The parties
Three keys seal the bond: buyer, seller and arbiter. Any two of the three can release the funds. If they never agree, the refund key can sweep everything back after the timelock. Paste a 64-hex x-only pubkey or a 12/24-word mnemonic per party — mnemonics never leave this page.
Buyer funds the escrow · default refund key
Seller receives on release
Arbiter breaks ties, never unilateral
The contract
The escrow address commits to both spending paths. Verify the scripts before anyone funds it — the address is fully determined by the three keys, the refund key and the lock height.
Spending paths
Leaf 0 · Release 2-of-3
Leaf 1 · Refund timelocked
Taptree
- Internal key
(NUMS — no known private key; keypath spending is impossible for anyone)- Release leaf hash
- Refund leaf hash
- Merkle root
Control blocks (each party should keep these)
Funding
Spend the escrow
Two ways out. Release pays the seller (and change back to the buyer) with any two of the three signatures. Refund returns everything to the refund key after the timelock — one signature, no quorum.
Service fee (disclosed): mainnet releases pay a 1% service fee on the seller amount to the operator address in the footer below. It appears as its own output in the spending plan before anyone signs — both signers approve it, since the signature digest commits to every output. Testnet releases and all refunds pay no service fee, and a fee below the 333-grain dust floor is waived, never rounded up.
Spending plan
- Digest to sign
- Outputs
- Fee
Each signer copies the digest to sign to their own device, signs it with their key, and sends back the 64-byte signature. Signatures are useless without this exact transaction.
Broadcast
The fully-signed transaction. Every signature was verified locally before assembly — what you broadcast is exactly what the signers approved.
- TXID
- vBytes