<p>I don't think it's possible in principle. The escrow service is one that is inherently authorized to make a decision as to who ultimately gets the funds. In a decentralized escrow service, who or what would make that decision?</p>

<p>If I place some coins in escrow as part of a transaction to you, something must decide whether those funds ultimately go to me or you. Obviously, that decision can't be made by me or you.</p>

<p>I have heard proposals where the coins are "burned" (lost forever) if both parties don't agree on who should ultimately get them. I think that's a pretty useless service as it allows one party to blackmail the other. "Release the coins to me and I'll give half of them back to you. Otherwise, they're lost forever."</p>

CC BY-SA 3.0
2015-12-31T10:39:37.883Z
@MeniRosenfeld The blackmailer could employ an automated escrow service ensuring the victim that he will do better if he releases the coins to the blackmailer than if he doesn't.
David Schwartz
CC BY-SA 3.0
2011-09-04T18:28:48.587Z
This "burn" model seems to be the only option for a decentralized escrow. [Here](https://bitcointalk.org/index.php?topic=33615.0) is a thread at bitcointalk where this approach was discussed.
nmat
CC BY-SA 3.0
2011-09-04T18:33:04.963Z
In an `(a AND b) OR c` signing model burning is still the main option between parties a and b but burning could be decreased by adding a trusted third party c. It would still require manually finding a third party to trust but it still allows a and b to settle their own transaction in the majority of cases, reduces the number of burned coins and allows the private industry of Bitcoin escrow to continue and thrive.
David Perry
CC BY-SA 3.0
2011-09-04T19:22:05.037Z
I updated the question addressing the unresolved conflict issue.
herzmeister
CC BY-SA 3.0
2011-09-04T20:11:39.993Z
@nmat I also linked a proposal from the thread you specified.
herzmeister
CC BY-SA 3.0
2011-09-04T20:38:00.217Z
I'm not sure what you mean by 'burned' but generally I would think they would go back to the block chain, as something like the tx fee, and the miners would pick it up.
Evil Spork
CC BY-SA 3.0
2011-09-04T21:01:22.207Z
By "burned" we mean that neither participant in the original transaction gets the money. Most escrow approaches "burn" the money if the parties can't agree. The problem with this is that it allows the receiver to blackmail the sender, "Give me the coins and I'll give you half of them back (maybe). Do nothing, and you get no coins back no matter what."
David Schwartz
CC BY-SA 3.0
2011-11-20T12:32:02.860Z
@DavidSchwartz someone who receives such a blackmail can be about 100% sure he will not receive the promised half. At worst he can be blackmailed out of his deposit, which should be fairly small, and I think it's safe to assume people will be vengeful enough to not want someone to get away with stealing their money (even more so if burned funds go to charity). Thus most blackmails will fail, and since the scammer needs to pay a deposit for each failed attempt, it will not be very profitable. Thus I think this is indeed useful.
Meni Rosenfeld
CC BY-SA 3.0
2011-09-04T18:20:53.093Z
2011-09-04T18:20:53.093Z
David Schwartz
<p>It may be possible to write escrow functionality into Bitcoin through the use of one or more <a href="https://bitcoin.stackexchange.com/questions/553/how-do-scripts-work">scripts</a> which I believe is how Namecoin implemented its DNS-like features on top of simply forking the block chain. Unfortunately the scripting abilities have been severely limited for security reasons. There is also discussion over whether this should be part of the main client at all or if it's better to be handled by third parties or perhaps additional plugins or applications.</p>

<p>If you'd like to stay up to date on this potential feature, there is a discussion on <a href="https://github.com/bitcoin/bitcoin/pull/319" rel="nofollow noreferrer">github</a> about a fork by groffer which is still awaiting approval and could potentially be pulled into the main client. Groffer's mod allows for multi-signature Bitcoin transactions, which essentially means that coins can be placed under the control of multiple accounts at once such that both accounts must agree to (sign) any outgoing transactions. In such a system one party cannot claim the funds without the approval of the other party.</p>

