Bitcoin Covenants: CHECKTEMPLATEVERIFY (BIP 119)

The is the archetypal nonfiction heavy diving into idiosyncratic covenant proposals that person reached a constituent of maturity meriting an successful extent breakdown. 

CHECKTEMPLATEVERIFY (CTV), enactment guardant by Jeremy Rubin with BIP 119, is the astir mature and afloat fleshed retired covenant proposal, not lone retired of the proposals we volition beryllium covering, but retired of each of the covenant proposals successful their entirety. As I mentioned successful the instauration nonfiction to this series, determination are galore concerns successful the ecosystem regarding covenants that are excessively flexible enabling things that upwind up having precise detrimental consequences for Bitcoin. 

CTV was designed specifically to constrain its capabilities tightly capable to debar immoderate of those concerns. To archetypal recognize however CTV functions, we request to recognize the idiosyncratic parts of a Bitcoin transaction. 

This is simply a precise precocious level presumption of a Bitcoin transaction. It has inputs, oregon unspent coins (UTXOs), and outputs, the caller unspent coins that the transaction volition make erstwhile it is confirmed successful a block. There are a batch much pieces we volition spell through, but this is the highest level presumption of a transaction’s structure. 

Every transaction besides has a mentation fig tract for the full transaction, indicating applicability of caller versions of rules oregon features. There is besides the marker and the flag, which are acceptable to circumstantial values to bespeak the transaction uses Segwit. After this is the input count, the fig of inputs successful the transaction. Then travel the existent inputs. 

Each input contains a TXID of the transaction that created the unspent coin being spent, a VOUT which marks what output successful that transaction is being spent, the size of the ScriptSig, and the ScriptSig, which is the unlocking publication proving the input being spent is authorized by its locking publication rules, and yet a Sequence fig which is utilized to guarantee the input being spent is pursuing comparative timelock rules. i.e. the input has existed for a definite fig of blocks oregon magnitude of clip since its creation. 

The output number is the adjacent portion of data, the fig of outputs successful the transaction. After this comes the existent outputs, which incorporate an magnitude of satoshis assigned to that output, the ScriptPubKey size, and the existent ScriptPubKey, which is the locking publication for that output. Lastly the nLocktime tract applies a timelock worth successful timestamp oregon artifact tallness that applies to the full transaction. 

Each Segwit transaction besides contains a Witness section, wherever each input has a corresponding witnesser containing a Stack Items count, however galore things volition beryllium enactment connected the publication stack, a Size tract for each item, and the existent information Item to spell connected the stack. 

How CTV Works

CTV is an opcode that enables the astir basal signifier of introspection and guardant information carrying retired of each the covenant proposals. It allows a publication to instrumentality a pre-defined 32 byte hash and comparison that against a hash of astir of the fields of the spending transaction. If the hash derived from the existent spending transaction does not lucifer the pre-defined hash, the transaction is invalid. 

The fields it commits to are:

• nVersion
• nLocktime
• Input count
• A hash of each the nSequence fields
• Output count
• A hash of each the outputs
• Input scale (the spot the input has successful the transaction, 1st input, 2nd, etc.)

These are each the fields committed to by the CTV hash, successful their entirety, and with nary quality to prime and choose. This is the grade of introspection CTV enables, “does the hash of these fields successful the spending transaction lucifer the hash successful the locking publication of the input being spent,” that’s it. The hash commits to fundamentally the full transaction but the existent inputs. There is simply a crushed the hash does not see the inputs. In bid to fastener an output to a 32 byte hash with CTV, you request to cognize the hash of the transaction that you are ensuring is the lone mode for it to beryllium spent. The input locked with CTV being spent volition person to see this hash successful bid to beryllium verified against CTV. That necessitates having the hash of that transaction before you make the implicit transaction. That is not possible. 

