WEBVTT - Automatic transcript; recognition may contain errors. Reviewed for technical wording and speaker labels. Times match the published episode. 00:00:20.560 --> 00:00:22.840 Live from Utrecht this is Bitcoin, 00:00:22.840 --> 00:00:23.980 Explained. 00:00:23.980 --> 00:00:25.220 Hey Sjors. 00:00:25.220 --> 00:00:26.000 What's up? 00:00:26.320 --> 00:00:32.100 So a couple weeks ago we did an episode on the Alexey Petrov trial 00:00:32.100 --> 00:00:35.920 and before we get into the main episode in the main topic of this episode which 00:00:35.920 --> 00:00:41.240 is going to be vaults I want to ask you though so you went to the second pro 00:00:41.240 --> 00:00:45.680 forma this week I was there for a little bit but I had to go halfway you were 00:00:45.680 --> 00:00:49.100 there for the whole thing I think is there any news for our listeners that I 00:00:49.100 --> 00:00:54.350 should… Did anything change about the trial Sjors? 00:00:54.690 --> 00:00:58.890 Not much changed. He still has to wait for another couple months. I think they 00:00:58.890 --> 00:01:04.880 opened his laptop a few days before that hearing. So they're going to 00:01:04.880 --> 00:01:06.500 need some time to look into that, I guess. 00:01:06.700 --> 00:01:10.660 Yeah, I think the only new thing that I heard while I was still there was so the 00:01:10.660 --> 00:01:14.960 prosecutors now suspect that he was himself running a relayer. 00:01:15.360 --> 00:01:19.670 Yeah, they suspect that and they're denying that. The defense is denying that. 00:01:19.670 --> 00:01:20.730 Oh, Alexei is denying that? 00:01:20.970 --> 00:01:21.250 Yeah. 00:01:21.550 --> 00:01:24.110 Okay. All right. So that probably happened after I was gone. 00:01:25.840 --> 00:01:26.380 Probably, yeah. 00:01:26.380 --> 00:01:29.500 Also, it probably doesn't really matter in the scheme of things, right? That's 00:01:29.500 --> 00:01:32.080 not really why they were after him in the first place. 00:01:34.480 --> 00:01:37.820 I don't know. I don't know what was in the dossier when they arrested him. 00:01:38.940 --> 00:01:43.840 All right. Well, thanks, Sjors, for that. Final update, you want us to read some 00:01:43.840 --> 00:01:46.840 boosts as well before we get to the actual topic du jour? 00:01:46.840 --> 00:01:52.520 Right, let's focus on happy thoughts. Yes, we got one boost from at MRMR 00:01:52.520 --> 00:01:58.360 or Mr. Mr., I guess. Thumbs up, exclamation mark. And then we got another 00:01:58.360 --> 00:02:04.040 boost from Mr. At MRMR for also 8,421 00:02:04.040 --> 00:02:09.610 sats with the words thumbs up, dot. So one with an exclamation mark and one with 00:02:09.610 --> 00:02:10.310 a dot. 00:02:10.810 --> 00:02:15.490 Sure. Reading out boosts is not my favorite part of the show. Do we need to keep 00:02:15.490 --> 00:02:17.430 doing this? Is this paying us enough? 00:02:17.610 --> 00:02:20.050 Exactly. This is what pays our bills. 00:02:20.690 --> 00:02:23.980 Not mine. When is my paycheck coming, Sjors? 00:02:24.200 --> 00:02:27.520 I'm sending you the split every couple months because it's too much work. You 00:02:27.520 --> 00:02:28.360 should just run your own node. 00:02:29.360 --> 00:02:31.720 So you want to keep reading the boosts going forward? 00:02:31.920 --> 00:02:33.420 Definitely until you run your own node. 00:02:34.280 --> 00:02:39.200 Okay, so that's going to be forever if it has to be a Lightning node. Yeah, 00:02:39.340 --> 00:02:44.600 that's just false. Let's just get to the topic of the day. Actually, I'm not sure 00:02:44.600 --> 00:02:49.680 if we're going to discuss vaults in general, or are we going to focus more on 00:02:49.680 --> 00:02:50.260 OP_VAULT? 00:02:50.500 --> 00:02:54.760 Yeah, we're going to focus on OP_VAULT, which I think we accidentally spelled in 00:02:54.760 --> 00:02:59.540 the French way, so hopefully that'll get fixed. And we may cover some vaults in 00:02:59.540 --> 00:03:02.260 general, but OP_VAULT is a specific proposal by James O’Beirne. 00:03:03.600 --> 00:03:05.580 Wait, so how do you spell vaults, Sjors? 00:03:06.080 --> 00:03:07.660 Oh, no, actually you spelled it correctly. 00:03:07.900 --> 00:03:13.240 Yeah, I think I did. All right. So yeah, there's a proposal by James O’Beirne, 00:03:13.750 --> 00:03:19.750 which is a specific type of vault. And I guess, what is a 00:03:19.750 --> 00:03:22.310 vault in very general terms? Can you explain? 00:03:22.530 --> 00:03:27.870 I like to describe it as a method to give you a undo button, at least 00:03:27.870 --> 00:03:30.190 temporarily. For a Bitcoin transaction. 