Skip to main content

TVM Instructions

advanced level

This information is very low-level and could be hard to understand for newcomers. So feel free to read about it later.

Introduction

This document provides a list of TVM instructions along with their opcodes and mnemonics.

info
  • TVM.pdf concept document for TON Virtual Machine (may include outdated information).
  • TVM Retracer

Fift is a stack-based programming language designed to manage TON smart contracts. The Fift assembler is a Fift library that converts mnemonics of TVM instructions into their binary representation.

A description of Fift, including an introduction to the Fift assembler, can be found here.

This document specifies the corresponding mnemonic for each instruction.

Note the following:

  1. Fift is a stack-based language, therefore all the arguments of any instruction are written before it (e.g. 5 PUSHINT, s0 s4 XCHG).
  2. Stack registers are denoted by s0, s1, ..., s15. Other stack registers (up to 255) are denoted by i s() (e.g. 100 s()).
  3. Control registers are denoted by c0, c1, ..., c15.

Gas prices

The gas price of each instruction is specified in this document. The basic gas price of an instruction is 10 + b, where b is the instruction length in bits. Some operations have additional fees:

  1. Parsing cells: Transforming a cell into a slice costs 100 gas units if the cell is loading for the first time and 25 for subsequent loads during the same transaction. For such instructions, two gas prices are specified (e.g. CTOS: 118/43).
  2. Cell creation: 500 gas units.
  3. Throwing exceptions: 50 gas units. In this document the exception fee is only specified for an instruction if its primary purpose is to throw (e.g. THROWIF, FITS). If the instruction only throws in some cases, two gas prices are specified (e.g. FITS: 26/76).
  4. Tuple creation: 1 gas unit for every tuple element.
  5. Implicit jumps: 10 gas units for an implicit jump, 5 gas units for an implicit back jump. This fee is not a part of any instruction.
  6. Moving stack elements between continuations: 1 gas unit per element, however moving the first 32 elements is free.
info

A full machine-readable list of TVM instructions is available here.

Each section of TVM Instructions includes a built-in search component for finding opcodes specific to that section as well.

On this page, however, the search covers all existing opcodes, providing a comprehensive search option across the entire opcode range.

Feel free to use the search field below to find a specific instruction:

OpcodeFift syntaxStackDescriptionGas
0is[i] XCHG0Interchanges s0 with s[i], 1 <= i <= 15.18
2is[i] PUSHPushes a copy of the old s[i] into the stack.18
D3cc[cc+1] LDUs - x s'Loads an unsigned cc+1-bit integer x from Slice s.26
82lxxx[xxx] PUSHINT [xxx] INT- xxx

Pushes integer xxx. Details: 5-bit 0 <= l <= 30 determines the length n=8l+19 of signed big-endian integer xxx. The total length of this instruction is l+4 bytes or n+13=8l+32 bits.

23
BAEQUALx y - x=yReturns -1 if x=y, 0 otherwise.18
F2E4_n[n] THROWIFNOTf - For 0 <= n < 2^11, an encoding of [n] THROWIFNOT for larger values of n.34/84
81xxxx[xxxx] PUSHINT [xxxx] INT- xxxxPushes integer xxxx. -2^15 <= xx < 2^15.34
3is[i] POPPops the old s0 value into the old s[i].18
9xccc[builder] PUSHCONT [builder] CONT- c

Pushes a continuation made from builder. Details: Pushes an x-byte continuation for 0 <= x <= 15.

18
CBcc[cc+1] STUx b - b'Stores an unsigned cc+1-bit integer x into Builder b. In all other respects it is similar to STI.26
7i[x] PUSHINT [x] INT- x

Pushes integer x into the stack. -5 <= x <= 10. Here i equals four lower-order bits of x (i=x mod 16).

18
E0IFJMPf c - Jumps to c (similarly to JMPX), but only if f is non-zero.18
D0CTOSc - sConverts a Cell into a Slice. Notice that c must be either an ordinary cell, or an exotic cell which is automatically loaded to yield an ordinary cell c', converted into a Slice afterwards.118/43
FA40LDMSGADDRs - s' s''Loads from Slice s the only prefix that is a valid MsgAddress, and returns both this prefix s' and the remainder s'' of s as slices.26
C8NEWC- bCreates a new empty Builder.18
1is1 s[i] XCHGInterchanges s1 with s[i], 2 <= i <= 15.18
C9ENDCb - cConverts a Builder into an ordinary Cell.518
DB3C[ref] CALLREFEquivalent to PUSHREFCONT CALLX.126/51
F85_k[k] GETGLOB - x

Returns the k-th global variable for 1 <= k <= 31. Equivalent to c7 PUSHCTR [k] INDEXQ.

26
ED5ic[i] POPCTR c[i] POPx - Pops a value x from the stack and stores it into control register c(i), if supported in the current codepage. Notice that if a control register accepts only values of a specific type, a type-checking exception may occur.26
CF16STSLICERb s - b'Equivalent to SWAP STSLICE.26
F82i[i] GETPARAM - x

Returns the i-th parameter from the Tuple provided at c7 for 0 <= i <= 15. Equivalent to c7 PUSHCTR FIRST [i] INDEX. If one of these internal operations fails, throws an appropriate type checking or range checking exception.

26
F87_k[k] SETGLOBx -

Assigns x to the k-th global variable for 1 <= k <= 31. Equivalent to c7 PUSHCTR SWAP k SETINDEXQ c7 POPCTR.

26+|c7'|
11iis0 [ii] s() XCHGInterchanges s0 with s[ii], 0 <= ii <= 255.26
D4LDREFs - c s'Loads a cell reference c from s.18
F2A_n[n] THROWIFNOTf - Throws exception 0 <= n <= 63 with parameter zero only if integer f=0.26/76
59ROTREV -ROTa b c - c a bEquivalent to 2 1 BLKSWAP or to s2 s2 XCHG2.18
A4INCx - x+1Equivalent to 1 ADDCONST.18
F26_n[n] THROWIFf - Throws exception 0 <= n <= 63 with parameter zero only if integer f!=0.26/76
F901HASHSUs - xComputes the hash of a Slice s and returns it as a 256-bit unsigned integer x. The result is the same as if an ordinary cell containing only data and references from s had been created and its hash computed by HASHCU.526
BEGEQx y - x>=yEquivalent to LESS NOT.18
D718LDSLICEXs l - s'' s'Loads the first 0 <= l <= 1023 bits from Slice s into a separate Slice s'', returning the remainder of s as s'.26
F800ACCEPT-

Sets current gas limit g_l to its maximal allowed value g_m, and resets the gas credit g_c to zero, decreasing the value of g_r by g_c in the process. In other words, the current smart contract agrees to buy some gas to finish the current transaction. This action is required to process external messages, which bring no value (hence no gas) with themselves.

26
F910CHKSIGNUh s k - ?

Checks the Ed25519-signature s of a hash h (a 256-bit unsigned integer, usually computed as the hash of some data) using public key k (also represented by a 256-bit unsigned integer). The signature s must be a Slice containing at least 512 data bits; only the first 512 bits are used. The result is -1 if the signature is valid, 0 otherwise. Notice that CHKSIGNU is equivalent to ROT NEWC 256 STU ENDC ROTREV CHKSIGNS, i.e., to CHKSIGNS with the first argument d set to 256-bit Slice containing h. Therefore, if h is computed as the hash of some data, these data are hashed twice, the second hashing occurring inside CHKSIGNS.

