Glossary / Transactions & fees
SIGHASH_NONE
- Definition
- SIGHASH_NONE is the flag that signs the inputs of a transaction while committing to none of its outputs, which leaves the destination of the money open to anyone who handles it.
Treat it as a blank cheque. A SIGHASH_NONE input authorizes the spend and says nothing about who gets paid, so a miner or any relaying node can rewrite every output before the transaction confirms. Its value is 2, no consumer wallet offers it, and if you ever see one in your own transaction, something has gone wrong.
How it works
Constructing this digest means dropping the output list entirely before hashing.
What survives is still substantial: the transaction version, the outpoint of the input being signed, that input's own sequence number, the script it is spending, and the locktime. The sequence numbers of every other input are zeroed out, a second piece of freedom, because it lets co-signers adjust their own relative timelocks after this signature already exists.
What does not survive is the whole point. With no output committed, the signature says only that this coin may be spent in a transaction of this version at or after this time. Whoever holds the half-built transaction picks where the value goes, and that includes anybody who sees it on the network, since an unconfirmed transaction is public from the moment it is broadcast.
Add the ANYONECANPAY modifier and the byte becomes 0x82, the weakest signature bitcoin can produce: it covers one input and nothing else whatsoever.
The flag has existed since the first release in January 2009 and has never been removed, because removing it would strand coins locked before anyone thought about the consequences. BIP143 and BIP341 both reimplemented it faithfully for segwit and Taproot rather than quietly dropping it.
Where you see it
SIGHASH_NONE turns up almost nowhere, which is exactly what you should expect.
The theoretical use is a protocol in which one party contributes funds and a counterparty chooses the destination, with that counterparty bound by something outside the signature. No widely used bitcoin application works that way. Constructions that need flexible inputs reach for ANYONECANPAY instead, and constructions that need flexible outputs use pre-signed alternatives where the possible destinations are fixed in advance.
So a SIGHASH_NONE signature in the wild is a bug or a theft in progress. Mempools are watched continuously by bots scanning for spendable oddities, and a transaction carrying one will not sit there unnoticed for long. Anyone writing signing code should treat the flag as an integer they never pass, and anyone auditing a custody system should confirm the flag is a constant rather than a caller-supplied parameter.
For someone buying and holding bitcoin the takeaway is short: you will not run into this, your wallet will not offer it, and software that asks you to sign with it is software to walk away from.
SIGHASH_NONE vs SIGHASH_SINGLE
SIGHASH_NONE commits to zero outputs; SIGHASH_SINGLE commits to exactly one, the output sitting at the same index as the input being signed. That one committed output changes the character of the signature completely. With SIGHASH_SINGLE a signer can guarantee their own payout while leaving the rest of the transaction open, which is a usable building block for swaps and marketplaces. SIGHASH_NONE guarantees the signer nothing at all, which is why one has real applications and the other turns up mainly in incident reports.