<p>This is my conceptual understanding, which will hopefully be useful here, but I'm sure there are technical subtleties that I am not including, which some more experienced with the side-chains project would be able to give more insight into.</p>

<p>First, we need to have a clear definition of an SPV proof. I will use SPV proof to mean: A bit sequence that proves that a transaction has a substantial amount of work committing to it. It is desirable for this proof to be as small as possible.</p>

<p>Essentially, you start by sending some coins on the main chain to an output that has a scriptPubKey that says</p>

<pre><code>OP_SPVPROOFVERIFY
</code></pre>

<p>Then wait until it has sufficient confirmations (1-days worth, I think), and you take this UTXO, represented by the pair (txid, n), and go over to a sidechain make a transaction that uses an SPV proof of the output being in the confirmed blockchain to issue new coins. This is essentially like moving coins from one blockchain to another.</p>

<p>Then when you're done using them on the side-chain, you make a new output with the same number of coins, maybe sending them to OP_RETURN. Thus, you've given up your coins on the side-chain, allowing them to be re-claimed on the main chain. Before you can re-claim them, though, you have to wait for 1-days worth of confirmations on the sidechain, and then construct an SPV proof that the coins have been destroyed in the sidechain. This SPV proof is what lets you unlock your coins from the <code>OP_SPVPROOFVERIFY</code> output that they were locked in before.</p>

<p>For more info on compact SPV proofs, see:</p>

<ul>
<li>Appendix B of the Sidechains white paper.</li>
<li><a href="http://sourceforge.net/p/bitcoin/mailman/message/32111357/" rel="nofollow noreferrer">This post on the bitcoin-dev mailing list</a></li>
<li><a href="https://bitcoin.stackexchange.com/questions/37914/is-there-a-pow-system-that-shows-cumulative-work-without-an-ever-increasing-proo">Is there a PoW system that shows cumulative work without an ever-increasing proof size?</a></li>
</ul>

CC BY-SA 3.0
2015-07-30T04:56:07.887Z
"Then when you're done using them on the side-chain, you make a new output with the same number of coins" what if the coins are splitted and the owner of splitted coin wants to reclaim that?
abeikverdi
CC BY-SA 3.0
2015-07-30T04:57:25.353Z
@abeikverdi, it doesn't have to be the exact same coins by any means, just the same amount of coins.
morsecoder
CC BY-SA 3.0
2015-07-30T05:01:59.137Z
Imagine I move 1 btc to a sidechain and then give you half in sidechain. Now you want to unlock 0.5 in the parent chain (bitcoin) from that 0.5 that I gave you in side chain. You wont be able to do that?
abeikverdi
CC BY-SA 3.0
2015-07-30T11:53:43.757Z
AFAIK, that is true, you wouldn't be able to.
morsecoder
CC BY-SA 4.0
2019-10-19T05:38:32.750Z
@abeikverdi I guess the sidechain protocol would need to require every transaction spending the locked coins keep track of the original mainchain UTXO. Then if you spend, say half, on the sidechain and the recipient want to move the half back to mainchain, `OP_SPVPROOFVERIFY` would check that his unlocking transaction on mainchain spends half to another `OP_SPVPROOFVERIFY`. And then the sidechain can update the old UTXO with the new UTXO.
Chan-Ho Suh
CC BY-SA 3.0
2015-07-29T14:52:35.120Z
2015-07-29T14:52:35.120Z
2017-04-13T12:47:32.940Z
morsecoder
<p>I am reading <a href="https://blockstream.com/sidechains.pdf" rel="nofollow">sidechains</a> white paper and in section 3.2 Symmetric two-way peg they mention that:</p>

<p>"The parent chain coins are sent to a special output on the parent chain that can only be unlocked by an SPV proof of possession on the sidechain. I dont get how the coins can be locked on a blockchain. </p>

<ul>
<li><p>Are they referring to locking it in a multisig address or something?</p></li>
<li><p>Who has the private key of that locked address?</p></li>
</ul>

<trust><sidechains>
How are the assets locked and unlocked trustlessly using sidechains?
abeikverdi
# How are the assets locked and unlocked trustlessly using sidechains?

(Asked by: username_0 on 2015-07-29)

I am reading [sidechains](https://blockstream.com/sidechains.pdf) white paper and in section 3.2 Symmetric two-way peg they mention that:

"The parent chain coins are sent to a special output on the parent chain that can only be unlocked by an SPV proof of possession on the sidechain. I dont get how the coins can be locked on a blockchain.

* Are they referring to locking it in a multisig address or something?
* Who has the private key of that locked address?

**Tags:** trust, sidechains


---

## 1 answers

### Answer by username_1 on 2015-07-29. Score: 2

This is my conceptual understanding, which will hopefully be useful here, but I'm sure there are technical subtleties that I am not including, which some more experienced with the side-chains project would be able to give more insight into.

First, we need to have a clear definition of an SPV proof. I will use SPV proof to mean: A bit sequence that proves that a transaction has a substantial amount of work committing to it. It is desirable for this proof to be as small as possible.

Essentially, you start by sending some coins on the main chain to an output that has a scriptPubKey that says

```
OP_SPVPROOFVERIFY

```

Then wait until it has sufficient confirmations (1-days worth, I think), and you take this UTXO, represented by the pair (txid, n), and go over to a sidechain make a transaction that uses an SPV proof of the output being in the confirmed blockchain to issue new coins. This is essentially like moving coins from one blockchain to another.

Then when you're done using them on the side-chain, you make a new output with the same number of coins, maybe sending them to OP\_RETURN. Thus, you've given up your coins on the side-chain, allowing them to be re-claimed on the main chain. Before you can re-claim them, though, you have to wait for 1-days worth of confirmations on the sidechain, and then construct an SPV proof that the coins have been destroyed in the sidechain. This SPV proof is what lets you unlock your coins from the `OP_SPVPROOFVERIFY` output that they were locked in before.

For more info on compact SPV proofs, see:

* Appendix B of the Sidechains white paper.
* [This post on the bitcoin-dev mailing list](http://sourceforge.net/p/bitcoin/mailman/message/32111357/)
* [Is there a PoW system that shows cumulative work without an ever-increasing proof size?](https://bitcoin.stackexchange.com/questions/37914/is-there-a-pow-system-that-shows-cumulative-work-without-an-ever-increasing-proo)

> **Comments:**
> **username_0**: "Then when you're done using them on the side-chain, you make a new output with the same number of coins" what if the coins are splitted and the owner of splitted coin wants to reclaim that?  
> **username_1**: @username_0, it doesn't have to be the exact same coins by any means, just the same amount of coins.  
> **username_0**: Imagine I move 1 btc to a sidechain and then give you half in sidechain. Now you want to unlock 0.5 in the parent chain (bitcoin) from that 0.5 that I gave you in side chain. You wont be able to do that?  
> **username_1**: AFAIK, that is true, you wouldn't be able to.  
> **username_2**: @username_0 I guess the sidechain protocol would need to require every transaction spending the locked coins keep track of the original mainchain UTXO. Then if you spend, say half, on the sidechain and the recipient want to move the half back to mainchain, `OP_SPVPROOFVERIFY` would check that his unlocking transaction on mainchain spends half to another `OP_SPVPROOFVERIFY`. And then the sidechain can update the old UTXO with the new UTXO.  

---

