Withdrawals and the Vault

A withdrawal takes value out of the pool to an ordinary Bitcoin address. It is the normal way out. (Exits covers the two ways out that need nobody’s help.)

A withdrawal is a payment with a payout

A withdrawal is a contribution like a payment, except that one of its two outputs is not a note but a payout: an amount and a destination script.

• The proof binds a hash of the destination’s scriptPubKey, so nobody can redirect it.
• Its record looks like any payment’s record. A payout record follows it, carrying the amount and the destination hash.
• The settlement’s payout total leaves the pool coin as one output, the vault, and the settlement’s caboose commits to the list of payouts.

The vault fan-out

The vault is a taproot output with one script leaf per payout count, up to 256. One follow-up transaction, the fan-out, pays everyone:

settlement ──▶ vault (Σ payouts) ──fan-out──▶ payout 1 to address A
                                          ├─▶ payout 2 to address B
                                          ├─▶ …
                                          └─▶ a 0-sat tag naming the vault

The vault’s leaf:

1. rebuilds the settlement it came from and reads the payout commitment and total;
2. requires the fan-out’s outputs to be exactly those payouts, plus a zero-value tag naming this vault (so two vaults can never share one fan-out);
3. is signed SIGHASH_ALL | ANYONECANPAY, so anyone may add an input to pay the miner fee, and nobody can change an output.

Every node fans out a confirmed settlement’s vault by default, paying the fee from its own wallet. Racing fan-outs conflict and one wins; the payouts are the same either way.

Cost

A fan-out is about 424 vB plus 109 vB per payout. Your withdrawal’s fee (paid inside your proof, like any contribution’s) is priced to cover your payout’s output.

What is visible

A withdrawal shows on Bitcoin as a payout of some amount to some address. Which note paid it, and who owned that note, is not shown. On the share chain, which is public, a withdrawal’s amount and destination are visible while it waits, along with its fee and when it arrived. The wallet makes each withdrawal one standard chip by default (1-2-5 from 1,000 sat to 1 BTC). See privacy for what timing still reveals at low volume.

Cancelling

A withdrawal that has not been fixed into a batch can be replaced by a payment of the same note back to yourself, which takes its place. Once a batch is fixed, it is final.

Status

Withdrawals and the fan-out have run with real proofs on a GSR regtest node, including in the share-chain runs of 2026-10-29 and 2026-11-04. Twelve withdrawals in one settlement were fanned out with stand-in verifiers.