Exit

A vault’s normal spends are covenants, which the operator and the emulator cosign. Every vault also needs an exit leaf: the path its owners use to claim funds onchain if the operator is unavailable. The operator also requires one before it admits the vault’s outputs to a batch. This page shows which exit leaf each kind of vault uses. An exit leaf is a tapscript function. Bitcoin checks it after the output is unrolled (its virtual transactions are broadcast onchain) and the exit delay passes. older(serverExitDelay) gates the leaf. The client binds serverExitDelay to the operator’s delay, so it is not a constructor argument (CSV delays). The leaf body has a fixed order: an optional hash, an optional timelock, and then one checkSig or one checkMultisig. Give it a standalone name such as unilateral. A tapscript with the name of a covenant replaces that covenant’s cosigned leaf instead, and must contain emulator.

Fixed-party vaults: an N-of-N of the parties

For a fixed-party vault the author names every party key in that leaf, and the threshold equals the number of keys. The operator accepts only an N-of-N leaf, so the author cannot write a smaller threshold. The compiler does not add the keys for you. Name both party keys:

function unilateral(signature partyASig, signature partyBSig) tapscript {
  require(older(serverExitDelay));
  require(checkMultisig([partyAPk, partyBPk], [partyASig, partyBSig], 2));
}

Escrow passes its own exit parameter to older instead of serverExitDelay. The savings vault names the owner:

function unilateral(signature ownerSig) tapscript {
  require(older(serverExitDelay));
  require(checkSig(ownerSig, owner));
}

Tokenized vaults: a NUMS key until PULSE

A tokenized vault cannot name every holder in one leaf. A standing exit for open membership, PULSE, is still research (compiler#91). No template on this tab ships it. Until then, the exit leaf pins a NUMS key: a valid public key that nobody can sign for. The operator accepts the script, and holders leave through the covenant paths. If the operator is unavailable, a holder has no way out: nobody can sign the NUMS leaf, so the virtual output cannot be spent, renewed, or exited, and the funds stay locked. The prediction market’s vault does this:

contracts/src/market_vault.ark @ c0b063f

  // BIP341 NUMS point: arkd needs an exit leaf to admit the vault to batches; nobody can sign it.
  pubkey noExitKey,
  // ...
  function unilateral(signature noExitSig) tapscript {
    // ...
    require(checkSig(noExitSig, noExitKey));
  }

The Tokenized, Lending, and Automated Market Maker contracts use the same leaf.

Understand

Reference

Fixed-party vaults: an N-of-N of the parties

Tokenized vaults: a NUMS key until PULSE

​Fixed-party vaults: an N-of-N of the parties

​Tokenized vaults: a NUMS key until PULSE

Fixed-party vaults: an N-of-N of the parties

Tokenized vaults: a NUMS key until PULSE