<p><strong>Edit:</strong> <em>I also believe that groffer's mod allows for more complex multi-signed transactions such as <code>(a AND b) OR c</code> type transactions where either the two involved parties (a and b) must both sign or a transaction to complete it or it may be completed by a chosen trusted third party (c).</em></p>

CC BY-SA 3.0
2011-09-04T18:22:57.240Z
[Gavin Andresen](http://bitcoin.stackexchange.com/users/53/gavinandresen), the Bitcoin client technical lead, has said that M-of-N transactions are a priority for the next major release of the Bitcoin client.
David Schwartz
CC BY-SA 3.0
2011-09-04T18:26:59.290Z
Any link to where he said this? I'd love to include it in my answer but I'm kind of a stickler for sources.
David Perry
CC BY-SA 3.0
2011-09-04T20:22:41.910Z
He asked about the methods to do this [here](http://crypto.stackexchange.com/questions/488/is-digest-hashhashahashb-equivalent-to-publishing-two-digests). I'll try to track down the announcement as well.
David Schwartz
CC BY-SA 3.0
2011-09-04T20:27:36.270Z
I think he backed off a bit and is now working harder to obtain consensus. See [here](https://bitcointalk.org/index.php?topic=38928.msg476360#msg476360) and [here](https://gist.github.com/39158239e36f6af69d6f). Also, [here](https://bitcointalk.org/index.php?topic=38954.msg476696#msg476696).
David Schwartz
CC BY-SA 3.0
2011-09-04T22:48:39.627Z
Perhaps we'd best leave this to the comments for the time being now, since we're not really sure if it's a priority for the next release. If he ever obtains consensus we can come back and modify answers then.
David Perry
CC BY-SA 3.0
2011-09-04T18:21:06.380Z
2011-09-04T18:21:06.380Z
2017-04-13T12:47:32.940Z
David Perry
<p>Anything is possible. David Zimbeck, created this concept for bitcoin back in 2014</p>

<p>BitHalo.org does this and has been running since 2014. It's an automated two party escrow service. Both parties put a deposit, if either one cheats the deal they lose their funds. Since there is no escrow agent then it's completely impossible to break the contracts and gain from it. 
David, is now the lead developer for BitBay.Market you can download the BitBay Client to see for yourself the most advanced version of Halo.
He is nearly complete with his decentralized dynamic peg as well. This will be the most decentralized stablecoin in the industry and it provides the highest potential ROI because it's a soft peg not a hard peg.</p>

<p>Daniel Larimer said it best back in 2014, "All attempts at creating a “stable currency” that neither grows nor falls in value are fundamentally flawed regardless of design because they are built to on a flawed requirement. "</p>

<p>BitBay's dynamic peg is due to be released in Sept/Oct 2018.
This will make BitBay the only cryptocurrency in the industry that has solved both Crypto 1.0 and Crypto 2.0. The former being the ability to remove the middleman from any form of transaction, not just crypto, but goods and services as well. The latter being the ability to stabilize the price of a cryptocurrency so that it can actually be used as a 'currency'.</p>

<p>Whitepapers:
Halo 
<a href="https://forum.bitbay.market/uploads/default/original/1X/a60c8a2bd0fac863ae0b112be1cd47fea32ff664.pdf" rel="nofollow noreferrer">https://forum.bitbay.market/uploads/default/original/1X/a60c8a2bd0fac863ae0b112be1cd47fea32ff664.pdf</a></p>

<p>Dynamic Peg
<a href="https://bitbay.market/downloads/whitepapers/bitbay-dynamic-peg.pdf" rel="nofollow noreferrer">https://bitbay.market/downloads/whitepapers/bitbay-dynamic-peg.pdf</a></p>

CC BY-SA 4.0
2018-08-19T18:50:11.280Z
2018-08-19T18:50:11.280Z
Craig Claussen
<p>I think multisignature transactions are a good escrow model.</p>

