Alice wants Bob to transfer 10btc to Carol, and is willing to pay Bob 11btc for the transfer.

They both entrust Trent to mediate the transaction, and Alice is willing to pay Trent 1btc as commission.

What is the correct and most secure protocol for performing this contract?

Edit: does the following protocol make sense?

  1. Alice broadcasts a transaction (Tx1) with 2 outputs:
    • 11btc with an output script specifying 2-of-3 multi-signature verification, specifying Alice, Bob and Trent as recipients
    • 1btc to Trent (commission)
  2. Bob verifies Alice's transaction:
    • Verified: Bob broadcasts a transaction (Tx2) sending Trent 10btc
    • Rollback - Bob is unsatisfied or fails to transfer the funds to Trent: Trent broadcasts a transaction (Tx3) sending Alice her 11btc back, specifying Tx1's first output as an input and signs the input. When Alice wants to spend Tx3, adding her signature to the input satisfies the 2-of-3 requirement (and the process stops here)
  3. Trent broadcasts a transaction (Tx4) sending Bob the 11btc, specifying Tx1's first output as an input. When Bob wants to spend Tx4, adding his signature to the input satisfies the 2-of-3 requirement
  4. Trent broadcasts a transaction (Tx5) sending Carol 10btc, specifying Tx2 as an input
  • 2
    Why doesn't Alice pay Carol 10 BTC herself, then pay 1 BTC to Bob?
    – Nick ODell
    Mar 18, 2013 at 15:18
  • Theoretically, Alice wants plausible deniability regarding the transfer of funds to Carol.
    – nivs
    Mar 18, 2013 at 15:32
  • 4
    The Bitcoin protocol can do M of N transactions, but the clients don't yet support it. The solution will be coming. Mar 18, 2013 at 18:22
  • Thanks Stephen. What I'm looking for is the best security protocol for fulfilling the contract (preserving the plausible deniability of Alice, making sure Alice and Bob transfer funds, and enabling Trent to rollback the transaction), regardless of client implementation.
    – nivs
    Mar 18, 2013 at 19:16
  • For clarification, as far as "plausible deniability", it should appear that the final decision to transfer funds to Carol was made by Bob and/or Trent, not Alice? Jan 13, 2014 at 4:05

2 Answers 2


Your protocol makes sense, but i would modify it as follows

  1. the 1btc sent to trent should also be mutlisig with Alice's signature as the 2nd one, so that if Trent fails to do what he promised he gets no commission. ((the 1btc will stay in limbo, unless Alice and Trent can somehow work this out)
  2. The Tx2 should also be multisig and Carol's signature should be added, that way Trent can't run with the money.

There is BTCrow (http://btcrow.com/) and ThruCoin (http://thrucoin.com/create), which both look like they will perform the services you need.

  • 4
    Thanks @cjastram, but I'm not looking for a service that implements it but for a description of the best information flow between parties. Also note that Carol is an uninvolved 3rd party, if that makes any difference.
    – nivs
    Mar 18, 2013 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.