BA-07 · LESSON 04

Tapscript

KEY DEFINITIONS

Terms used in this lesson

Tapscript: The version of Bitcoin Script used by a Taproot script-path spend.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.
Control block: Proof data showing that a revealed script was committed inside a Taproot output.
Taproot: A Bitcoin output and spending design that can combine a public-key path with privately committed alternative scripts.
P2TR: Pay to Taproot, the Bitcoin output type introduced with Taproot.
BIP340: The Bitcoin Improvement Proposal specifying Schnorr signatures for the secp256k1 curve.
Schnorr signature: Bitcoin’s Taproot signature scheme, whose algebra supports compact verification and advanced multi-party signing.
CHECKSIG: The Bitcoin Script operation that checks whether a signature is valid for the required public key and transaction message.

Script-path spends reveal one leaf, its witness, and a control block while keeping unused branches private.

65 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · tapscript executionTapscript executes the revealed leaf under versioned rulesSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered validation pipeline

01
WITNESSStack and leaf script
The final two witness items are the serialized script and control block.
02
MEMBERSHIPReconstruct output key
The leaf version, script bytes, siblings, internal key, and parity are committed.
03
EXECUTETapscript opcodes
Successful membership selects Tapscript validation for this leaf version.
04
CHECKSIGADDCount valid signatures
Tapscript supports efficient threshold constructions with Schnorr signatures.
05
RESULTClean true result
A valid tree proof cannot rescue a failing script, and a valid script cannot rescue a bad proof.

Rule shown: The control block first proves membership; only then does the node execute that leaf as Tapscript with its own opcode and signature rules.

STAGE 1 OF 5WITNESS: Stack and leaf script

The final two witness items are the serialized script and control block.

Governing relationship: The control block first proves membership; only then does the node execute that leaf as Tapscript with its own opcode and signature rules. Complete path: 1. WITNESS, Stack and leaf script. The final two witness items are the serialized script and control block. 2. MEMBERSHIP, Reconstruct output key. The leaf version, script bytes, siblings, internal key, and parity are committed. 3. EXECUTE, Tapscript opcodes. Successful membership selects Tapscript validation for this leaf version. 4. CHECKSIGADD, Count valid signatures. Tapscript supports efficient threshold constructions with Schnorr signatures. 5. RESULT, Clean true result. A valid tree proof cannot rescue a failing script, and a valid script cannot rescue a bad proof.

1. State transitionWhat exists, what changes, and what results

BEFORE

A P2TR output commits to leaf L: <RecoveryKey> OP_CHECKSIG, plus a separate hidden leaf.

MECHANISM

The spender chooses a script path and assembles only the arguments needed by that leaf. Other leaves remain hidden.

AFTER

A script-path spend proves both membership of the leaf and satisfaction of that leaf.

Text equivalent: Starting from A P2TR output commits to leaf L: <RecoveryKey> OP_CHECKSIG, plus a separate hidden leaf. The mechanism begins when The spender chooses a script path and assembles only the arguments needed by that leaf. Other leaves remain hidden. The resulting lesson is A script-path spend proves both membership of the leaf and satisfaction of that leaf.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Select one committed leaf

The spender chooses a script path and assembles only the arguments needed by that leaf. Other leaves remain hidden.

Complete path: 1. Select one committed leaf: The spender chooses a script path and assembles only the arguments needed by that leaf. Other leaves remain hidden. 2. Reveal script and proof: The witness's final items are the serialized Tapscript and control block. Earlier items become the initial execution stack, subject to annex handling. 3. Reconstruct the commitment: The node hashes the leaf with its version, combines sibling hashes from the control block, and recomputes the tweaked output key and parity. 4. Execute Tapscript: If membership is valid, the node runs the script with Tapscript semantics, including Schnorr CHECKSIG behavior and validation-weight rules. 5. Require successful completion: Signatures, hashes, timelocks, stack structure, and final truth must satisfy the revealed leaf. Membership alone is not authorization.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Control-block membership first reconstructs leaf, ordered root, tweak, output key, and parity; only then may the revealed leaf execute under Tapscript.

CHANGED CONDITION

A bad proof stops before Script, while a valid proof with a bad signature fails during execution; membership alone never authorizes the spend.

Important distinction: A valid control block makes the Taproot spend valid even if the revealed script returns false. The control block proves commitment membership. The revealed Tapscript must then execute successfully with its witness.

Text equivalent: The accepted path is enforced by Control-block membership first reconstructs leaf, ordered root, tweak, output key, and parity; only then may the revealed leaf execute under Tapscript. If the required condition changes, A bad proof stops before Script, while a valid proof with a bad signature fails during execution; membership alone never authorizes the spend.

Loading lesson visuals...

Learn the idea

Tapscript is the Script version used by Taproot script-path spends. The witness supplies stack arguments, the revealed script leaf, and a control block. Taproot first verifies that the leaf was committed to the P2TR output, then executes it under Tapscript rules. Tapscript uses BIP340 Schnorr signatures and changes several Script limits and upgrade mechanisms.

GUIDED EXPLANATION1/5 ideas inspected

Select one committed leaf

The spender chooses a script path and assembles only the arguments needed by that leaf. Other leaves remain hidden.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“A valid control block makes the Taproot spend valid even if the revealed script returns false.”

The control block proves commitment membership. The revealed Tapscript must then execute successfully with its witness.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.