ScriptSig in bip65 escrow example

Question

In the bip65 there is an example how it can be used for escrow in combination with a multisig. See: https://github.com/bitcoin/bips/blob/master/bip-0065.mediawiki#Escrow

There it claims that the funds can be spent with the following scriptSig: 0 <Alice's signature> <Bob's signature> 0 but when working through the example it always seems like the is one 0 to many. I am aware of the bug where one item too many is popped of the stack, and that is why a multisig script usually has a 0 first, but why does this one also have on at the end?

Answer 1

The scriptSig part is first on stack, so there would be:

0 <Alice's signature> <Bob's signature> 0

and this for the payout into the CLTV branch:

0 <Alice/Bob's signature> <Lenny's signature> 1

After the sig part follows the pubkey script, with the first Opcode "IF". This "IF" verifies the value befor on the stack (which is "0" or "1" from the sciptSig before), and branches accordingly:

IF
   <now + 3 months> CHECKLOCKTIMEVERIFY DROP
   <Lenny's pubkey> CHECKSIGVERIFY
   1
ELSE
   2
ENDIF
<Alice's pubkey> <Bob's pubkey> 2 CHECKMULTISIG

Assuming the first branch is chosen, then the last item in the if clause is a "1", followed by the line after "ENDIF", so this becomes a 1-of-2 multisig, where only one person needs to sign. But this person has then to wait for the time lock (via CSV parameter). Here in the example: Lenny can spend after timeout is reached.

If there is a "0" on the stack before the IF clause, then the second part is executed, and this becomes a "2-of-2" multisig, which means, Alice and Bob can spend anytime.

Et voilà - smart contracts easy :-)