BA-06 · LESSON 06

Multisig and policy composition

KEY DEFINITIONS

Terms used in this lesson

Hashlock: A spending condition that requires revealing data matching a committed hash.
Preimage: The original secret data whose hash equals a previously committed value.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.
CLTV: CheckLockTimeVerify: a Bitcoin Script operation that enforces an absolute time or block-height condition.
CSV: CheckSequenceVerify: a Bitcoin Script operation that enforces a relative delay after an earlier output confirms.
Hash160: SHA-256 followed by RIPEMD-160, producing the 20-byte hash used by several Bitcoin spending conditions.
CHECKSIG: The Bitcoin Script operation that checks whether a signature is valid for the required public key and transaction message.

Multiple keys, timelocks, and hashlocks can form recovery, escrow, and channel policies.

45 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · script stackWitness data is evaluated by a deterministic stack machineSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered validation pipeline

01
WITNESSStack items
The spender supplies signatures, preimages, selectors, or other required items.
02
PROGRAMLocking script
The prior output determines the program and rule version to execute.
03
EXECUTEMultisig and policy composition
This lesson follows the stack effects and failure boundary for Multisig and policy composition.
04
FIRST FAILUREOpcode and state
Invalid encoding, underflow, failed verification, or disabled behavior stops execution.
05
FINAL STACKTrue or false
Consensus accepts the input only when the applicable Script rules succeed.

Rule shown: A spend succeeds only if every opcode is valid and the final stack satisfies the spending condition.

STAGE 1 OF 5WITNESS: Stack items

The spender supplies signatures, preimages, selectors, or other required items.

Governing relationship: A spend succeeds only if every opcode is valid and the final stack satisfies the spending condition. Complete path: 1. WITNESS, Stack items. The spender supplies signatures, preimages, selectors, or other required items. 2. PROGRAM, Locking script. The prior output determines the program and rule version to execute. 3. EXECUTE, Multisig and policy composition. This lesson follows the stack effects and failure boundary for Multisig and policy composition. 4. FIRST FAILURE, Opcode and state. Invalid encoding, underflow, failed verification, or disabled behavior stops execution. 5. FINAL STACK, True or false. Consensus accepts the input only when the applicable Script rules succeed.

1. State transitionWhat exists, what changes, and what results

BEFORE

Alice can claim with secret s before coordination ends; after 100 blocks Bob can refund with his signature. The output commits to HASH160(s).

MECHANISM

For example, the fast branch might require Alice and Bob, while recovery requires Carol after 144 blocks.

AFTER

Hashlocks control knowledge, timelocks control eligibility, and signatures control authorization. A policy often needs all three dimensions.

Text equivalent: Starting from Alice can claim with secret s before coordination ends; after 100 blocks Bob can refund with his signature. The output commits to HASH160(s). The mechanism begins when For example, the fast branch might require Alice and Bob, while recovery requires Carol after 144 blocks. The resulting lesson is Hashlocks control knowledge, timelocks control eligibility, and signatures control authorization. A policy often needs all three dimensions.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Write each branch as a condition

For example, the fast branch might require Alice and Bob, while recovery requires Carol after 144 blocks.

Complete path: 1. Write each branch as a condition: For example, the fast branch might require Alice and Bob, while recovery requires Carol after 144 blocks. 2. Commit secrets rather than reveal them: A hashlock output contains a hash. The preimage stays off chain until a spending path reveals it. 3. Bind time conditions: CLTV or CSV checks transaction fields and chain context. Signatures remain necessary if the policy requires authorization after the delay. 4. Construct branch-specific witnesses: Each path needs only its required signatures, preimages, selector value, and revealed script or proof in the correct order. 5. Analyze all paths: Security is set by the easiest unintended satisfiable path. Review bypasses, signer collusion, secret leakage, timeout race, and fee availability.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Each branch independently checks its selector, signatures, preimage commitment, absolute or relative delay, and exact witness order before final truth.

CHANGED CONDITION

Removing any required item or using an immature delay fails at its first predicate; satisfying one dimension cannot bypass another branch condition.

Important distinction: Learning a hashlock preimage always grants unilateral control of the output. The selected branch may also require a signature, timelock state, or other condition. The complete script determines authority.

Text equivalent: The accepted path is enforced by Each branch independently checks its selector, signatures, preimage commitment, absolute or relative delay, and exact witness order before final truth. If the required condition changes, Removing any required item or using an immature delay fails at its first predicate; satisfying one dimension cannot bypass another branch condition.

Loading lesson visuals...

Learn the idea

A spending policy can combine signatures, timelocks, and hashlocks. A hashlock requires a preimage whose hash matches a commitment. An absolute timelock targets a height or time, while a relative timelock requires an output to age. Multisig requires a threshold of listed keys. Script branches let different combinations satisfy the same output.

GUIDED EXPLANATION1/5 ideas inspected

Write each branch as a condition

For example, the fast branch might require Alice and Bob, while recovery requires Carol after 144 blocks.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Learning a hashlock preimage always grants unilateral control of the output.”

The selected branch may also require a signature, timelock state, or other condition. The complete script determines authority.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.