Bitcoin, Explained 73: OP_VAULT

Aaron van Wirdum Live from Utrecht this is Bitcoin,

Sjors Provoost Explained.

Aaron van Wirdum Hey Sjors.

Sjors Provoost What's up?

Aaron van Wirdum So a couple weeks ago we did an episode on the Alexey Petrov trial and before we get into the main episode in the main topic of this episode which is going to be vaults I want to ask you though so you went to the second pro forma this week I was there for a little bit but I had to go halfway you were there for the whole thing I think is there any news for our listeners that I should… Did anything change about the trial Sjors?

Sjors Provoost Not much changed. He still has to wait for another couple months. I think they opened his laptop a few days before that hearing. So they're going to need some time to look into that, I guess.

Aaron van Wirdum Yeah, I think the only new thing that I heard while I was still there was so the prosecutors now suspect that he was himself running a relayer.

Sjors Provoost Yeah, they suspect that and they're denying that. The defense is denying that.

Aaron van Wirdum Oh, Alexei is denying that?

Sjors Provoost Yeah.

Aaron van Wirdum Okay. All right. So that probably happened after I was gone.

Sjors Provoost Probably, yeah.

Aaron van Wirdum Also, it probably doesn't really matter in the scheme of things, right? That's not really why they were after him in the first place.

Sjors Provoost I don't know. I don't know what was in the dossier when they arrested him.

Aaron van Wirdum All right. Well, thanks, Sjors, for that. Final update, you want us to read some boosts as well before we get to the actual topic du jour?

Sjors Provoost Right, let's focus on happy thoughts. Yes, we got one boost from at MRMR or Mr. Mr., I guess. Thumbs up, exclamation mark. And then we got another boost from Mr. At MRMR for also 8,421 sats with the words thumbs up, dot. So one with an exclamation mark and one with a dot.

Aaron van Wirdum Sure. Reading out boosts is not my favorite part of the show. Do we need to keep doing this? Is this paying us enough?

Sjors Provoost Exactly. This is what pays our bills.

Aaron van Wirdum Not mine. When is my paycheck coming, Sjors?

Sjors Provoost I'm sending you the split every couple months because it's too much work. You should just run your own node.

Aaron van Wirdum So you want to keep reading the boosts going forward?

Sjors Provoost Definitely until you run your own node.

Aaron van Wirdum Okay, so that's going to be forever if it has to be a Lightning node. Yeah, that's just false. Let's just get to the topic of the day. Actually, I'm not sure if we're going to discuss vaults in general, or are we going to focus more on OP_VAULT?

Sjors Provoost Yeah, we're going to focus on OP_VAULT, which I think we accidentally spelled in the French way, so hopefully that'll get fixed. And we may cover some vaults in general, but OP_VAULT is a specific proposal by James O’Beirne.

Aaron van Wirdum Wait, so how do you spell vaults, Sjors?

Sjors Provoost Oh, no, actually you spelled it correctly.

Aaron van Wirdum Yeah, I think I did. All right. So yeah, there's a proposal by James O’Beirne, which is a specific type of vault. And I guess, what is a vault in very general terms? Can you explain?

Sjors Provoost I like to describe it as a method to give you a undo button, at least temporarily. For a Bitcoin transaction.

Aaron van Wirdum So it's like RBF.

Sjors Provoost Well, RBF is a very, very short-term undo button. That's true, yes. But with RBF, you can undo, if somebody hacks your keys and you still have your own keys, then they'll make a transaction stealing your coins. You then make another transaction that pays a higher fee with or without the RBF flag, and you keep racing each other that way. But with vaults, in general, the idea is that you'll have more time to do that. And generally also it's less easy for the thief to just keep bidding up the fees.

Aaron van Wirdum Yeah, I will say I think undo is a little bit confusing because that's not really what you're doing with most vault designs.

Sjors Provoost No, I guess with RBF you're really undoing it, but you're effectively undoing the damage. So the way that's done, we'll explain that of course, but the general purpose is that you see a transaction happening, you even see it on the blockchain, but you still have and you didn't want that transaction to happen. But you still have a way to get that money back until a certain time window expires.

Aaron van Wirdum Yeah, well, I think this is a good time to get a little bit more specific. So I think most vault designs, if not all vault designs, I think work in a specific way where you put your coins essentially in what you would call a vault. And then the only way to withdraw it, like withdrawing is a process. And during that process, you have an option to send... These coins that are being potentially so if you see they're being stolen you can send them to another vault that…

Sjors Provoost Or back to the same vault. Yeah exactly. So so the way that would… yeah.

