Covenant Proposals

Remark 30.1 (Why Bitcoin Lacks Covenants)

Bitcoin Script currently has no introspection opcodes. A script cannot examine:

• The outputs of the spending transaction
• Other inputs being spent
• Transaction metadata beyond the current input

The opcodes that would permit introspection were disabled in 2010 after vulnerabilities were found; Bitcoin Script has remained without introspection since.

DefaultCheckTemplateVerifyHash(tx, input_index):
    return SHA256(
        nVersion ||
        nLockTime ||
        SHA256(scriptSigs) ||      // if any
        input_count ||
        SHA256(sequences) ||
        output_count ||
        SHA256(outputs) ||
        input_index
    )

Vault Output (CTV-only; no key can spend it directly):
  <ctv_hash> CTV               // Can only go to the staged withdrawal

Staged Withdrawal Output:
  IF
    <delay> CSV DROP
    <hot_key> CHECKSIG         // Withdrawal: hot key, after the delay
  ELSE
    <ctv_to_cold_hash> CTV     // Clawback to cold storage: immediate
  ENDIF

A thief who steals the hot key must wait out the CSV delay,
during which the owner claws the funds back to cold storage.

Remark 30.2 (CTV Debate)

CTV has been controversial despite its simplicity:

Proponents—including BIP-119's author and, by 2025, a substantial list of developers urging activation alongside CSFS—argue that CTV is the most-reviewed covenant primitive ever proposed, that vaults address theft losses users suffer today, and that indefinite delay is itself a choice with costs. Opponents counter that no consensus change should activate without demonstrated demand from production systems, that the 2022 activation attempt tried to short-circuit the consensus process of Chapter 33, and that committing to a limited primitive now may foreclose a better general design later. (Critics sometimes add that even limited covenants begin a path toward MEV-like extraction; proponents respond that CTV's fixed, non-recursive templates leave nothing to extract—the expressivity concern belongs to general introspection, Remark 30.3.) Beneath the specific proposals lies the meta-debate of Remark 33.4: whether the difficulty of activating any covenant is a failure of governance or its proper functioning.

Stack before: [x] [y]
OP_CAT
Stack after:  [x || y]

// Conceptual (simplified)
<expected_output_script>
<actual_output_from_witness>
OP_EQUAL                        // Verify output matches
OP_VERIFY

// Then verify the sighash includes this output
<sig_components...>
OP_CAT OP_CAT ...               // Reconstruct sighash
<signature>
<pubkey>
OP_CHECKSIG

Remark 30.3 (CAT Power and Concerns)

OP_CAT, despite its two-line semantics, suffices for:

• Enables: Covenants, validity proofs, Lamport signatures
• Recursive covenants: Potentially possible with CAT
• Script complexity: CAT-based covenants are complex
• Audit difficulty: Harder to reason about than CTV
• MEV and expressivity: Critics argue that general introspection imports the miner-extractable-value dynamics of expressive chains and could be used to build transferable restrictions on coins; proponents respond that the same restrictions are already constructible off-chain and that opt-in scripts cannot encumber anyone else's coins

Remark 30.4 (Vault Security Properties)

OP_VAULT provides security guarantees, under two assumptions: the owner or a delegate monitors the chain within the timelock window, and the recovery key remains uncompromised. Given these:

1. Theft prevention: Attacker with trigger key cannot steal immediately
2. Recovery window: Owner has timelock period to react
3. Emergency recovery: Recovery key bypasses normal flow
4. No key rotation: Recovery works even if the trigger key is compromised

Remark 30.5 (Recursive Covenant Implications)

Recursive covenants enable:

• Positive: Perpetual vaults, on-chain governance, colored coins
• Concerning: "Tainted" coins, censorship infrastructure

Remark 30.6 (The Fungibility Debate)

A key concern about recursive covenants:

• Could governments mandate covenants on regulated coins?
• Would "covenant-free" coins trade at a premium?
• Does this threaten Bitcoin's fungibility?

Counter-arguments:

• Coerced covenant adoption is already possible via regulation
• Covenants are opt-in; users choose to use them
• Benefits (vaults, scaling) may outweigh risks