Covenant

Covenant is a restriction encoded into a Bitcoin output that limits how the coins can be spent in the future, beyond simply proving ownership of a key. Ordinary Bitcoin Script answers one question — "is this spend authorized right now?" — whereas a covenant extends that to "is this spend authorized, and does the next transaction also satisfy these conditions?" In practice a covenant can constrain the destination addresses, amounts, or structure of the transaction that spends the output, so the rules travel with the coins instead of ending at the signature check.

Recursive vs. non-recursive

Covenant designs are commonly grouped by whether they can chain indefinitely. A non-recursive covenant commits to a fixed, fully enumerated next transaction and cannot impose further restrictions beyond it — you know at creation time exactly what the spending transaction will look like. A recursive covenant can require that the conditions carry forward into subsequent spends, potentially forever, enabling more powerful but also more debated constructions. This distinction is central to the design discussion: non-recursive proposals are pitched as bounded and analyzable, while recursion raises harder questions about coins that could be permanently encumbered. Every UTXO under a recursive covenant is, in a sense, a small state machine — a significant departure from Bitcoin's deliberately stateless spending model.

What covenants enable

Proposed and experimental uses include secure storage vaults with delayed, reversible withdrawals — the flagship use case, where an attacker who steals your keys still cannot move coins to an arbitrary address without tripping a recovery path; non-interactive payment-channel and Lightning channel constructions that reduce the interactivity today's protocols require; congestion control, where a single confirmed transaction commits to a batch of payouts that unfold later at lower fee pressure; payment pools that let many users share one UTXO; and discreet log contracts. For self-custody specifically, vault-style covenants are the most interesting frontier: they promise the kind of time-delayed, reversible-withdrawal protection that today requires trusted co-signers or elaborate multisig ceremonies, enforced instead by the consensus rules themselves.

The proposals and the caution

Because covenants change the expressiveness of Bitcoin's spending rules, they are a deliberately cautious area of protocol research. OP_CHECKTEMPLATEVERIFY (CTV) takes the minimal path: an output commits to the hash of a specific spending-transaction template, giving non-recursive covenants with a small, well-understood surface. OP_VAULT targets the vault use case directly with purpose-built opcodes. OP_CAT, by contrast, is a tiny primitive whose combinations unlock broad — including recursive — covenant behavior, which is precisely why it draws both enthusiasm and concern. Each would arrive through a soft fork adding or redefining an opcode, and none had achieved activation consensus as of early 2026. The slow pace is a feature: changes to what Bitcoin's money can be programmed to do deserve years of adversarial review, not months.

The standing objections deserve honest airing too. Critics worry that expressive covenants could be used to encode transfer restrictions into coins themselves — whitelisted destinations, permissioned money — degrading fungibility; that recursive designs might create coins permanently trapped by buggy or malicious scripts; and that each expansion of Script's power widens the surface future soft forks must remain compatible with. Proponents answer that non-recursive designs are provably bounded, that nobody can impose a covenant on coins they do not own, and that the same expressiveness objection applied to past upgrades that proved benign. The debate is genuinely unsettled, which in Bitcoin is the system working as intended.

Covenants sit at the intersection of self-custody and protocol engineering — the attempt to make holding your own keys safer without adding trusted parties. See Bitcoin vault for the flagship application, and CTV above for the leading minimal design.