Can old wallets redeem segwit outputs it receives? If so how? There's some conflicting information out there on whether this is true or not. I'm looking for a technical answer to this in the hopes of clearing up future potential confusion over the matter.

The main question is: Can old non-upgraded non-segwit aware wallets redeem a segwit output it receives?

Segwit output is defined as an outpoint having a P2WPKH or P2WSH structure as outline in bip141 in its scriptPub section.

As I understand it, when an old wallet receives a segwit transaction meant for it(assume tx is already mined in a block), it will see 0 &lt;20-byte hash&gt;(assuming P2WPKH) in the scriptPub from this segwit transaction. Interpreting this under non-segwit rules, old wallets will see this as anyone_can_spend -- the top of the script stack always evaluates to truthy regardless of what's provided in the scriptSig in the redeeming transaction.

The only way for the wallet to use/redeem this segwit output is to construct a transaction as outline in the bip. That is, it constructs the transaction specifying prev_txid and index as normal, an empty scriptSig and a witness program + witness hash. But a non-segwit aware wallet won't know how to construct the last part of this. Without that part, segwit validating nodes and miners will have to reject this transaction.

So from this, it naturally follows that old non-segwit wallets should not be able to spend segwit transactions.

Note, this question is not about:


old wallets sending non-segwit inputs -> to a segwit output.
segwit wallets sending segwit inputs -> to a non-segwit output.
So from this, it naturally follows that old non-segwit wallets should not be able to spend segwit transactions.


That is correct. A wallet that does not know anything about segwit will be unable to construct a valid transaction input that spends a segwit output.

However, the premise of the question


  when an old wallet receives a segwit transaction meant for it


doesn't make sense either. If a wallet does not know about segwit, it will never construct a segwit address to give out. So, by definition, there cannot be any segwit output meant for it.

It is always the receiver who decides what exact outputs to accept money on - and this is what gets encoded into an address.