Skip to main content
Share Your Experience: Take the 2024 Developer Survey
7 votes
Accepted

How did Taproot get its name?

This was answered in the Bitcoin Optech "Preparing for Taproot" series (2021): “I always assumed the origin of the name was ‘taps into the Merkle root’, but I don’t actually know what ...
Michael Folkson's user avatar
7 votes
Accepted

Why does BIP-340 use secp256k1?

Couldn't it have used other curves, like Curve25519 and its signature schemes that are being used by many other projects? Curve25519 is a key agreement scheme, but if you're referring to the (related)...
Pieter Wuille's user avatar
6 votes
Accepted

What would happen if we provide witness program different than 32 bytes for SegWit 1?

SegWit version 1 outputs with lengths other than 32 bytes remain unencumbered, which means their validation is unchanged and they remain anyone-can-spend. From BIP341: A Taproot output is a native ...
Vojtěch Strnad's user avatar
5 votes
Accepted

How can I tell if a Taproot input is a key path spend or a script path spend?

Taproot is specified in BIP341 which also includes much relevant information such as motivation and rationale. My answer will essentially just rephrase some of its highlights. Key path spends and ...
Vojtěch Strnad's user avatar
5 votes
Accepted

Where can I find (free) "deep-dive" materials related to Taproot?

This is a non-exhaustive list but these are some of the best resources to get started: Bitcoin Optech Preparing for Taproot series Bitcoin Optech Taproot workshop Bitcoin Optech Taproot workshop ...
Michael Folkson's user avatar
5 votes
Accepted

What is Tapscript?

Script (uppercase S, also Bitcoin Script) is the scripting language used in Bitcoin. Its programs are called "scripts" (lowercase s), often with an adjective based on the location of the ...
Vojtěch Strnad's user avatar
4 votes

How can I tell from the `getrawtransaction` if a transaction signaled Taproot?

It is still not clear to me what tx version number a Taproot transaction uses. Any transaction version number can have Taproot inputs or outputs. Is there a way to know via the ins (via ...
Pieter Wuille's user avatar
4 votes
Accepted

Are contrived combinations of address format and segwit version program possible?

I wonder that I'm unable to see how exactly BIP 0341 forbids v1+ segwit from using bech32. BIP341 has nothing to do with this; it specifies consensus validation rules, not address encoding. BIP350 ...
Pieter Wuille's user avatar
4 votes
Accepted

How is tapscript different than P2PKH using opcodes from a developer perspective?

It sounds like this means that I could do an ordinal in a non-taproot address bitcoin transaction. So I could mint an ordinal with a P2PKH address. Historically output types with address standards ...
Murch's user avatar
  • 75.7k
3 votes
Accepted

Is the signature check performed when the signature is the empty vector?

For pre-Tapscript opcodes (CHECKSIG and CHECKMULTISIG), the empty signature is checked against the public key. Note that by standardness if the check fails, the signature is required to be the empty ...
Antoine Poinsot's user avatar
3 votes
Accepted

Is it true that we don't care about parity with the key path, but it is not case with the script path? (Taproot)

Correct on both accounts. In taproot spends there can actually be up to 3 kinds of keys: The internal key (before tweaking) The output key (the internal key after tweaking) Script keys (inside the ...
Pieter Wuille's user avatar
3 votes
Accepted

"Witness program hash mismatch" code -26 when broadcasting a transaction

"Witness program hash mismatch" in a Taproot script path spend means the Taproot commitment wasn't successfully verified, in other words the internal key tweaked with the taptweak hash (...
Vojtěch Strnad's user avatar
3 votes

How many recipients can fit in a single Ark shared output?

MAST isn't really relevant here. As the Ark vtxo trees are just trees of sequential transactions. In theory they can be arbitrarily large. Some things are to take into account though: More round ...
Steven Roose's user avatar
  • 11.9k
3 votes
Accepted

non-mandatory-script-verify-flag (Invalid Schnorr signature) when trying to reveal a TR output

Your transaction is a key path spend, not a script path spend (it only has one witness item, the signature). Perhaps you've calculated the sighash for a script path spend but then only included the ...
Vojtěch Strnad's user avatar
3 votes

Accidently sent BTC to taproot wallet on Phantom. Wondering how i can get it back to Segwit so i can buy ordinals with it

Note that addresses are not accounts. The only way to move your coins to a different address (regardless of type) is to make a transaction. Presumably the wallet you are using allows you to send ...
Ava Chow's user avatar
  • 70.8k
3 votes
Accepted

How can taproot transactions manage to store so much data?