00:03:30.510 --> 00:03:31.670 So it's like RBF. 00:03:31.950 --> 00:03:37.750 Well, RBF is a very, very short-term undo button. That's true, yes. But with RBF, 00:03:38.030 --> 00:03:41.950 you can undo, if somebody hacks your keys and you still have your own keys, then 00:03:41.950 --> 00:03:47.530 they'll make a transaction stealing your coins. You then make another transaction 00:03:47.530 --> 00:03:51.730 that pays a higher fee with or without the RBF flag, and you keep racing each 00:03:51.730 --> 00:03:56.170 other that way. But with vaults, in general, the idea is that you'll have more 00:03:56.170 --> 00:04:01.850 time to do that. And generally also it's less easy for the thief to just 00:04:01.850 --> 00:04:03.190 keep bidding up the fees. 00:04:04.010 --> 00:04:08.670 Yeah, I will say I think undo is a little bit confusing because that's not really 00:04:08.670 --> 00:04:10.690 what you're doing with most vault designs. 00:04:11.010 --> 00:04:15.050 No, I guess with RBF you're really undoing it, but you're effectively undoing the 00:04:15.050 --> 00:04:18.790 damage. So the way that's done, we'll explain that of course, but the general 00:04:18.790 --> 00:04:22.630 purpose is that you see a transaction happening, you even see it on the 00:04:22.630 --> 00:04:26.530 blockchain, but you still have and you didn't want that transaction to happen. 00:04:26.940 --> 00:04:30.800 But you still have a way to get that money back until a certain time window 00:04:30.800 --> 00:04:31.280 expires. 00:04:31.680 --> 00:04:35.540 Yeah, well, I think this is a good time to get a little bit more specific. So I 00:04:35.540 --> 00:04:40.820 think most vault designs, if not all vault designs, I think work in a specific 00:04:40.820 --> 00:04:45.780 way where you put your coins essentially in what you would call a vault. 00:04:46.440 --> 00:04:52.100 And then the only way to withdraw it, like withdrawing is a process. And during 00:04:52.100 --> 00:04:57.070 that process, you have an option to send... These coins that are being 00:04:57.070 --> 00:05:01.110 potentially so if you see they're being stolen you can send them to another vault 00:05:01.110 --> 00:05:01.530 that… 00:05:01.530 --> 00:05:06.010 Or back to the same vault. Yeah exactly. So so the way that would… yeah. 00:05:06.010 --> 00:05:09.910 You say back to the same vault well that would get you in a problem if the thief 00:05:09.910 --> 00:05:14.110 just does it again right? That's never useful. Right like why would you ever want 00:05:14.110 --> 00:05:17.590 that? You would always want to send it to a new vault essentially right? 00:05:18.380 --> 00:05:21.880 Probably. Maybe there's some in-between case where that's okay to send it back. 00:05:22.040 --> 00:05:27.540 But the general idea how you might do that is first you just send money to an 00:05:27.540 --> 00:05:31.640 address. You make a private key. You send the money to that address with the 00:05:31.640 --> 00:05:37.480 private key. And then you create a transaction that sends that money away again 00:05:37.480 --> 00:05:42.120 from that private key to wherever you want to go. But you're sending that to a 00:05:42.120 --> 00:05:47.480 special script. And that special script... I guess would have two conditions. One 00:05:47.480 --> 00:05:51.320 is you can spend it after three months in whatever way you want using your own 00:05:51.320 --> 00:05:56.700 keys. Or before those three months, there is another script that will send it 00:05:56.700 --> 00:06:02.110 back. Something like that. Send it to your next vault, I guess. But then how 00:06:02.110 --> 00:06:02.830 would that be secured? 00:06:03.170 --> 00:06:06.550 Well, I think that's an important concept. Before we get into the details. 00:06:07.290 --> 00:06:10.650 But then you burn the original private key. That's kind of where the magic 00:06:10.650 --> 00:06:14.330 happens. You have to burn the original private key so that that private key, the 00:06:14.330 --> 00:06:16.970 money is now in a place that you cannot spend it from because you don't have the 00:06:16.970 --> 00:06:21.070 private key. All you have is a pre-signed transaction that then make sure that 00:06:21.070 --> 00:06:22.250 some other things happen in the future. 00:06:22.250 --> 00:06:27.810 Yeah I just want to establish moving forward we're gonna let's agree on some 00:06:27.810 --> 00:06:30.990 terms. Because that will make it clear when we're trying to explain things. 00:06:30.990 --> 00:06:31.710 That sounds boring. 00:06:31.710 --> 00:06:33.850 No this is important, Sjors, this is vital. 