Aaron van Wirdum You say back to the same vault well that would get you in a problem if the thief just does it again right? That's never useful. Right like why would you ever want that? You would always want to send it to a new vault essentially right?

Sjors Provoost Probably. Maybe there's some in-between case where that's okay to send it back. But the general idea how you might do that is first you just send money to an address. You make a private key. You send the money to that address with the private key. And then you create a transaction that sends that money away again from that private key to wherever you want to go. But you're sending that to a special script. And that special script... I guess would have two conditions. One is you can spend it after three months in whatever way you want using your own keys. Or before those three months, there is another script that will send it back. Something like that. Send it to your next vault, I guess. But then how would that be secured?

Aaron van Wirdum Well, I think that's an important concept. Before we get into the details.

Sjors Provoost But then you burn the original private key. That's kind of where the magic happens. You have to burn the original private key so that that private key, the money is now in a place that you cannot spend it from because you don't have the private key. All you have is a pre-signed transaction that then make sure that some other things happen in the future.

Aaron van Wirdum Yeah I just want to establish moving forward we're gonna let's agree on some terms. Because that will make it clear when we're trying to explain things.

Sjors Provoost That sounds boring.

Aaron van Wirdum No this is important, Sjors, this is vital.

Sjors Provoost Okay.

Aaron van Wirdum Okay. So let's say you know a vault a vault is the first thing where you put the money and it's supposed to be kind of safe but then we also have the super vault That's like the backup vault. So the super vaults...

Sjors Provoost I think that's terrible terminology because probably your backup plan, like if everything else fails, is not a vault. It is probably more simple but very secure multisig address.

Aaron van Wirdum Well, that is a super vault then, right?

Sjors Provoost No, because we're using the word vault here to refer to a very specific mechanism.

Aaron van Wirdum No one is using steel boxes here. The multisig thing is super vault, right? Am I, like, why… What do you want to call it?

Sjors Provoost Because we're using the word vault here, not in the sense of the physical box, but in the sense of a mechanism where you can undo the damage. But when you do that, when you invoke this undo function... The money has to go somewhere. And that does not have to be a vault in the same sense that we just defined a vault. It can be any kind of secure setup. But generally the trade-off there is that there is a place where you keep coins that is extremely secure but extremely hard to access. And that's not practical. And you have another place that's a little bit less cold. And that's where your vault is. So your vault is sort of an in-between phase between really a hot wallet and a super cold wallet.

Aaron van Wirdum Right. Well, that's exactly what I want to establish. So we just got to agree on terms, which seems is the hard part at this point.

Sjors Provoost Yeah. You can keep the keys, let's say, in a safe, but not a vault.

Aaron van Wirdum The vault is where you put the money at first. Yeah. And that's kind of the smart contract thing in which we're going to explain.

Sjors Provoost Yeah.

Aaron van Wirdum But then we need to have the super secure backup, which we're calling the super secure backup then.

Sjors Provoost Let's call it the super secure backup.

Aaron van Wirdum Okay. So the idea behind the super secure backup is that it's super secure. And it’s, and it’s, but… The problem, though, is that it's so secure that it's actually kind of hard to use. So, for example, you have a multisig setup. You have several cold keys that are stored in different actual vaults in different countries. So it's super secure, but you can't actually use it day-to -day. So that's why it's a super secure backup.

Sjors Provoost And I think the context that most of the James O’Beirne paper was written for was if you're an exchange. Because an exchange tends to have a hot wallet, which they need to use to pay customers quite quickly, but there's a lot of money in it. So they really have this issue where they want to be able to pay their customers quickly, but they're also sitting on a lot of money that they don't want to get stolen, and maybe they only realize it's stolen when it's too late, and they want some sort of undo button. But they may also have access to a bunch of safes in the Arctic. It's just that if they ever have to send the money there... Their hot wallet is going to be empty and they have to wait three months to send some guy on a private jet. So they don't want to use the option, but they want to have the option because it's better than losing the money.

Aaron van Wirdum Yeah I think your point there is if you are an individual that's just stacking sats and doesn't really use Bitcoin you know other for other than storing your wealth You kind of only need the super secure backup you didn't you don't really need to vault because you're not…

Sjors Provoost Maybe it depends on your lifestyle maybe you have a super secure backup where you keep like billions of dollars and then you have a vault that you use just if you need to buy a Lambo or something like that, like the casual but still pretty high expenses, and then you also have a Lightning hot wallet that you use for ice cream. I mean, it just depends.

