Watchtower monitoring logic for vault:

Goal: Protect against key theft

- If attacker steals hot key, they must wait 144 blocks (~24 hours)
  during which the owner can cancel using cold key

- Owner can cancel instantly using cold key at any time

- After 144 blocks, hot key spend is final

Vault structure:
IF
    <cold_key> CHECKSIG          ← Immediate spend (emergency)
ELSE
    <144> CHECKSEQUENCEVERIFY    ← Must wait 144 blocks relative
    DROP
    <hot_key> CHECKSIG           ← Then hot key can spend
ENDIF

scriptPubKey (as P2WSH, hash of this goes on-chain):

OP_IF
    <cold_pubkey_33bytes> OP_CHECKSIG
OP_ELSE
    <0x9000> OP_CHECKSEQUENCEVERIFY
    OP_DROP
    <hot_pubkey_33bytes> OP_CHECKSIG
OP_ENDIF

Where 0x9000 = 144 blocks in CSV encoding:

- 0x0090 in little-endian = 144

- CSV flag bit not set (blocks, not time)

Witness: [<cold_sig>, 0x01]
(for P2WSH: scriptWitness = [cold_sig, "1", vault_script])

Valid cold_sig? → [1]

Used in: Emergency situations, key rotation, suspicious activity noticed.

Witness: [<hot_sig>, 0x00]
Input must have nSequence >= 144 (0x00000090)

Check: input's nSequence >= 144?
  If YES (144+ blocks since vault output confirmed): continue
  If NO (too soon): SCRIPT FAILS

Remove CSV argument from stack

Valid hot_sig AND input is 144+ blocks old? → [1]

# Watchtower monitoring logic for vault:
def watch_vault_utxo(vault_txid, vault_vout, cold_key):
    """
    Watch for unauthorized hot-key spend attempts.
    If detected within 144 blocks, broadcast cold-key cancellation.
    """
    while True:
        # Check mempool and recent blocks
        spending_tx = find_spending_tx(vault_txid, vault_vout)

        if spending_tx:
            # Check if it's a hot-key spend (ELSE branch)
            if uses_hot_key_path(spending_tx):
                # We have 144 blocks to react
                cancellation_tx = build_cold_key_spend(
                    vault_txid, vault_vout, cold_key,
                    destination=cold_storage_address
                )
                broadcast(cancellation_tx)
                log("Vault breach attempt cancelled!")
                break

        sleep(60)  # Check every minute