Skip to content

ErgoScript#

Overview#

ErgoScript is a powerful, developer-friendly programming language designed specifically for writing smart contracts on the Ergo blockchain. Think of it as a specialized language that allows you to create complex financial contracts and applications with unprecedented flexibility and security. Designed as a subset of Scala, it allows developers to define complex conditions for spending funds.

ErgoScript code is translated into a lower-level representation called ErgoTree before being stored on the blockchain. During transaction validation, ErgoTree is interpreted using cryptographic protocols based on Sigma Protocols. This unique architecture enables Ergo to support advanced cryptographic functionalities like ring signatures and threshold signatures directly within the scripting language, without requiring special core protocol changes.

Sigma Protocols

Ergo's support for Sigma Protocols (aka generalized Schnorr proofs) is a key feature, providing efficient and composable building blocks for zero-knowledge proofs. Schnorr proofs and proofs of Diffie-Hellman tuples are supported by default, with the potential for the community to add more through soft forks.

ErgoScript builds upon the security principles of Bitcoin while enabling much more complex financial contracts. Unlike Bitcoin Script, ErgoScript supports features necessary for advanced applications, including the ability to reference blockchain state and implement complex logic, effectively enabling Turing-Complete computations through multi-stage contract interactions.

Background Reading
Contract Model Comparison: Ergo (eUTXO) vs. Ethereum (Account)

Paradigm#

The account model (used by Ethereum) is imperative: sending coins involves changing balances in a global storage state. Ergo's eUTXO-based programming model is declarative: ErgoScript contracts specify conditions under which funds (UTXOs) can be spent, rather than dictating state changes.

Scalability#

In the account model, both storage changes and validity checks happen on-chain during contract execution. In Ergo, transactions are typically created off-chain, and only the validation checks occur on-chain. This significantly reduces the computational load on validating nodes. The immutable nature of the transaction graph also allows for various optimizations to improve throughput. Furthermore, Ergo's design facilitates light verifying nodes (via NIPoPoWs), enhancing network scalability and accessibility.

Shared State#

The account-based model relies on a shared mutable state, which can lead to complex interactions and subtle bugs in concurrent systems. Ergo's model, based on Bitcoin's UTXO concept, uses an immutable graph of transactions, which is inherently more suitable for distributed environments and simplifies the development of light clients.

Expressive Power#

While Ethereum's Turing-complete language offers theoretical flexibility, it has practical limitations like blockchain bloat, complex bugs, unpredictable gas costs, and limits on contract complexity. Ergo achieves similar expressive power through its eUTXO model and multi-stage contracts, but intentionally keeps the core ErgoScript language itself non-Turing-complete to enhance security and predictability.

Simple Example

// This script locks funds in a box.
// It allows Alice to spend the funds before block 100,000,
// OR Bob to spend them at or after block 100,000.
{
  (HEIGHT < 100000 && alicePubKey) ||
  (HEIGHT >= 100000 && bobPubKey)
}
(HEIGHT is a context variable representing the current block height. alicePubKey and bobPubKey represent proof of knowledge of their respective secret keys, typically via a signature check).

Key Concepts

Explore the Core Concepts of ErgoScript.

Data Inputs

Ergo offers a unique approach to smart contracts by allowing them to access data from other boxes on the blockchain without spending them, using data inputs. This enables efficient access to shared information like oracle price feeds or DAO parameters.

ErgoScript vs ErgoTree

ErgoScript is the high-level, developer-friendly language. It gets compiled into ErgoTree, a lower-level, serialized representation stored on the blockchain and interpreted by nodes. Explore the distinction here.

Experimenting & Tooling#

While ErgoScript aims for simplicity and security, debugging complex contracts can still be challenging. Currently, developers often rely on manual inspection and testing using the tools below. Tools are emerging to improve this process:

Advanced Patterns & Tutorials#

ErgoScript's features enable the implementation of complex contract patterns:

Common Use Cases#

ErgoScript's flexibility enables various applications:

  • Multi-Signature Wallets: Create wallets requiring multiple parties to approve transactions.
  • Time-Locked Contracts: Define contracts that can only be executed after a specific time or block height.
  • Conditional Spending: Set complex conditions for spending funds based on various parameters (e.g., oracle data, specific inputs).
  • Atomic Swaps: Facilitate trustless peer-to-peer exchange of different assets across blockchains or within Ergo.
  • Crowdfunding: Implement secure and transparent crowdfunding campaigns.
  • Complex Financial Derivatives: Build sophisticated financial instruments on the blockchain.

Best Practices#

  1. Keep contracts simple and readable.
  2. Use built-in cryptographic primitives where possible.
  3. Always consider transaction validation overhead and potential costs.
  4. Test contracts thoroughly using playgrounds and SDK testing frameworks.
  5. Reason carefully about all possible execution paths and potential economic exploits.
  6. Leverage data inputs for accessing shared state efficiently.

Common Pitfalls to Avoid#

  • Overcomplicating contract logic unnecessarily.
  • Ignoring performance implications and transaction costs.
  • Neglecting comprehensive error handling and edge cases in off-chain code interacting with contracts.
  • Not fully understanding the nuances of the eUTXO model (e.g., box lifecycle, state transitions).
  • Insecure handling of secrets or assumptions about context in off-chain components.

Learning Paths & Next Steps#

  1. Beginner:
  2. Intermediate:
  3. Advanced:

Join community discussions on Discord (#ergoscript, #sigma-rust, #appkit, #fleet), Telegram, or the Ergo Forum to ask questions and collaborate.

Advanced Cryptography & Structures#

ErgoScript's foundation on Sigma Protocols allows for powerful cryptographic primitives. However, some advanced structures have specific considerations:

  • Merkle Trees: While Merkle Trees are fundamental to Ergo's data integrity (e.g., for transactions and extension data), direct verification of arbitrary Merkle proofs within an ErgoScript contract is not natively supported by a single built-in function. Verification typically happens off-chain or relies on specific protocol designs where roots are checked. The MAST pattern leverages Merkle trees conceptually, often using executeFromVar for on-chain execution of proven branches rather than full proof verification within the script. Developers interested in the general concept and off-chain usage should consult the main Merkle Tree documentation.

Comparative Analysis#

ErgoScript stands out by:

Performance Considerations#