Vaults and Covenants

💡 The Plain-English Definition

Covenants are Bitcoin spending conditions that restrict not just who can spend some bitcoin, but where it’s allowed to go next. Vaults use covenants to create a withdrawal delay with a cancellation window — so if your keys are stolen, you can reclaim the bitcoin before the thief can finalise the transaction.

🤔 But Why Though?

Standard Bitcoin security has an unavoidable weakness: if someone gets your private key, they can move your bitcoin immediately — instantly and irreversibly. Self-custody means accepting that risk and managing it through careful operational security. Covenants change this by adding a constraint on where funds can go: even with the right key, the bitcoin can’t go just anywhere. The script either limits it to a set of allowed destinations or enforces a delay before the funds can be reached.

A Bitcoin vault built on covenants would work like this. You send bitcoin into a vault address. When you want to withdraw, you don’t send it straight to its final destination — you first start the withdrawal toward a pre-defined “recovery” path. After a delay of, say, 24 hours, enforced by a CSV timelock (a script condition requiring a set number of blocks to pass after the starting transaction confirms), the bitcoin can move on to the final destination.

During that 24-hour window, if you see a withdrawal you didn’t start — because a thief triggered it — you can broadcast a “clawback” transaction that sends the bitcoin back to a cold-storage address (keys kept offline), cancelling the theft. The thief can’t complete the move, because the delay gives you time to react.

Two proposed opcode upgrades would make this possible. OP_CTV — CheckTemplateVerify, BIP119, proposed by Jeremy Rubin — lets a transaction commit to exactly which future transaction is allowed to spend its output, enforcing the “where it goes next” restriction simply and efficiently. OP_VAULT — BIP345, proposed by James O’Beirne — implements the full vault pattern, with delay and clawback, in a more flexible way. As of 2025–2026, neither has been activated in Bitcoin; both remain proposals under active debate about whether their benefits justify the extra scripting complexity.

There’s also the Winternitz Vault, a variant that uses hash-based signatures instead of elliptic-curve cryptography. Because hash-based signatures resist quantum computers, it addresses both custody security and the post-quantum threat at once, which could make vaults relevant to current and future security concerns alike.

🌍 The Real-World Analogy

A Bitcoin vault with covenants is like a bank transfer with a mandatory 24-hour review period before it clears. When you start the transfer, it sits pending — visible to you — before it completes. If someone fraudulently starts a transfer from your account, you see the pending transaction, call the bank, and cancel it before it clears. Today’s Bitcoin has no such window: once a transaction is broadcast with a valid signature, it’s permanent. Covenants add that pending window back — not by involving a bank, but by encoding the delay and cancellation logic directly in the Bitcoin script.