BA-07 · LESSON 02

Taproot outputs

KEY DEFINITIONS

Terms used in this lesson

Taproot: A Bitcoin output and spending design that can combine a public-key path with privately committed alternative scripts.
P2TR: Pay to Taproot, the Bitcoin output type introduced with Taproot.
Taptree: The Merkle tree of alternative scripts committed inside a Taproot output.
Vault: A set of Bitcoin outputs and spending rules that holds collateral and represents the current loan state.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.
Tapscript: The version of Bitcoin Script used by a Taproot script-path spend.
Control block: Proof data showing that a revealed script was committed inside a Taproot output.
Guardian: A Ducat policy-checking signer that can authorize or reject defined protocol transactions.
BIP341: The Bitcoin Improvement Proposal specifying Taproot output validation and the transaction signature message used by Taproot signatures.

P2TR commits to an internal key optionally tweaked by a script-tree root, presenting one compact output key on chain.

45 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · taproot output keyOne output key commits an internal key and optional scriptsSelect any state to inspect its exact role.

RELATIONSHIP MAPCommitment and derivation tree

01
INTERNAL KEYX-only P
P is a 32-byte x coordinate with the even-y point convention.
02
TREE ROOTEmpty
A key-only output commits no script leaves.
03
TWEAKH_TapTweak(P)
Tagged hashing separates this commitment from every other hash domain.
04
OUTPUT KEYQ = P + tweak*G
The witness program stores x(Q) as 32 bytes.
05
ADDRESSbc1p...
Bech32m encodes witness version 1 and the output key; the address is not stored in the transaction.

Rule shown: Q equals P plus H_TapTweak(P || merkle_root) times G; an empty script tree uses only P in the tweak hash.

STAGE 1 OF 5INTERNAL KEY: X-only P

P is a 32-byte x coordinate with the even-y point convention.

Governing relationship: Q equals P plus H_TapTweak(P || merkle_root) times G; an empty script tree uses only P in the tweak hash. Complete path: 1. INTERNAL KEY, X-only P. P is a 32-byte x coordinate with the even-y point convention. 2. TREE ROOT, Empty. A key-only output commits no script leaves. 3. TWEAK, H_TapTweak(P). Tagged hashing separates this commitment from every other hash domain. 4. OUTPUT KEY, Q = P + tweak*G. The witness program stores x(Q) as 32 bytes. 5. ADDRESS, bc1p.... Bech32m encodes witness version 1 and the output key; the address is not stored in the transaction.

1. State transitionWhat exists, what changes, and what results

BEFORE

A vault commits to a cooperative owner-plus-Guardian path and a liquidation path.

MECHANISM

The internal public key is the starting point for the output. Protocols may use a real signing key or deliberately choose an unspendable internal key.

AFTER

The output is compact and unused alternatives remain hidden, but the revealed path is still verified by every node.

Text equivalent: Starting from A vault commits to a cooperative owner-plus-Guardian path and a liquidation path. The mechanism begins when The internal public key is the starting point for the output. Protocols may use a real signing key or deliberately choose an unspendable internal key. The resulting lesson is The output is compact and unused alternatives remain hidden, but the revealed path is still verified by every node.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 4

Choose an internal key

The internal public key is the starting point for the output. Protocols may use a real signing key or deliberately choose an unspendable internal key.

Complete path: 1. Choose an internal key: The internal public key is the starting point for the output. Protocols may use a real signing key or deliberately choose an unspendable internal key. 2. Optionally build a script tree: Each alternative Tapscript condition becomes a leaf. Leaf hashes combine into a Merkle root, allowing one compact commitment to many paths. 3. Tweak the key: The internal key and optional Merkle root are hashed into a tweak. Adding that tweak point produces the output key encoded in the P2TR output. 4. Spend by key or script: A key-path spend supplies a signature for the tweaked key. A script-path spend reveals one script, its witness, and a control block proving that leaf was committed.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

BIP341 tagged TapLeaf, TapBranch, and TapTweak hashes, lexicographic branch ordering, internal-key parity, output-key parity, witness version, and 32-byte program must all agree.

CHANGED CONDITION

Changing a leaf, sibling order, internal key, or parity bit produces a different output commitment, so a spend cannot borrow a branch from another tree.

Important distinction: Taproot puts the whole taptree on chain when the output is created. Only the tweaked output key is visible at creation. A script and its proof appear only if that script path is spent.

Text equivalent: The accepted path is enforced by BIP341 tagged TapLeaf, TapBranch, and TapTweak hashes, lexicographic branch ordering, internal-key parity, output-key parity, witness version, and 32-byte program must all agree. If the required condition changes, Changing a leaf, sibling order, internal key, or parity bit produces a different output commitment, so a spend cannot borrow a branch from another tree.

Loading lesson visuals...

Learn the idea

A Taproot output is a version-1 witness output containing a 32-byte public key. That output key can commit to an internal key alone or to an internal key plus a tree of alternative scripts.

GUIDED EXPLANATION1/4 ideas inspected

Choose an internal key

The internal public key is the starting point for the output. Protocols may use a real signing key or deliberately choose an unspendable internal key.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Taproot puts the whole taptree on chain when the output is created.”

Only the tweaked output key is visible at creation. A script and its proof appear only if that script path is spent.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.