The only thing Taproot changed with respect to the "inscription envelope" is removing the script size limit, which was previously 10,000 bytes for P2WSH and 520 bytes for P2SH. In P2TR, the ...
Vojtěch Strnad's user avatar
3 votes
Accepted

How do pre-Segwit nodes interpret transactions containing Taproot OP_CHECKSIGADD?

Tapscript can only appear in leaf scripts. Leaf scripts can only appear in the witness stack of a P2TR script path spend. Pre-segwit nodes don’t see witness data. Ergo, a pre-segwit node will never ...
Murch's user avatar
  • 75.7k
2 votes

Sweep Taproot and native Segwit v0 coins in a single transaction using Bitcoin Core wallet

Regularly you'd use walletcreatefundedpsbt and then walletprocesspsbt. But since you've only got two coins in your wallet that you want to sweep you can simply use sendall. Let's walk through a ...
Antoine Poinsot's user avatar
2 votes
Accepted

taproot script spending issue

Since you only have a single script in the tree, the Merkle path would be empty, and the control block would be 33 bytes long. In general, the Merkle path elements in the control block are the other ...
Pieter Wuille's user avatar
2 votes
Accepted

Is the Taproot upgrade really essential for BRC-20 tokens on Bitcoin?

As far as I know, in principle, BRC-20, or something equivalent, only really needs to store about 60 bytes in some predictable location in a Bitcoin transaction. Nothing else. There is a very long ...
RedGrittyBrick's user avatar
2 votes
Accepted

How to get signature for tweaked public key in P2TR in case of multiple signature?

To sign for an aggregated public key you need to run the respective collaborative signing protocol (e.g. if you use MuSig2 key aggregation to aggregate the keys, you need to run the MuSig2 signing ...
Pieter Wuille's user avatar
2 votes
Accepted

What is the way to create public key in P2TR?

Consider two keyapirs, pubkey A with privkey a and pubkey B with privkey b. If you add the pubkeys together to get pubkey C, (A + B = C), C's private key c is also the sum of the two private keys, i.e....
Ava Chow's user avatar
  • 70.8k
2 votes

Verifying a zkSNARK on Bitcoin/Hope for a future with OP_MUL

I am trying to write a script that can verify a SNARK, but from what I understand OP_MUL is still is disabled in TapScript. It appears completely infeasible to me to implement a SNARK verifier in ...
Pieter Wuille's user avatar
2 votes
Accepted

How many transactions go on-chain if a user unilaterally exits from an Ark?

For a single user to unilaterally exit, they only have to broadcast their vtxo tree branch. This means your personal vtxo leaf tx and all the transactions that are between the leaf and the on-chain ...
Steven Roose's user avatar
  • 11.9k
2 votes
Accepted

Do we need a taproot commit for multisignatures if there is no script path, but we are using the MuSig2 protocol?

Is there any need for addition key tweaking if we use MuSig2 protocol for multisignature? Citing BIP341: Why should the output key always have a taproot commitment, even if there is no script path? ...
Pieter Wuille's user avatar
2 votes
Accepted

Is the Taproot script tree commitment quantum safe?

This was answered by Pieter Wuille on Delving Bitcoin: As long as SHA256 remains preimage resistant, script path spends remain secure (obviously only under the assumption the script itself isn’t ...
Vojtěch Strnad's user avatar
2 votes
Accepted

Where can I see Taproot scripts?

Does e.g. the "Details" button on Mempool.space satisfy your inquiry?
Murch's user avatar
  • 75.7k
2 votes

Where can I see Taproot scripts?

If you're looking for a blockchain explorer for Taproot scripts, there's scriptpath.info (disclaimer: I created it). It only shows transactions that spend Taproot script path inputs, decodes their ...
Vojtěch Strnad's user avatar
2 votes
Accepted

Which private key is used in Taproot transactions?

In a key path spend, you always sign with the private key corresponding to the output key. If that key is a tweaked public key (it's recommended to always use a tweaked key), you will also need to ...
Vojtěch Strnad's user avatar
2 votes

How do pre-Segwit nodes interpret transactions containing Taproot OP_CHECKSIGADD?

OP_CHECKSIGADD is only defined for SegWit v1 (Taproot). A pre SegWit v1 node that doesn't recognize Taproot rules will treat all SegWit v1 outputs as "anyone can spend" regardless of whether ...
Michael Folkson's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible