Glossary / Transactions & fees
SIGHASH_ANYONECANPAY
- Definition
- SIGHASH_ANYONECANPAY is a modifier that strips every other input out of the digest, so a signature covers only the one coin it spends and others can join the transaction freely.
It is not a mode of its own. The flag has the value 128 and is added to one of the three base modes, producing 129, 130, or 131, and each combination answers a different question about what the signer is willing to let strangers change. Crowdfunding and ordinals marketplaces are the two places it earns its keep.
How it works
Setting the modifier shrinks the input side of the digest to a single entry: the outpoint being spent, its sequence number, and the script it unlocks.
Every other input vanishes from the calculation. A signer working under this rule neither knows nor cares how many other people contributed coins, in what order they did so, or whether more will arrive afterwards, and adding an input later cannot invalidate a signature made earlier. That property is the entire feature, and it is what makes signatures collectable: several people can sign in isolation, at different times, on different machines, and someone can gather the pieces into one valid transaction.
The base mode still governs the output side, and the three combinations behave very differently.
- 129, the modifier with the all-outputs rule, means "my coin goes in and the payouts must be exactly this list". Inputs may be added, outputs may not.
- 130, the modifier with the no-outputs rule, is the weakest signature the protocol allows: one coin in, and no statement at all about where anything ends up.
- 131, the modifier with the single-output rule, means "my coin goes in and I must receive the output at my index". Everything else is left open.
Where you see it
Two constructions use it seriously, and both depend on strangers being able to add funds without breaking what is already signed.
The first is the assurance contract, bitcoin's version of a crowdfunding pledge. Every backer signs value 129 over a fixed output list containing the project's payout, and each pledge is an input. The transaction only becomes valid once the pledged inputs cover the outputs, so the funding target enforces itself with arithmetic instead of an escrow agent, and a campaign that falls short simply never produces a valid transaction. Pledging costs nothing and withdrawing costs nothing, because the coins never move.
The second is the pre-signed marketplace offer. A seller signs value 131 over their own inscription or rune output and the price they want, publishes the result as a partially signed transaction, and any buyer completes it with their own inputs, their own change, and a fee. No listing contract, no custodian, and no counterparty to trust for the settlement itself.
A warning comes attached. Value 130 sitting in a public mempool is free money for whoever picks it up first, and only one bit separates it from the safe combinations. If you are reviewing signing code, check that the base mode is a hard-coded constant and that the modifier is the only part anything is allowed to vary.
Reading the flag byte
Split the sighash flag byte into its two halves and it stops being cryptic. The bottom bits give the base mode: 1 for all outputs, 2 for none, 3 for a single matching output. The high bit, worth 128, is the modifier. So a signature ending in 81 covers everything except the other inputs, 83 is the marketplace rule, and a plain 01 with no modifier is the ordinary payment your own wallet produces every time you spend.