Partially signed transactions (PST)
A PST carries an unsigned transaction plus everything signers need: the outputs it spends, the
data each lock commits to (redeem), key origins and collected signatures. It follows BIP 174 /
BIP 370 (PSBT), adapted to Arrekta. It is a wallet standard, not consensus
(§16). Text form is standard base64 of the binary,
which starts with the magic dpst 0xFF.
Roles
| Role | Does |
|---|---|
| Creator | wraps an unsigned transaction and the outputs it spends; may leave inputs or outputs open with flags |
| Constructor | appends inputs/outputs while the matching flag is set (atomic swaps: Bob adds his side to Alice's offer) |
| Updater | adds redeem data (public key, multisig policy or policy encoding) and key origins |
| Signer | signs sighash(i) for each input whose redeem names one of its keys, then clears the flags |
| Combiner | merges PSTs of the same transaction, verifying every incoming signature |
| Finalizer | builds the witnesses, verifies them and outputs the signed transaction |
Hashlock preimages are given to the finalizer locally and are never stored in the PST.
Why signers can trust it without a UTXO lookup
The signature hash commits to the network, the whole transaction, the input position and the asset, amount and lock of every spent output. A coordinator that lies about a spent output gets a signature over a different message, which the network rejects. The worst it can do is waste a signature, so the fee and the per-asset amounts a signer computes from the PST are trustworthy.
A signer should display, per asset, the amounts leaving, the change and the fee. An output counts
as change only if one of its origins derives, from the signer's own seed, to a key named in the
output's redeem, and the decoder guarantees redeem matches the lock. So a coordinator cannot
pass off a lock it controls as the signer's change.
Safety rules the decoder enforces
- Magic, version 1, only known flag bits, no trailing bytes.
- Every
redeemmust hash to its lock; origins and signatures are sorted and must name keys inredeem. - Once any signature is present, flags must be 0: a signed PST can no longer change shape.
- Burn outputs and reserved lock kinds can't be spent through a PST.
Each violation has a stable error code (pst-magic, pst-redeem-mismatch, pst-flags, …),
listed in the error code reference.
Where it is used
- Multisig wallets and air-gapped signers: Multisig with PST.
- The wallet service coordinates PSTs between co-signers and never holds private keys.
- The issuer service co-signs restricted transfers as a PST signer.
- Atomic swaps of two assets, using the constructor phase.