26
50ijs[i] s[j] XCHG2Equivalent to s1 s[i] XCHG s[j] XCHG0.26
D74E_n[n] PLDREFIDXs - cReturns the n-th cell reference of Slice s, where 0 <= n <= 3.26
FFnn[nn] SETCP-Selects TVM codepage 0 <= nn < 240. If the codepage is not supported, throws an invalid opcode exception.26
DDIFNOTRET IF:f - Performs a RET, but only if integer f is zero.18
FA00LDGRAMS LDVARUINT16s - x s'

Loads (deserializes) a Gram or VarUInteger 16 amount from Slice s, and returns the amount as Integer x along with the remainder s' of s. The expected serialization of x consists of a 4-bit unsigned big-endian integer l, followed by an 8l-bit unsigned big-endian representation of x. The net effect is approximately equivalent to 4 LDU SWAP 3 LSHIFT# LDUX.

26
ED4ic[i] PUSHCTR c[i] PUSH- xPushes the current value of control register c(i). If the control register is not supported in the current codepage, or if it does not have a value, an exception is triggered.26
CCSTREFc b - b'Stores a reference to Cell c into Builder b.18
F0nn[nn] CALL [nn] CALLDICT- nn

Calls the continuation in c3, pushing integer 0 <= nn <= 255 into its stack as an argument. Approximately equivalent to [nn] PUSHINT c3 PUSHCTR EXECUTE.

FA02STGRAMS STVARUINT16b x - b'Stores (serializes) an Integer x in the range 0...2^120-1 into Builder b, and returns the resulting Builder b'. The serialization of x consists of a 4-bit unsigned big-endian integer l, which is the smallest integer l>=0, such that x<2^(8l), followed by an 8l-bit unsigned big-endian representation of x. If x does not belong to the supported range, a range check exception is thrown.26
10ijs[i] s[j] XCHGInterchanges s[i] with s[j], 1 <= i < j <= 15.26
8F_rxxcccc[builder] PUSHCONT [builder] CONT- c

Pushes a continuation made from builder. Details: Pushes the simple ordinary continuation cccc made from the first 0 <= r <= 3 references and the first 0 <= xx <= 127 bytes of cc.code.

26
6Cij[i] [j] BLKDROP2

Drops i stack elements under the top j elements. 1 <= i <= 15, 0 <= j <= 15 Equivalent to [i+j] 0 REVERSE [i] BLKDROP [j] 0 REVERSE.

26
83xx[xx+1] PUSHPOW2- 2^(xx+1)

(Quietly) pushes 2^(xx+1) for 0 <= xx <= 255. 2^256 is a NaN.

26
80xx[xx] PUSHINT [xx] INT- xxPushes integer xx. -128 <= xx <= 127.26
F400STDICT STOPTREFD b - b'

Stores dictionary D into Builder b, returning the resulting Builder b'. In other words, if D is a cell, performs STONE and STREF; if D is Null, performs NIP and STZERO; otherwise throws a type checking exception.

26
C0yy[yy] EQINTx - x=yy

Returns -1 if x=yy, 0 otherwise. -2^7 <= yy < 2^7.

26
5F0i[i] BLKDROPEquivalent to DROP performed i times.26
F404LDDICT LDOPTREFs - D s'Loads (parses) a dictionary D from Slice s, and returns the remainder of s as s'. May be applied to dictionaries or to values of arbitrary (^Y)? types.26
58ROTa b c - b c aEquivalent to 1 2 BLKSWAP or to s2 s1 XCHG2.18
D749SBITSs - lReturns the number of data bits in Slice s.26
52ijs[i] s[j-1] PUXCEquivalent to s[i] PUSH SWAP s[j] XCHG0.26
B0ANDx y - x&yBitwise and of two signed integers x and y, sign-extended to infinity.18
D70Bcc[cc+1] PLDUs - xPreloads an unsigned cc+1-bit integer from s.34
E2IFELSEf c c' - If integer f is non-zero, executes c, otherwise executes c'. Equivalent to CONDSELCHK EXECUTE.18
CAcc[cc+1] STIx b - b'Stores a signed cc+1-bit integer x into Builder b for 0 <= cc <= 255, throws a range check exception if x does not fit into cc+1 bits.26
A0ADDx y - x+y18
55ij[i+1] [j+1] BLKSWAP

Permutes two blocks s[j+i+1] ... s[j+1] and s[j] ... s0. 0 <= i,j <= 15 Equivalent to [i+1] [j+1] REVERSE [j+1] 0 REVERSE [i+j+2] 0 REVERSE.

26
F2D4_n[n] THROWIFf - For 0 <= n < 2^11, an encoding of [n] THROWIF for larger values of n.34/84
E302[ref] IFJMPREFf - Equivalent to PUSHREFCONT IFJMP.26/126/51
A1SUBx y - x-y18
4ijks[i] s[j] s[k] XCHG3Equivalent to s2 s[i] XCHG s1 s[j] XCHG s[k] XCHG0.26
D2cc[cc+1] LDIs - x s'Loads (i.e., parses) a signed cc+1-bit integer x from Slice s, and returns the remainder of s as s'.26
FB00SENDRAWMSGc x - Sends a raw message contained in Cell c, which should contain a correctly serialized object Message X, with the only exception that the source address is allowed to have dummy value addr_none (to be automatically replaced with the current smart-contract address), and ihr_fee, fwd_fee, created_lt and created_at fields can have arbitrary values (to be rewritten with correct values during the action phase of the current transaction). Integer parameter x contains the flags. Currently x=0 is used for ordinary messages; x=128 is used for messages that are to carry all the remaining balance of the current smart contract (instead of the value originally indicated in the message); x=64 is used for messages that carry all the remaining value of the inbound message in addition to the value initially indicated in the new message (if bit 0 is not set, the gas fees are deducted from this amount); x'=x+1 means that the sender wants to pay transfer fees separately; x'=x+2 means that any errors arising while processing this message during the action phase should be ignored. Finally, x'=x+32 means that the current account must be destroyed if its resulting balance is zero. This flag is usually employed together with +128.526
C705SDEQs s' - ?Checks whether the data parts of s and s' coincide, equivalent to SDLEXCMP ISZERO.26
53ijs[i] s[j] PUSH2Equivalent to s[i] PUSH s[j+1] PUSH.26
D1ENDSs - Removes a Slice s from the stack, and throws an exception if it is not empty.18/68
57ii[ii] s() POP

Pops the old s0 value into the old s[ii]. 0 <= ii <= 255

26
51ijs[i] s[j] XCPUEquivalent to s[i] XCHG0 s[j] PUSH.26
C2yy[yy] GTINT [yy+1] GEQINTx - x>yy

Returns -1 if x>yy, 0 otherwise. -2^7 <= yy < 2^7.

26
C700SEMPTYs - ?Checks whether a Slice s is empty (i.e., contains no bits of data and no cell references).26
6F0n[n] TUPLEx_1 ... x_n - t

Creates a new Tuple t=(x_1, ... ,x_n) containing n values x_1,..., x_n. 0 <= n <= 15

26+n
8Drxxsssss[slice] PUSHSLICE [slice] SLICE- s

Pushes the slice slice into the stack. Details: Pushes the subslice of cc.code consisting of 0 <= r <= 4 references and up to 8xx+6 bits of data, with 0 <= xx <= 127. A completion tag is assumed.

