<p>Christian Decker answered this on the Stephan Livera <a href="https://btctranscripts.com/stephan-livera-podcast/2020-08-13-christian-decker-lightning-topics/#difference-between-anyprevout-and-anyprevoutanyscript" rel="nofollow noreferrer">podcast</a>.</p>
<p>ANYPREVOUT (as you probably already know if you have read <a href="https://github.com/bitcoin/bips/blob/master/bip-0118.mediawiki" rel="nofollow noreferrer">BIP 118</a>) relaxes the requirement for an input to spend a particular output. Instead a specific signature can be used to spend any UTXO with the same script.</p>
<p>Rather than binding by both the explicit reference (e.g. transaction 100 connects to transaction 99) and the scripts matching, ANYPREVOUT only requires the scripts to match. The script is still committed to (hashed) in the sighash and hence can't be modified.</p>
<p>ANYPREVOUTANYSCRIPT relaxes this further by not committing to the script in the sighash (the script is not hashed). This allows outputs to bind to different inputs even if the scripts don't entirely match. In eltoo the output script will contain a different state number that changes from state to state in a Lightning setting. With eltoo we want to take a later state and attach it to any of the previous states.</p>
<p>For more information on eltoo see this Christian Decker <a href="https://btctranscripts.com/chaincode-labs/chaincode-residency/2019-06-25-christian-decker-eltoo/" rel="nofollow noreferrer">presentation</a> at Chaincode Labs.</p>
<p>So eltoo would use ANYPREVOUTANYSCRIPT but there are still possible use cases for ANYPREVOUT:</p>
<blockquote>
<p>For example if we have any sort of transaction malleability and we
still want to take a transaction that connects to a potentially
malleable transaction, then we can use SIGHASH_ANYPREVOUT. If the
transaction gets malleated in the public network before it is being
confirmed we can still connect to it using the connection between the
output script and the input script and the commitment of the output
script in the spending transaction.</p>
</blockquote>
<p>Jeremy Rubin has this <a href="https://docs.google.com/spreadsheets/d/1KeWJ_cly9zoRX5_h70RTniRT2m8_iaVceK_aF6obWeM" rel="nofollow noreferrer">cheatsheet</a> for what is signed under the various existing and proposed sighashes that he sent to the Lightning dev mailing <a href="https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-July/003135.html" rel="nofollow noreferrer">list</a>.</p>
<p>Richard Myers included this table in a <a href="https://yakshaver.org/2021/07/26/first.html" rel="nofollow noreferrer">blog post</a> which outlines what is hashed under ANYPREVOUT and ANYPREVOUTANYSCRIPT.</p>
<p><a href="https://i.sstatic.net/fwRm7.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/fwRm7.png" alt="anyprevouthashes" /></a></p>

CC BY-SA 4.0
2021-07-29T14:03:33.443Z
My read of the section [Signature Message](https://github.com/bitcoin/bips/blob/master/bip-0118.mediawiki#signature-message) is that an input with SIGHASH_ANYPREVOUT commits to the `scriptPubKey` and the **`amount`** of the spent UTXO.
Murch
CC BY-SA 4.0
2023-03-05T18:59:53.483Z
@Michael Folkson But Eltoo would use both APO and APOAS, correct? APOAS is used to sign updates, allowing rebinding to any updates with newer state, while APO is used to sign settlements, commiting to a specific script i.e. channel balance (?).
sutterseba
CC BY-SA 4.0
2021-07-29T10:02:49.000Z
2021-09-06T11:23:52.660Z
2021-09-06T11:23:52.660Z
Michael Folkson
<p><a href="https://github.com/bitcoin/bips/blob/d616d5492bc6e6566af1b9f9e43b660bcd48ca29/bip-0118.mediawiki" rel="nofollow noreferrer">BIP 118</a> describes SIGHASH_ANYPREVOUT, but also mentions SIGHASH_ANYPREVOUTANYSCRIPT. What is the difference, and why is the later sighash flag needed?</p>

<transactions><script><taproot><sighash-flags><bip118-sighash-anyprevout>
What is SIGHASH_ANYPREVOUTANYSCRIPT?
JordanPedersenCommitments
# What is SIGHASH_ANYPREVOUTANYSCRIPT?

(Asked by: username_0 on 2021-07-28)

[BIP 118](https://github.com/bitcoin/bips/blob/d616d5492bc6e6566af1b9f9e43b660bcd48ca29/bip-0118.mediawiki) describes SIGHASH\_ANYPREVOUT, but also mentions SIGHASH\_ANYPREVOUTANYSCRIPT. What is the difference, and why is the later sighash flag needed?

**Tags:** transactions, script, taproot, sighash-flags, bip118-sighash-anyprevout


---

## 1 answers

### Answer by username_1 on 2021-07-29. Score: 4 | Accepted answer

Christian Decker answered this on the Stephan Livera [podcast](https://btctranscripts.com/stephan-livera-podcast/2020-08-13-christian-decker-lightning-topics/#difference-between-anyprevout-and-anyprevoutanyscript).

ANYPREVOUT (as you probably already know if you have read [BIP 118](https://github.com/bitcoin/bips/blob/master/bip-0118.mediawiki)) relaxes the requirement for an input to spend a particular output. Instead a specific signature can be used to spend any UTXO with the same script.

Rather than binding by both the explicit reference (e.g. transaction 100 connects to transaction 99) and the scripts matching, ANYPREVOUT only requires the scripts to match. The script is still committed to (hashed) in the sighash and hence can't be modified.

ANYPREVOUTANYSCRIPT relaxes this further by not committing to the script in the sighash (the script is not hashed). This allows outputs to bind to different inputs even if the scripts don't entirely match. In eltoo the output script will contain a different state number that changes from state to state in a Lightning setting. With eltoo we want to take a later state and attach it to any of the previous states.

For more information on eltoo see this Christian Decker [presentation](https://btctranscripts.com/chaincode-labs/chaincode-residency/2019-06-25-christian-decker-eltoo/) at Chaincode Labs.

So eltoo would use ANYPREVOUTANYSCRIPT but there are still possible use cases for ANYPREVOUT:

> For example if we have any sort of transaction malleability and we
> still want to take a transaction that connects to a potentially
> malleable transaction, then we can use SIGHASH\_ANYPREVOUT. If the
> transaction gets malleated in the public network before it is being
> confirmed we can still connect to it using the connection between the
> output script and the input script and the commitment of the output
> script in the spending transaction.

Jeremy Rubin has this [cheatsheet](https://docs.google.com/spreadsheets/d/1KeWJ_cly9zoRX5_h70RTniRT2m8_iaVceK_aF6obWeM) for what is signed under the various existing and proposed sighashes that he sent to the Lightning dev mailing [list](https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-July/003135.html).

Richard Myers included this table in a [blog post](https://yakshaver.org/2021/07/26/first.html) which outlines what is hashed under ANYPREVOUT and ANYPREVOUTANYSCRIPT.

[![anyprevouthashes](https://i.sstatic.net/fwRm7.png)](https://i.sstatic.net/fwRm7.png)

> **Comments:**
> **username_2**: My read of the section [Signature Message](https://github.com/bitcoin/bips/blob/master/bip-0118.mediawiki#signature-message) is that an input with SIGHASH_ANYPREVOUT commits to the `scriptPubKey` and the **`amount`** of the spent UTXO.  
> **username_3**: @username_1 But Eltoo would use both APO and APOAS, correct? APOAS is used to sign updates, allowing rebinding to any updates with newer state, while APO is used to sign settlements, commiting to a specific script i.e. channel balance (?).  

---

