[Proposal] Trustless BTC-Backed Loans Using Taproot

Newbie post seeking technical feedback. This proposal was drafted with AI assistance. Anyone is welcome to take these ideas forward (BIP or whatever).

[Proposal] Trustless BTC-Backed Loans Using Taproot (Phase 1 Today, Phase 2 Tomorrow)

TL;DR:
Alice needs a loan. She wants 0.20 BTC of liquidity for 365 days, agreeing to 0.05 BTC interest (total repayment: 0.25 BTC). She’s willing to lock 0.50 BTC as collateral. She doesn’t want to send her coins to a foreign custodian, so she and the lender use a simple on-chain setup detailed in Phase 1 and Phase 2 below.

Phase 1 works today with Taproot + timelocks and already beats most custodial loan models.
Phase 2 (future) adds covenants so repayment and collateral return happen without lender signature, eliminating the hold‑out problem and makes the loan fully trustless.

1) The Problem
Most BTC-backed loans today depend on custodians or centralized platforms, which creates:
• Loss of control: You hand over coins and hope they don’t get frozen or lost.
• Counterparty risk: Insolvency or hacks can wipe out your collateral.
• Regulatory exposure: Centralized entities can be coerced to freeze or seize.
• Privacy loss: KYC and on-platform activity linkage.

2) The Goal
Keep collateral governed by Bitcoin’s rules:
• Lender can’t seize early.
• Borrower can’t underpay.
• Cooperative settlements look like normal Taproot spends (privacy/fungibility).

3) Concrete Example
Loan: 0.20 BTC
Interest: 0.05 BTC
Total Repayment: 0.25 BTC
Collateral: 0.50 BTC
Term: 365 days
Alice does not want to send coins to a custodian.

4) Phase 1 — Works Today (Taproot + Timelock)
Collateral Lock: Alice locks 0.50 BTC in a Taproot output with two spending paths:
• Cooperative key‑path: Alice + lender co‑sign anytime → collateral returns to Alice.
• Script‑path fallback:
• After 365 days the lock is released and collateral returns to Alice.
• However, after 364 days, if Alice has not repaid the loan, the lender can claim the collateral via CLTV. This gives the lender priority by one day to prevent last-block race conditions.

Flow:
• If Alice repays early, cooperative spend looks like a normal Taproot spend (private).
• If Alice disappears, lender broadcasts timelocked fallback after day 364.

Known Limitation — Lender hold‑out:
If Alice repays off‑chain first, a malicious lender can refuse to co‑sign and wait for day 364 fallback.

Risk Mitigations:
• Atomic repayment (single PSBT): Inputs: Alice’s 0.25 BTC repayment + the 0.50 BTC collateral UTXO. Outputs: 0.25 BTC to lender; 0.50 BTC back to Alice. Both co‑sign → repayment and collateral return happen together, or not at all.
• Or obtain a fully co‑signed, fee‑robust cooperative transaction before sending repayment (enable RBF and/or ensure CPFP from an Alice‑controlled output).

5) Why Phase 1 Already Beats Today’s BTC Loan Model
• No custodians: Collateral stays in a Taproot address controlled by script rules.
• Reduced counterparty risk: If the lender disappears, the timelock guarantees Alice can recover collateral (after expiry).
• Privacy: Cooperative spends look like ordinary Taproot transactions.
• Less regulatory exposure: Pure on‑chain enforcement.
• Deployable now: Uses existing primitives (Taproot, CLTV, PSBT).
Caveat: Phase 1 still has lender hold‑out risk. Phase 2 removes that.

6) Phase 2 — Future Upgrade (Covenants like OP_CTV/OP_CAT)
How Phase 2 Eliminates Hold‑Out and makes the loan fully trustless:
• Script‑enforced repayment template: The collateral Taproot script commits to a transaction template that must:
– Pay the lender 0.25 BTC (principal + interest), and
– Return the full 0.50 BTC collateral to Alice (minus fees if desired).
• Unilateral by Alice: At payoff, Alice assembles that exact transaction, adds her 0.25 BTC inputs, and broadcasts.
• The network checks the covenant; no lender signature required.
• Safety preserved: If Alice never broadcasts, the 364‑day lender fallback path still exists.

Operational Notes:
• The template can specify exact outputs and fee policy (e.g., fee from Alice’s inputs, or multiple fee‑tier variants pre‑committed).
• Cooperative key‑path remains for privacy when both parties are aligned.
• The explicit 0.05 BTC interest baked into the template prevents underpayment games.

7) Implementation Today (Phase 1)
• Taproot output with:
– Key‑path: Alice + lender keys (cooperative spend).
– Script‑path: OP_CHECKLOCKTIMEVERIFY leaf enabling lender to spend after 364 days.
• PSBT workflow for multi‑party signing (hardware‑wallet and cross‑wallet friendly).
• Fee strategy: Prefer RBF or ensure CPFP via an Alice‑controlled output in the cooperative transaction.

8) Questions for the Community
• Would you use this setup for BTC‑backed loans today (Phase 1)?
• Should wallets implement a PSBT flow for the atomic repayment pattern?
• For Phase 2: Is a standardized covenant repayment template (principal + interest + collateral return) worth pursuing?

9) Related Work (plain‑text links)
• Taproot basics & tooling (Bitcoin Optech): https://bitcoinops.org/en/topics/taproot/
• Taproot technical explainer: https://learnmeabitcoin.com/technical/upgrades/taproot/
• OP_CHECKTEMPLATEVERIFY (BIP‑119) on Optech: https://bitcoinops.org/en/topics/op_checktemplateverify/
• Covenants overview (CTV) on covenants.info: https://covenants.info/proposals/ctv/
• OP_CAT explainer (Bitcoin Magazine via Nasdaq): https://www.nasdaq.com/articles/op-cat:-the-purr-fect-solution-for-covenants
• OP_CAT entry (covenants.info): https://covenants.info/extra/cat/
• DLC lending: Lava Loans v2 (Bitcoin Magazine): https://bitcoinmagazine.com/technical/lava-loans-protocol-v2-dlc-based-bitcoin-collateralized-loans
• MIT DCI — Discreet Log Contracts: https://www.dci.mit.edu/projects/discreet-log-contracts
• Liquidium DLC explainer: https://liquidium.wtf/blog/dlcs-%28discreet-log-contracts%29-bitcoin-smart-contracts
• Lygos Finance acquisition (Yahoo Finance): https://finance.yahoo.com/news/lygos-finance-acquires-atomic-finance-120000622.html

10) Trade‑offs & Design Choices (quick comparison)
Phase 1 (Taproot + CLTV + PSBT, no oracles)
• Pros: Deployable today; no custodians; cooperative spend looks like ordinary Taproot; lender disappearance is survivable via timelock.
• Cons: Lender hold‑out risk (co‑signature needed for cooperative repayment); no price‑aware liquidations (oracle‑free means time‑based rather than LTV‑based).

DLC‑style loans (multisig + timelocks + oracles)
• Pros: Price‑based margining/liquidation via external oracles; several implementations exist; discreet on‑chain footprint.
• Cons: Oracle dependency/coordination; more complex ops; cross‑chain settlement can add trust assumptions.

Phase 2 with covenants (OP_CTV / OP_CAT / CSFS)
• Pros: Unilateral, template‑enforced repayment (no lender veto); reduced interactivity; clearer fee policy via templating; cooperative key‑path remains for privacy.
• Cons: Requires consensus changes and broad agreement; template rigidity vs flexibility; potential privacy trade‑offs if templates are visible on‑chain.