As part of a long-planned upgrade to Blockstream Green’s multisig security, today we’re upgrading the timelocks used for the recovery process on Blockstream Green from nLockTime to CheckSequenceVerify (CSV—not to be confused with the csv file type!). nLockTime was originally chosen because it was the only suitable technology at the time Blockstream Green (then known as “GreenAddress”) was launched. CSV was introduced later in a Bitcoin soft fork. If you’re a Blockstream Green user, don’t worry, you don’t need to do anything. The update won’t change how you use your wallet to send and receive bitcoin—our backend will handle everything.
The main difference CSV introduces is in the garecovery process of your Bitcoin accounts, which is required if you cannot access Blockstream’s servers or lose your two-factor authentication (2FA) method. Now you no longer need to provide an email address to receive timelock backup emails each time you send or receive a transaction. You’ll still always need your mnemonic (recovery phrase), so keep that safe!
The transition to CSV from nLockTime is great for both privacy and trust-minimization:
- Privacy: You no longer need to link any new accounts to an email address.
- Trust-minimization: You no longer need to trust that the Blockstream servers will send nLockTime backups. Instead, you can recover your funds using only your mnemonic and garecovery once your 2FA expires.
There’s some complex stuff going on under the hood, so we’ve set up an article on our Help Center that provides extra details on the motivation and mechanics of the change.
Affects New Transactions on Bitcoin 2-of-2 Accounts Only
If you’re already using a Blockstream Green standard Bitcoin account (2-of-2), you should continue to securely store any of your existing timelock backup files (or turn on timelock backups if you have not already).
The only funds that will be secured by CSV will be:
- New transactions that you receive from today.
- Change transactions received from your outgoing transactions.
- Transactions you send from the account back to yourself.
Liquid accounts have been using CSV since launch and are not affected by today’s change. Bitcoin 2-of-3 accounts do not use timelocks (the third key is used for garecovery instead) and are also not affected.
Tradeoffs with CSV
Despite the significant improvements for trust and privacy, there are a few tradeoffs with the transition to CSV that users should be aware of:
Mixed nLockTime and CSV wallets
If you already use a Bitcoin 2-of-2 account (the default account used by most users), your funds will be secured by a mixture of nLocktime and CSV for a while. Any new funds you receive will be on CSV, and existing funds will be migrated from nLockTime to CSV as you spend them.
Funds Spendable with Mnemonic After Timelock Expiry
If you have set up 2FA and someone steals your mnemonic (recovery phrase), that person could now spend your funds after the timelocks’ expiry (12 months by default) without needing the timelock backups. To keep your funds secure from this threat, make sure you have 2FA set up and follow any redeposit prompts from your wallet.
Slightly More Fees
The CheckSequenceVerify timelocks take up a little more space on the blockchain than nLockTime timelocks. As a result, transactions from Blockstream Green wallets will be 2% more expensive on average (Taproot should enable us to make some big reductions on this in the future).
Update to the Latest Version
Only users logging in with the following versions or greater of Blockstream Green will be able to take advantage of CSV:
- iOS and Android: 3.4.3 and higher (latest is 3.4.7)
- Desktop: 0.0.6 and higher (latest is 0.0.9)
Help Center for More Details
Blockstream Green’s multisig and timelock model can take some time to understand, so if anything isn’t clear, let us know on Twitter or by contacting us through our Help Center. Your feedback will help us improve our guides for other users.