What Is Pay-to-Contract?

The method rests on the fact that elliptic curve keys can be added together. The paying party obtains a new key by adding a value derived from the hash of the contract text to the recipient's public key, and sends the payment to this key. The recipient can spend the payment by adding the same value to their own private key. From the outside, the address looks ordinary; but once the contract text and the recipient's original public key are revealed, anyone can verify that the payment was made for exactly that contract.

This way, the link between the payment and the agreement can be proven without writing extra data on-chain; the recipient cannot later claim that the payment they received belonged to a different agreement. Bitcoin's Taproot upgrade also hides alternative spending conditions inside a single public key with a similar key tweaking logic.

Pay-to-Contract is not a smart contract that runs code, as on Ethereum, but a commitment method. If not applied correctly, the proof can lose its value; also, the contract data needed for proof must be stored securely by the parties, because if this data is lost, the link cannot be proven.