You tin besides nest CTV scripts, i.e. person an archetypal CTV publication perpetrate to a transaction with outputs that besides see CTV scripts. This is what allows CTV to “carry forward” data. All it carries guardant successful signifier though is immoderate information is contained successful the concatenation of transactions. You tin bash this successful mentation to an infinite depth, but you are constricted successful signifier to a finite extent due to the fact that the nesting indispensable beryllium generated backwards starting from the end. This is due to the fact that each level, oregon “hop,”  indispensable person the hash of the transaction moving to the adjacent one, different you can’t make the locking publication successful the archetypal place. If you don’t already cognize the adjacent transaction, you can’t make the erstwhile one. 

What Is CTV Useful For

CTV allows you to restrict an output truthful that it tin lone beryllium spent, according to statement rules, by an nonstop pre-defined transaction. Some of you mightiness beryllium asking what the large woody is, we tin already pre-sign transactions. If the level of introspection is truthful constricted that it tin lone execute thing we tin already bash conscionable pre-signing, what is the worth add? 

First, pre-signed transactions ever permission unfastened the anticipation of the keyholder(s) signing caller transactions and spending those coins successful a antithetic way. You person to spot that the keyholder volition not bash this, oregon volition delete the cardinal needed to motion with (which you besides person to spot them on). CTV removes that spot entirely. Once the spending transaction is defined and the output locked to that CTV hash is created, determination is nary anticipation of being spent different way, enforced by consensus. 

Currently the lone mode astir that spot is to beryllium progressive successful pre-signing transactions yourself utilizing multisig. Then you tin beryllium wholly definite that unless you take to motion 1 yourself, nary different valid transaction spending a coin successful a antithetic mode tin beryllium created. The occupation is the much radical are involved, the much hard and unreliable coordinating everyone to pre-sign a transaction astatine the aforesaid clip becomes. Past tiny sizes it becomes a wholly impractical occupation to lick reliably. 

CTV gives a mode for radical to cognize a acceptable of transactions is committed without everyone having to get online astatine the aforesaid clip to motion them. It greatly simplifies the coordination process by allowing everyone to get the needed accusation to anyone other whenever they can, and erstwhile that idiosyncratic has everyone’s accusation they tin make the concatenation of CTV transactions without anyone else’s involvement, and everyone tin verify and beryllium definite that the close result is the lone imaginable one. 

That is incredibly invaluable connected its own, but CTV tin besides alteration adjacent much invaluable things successful operation with different opcodes, which we’ll spot successful the adjacent article. 

Closing Thoughts

CTV is simply a tightly restricted covenant that enables a grade of introspection and guardant information carrying that is truthful constricted it does not transcend the existent functionality of thing that tin beryllium done with pre-signed transactions. The worth proposition is not successful enabling caller functionality successful its ain right, but drastically improving the efficiency, scalability, and information guarantees of what tin beryllium built presently utilizing pre-signed transactions. This unsocial is simply a monolithic payment to astir each presently deployed protocol utilizing pre-signed transactions.

Here are immoderate of the projects demonstrating however thoroughly fleshed retired and explored this peculiar covenant is compared to the others:

• A basal outgo excavation example by stutxo. 
• A CTV vault implementation by James O’Beirne, who went connected to suggest OP_VAULT (which inactive makes usage of CTV). 
• A proof-of-concept larboard of the pre-signed transaction based Ark implementation from Second by Steven Roose to usage CTV instead.
• The Sapio Language by Jeremy Rubin himself, a higher level connection for gathering contracts with CTV (also supporting the usage of pre-signed transactions instead). 
• Timeout Trees, a connection for a precise basal coinpool plan by John Law.
• Numerous different possible protocols, specified arsenic optimized Discreet Log Contracts (DLCs), non-interactive Lightning channels 1 enactment could unfastened without the other, and adjacent decentralized ways for miners to excavation together. 

CTV is an incredibly mature connection astatine this point, with a precocious worth add, and nary hazard of enabling thing driving the concerns astir covenants. This should not lone beryllium precise earnestly considered, but successful my idiosyncratic sentiment should person been activated years ago.