  Covenants are linguistic primitives that extend the Bitcoin script language,
allowing transactions to constrain the scripts of the redeeming ones. Advocated
as a way of improving the expressiveness of Bitcoin contracts while preserving
the simplicity of the UTXO design, various forms of covenants have been
proposed over the years. A common drawback of the existing descriptions is the
lack of formalization, making it difficult to reason about properties and
supported use cases. In this paper we propose a formal model of covenants,
which can be implemented with minor modifications to Bitcoin. We use our model
to specify some complex Bitcoin contracts, and we discuss how to exploit
covenants to design high-level language primitives for Bitcoin contracts.
