What does Pay to Contract (P2C) mean in Bitcoin? Is it just tweaking private/public key with the hash (represented as a number) of some message and then using classic P2PKH?

For example, if we are buying some car, the message this payment is for the car goes into SHA256 hash function. After that, tweaking the given number with the public key and by making RIPEMD(SHA256()) hash of it, we create classic P2PKH output. Later, we can prove that the payment was for the car with revealing the original public key and the message.

Is it P2C? Does it represent something more?

1 Answer 1


The actual protocol as described all the way back in 2012 in the paper Homomorphic Payment Addresses and the Pay-to-Contract Protocol is a bit more complicated, but the basics are as you've described them: create a hash from a message, then tweak the public key with this hash and you'll be able to prove later that the public key commits to your original message. Taproot implements a version of this protocol, as spending using the script path requires you to prove that your public key commits to the root of a script tree.

Bitcoin Optech has a topic for Pay-to-Contract which summarizes the topic and links to a few instances where the protocol is discussed.

  • I thought Taproot always include some kind of P2C since you are tweaking public key and a root of MAST?
    – LeaBit
    Commented Nov 7, 2023 at 23:19
  • BIP341 recommends that the key is tweaked even if you don't want to include any scripts, but you don't need to. Commented Nov 7, 2023 at 23:28
  • So you can use taproot without tweaking public key and the root of MAST in scriptPubKey?
    – LeaBit
    Commented Nov 7, 2023 at 23:33
  • Yes, see: Can you use un-tweaked public key with P2TR? Commented Nov 7, 2023 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.