28
D721SDSKIPFIRSTs l - s'Returns all but the first 0 <= l <= 1023 bits of s. It is equivalent to LDSLICEX NIP.26
6FA1NULLSWAPIFNOTx - x or null xPushes a Null under the topmost Integer x, but only if x=0. May be used for stack alignment after quiet primitives such as PLDUXQ.26
DEIFf c - Performs EXECUTE for c (i.e., executes c), but only if integer f is non-zero. Otherwise simply discards both values.18
F900HASHCUc - xComputes the representation hash of a Cell c and returns it as a 256-bit unsigned integer x. Useful for signing and checking signatures of arbitrary entities represented by a tree of cells.26
6DNULL PUSHNULL - nullPushes the only value of type Null.18
84xx[xx+1] PUSHPOW2DEC- 2^(xx+1)-1Pushes 2^(xx+1)-1 for 0 <= xx <= 255.26
545ijks[i] s[j-1] s[k-1] PUXCPUEquivalent to s[i] s[j-1] PUXC s[k] PUSH.34
A3NEGATEx - -x

Equivalent to -1 MULCONST or to ZERO SUBR. Notice that it triggers an integer overflow exception if x=-2^256.

18
A8MULx y - x*y18
F2F0THROWANYn - 0 n

Throws exception 0 <= n < 2^16 with parameter zero. Approximately equivalent to ZERO SWAP THROWARGANY.

76
541ijks[i] s[j] s[k] XC2PUEquivalent to s[i] s[j] XCHG2 s[k] PUSH.34
6EISNULLx - ?Checks whether x is a Null, and returns -1 or 0 accordingly.18
B1ORx y - x|yBitwise or of two integers.18
F40EDICTUGETi D n - x -1 or 0Similar to DICTIGET, but with unsigned (big-endian) n-bit Integer i used as a key.
FA44REWRITESTDADDRs - x yParses Slice s containing a valid MsgAddressInt (usually a msg_addr_std), applies rewriting from the anycast (if present) to the same-length prefix of the address, and returns both the workchain x and the 256-bit address y as integers. If the address is not 256-bit, or if s is not a valid serialization of MsgAddressInt, throws a cell deserialization exception.26
BCGREATERx y - x>y18
5BDROP2 2DROPa b - Equivalent to DROP DROP.18
542ijks[i] s[j] s[k-1] XCPUXCEquivalent to s1 s[i] XCHG s[j] s[k-1] PUXC.34
E30D[ref] IFREFELSEf c -Equivalent to PUSHREFCONT SWAP IFELSE, with the optimization that the cell reference is not actually loaded into a Slice and then converted into an ordinary Continuation if f=0. Similar remarks apply to the next two primitives: cells are converted into continuations only when necessary.26/126/51
A904DIVx y - qq=floor(x/y), r=x-y*q26
56ii[ii] s() PUSH

Pushes a copy of the old s[ii] into the stack. 0 <= ii <= 255

26
8Bxsss[slice] PUSHSLICE [slice] SLICE- s

Pushes the slice slice into the stack. Details: Pushes the (prefix) subslice of cc.code consisting of its first 8x+4 bits and no references (i.e., essentially a bitstring), where 0 <= x <= 15. A completion tag is assumed, meaning that all trailing zeroes and the last binary one (if present) are removed from this bitstring. If the original bitstring consists only of zeroes, an empty slice will be pushed.

22
B9LESSx y - x<yReturns -1 if x<y, 0 otherwise.18
547ijks[i] s[j] s[k] PUSH3Equivalent to s[i] PUSH s[j+1] s[k+1] PUSH2.34
B3NOTx - ~xBitwise not of an integer.26
E6UNTILc - Executes continuation c, then pops an integer x from the resulting stack. If x is zero, performs another iteration of this loop. The actual implementation of this primitive involves an extraordinary continuation ec_until with its arguments set to the body of the loop (continuation c) and the original current continuation cc. This extraordinary continuation is then saved into the savelist of c as c.c0 and the modified c is then executed. The other loop primitives are implemented similarly with the aid of suitable extraordinary continuations.18
F2F4THROWANYIFNOTn f - Throws exception 0 <= n<2^16 with parameter zero only if f=0.26/76
C1yy[yy] LESSINT [yy-1] LEQINTx - x<yy

Returns -1 if x<yy, 0 otherwise. -2^7 <= yy < 2^7.

26
C3yy[yy] NEQINTx - x!=yy

Returns -1 if x!=yy, 0 otherwise. -2^7 <= yy < 2^7.

26
EDFBSAMEALTSAVE-

Sets c1 to c0, but first saves the old value of c1 into the savelist of c0. Equivalent to c1 SAVE SAMEALT.

26
CF00STIXx b l - b'Stores a signed l-bit integer x into b for 0 <= l <= 257.26
BBLEQx y - x<=y18
AAcc[cc+1] LSHIFT#x - x*2^(cc+1)0 <= cc <= 25526
E8WHILEc' c - Executes c' and pops an integer x from the resulting stack. If x is zero, exists the loop and transfers control to the original cc. If x is non-zero, executes c, and then begins a new iteration.18
EDAic[i] SAVE c[i] SAVECTRSaves the current value of c(i) into the savelist of continuation c0. If an entry for c[i] is already present in the savelist of c0, nothing is done. Equivalent to c[i] PUSHCTR c[i] SETRETCTR.26
5ASWAP2 2SWAPa b c d - c d a bEquivalent to 2 2 BLKSWAP or to s3 s2 XCHG2.18
D8EXECUTE CALLXc - Calls, or executes, continuation c.18
6F2n[n] UNTUPLEt - x_1 ... x_n

Unpacks a Tuple t=(x_1,...,x_n) of length equal to 0 <= n <= 15. If t is not a Tuple, or if |t| != n, a type check exception is thrown.

26+n
A9B4tt[tt+1] MULRSHIFT#x y - floor(x*y/2^(tt+1))34
FEij{i*16+j} DEBUG-26
E300[ref] IFREFf -

Equivalent to PUSHREFCONT IF, with the optimization that the cell reference is not actually loaded into a Slice and then converted into an ordinary Continuation if f=0. Gas consumption of this primitive depends on whether f=0 and whether the reference was loaded before. Similar remarks apply other primitives that accept a continuation as a reference.

26/126/51
8A[ref] PUSHREFCONT- contSimilar to PUSHREFSLICE, but makes a simple ordinary Continuation out of the cell.118/43
6F1k[k] INDEXt - x

Returns the k-th element of a Tuple t. 0 <= k <= 15.

26
A984MULDIVx y z - qq=floor(x*y/z)26
89[ref] PUSHREFSLICE- sSimilar to PUSHREF, but converts the cell into a Slice.118/43
BDNEQx y - x!=yEquivalent to EQUAL NOT.18
ABcc[cc+1] RSHIFT#x - floor(x/2^(cc+1))0 <= cc <= 25518
F417DICTUSETREFc i D n - D'Similar to DICTISETREF, but with i unsigned.
CF01STUXx b l - b'Stores an unsigned l-bit integer x into b for 0 <= l <= 256.26
A6cc[cc] ADDCONST [cc] ADDINT [-cc] SUBCONST [-cc] SUBINTx - x+cc-128 <= cc <= 127.26
F443DICTUSETBb i D n - D'
B608MINx y - x or yComputes the minimum of two integers x and y.26
66TUCKa b - b a bEquivalent to SWAP OVER or to s1 s1 XCPU.18
5CDUP2 2DUPa b - a b a bEquivalent to s1 s0 PUSH2.18
E1IFNOTJMPf c - Jumps to c (similarly to JMPX), but only if f is zero.18
F40ADICTGETk D n - x -1 or 0

Looks up key k (represented by a Slice, the first 0 <= n <= 1023 data bits of which are used as a key) in dictionary D of type HashmapE(n,X) with n-bit keys. On success, returns the value found as a Slice x.

