There's some conflicting information out there on whether this is true or not. I'm looking for a technical answer to this in the hopes of clearing up future potential confusion over the matter.
The main question is: Can old non-upgraded non-segwit aware wallets redeem a segwit output it receives?
Segwit output is defined as an outpoint having a P2WPKH or P2WSH structure as outline in bip141 in its scriptPub section.
As I understand it, when an old wallet receives a segwit transaction meant for it(assume tx is already mined in a block), it will see 0 <20-byte hash>(assuming P2WPKH) in the scriptPub from this segwit transaction. Interpreting this under non-segwit rules, old wallets will see this as anyone_can_spend -- the top of the script stack always evaluates to truthy regardless of what's provided in the scriptSig in the redeeming transaction.
The only way for the wallet to use/redeem this segwit output is to construct a transaction as outline in the bip. That is, it constructs the transaction specifying prev_txid and index as normal, an empty scriptSig and a witness program + witness hash. But a non-segwit aware wallet won't know how to construct the last part of this. Without that part, segwit validating nodes and miners will have to reject this transaction.
So from this, it naturally follows that old non-segwit wallets should not be able to spend segwit transactions.
Note, this question is not about:
- old wallets sending non-segwit inputs -> to a segwit output.
- segwit wallets sending segwit inputs -> to a non-segwit output.
