Advanced Bitcoin Transactions

Question

Let's say that 7 users want to spend money from a Bitcoin multisig address. The approval of funds from this address requires the signatures of A (the leader), either B or C (two managers), and 2 of 4 members of a board of investors (D, E, F, G). So if A, B, D, & G all submit their signatures then the transaction should be considered valid. However, even if B, C, D, E, F, and G all submit their signatures, A can veto by not submitting his/her signature.

Does the Bitcoin protocol currently support advanced transactions like this or does it only support basic M-of-N addresses/transactions?

Answer 1

This should be possible by having several checks happen in one script.

So, a normal pay-to-address script looks like:

OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG

And a normal multisig, say for 2-of-3, looks like this (format is a little different from above):

format: [byte value] [meaning]
52 OP_2, meaning you need two signatures
41 push 65 bytes
[pubkey 1]
41 push 65 bytes
[pubkey 2]
41 push 65 bytes
[pubkey 3]
53 OP_3, meaning there are three public keys
ae OP_CHECKMULTISIG described at https://en.bitcoin.it/wiki/Script

And we want to have three checks: A must have signed, 1-of-(B and C) must have signed, and 2-of-(D, E, F, G) must have signed. So we chain it like so:

OP_DUP OP_HASH160 <pubKeyHash A> OP_EQUALVERIFY OP_CHECKSIGVERIFY
OP_1 <pubkey B> <pubkey C> OP_2 OP_CHECKMULTISIGVERIFY
OP_2 <pubkey D> <pubkey E> <pubkey F> <pubkey G> OP_4 OP_CHECKMULTISIG

And hash that script to have something easy to send to (pay-to-script-hash). Note the use of the VERIFY variants in the first two checks and the ordinary one in the last. If you look at the meaning of these OP codes and the fact that a valid transaction needs to end with a non-zero value, the correctness of this should be clear.

It'd be a good idea to try this out on the testnet before using it in a real transaction, so that you don't wind up with unspendable (or spendable-by-anyone) bitcoins.