00:06:33.850 --> 00:06:34.350 Okay. 00:06:34.350 --> 00:06:39.170 Okay. So let's say you know a vault a vault is the first thing where you put the 00:06:39.170 --> 00:06:44.750 money and it's supposed to be kind of safe but then we also have the super vault 00:06:45.400 --> 00:06:48.400 That's like the backup vault. So the super vaults... 00:06:48.400 --> 00:06:53.180 I think that's terrible terminology because probably your backup plan, like if 00:06:53.180 --> 00:06:58.610 everything else fails, is not a vault. It is probably more simple but very secure 00:06:58.610 --> 00:06:59.470 multisig address. 00:07:01.590 --> 00:07:03.830 Well, that is a super vault then, right? 00:07:04.190 --> 00:07:07.110 No, because we're using the word vault here to refer to a very specific 00:07:07.110 --> 00:07:07.550 mechanism. 00:07:07.770 --> 00:07:13.370 No one is using steel boxes here. The multisig thing is super vault, right? 00:07:13.280 --> 00:07:16.400 Am I, like, why… What do you want to call it? 00:07:16.690 --> 00:07:21.110 Because we're using the word vault here, not in the sense of the physical box, 00:07:21.170 --> 00:07:27.050 but in the sense of a mechanism where you can undo the damage. But when you do 00:07:27.050 --> 00:07:31.520 that, when you invoke this undo function... The money has to go somewhere. And 00:07:31.520 --> 00:07:35.440 that does not have to be a vault in the same sense that we just defined a vault. 00:07:35.540 --> 00:07:40.140 It can be any kind of secure setup. But generally the trade-off there is that 00:07:40.140 --> 00:07:45.220 there is a place where you keep coins that is extremely secure but extremely hard 00:07:45.220 --> 00:07:48.800 to access. And that's not practical. And you have another place that's a little 00:07:48.800 --> 00:07:53.440 bit less cold. And that's where your vault is. So your vault is sort of an 00:07:53.440 --> 00:07:57.040 in-between phase between really a hot wallet and a super cold wallet. 00:07:58.430 --> 00:08:02.290 Right. Well, that's exactly what I want to establish. So we just got to agree on 00:08:02.290 --> 00:08:04.450 terms, which seems is the hard part at this point. 00:08:04.670 --> 00:08:07.430 Yeah. You can keep the keys, let's say, in a safe, but not a vault. 00:08:08.500 --> 00:08:12.080 The vault is where you put the money at first. Yeah. And that's kind of the smart 00:08:12.080 --> 00:08:13.720 contract thing in which we're going to explain. 00:08:14.060 --> 00:08:14.200 Yeah. 00:08:14.320 --> 00:08:17.560 But then we need to have the super secure backup, which we're calling the super 00:08:17.560 --> 00:08:18.460 secure backup then. 00:08:18.600 --> 00:08:19.720 Let's call it the super secure backup. 00:08:20.240 --> 00:08:24.220 Okay. So the idea behind the super secure backup is that it's super secure. 00:08:24.240 --> 00:08:29.760 And it’s, and it’s, but… The problem, though, is that it's so secure 00:08:29.760 --> 00:08:34.360 that it's actually kind of hard to use. So, for example, you have a multisig setup. 00:08:35.930 --> 00:08:41.490 You have several cold keys that are stored in different actual vaults in 00:08:41.490 --> 00:08:44.970 different countries. So it's super secure, but you can't actually use it day-to 00:08:44.970 --> 00:08:47.010 -day. So that's why it's a super secure backup. 00:08:47.230 --> 00:08:51.330 And I think the context that most of the James O’Beirne paper was written for was 00:08:51.330 --> 00:08:56.300 if you're an exchange. Because an exchange tends to have a hot wallet, which they 00:08:56.300 --> 00:09:00.420 need to use to pay customers quite quickly, but there's a lot of money in it. So 00:09:00.420 --> 00:09:02.740 they really have this issue where they want to be able to pay their customers 00:09:02.740 --> 00:09:05.540 quickly, but they're also sitting on a lot of money that they don't want to get 00:09:05.540 --> 00:09:09.460 stolen, and maybe they only realize it's stolen when it's too late, and they want 00:09:09.460 --> 00:09:14.200 some sort of undo button. But they may also have access to a bunch of safes in 00:09:14.200 --> 00:09:17.810 the Arctic. It's just that if they ever have to send the money there... Their hot 00:09:17.810 --> 00:09:21.270 wallet is going to be empty and they have to wait three months to send some guy 00:09:21.270 --> 00:09:24.350 on a private jet. So they don't want to use the option, but they want to have the 00:09:24.350 --> 00:09:25.810 option because it's better than losing the money. 