+w)/z) r=(xy+w)-zq34
B7A982QMULADDDIVMODCx y w z - q=ceil((xy+w)/z) r=(xy+w)-zq34
B7A981QMULADDDIVMODRx y w z - q=round((xy+w)/z) r=(xy+w)-zq34
B7A9B2tt[tt+1] QMULADDRSHIFTC#MODx y w - q=ceil((xy+w)/2^z) r=(xy+w)-q*2^z42
B7A9B0tt[tt+1] QMULADDRSHIFT#MODx y w - q=floor((xy+w)/2^z) r=(xy+w)-q*2^z42
B7A9B1tt[tt+1] QMULADDRSHIFTR#MODx y w - q=round((xy+w)/2^z) r=(xy+w)-q*2^z42
B7A984QMULDIVx y z - qq=floor(x*y/z)34
B7A986QMULDIVCx y z - q'q'=ceil(x*y/z)34
B7A98EQMULDIVMODCx y z - q rq=ceil(x*y/z), r=x*y-z*q34
B7A98DQMULDIVMODRx y z - q rq=round(x*y/z), r=x*y-z*q34
B7A985QMULDIVRx y z - q'34
B7A988QMULMODx y z - x*y mod z34
B7A98AQMULMODCx y z - x*y mod z34
B7A9B8tt[tt+1] QMULMODPOW2#x y - x*y mod 2^(tt+1)42
B7A9BAtt[tt+1] QMULMODPOW2C#x y - x*y mod 2^(tt+1)42
B7A9AAQMULMODPOW2C_VARx y z - x*y mod 2^z34
B7A9B9tt[tt+1] QMULMODPOW2R#x y - x*y mod 2^(tt+1)42
B7A9A9QMULMODPOW2R_VARx y z - x*y mod 2^z34
B7A9A8QMULMODPOW2_VARx y z - x*y mod 2^z34
B7A989QMULMODRx y z - x*y mod z34
B7A9B4tt[tt+1] QMULRSHIFT#x y - floor(x*y/2^(tt+1))42
B7A9B6tt[tt+1] QMULRSHIFTC#x y - ceil(x*y/2^(tt+1))42
B7A9BEQMULRSHIFTC#MODx y - q=ceil(x*y/2^(tt+1)) r=xy-q*2^(tt+1)42
B7A9AEQMULRSHIFTCMOD_VARx y z - q=ceil(x*y/2^z) r=xy-q*2^z34
B7A9A6QMULRSHIFTCx y z - ceil(x*y/2^z)0 <= z <= 25634
B7A9BCQMULRSHIFT#MODx y - q=floor(x*y/2^(tt+1)) r=xy-q*2^(tt+1)42
B7A9ACQMULRSHIFTMOD_VARx y z - q=floor(x*y/2^z) r=xy-q*2^z34
B7A9B5tt[tt+1] QMULRSHIFTR#x y - round(x*y/2^(tt+1))42
B7A9BDQMULRSHIFTR#MODx y - q=round(x*y/2^(tt+1)) r=xy-q*2^(tt+1)42
B7A9ADQMULRSHIFTRMOD_VARx y z - q=round(x*y/2^z) r=xy-q*2^z34
B7A9A5QMULRSHIFTRx y z - round(x*y/2^z)0 <= z <= 25634
B7A9A4QMULRSHIFTx y z - floor(x*y/2^z)0 <= z <= 25634
B7A3QNEGATEx - -x26
B7B3QNOTx - ~x26
B7B1QORx y - x|y26
B7AEQPOW2y - 2^y26
B7ABcc[cc+1] RSHIFT#x - floor(x/2^(cc+1))0 <= cc <= 25526
B7A936tt[tt+1] QRSHIFTC#x - ceil(x/2^(tt+1))42
B7A93Ett[tt+1] QRSHIFTC#MODx - q=ceil(x/2^(tt+1)) r=x-q*2^(tt+1)42
B7A926QRSHIFTCx y - ceil(x/2^y)34
A93Ctt[tt+1] QRSHIFT#MODx - q=floor(x/2^(tt+1)) r=x-q*2^(tt+1)42
B7A92EQRSHIFTMODCx y - q=ceil(x/2^y) r=x-q*2^y34
B7A92DQRSHIFTMODRx y - q=round(x/2^y) r=x-q*2^y34
B7A92CQRSHIFTMODx y - q=floor(x/2^y) r=x-q*2^y34
B7A935tt[tt+1] QRSHIFTR#x - round(x/2^(tt+1))42
A93Dtt[tt+1] QRSHIFTR#MODx - q=round(x/2^(tt+1)) r=x-q*2^(tt+1)42
B7A925QRSHIFTRx y - round(x/2^y)34
B7ADQRSHIFTx y - floor(x/2^y)26
B7A1QSUBx y - x-y26
B7A2QSUBRx y - y-x26
B7B5cc[cc+1] QUFITSx - xReplaces x with a NaN if x is not a cc+1-bit unsigned integer, leaves it intact otherwise.34
B7B601QUFITSXx c - xReplaces x with a NaN if x is not a c-bit unsigned integer, leaves it intact otherwise.34
B7B2QXORx y - x xor y26
FB03RAWRESERVEXx D y - Similar to RAWRESERVE, but also accepts a dictionary D (represented by a Cell or Null) with extra currencies. In this way currencies other than Grams can be reserved.526
E314REPEATBRKn c -Similar to REPEAT, but also sets c1 to the original cc after saving the old value of c1 into the savelist of the original cc. In this way RETALT could be used to break out of the loop body.26
E5REPEATEND REPEAT:n - Similar to REPEAT, but it is applied to the current continuation cc.18
E315REPEATENDBRKn -Similar to REPEATEND, but also sets c1 to the original c0 after saving the old value of c1 into the savelist of the original c0. Equivalent to SAMEALTSAVE REPEATEND.26
DB30RET RETTRUE