E30F[ref] [ref] IFREFELSEREFf -Equivalent to PUSHREFCONT PUSHREFCONT IFELSE.126/51
546ijks[i] s[j-1] s[k-2] PU2XCEquivalent to s[i] PUSH SWAP s[j] s[k-1] PUXC.34
F40FDICTUGETREFi D n - c -1 or 0Similar to DICTIGETREF, but with an unsigned n-bit Integer key i.
543ijks[i] s[j] s[k] XCPU2Equivalent to s[i] XCHG0 s[j] s[k] PUSH2.34
6FA5NULLSWAPIFNOT2x - x or null null x

Pushes two nulls under the topmost Integer x, but only if x=0. Equivalent to NULLSWAPIFNOT NULLSWAPIFNOT.

26
A985MULDIVRx y z - q'q'=round(x*y/z)26
E30E[ref] IFELSEREFf c -Equivalent to PUSHREFCONT IFELSE.26/126/51
DCIFRET IFNOT:f - Performs a RET, but only if integer f is non-zero. If f is a NaN, throws an integer overflow exception.18
DFIFNOTf c - Executes continuation c, but only if integer f is zero. Otherwise simply discards both values.18
F836GETGASFEEgas_used is_mc - priceCalculates gas fee
E4REPEATn c -

Executes continuation c n times, if integer n is non-negative. If n>=2^31 or n<-2^31, generates a range check exception. Notice that a RET inside the code of c works as a continue, not as a break. One should use either alternative (experimental) loops or alternative RETALT (along with a SETEXITALT before the loop) to break out of a loop.

18
CF31BBITSb - xReturns the number of data bits already stored in Builder b.26
FB02RAWRESERVEx y - Creates an output action which would reserve exactly x nanograms (if y=0), at most x nanograms (if y=2), or all but x nanograms (if y=1 or y=3), from the remaining balance of the account. It is roughly equivalent to creating an outbound message carrying x nanograms (or b-x nanograms, where b is the remaining balance) to oneself, so that the subsequent output actions would not be able to spend more money than the remainder. Bit +2 in y means that the external action does not fail if the specified amount cannot be reserved; instead, all remaining balance is reserved. Bit +8 in y means x:=-x before performing any further actions. Bit +4 in y means that x is increased by the original balance of the current account (before the compute phase), including all extra currencies, before performing any other checks and actions. Currently x must be a non-negative integer, and y must be in the range 0...15.526
544ijks[i] s[j-1] s[k-1] PUXC2Equivalent to s[i] PUSH s2 XCHG0 s[j] s[k] XCHG2.34
ED6ic[i] SETCONT c[i] SETCONTCTRx c - c'Stores x into the savelist of continuation c as c(i), and returns the resulting continuation c'. Almost all operations with continuations may be expressed in terms of SETCONTCTR, POPCTR, and PUSHCTR.26
CF17STBR BCONCATb b' - b''

Concatenates two builders. Equivalent to SWAP STB.

26
D74ASREFSs - rReturns the number of references in Slice s.26
F416DICTUSETx i D n - D'Similar to DICTISET, but with i an unsigned n-bit integer.
F80FCOMMIT-Commits the current state of registers c4 (''persistent data'') and c5 (''actions'') so that the current execution is considered ''successful'' with the saved values even if an exception is thrown later.26
A7cc[cc] MULCONST [cc] MULINTx - x*cc-128 <= cc <= 127.26
F2F2THROWANYIFn f - Throws exception 0 <= n < 2^16 with parameter zero only if f!=0.26/76
F815ADDRAND RANDOMIZEx - Mixes unsigned 256-bit Integer x into the random seed r by setting the random seed to Sha of the concatenation of two 32-byte strings: the first with the big-endian representation of the old seed r, and the second with the big-endian representation of x.26
88[ref] PUSHREF- c

Pushes the reference ref into the stack. Details: Pushes the first reference of cc.code into the stack as a Cell (and removes this reference from the current continuation).

18
F405PLDDICT PLDOPTREFs - D

Preloads a dictionary D from Slice s. Approximately equivalent to LDDICT DROP.

26
F833CONFIGOPTPARAMi - c^?

Returns the value of the global configuration parameter with integer index i as a Maybe Cell c^?. Equivalent to CONFIGDICT DICTIGETOPTREF.

A5DECx - x-1Equivalent to -1 ADDCONST.18
F2C4_n[n] THROW- 0 nnFor 0 <= n < 2^11, an encoding of [n] THROW for larger values of n.84
6F8CTPUSH COMMAt x - t'Appends a value x to a Tuple t=(x_1,...,x_n), but only if the resulting Tuple t'=(x_1,...,x_n,x) is of length at most 255. Otherwise throws a type check exception.26+|t'|
F838GETFORWARDFEEcells bits is_mc - priceCalculates forward fee.
5Eij[i+2] [j] REVERSEReverses the order of s[j+i+1] ... s[j].26
F486DICTUMIND n - x i -1 or 0Similar to DICTMIN, but returns the key as an unsigned n-bit Integer i.
6F88TLENt - nReturns the length of a Tuple.26
F46BDICTUGETOPTREFi D n - c^?DICTGETOPTREF, but with i an unsigned n-bit integer. If the key i is out of range, also returns Null.
F45BDICTUDELi D n - D' ?Similar to DICTIDEL, but with i an unsigned n-bit integer.
A908MODx y - r26
C701SDEMPTYs - ?Checks whether Slice s has no bits of data.26
A938tt[tt+1] MODPOW2#x - x mod 2^(tt+1)34
F466DICTUDELGETi D n - D' x -1 or D 0DICTDELGET, but with i an unsigned n-bit integer.
F811RANDy - z

Generates a new pseudo-random integer z in the range 0...y-1 (or y...-1, if y<0). More precisely, an unsigned random value x is generated as in RAND256U; then z:=floor(x*y/2^256) is computed. Equivalent to RANDU256 256 MULRSHIFT.