00:09:26.480 --> 00:09:31.140 Yeah I think your point there is if you are an individual that's just stacking 00:09:31.140 --> 00:09:36.140 sats and doesn't really use Bitcoin you know other for other than storing your 00:09:36.140 --> 00:09:40.380 wealth You kind of only need the super secure backup you didn't you don't really 00:09:40.380 --> 00:09:41.340 need to vault because you're not… 00:09:41.340 --> 00:09:45.160 Maybe it depends on your lifestyle maybe you have a super secure backup where you 00:09:45.160 --> 00:09:49.740 keep like billions of dollars and then you have a vault that you use just if you 00:09:49.740 --> 00:09:53.040 need to buy a Lambo or something like that, like the casual but still pretty high 00:09:53.040 --> 00:09:56.380 expenses, and then you also have a Lightning hot wallet that you use for ice 00:09:56.380 --> 00:09:58.100 cream. I mean, it just depends. 00:09:58.280 --> 00:10:00.280 Okay, we're getting super lost in the terminology. 00:10:00.600 --> 00:10:03.820 But what I would want to say is that vaults are not useful for daily 00:10:03.820 --> 00:10:07.880 transactions, I think. They're too tedious, even the ones that we're going to 00:10:07.880 --> 00:10:08.440 explain. 00:10:09.280 --> 00:10:13.820 Sure, I'm still trying to establish, but I think there are three important parts 00:10:13.820 --> 00:10:17.340 of the terminology we need to establish. I think vaults we've established. That's 00:10:17.340 --> 00:10:20.640 a smart contract thing we're going to explain. Then we've got a super secure 00:10:20.640 --> 00:10:26.520 backup, and then you've got the actual hot wallet. Well, I guess these 00:10:26.520 --> 00:10:28.960 aren't used in the James O’Beirne version. 00:10:29.240 --> 00:10:31.900 No, that last ingredient does not exist. So it's interesting to say that normally 00:10:31.900 --> 00:10:35.600 it does, or at least in the other concepts. So there's indeed, like you said, a 00:10:35.600 --> 00:10:40.150 hot wallet that... What you would do is you take money out of the vault and then 00:10:40.150 --> 00:10:43.270 instead of sending it wherever you want to send it you first have to put it in a 00:10:43.270 --> 00:10:43.730 hot wallet. 00:10:43.730 --> 00:10:44.990 Your own hot wallet. Yeah. 00:10:44.990 --> 00:10:48.910 Yeah. And that hot wallet or I guess doesn't… well let's just assume it's a hot 00:10:48.910 --> 00:10:53.470 wallet. You have to… with previous designs you have to decide in advance what 00:10:53.470 --> 00:10:55.990 that hot wallet is and that's what you can send it to 00:10:55.990 --> 00:11:00.010 And then you mean the address, most obviously right? Yeah yeah. 00:11:00.010 --> 00:11:04.500 And what's what's the problem with that? It's not very flexible. And it means you 00:11:04.500 --> 00:11:08.400 have an extra step. It also means that if that hot wallet is compromised, then 00:11:08.400 --> 00:11:10.120 you can't send it to that hot wallet. 00:11:11.840 --> 00:11:16.400 Yeah, which is especially tricky because you might not know if it is compromised, right? 00:11:17.020 --> 00:11:21.040 Yeah. Though, of course, the same kind of problem exists with the new proposal. 00:11:21.160 --> 00:11:25.060 So maybe it's not the most relevant argument. But it's good to point out. The 00:11:25.060 --> 00:11:28.180 biggest problem with these old vault proposals is that it's just very tedious. 00:11:28.660 --> 00:11:30.300 But maybe we want to get into that. 00:11:30.660 --> 00:11:35.920 We're getting into your... Sjors, you're getting into weeds and you're skipping 00:11:35.920 --> 00:11:37.680 ahead of all kinds of explanations. 00:11:38.200 --> 00:11:38.300 Cool. 00:11:39.710 --> 00:11:43.950 First, I just wanted to establish the terms we're going to use. 00:11:44.010 --> 00:11:44.550 I think we've done that. 00:11:44.550 --> 00:11:47.390 And I think we've done that. So we've got the vaults, we've got the super sugar 00:11:47.390 --> 00:11:50.610 backups, and we've got the hot wallets. Even though hot wallets aren't really 00:11:50.610 --> 00:11:55.150 used in O’Beirne’s thing, but we still want to use the term to explain that it 00:11:55.150 --> 00:11:56.030 doesn't use the thing. 00:11:56.620 --> 00:11:57.180 Sounds good. 00:11:57.240 --> 00:12:02.900 Right? Okay. Now you've sort of explained how vaults worked so far. 00:12:04.970 --> 00:12:10.410 Do you think that was clear enough to move to the next step? I'm still a little 00:12:10.410 --> 00:12:11.790 bit unsure. So do you want to... 00:12:11.790 --> 00:12:12.770 Do you want to re-explain it? 00:12:13.130 --> 00:12:13.390 Yeah. 00:12:13.470 --> 00:12:15.190 We were talking about pre-signed transactions, right? 00:12:15.190 --> 00:12:19.430 Exactly. I can re-explain it real quick and that should hopefully do the trick. 