<p>On the surface, this doesn't seem to provide any protection - the seller could just tell the buyer, "I'm taking 90% of the bitcoins. I'll give you 10%. If you refuse, neither of us will get anything." A perfectly rational actor would take that deal - but a human wouldn't, because they'd feel cheated.</p>

<p>So essentially, multisignature escrow will work because humans are vindictive.</p>

CC BY-SA 3.0
2013-04-03T23:15:32.157Z
2013-04-03T23:15:32.157Z
Nick ODell
<p>It is possible to implement a decentralized Escrow algorithm (to exchange any cryptocurrencies; could be used for example for decentralized trading from wallet to wallet with the aid of escrow) which has the following simple rules:</p>
<ol>
<li><p>Parties agree on i) deadline, ii) deposit amounts A and B required from both parties into escrow chain. The Escrow creates wallets for deposits A and B.</p>
</li>
<li><p>The Escrow holds the private keys (in a safe decentralized hacksafe manner) to the deposits until the transaction is completed (or cancelled).</p>
</li>
<li><p>If transfer is successful and Escrow receives full deposits of A and B before deadline, it will &quot;forward&quot; the contents the wallet to the recipient to the given transfer destination wallet addresses. Otherwise, if transfer is unsuccessful (or cancelled by either party), Escrow &quot;returns&quot; the funds back to each of the senders.</p>
</li>
<li><p>Additional features can be added such as &quot;speed reputation statistics&quot;, &quot;party A usually deposits in 5 seconds&quot; etc.</p>
</li>
<li><p>After such atomic swaps are implemented, a framework needs to be built where swaps can be combined like on a trading platform and initiated directly from a wallet.</p>
</li>
</ol>

CC BY-SA 4.0
2021-10-23T11:30:26.810Z
2021-11-01T04:50:16.957Z
2021-11-01T04:50:16.957Z
Martin
<p>AFAIK there are a few websites out there that offer escrow services for Bitcoin. Those however are central, i.e. I have to "trust" them.</p>

<p>Is it being discussed, is it theoretically possible, or does the blockchain technology already enable to implement a decentralized escrow service?</p>

<p>After all, it is easy to imagine that an escrow holder could be nothing more than a "virtual" party or a "bot", with its own wallet or private keys, that two negotiating parties could cast into existence. After the transaction has completed (or cancelled), the software would release (or revoke) the entrusted value to the respective party.</p>

<p>Update: If two parties cannot come to agreement, I can think of these solutions for now:</p>

<p><ol>
<li>There could be a form of escrow option that will be chosen where at least one party is public facing and reputational, e.g. a (online) shop, that will be trusted by the other party not to deceive.</li>
<li>Two more "ordinarily" trading parties would choose an escrow option where the funds will never be released in the case of conflict at first. If they disclosed identity to each other, a court hearing could then be invoked which should usually come to a resolution, and the losing party will be enforced by law to provide value. Should Bitcoin never be accepted as negotiable matter by traditional jurisdiction, an alternative, equivalent infrastructure is thinkable, but let's leave that to another question for now.</li>
<li><a href="https://bitcointalk.org/index.php?topic=33615.msg421527#msg421527">This proposal</a> by user <a href="https://bitcointalk.org/index.php?action=profile;u=5776">Meni Rosenfeld</a>:</p>

<blockquote>
  <p>How about this. There is a box in which there are two types of coins,
  "deposit" and "payment". Both parties have permission to open the box.
  When the box is opened, the deposits go to whoever put them, and the
  payment goes to the party other than the one who opened it.</p>
  
  <p>So first the buyer and seller both put a small deposit in the box.
  This is safe since they can get it back. Then the buyer puts the
  entire sum of the payment in the box. Now:</p>
  
