Creating an offline Tx

[raz0r0078]

Hi

I am trying to create and sign an offline Tx and broadcast it on an online node. To do it, I'm using Bitcoin Core 25.0.

My questions are:

1. Can BitcoinCore automatically select the UTXO to use, preventing me from selecting it manually? The idea is to avoid possible human errors. I know the command createrawtransaction but I have to manually select them using listunspent.

2. I need to have synchronized node data on the offline pc to do this (I have to have the updated UTXO list). So the other question is: Is there any simpler method where maybe I can copy only the UTXO list from my wallet to the offline computer instead of copying all the node data? I don't even have a synchronized node. If I can only copy the "utxo list"... where can I get it?

These are my doubts.
This is what I know so far, steps:

Offline PC:
1. Copy node data from online pc to offline pc.
2. Create the Tx using: createrawtransaction (use listunspent to see the utxo to use)
3. Sign it using signrawtransactionwithwallet

Online PC:
1. Copy the offline signed Tx data from offline pc to online pc.
2. Broadcast it using sendrawtransaction


Thanks

[1714513472]

1714513472

[1714513472]

1714513472

[1714513472]

1714513472

[1714513472]

1714513472

[mocacinno]

If i remember correctly (my node was shut down a long, long time ago), i just used to create the raw transaction on the watch-only (online) wallet, then transferred the raw (unsigned) transaction to the offline machine to sign it, and then transfer the signed transaction back to the online machine... IIRC, that way you didn't have to transfer any other data between your online machine and your airgapped one.

I know that doesn't 100% cover your question, but i just wondered if you might have been overthinking ... It's easyer to create the unsigned tx on your online machine, transfer this unsigned tx to the offline machine for signing, and back to the online machine for broadcasting than it is to synchronise an offline node.

I switched to a hardware wallet, and that's basically what happens with a HW wallet aswell: your watch only desktop wallet creates an unsigned tx, transfers it to your HW for signing (which doesn't have a clue about the utxo set, it just receives the unsigned tx), and then the signed tx goes from the HW wallet to the desktop wallet for broadcasting.

EDIT: if you're afraid you made an error when selecting inputs and calculating the fee, you can decode the raw unsigned transaction, either by using the cli, or by using the (offline, for your privacy) version of coinb.in (for example). That way, you can verify what you're signing, and you can make sure you didn't mess up the fee calculation before signing...

[nc50lc]

This is what I know so far, steps:

Just create a cold-storage setup that the new "descriptor wallet" can do.

Follow this instructions: Bitcoin core create a watch only wallet and sign transactions offline [Tutorial]
In the steps to export and import the descriptor(s), you may import all instead of just the selected script type if you want to be able to generate all four address types.

Or are you trying this on an existing non-descriptor wallet?
If so, you can create a "blank" and "disable_private_key" wallet in the online PC and import the necessary address(es) as descriptors. (descriptors.md)
Then you can do the provided steps of creating the PSBT in the online machine to be signed in the offline machine.

[Pmalek]

I need to have synchronized node data on the offline pc to do this (I have to have the updated UTXO list). So the other question is: Is there any simpler method where maybe I can copy only the UTXO list from my wallet to the offline computer instead of copying all the node data? I don't even have a synchronized node. If I can only copy the "utxo list"... where can I get it?

What kind of user errors are you looking to prevent by having Bitcoin Core select the UTXOs instead of you? If you already have a cold wallet on an airgapped computer, then leave it as your signing machine. You need to synchronize your online wallet. That's where you should manually select the coins you want to spend and bring them over for signing using the private keys in your cold wallet.

Working with cold storage like that isn't as easy as using a light client. But I think what mocacinno and myself have recommended is more user-friendly than adding additional steps to the process.

[raz0r0078]

If i remember correctly (my node was shut down a long, long time ago), i just used to create the raw transaction on the watch-only (online) wallet, then transferred the raw (unsigned) transaction to the offline machine to sign it, and then transfer the signed transaction back to the online machine... IIRC, that way you didn't have to transfer any other data between your online machine and your airgapped one.

I know that doesn't 100% cover your question, but i just wondered if you might have been overthinking ... It's easyer to create the unsigned tx on your online machine, transfer this unsigned tx to the offline machine for signing, and back to the online machine for broadcasting than it is to synchronise an offline node.

