Glossary / Transactions & fees
SIGHASH_SINGLE
- Definition
- SIGHASH_SINGLE is the flag that ties a signature to one output only, the one sitting at the same position in the list as the input being signed.
Input zero is paired with output zero, input one with output one, and everything else in the transaction is left unsigned. The design lets several parties each guarantee their own payout inside one shared transaction. It also carries bitcoin's most notorious signing bug, which legacy inputs still contain.
How it works
The digest keeps the input being signed, the transaction version, the locktime, and exactly one output: the one whose index matches the input's index.
Outputs after that index are removed from the copy before hashing. Outputs before it are kept as placeholders but emptied out, given a value of minus one and an empty script, so their real contents are not covered either. Sequence numbers on all other inputs are zeroed, as they are under the no-outputs flag.
Then comes the bug. In the original algorithm, if the index of the input being signed is greater than or equal to the number of outputs, there is no matching output to hash. Rather than failing, the code returns a fixed digest: the 32 byte value one. Every signer who lands in that position produces a signature over the identical digest, so the signature is not bound to any particular transaction and can be lifted and replayed by anyone able to arrange an input at the same index. The branch survives in Bitcoin Core to this day, because deleting it would change the validity of coins already sitting on the chain.
Both rewrites of the signature hash algorithm closed it. BIP143 specifies that for a segwit version 0 input with no matching output, the outputs portion of the digest is 32 zero bytes, while the rest of the digest still commits to that specific input, so nothing is replayable. BIP341 goes further: on a Taproot input, a signature of this type with an index beyond the output count simply fails validation.
Where you see it
The flag shows up as a trailing 03 on a signature, and you will find it almost exclusively inside pre-signed offers rather than ordinary payments.
The pattern is a half-transaction published as an invitation. A seller signs the statement "this input of mine goes in, and the output at the matching index pays me my asking price", then leaves the rest of the transaction blank for a buyer to fill. Because the seller's signature ignores every other input and output, the buyer can add their own funds, their own change, and a fee at whatever rate the mempool demands, and the seller's guarantee still holds. Ordinals and runes marketplaces are built on exactly this, distributed as PSBTs, and it is one of the few genuinely trustless trades bitcoin supports with no third party in the middle.
It is nearly always paired with ANYONECANPAY, because on its own the flag still commits to the full list of inputs, which defeats the purpose of leaving the transaction open for someone else to complete.
SIGHASH_SINGLE vs SIGHASH_ANYONECANPAY
SIGHASH_SINGLE is a base mode and SIGHASH_ANYONECANPAY is a modifier, so they answer different questions. The base mode decides how much of the output side a signature covers: all of it, none of it, or one matching output. The modifier decides how much of the input side it covers: every input, or only the one being signed. You pick one base mode, then decide separately whether to add the modifier, which is why the flag byte on a real signature is usually the sum of the two rather than either one alone.