3

Is the following scenario possible?

I want to send money to a script. This script will require knowing a private key to spend, as usual, but the script is only valid if the money is being sent to one of two addresses. That is, if the transaction has more than one output, it is invalid. If the transaction's output is a standard script to address A or to address B then it is valid. If the transaction output value is any less than x, it is invalid.

In other words, it seems the scripts serve to validate that you can spend the output, but then the output can be spent however the claimant wants. Is there any way to limit how the outputs are spent? All this without requiring a trusted oracle of course.

Improve this question
4
  • Interesting question. This particular application (funds to be paid to either A or B, but a third party C gets to decide which) might be achievable using multisig transactions, but maybe needing more interaction between the parties.
    – Nate Eldredge
    Mar 21, 2014 at 3:51
  • @NateEldredge: Wouldn't multisig not help with this? e.g. say you need 2 of A, B, or C's signatures to spend it. A and B could both decide to just send it to E.
    – Claudiu
    Mar 21, 2014 at 4:02
  • One way would be to require 3 signatures out of 4, and give two shares to C.
    – Nate Eldredge
    Mar 21, 2014 at 12:04
  • @NateEldredge: Oh interesting. So you need either A&C, B&C, or all three. Someone could still steal all the private keys and send the money to E, though. I'm asking if there's a network-level rule to restrict how an input is spent, but it seems like there isn't.
    – Claudiu
    Mar 21, 2014 at 15:57

1 Answer 1

Reset to default
2

There's no way for an input script to control the output script, so it can't be encoded into the script itself. However, you can get the same effect with more than one partially-signed transaction. Make a P2SH 2-of-2 multisig address, where you hold one key and the claimant holds the other. Send it some Bitcoin. Then part-sign two transactions from that address, one to A and the other to B. Send the claimant both transactions.

The claimant will only be able to spend exactly the amount you sign for, so if you really want a lower limit you'll need to create more transactions with different outputs.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.