BA-07 · LESSON 05

Taptrees and control blocks

KEY DEFINITIONS

Terms used in this lesson

Taptree: The Merkle tree of alternative scripts committed inside a Taproot output.
Control block: Proof data showing that a revealed script was committed inside a Taproot output.
Taproot: A Bitcoin output and spending design that can combine a public-key path with privately committed alternative scripts.
Tapscript: The version of Bitcoin Script used by a Taproot script-path spend.
Vault: A set of Bitcoin outputs and spending rules that holds collateral and represents the current loan state.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.

Merkle paths prove that a revealed leaf was committed into the Taproot output key.

35 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · taproot control blockA control block proves one hidden leaf belongs to the outputSelect any state to inspect its exact role.

RELATIONSHIP MAPCommitment and derivation tree

01
REVEALED LEAFScript L1 and version c0
Only the executed Tapscript leaf becomes public.
02
TAPLEAFH_TapLeaf(version || len || script)
Leaf version and CompactSize script length are part of the commitment.
03
MERKLE PATHSibling H(L2)
Each 32-byte sibling reconstructs one tree level in sorted hash order.
04
CONTROL BLOCKParity, internal key, and sibling hashes
The first byte records leaf version and output-key parity.
05
VERIFYRecomputed Q equals output Q
A wrong leaf, sibling, order, internal key, or parity bit fails the spend.

Rule shown: The spender hashes the revealed leaf with each sibling, recomputes the tweak, and checks that the resulting output key matches the witness program.

STAGE 1 OF 5REVEALED LEAF: Script L1 and version c0

Only the executed Tapscript leaf becomes public.

Governing relationship: The spender hashes the revealed leaf with each sibling, recomputes the tweak, and checks that the resulting output key matches the witness program. Complete path: 1. REVEALED LEAF, Script L1 and version c0. Only the executed Tapscript leaf becomes public. 2. TAPLEAF, H_TapLeaf(version || len || script). Leaf version and CompactSize script length are part of the commitment. 3. MERKLE PATH, Sibling H(L2). Each 32-byte sibling reconstructs one tree level in sorted hash order. 4. CONTROL BLOCK, Parity, internal key, and sibling hashes. The first byte records leaf version and output-key parity. 5. VERIFY, Recomputed Q equals output Q. A wrong leaf, sibling, order, internal key, or parity bit fails the spend.

1. State transitionWhat exists, what changes, and what results

BEFORE

A Ducat vault output commits to several possible paths, including liquidation.

MECHANISM

A leaf commits to its script and leaf version with a tagged TapLeaf hash.

AFTER

The proof establishes membership, not truth by itself. The revealed script still has to execute successfully.

Text equivalent: Starting from A Ducat vault output commits to several possible paths, including liquidation. The mechanism begins when A leaf commits to its script and leaf version with a tagged TapLeaf hash. The resulting lesson is The proof establishes membership, not truth by itself. The revealed script still has to execute successfully.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 4

Hash each script leaf

A leaf commits to its script and leaf version with a tagged TapLeaf hash.

Complete path: 1. Hash each script leaf: A leaf commits to its script and leaf version with a tagged TapLeaf hash. 2. Combine leaves into branches: Pairs of hashes are ordered and combined with tagged TapBranch hashing until one Merkle root remains. 3. Commit the root into the output key: The root is included in the TapTweak calculation that turns the internal key into the Taproot output key. 4. Reveal a control block when spending: The control block contains the internal key, leaf-version information, and sibling hashes. A verifier rebuilds the root, recomputes the output key, and then executes the revealed script.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The control block must reconstruct the exact TapLeaf hash, ordered Merkle root, tweaked output key, and parity before the revealed leaf executes under Tapscript.

CHANGED CONDITION

A malformed control block or wrong sibling fails membership before execution, while a valid membership proof with an unsatisfied script still rejects the spend.

Important distinction: A control block is a trusted signature from the wallet that created the tree. It is a deterministic Merkle proof. Nodes verify it mathematically against the Taproot output key.

Text equivalent: The accepted path is enforced by The control block must reconstruct the exact TapLeaf hash, ordered Merkle root, tweaked output key, and parity before the revealed leaf executes under Tapscript. If the required condition changes, A malformed control block or wrong sibling fails membership before execution, while a valid membership proof with an unsatisfied script still rejects the spend.

Loading lesson visuals...

Learn the idea

A taptree is a Merkle tree of possible Tapscript spending conditions. It lets a Taproot output commit to many alternatives while revealing only the branch actually used.

GUIDED EXPLANATION1/4 ideas inspected

Hash each script leaf

A leaf commits to its script and leaf version with a tagged TapLeaf hash.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“A control block is a trusted signature from the wallet that created the tree.”

It is a deterministic Merkle proof. Nodes verify it mathematically against the Taproot output key.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.