[Paper Review] Bitcoin Covenants: Three Ways to Control the Future

Jacob Swambo, Spencer Hommel+2 more|arXiv (Cornell University)|Jun 30, 2020

Blockchain Technology Applications and Security19 references4 citations

TL;DR

This paper proposes three practical approaches to implementing Bitcoin covenants—deleted-key, recovered-key, and script-based covenants—without altering Bitcoin's consensus rules, demonstrating that deleted-key covenants offer strong security through pre-signed transactions and secure key deletion, while recovered-key and script-based covenants enable non-interactive enforcement via soft-fork upgrades, significantly improving practicality for custody and payment protocols.

ABSTRACT

A bitcoin covenant is a mechanism to enforce conditions on how the control of coins will be transferred in the future. This work introduces deleted-key covenants; using pre-signed transactions with secure key deletion. With this, a general class of covenants are possible without introducing new security risks to bitcoin. There is a range of security models for the key deletion process, but this is subject to a security-convenience trade-off and requires interactivity in a multi-party context. On the other hand, this work makes a compelling case for what can be gained through a soft-fork upgrade to the signature hash system [Dec17] which enables recovered-key covenants through elliptic curve key recovery. This has similar properties to script-based covenant mechanisms proposed previously [Rub20]. Key factors are discussed and compared for the three covenant mechanisms, including; the enforcement process, methods for proving accessibility of funds and whether or not they are bound by a covenant, methods for dynamic fee allocation, the underlying cryptographic assumptions, and their feasibility in single-party, hierarchical and adversarial multi-party contexts. Despite the relative downsides of deleted-key covenants, they are a practical tool for custody protocol design. The comparison shows precisely how soft-fork proposals improve the practicality of bitcoin covenants, through non-interactive enforcement and tighter cryptographic assumptions, to enhance custody protocols and enable some adversarial applications such as payment protocols.

Motivation & Objective

• To design a class of Bitcoin covenants that enforce future spending conditions without requiring consensus rule changes.
• To analyze the trade-offs between security and convenience in deleted-key covenants, particularly regarding key deletion procedures.
• To evaluate the feasibility and advantages of soft-fork-enabled covenants (recovered-key and script-based) for broader protocol applications.
• To compare the security models, cryptographic assumptions, and practical deployment contexts of each covenant type.
• To assess the utility of covenants in self-custody, joint-custody, and adversarial multi-party settings, especially for financial and custody protocols.

Proposed method

• Proposes deleted-key covenants using pre-signed transactions and secure key deletion, relying on multi-signature setups to enforce deletion procedures.
• Introduces recovered-key covenants via a new SIGHASH type that enables dynamic binding of signatures to prior outputs, allowing non-interactive covenant enforcement.
• Analyzes script-based covenants as a complementary approach, leveraging existing Bitcoin Script for conditional spending rules.
• Evaluates security models for deleted-key covenants based on the number of signing devices and deletion procedures, ranging from single to distributed trust models.
• Demonstrates dynamic fee allocation in covenant chains by showing that intermediate transactions can be modified without breaking dependencies.
• Uses formal analysis to compare cryptographic assumptions, activation processes, and auditability across all three covenant types.

Experimental results

Research questions

• RQ1 Can a general class of Bitcoin covenants be constructed without changing Bitcoin’s consensus rules, and what are the security trade-offs involved?
• RQ2 How does the security of deleted-key covenants depend on the key deletion process, and what are the implications for auditability and adversarial settings?
• RQ3 What advantages do recovered-key and script-based covenants offer over deleted-key covenants in terms of non-interactivity, cryptographic assumptions, and practical deployment?
• RQ4 To what extent can covenant mechanisms improve the design of custody and payment protocols in Bitcoin?
• RQ5 What are the systemic and social challenges to deploying soft-fork-enabled covenant mechanisms, and how do they compare to non-upgradeable alternatives?

Key findings

• Deleted-key covenants provide strong security through pre-signed transactions and secure key deletion but require interactive enforcement, limiting their use in adversarial or auditable contexts.
• Recovered-key covenants enable non-interactive enforcement and proof of covenant binding, bypassing the key deletion trade-off and offering superior practicality across all deployment models.
• Script-based covenants are functionally equivalent to recovered-key covenants in terms of utility, with both enabling dynamic fee allocation and secure chain composition.
• The proposed SIGHASH-based soft-fork upgrade enables recovered-key covenants by allowing signatures to bind to different previous outputs, simplifying off-chain protocols and enhancing security.
• Dynamic fee allocation is safe and effective in recovered-key and script-based chains, as intermediate transactions can be modified without invalidating dependent transactions.
• Despite their limitations, deleted-key covenants remain highly practical for self-custody and joint-custody protocols due to their ability to enforce sequential spending rules, time-locks, and rate-limits.