26+|c7|+|c1_1|
B609MAXx y - x or yComputes the maximum of two integers x and y.26
D6cc[cc+1] LDSLICEs - s'' s'Cuts the next cc+1 bits of s into a separate Slice s''.26
F401SKIPDICT SKIPOPTREFs - s'Equivalent to LDDICT NIP.26
F810RANDU256- xGenerates a new pseudo-random unsigned 256-bit Integer x. The algorithm is as follows: if r is the old value of the random seed, considered as a 32-byte array (by constructing the big-endian representation of an unsigned 256-bit integer), then its sha512(r) is computed; the first 32 bytes of this hash are stored as the new value r' of the random seed, and the remaining 32 bytes are returned as the next random value x.26+|c7|+|c1_1|
EDF1COMPOSALT BOOLORc c' - c''Computes the alternative composition compose1(c, c'), which has the meaning of ''perform c, and, if not successful, perform c''' (if c is a boolean circuit). Equivalent to SWAP c1 SETCONT.26
F2FFTRYc c' - Sets c2 to c', first saving the old value of c2 both into the savelist of c' and into the savelist of the current continuation, which is stored into c.c0 and c'.c0. Then runs c similarly to EXECUTE. If c does not throw any exceptions, the original value of c2 is automatically restored on return from c. If an exception occurs, the execution is transferred to c', but the original value of c2 is restored in the process, so that c' can re-throw the exception by THROWANY if it cannot handle it by itself.26
F22_n[n] THROW - 0 n

Throws exception 0 <= n <= 63 with parameter zero. In other words, it transfers control to the continuation in c2, pushing 0 and n into its stack, and discarding the old stack altogether.

76
D70Acc[cc+1] PLDIs - xPreloads a signed cc+1-bit integer from Slice s.34
F441DICTSETBb k D n - D'
F902SHA256Us - xComputes Sha of the data bits of Slice s. If the bit length of s is not divisible by eight, throws a cell underflow exception. The hash value is returned as a 256-bit unsigned integer x.26
5DOVER2 2OVERa b c d - a b c d a bEquivalent to s3 s2 PUSH2.18
FA03STVARINT16b x - b'Similar to STVARUINT16, but serializes a signed Integer x in the range -2^119...2^119-1.26
AEPOW2y - 2^y

0 <= y <= 1023 Equivalent to ONE SWAP LSHIFT.

18
F47CDICTUGETNEXTi D n - x' i' -1 or 0Similar to DICTGETNEXT, but interprets all keys in dictionary D as big-endian unsigned n-bit integers, and computes the minimal key i' that is larger than Integer i (which does not necessarily fit into n bits, and is not necessarily non-negative).
ED11SETCONTVARARGSx_1 x_2...x_r c r n - c'Similar to SETCONTARGS, but with 0 <= r <= 255 and -1 <= n <= 255 taken from the stack.26+s''
FB04SETCODEc - Creates an output action that would change this smart contract code to that given by Cell c. Notice that this change will take effect only after the successful termination of the current run of the smart contract.526
F83AGETORIGINALFWDFEEfwd_fee is_mc - orig_fwd_feeCalculate fwd_fee * 2^16 / first_frac. Can be used to get the original fwd_fee of the message.
C702SREMPTYs - ?Checks whether Slice s has no references.26
DB0p[p] -1 CALLXARGSc - Calls continuation c with 0 <= p <= 15 parameters, expecting an arbitrary number of return values.26
E303[ref] IFNOTJMPREFf - Equivalent to PUSHREFCONT IFNOTJMP.26/126/51
D719PLDSLICEXs l - s''Returns the first 0 <= l <= 1023 bits of s as s''.26
F801SETGASLIMITg - Sets current gas limit g_l to the minimum of g and g_m, and resets the gas credit g_c to zero. If the gas consumed so far (including the present instruction) exceeds the resulting value of g_l, an (unhandled) out of gas exception is thrown before setting new gas limits. Notice that SETGASLIMIT with an argument g >= 2^63-1 is equivalent to ACCEPT.26
6F81INDEXVARt k - xSimilar to k INDEX, but with 0 <= k <= 254 taken from the stack.26
CF40STZEROESb n - b'Stores n binary zeroes into Builder b.26
D701LDUXs l - x s'Loads an unsigned l-bit integer x from (the first l bits of) s, with 0 <= l <= 256.26
A906DIVCx y - q''q''=ceil(x/y), r''=x-y*q''26
CESTSLICEs b - b'Stores Slice s into Builder b.18
F12_n[n] CALL [n] CALLDICT- nFor 0 <= n < 2^14, an encoding of [n] CALL for larger values of n.
D736SPLITs l r - s' s''Splits the first 0 <= l <= 1023 data bits and first 0 <= r <= 4 references from s into s', returning the remainder of s as s''.26
FA46REWRITEVARADDRs - x s'A variant of REWRITESTDADDR that returns the (rewritten) address as a Slice s, even if it is not exactly 256 bit long (represented by a msg_addr_var).26
F911CHKSIGNSd s k - ?Checks whether s is a valid Ed25519-signature of the data portion of Slice d using public key k, similarly to CHKSIGNU. If the bit length of Slice d is not divisible by eight, throws a cell underflow exception. The verification of Ed25519 signatures is the standard one, with Sha used to reduce d to the 256-bit number that is actually signed.26
F941CDATASIZEc n - x y zA non-quiet version of CDATASIZEQ that throws a cell overflow exception (8) on failure.
B60BABSx - |x|Computes the absolute value of an integer x.26
FA01LDVARINT16s - x s'

Similar to LDVARUINT16, but loads a signed Integer x. Approximately equivalent to 4 LDU SWAP 3 LSHIFT# LDIX.

26
D700LDIXs l - x s'Loads a signed l-bit (0 <= l <= 257) integer x from Slice s, and returns the remainder of s as s'.26
A986MULDIVCx y z - q'q'=ceil(x*y/z)26
F48EDICTUMAXD n - x i -1 or 0Similar to DICTMAX, but returns the key as an unsigned n-bit Integer i.
F93010BLS_G1_ADDx y - x+yAddition on G1.3934
F93013BLS_G1_MULx s - x*sMultiplies G1 point x by scalar s. Any s is valid, including negative.5234
F48FDICTUMAXREFD n - c i -1 or 0Similar to DICTUMAX, but returns the only reference in the value.
C70BSDPPFXREVs s' - ?Checks whether s' is a proper prefix of s.26
F837GETSTORAGEFEEcells bits seconds is_mc - priceCalculates storage fees (only current StoragePrices entry is used).
D723SDSKIPLASTs l - s'Returns all but the last 0 <= l <= 1023 bits of s.26
F90403HASHEXT_KECCAK256s_1 ... s_n n - hCalculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/11 gas per byte
D722SDCUTLASTs l - s'Returns the last 0 <= l <= 1023 bits of s.26
A90CDIVMODx y - q r26
F453DICTUADDBb i D n - D' -1 or D 0
F4A6_n[ref] [n] DICTPUSHCONST - D nPushes a non-empty constant dictionary D (as a Cell^?) along with its key length 0 <= n <= 1023, stored as a part of the instruction. The dictionary itself is created from the first of remaining references of the current continuation. In this way, the complete DICTPUSHCONST instruction can be obtained by first serializing xF4A4_, then the non-empty dictionary itself (one 1 bit and a cell reference), and then the unsigned 10-bit integer n (as if by a STU 10 instruction). An empty dictionary can be pushed by a NEWDICT primitive instead.34
ED1EBLESSs - cTransforms a Slice s into a simple ordinary continuation c, with c.code=s and an empty stack and savelist.26
F940CDATASIZEQc n - x y z -1 or 0Recursively computes the count of distinct cells x, data bits y, and cell references z in the dag rooted at Cell c, effectively returning the total storage used by this dag taking into account the identification of equal cells. The values of x, y, and z are computed by a depth-first traversal of this dag, with a hash table of visited cell hashes used to prevent visits of already-visited cells. The total count of visited cells x cannot exceed non-negative Integer n; otherwise the computation is aborted before visiting the (n+1)-st cell and a zero is returned to indicate failure. If c is Null, returns x=y=z=0.
D74BSBITREFSs - l rReturns both the number of data bits and the number of references in s.26
D5LDREFRTOSs - s' s''Equivalent to LDREF SWAP CTOS.118/43
F839GETPRECOMPILEDGAS- xReturns gas usage for the current contract if it is precompiled, null otherwise.
D724SDSUBSTRs l l' - s'Returns 0 <= l' <= 1023 bits of s starting from offset 0 <= l <= 1023, thus extracting a bit substring out of the data of s.26
CF13STBb' b - b''Appends all data from Builder b' to Builder b.26
F487DICTUMINREFD n - c i -1 or 0Similar to DICTUMIN, but returns the only reference in the value.
F83CGETFORWARDFEESIMPLEcells bits is_mc - priceSame as GETFORWARDFEE, but without lump price (just (bits*bit_price + cells*cell_price) / 2^16).
F4A1DICTUGETJMPi D n - Similar to DICTIGETJMP, but performs DICTUGET instead of DICTIGET.
D739XCTOSc - s ?Transforms an ordinary or exotic cell into a Slice, as if it were an ordinary cell. A flag is returned indicating whether c is exotic. If that be the case, its type can later be deserialized from the first eight bits of s.
F40DDICTIGETREFi D n - c -1 or 0Combines DICTIGET with DICTGETREF: it uses signed n-bit Integer i as a key and returns a Cell instead of a Slice on success.
F807GASCONSUMED- g_cReturns gas consumed by VM so far (including this instruction).26
DApr[p] [r] CALLXARGSc -