  <ol>
  <li>If the seller sends the goods, the buyer will open the box and the
  seller will receive the funds. He is incentivized not to be lazy or
  spiteful because he wants his deposit back.</li>
  <li>If the seller for any reason wants to back out of the deal, he can
  open the box and have the payment return to the buyer, and is
  incentivized to do so because he wants his deposit back.</li>
  <li>If the seller goes with the "reimbursement" plot, the buyer knows
  he is scamming (since the seller should have just opened the box) and
  ignore the request. (There is a potential weakness in that the buyer
  can "defect" and open the box anyway, to get the deposit. This may be
  alleviated by having the buyer's deposit smaller than the seller's,
  giving him more bargaining power).</li>
  <li>A fraudulent seller is not incentivized to try this on N people
  until it succeeds, since every failure costs him his deposit. Hence,
  scenario 3 in which the money is burned should very rarely happen.</li>
  </ol>
  
  <p>In any case this isn't supposed to be bullet-proof, just a significant
  extra protection for sellers who already pass the sniff-test.</p>
  
  <p>Additionally, the box can specify a charity address, agreed upon by
  both parties, to which the buyer has permission to send all funds,
  deposits and payment. So in the worst case the money will go to
  charity.</p>
  
  <p>I'm not sure about the technical implementation details but all this
  should be very doable.</li>
  </ol></p>
</blockquote>

<blockchain><escrow><decentralization>
Decentralized escrow functionality built into Bitcoin?
herzmeister
# Decentralized escrow functionality built into Bitcoin?

(Asked by: username_0 on 2011-09-04)

AFAIK there are a few websites out there that offer escrow services for Bitcoin. Those however are central, i.e. I have to "trust" them.

Is it being discussed, is it theoretically possible, or does the blockchain technology already enable to implement a decentralized escrow service?

After all, it is easy to imagine that an escrow holder could be nothing more than a "virtual" party or a "bot", with its own wallet or private keys, that two negotiating parties could cast into existence. After the transaction has completed (or cancelled), the software would release (or revoke) the entrusted value to the respective party.

Update: If two parties cannot come to agreement, I can think of these solutions for now:

1. There could be a form of escrow option that will be chosen where at least one party is public facing and reputational, e.g. a (online) shop, that will be trusted by the other party not to deceive.
2. Two more "ordinarily" trading parties would choose an escrow option where the funds will never be released in the case of conflict at first. If they disclosed identity to each other, a court hearing could then be invoked which should usually come to a resolution, and the losing party will be enforced by law to provide value. Should Bitcoin never be accepted as negotiable matter by traditional jurisdiction, an alternative, equivalent infrastructure is thinkable, but let's leave that to another question for now.
3. [This proposal](https://bitcointalk.org/index.php?topic=33615.msg421527#msg421527) by user [username_5 username_5](https://bitcointalk.org/index.php?action=profile;u=5776):
   > How about this. There is a box in which there are two types of coins,
   > "deposit" and "payment". Both parties have permission to open the box.
   > When the box is opened, the deposits go to whoever put them, and the
   > payment goes to the party other than the one who opened it.
   >
   > So first the buyer and seller both put a small deposit in the box.
   > This is safe since they can get it back. Then the buyer puts the
   > entire sum of the payment in the box. Now:
   >
   > 1. If the seller sends the goods, the buyer will open the box and the
   >    seller will receive the funds. He is incentivized not to be lazy or
   >    spiteful because he wants his deposit back.
   > 2. If the seller for any reason wants to back out of the deal, he can
   >    open the box and have the payment return to the buyer, and is
   >    incentivized to do so because he wants his deposit back.
   > 3. If the seller goes with the "reimbursement" plot, the buyer knows
   >    he is scamming (since the seller should have just opened the box) and
   >    ignore the request. (There is a potential weakness in that the buyer
   >    can "defect" and open the box anyway, to get the deposit. This may be
   >    alleviated by having the buyer's deposit smaller than the seller's,
   >    giving him more bargaining power).
   > 4. A fraudulent seller is not incentivized to try this on N people
   >    until it succeeds, since every failure costs him his deposit. Hence,
   >    scenario 3 in which the money is burned should very rarely happen.
   >
   > In any case this isn't supposed to be bullet-proof, just a significant
   > extra protection for sellers who already pass the sniff-test.
   >
   > Additionally, the box can specify a charity address, agreed upon by
   > both parties, to which the buyer has permission to send all funds,
   > deposits and payment. So in the worst case the money will go to
   > charity.
   >
   > I'm not sure about the technical implementation details but all this
   > should be very doable.