Returns to the continuation at c0. The remainder of the current continuation cc is discarded. Approximately equivalent to c0 PUSHCTR JMPX.

26
DB31RETALT RETFALSE

Returns to the continuation at c1. Approximately equivalent to c1 PUSHCTR JMPX.

26
DB2r[r] RETARGSReturns to c0, with 0 <= r <= 15 return values taken from the current stack.26
DB3FRETDATAEquivalent to c0 PUSHCTR JMPXDATA. In this way, the remainder of the current continuation is converted into a Slice and returned to the caller.26
ED0p[p] RETURNARGS-Leaves only the top 0 <= p <= 15 values in the current stack (somewhat similarly to ONLYTOPX), with all the unused bottom values not discarded, but saved into continuation c0 in the same way as SETCONTARGS does.26+s''
ED10RETURNVARARGSp -Similar to RETURNARGS, but with Integer 0 <= p <= 255 taken from the stack.26+s''
DB39RETVARARGSp r - Similar to RETARGS.26
FA47REWRITEVARADDRQs - x s' -1 or 0A quiet version of primitive REWRITEVARADDR.26
F922RIST255_ADDx y - x+yAddition of two points on a curve.626
B7F922RIST255_QADDx y - 0 or x+y -1Addition of two points on a curve. Returns -1 on success and 0 on failure.634
B7F924RIST255_QMULx n - 0 or x*n -1Multiplies point x by a scalar n. Any n is valid, including negative. Returns -1 on success and 0 on failure.2034
B7F925RIST255_QMULBASEn - 0 or g*n -1Multiplies the generator point g by a scalar n. Any n is valid, including negative.784
B7F923RIST255_QSUBx y - 0 or x-y -1Subtraction of two points on curve. Returns -1 on success and 0 on failure.634
B7F921RIST255_QVALIDATEx - 0 or -1Checks that integer x is a valid representation of some curve point. Returns -1 on success and 0 on failure.234
A93Ett[tt+1] RSHIFTC#MODx - q=ceil(x/2^(tt+1)) r=x-q*2^(tt+1)34
A93Ctt[tt+1] RSHIFT#MODx - q=floor(x/2^(tt+1)) r=x-q*2^(tt+1)34
A93Dtt[tt+1] RSHIFTR#MODx - q=round(x/2^(tt+1)) r=x-q*2^(tt+1)34
DB50RUNVMXx_1 ... x_n n code [r] [c4] [c7] [g_l] [g_m] flags - x'_1 ... x'_m exitcode [data'] [c4'] [c5] [g_c]Runs child VM with code code and stack x_1...x_n. Returns the resulting stack x'_1...x'_m and exitcode. Other arguments and return values are enabled by flags.
EDFASAMEALT-Sets c1 to c0. Equivalent to c0 PUSHCTR c1 POPCTR.26
EDBic[i] SAVEALT c[i] SAVEALTCTRSimilar to c[i] SAVE, but saves the current value of c[i] into the savelist of c1, not c0.26
EDCic[i] SAVEBOTH c[i] SAVEBOTHCTREquivalent to c[i] SAVE c[i] SAVEALT.26
D743SCHKBITREFSs l r - Checks whether there are at least l data bits and r references in Slice s.26/76