00:12:19.550 --> 00:12:25.150 So yeah, what previous vault tricks used was you 00:12:25.150 --> 00:12:30.430 create a transaction that sends money that can be spent in one of two ways. 00:12:30.950 --> 00:12:36.830 So once this transaction is broadcast, it can either be sent the 00:12:36.830 --> 00:12:42.000 money can either be sent to the super super secure backup right away or there's a 00:12:42.000 --> 00:12:47.520 time lock on it and after a while it can be spent to the hot wallet or by the hot wallet. 00:12:47.520 --> 00:12:47.840 Yeah. 00:12:47.840 --> 00:12:53.810 Right, and like you said the key here pun not intended but the key 00:12:53.810 --> 00:12:59.190 here is that you delete the key so you create this pre-signed transaction and 00:12:59.190 --> 00:13:04.460 then you delete the key so from that point on The only way to possibly spend 00:13:04.460 --> 00:13:10.280 these funds is to broadcast this unbroadcasted transaction. Now you broadcast 00:13:10.280 --> 00:13:15.840 it and now it can only be spent in two ways. So now if you do that, 00:13:16.060 --> 00:13:22.040 if you're using the vault, then now you can keep an eye on the blockchain. And 00:13:22.040 --> 00:13:26.880 if you're just keeping the unsigned transaction for yourself, hopefully kind of 00:13:26.880 --> 00:13:30.820 secure on your laptop or whatever, whatever you consider secure. But then if your 00:13:30.820 --> 00:13:35.630 laptop is hacked and the hacker finds this transaction and he broadcasts it. Now 00:13:35.630 --> 00:13:39.210 you see that it's being broadcast. You see that it ends up on the blockchain, but 00:13:39.210 --> 00:13:42.630 now you still have like three months to send it to your super secure backup 00:13:42.630 --> 00:13:45.290 before the hacker can actually take the funds. 00:13:45.490 --> 00:13:48.510 Exactly. And then I'm assuming that they also compromised your hot wallet, right? 00:13:48.510 --> 00:13:52.670 If they only find this transaction to get it out of the vault, but not your hot 00:13:52.670 --> 00:13:55.910 wallet, then I guess your money just goes to your hot wallet and then you move it 00:13:55.910 --> 00:13:59.430 away. But there is this other condition where you can send it to your super 00:13:59.430 --> 00:14:02.510 secure setup and you have to get on your private jet and stuff. 00:14:02.690 --> 00:14:08.560 Right. Okay the problem there's a couple of problems with this design but 00:14:08.560 --> 00:14:14.440 I think they all boil down to more or less the same problem which is 00:14:14.440 --> 00:14:15.940 you need to pre 00:14:17.240 --> 00:14:18.440 compute it and pre-sign it. 00:14:18.440 --> 00:14:22.560 So you need to pre-sign it. You need to make absolutely sure that the the private 00:14:22.560 --> 00:14:26.480 keys are gone. Because otherwise if somebody does find the private key they can 00:14:26.480 --> 00:14:29.880 just make another transaction and it does not obey any of the smart contract 00:14:29.880 --> 00:14:33.480 rules you just thought about and it's very unflexible right you can you can take 00:14:33.480 --> 00:14:37.800 everything out or not or if you did want to split it you'd have to think about in 00:14:37.800 --> 00:14:41.300 advance how you would want to split it and make all the pre-signed transactions 00:14:41.300 --> 00:14:45.260 to do the splitting also in advance so you cannot just say I want to buy this 00:14:45.260 --> 00:14:49.500 this thing I'm going to send some coins out of my hot or out of the vault but 00:14:49.500 --> 00:14:50.500 leave some of it in it. 00:14:50.500 --> 00:14:55.940 Yeah I think that's the key word inflexible. You just have to decide beforehand 00:14:55.940 --> 00:15:01.260 basically everything. Basically all the conditions and the amounts and where it's 00:15:01.260 --> 00:15:06.930 going which hot water, which hot wallet, everything has to be decided up front 00:15:06.930 --> 00:15:10.090 but there is a benefit. What's the benefit? 00:15:10.090 --> 00:15:11.290 It doesn't need a soft fork. 00:15:11.710 --> 00:15:17.580 Yeah right, that's that's a pretty big benefit. Because so… 00:15:18.220 --> 00:15:23.220 There is a James O’Beirne recently made a proposal called OP_VAULT so that's a 00:15:23.220 --> 00:15:29.060 soft fork yes and that has the downside arguably at least that it's a soft 00:15:29.060 --> 00:15:33.800 fork as you mentioned but then it's a lot more flexible that's the main benefit 00:15:33.800 --> 00:15:38.800 right you can Treat it much more like an actual vault. You can just put anything 00:15:38.800 --> 00:15:43.100 in it anytime you want, get anything out of it anytime you want. But other than 00:15:43.100 --> 00:15:48.580 that, the core principle is still the same. If someone tries to steal something 00:15:48.580 --> 00:15:53.300 from your vault, you'll see it on the blockchain and you'll have time to send it 00:15:53.300 --> 00:15:54.460 to your super secure backup. 