<p>Absolutely.</p>
<ol>
<li><p>The mediator, C, creates an address.</p>
</li>
<li><p>After the bet payment(s) have been made, C creates two transactions. One pays to A, and the other pays to B. He <em>keeps both of these transactions secret.</em> Then, he destroys the private key for the address.</p>
</li>
<li><p>Depending on who wins, the mediator publishes one of the transactions.</p>
</li>
</ol>
<p>An attacker can't send the Bitcoins to himself, but he can choose who wins the bet, or destroy both transactions.</p>
<h3>Downsides</h3>
<p>If additional payments are made to C's address after he destroys its private key, those Bitcoins are lost. This could be mitigated by having the address be a 1-of-2 multisignature account, where one of the keys is an offline key held by the operator of the service.</p>
<p>The service is vulnerable between the time that it publishes the address and the time it creates and signs the transactions. You can't create the transactions in step two before you see the incoming transactions, either, because they will depend on the txid you're trying to spend.</p>

CC BY-SA 3.0
2014-11-14T18:01:57.807Z
Wow, this is a great explanation. Thanks. Is it possible to create a 1-of-2 multisig address without taking the second "master" key out of the offline storage?
andr111
CC BY-SA 3.0
2014-11-14T18:28:47.690Z
Yes. [This guide explains how to create a multisignature address, assuming you know the public key of the offline key.](http://bitcoin.stackexchange.com/a/10593/2306) Spending from a multisignature address is still a little annoying.
Nick ODell
CC BY-SA 3.0
2014-11-14T19:51:35.293Z
Another issue is that C has no way to prove that the private key is really destroyed. He could have kept a copy, intentionally or unintentionally, that could later be stolen or abused.
Nate Eldredge
CC BY-SA 3.0
2014-11-14T16:27:01.407Z
2014-11-14T18:31:26.477Z
2020-06-16T11:10:03.350Z
Nick ODell
<p>Imagine a scenario. There are 3 parties: Party A, Party B and a mediator party C. A and B transfer each 1 BTC to a newly created wallet W owned by C. The function of C is to distribute the entire 2 BTC to either A or B depending on some condition (think a bet). Now imagine C gets compromised and it's private key is stolen by a hacker. The hacker can now send 2 BTC to any address he wants. Is it possible to limit wallet W to sending funds to only A or B? So that even if it's compromised, the hacker can only send funds to A or B and not any arbitrary address.</p>

<wallet><multi-signature><escrow>
Limit wallet to sending funds to a list of addresses
andr111
# Limit wallet to sending funds to a list of addresses

(Asked by: username_0 on 2014-11-14)

Imagine a scenario. There are 3 parties: Party A, Party B and a mediator party C. A and B transfer each 1 BTC to a newly created wallet W owned by C. The function of C is to distribute the entire 2 BTC to either A or B depending on some condition (think a bet). Now imagine C gets compromised and it's private key is stolen by a hacker. The hacker can now send 2 BTC to any address he wants. Is it possible to limit wallet W to sending funds to only A or B? So that even if it's compromised, the hacker can only send funds to A or B and not any arbitrary address.

**Tags:** wallet, multi-signature, escrow


---

## 1 answers

### Answer by username_1 on 2014-11-14. Score: 1 | Accepted answer

Absolutely.

1. The mediator, C, creates an address.
2. After the bet payment(s) have been made, C creates two transactions. One pays to A, and the other pays to B. He *keeps both of these transactions secret.* Then, he destroys the private key for the address.
3. Depending on who wins, the mediator publishes one of the transactions.

An attacker can't send the Bitcoins to himself, but he can choose who wins the bet, or destroy both transactions.

### Downsides

If additional payments are made to C's address after he destroys its private key, those Bitcoins are lost. This could be mitigated by having the address be a 1-of-2 multisignature account, where one of the keys is an offline key held by the operator of the service.

The service is vulnerable between the time that it publishes the address and the time it creates and signs the transactions. You can't create the transactions in step two before you see the incoming transactions, either, because they will depend on the txid you're trying to spend.

> **Comments:**
> **username_0**: Wow, this is a great explanation. Thanks. Is it possible to create a 1-of-2 multisig address without taking the second "master" key out of the offline storage?  
> **username_1**: Yes. [This guide explains how to create a multisignature address, assuming you know the public key of the offline key.](http://bitcoin.stackexchange.com/a/10593/2306) Spending from a multisignature address is still a little annoying.  
> **username_2**: Another issue is that C has no way to prove that the private key is really destroyed. He could have kept a copy, intentionally or unintentionally, that could later be stolen or abused.  

---