Aaron van Wirdum Okay, we're getting super lost in the terminology.

Sjors Provoost But what I would want to say is that vaults are not useful for daily transactions, I think. They're too tedious, even the ones that we're going to explain.

Aaron van Wirdum Sure, I'm still trying to establish, but I think there are three important parts of the terminology we need to establish. I think vaults we've established. That's a smart contract thing we're going to explain. Then we've got a super secure backup, and then you've got the actual hot wallet. Well, I guess these aren't used in the James O’Beirne version.

Sjors Provoost No, that last ingredient does not exist. So it's interesting to say that normally it does, or at least in the other concepts. So there's indeed, like you said, a hot wallet that... What you would do is you take money out of the vault and then instead of sending it wherever you want to send it you first have to put it in a hot wallet.

Aaron van Wirdum Your own hot wallet. Yeah.

Sjors Provoost Yeah. And that hot wallet or I guess doesn't… well let's just assume it's a hot wallet. You have to… with previous designs you have to decide in advance what that hot wallet is and that's what you can send it to

Aaron van Wirdum And then you mean the address, most obviously right? Yeah yeah.

Sjors Provoost And what's what's the problem with that? It's not very flexible. And it means you have an extra step. It also means that if that hot wallet is compromised, then you can't send it to that hot wallet.

Aaron van Wirdum Yeah, which is especially tricky because you might not know if it is compromised, right?

Sjors Provoost Yeah. Though, of course, the same kind of problem exists with the new proposal. So maybe it's not the most relevant argument. But it's good to point out. The biggest problem with these old vault proposals is that it's just very tedious. But maybe we want to get into that.

Aaron van Wirdum We're getting into your... Sjors, you're getting into weeds and you're skipping ahead of all kinds of explanations.

Sjors Provoost Cool.

Aaron van Wirdum First, I just wanted to establish the terms we're going to use.

Sjors Provoost I think we've done that.

Aaron van Wirdum And I think we've done that. So we've got the vaults, we've got the super sugar backups, and we've got the hot wallets. Even though hot wallets aren't really used in O’Beirne’s thing, but we still want to use the term to explain that it doesn't use the thing.

Sjors Provoost Sounds good.

Aaron van Wirdum Right? Okay. Now you've sort of explained how vaults worked so far. Do you think that was clear enough to move to the next step? I'm still a little bit unsure. So do you want to...

Sjors Provoost Do you want to re-explain it?

Aaron van Wirdum Yeah.

Sjors Provoost We were talking about pre-signed transactions, right?

Aaron van Wirdum Exactly. I can re-explain it real quick and that should hopefully do the trick. So yeah, what previous vault tricks used was you create a transaction that sends money that can be spent in one of two ways. So once this transaction is broadcast, it can either be sent the money can either be sent to the super super secure backup right away or there's a time lock on it and after a while it can be spent to the hot wallet or by the hot wallet.

Sjors Provoost Yeah.

Aaron van Wirdum Right, and like you said the key here pun not intended but the key here is that you delete the key so you create this pre-signed transaction and then you delete the key so from that point on The only way to possibly spend these funds is to broadcast this unbroadcasted transaction. Now you broadcast it and now it can only be spent in two ways. So now if you do that, if you're using the vault, then now you can keep an eye on the blockchain. And if you're just keeping the unsigned transaction for yourself, hopefully kind of secure on your laptop or whatever, whatever you consider secure. But then if your laptop is hacked and the hacker finds this transaction and he broadcasts it. Now you see that it's being broadcast. You see that it ends up on the blockchain, but now you still have like three months to send it to your super secure backup before the hacker can actually take the funds.

Sjors Provoost Exactly. And then I'm assuming that they also compromised your hot wallet, right? If they only find this transaction to get it out of the vault, but not your hot wallet, then I guess your money just goes to your hot wallet and then you move it away. But there is this other condition where you can send it to your super secure setup and you have to get on your private jet and stuff.

Aaron van Wirdum Right. Okay the problem there's a couple of problems with this design but I think they all boil down to more or less the same problem which is you need to pre compute it and pre-sign it.