00:15:54.940 --> 00:15:59.490 Yeah. Do we want to explain this or do we want to explain the other proposals? 00:15:59.770 --> 00:16:04.750 Which other proposals? I was well on my way of explaining this. What other 00:16:04.750 --> 00:16:05.830 proposals are you thinking of? 00:16:05.970 --> 00:16:08.010 Well, using OP_CSV or general covenants. 00:16:08.150 --> 00:16:08.410 Oh, yeah. 00:16:08.410 --> 00:16:11.510 It might be better to explain it after because then we can contrast it. 00:16:12.590 --> 00:16:17.750 Okay, sure. So we're going to go OP_VAULT now. Yeah, let's just... 00:16:18.590 --> 00:16:20.490 Steamroll ahead with OP_VAULTs at this point. 00:16:20.750 --> 00:16:23.690 Yeah, so we'll just take, basically, because OP_VAULT is really the simplest 00:16:23.690 --> 00:16:27.810 proposal, I would say, for a vault, but it is a soft fork, but it is a relatively 00:16:27.810 --> 00:16:32.650 simple soft fork. And we can get then later to the discussion of why maybe you 00:16:32.650 --> 00:16:35.830 want a more complicated soft fork, a more general soft fork, rather than this 00:16:35.830 --> 00:16:36.570 very specific one. 00:16:36.670 --> 00:16:42.290 There are other types of soft forks, especially OP_CTV that could also 00:16:42.290 --> 00:16:45.870 enable vaults, yeah. Okay, we're going to go to OP_VAULT. 00:16:48.810 --> 00:16:51.210 Sjors, what's in the OP_VAULT output? 00:16:53.730 --> 00:16:58.290 We're introducing a new opcode, which is OP_VAULT. What does it mean? What does 00:16:58.290 --> 00:16:58.790 it require? 00:16:59.070 --> 00:17:02.990 It is not an output itself, right? So you put it in a script as you would 00:17:02.990 --> 00:17:07.050 anytime. So when you're creating a Bitcoin address, you're creating a script. And 00:17:07.050 --> 00:17:12.900 usually what you put on the blockchain is a hash of the script, right? But 00:17:12.900 --> 00:17:13.720 what the script... 00:17:14.900 --> 00:17:19.710 So when you're putting money in the vault… you're sending money to… 00:17:19.710 --> 00:17:22.470 You're sending well you're sending money to a Taproot address. 00:17:22.470 --> 00:17:23.550 Yes exactly. 00:17:23.550 --> 00:17:28.030 So and that Taproot address is a tree and in that tree is a one of the leaves in 00:17:28.030 --> 00:17:32.370 the tree is a script. Yes and that script has part of that script is the new 00:17:32.370 --> 00:17:34.310 OP_VAULT opcode right? 00:17:34.310 --> 00:17:35.470 And what else is in there? 00:17:35.470 --> 00:17:39.950 Yeah exactly so this thing takes two other things or three other things it takes 00:17:39.950 --> 00:17:44.690 a recovery thing we'll talk about recovery later it takes a time delay argument 00:17:44.690 --> 00:17:47.450 so it needs to know how many blocks the delay is supposed to be 00:17:48.050 --> 00:17:49.870 Probably blocks or actual time, right? 00:17:50.250 --> 00:17:56.210 Yeah. Yes, exactly. And it takes the hash of whatever regular script you need to 00:17:56.210 --> 00:18:01.530 spend from your vault. So presumably you want to, when you use your vault, you 00:18:01.530 --> 00:18:04.810 also want to use a multisig or a single-sig or whatever you want to do for the 00:18:04.810 --> 00:18:07.590 normal condition. So you provide a hash of that too. 00:18:09.250 --> 00:18:13.230 And so then the question is, how do you spend this OP_VAULT thing? That's where 00:18:13.230 --> 00:18:14.750 OP_UNVAULT comes in. 00:18:17.130 --> 00:18:21.050 So now you want to take money out of your vault, basically. You create a 00:18:21.050 --> 00:18:26.810 transaction that says, okay, here is OP_UNVAULT. Then first you're going to... 00:18:26.810 --> 00:18:31.030 So let's say you're spending money to me, okay? You got your money in the vault 00:18:31.030 --> 00:18:33.350 and I want money from your vault. 00:18:33.670 --> 00:18:34.070 Yeah. 00:18:34.330 --> 00:18:37.550 And I'm not trying to steal it. You're actually trying to send it to me in this case. 00:18:37.610 --> 00:18:38.330 Exactly. I'm trying to send it to you. 00:18:38.410 --> 00:18:40.570 So I give you my address, right? 00:18:41.540 --> 00:18:43.540 Yeah, exactly. Yeah, exactly. 00:18:43.800 --> 00:18:44.040 Okay. 00:18:44.280 --> 00:18:47.720 But in the first step, I'm not actually using your address, not directly anyway. 