Calls continuation c with p parameters and expecting r return values 0 <= p <= 15, 0 <= r <= 15

26
F40CDICTIGETi D n - x -1 or 0Similar to DICTGET, but with a signed (big-endian) n-bit Integer i as a key. If i does not fit into n bits, returns 0. If i is a NaN, throws an integer overflow exception.
F4A8PFXDICTGETQs D n - s' x s'' -1 or s 0Looks up the unique prefix of Slice s present in the prefix code dictionary represented by Cell^? D and 0 <= n <= 1023. If found, the prefix of s is returned as s', and the corresponding value (also a Slice) as x. The remainder of s is returned as a Slice s''. If no prefix of s is a key in prefix code dictionary D, returns the unchanged s and a zero flag to indicate failure.
F814SETRANDx - Sets the random seed to unsigned 256-bit Integer x.26+|c7|+|c1_1|
F47FDICTUGETPREVEQi D n - x' i' -1 or 0Similar to DICTGETPREVEQ, but interprets keys a unsigned n-bit integers.
B2XORx y - x xor yBitwise xor of two integers.18
F912ECRECOVERhash v r s - 0 or h x1 x2 -1Recovers the public key from a secp256k1 signature, identical to Bitcoin/Ethereum operations. Takes a 32-byte hash as uint256 hash and a 65-byte signature as uint8 v, uint256 r, and uint256 s. In TON, the v value is strictly 0 or 1; no extra flags or extended values are supported. If the public key cannot be recovered, the instruction returns 0. On success, it returns the recovered 65-byte public key as uint8 h, uint256 x1, and uint256 x2, followed by -1.1526
E301[ref] IFNOTREFf - Equivalent to PUSHREFCONT IFNOT.26/126/51
F46ADICTIGETOPTREFi D n - c^?DICTGETOPTREF, but with i a signed n-bit integer. If the key i is out of range, also returns Null.
F482DICTMIND n - x k -1 or 0Computes the minimal key k (represented by a Slice with n data bits) in dictionary D, and returns k along with the associated value x.
F40BDICTGETREFk D n - c -1 or 0

Similar to DICTGET, but with a LDREF ENDS applied to x on success. This operation is useful for dictionaries of type HashmapE(n,^Y).

F470PFXDICTSETx k D n - D' -1 or D 0
A98CMULDIVMODx y z - q rq=floor(x*y/z), r=x*y-z*q26
D703PLDUXs l - xPreloads an unsigned l-bit integer from s, for 0 <= l <= 256.26
6F8DTPOPt - t' xDetaches the last element x=x_n from a non-empty Tuple t=(x_1,...,x_n), and returns both the resulting Tuple t'=(x_1,...,x_{n-1}) and the original last element x.26+|t'|
F93012BLS_G1_NEGx - -xNegation on G1.784
F93030BLS_PAIRINGx_1 y_1 ... x_n y_n n - boolGiven G1 points x_i and G2 points y_i, calculates and multiply pairings of x_i,y_i. Returns true if the result is the multiplicative identity in FP12, false otherwise. Returns false if n=0.20034+n*11800
B603UBITSIZEx - cComputes smallest c >= 0 such that x fits into a c-bit unsigned integer (0 <= x < 2^c), or throws a range check exception.26
D9JMPXc -

Jumps, or transfers control, to continuation c. The remainder of the previous current continuation cc is discarded.

18
F4A0DICTIGETJMPi D n - Similar to DICTIGET, but with x BLESSed into a continuation with a subsequent JMPX to it on success. On failure, does nothing. This is useful for implementing switch/case constructions.
F44BDICTUREPLACEBb i D n - D' -1 or D 0
F1A_n[n] PREPARE [n] PREPAREDICT - n c

Equivalent to n PUSHINT c3 PUSHCTR, for 0 <= n < 2^14. In this way, [n] CALL is approximately equivalent to [n] PREPARE EXECUTE, and [n] JMP is approximately equivalent to [n] PREPARE JMPX. One might use, for instance, CALLXARGS or CALLCC instead of EXECUTE here.

F415DICTISETREFc i D n - D'Similar to DICTSETREF, but with the key a signed n-bit integer as in DICTISET.
C704SDLEXCMPs s' - xCompares the data of s lexicographically with the data of s', returning -1, 0, or 1 depending on the result.26
F90400HASHEXT_SHA256s_1 ... s_n n - hCalculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/33 gas per byte
F496DICTUREMMIND n - D' x i -1 or D 0Similar to DICTREMMIN, but returns the key as an unsigned n-bit Integer i.
F41EDICTUSETGETx i D n - D' y -1 or D' 0DICTISETGET, but with i an unsigned n-bit integer.
F497DICTUREMMINREFD n - D' c i -1 or D 0Similar to DICTUREMMIN, but returns the only reference in the value.
FA42PARSEMSGADDRs - tDecomposes Slice s containing a valid MsgAddress into a Tuple t with separate fields of this MsgAddress. If s is not a valid MsgAddress, a cell deserialization exception is thrown.26
6F85SETINDEXVARt x k - t'Similar to k SETINDEX, but with 0 <= k <= 254 taken from the stack.26+|t'|
00NOP-Does nothing.18
6F84EXPLODEVARt n - x_1 ... x_m mSimilar to n EXPLODE, but with 0 <= n <= 255 taken from the stack.26+m
D765CDEPTHc - xReturns the depth of Cell c. If c has no references, then x=0; otherwise x is one plus the maximum of depths of cells referred to from c. If c is a Null instead of a Cell, returns zero.26
FA41LDMSGADDRQs - s' s'' -1 or s 0A quiet version of LDMSGADDR: on success, pushes an extra -1; on failure, pushes the original s and a zero.26
B601UFITSXx c - xChecks whether x is a c-bit unsigned integer for 0 <= c <= 1023.26/76
ACLSHIFTx y - x*2^y0 <= y <= 102318
F943SDATASIZEs n - x y zA non-quiet version of SDATASIZEQ that throws a cell overflow exception (8) on failure.
A935tt[tt+1] RSHIFTR#x - round(x/2^(tt+1))34
CFC0_xysss[slice] STSLICECONSTb - b'

Stores a constant subslice sss. Details: sss consists of 0 <= x <= 3 references and up to 8y+2 data bits, with 0 <= y <= 7. Completion bit is assumed. Note that the assembler can replace STSLICECONST with PUSHSLICE STSLICER if the slice is too big.