D747SCHKBITREFSQs l r - ?Checks whether there are at least l data bits and r references in Slice s.26
D741SCHKBITSs l - Checks whether there are at least l data bits in Slice s. If this is not the case, throws a cell deserialisation (i.e., cell underflow) exception.26/76
D745SCHKBITSQs l - ?Checks whether there are at least l data bits in Slice s.26
D742SCHKREFSs r - Checks whether there are at least r references in Slice s.26/76
D746SCHKREFSQs r - ?Checks whether there are at least r references in Slice s.26
D730SCUTFIRSTs l r - s'Returns the first 0 <= l <= 1023 bits and first 0 <= r <= 4 references of s.26
F942SDATASIZEQs n - x y z -1 or 0Similar to CDATASIZEQ, but accepting a Slice s instead of a Cell. The returned value of x does not take into account the cell that contains the slice s itself; however, the data bits and the cell references of s are accounted for in y and z.
D726SDBEGINSXs s' - s''Checks whether s begins with (the data bits of) s', and removes s' from s on success. On failure throws a cell deserialization exception. Primitive SDPFXREV can be considered a quiet version of SDBEGINSX.26
D727SDBEGINSXQs s' - s'' -1 or s 0A quiet version of SDBEGINSX.26
C711SDCNTLEAD1s - nReturns the number of leading ones in s.26
C712SDCNTTRAIL0s - nReturns the number of trailing zeroes in s.26
C708SDPFXs s' - ?Checks whether s is a prefix of s'.26
C70ASDPPFXs s' - ?Checks whether s is a proper prefix of s' (i.e., a prefix distinct from s').26
C70ESDPSFXs s' - ?Checks whether s is a proper suffix of s'.26
C70FSDPSFXREVs s' - ?Checks whether s' is a proper suffix of s.26
C70CSDSFXs s' - ?Checks whether s is a suffix of s'.26
C70DSDSFXREVs s' - ?Checks whether s' is a suffix of s.26
ED8ic[i] SETALTCTRx - Equivalent to c1 PUSHCTR c[i] SETCONTCTR c1 POPCTR.26
EDE2SETCONTCTRXx c i - c'Similar to c[i] SETCONTCTR, but with 0 <= i <= 255 from the stack.26
FFF0SETCPXc - Selects codepage c with -2^15 <= c < 2^15 passed in the top of the stack.26
FFFz[z-16] SETCP-Selects TVM codepage z-16 for 1 <= z <= 15. Negative codepages -13...-1 are reserved for restricted versions of TVM needed to validate runs of TVM in other codepages. Negative codepage -14 is reserved for experimental codepages, not necessarily compatible between different TVM implementations, and should be disabled in the production versions of TVM.26
EDF5SETEXITALTc -

Sets c1 to compose1(compose0(c, c0), c1), In this way, a subsequent RETALT will first execute c, then transfer control to the original c0. This can be used, for instance, to exit from nested loops.

