BIP 175 Pay-to-Contract: Closed Derivation Protocol

This guide explains BIP 175 pay to contract in plain English. It covers the problem behind the BIP, why it matters and whether the proposal is part of Bitcoin today.

Contract commitment goal

The address derivation commits to agreed invoice data without putting the contract directly on-chain. Payer and merchant can reproduce the destination from the same canonical contract and payment base. Any difference in bytes, ordering, encoding or normalisation yields a different destination.

Payment-base key

The merchant exposes an extended public key from which contract-specific keys can be derived while retaining the corresponding private derivation capability. Key scope, network, account and reuse must be documented. An over-broad extended key can reveal links or enable unintended derivations.

Canonical contract representation

Human documents permit harmless formatting differences, but cryptographic commitments do not. Implementations need a canonical byte representation, version and hash domain. Displayed terms must match committed bytes exactly, and both parties should retain the signed or authenticated invoice.

Multiparty proof

The scheme aimed to give cryptographic evidence of payee and purpose without public chain metadata. A proof’s legal or commercial meaning still depends on identity verification, invoice authenticity and custody of records. Cryptography does not establish that goods were delivered.

Privacy properties

Derived outputs resemble ordinary P2PKH or witness destinations and avoid an obvious public contract marker. Reusing payment-base branches, network metadata, amount patterns and later disclosure can still link payments. Proof sharing should reveal only what the dispute requires.

Closed status and wallet support

BIP 175 is Closed, and standard wallet recovery may not scan its custom derivation. A seed backup without the contract set, payment-base path and canonicalisation rules may miss funds. Do not accept real payment until independent derivation and restoration have been tested.

How specialists test it

Developers test the proposal with made-up data on an isolated test network. They check normal cases and deliberately invalid cases. Different implementations should reach the same result before anyone relies on the proposal.

Conclusion

BIP 175 was a closed scheme for private on-chain contract commitments through HD derivation. Its security depends on canonical terms, scoped keys, authenticated invoices and recovery data beyond the wallet seed.