<p>There's no way for an input script to control the output script, so it can't be encoded into the script itself. However, you can get the same effect with more than one partially-signed transaction. Make a P2SH 2-of-2 multisig address, where you hold one key and the claimant holds the other. Send it some Bitcoin. Then part-sign two transactions from that address, one to A and the other to B. Send the claimant both transactions.</p>

<p>The claimant will only be able to spend exactly the amount you sign for, so if you really want a lower limit you'll need to create more transactions with different outputs.</p>

CC BY-SA 3.0
2014-03-28T08:10:41.227Z
2014-03-28T12:16:55.647Z
2014-03-28T12:16:55.647Z
Nathan Cook
<p>Is the following scenario possible?</p>

<p>I want to send money to a script. This script will require knowing a private key to spend, as usual, but the script is only valid if the money is being sent to one of two addresses. That is, if the transaction has more than one output, it is invalid. If the transaction's output is a standard script to address <code>A</code> or to address <code>B</code> then it is valid. If the transaction output value is any less than <code>x</code>, it is invalid.</p>

<p>In other words, it seems the scripts serve to validate that you can spend the output, but then the output can be spent however the claimant wants. Is there any way to limit how the outputs are spent? All this without requiring a trusted oracle of course.</p>

CC BY-SA 3.0
2014-03-21T03:51:46.273Z
Interesting question. This particular application (funds to be paid to either A or B, but a third party C gets to decide which) might be achievable using multisig transactions, but maybe needing more interaction between the parties.
Nate Eldredge
CC BY-SA 3.0
2014-03-21T04:02:26.633Z
@NateEldredge: Wouldn't multisig not help with this? e.g. say you need 2 of A, B, or C's signatures to spend it. A and B could both decide to just send it to E.
Claudiu
CC BY-SA 3.0
2014-03-21T12:04:10.103Z
One way would be to require 3 signatures out of 4, and give two shares to C.
Nate Eldredge
CC BY-SA 3.0
2014-03-21T15:57:59.883Z
@NateEldredge: Oh interesting. So you need either A&C, B&C, or all three. Someone could still steal all the private keys and send the money to E, though. I'm asking if there's a network-level rule to restrict how an input is spent, but it seems like there isn't.
Claudiu
<transactions><address><script><contracts><transaction-verification>
Is there any way to send an output to a script which can then only be sent to one of two addresses?
Claudiu
# Is there any way to send an output to a script which can then only be sent to one of two addresses?

(Asked by: username_0 on 2014-03-20)

Is the following scenario possible?

I want to send money to a script. This script will require knowing a private key to spend, as usual, but the script is only valid if the money is being sent to one of two addresses. That is, if the transaction has more than one output, it is invalid. If the transaction's output is a standard script to address `A` or to address `B` then it is valid. If the transaction output value is any less than `x`, it is invalid.

In other words, it seems the scripts serve to validate that you can spend the output, but then the output can be spent however the claimant wants. Is there any way to limit how the outputs are spent? All this without requiring a trusted oracle of course.

**Tags:** transactions, address, script, contracts, transaction-verification

> **Comments:**
> **username_1**: Interesting question. This particular application (funds to be paid to either A or B, but a third party C gets to decide which) might be achievable using multisig transactions, but maybe needing more interaction between the parties.  
> **username_0**: @username_1: Wouldn't multisig not help with this? e.g. say you need 2 of A, B, or C's signatures to spend it. A and B could both decide to just send it to E.  
> **username_1**: One way would be to require 3 signatures out of 4, and give two shares to C.  
> **username_0**: @username_1: Oh interesting. So you need either A&C, B&C, or all three. Someone could still steal all the private keys and send the money to E, though. I'm asking if there's a network-level rule to restrict how an input is spent, but it seems like there isn't.  

---

## 1 answers

### Answer by username_2 on 2014-03-28. Score: 2

There's no way for an input script to control the output script, so it can't be encoded into the script itself. However, you can get the same effect with more than one partially-signed transaction. Make a P2SH 2-of-2 multisig address, where you hold one key and the claimant holds the other. Send it some Bitcoin. Then part-sign two transactions from that address, one to A and the other to B. Send the claimant both transactions.

The claimant will only be able to spend exactly the amount you sign for, so if you really want a lower limit you'll need to create more transactions with different outputs.


---