26
F860SETGLOBVARx k -

Assigns x to the k-th global variable for 0 <= k < 255. Equivalent to c7 PUSHCTR ROTREV SETINDEXVARQ c7 POPCTR.

26+|c7'|
ED12SETNUMVARARGSc n - c'

-1 <= n <= 255 If n=-1, this operation does nothing (c'=c). Otherwise its action is similar to [n] SETNUMARGS, but with n taken from the stack.

26
ED7ic[i] SETRETCTRx - Equivalent to c0 PUSHCTR c[i] SETCONTCTR c0 POPCTR.26
D737SPLITQs l r - s' s'' -1 or s 0A quiet version of SPLIT.26
D731SSKIPFIRSTs l r - s'Returns all but the first l bits of s and r references of s.26
D733SSKIPLASTs l r - s'Returns all but the last l bits of s and r references of s.26
CF1BSTBQb' b - b' b -1 or b'' 0Quiet version of STB.26
CF19STBREFQb' b - b' b -1 or b'' 0Quiet version of STBREF.526
CDSTBREFR ENDCSTb b'' - bEquivalent to ENDC SWAP STREF.518
CF1DSTBREFRQb b' - b b' -1 or b'' 0Quiet version of STBREFR.526
CF15STBREFR_lb b' - b''A longer encoding of STBREFR.526
CF1FSTBRQ BCONCATQb b' - b b' -1 or b'' 0Quiet version of STBR.26
CF28STILE4x b - b'Stores a little-endian signed 32-bit integer.26
CF2ASTILE8x b - b'Stores a little-endian signed 64-bit integer.26
CF0Ccc[cc+1] STIQx b - x b f or b' 0A quiet version of STI.34
CF0Ecc[cc+1] STIRQb x - b x f or b' 0A quiet version of STIR.34
CF04STIXQx b l - x b f or b' 0

A quiet version of STIX. If there is no space in b, sets b'=b and f=-1. If x does not fit into l bits, sets b'=b and f=1. If the operation succeeds, b' is the new Builder and f=0. However, 0 <= l <= 257, with a range check exception if this is not so.