24
FB06SETLIBCODEc x - Creates an output action that would modify the collection of this smart contract libraries by adding or removing library with code given in Cell c. If x=0, the library is actually removed if it was previously present in the collection (if not, this action does nothing). If x=1, the library is added as a private library, and if x=2, the library is added as a public library (and becomes available to all smart contracts if the current smart contract resides in the masterchain); if the library was present in the collection before, its public/private status is changed according to x. Values of x other than 0...2 are invalid.526
C4ISNANx - x=NaNChecks whether x is a NaN.18
F83400PREVMCBLOCKS- tRetrives last_mc_blocks part of PrevBlocksInfo from c7 (parameter 13).
83FFPUSHNAN- NaNPushes a NaN.26
6F5k[k] SETINDEXt x - t'

Computes Tuple t' that differs from t only at position t'_{k+1}, which is set to x. 0 <= k <= 15 If k >= |t|, throws a range check exception.

26+|t|
F47EDICTUGETPREVi D n - x' i' -1 or 0Similar to DICTGETPREV, but interprets keys as unsigned n-bit integers.
F484DICTIMIND n - x i -1 or 0Similar to DICTMIN, but computes the minimal key i under the assumption that all keys are big-endian signed n-bit integers. Notice that the key and value returned may differ from those computed by DICTMIN and DICTUMIN.
6F89QTLENt - n or -1Similar to TLEN, but returns -1 if t is not a Tuple.26
FB08SENDMSGc x - feeCreates an output action and returns a fee for creating a message. Mode has the same effect as in the case of SENDRAWMSG. Additionally +1024 means - do not create an action, only estimate fee. Other modes affect the fee calculation as follows: +64 substitutes the entire balance of the incoming message as an outcoming value (slightly inaccurate, gas expenses that cannot be estimated before the computation is completed are not taken into account), +128 substitutes the value of the entire balance of the contract before the start of the computation phase (slightly inaccurate, since gas expenses that cannot be estimated before the completion of the computation phase are not taken into account).526
F436DICTUADDx i D n - D' -1 or D 0DICTADD, but with i an unsigned n-bit integer.
E308IFRETALTf -Performs RETALT if integer f!=0.26
F83401PREVKEYBLOCK- tRetrives prev_key_block part of PrevBlocksInfo from c7 (parameter 13).
A9B5tt[tt+1] MULRSHIFTR#x y - round(x*y/2^(tt+1))34
F414DICTISETx i D n - D'Similar to DICTSET, but with the key represented by a (big-endian) signed n-bit integer i. If i does not fit into n bits, a range check exception is generated.
F469DICTGETOPTREFk D n - c^?A variant of DICTGETREF that returns Null instead of the value c^? if the key k is absent from dictionary D.
BFCMPx y - sgn(x-y)

Computes the sign of x-y: -1 if x<y, 0 if x=y, 1 if x>y. No integer overflow can occur here unless x or y is a NaN.

18
F924RIST255_MULx n - x*nMultiplies point x by a scalar n. Any n is valid, including negative.2026
D720SDCUTFIRSTs l - s'Returns the first 0 <= l <= 1023 bits of s. It is equivalent to PLDSLICEX.26
D764SDEPTHs - xReturns the depth of Slice s. If s has no references, then x=0; otherwise x is one plus the maximum of depths of cells referred to from s.26
CF41STONESb n - b'Stores n binary ones into Builder b.26
F90600HASHEXTA_SHA256b s_1 ... s_n n - b'Calculates hash of the concatenation of slices (or builders) s_1...s_n. Appends the resulting hash to a builder b.1/33 gas per byte
F925RIST255_MULBASEn - g*nMultiplies the generator point g by a scalar n. Any n is valid, including negative.776
F840GETGLOBVARk - x

Returns the k-th global variable for 0 <= k < 255. Equivalent to c7 PUSHCTR SWAP INDEXVARQ.

26
F45ADICTIDELi D n - D' ?A version of DICTDEL with the key represented by a signed n-bit Integer i. If i does not fit into n bits, simply returns D 0 (''key not found, dictionary unmodified'').
D72E_xsss[slice] SDBEGINSQs - s'' -1 or s 0A quiet version of SDBEGINS.31
D732SCUTLASTs l r - s'Returns the last 0 <= l <= 1023 data bits and last 0 <= r <= 4 references of s.26
F467DICTUDELGETREFi D n - D' c -1 or D 0DICTDELGETREF, but with i an unsigned n-bit integer.
F407PLDDICTQs - D -1 or 0A quiet version of PLDDICT.26
F462DICTDELGETk D n - D' x -1 or D 0Deletes n-bit key, represented by a Slice k, from dictionary D. If the key is present, returns the modified dictionary D', the original value x associated with the key k (represented by a Slice), and the success flag -1. Otherwise, returns the original dictionary D and 0.
F83BGETGASFEESIMPLEgas_used is_mc - priceSame as GETGASFEE, but without flat price (just (gas_used * price) / 2^16).
A936tt[tt+1] RSHIFTC#x - ceil(x/2^(tt+1))34
C709SDPFXREVs s' - ?Checks whether s' is a prefix of s, equivalent to SWAP SDPFX.26
B7A8QMULx y - x*y26
B7A98CQMULDIVMODx y z - q r34
F478DICTIGETNEXTi D n - x' i' -1 or 0Similar to DICTGETNEXT, but interprets all keys in dictionary D as big-endian signed n-bit integers, and computes the minimal key i' that is larger than Integer i (which does not necessarily fit into n bits).
F412DICTSETx k D n - D'Sets the value associated with n-bit key k (represented by a Slice as in DICTGET) in dictionary D (also represented by a Slice) to value x (again a Slice), and returns the resulting dictionary as D'.
D751LDULE4s - x s'Loads a little-endian unsigned 32-bit integer.26
F413DICTSETREFc k D n - D'Similar to DICTSET, but with the value set to a reference to Cell c.
F437DICTUADDREFc i D n - D' -1 or D 0DICTADDREF, but with i an unsigned n-bit integer.
F835GLOBALID- iRetrieves global_id from 19 network config.
C713SDCNTTRAIL1s - nReturns the number of trailing ones in s.26
CF11STBREFb' b - b''Equivalent to SWAP STBREFR.526
DB35JMPXDATAc - Similar to CALLCC, but the remainder of the current continuation (the old value of cc) is converted into a Slice before pushing it into the stack of c.26
CF23ENDXCb x - c

If x!=0, creates a special or exotic cell from Builder b. The type of the exotic cell must be stored in the first 8 bits of b. If x=0, it is equivalent to ENDC. Otherwise some validity checks on the data and references of b are performed before creating the exotic cell.

