Component

Exiting

A member leaves by proving their leaf against the committed root and putting an empty slot in its place, in one transaction that needs only their own signature. Two members can leave in one transaction, but each still carries a full proof, so the pair saves only the transaction's fixed overhead.

What an exit checks

An exit is the state machine with the simplest rule. The old node is the leaf; the new node is the empty slot. On top of the three checks every transition makes, the exit script requires:

• output 1 pays to the leaf's exit key;
• the leaf's owner key signed the transaction, with a signature that covers all outputs;
• output 1's amount is at most the leaf's amount, or exactly the leaf's amount in a tree created with exact payouts.

The exit key is separate from the owner key so that a hot key can authorise while the money lands on a cold key, and so that a leaf can name the funding key of a Lightning channel (see payments).

Why the operator does not sign

The first sketch of this design had the operator sign a voucher that a member presented to leave. Review removed it. Once the covenant checks the proof against the committed root, the operator has already agreed to the leaf: it signed the transition that put the leaf there. A required operator signature would add nothing except a way to refuse it. So the proof plus the owner's own signature is the whole authorisation, and the operator holds no key over anyone's balance.

Owners are still encouraged to ask the operator first. A unilateral exit competes with whatever the operator has pending for the same output, while a cooperative one can be folded into the operator's next transition for less.

Exact payouts and fee-paying payouts

In the FULL tier an owner's payout may be smaller than the leaf, and the difference goes to the fee; the owner agreed to it by signing. This lets an owner with no other coins pay the fee from the exit itself, and saves the fee input, about 99 vB. A tree may instead be created with exact payouts (EXIT_K^=), in which every payout equals its leaf and every fee comes from another input. The choice changes the scripts, so it is visible in the tree's identifier. The MID and MIN tiers are always exact, and a tree that hosts Lightning channels in its leaves is meant to be exact, because a channel's signed states assume its full capacity arrives.

Two exits, and why that saves little

EXIT_2 chains two single exits. Each step proves its own leaf against the root the previous step produced, folds its own path, and pays its own output. The second leaf brings a full path of its own, so the only shared bytes are the transaction's skeleton and the script's fixed parts. The second exit costs about 665 vB on top of the first, and the pair averages 842 per leaf.

Leaves that sit in the same aligned subtree share most of their path, and a script built for that shape hashes the shared part once. That is a different transition, the cohort rewrite, and the batching page covers it: 64 owners leaving together pay about 165 vB each.

What it costs

Each level of depth adds about 32 vB, so a tree holding sixteen times as many slots costs about 130 vB more to leave. The last member to leave takes a terminal exit: once the new root is the empty root, the tree output need not be recreated at all.

After any exit, the other members update their proofs from the exit's witness, which contains the full path and the new nodes. Nobody needs the operator's help to keep a proof current.