00:18:48.460 --> 00:18:54.280 First, I'm saying OP_UNVAULT, the magic word basically. Then I will satisfy the 00:18:54.280 --> 00:18:57.720 script that I created earlier. So I have to provide a signature or multiple 00:18:57.720 --> 00:19:00.120 signatures or whatever script I provided the hash from. 00:19:01.950 --> 00:19:08.010 And then I have to repeat basically the delay. So that's interesting. 00:19:08.210 --> 00:19:10.290 You just got to repeat how many blocks of delays? 00:19:12.220 --> 00:19:13.040 Yeah, exactly. 00:19:13.300 --> 00:19:16.840 So if the delay was 100 blocks, you just got to include 100 again? 00:19:17.400 --> 00:19:18.720 Yeah, but here's the separation. 00:19:18.720 --> 00:19:19.820 It just has to match. 00:19:20.000 --> 00:19:22.520 Yeah, I think here's where the separation between the input and the output comes 00:19:22.520 --> 00:19:26.920 in and why it's a magical covenant. So I think on the input, I'm guessing I just 00:19:26.920 --> 00:19:29.920 have to satisfy the script. I'm not entirely sure, but that's going to be my 00:19:29.920 --> 00:19:34.200 guess. But on the output, I have to put the unvault opcode. 00:19:36.270 --> 00:19:40.430 And then I have to repeat the spend delay, as we said. And then I have to say 00:19:40.430 --> 00:19:44.400 where it's supposed to go. And that is not your address, but the hash of your 00:19:44.400 --> 00:19:46.100 address in this case that you gave me. 00:19:48.790 --> 00:19:52.430 So this is really where the magic is starting to happen. Because normally you 00:19:52.430 --> 00:19:57.870 think if you have an OP_VAULT opcode somewhere, then you can spend that and then 00:19:57.870 --> 00:20:01.450 it's done. You can do whatever you want. But that's not true. The OP_VAULT code 00:20:01.450 --> 00:20:06.520 says that you can only spend it if the output of your transaction... Has 00:20:06.520 --> 00:20:09.720 OP_UNVAULT in it right unless it's the recovery thing. 00:20:09.720 --> 00:20:14.260 So how do I get the money Sjors, because now there's only a hash of my address on 00:20:14.260 --> 00:20:14.760 the blockchain? 00:20:14.760 --> 00:20:18.880 Exactly now there's only a hash of your address on the blockchain and there's 00:20:18.880 --> 00:20:23.600 this mysterious OP_UNVAULT code which probably is also hidden in a [unclear] but 00:20:23.600 --> 00:20:28.000 that doesn't really matter well the way you spend it the way I spend it is I have 00:20:28.000 --> 00:20:33.730 to wait for n blocks and then I can create a transaction with no signature Just, 00:20:33.730 --> 00:20:37.910 I can just take the money. Anybody can take that money, in fact. But there's a, 00:20:38.110 --> 00:20:40.910 and again, the covenant is putting a restriction on the output side of the 00:20:40.910 --> 00:20:44.830 transaction saying this can only go to wherever that hash refers to. 00:20:45.570 --> 00:20:45.930 Right. 00:20:46.030 --> 00:20:49.310 So if I fill in your address, it matches the hash and it goes through. But 00:20:49.310 --> 00:20:51.110 interestingly, you could have made that transaction too. 00:20:51.490 --> 00:20:55.030 Yeah. So, well, in that case, you would have had to give me the transaction, I 00:20:55.030 --> 00:20:58.540 guess, right? Would I know what the transaction looks like? 00:20:59.200 --> 00:21:02.400 You probably would not have been able to guess because you don't know all the 00:21:02.400 --> 00:21:06.280 details to make the Taproot transaction. In principle, anybody can make it. Once 00:21:06.280 --> 00:21:09.300 it's on the blockchain, I guess you could copy it and change it. 00:21:11.040 --> 00:21:16.960 Well, just to be clear, I think we need to be clear about the different type 00:21:16.960 --> 00:21:22.500 of transactions that are involved here. So the first transaction is putting 00:21:22.500 --> 00:21:28.210 the coins in the vault, right? And then there's a second transaction 00:21:28.210 --> 00:21:34.430 that's getting the money out of the vault, but it's not yet sent to me. 00:21:34.650 --> 00:21:34.910 Exactly. 00:21:35.050 --> 00:21:40.550 There's an intermediate transaction. This is recorded on the blockchain as 00:21:40.550 --> 00:21:46.370 explicitly an intermediate transaction. And then after some time has passed, 00:21:46.610 --> 00:21:50.190 now there's a third transaction, and that's the transaction that's actually 00:21:50.190 --> 00:21:51.590 sending money to me. 00:21:51.940 --> 00:21:52.420 Yes. 00:21:52.560 --> 00:21:56.260 And this third transaction doesn't need to be signed or anything. The only thing 00:21:56.260 --> 00:22:01.360 that needs to happen is that the amount of time that was defined by the 00:22:01.360 --> 00:22:05.860 intermediate transaction and the original transaction, by the way, that needs to 00:22:05.860 --> 00:22:07.820 have passed. That's all that really needs to happen. 