I am trying to verify the witness of a P2TR transaction, but the signature verification failed, could you please help?

The raw transaction:


The scriptpubkey of input: 5120dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062 , and the value: 4677.

Above are arguments, and I generate a sigmsg from those arguments:


Then sighash: 54383836474379391a2ef0151bdbd9dc0e3b0e770f5052c433952082b09a2d7d.

The merkle_root: ec24ababd925ccbc309ce2684694fa32d17a8263b0a3f2d2999febfdfc7e5d28.

And the tweaked_pubkey: dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062.

In the end, I use signature 318bd919ead99017116322d9b861fef0e1f7d26a115dcc7b48fba34bfd5be023ef6d5ab364861b99bd0950ff74b3e93e50c6fd6d17751336f0cf435bb0738c5d to verify with sighash and tweaked_pubkey, but failed.

  • 1
    If it's a script path spend, the signature in it should be verified against the public key at it appears in the script, not the tweaked pubkey (the latter is only for key path spends). May 29, 2023 at 13:12
  • @peter Thank you. I tried the internal pubkey 64a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc41, but still can't pass the schnorr signature verify.
    – lj zn
    May 29, 2023 at 13:52

1 Answer 1


Finally, I found the problem.

  1. The signature is generated with the default sig type, aka 0x00. But I use the sighash_all, aka 0x01 to generate the sighash.

  2. I missed the extension part. Which is <tapleaf_hash_of_script> <0x00> <0xFFFFFFFF>, and should be appended at the end of sigmsg.

  3. As Peter commented, we need the internal pubkey to verify the script path spending.

  • 1
    Not the internal pubkey, but the pubkey in the script. In this case they are the same, but they don't have to be. May 30, 2023 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.