526
A9D6tt[tt+1] LSHIFT#DIVCx y - ceil(2^(tt+1)*x/y)26
F90401HASHEXT_SHA512s_1 ... s_n n - h1 h2Calculates and returns hash of the concatenation of slices (or builders) s_1...s_n.1/16 gas per byte
F920RIST255_FROMHASHh1 h2 - xDeterministically generates a valid point x from a 512-bit hash (given as two 256-bit integers).626
F926RIST255_PUSHL- lPushes integer l=2^252+27742317777372353535851937790883648493, which is the order of the group.26
F923RIST255_SUBx y - x-ySubtraction of two points on curve.626
F485DICTIMINREFD n - c i -1 or 0Similar to DICTIMIN, but returns the only reference in the value.
D714_c[32(c+1)] PLDUZs - s xPreloads the first 32(c+1) bits of Slice s into an unsigned integer x, for 0 <= c <= 7. If s is shorter than necessary, missing bits are assumed to be zero. This operation is intended to be used along with IFBITJMP and similar instructions.26
F4BCDICTIGETJMPZi D n - i or nothingA variant of DICTIGETJMP that returns index i on failure.
F2CC_n[n] THROWARGx - x nnThrows exception 0 <= n < 2^11 with parameter x, by copying x and n into the stack of c2 and transferring control to c2.84
F435DICTIADDREFc i D n - D' -1 or D 0DICTADDREF, but with i a signed n-bit integer.
8Crxxssss[slice] PUSHSLICE [slice] SLICE- s

Pushes the slice slice into the stack. Details: Pushes the (prefix) subslice of cc.code consisting of its first 1 <= r+1 <= 4 references and up to first 8xx+1 bits of data, with 0 <= xx <= 31. A completion tag is also assumed.

25
F47BDICTIGETPREVEQi D n - x' i' -1 or 0Similar to DICTGETPREVEQ, but interprets keys as signed n-bit integers.
D71Dcc[cc+1] PLDSLICEs - s''Returns the first 0 < cc+1 <= 256 bits of s as s''.34
F451DICTADDBb k D n - D' -1 or D 0
A9D5tt[tt+1] LSHIFT#DIVRx y - round(2^(tt+1)*x/y)34
DB4fffflags RUNVMx_1 ... x_n n code [r] [c4] [c7] [g_l] [g_m] - x'_1 ... x'_m exitcode [data'] [c4'] [c5] [g_c]Runs child VM with code code and stack x_1...x_n. Returns the resulting stack x'_1...x'_m and exitcode. Other arguments and return values are enabled by flags.
A9BDMULRSHIFTR#MODx y - q=round(x*y/2^(tt+1)) r=xy-q*2^(tt+1)34
A9CDLSHIFTDIVMODRx y z - q=round(2^z*x/y) r=2^z*x-q*y26
A925RSHIFTRx y - round(x/2^y)26
B5cc[cc+1] UFITSx - xChecks whether x is a cc+1-bit unsigned integer for 0 <= cc <= 255 (i.e., whether 0 <= x < 2^(cc+1)).26/76
A905DIVRx y - q'q'=round(x/y), r'=x-y*q'26
B8SGNx - sgn(x)

Computes the sign of an integer x: -1 if x<0, 0 if x=0, 1 if x>0.

18
CF0Bcc[cc+1] STURb x - b'Equivalent to SWAP [cc+1] STU.34
D72A_xsss[slice] SDBEGINSs - s''Checks whether s begins with constant bitstring sss of length 8x+3 (with continuation bit assumed), where 0 <= x <= 127, and removes sss from s on success.31
C703SDFIRSTs - ?Checks whether the first bit of Slice s is a one.26
F921RIST255_VALIDATEx -Checks that integer x is a valid representation of some curve point. Throws range_chk on error.226
CF3DBCHKBITSQb x - ?Checks whether x bits can be stored into b, 0 <= x <= 1023.26
F475DICTGETNEXTEQk D n - x' k' -1 or 0Similar to DICTGETNEXT, but computes the minimal key k' that is lexicographically greater than or equal to k.
CF29STULE4x b - b'Stores a little-endian unsigned 32-bit integer.26
F459DICTDELk D n - D' -1 or D 0Deletes n-bit key, represented by a Slice k, from dictionary D. If the key is present, returns the modified dictionary D' and the success flag -1. Otherwise, returns the original dictionary D and 0.
F47DDICTUGETNEXTEQi D n - x' i' -1 or 0Similar to DICTGETNEXTEQ, but interprets keys as unsigned n-bit integers.
E309IFNOTRETALTf -Performs RETALT if integer f=0.26
D705LDUXQs l - x s' -1 or s 0Quiet version of LDUX.26
F48ADICTMAXD n - x k -1 or 0Computes the maximal key k (represented by a Slice with n data bits) in dictionary D, and returns k along with the associated value x.
CF0Acc[cc+1] STIRb x - b'Equivalent to SWAP [cc+1] STI.34
C710SDCNTLEAD0s - nReturns the number of leading zeroes in s.26
EBAGAINEND AGAIN:-Similar to AGAIN, but performed with respect to the current continuation cc.18
F442DICTISETBb i D n - D'
F424DICTIREPLACEx i D n - D' -1 or D 0DICTREPLACE, but with i a signed n-bit integer.
85xx[xx+1] PUSHNEGPOW2- -2^(xx+1)Pushes -2^(xx+1) for 0 <= xx <= 255.26
CF14STREFRb c - b'Equivalent to SWAP STREF.26
F93014BLS_G1_MULTIEXPx_1 s_1 ... x_n s_n n - x_1*s_1+...+x_n*s_nCalculates x_1*s_1+...+x_n*s_n for G1 points x_i and scalars s_i. Returns zero point if n=0. Any s_i is valid, including negative.11409+n*630+n/floor(max(log2(n),4))*8820
FA45REWRITESTDADDRQs - x y -1 or 0A quiet version of primitive REWRITESTDADDR.26
F47ADICTIGETPREVi D n - x' i' -1 or 0Similar to DICTGETPREV, but interprets keys as signed n-bit integers.
F914P256_CHKSIGNUh sig k - ?Checks seck256r1-signature sig of a number h (a 256-bit unsigned integer, usually computed as the hash of some data) and public key k. Returns -1 on success, 0 on failure. Public key is a 33-byte slice (encoded according to Sec. 2.3.4 point 2 of SECG SEC 1). Signature sig is a 64-byte slice (two 256-bit unsigned integers r and s).3526
ECrn[r] [n] SETCONTARGSx_1 x_2...x_r c - c'Pushes 0 <= r <= 15 values x_1...x_r into the stack of (a copy of) the continuation c, starting with x_1. When n is 15 (-1 in Fift notation), does nothing with c.nargs. For 0 <= n <= 14, sets c.nargs to the final size of the stack of c' plus n. In other words, transforms c into a closure or a partially applied function, with 0 <= n <= 14 arguments missing.26+s''
63BLKSWXPops integers i,j from the stack, then performs [i] [j] BLKSWAP.18
6F6k[k] INDEXQt - xReturns the k-th element of a Tuple t, where 0 <= k <= 15. In other words, returns x_{k+1} if t=(x_1,...,x_n). If k>=n, or if t is Null, returns a Null instead of x.26
D73AXLOADc - c'Loads an exotic cell c and returns an ordinary cell c'. If c is already ordinary, does nothing. If c cannot be loaded, throws an exception.