# ZIP 309: Blind Off-chain Lightweight Transactions (BOLT)

Status: Reserved

Owners: J. Ayo Akinyele, Colleen Swanson

Snapshot: a34cfc091434275120ff017c92c3b50d3cef623a

Source date: 2026-10-16T02:56:04+01:00

[Source revision](https://github.com/zcash/zips/commit/a34cfc091434275120ff017c92c3b50d3cef623a)

[Official source](https://zips.z.cash/zip-0309) · [Source file](https://github.com/zcash/zips/blob/a34cfc091434275120ff017c92c3b50d3cef623a/zips/zip-0309.rst) · [Discussion](https://github.com/zcash/zips/issues/1138)

[Edit by @daira on 2025-11-19: BOLT is on the back burner. This has a recent issue number because it has been transferred from [https://github.com/zcash/zcash](https://github.com/zcash/zcash) .]

To integrate BOLT,  we need to add a new unshielded transaction type  with a special script/payload/functionality where

1. Funds can be escrowed under the control of the payload

2. The script can validate  the opening and signature of a  signed commitment to a given value

3. The script can use  that value to control how the escrowed funds are split between two fixed output addresses provided at setup.

I imagine the basic approach will be similar to adding the TX type for zerocash transactions, but instead of having one vpub out, it has two to those two addresses. Effectively BOLT then becomes a way to privately and securely generated updated values to that commitment.

Most of this is completely independent of the cryptography used in BOLT payments. In the straight forward model, we would need to validate a proof of possession of a bilinear signature and use a pairing friendly curve for signatures as part of the tx type. However, I believe we can simply use  ECDSA and Pedersen commitments in the same curve at the cost of one additional round trip in the BOLT payment protocol.

Crucially, this makes the choice of primitives used to implement the actual payments in BOLT completely separate from the mechanism supporting BOLT in zcash.

In case it is not explicitly, clear, this proposal requires no changes to the circuit, nor does it require fixing transaction malleability.

## Citation relationships

Cites: None

Cited by: None