**Tags:** blockchain, escrow, decentralization


---

## 5 answers

### Answer by username_1 on 2011-09-04. Score: 4

I don't think it's possible in principle. The escrow service is one that is inherently authorized to make a decision as to who ultimately gets the funds. In a decentralized escrow service, who or what would make that decision?

If I place some coins in escrow as part of a transaction to you, something must decide whether those funds ultimately go to me or you. Obviously, that decision can't be made by me or you.

I have heard proposals where the coins are "burned" (lost forever) if both parties don't agree on who should ultimately get them. I think that's a pretty useless service as it allows one party to blackmail the other. "Release the coins to me and I'll give half of them back to you. Otherwise, they're lost forever."

> **Comments:**
> **username_2**: This "burn" model seems to be the only option for a decentralized escrow. [Here](https://bitcointalk.org/index.php?topic=33615.0) is a thread at bitcointalk where this approach was discussed.  
> **username_3**: In an `(a AND b) OR c` signing model burning is still the main option between parties a and b but burning could be decreased by adding a trusted third party c. It would still require manually finding a third party to trust but it still allows a and b to settle their own transaction in the majority of cases, reduces the number of burned coins and allows the private industry of Bitcoin escrow to continue and thrive.  
> **username_0**: I updated the question addressing the unresolved conflict issue.  
> **username_0**: @username_2 I also linked a proposal from the thread you specified.  
> **username_4**: I'm not sure what you mean by 'burned' but generally I would think they would go back to the block chain, as something like the tx fee, and the miners would pick it up.  
> **username_1**: By "burned" we mean that neither participant in the original transaction gets the money. Most escrow approaches "burn" the money if the parties can't agree. The problem with this is that it allows the receiver to blackmail the sender, "Give me the coins and I'll give you half of them back (maybe). Do nothing, and you get no coins back no matter what."  
> **username_5**: @username_1 someone who receives such a blackmail can be about 100% sure he will not receive the promised half. At worst he can be blackmailed out of his deposit, which should be fairly small, and I think it's safe to assume people will be vengeful enough to not want someone to get away with stealing their money (even more so if burned funds go to charity). Thus most blackmails will fail, and since the scammer needs to pay a deposit for each failed attempt, it will not be very profitable. Thus I think this is indeed useful.  
> **username_1**: @username_5 The blackmailer could employ an automated escrow service ensuring the victim that he will do better if he releases the coins to the blackmailer than if he doesn't.  

---

### Answer by username_3 on 2011-09-04. Score: 2

It may be possible to write escrow functionality into Bitcoin through the use of one or more [scripts](https://bitcoin.stackexchange.com/questions/553/how-do-scripts-work) which I believe is how Namecoin implemented its DNS-like features on top of simply forking the block chain. Unfortunately the scripting abilities have been severely limited for security reasons. There is also discussion over whether this should be part of the main client at all or if it's better to be handled by third parties or perhaps additional plugins or applications.

If you'd like to stay up to date on this potential feature, there is a discussion on [github](https://github.com/bitcoin/bitcoin/pull/319) about a fork by groffer which is still awaiting approval and could potentially be pulled into the main client. Groffer's mod allows for multi-signature Bitcoin transactions, which essentially means that coins can be placed under the control of multiple accounts at once such that both accounts must agree to (sign) any outgoing transactions. In such a system one party cannot claim the funds without the approval of the other party.

