SIGHASH_ANYONECANPAY

SIGHASH_ANYONECANPAY is a modifier flag (value 0x80) that, when combined with one of Bitcoin's three base signature-hash modes, restricts a signature to cover only the single input it is spending. Every other input is left outside the signature's commitment, which means anyone can add further inputs to the transaction without invalidating the existing signature. The name is literal: once you have signed your own input this way, anyone can pay alongside you.

What the flag changes

Normally a Bitcoin signature commits to the entire input set: add or remove any input and every prior signature breaks. That default is what makes a finished transaction tamper-evident. With ANYONECANPAY set, the signing algorithm shrinks the committed input data down to just the input being signed — its outpoint, script, and amount — so the signature says, in effect, "I authorize this coin to be spent into these outputs, and I don't care what other coins join." The flag never travels alone; it is OR-ed with a base mode, and the base mode continues to govern the output side independently. The mechanics of how each combination serializes the transaction are covered under sighash and the full flag family under SIGHASH flags.

The three combinations

ALL | ANYONECANPAY (0x81) signs one input and all outputs: "my coin goes to exactly this output set, whoever else contributes." This is the crowdfunding primitive. NONE | ANYONECANPAY (0x82) signs one input and no outputs — close to a blank cheque for that coin, rarely safe outside special protocols. SINGLE | ANYONECANPAY (0x83) signs one input and the single output at the same index: "my coin funds this specific output, everything else is open," useful for appending matched input/output pairs to an existing transaction.

What it enables

The flag is the building block for collaborative funding. Assurance-contract crowdfunding lets many participants each sign one input toward a fixed output set with 0x81; the transaction becomes valid only once enough value has accumulated, and until then anyone can join without coordination rounds. It also supports fee-topping designs where a third party adds an input to lift a stuck transaction's feerate, and construction patterns where partially signed pieces are assembled by an aggregator. The same flexibility carries into the Taproot era: the BIP341 signature-hash design retains ANYONECANPAY semantics for Schnorr-based spends under Taproot.

Risks and sharp edges

In everyday use you will almost never see this flag: ordinary wallets sign everything with SIGHASH_ALL, and that is the correct default. ANYONECANPAY surfaces in protocol-level tooling — collaborative constructions assembled through partially signed transaction workflows, where each participant contributes a signed input and an aggregator completes the package. That division of labor is precisely why signing devices display the sighash mode: a request to sign with an unusual flag on funds that should be a simple payment is a red flag worth refusing, since the looser commitment hands the assembler powers a normal payment never grants.

Openness cuts both ways. Because the rest of the input set is uncommitted, a third party can attach inputs you did not anticipate, producing a different transaction ID than expected and complicating protocols that track specific txids. An adversary can also exploit the malleability for transaction pinning — attaching inputs or conflicting spends that make the combined transaction hard to replace or slow to confirm. And the weaker combinations (especially with NONE) hand significant control to whoever completes the transaction. The rule of thumb: ANYONECANPAY is a scalpel for collaborative constructions, not a default — sign with SIGHASH_ALL unless a protocol specifically requires the looser commitment, and model what an adversary can append whenever you loosen it.