Sjors Provoost So you need to pre-sign it. You need to make absolutely sure that the the private keys are gone. Because otherwise if somebody does find the private key they can just make another transaction and it does not obey any of the smart contract rules you just thought about and it's very unflexible right you can you can take everything out or not or if you did want to split it you'd have to think about in advance how you would want to split it and make all the pre-signed transactions to do the splitting also in advance so you cannot just say I want to buy this this thing I'm going to send some coins out of my hot or out of the vault but leave some of it in it.

Aaron van Wirdum Yeah I think that's the key word inflexible. You just have to decide beforehand basically everything. Basically all the conditions and the amounts and where it's going which hot water, which hot wallet, everything has to be decided up front but there is a benefit. What's the benefit?

Sjors Provoost It doesn't need a soft fork.

Aaron van Wirdum Yeah right, that's that's a pretty big benefit. Because so… There is a James O’Beirne recently made a proposal called OP_VAULT so that's a soft fork yes and that has the downside arguably at least that it's a soft fork as you mentioned but then it's a lot more flexible that's the main benefit right you can Treat it much more like an actual vault. You can just put anything in it anytime you want, get anything out of it anytime you want. But other than that, the core principle is still the same. If someone tries to steal something from your vault, you'll see it on the blockchain and you'll have time to send it to your super secure backup.

Sjors Provoost Yeah. Do we want to explain this or do we want to explain the other proposals?

Aaron van Wirdum Which other proposals? I was well on my way of explaining this. What other proposals are you thinking of?

Sjors Provoost Well, using OP_CSV or general covenants.

Aaron van Wirdum Oh, yeah.

Sjors Provoost It might be better to explain it after because then we can contrast it.

Aaron van Wirdum Okay, sure. So we're going to go OP_VAULT now. Yeah, let's just... Steamroll ahead with OP_VAULTs at this point.

Sjors Provoost Yeah, so we'll just take, basically, because OP_VAULT is really the simplest proposal, I would say, for a vault, but it is a soft fork, but it is a relatively simple soft fork. And we can get then later to the discussion of why maybe you want a more complicated soft fork, a more general soft fork, rather than this very specific one.

Aaron van Wirdum There are other types of soft forks, especially OP_CTV that could also enable vaults, yeah. Okay, we're going to go to OP_VAULT. Sjors, what's in the OP_VAULT output? We're introducing a new opcode, which is OP_VAULT. What does it mean? What does it require?

Sjors Provoost It is not an output itself, right? So you put it in a script as you would anytime. So when you're creating a Bitcoin address, you're creating a script. And usually what you put on the blockchain is a hash of the script, right? But what the script...

Aaron van Wirdum So when you're putting money in the vault… you're sending money to…

Sjors Provoost You're sending well you're sending money to a Taproot address.

Aaron van Wirdum Yes exactly.

Sjors Provoost So and that Taproot address is a tree and in that tree is a one of the leaves in the tree is a script. Yes and that script has part of that script is the new OP_VAULT opcode right?

Aaron van Wirdum And what else is in there?

Sjors Provoost Yeah exactly so this thing takes two other things or three other things it takes a recovery thing we'll talk about recovery later it takes a time delay argument so it needs to know how many blocks the delay is supposed to be

Aaron van Wirdum Probably blocks or actual time, right?

Sjors Provoost Yeah. Yes, exactly. And it takes the hash of whatever regular script you need to spend from your vault. So presumably you want to, when you use your vault, you also want to use a multisig or a single-sig or whatever you want to do for the normal condition. So you provide a hash of that too. And so then the question is, how do you spend this OP_VAULT thing? That's where OP_UNVAULT comes in. So now you want to take money out of your vault, basically. You create a transaction that says, okay, here is OP_UNVAULT. Then first you're going to...

Aaron van Wirdum So let's say you're spending money to me, okay? You got your money in the vault and I want money from your vault.

Sjors Provoost Yeah.

Aaron van Wirdum And I'm not trying to steal it. You're actually trying to send it to me in this case.

Sjors Provoost Exactly. I'm trying to send it to you.

Aaron van Wirdum So I give you my address, right?

Sjors Provoost Yeah, exactly. Yeah, exactly.

Aaron van Wirdum Okay.

Sjors Provoost But in the first step, I'm not actually using your address, not directly anyway. First, I'm saying OP_UNVAULT, the magic word basically. Then I will satisfy the script that I created earlier. So I have to provide a signature or multiple signatures or whatever script I provided the hash from. And then I have to repeat basically the delay. So that's interesting.

Aaron van Wirdum You just got to repeat how many blocks of delays?