00:22:08.000 --> 00:22:12.060 Exactly. Well, and it needs to go to the destination that was committed to in the 00:22:12.060 --> 00:22:13.600 second transaction. 00:22:15.200 --> 00:22:16.940 Sure, it needs to go to my address. 00:22:17.200 --> 00:22:17.500 Exactly. 00:22:17.780 --> 00:22:19.140 Yeah, otherwise it wouldn't be valid, right? 00:22:19.280 --> 00:22:22.600 So it's completely, essentially it's predetermined, but you have to wait a while 00:22:22.600 --> 00:22:24.020 before you can send it on the internet. 00:22:24.280 --> 00:22:24.440 Yeah. 00:22:24.720 --> 00:22:29.640 And this is kind of like the hot wallet that you see in these other vault 00:22:29.640 --> 00:22:33.330 designs, except it's not really a wallet. It's some sort of limbo place. Where 00:22:33.330 --> 00:22:35.350 your transaction briefly rests and then continues. 00:22:35.350 --> 00:22:39.330 Yeah it's really a new kind of thing like this is probably the main new kind of 00:22:39.330 --> 00:22:42.930 thing. Well this is the main new kind of thing in this proposal. That there's 00:22:42.930 --> 00:22:48.250 this intermediate limbo transaction that can just be spent after some time and 00:22:48.250 --> 00:22:52.690 doesn't require any of the [unclear] signatures after that yeah okay so that's 00:22:52.690 --> 00:22:58.130 these are sort of the three main transactions at least In the happy place? 00:22:58.290 --> 00:23:02.610 Yeah, and in the unhappy place, there is a recovery transaction. And this 00:23:02.610 --> 00:23:06.250 essentially just, because you've committed to the recovery script in advance, 00:23:06.450 --> 00:23:11.000 you've basically told that you can simply spend it with the recovery script. And 00:23:11.000 --> 00:23:12.860 then send it wherever you want immediately. 00:23:13.160 --> 00:23:16.380 I'm not sure what that means. I'm not sure what you're saying now. 00:23:17.140 --> 00:23:21.140 So you can spend it by sending it to the recovery destination. I think that's it. 00:23:21.340 --> 00:23:25.020 So you can always make a transaction that takes the money out of the vault and 00:23:25.020 --> 00:23:28.680 sends it to your recovery destination. And you've decided what that recovery 00:23:28.680 --> 00:23:31.420 destination is when you created the vault. 00:23:32.670 --> 00:23:34.430 Because the first transaction... 00:23:34.430 --> 00:23:38.750 You probably still need a signature for that transaction, right? Or is that 00:23:38.750 --> 00:23:39.470 always possible? 00:23:39.630 --> 00:23:45.150 No, I think not. I think it's optional. But I think in principle, if somebody 00:23:45.150 --> 00:23:49.130 else knows how your vault works, they can trigger it. But if you just keep that a 00:23:49.130 --> 00:23:49.870 secret, they can't. 00:23:51.680 --> 00:23:56.900 I see. So anyone should be able to send... Well, at least you should be able to 00:23:56.900 --> 00:24:01.560 send... The money from your vault to your super secure backup anytime you want. 00:24:01.560 --> 00:24:06.760 Yeah, and also and this is the important part, I think you can also send the 00:24:06.760 --> 00:24:11.560 money to the super secure setup from the intermediate transaction. 00:24:11.560 --> 00:24:16.360 Exactly so you can either do it because you lost whatever ability you had to use 00:24:16.360 --> 00:24:20.740 the vault normally right but you can also take it from the intermediate 00:24:20.740 --> 00:24:23.700 transaction if you see that somebody is taking money out of your vault and you 00:24:23.700 --> 00:24:27.900 were not expecting it then you have X amount of days or hours or whatever it is 00:24:27.900 --> 00:24:31.220 to send your money to your backup destination. 00:24:31.560 --> 00:24:32.680 So in that case, 00:24:33.890 --> 00:24:38.650 that also requires nothing in particular? That requires no signature or nothing? 00:24:39.130 --> 00:24:41.890 No, as far as I know, it doesn't. And there was some discussion on the mailing 00:24:41.890 --> 00:24:46.870 list about whether that's good or not, because if you have multiple coins in the 00:24:46.870 --> 00:24:51.030 same vault, then if you decide to pull one back to the backup location, somebody 00:24:51.030 --> 00:24:54.070 else can go ahead and send all the other ones back. But that's probably what you 00:24:54.070 --> 00:24:57.510 want. But I think there is some option if you don't want that for some reason to 00:24:57.510 --> 00:24:58.890 opt out of it. 00:24:59.310 --> 00:24:59.670 Okay. 00:24:59.810 --> 00:25:02.410