I switched to a hardware wallet, and that's basically what happens with a HW wallet aswell: your watch only desktop wallet creates an unsigned tx, transfers it to your HW for signing (which doesn't have a clue about the utxo set, it just receives the unsigned tx), and then the signed tx goes from the HW wallet to the desktop wallet for broadcasting.

EDIT: if you're afraid you made an error when selecting inputs and calculating the fee, you can decode the raw unsigned transaction, either by using the cli, or by using the (offline, for your privacy) version of coinb.in (for example). That way, you can verify what you're signing, and you can make sure you didn't mess up the fee calculation before signing...

Thanks for your help!
You are right - we can create a raw transaction on the watch-only (online) wallet. By doing so, we avoid the first step on the offline pc: copying the node data.
The idea is not to have the .dat file on an online PC, for security reasons.
About the hardware wallets: I don't trust on them. It runs a specific firmware that we have no control.


But anyway ... I see your point. Anyone can do what they want and take the risks.

Just create a cold-storage setup that the new "descriptor wallet" can do.

Follow this instructions: Bitcoin core create a watch only wallet and sign transactions offline [Tutorial]
In the steps to export and import the descriptor(s), you may import all instead of just the selected script type if you want to be able to generate all four address types.

Or are you trying this on an existing non-descriptor wallet?
If so, you can create a "blank" and "disable_private_key" wallet in the online PC and import the necessary address(es) as descriptors. (descriptors.md)
Then you can do the provided steps of creating the PSBT in the online machine to be signed in the offline machine.

Let me take a look at this. I will return if I have any questions. It's interesting.
But I read in that topic that "Your online PC must have bitcoin core installed and synched", so we cannot avoid having a synched node? (2nd question I posted here). Or maybe we can use a public node to broadcast the Tx... ? The idea is to find the easiest and fastest way. Let me take a deep look.

Creating a watch-only wallet on the online pc and import descriptions isn't insecure right ? I'm just importing 2 descriptors, it's not like my entire .dat file I suppose ...
The idea is not to have the .dat file on an online PC, for security reasons.

What kind of user errors are you looking to prevent by having Bitcoin Core select the UTXOs instead of you?

Basically these are the parameters to create a raw tx:

./bitcoin-cli -regtest createrawtransaction '''[ { "txid": "'$utxo_txid'", "vout": '$utxo_vout' } ]''' '''{ "'$recipient'":$rcp }'''

$utxo_txid and $utxo_vout are values that you have to manually select using the cmd listunspent.
This is how it works: https://github.com/BlockchainCommons/Learning-Bitcoin-from-the-Command-Line/blob/master/04_4_Sending_Coins_with_a_Raw_Transaction.md
Read at the end of the doc:
The disadvantages. It's easy to lose money. There are no warnings, no safeguards, and no programmatic backstops unless you write them. It's also arcane. The formatting is obnoxious, even using the easy-to-use bitcoin-cli interface, and you have to do a lot of lookup and calculation by hand.


The task is easy when you only use 1 full UTXO. But things get more complicated when you have to use more than 1, do some calculations, etc.
So... what I'm looking for is to forget about this. Let BitcoinCore do it for me, why don't we have a "magic" command to calculate this automatically? In other clients like the Kaspa client (other coin that uses UTXO format), it's automatic. Why didn't bitcoin core do this? It is a great intrigue that I have. Or maybe there is something that I still don't know.

EDIT: I see this command fundrawtransaction ... https://github.com/BlockchainCommons/Learning-Bitcoin-from-the-Command-Line/blob/master/04_5_Sending_Coins_with_Automated_Raw_Transactions.md maybe this is the "automatic" thing that i was looking for. Lol.

[nc50lc]

Creating a watch-only wallet on the online pc and import descriptions isn't insecure right ? I'm just importing 2 descriptors, it's not like my entire .dat file I suppose ...
The idea is not to have the .dat file on an online PC, for security reasons.

Based from this, it's looks like for a new set-up, not from an existing wallet.dat file?

For the security, listdescriptors without "true" arg only outputs public descriptors containing your wallet's extended public key (xpub).
That's what the instructions mentioned to import to the "watching-only" wallet.dat in the online PC.

-snip-

Let me take a look at this. I will return if I have any questions. It's interesting.
But I read in that topic that "Your online PC must have bitcoin core installed and synched", so we cannot avoid having a synched node? (2nd question I posted here). Or maybe we can use a public node to broadcast the Tx... ? The idea is to find the easiest and fastest way. Let me take a deep look.