Sjors Provoost Yeah, exactly.

Aaron van Wirdum So if the delay was 100 blocks, you just got to include 100 again?

Sjors Provoost Yeah, but here's the separation.

Aaron van Wirdum It just has to match.

Sjors Provoost Yeah, I think here's where the separation between the input and the output comes in and why it's a magical covenant. So I think on the input, I'm guessing I just have to satisfy the script. I'm not entirely sure, but that's going to be my guess. But on the output, I have to put the unvault opcode. And then I have to repeat the spend delay, as we said. And then I have to say where it's supposed to go. And that is not your address, but the hash of your address in this case that you gave me. So this is really where the magic is starting to happen. Because normally you think if you have an OP_VAULT opcode somewhere, then you can spend that and then it's done. You can do whatever you want. But that's not true. The OP_VAULT code says that you can only spend it if the output of your transaction... Has OP_UNVAULT in it right unless it's the recovery thing.

Aaron van Wirdum So how do I get the money Sjors, because now there's only a hash of my address on the blockchain?

Sjors Provoost Exactly now there's only a hash of your address on the blockchain and there's this mysterious OP_UNVAULT code which probably is also hidden in a [unclear] but that doesn't really matter well the way you spend it the way I spend it is I have to wait for n blocks and then I can create a transaction with no signature Just, I can just take the money. Anybody can take that money, in fact. But there's a, and again, the covenant is putting a restriction on the output side of the transaction saying this can only go to wherever that hash refers to.

Aaron van Wirdum Right.

Sjors Provoost So if I fill in your address, it matches the hash and it goes through. But interestingly, you could have made that transaction too.

Aaron van Wirdum Yeah. So, well, in that case, you would have had to give me the transaction, I guess, right? Would I know what the transaction looks like?

Sjors Provoost You probably would not have been able to guess because you don't know all the details to make the Taproot transaction. In principle, anybody can make it. Once it's on the blockchain, I guess you could copy it and change it.

Aaron van Wirdum Well, just to be clear, I think we need to be clear about the different type of transactions that are involved here. So the first transaction is putting the coins in the vault, right? And then there's a second transaction that's getting the money out of the vault, but it's not yet sent to me.

Sjors Provoost Exactly.

Aaron van Wirdum There's an intermediate transaction. This is recorded on the blockchain as explicitly an intermediate transaction. And then after some time has passed, now there's a third transaction, and that's the transaction that's actually sending money to me.

Sjors Provoost Yes.

Aaron van Wirdum And this third transaction doesn't need to be signed or anything. The only thing that needs to happen is that the amount of time that was defined by the intermediate transaction and the original transaction, by the way, that needs to have passed. That's all that really needs to happen.

Sjors Provoost Exactly. Well, and it needs to go to the destination that was committed to in the second transaction.

Aaron van Wirdum Sure, it needs to go to my address.

Sjors Provoost Exactly.

Aaron van Wirdum Yeah, otherwise it wouldn't be valid, right?

Sjors Provoost So it's completely, essentially it's predetermined, but you have to wait a while before you can send it on the internet.

Aaron van Wirdum Yeah.

Sjors Provoost And this is kind of like the hot wallet that you see in these other vault designs, except it's not really a wallet. It's some sort of limbo place. Where your transaction briefly rests and then continues.

Aaron van Wirdum Yeah it's really a new kind of thing like this is probably the main new kind of thing. Well this is the main new kind of thing in this proposal. That there's this intermediate limbo transaction that can just be spent after some time and doesn't require any of the [unclear] signatures after that yeah okay so that's these are sort of the three main transactions at least In the happy place?

Sjors Provoost Yeah, and in the unhappy place, there is a recovery transaction. And this essentially just, because you've committed to the recovery script in advance, you've basically told that you can simply spend it with the recovery script. And then send it wherever you want immediately.

Aaron van Wirdum I'm not sure what that means. I'm not sure what you're saying now.

Sjors Provoost So you can spend it by sending it to the recovery destination. I think that's it. So you can always make a transaction that takes the money out of the vault and sends it to your recovery destination. And you've decided what that recovery destination is when you created the vault. Because the first transaction...

Aaron van Wirdum You probably still need a signature for that transaction, right? Or is that always possible?

Sjors Provoost No, I think not. I think it's optional. But I think in principle, if somebody else knows how your vault works, they can trigger it. But if you just keep that a secret, they can't.

