AnyPrevOut (APO / BIP-118)

AnyPrevOut, abbreviated APO and specified in BIP-118, is a proposed new signature-hash (SIGHASH) mode for Bitcoin. A normal signature commits to the exact previous output — the specific UTXO — being spent, so it is valid for that one input and nothing else. An ANYPREVOUT signature deliberately omits the input reference, so the same signature can later be "rebound" to any output protected by a matching script and key. In effect, it lets you sign a transaction template whose attachment point is decided later — a small change to what a signature means, with large consequences for what protocols can be built.

From SIGHASH_NOINPUT to APO

The idea was first floated as SIGHASH_NOINPUT and refined into BIP-118's two flags. SIGHASH_ANYPREVOUT drops the commitment to the specific output being spent but still commits to the script being satisfied; SIGHASH_ANYPREVOUTANYSCRIPT drops that too, committing only to the transaction's own structure. The proposal is built for Taproot: rebindable signatures are only available to keys that explicitly opt in within a Taproot script path, using Schnorr signatures. Ordinary wallets and ordinary transactions are untouched — the feature is contained to spending paths that deliberately request it, so it cannot weaken anyone's existing coins. Rebindable signatures do demand care from protocol designers, since a signature that can attach to multiple outputs is a footgun if keys or scripts are carelessly reused; the opt-in design is precisely what fences that risk in.

Why it matters: eltoo and Lightning symmetry

APO's headline use case is eltoo (also styled LN-Symmetry), a simplified update mechanism for Lightning channels. Today's channels are penalty-based: each party must retain every old channel state forever, because publishing a stale state must be punishable by loss of all funds. That "toxic waste" makes honest mistakes catastrophic — restore a node from an old backup, accidentally broadcast a stale state, and the penalty machinery can confiscate your entire channel balance. With rebindable signatures, the design inverts: any newer state can spend the transaction of any older state, so the protocol simply enforces latest state wins. No old states to store, no penalty for a mistake — an out-of-date broadcast just gets superseded on-chain. For self-hosted node runners, that is the difference between a protocol that punishes imperfect backups and one that forgives them. Beyond eltoo, APO underpins designs like blind merged mining for spacechains, and its ability to commit to a transaction's shape independent of its inputs gives it covenant-adjacent power — one reason it is discussed alongside proposals like CTV in the covenant conversation.

Status: proposed, not consensus

A quieter benefit of the eltoo design is what it does for watchtowers — the third-party services that watch the chain for channel cheating while a node is offline. Under penalty channels, a watchtower must store response data for every state a channel has ever had, growing without bound. Under latest-state-wins, it needs only the most recent state, since that single transaction answers any old broadcast. Constant storage per channel makes watchtowers cheap enough for anyone to run — one more piece of Lightning infrastructure pulled within reach of the self-hosted node runner rather than concentrated in a few large services. Like everything else about eltoo, it trades a small consensus change at the base layer for a large simplification everywhere above it — the pattern that makes the proposal worth understanding even while it waits.

AnyPrevOut would require a soft fork. It has not been activated, no activation timeline exists, and it competes for review attention with other proposals in a deliberately slow process — the same conservatism that keeps the base layer trustworthy. Until and unless that changes, Lightning continues on penalty-based channels, hardened in the meantime by tools like ephemeral anchors and related fee-bumping constructions that modern channel designs use today.