<blockquote>
  <p>So from this, it naturally follows that old non-segwit wallets should not be able to spend segwit transactions.</p>
</blockquote>

<p>That is correct. A wallet that does not know anything about segwit will be unable to construct a valid transaction input that spends a segwit output.</p>

<p>However, the premise of the question</p>

<blockquote>
  <p>when an old wallet receives a segwit transaction meant for it</p>
</blockquote>

<p>doesn't make sense either. If a wallet does not know about segwit, it will never construct a segwit address to give out. So, by definition, there cannot be any segwit output meant for it.</p>

<p>It is always the receiver who decides what exact outputs to accept money on - and this is what gets encoded into an address.</p>

CC BY-SA 3.0
2016-12-18T05:46:21.183Z
2016-12-18T05:46:21.183Z
Pieter Wuille
<p>There's some conflicting information out there on whether this is true or not. I'm looking for a technical answer to this in the hopes of clearing up future potential confusion over the matter.</p>

<p><strong>The main question is:</strong> Can old non-upgraded non-segwit aware wallets redeem a segwit output it receives?</p>

<p>Segwit output is defined as an outpoint having a P2WPKH or P2WSH structure as outline in <a href="https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki#examples" rel="noreferrer">bip141</a> in its <code>scriptPub</code> section.</p>

<p>As I understand it, when an old wallet receives a segwit transaction meant for it(assume tx is already mined in a block), it will see <code>0 &lt;20-byte hash&gt;</code>(assuming P2WPKH) in the <code>scriptPub</code> from this segwit transaction. Interpreting this under non-segwit rules, old wallets will see this as <code>anyone_can_spend</code> -- the top of the script stack always evaluates to truthy regardless of what's provided in the <code>scriptSig</code> in the redeeming transaction.</p>

<p>The only way for the wallet to use/redeem this segwit output is to construct a transaction as outline in the bip. That is, it constructs the transaction specifying prev_txid and index as normal, an empty <code>scriptSig</code> and a witness program + witness hash. But a non-segwit aware wallet won't know how to construct the last part of this. Without that part, segwit validating nodes and miners will have to reject this transaction.</p>

<p>So from this, it naturally follows that old non-segwit wallets should not be able to spend segwit transactions.</p>

<p>Note, this question is not about:</p>

<ul>
<li>old wallets sending non-segwit inputs -> to a segwit output.</li>
<li>segwit wallets sending segwit inputs -> to a non-segwit output.</li>
</ul>

<transactions><wallet><segregated-witness>
Can old wallets redeem segwit outputs it receives? If so how?
greatwolf
# Can old wallets redeem segwit outputs it receives? If so how?

(Asked by: username_0 on 2016-12-18)

There's some conflicting information out there on whether this is true or not. I'm looking for a technical answer to this in the hopes of clearing up future potential confusion over the matter.

**The main question is:** Can old non-upgraded non-segwit aware wallets redeem a segwit output it receives?

Segwit output is defined as an outpoint having a P2WPKH or P2WSH structure as outline in [bip141](https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki#examples) in its `scriptPub` section.

As I understand it, when an old wallet receives a segwit transaction meant for it(assume tx is already mined in a block), it will see `0 <20-byte hash>`(assuming P2WPKH) in the `scriptPub` from this segwit transaction. Interpreting this under non-segwit rules, old wallets will see this as `anyone_can_spend` -- the top of the script stack always evaluates to truthy regardless of what's provided in the `scriptSig` in the redeeming transaction.

The only way for the wallet to use/redeem this segwit output is to construct a transaction as outline in the bip. That is, it constructs the transaction specifying prev\_txid and index as normal, an empty `scriptSig` and a witness program + witness hash. But a non-segwit aware wallet won't know how to construct the last part of this. Without that part, segwit validating nodes and miners will have to reject this transaction.

So from this, it naturally follows that old non-segwit wallets should not be able to spend segwit transactions.

Note, this question is not about:

* old wallets sending non-segwit inputs -> to a segwit output.
* segwit wallets sending segwit inputs -> to a non-segwit output.

**Tags:** transactions, wallet, segregated-witness


---

## 1 answers

### Answer by username_1 on 2016-12-18. Score: 5 | Accepted answer

> So from this, it naturally follows that old non-segwit wallets should not be able to spend segwit transactions.

That is correct. A wallet that does not know anything about segwit will be unable to construct a valid transaction input that spends a segwit output.

However, the premise of the question

> when an old wallet receives a segwit transaction meant for it

doesn't make sense either. If a wallet does not know about segwit, it will never construct a segwit address to give out. So, by definition, there cannot be any segwit output meant for it.

It is always the receiver who decides what exact outputs to accept money on - and this is what gets encoded into an address.


---