Aaron van Wirdum I see. So anyone should be able to send... Well, at least you should be able to send... The money from your vault to your super secure backup anytime you want. Yeah, and also and this is the important part, I think you can also send the money to the super secure setup from the intermediate transaction.

Sjors Provoost Exactly so you can either do it because you lost whatever ability you had to use the vault normally right but you can also take it from the intermediate transaction if you see that somebody is taking money out of your vault and you were not expecting it then you have X amount of days or hours or whatever it is to send your money to your backup destination.

Aaron van Wirdum So in that case, that also requires nothing in particular? That requires no signature or nothing?

Sjors Provoost No, as far as I know, it doesn't. And there was some discussion on the mailing list about whether that's good or not, because if you have multiple coins in the same vault, then if you decide to pull one back to the backup location, somebody else can go ahead and send all the other ones back. But that's probably what you want. But I think there is some option if you don't want that for some reason to opt out of it.

Aaron van Wirdum Okay.

Sjors Provoost Because it all looks the same. So somebody, yeah, there's no permission needed. If you know what the magic revocation transaction is, you can apply it.

Aaron van Wirdum Okay. I'm almost clear on all of this, I think.

Sjors Provoost Okay.

Aaron van Wirdum If we got it right at least, then I'm almost clear. But let me... Sort of recap and walk through it one more time just to make sure that I actually understand it and might help our listeners as well so when you're first locking up the coins in the vault there's three things you need to specify right one of them is the time delay that's that's easy everyone will understand that and then the second thing is how to get it to the super secure backup?

Sjors Provoost Yep.

Aaron van Wirdum So what's actually I think what's actually in there?

Sjors Provoost I think you're just putting the address or script of the super secure backup there. I almost as if you're sending it there right?

Aaron van Wirdum Well you're probably putting the hash of it there or not?

Sjors Provoost Yeah but probably yes. So

Aaron van Wirdum You're probably okay. So you're putting the hash of the address.

Sjors Provoost I mean that's an implementation detail either it's the hash or the address itself. Well probably the hash. Well if you know the address is already a hash so I think it's the same thing An address is already the hash of either a public key or a script. So my guess is that the thing you're putting in there is just the address.

Aaron van Wirdum Well, if you put the address there, then it's super easy for everyone to just troll you and send your money to the vault. Well, if you put the hash there... It's not, right?

Sjors Provoost Well...

Aaron van Wirdum If you put a hash there, then you would actually need to know the address.

Sjors Provoost Yeah, that's probably true. Because I guess when you're creating the vault, nobody can see it. Because it's just hidden inside the Taproot tree. But as soon as you use the vault, people would be able to see it. So I guess it's not the exact hash. Because that would indeed be a problem. But you'd have to read the picture.

Aaron van Wirdum Not the exact address is what you mean.

Sjors Provoost Yeah, not the exact address. Because that would be a problem. Maybe. Not necessarily. But yeah, I guess then somebody else could take it out. So you don't want that.

Aaron van Wirdum Okay, well, my quick recap is turning more into a brainstorm.

Sjors Provoost Exactly. So the main point is you put something in there that tells you how it goes to the super secure backup thing. But we don't know exactly what you put in it. Right.

Aaron van Wirdum So you put the delay in there that's required. You put it… That's kind of a cop-out [unclear]. Shouldn't we know what you put in there?

Sjors Provoost Do you want to read the BIP again?

Aaron van Wirdum You put some magic in there so you put the delay in there you put some magic in there that shows you how to get it to the backup the super secure backup and then the third one was

Sjors Provoost Whatever condition you have to spend it normally so because you don't your vault shouldn't be in anyone can spend address obviously your vault should be just I don't know it should take a signature or multiple signatures whatever you usually do for your wallet is you have to tell the vault that right?

Aaron van Wirdum Got it. So that can be a regular signature. That in most cases that will probably be a regular signature.

Sjors Provoost Yeah.

Aaron van Wirdum Okay, got it. So that's the three things. A delay, instructions of how to get it or a hash or magic of how to get it to the super secure backup. And then the third thing is whatever you would usually do to be able to spend the money.

Sjors Provoost Yeah, followed by a vault.

Aaron van Wirdum That's how you get it into the vault, getting it out of the vault once again. Use the OP_UNVAULT.