**Edit:** *I also believe that groffer's mod allows for more complex multi-signed transactions such as `(a AND b) OR c` type transactions where either the two involved parties (a and b) must both sign or a transaction to complete it or it may be completed by a chosen trusted third party (c).*

> **Comments:**
> **username_1**: [Gavin Andresen](http://bitcoin.stackexchange.com/users/53/gavinandresen), the Bitcoin client technical lead, has said that M-of-N transactions are a priority for the next major release of the Bitcoin client.  
> **username_3**: Any link to where he said this? I'd love to include it in my answer but I'm kind of a stickler for sources.  
> **username_1**: He asked about the methods to do this [here](http://crypto.stackexchange.com/questions/488/is-digest-hashhashahashb-equivalent-to-publishing-two-digests). I'll try to track down the announcement as well.  
> **username_1**: I think he backed off a bit and is now working harder to obtain consensus. See [here](https://bitcointalk.org/index.php?topic=38928.msg476360#msg476360) and [here](https://gist.github.com/39158239e36f6af69d6f). Also, [here](https://bitcointalk.org/index.php?topic=38954.msg476696#msg476696).  
> **username_3**: Perhaps we'd best leave this to the comments for the time being now, since we're not really sure if it's a priority for the next release. If he ever obtains consensus we can come back and modify answers then.  

---

### Answer by username_6 on 2018-08-19. Score: 2

Anything is possible. username_1 Zimbeck, created this concept for bitcoin back in 2014

BitHalo.org does this and has been running since 2014. It's an automated two party escrow service. Both parties put a deposit, if either one cheats the deal they lose their funds. Since there is no escrow agent then it's completely impossible to break the contracts and gain from it.
username_1, is now the lead developer for BitBay.Market you can download the BitBay Client to see for yourself the most advanced version of Halo.
He is nearly complete with his decentralized dynamic peg as well. This will be the most decentralized stablecoin in the industry and it provides the highest potential ROI because it's a soft peg not a hard peg.

Daniel Larimer said it best back in 2014, "All attempts at creating a “stable currency” that neither grows nor falls in value are fundamentally flawed regardless of design because they are built to on a flawed requirement. "

BitBay's dynamic peg is due to be released in Sept/Oct 2018.
This will make BitBay the only cryptocurrency in the industry that has solved both Crypto 1.0 and Crypto 2.0. The former being the ability to remove the middleman from any form of transaction, not just crypto, but goods and services as well. The latter being the ability to stabilize the price of a cryptocurrency so that it can actually be used as a 'currency'.

Whitepapers:
Halo
<https://forum.bitbay.market/uploads/default/original/1X/a60c8a2bd0fac863ae0b112be1cd47fea32ff664.pdf>

Dynamic Peg
<https://bitbay.market/downloads/whitepapers/bitbay-dynamic-peg.pdf>


---

### Answer by username_7 on 2013-04-03. Score: 1

I think multisignature transactions are a good escrow model.

On the surface, this doesn't seem to provide any protection - the seller could just tell the buyer, "I'm taking 90% of the bitcoins. I'll give you 10%. If you refuse, neither of us will get anything." A perfectly rational actor would take that deal - but a human wouldn't, because they'd feel cheated.

So essentially, multisignature escrow will work because humans are vindictive.


---

### Answer by username_8 on 2021-10-23. Score: 0

It is possible to implement a decentralized Escrow algorithm (to exchange any cryptocurrencies; could be used for example for decentralized trading from wallet to wallet with the aid of escrow) which has the following simple rules:

1. Parties agree on i) deadline, ii) deposit amounts A and B required from both parties into escrow chain. The Escrow creates wallets for deposits A and B.
2. The Escrow holds the private keys (in a safe decentralized hacksafe manner) to the deposits until the transaction is completed (or cancelled).
3. If transfer is successful and Escrow receives full deposits of A and B before deadline, it will "forward" the contents the wallet to the recipient to the given transfer destination wallet addresses. Otherwise, if transfer is unsuccessful (or cancelled by either party), Escrow "returns" the funds back to each of the senders.
4. Additional features can be added such as "speed reputation statistics", "party A usually deposits in 5 seconds" etc.
5. After such atomic swaps are implemented, a framework needs to be built where swaps can be combined like on a trading platform and initiated directly from a wallet.


---

