**Understanding SIGHASH_ANYPREVOUT and Its Role in Bitcoin Covenants**
In the ongoing exploration of Bitcoin covenants, Part 3 of our technical series delves into a significant proposal: **SIGHASH_ANYPREVOUT**. This mechanism, outlined in BIP 118, builds upon concepts from earlier Bitcoin research, particularly the foundational work on the Lightning Network and subsequent discussions within the Bitcoin community.
SIGHASH_ANYPREVOUT is not a novel opcode but represents a proposed new value for the existing SIGHASH flag. This flag, appended to a signature, dictates which components of a transaction are subject to signing and verification by the CHECKSIG opcode. Traditionally, the SIGHASH flag is selected by the transaction signer, and its implications are well-established across various standard modes. These modes include:
– **SIGHASH_ALL**: Signs all inputs, outputs, and the specific outpoint.
– **SIGHASH_NONE**: Signs only inputs, leaving outputs unconstrained.
– **SIGHASH_SINGLE**: Signs all inputs but only the corresponding output at the same index.
– **ANYONECANPAY**: Allows a single input to be signed independently.
A critical limitation of these existing modes is that they all require commitment to the specific outpoint being spent—the unique combination of a transaction ID and output index. **SIGHASH_ANYPREVOUT fundamentally alters this by removing the outpoint from the signature digest.** This modification allows a single signature to authorize spending *any* compatible Unspent Transaction Output (UTXO) that matches the remaining committed fields, such as the amount and scriptPubKey.
The BIP 118 proposal defines two variants that differ in the extent of omitted information:
1. **SIGHASH_ANYPREVOUT**: Excludes the outpoint but still commits to the previous output’s amount and scriptPubKey, as well as the input’s nSequence.
2. **SIGHASH_ANYPREVOUTANYSCRIPT**: Further excludes the amount and scriptPubKey, meaning the signature is not bound to the locking script of the spent output at all.
This rebinding property makes SIGHASH_ANYPREVOUT particularly valuable for layer-2 protocols and covenant-like applications. A signature created for a specific UTXO can be reused if that same address later receives a different, compatible UTXO. For instance, a pre-signed transaction for 0.5 BTC can still be used if the recipient later holds another 0.5 BTC UTXO, although any excess value would be forfeited to miners unless a change output was included. Crucially, while this enables flexibility, the ANYPREVOUT variants preserve the commitment to the scriptPubKey of the previous output, ensuring funds remain bound to the intended locking script.
It is important to note that SIGHASH_ANYPREVOUT does not enable recursive covenants or transaction introspection on its own. Its core function is to relax the binding between a signature and a specific UTXO. Furthermore, research has indicated that removing the outpoint commitment can facilitate recovered-key constructions, where a public key is derived from a fixed signature, theoretically making the key path unspendable and forcing a spend through the script path.
However, this flexibility introduces a primary risk: **signature replay**. Because the signature is not tied to a specific outpoint, it could potentially be used to spend a different UTXO that satisfies the same committed fields. This risk is heightened in certain configurations, such as when using SIGHASH_ANYPREVOUT with SINGLE, or when identical scripts and amounts exist. Mitigating this risk requires careful consideration during protocol design and implementation.
Our discussion will continue in the next article, where we will explore supporting opcode tools like OP_CHECKSIGFROMSTACK and OP_CAT, which extend Bitcoin script’s expressiveness without inherently implementing covenant functionality.
***
**Original Source:**
This article is based on “Bitcoin covenants, part 3: SIGHASH_ANYPREVOUT,” published by Cointelegraph Research. The original text and figures can be found at the link below.
**Source:** [Cointelegraph Research – Bitcoin covenants, part 3: SIGHASH_ANYPREVOUT](https://cointelegraph.com/research/bitcoin-covenants-sighash-anyprevout-bip-118)