Sjors Provoost Yeah, but the OP_UNVAULT is on the spending side of that transaction. So to get it out, you have to do something on the input side. And we're a little vague on that, but I think the only thing you need to do on the input side is just satisfy the script as you would normally satisfy a script, basically, the happy case script. And then the OP_VAULT code that you had before demands that the output of this intermediate transaction has certain qualities. The output has to contain an OP_UNVAULT code. And that unvault code then has to contain, again, the recovery stuff that we talked about. It has to have the delay again. And it has to have, and that's new, the hash of the outputs that you're going to send it to. So the hash of the final destination.

Aaron van Wirdum Yeah, so that was the hash of my address in the example we gave.

Sjors Provoost Exactly. Now, in your case, you know your address, so you know what the hash is, but there might be multiple destinations, right? It might be paying to you and a few other people. So, and that is followed by OP_UNVAULT. And so that means that this transaction, when you then have the third transaction, it has to wait for a number of blocks. Because that's what the OP_UNVAULT part ensures, basically. And when you withdraw the transaction, again, you don't have to put in anything on the signature side. It's just a transaction that says, okay, you can take it now. But because it's a covenant, it demands that the outputs go to you.

Aaron van Wirdum Okay, we've been over this twice now, and I think it's...

Sjors Provoost It's super clear everybody understands this.

Aaron van Wirdum Yes, that's what I think, Sjors. Why is this better than what we have?

Sjors Provoost Oh, and one more thing. The amount I'm sending to you doesn't have to be the full amount of the vault. It can have changed, and that change can go back to the same vault, trivially, without doing anything complicated. That would be address reuse, but at least it would be nice.

Aaron van Wirdum Yeah, well, that's, I think, one of the main benefits, right? Because when we started...

Sjors Provoost You can also do it without address reuse. You can just create a new vault, but then sending the change to that new vault would also have to go through that 30-day or whatever delay it is. So there is normal change that you make in a transaction, but then you're taking everything out of the vault. And if you really don't want to have any address reuse... I would send some to you and then the change would go back to me, but that's just another transaction, so it has to go through the delay. But there's a special exception that if you send it back to the same vault, the exact same address, it doesn't have to wait. The change can go back immediately and the money that I'm sending to you will be in limbo.

Aaron van Wirdum You say address reuse. Is it literally address reuse?

Sjors Provoost Yeah, because the vault is just an address. You can make as many vaults as you want, but one vault is one address. So if you want to spend part of a vault part of an address then the change in order to do it quickly has to go back to the same address is

Aaron van Wirdum there a way of putting it in the same vault under a different address

Sjors Provoost not as far as the blockchain is concerned but if you have a wallet then it can be smart it can just like you put in an xpub and it could create multiple vaults and then it would just send money changed from one vault to the second vault.

Aaron van Wirdum And they do… would they use the same super secure backup?

Sjors Provoost Well, assuming your super secure backup is also an xpub, essentially, let's say you would just use address number two of the xpub as address number three of your super secure backup. So your super secure backup can be a hierarchical wallet as well. So one address in your vault wallet corresponds to one address in your super secure backup. But it just depends on how you want to do it. You can also have one address as a super secure backup. It just means that if you ever use it, you're kind of doxing all your coins because they all go to the same place. It's pretty flexible. The proposal itself doesn't care.

Aaron van Wirdum Well, what I'm kind of trying to get at is that I think one of the benefits of this proposal is indeed the flexibility. I definitely read something along the lines of being able to use the super secure backup. And that was a benefit there. There was some sort of aggregation going on. You would need fewer transactions, something like that.

Sjors Provoost If you're willing to reuse addresses, then it gets easier. Because I think there might be multiple things you can do, if I read it correctly. One is that you can just send change immediately back to the vault without having to wait 30 days, which means that if you want to pay multiple people... In order. You don't have to wait for each of those two for the vault to finish. But I think the other one is that you can create a single transaction that combines stuff from multiple coins in your vault. So let's say you have your vault address and 10 different people sent money to it. Then I think you can combine all 10 of them and then withdraw them in like with just one intermediate transaction rather than 10. I think stuff like that is possible, but I don't know. You'd have to read the BIP and improve the BIP.

Aaron van Wirdum I'm definitely reaching the point where I feel like this would have benefited from having James on the podcast or something.

Sjors Provoost Certainly, yes.

Aaron van Wirdum There's definitely a lot of stuff we don't really understand, or at least that I don't understand, and that you also seem a bit iffy on still.

Sjors Provoost Oh, for sure, yeah.

