Gearing up the Caravan

Caravan is already the easiest way to build and spend from multisig addresses anonymously, and today we’re excited to share a massive upgrade. 

Caravan, which started as a multisig address coordinator is now the most user friendly, open source multisig wallet coordinator. It remains a powerful tool as a companion for anyone with an Unchained Capital Vault, and is becoming increasingly powerful as an independent multisig wallet.  

For bitcoin to meet the needs of billions of users while avoiding the centralized pitfalls of the legacy financial system, less technical users need easier solutions to better secure their wealth. Multisig usability, particularly where individuals control their keys, is one of the most important problems to solve for building a decentralized and antifragile bitcoin economy. Multisignature delivers enhanced security to individuals and businesses by creating redundancy and greater financial controls. Instead of mirroring the centralized account-based security of the legacy system, bitcoiners can rely on the security of bitcoin private key ownership to access financial services, as long as multisig is easy and ubiquitous. 

I meet people who use bitcoin every day who know they should be using multisig, but find it difficult to understand or difficult to get started. Caravan is a lightweight introduction for people who are curious to test multisig, and for developers working to solve one of the most important problems for bitcoiners today.

When we launched Caravan in November 2019, we spoke about our desire to create an open source tool that would help accelerate convergence on multisig standards. Many bitcoin companies are paving new ground around multisig standards, and Caravan gives these companies a venue to work out compatibility issues among users, developers, hardware wallets, software wallets and anyone else involved in multisig products. Beyond wanting to be good citizens of bitcoin, Caravan is extremely useful for Unchained Capital: we want our private application to use more open source, trust minimized software for critical operations. For example in this release, confirming multisig addresses on your Trezor device has been added to the unchained-wallets library in Caravan, which will also be used in Unchained Capital’s private Vault and Loans products. Multisig users win, anyone working on multisig products win, and yes, Unchained Capital and our users win as well. 

So what are all of us winners getting in this Caravan release?

Details of the Release

This release of Caravan comes with some major functionality enhancements that lay the foundation for PSBT support and give users more flexibility with how they interact with the tool. 

Consider Xpubs

The most noticeable change is that Caravan now generates a multisig “wallet” by coordinating extended public keys (xpubs), as opposed to only coordinating individual addresses with public keys (pubkeys). When xpubs are uploaded from hardware devices or by pasting them in manually, Caravan produces a stream of multisignature addresses with which users can transact, whereas the first release of Caravan produced a single address at a time. 

This means that N keystores (or devices) are only needed for an M-of-N multisignature wallet during set-up, after which only M keystores are needed for transacting from any of the coordinated addresses. This change makes Caravan more functional for users that want to create unique quorums and store keys geographically separated while still having the ability to transact frequently.

Downloading address details changes as well. With the wallet functionality, downloading wallet details saves the xpubs, wallet and key names, and BIP32 paths in a convenient, single JSON file, which users can save in an encrypted location and can use in the future to initialize their full wallet, giving them the ability to see address history and balances for multiple addresses. Instead of generating new address details for each address, users will have a single file to manage as long as they would like to interact with the same wallet. 

Use of UTXOs

Now that Caravan coordinates an entire wallet, users need a way to select which specific address they would like to spend from. They can now manually construct transactions by picking an address, or let Caravan select addresses to build transactions for them. Fine tuning addresses gives Caravan users extra control over how they construct transactions. By manually selecting unique addresses, Caravan users can work around potentially tainted UTXOs. 

The Confirmer of Addresses

Before Trezor Connect 8, Trezor devices were unable to confirm multisignature address details from the browser. Dhruv Bansal and Szymon Lesisz collaborated to enhance Trezor Connect, so that now users do not need to trust the address that Caravan is displaying in the browser, users can do so directly on the Trezor itself. This functionality helps bitcoiners avoid malicious browser extension attacks that could spoof addresses, and is something we believe should be a standard across all hardware wallets. If you’re a hardware wallet manufacturer, we would love to work together to enable this crucial functionality for your device. 

The State of the Hardware Wallet

All hardware wallets understand multisignature differently, particularly when used in tandem with the browser. That said, multisignature addresses give developers the ability to perform live tests with devices using mainnet bitcoin (as well as with testnet funds) in a way that is impossible to replicate with the legacy financial system or with single signature bitcoin wallets.  

This release comes with an enhanced hardware wallet testing suite. By loading an open source seed phrase onto a hardware device and combining it with a closed source seed phrase controlled by Unchained Capital, Caravan can now be used by hardware wallet manufacturers to generate a 2-of-2 multisignature wallet to confirm that their devices and firmware updates are compatible and behave consistently with different mainnet and testnet multisignature addresses in the browser. 

On both testnet and mainnet, the test suite is able to verify that hardware wallets can export pubkeys and xpubs at standard multisignature BIP32 paths, and also that devices can generate and sign P2SH, P2WSH, and P2SH-P2WSH multisignature addresses.

The test suite can be viewed as a bug bounty for multisignature in general, since there is one private key unveiled to the public in a 2-of-2 multisignature address. The test suite was already used to discover this bug in Trezor Connect 8, which the SatoshiLabs team was able to patch prior to release. We encourage all hardware wallet manufacturers and bitcoin developers to leverage the test suite in order to standardize browser-based multisig. 

Surface Detail

Finally, Caravan was given a cosmetic boost, with a new UI that stores slightly more state among different workflows while still remaining stateless overall. Everything lives on a single browser tab, and as soon as the browser session is concluded, Caravan forgets all wallet details by design. 

Caravan’s redeem script and address-specific functionality is now located under a dropdown menu, so that multiple users can still coordinate bitcoin price bets by constructing only a single address at a time, which prevents them from having to share more information than is necessary. Caravan is still able to coordinate pubkeys in addition to xpubs. 

Circling up the Wagons

We’re thankful for the contributions and ideas from so many people in this release, but particularly from Richard Bondi, who worked on almost every feature described.  If you’re interested in contributing, we’re always on the lookout for new ideas and PRs.

As for what’s next for Caravan, we’re focused on three things: 

• Continuing to transition our private apps to use Caravan’s libraries for the benefit of Unchained Capital Vault and Loans clients
• PSBT/Coldcard support
• More collaboration with Caravan open source contributors

If you’re an Unchained Capital client or prospective client, you can schedule time with our vault specialists to see a demo.