Can't verify Taproot signatures that use SIGHASH_ANYONECANPAY

Question

I wrote a program that verifies signatures for Taproot transactions using the secp256k1 library. My program works perfectly for SIGHASH_ALL, SIGHASH_NONE and SIGHASH_SINGLE. But in February, we saw the beginning of a huge wave of Taproot transactions using 0x83 as the SIGHASH byte. I also know of one Taproot transaction that uses SIGHASH byte 0x81. My program fails on transactions that include the SIGHASH_ANYONECANPAY bit and I can't figure out why. These are all keypath spent transactions, which should be relatively simple to verify.

The problem must be that I am not producing the same message that was signed for these SIGHASH types, but I can't find where the error is. I am using the Signature validation rules section of BIP341 to determine which parts of the transaction to include.

The transaction that uses SIGHASH byte 0x81 is c0b767665e68916510126d704c1e96903275ed9e8c97e6782568cd23a4e8ef09, input 0. My program produces a message of 126 bytes as follows:

    Zero byte: 00
      Sighash: 81
   Tx Version: 02000000
  Tx Locktime: 00000000
 Outputs Hash: d32241d6cf9637a786922b700fc5c34385dc2a738d84734cae914b39ef595cfe
   Spend Type: 00
     Outpoint: 7eac3298e596858e44bdf23a06409133bf5eb5b886dda2891de452b991a7489400000000
       Amount: 3954000000000000
Output Script: 225120fd784aba5e91d18306ba722f3af50ecdaf056caf19a3632a39b1b64a2109ecf6
     Sequence: ffffffff

The outputs hash is a single SHA256 of the following bytes:

Output 0 Amount: e803000000000000
Output 0 Script: 225120fd784aba5e91d18306ba722f3af50ecdaf056caf19a3632a39b1b64a2109ecf6
Output 1 Amount: 3d46000000000000
Output 1 Script: 225120fd784aba5e91d18306ba722f3af50ecdaf056caf19a3632a39b1b64a2109ecf6

A transaction that uses SIGHASH byte 0x83 is 2e46f5b63deb421dee85cfea240a74b99d14b3286c195189f223f6260ea13943, input 1. My program produces a message of 126 bytes as follows:

    Zero byte: 00
      Sighash: 83
   Tx Version: 02000000
  Tx Locktime: 00000000
   Spend Type: 00
     Outpoint: 19ad63e54efbd351f94496789035483cd4c6962c9d63fe83dc9babcead677f4b00000000
       Amount: 1027000000000000
Output Script: 2251208102001190c6aad9a015dff1540dc9a7bda31613b8ab05a58268c4bff53fae82
     Sequence: ffffffff
  Output Hash: a29ce7981f103591964c176f85cb171e098c4d86d31ec711b2a91c0d59134adf

The output hash is a single SHA256 of the following bytes:

Output 1 Amount: 1027000000000000
Output 1 Script: 2251208102001190c6aad9a015dff1540dc9a7bda31613b8ab05a58268c4bff53fae82

Everything else is working fine. I'm using the TapSighash tag and everything else correctly, otherwise none of the other transactions would verify either. The problem is only happening for SIGHASH_ANYONECANPAY types. What am I missing?

Answer 1

It looks like your outpoints are serialized incorrectly. Txids are always displayed in reverse byte order, so when serializing them, they need to be in the reverse order of what everything displays them as.