26
CF02STIXRb x l - b'Similar to STIX, but with arguments in a different order.26
CF06STIXRQb x l - b x f or b' 0A quiet version of STIXR.26
CF08cc[cc+1] STI_lx b - b'A longer version of [cc+1] STI.34
CF21[ref] [ref] STREF2CONSTb - b'Equivalent to STREFCONST STREFCONST.26
CF20[ref] STREFCONSTb - b'Equivalent to PUSHREF STREFR.26
CF18STREFQc b - c b -1 or b' 0Quiet version of STREF.26
CF1CSTREFRQb c - b c -1 or b' 0Quiet version of STREFR.26
CF10STREF_lc b - b'A longer version of STREF.26
CF42STSAMEb n x - b'Stores n binary xes (0 <= x <= 1) into Builder b.26
CF1ASTSLICEQs b - s b -1 or b' 0Quiet version of STSLICE.26
CF1ESTSLICERQb s - b s -1 or b'' 0Quiet version of STSLICER.26
CF12STSLICE_ls b - b'A longer version of STSLICE.26
CF2BSTULE8x b - b'Stores a little-endian unsigned 64-bit integer.26
CF0Dcc[cc+1] STUQx b - x b f or b' 0A quiet version of STU.34
CF0Fcc[cc+1] STURQb x - b x f or b' 0A quiet version of STUR.34
CF05STUXQx b l - x b f or b' 0A quiet version of STUX.26
CF03STUXRb x l - b'Similar to STUX, but with arguments in a different order.26
CF07STUXRQb x l - b x f or b' 0A quiet version of STUXR.26
CF09cc[cc+1] STU_lx b - b'A longer version of [cc+1] STU.34
FA07STVARINT32b x - b'Similar to STVARUINT32, but serializes a signed Integer x in the range -2^247...2^247-1.26
FA06STVARUINT32b x - b'Stores (serializes) an Integer x in the range 0...2^248-1 into Builder b, and returns the resulting Builder b'. The serialization of x consists of a 5-bit unsigned big-endian integer l, which is the smallest integer l>=0, such that x<2^(8l), followed by an 8l-bit unsigned big-endian representation of x. If x does not belong to the supported range, a range check exception is thrown.26
F4B1SUBDICTGETk l D n - D'Constructs a subdictionary consisting of all keys beginning with prefix k (represented by a Slice, the first 0 <= l <= n <= 1023 data bits of which are used as a key) of length l in dictionary D of type HashmapE(n,X) with n-bit keys. On success, returns the new subdictionary of the same type HashmapE(n,X) as a Slice D'.
F4B2SUBDICTIGETx l D n - D'Variant of SUBDICTGET with the prefix represented by a signed big-endian l-bit Integer x, where necessarily l <= 257.
F4B6SUBDICTIRPGETx l D n - D'Variant of SUBDICTRPGET with the prefix represented by a signed big-endian l-bit Integer x, where necessarily l <= 257.
F4B5SUBDICTRPGETk l D n - D'Similar to SUBDICTGET, but removes the common prefix k from all keys of the new dictionary D', which becomes of type HashmapE(n-l,X).
F4B3SUBDICTUGETx l D n - D'Variant of SUBDICTGET with the prefix represented by an unsigned big-endian l-bit Integer x, where necessarily l <= 256.
F4B7SUBDICTURPGETx l D n - D'Variant of SUBDICTRPGET with the prefix represented by an unsigned big-endian l-bit Integer x, where necessarily l <= 256.
D734SUBSLICEs l r l' r' - s'Returns 0 <= l' <= 1023 bits and 0 <= r' <= 4 references from Slice s, after skipping the first 0 <= l <= 1023 bits and first 0 <= r <= 4 references.26
EDF6THENRETc - c'Computes compose0(c, c0).26
EDF7THENRETALTc - c'Computes compose0(c, c1)26
F2F1THROWARGANYx n - x n

Throws exception 0 <= n < 2^16 with parameter x, transferring control to the continuation in c2. Approximately equivalent to c2 PUSHCTR 2 JMPXARGS.

76
F2F3THROWARGANYIFx n f - Throws exception 0 <= n<2^16 with parameter x only if f!=0.26/76
F2F5THROWARGANYIFNOTx n f - Throws exception 0 <= n<2^16 with parameter x only if f=0.26/76
F2DC_n[n] THROWARGIFx f - Throws exception 0 <= nn < 2^11 with parameter x only if integer f!=0.34/84
F2EC_n[n] THROWARGIFNOTx f - Throws exception 0 <= n < 2^11 with parameter x only if integer f=0.34/84
F3pr[p] [r] TRYARGSc c' -

Similar to TRY, but with [p] [r] CALLXARGS internally used instead of EXECUTE. In this way, all but the top 0 <= p <= 15 stack elements will be saved into current continuation's stack, and then restored upon return from either c or c', with the top 0 <= r <= 15 values of the resulting stack of c or c' copied as return values.

26
E316UNTILBRKc -Similar to UNTIL, but also modifies c1 in the same way as REPEATBRK.26
E7UNTILEND UNTIL:-Similar to UNTIL, but executes the current continuation cc in a loop. When the loop exit condition is satisfied, performs a RET.18
E317UNTILENDBRK UNTILBRK:-Equivalent to SAMEALTSAVE UNTILEND.26
E318WHILEBRKc' c -Similar to WHILE, but also modifies c1 in the same way as REPEATBRK.26
E9WHILEENDc' - Similar to WHILE, but uses the current continuation cc as the loop body.18
E319WHILEENDBRKc -Equivalent to SAMEALTSAVE WHILEEND.26
D73BXLOADQc - c' -1 or c 0Loads an exotic cell c and returns an ordinary cell c'. If c is already ordinary, does nothing. If c cannot be loaded, returns 0.