Okay, if you really don't want to sync a node, you can go for Electrum as the watching-only wallet.
In the current version, you can directly import the addresses or to be able to generate an HD watching-only wallet; the extended public key in your public descriptor.

For the former: Select "Import bitcoin addresses or private keys" when creating a wallet, then import your address(es), one per line.
The disadvantage of this over the other option is: you're stuck with those addresses and you'll have to manually import if you want to use more of your addresses from offline Bitcoin Core.
In the other option, both online and offline wallets can generate the same addresses of the selected script type, including change.
The advantage of this is you can import TapRoot addresses.

For the latter: Select "Standard->Use a master key" but for extended public key must be converted from "xpub" into "zpub" or "ypub" if you're not going to use legacy addresses; refer to the descriptor's script type, "wpkh(" or "sh(wpkh".
You can do this in Electrum's console but it's only accessible once you created a wallet, so create a dummy wallet that you can delete later, name it accordingly. (or use the command-line)
Once a wallet is loaded, enable the console in "View->Show console" and go to 'Console' tab, then type the command: convert_xkey(xkey="xpub.....",xtype="p2wpkh")
The sample "xtype" is for "bc1q" 'Native SegWit' addresses, change it to "p2wpkh-p2sh" if you want to use "3" 'p2sh-SegWit' instead, TapRoot isn't currently supported.
Then Import the output in the menu above.

To export transactions from that watching-only wallet: Select "Share->Save to file/Copy to Clipboard".
To import to Bitcoin Core GUI: Select "File->Load PSBT from...", sign it and copy to clipboard, go to Console (Window->Console), finalize it with "finalizepsbt <paste_it>".
To import the finalized signed raw transaction to Electrum: Use, "Tools->Load transaction->from Text", check the inputs/outputs, fee and amounts, then broadcast it.

[Pmalek]

The idea is not to have the .dat file on an online PC, for security reasons.

Your security couldn't be affected to the point that you could lose your bitcoin. The online wallet would need the private keys - the signing keys to be able to spend UTXOs. But it's not going to have that. It's only going to have public keys for address generation and for watching the wallet and its balance updates.

Worst case scenario, your privacy is affected.

About the hardware wallets: I don't trust on them. It runs a specific firmware that we have no control.

I understand that. It is important to distinguish closed-source and open-source wallets and their firmware. Open-source wallets have been thoroughly tested. Now, that doesn't mean that someone couldn't find a serious bug one day, but the same is true for Bitcoin Core. 

[raz0r0078]

Okay, if you really don't want to sync a node, you can go for Electrum as the watching-only wallet.
In the current version, you can directly import the addresses or to be able to generate an HD watching-only wallet; the extended public key in your public descriptor.

For the former: Select "Import bitcoin addresses or private keys" when creating a wallet, then import your address(es), one per line.
The disadvantage of this over the other option is: you're stuck with those addresses and you'll have to manually import if you want to use more of your addresses from offline Bitcoin Core.
In the other option, both online and offline wallets can generate the same addresses of the selected script type, including change.
The advantage of this is you can import TapRoot addresses.

For the latter: Select "Standard->Use a master key" but for extended public key must be converted from "xpub" into "zpub" or "ypub" if you're not going to use legacy addresses; refer to the descriptor's script type, "wpkh(" or "sh(wpkh".
You can do this in Electrum's console but it's only accessible once you created a wallet, so create a dummy wallet that you can delete later, name it accordingly. (or use the command-line)
Once a wallet is loaded, enable the console in "View->Show console" and go to 'Console' tab, then type the command: convert_xkey(xkey="xpub.....",xtype="p2wpkh")
The sample "xtype" is for "bc1q" 'Native SegWit' addresses, change it to "p2wpkh-p2sh" if you want to use "3" 'p2sh-SegWit' instead, TapRoot isn't currently supported.
Then Import the output in the menu above.

To export transactions from that watching-only wallet: Select "Share->Save to file/Copy to Clipboard".
To import to Bitcoin Core GUI: Select "File->Load PSBT from...", sign it and copy to clipboard, go to Console (Window->Console), finalize it with "finalizepsbt <paste_it>".
To import the finalized signed raw transaction to Electrum: Use, "Tools->Load transaction->from Text", check the inputs/outputs, fee and amounts, then broadcast it.

