Opt-In Audibility for Bitcoin Transactions via Cryptographic Commitments in Taproot Change Outputs

Abstract

Bitcoin transactions carry no native mechanism for linking an on-chain payment to its real- world commercial purpose. A self-custodying user who wishes to demonstrate that a specific transaction corresponds to a specific invoice — for tax reporting, corporate audit, or reg- ulatory compliance — has no standardised, cryptographically sound way to do so without revealing their full wallet history. Existing approaches either lack on-chain binding (BIP-70, manual record-keeping), impose visible overhead and privacy costs (OP_RETURN commit- ments), or operate on different platforms entirely (Zcash viewing keys, Lightning invoices). This thesis presents an opt-in auditability protocol that embeds a cryptographic commit- ment to a structured invoice inside a standard Taproot change output using a pay-to-contract key tweak. The commitment adds zero bytes to the transaction, produces an output that is byte-for-byte indistinguishable from any other Pay-to-Taproot output, and requires no changes to Bitcoin's consensus rules. A new invoice format — the Signed Bitcoin Invoice (SBI) — organises payment metadata into a Merkle tree with per-field blinding nonces, en- abling field-level selective disclosure to auditors via inclusion proofs. An optional verifiable credential, embedded as a Merkle leaf, binds the merchant's identity to the payment address, providing pre-payment address authenticity verification. Five security properties (commitment binding, commitment hiding, disclosure soundness, disclosure privacy, and non-repudiation) are formally argued via reductions to standard cryp- tographic assumptions. A game-theoretic analysis demonstrates that the invisibility of the mechanism is a prerequisite for the opt-in property to remain voluntary under regulatory pressure.