Aaron van Wirdum Okay,

Sjors Provoost Well, at least we've established that. There's a white paper that James wrote. Like, I think if you Google O’Beirne vaults PDF, you'll find it. And then there is a BIP that he wrote, which sort of specifies it precisely how it works, which also has some nice pictures in it. And... You just broke your headphones.

Aaron van Wirdum That's fine.

Sjors Provoost Okay. And there is a implementation, like a draft example of how to put it in Bitcoin Core that you can play with. Now, generally what happens is this PDF white paper will be out of date because it was written a month ago and then the proposal keeps changing. So you probably want to read either the BIP or the implementation or the mailing list to figure out precisely what it can do or not.

Aaron van Wirdum Can we just... Structure our episodes like this moving forward that's much easier we just say hey there's a new proposal you can read it yourself read the mailing list yeah Read the BIP have fun see you in two weeks.

Sjors Provoost Exactly. Now do we quickly want to get into how this contrasts to some other proposals?

Aaron van Wirdum Oh my god. I almost forgot about that yeah do you think you still have to do you think you got the Power left the oomph to do that, the energy left.

Sjors Provoost Not to do it for very long, but very briefly.

Aaron van Wirdum Not to mention the knowledge is Sjors.

Sjors Provoost Very briefly, there is a, there's two ideas roughly how to do covenants. I guess there's multiple. One is the OP_CSV proposal by Jeremy Rubin and very TL;DR: This still requires you to pre-sign transactions. But it's a little bit more flexible than how you would do here.

Aaron van Wirdum Well, also a little bit more blockchain-y, right? You don't have the unsigned transactions that you need to store somewhere. Like the stuff is still actually on the blockchain.

Sjors Provoost I think you still need to store unsigned transactions just that you don't have to delete the private key. Because I think what you're doing is you're creating a transaction that commits to a hash and that hash represents the next transaction in the series. Or like a tree of transactions. So you broadcast one transaction on chain, but this really represents future transactions that can be broadcast on chain later. But you still need to hold on to what those future transactions are, of course, otherwise the blockchain doesn't know. And so that you can implement a vault structure as we discussed in the beginning. In that way too but it still requires signing a bunch of transactions in advance it's not it's not flexible but it doesn't require you to have some toxic material basically the idea of having a private key that if you forgot to delete it or if it was already compromised you'd be screwed yeah so it's a little bit better and the other thing you can do is create a more generic covenant So now we've described this covenant can, has some, this opcode has very specific requirements on what the, on what the outputs do of a new transaction. But you can make this very generic saying like, okay, the only, this transaction can only be spent by this specific kind of other transaction. And you can make that very abstract. And then using that very abstract system, you can then implement a vault. And there's two problems with that. One is that there is no such proposal, I believe. And at least it's not going to happen anytime soon because covenants are a little bit scary, especially with ideas like, oh my God, you can put some condition in it that will sort of poison those coins for eternity because wherever you spend them, they also have to meet the covenant. And the second thing, at least what James O’Beirne points out in his PDF, is that even if you do have a system like that, it's going to be complicated to build a vault. So the vault would not be a simple two-upcode thing. It would be a much more complicated construction. And more complicated construction also means it uses more fees. So that's the argument for basically saying, let's do a very simple soft fork.

Aaron van Wirdum Yeah, which is OP_VAULT. That's the idea.

Sjors Provoost Yeah.

Aaron van Wirdum There's also, there's a lot more we could get into, which I don't think we're gonna.

Sjors Provoost No, I mean, we could explain how to do inscriptions and ordinals with this.

Aaron van Wirdum No, I'm just kidding.

Sjors Provoost You cannot.

Aaron van Wirdum I was referring to the whole fee situation, which James has been writing a lot about.

Sjors Provoost Yeah, this whole combining transactions, you know, in series, there are some subtle things about fees there that we're not going to explain. In part because we don't know and in part because we've been doing this long enough now.

Aaron van Wirdum We've been doing the sort of guessing our way through the OP_VAULT proposal long enough.

Sjors Provoost Yeah.

Aaron van Wirdum Okay, let's call it an episode then, Sjors. I think at least it was somewhat clear in part. It may have given some people a slightly bigger clue of what a vault is. And then hopefully specifically what a OP_VAULT is. And if you want to read more about the details, then Sjors knows where you can find it. Can you repeat for our dear listener?

Sjors Provoost Yes, you can see it in the show notes. Thank you for listening to Bitcoin,

Aaron van Wirdum Explained.