Thank you so much for your help! Yes, something like Electrum is what I was looking for.
I followed the steps to create a watch-only wallet on Electrum.
Now I have a watch-only wallet ready to use (and linked to my offline wallet I think, because it was created based on the xpub/zpub from my offline wallet).

But now my question is: how can I create the unsigned Tx in Electrum ? I didn't understand that part. I have to create it and generate the PSBT file.
Then I have to sign it on my offline pc and return to Electrum to broadcast,
But I don't understand how to create the unsigned Tx and generate the PSBT file on Electrum.

Thanks

[BitMaxz]

But now my question is: how can I create the unsigned Tx in Electrum ? I didn't understand that part. I have to create it and generate the PSBT file.
Then I have to sign it on my offline pc and return to Electrum to broadcast,
But I don't understand how to create the unsigned Tx and generate the PSBT file on Electrum.

Thanks

It should be easy to create an unsigned transaction on Electrum and save it into PSBT look at the image below


1. go to send tab
2. Paste the BTC address where you want to send  BTC
3. The amount that you willing to send
4. Click pay

5. Adjust the fee you want to pay
6. Click ok

7. Click share after you review the transaction
8. Then save it to file

After you save it into a file make sure the end of the extension file is psbt copy it and move it to other hardware devices where you can sign it offline.

[nc50lc]

-snip-
To export transactions from that watching-only wallet: Select "Share->Save to file/Copy to Clipboard".

But now my question is: how can I create the unsigned Tx in Electrum ? I didn't understand that part. I have to create it and generate the PSBT file.

BitMaxz already provided the detailed steps.

I skipped the "create transaction" part because it should be straightforward steps using the 'Send' tab, I guess I should've noted it.
And then in the last part, the steps to export and import transactions which could be tricky to do without a guide (in the quote).

[raz0r0078]

Thanks for the help!
I was able to do everything, using Electrum (pc-online) and Bitcoin Core (pc-offline), but I have a problem:

The Tx was executed and the Destination Wallet received the correct amount, but my Origin Wallet doesn't have the correct amount. It's because I have money in a change-address and it never returned to my origin address. So... I have these questions:


1) If I want to return the money from my change-address to my origin-address I have to create a new watch-only wallet in Electrum with the xpub/zpub of my change-address and generate a new Tx. Is that right ? If not, how to return the money to my origin address ?

2) How can we make this automatic ? I mean, auto-return the money always from my change-address to my origin-address. Is there any option in Electrum or something like that ? Or I have to always do it manually ?

Anyway I see the correct amount in Electrum, so maybe it's not necessary to return the money. But if I want to see it in a public explorer like blockchain.com obviously I cannot see the total amount of my origin wallet. That bothers me.


Finally I wanted to ask ... maybe for the future ... can we use Lighting Network in Electrum right? Is there a simple way to use it or it's complex ? The point is that Bitcoin is very very slow, I had to wait 1 hour to get my Tx executed 

Thanks

[nc50lc]

The Tx was executed and the Destination Wallet received the correct amount, but my Origin Wallet doesn't have the correct amount. It's because I have money in a change-address and it never returned to my origin address. So... I have these questions:

By saying "Wallet", do you meant "Address"?

If so, that's expected if you've followed the "Use a master key" method which created an HD wallet that can generate both external (receiving) and internal (change) addresses.
Both are the same in your Bitcoin Core's parent descriptors of your change and receiving address of the selected script type.
That's the recommended way of importing your Bitcoin Core's public descriptor(s) to Electrum which is good for your privacy.

You can untick "Use change address" in the setting icon inside 'New Transaction' dialogue box after clicking "Pay...", that'll reuse the same address to receive the change.


However, if you don't want to use an HD wallet and keep on reusing the same address for some reason...
You can just create another watching-only wallet using the "Import addresses or private keys" method and just import that single address, then send all your coins there.

Finally I wanted to ask ... maybe for the future ... can we use Lighting Network in Electrum right? Is there a simple way to use it or it's complex ? The point is that Bitcoin is very very slow, I had to wait 1 hour to get my Tx executed  

Electrum's lightning implementation is in the middle (to complex) ground, it's self-custody and works as a lightning node but not as complex as lnd.
There's a topic in Electrum board that covers most of its functions with instructions on how to set-it-up: Electrum Lightning Network walkthrough
(images are broken)

[raz0r0078]

Perfect, it worked!
Thank you so much. There is a great community here. Thanks guys