non-mandatory-script-verify-flag (Invalid Schnorr signature) when trying to reveal a TR output

Question

I'm building a Bitcoin wallet, and I'm trying to spend a Taproot output via a script spend path, but I keep running into this "Invalid Schnorr signature" error from my RPC node:

{
    "result": null,
    "error": {
        "code": -26,
        "message": "non-mandatory-script-verify-flag (Invalid Schnorr signature)"
    },
    "id": null
}

The Taproot script I'm trying to spend is fairly straight-forward. It looks something like:

OP_PUSHBYTES_32 f24c112b21c9712042a0ba081261b2f447ac8e927230665417d0929a243e8fda
OP_CHECKSIG
OP_0
OP_IF
OP_PUSHBYTES_3 ...
OP_PUSHBYTES_1 ...
OP_PUSHBYTES_24 ...
OP_0
OP_PUSHBYTES_54 ...
OP_ENDIF

I've triple checked that the private key I'm using to sign with is associated with the public key f24c112b21c9712042a0ba081261b2f447ac8e927230665417d0929a243e8fda. I've also looked at Bitcoin Core and see that its failing the Schnorr verification, but the Schnorr verification passes locally. (I use scure/btc-signer for signing).

I'm not sure what additional information I can provide that would help debug. I can provide the commit tx id that creates the script spend output:

f3bab70b18ed3bef960d7df2a7b35839077c764c8d7791ffa8f8ec6c06d28102

whose transaction hex looks like:

020000000001012a1187fd23fa30932ec9dba59ec0e8d9032c6820d4bd20c860eb1c5c4c0545fc0100000000fdffffff0274670000000000002251201b09ce3a37ee16dbcb0a8dbf262a362996254af51d69a47379de9f3548d719a9bb030100000000002251208dace6f04076ca1ea4eb168dcdad6ad61f695ca1c16a3df6b9586cdca1c71db80140c16f410d7f98dc3ba17991ce61e5329350ae98e68dd8d3994afb6e44076e5c6c28185fd1934a0ff2d345dc755fb27aaa6a4b55381d29482b910941e46cb1a9dc00000000

And the reveal transaction hex that I'm trying to broadcast that is rejected with the "Invalid Schnorr signature" looks like:

02000000000102927d72fed0a50c351f0cd7c0d3a35714835ca6f133b8a4b311f9eb830d418f0a0100000000fdffffff65fb61cb2ecfad91c1c681b99dafcb221d6cb4fe577c8f60b67f069e9edaeebc0000000000fdffffff0274670000000000002251201c573b23ee8b7661095cad641f1f898d126794fc25cfbf61c8d9cbcaf529fd32a1a60100000000002251208dace6f04076ca1ea4eb168dcdad6ad61f695ca1c16a3df6b9586cdca1c71db80140b722450ec2fcb97dcd64f288b1b880d3a87bb72bb40563ddb3f7bad2a7267f694f2a427df52a91996c518d90848849cce6b204df71ee9c1126939ad57d35eb630140d4bbdf0a1ae79a96a90c48d34816ef29e69220faa292da04b682c7c9cc962184337cce55ea745cdc105744c0b8cfa5999551ca68623193136b247d524c615ca500000000

Any thoughts or help would be immensely appreciated. Thank you in advance!

Answer 1

Your transaction is a key path spend, not a script path spend (it only has one witness item, the signature). Perhaps you've calculated the sighash for a script path spend but then only included the signature in the witness stack, you also need to include the script and the control block.