Taproot & Tapscript

Taproot (SegWit v1) lets coins be spent with a single Schnorr signature in the common case, while still allowing complex scripts as hidden alternatives. Addresses look like bc1p... (Bech32m).

Complete Step 1 // Required reading in the study plan above, then continue here.

Step 2 — Core idea: key-path vs script-path

Taproot improves privacy and efficiency for multisig-like policies and future Lightning constructions. Modern wallet descriptors increasingly default to Taproot.

Analogy: A house with a normal front door (key path) and several secret side doors (script leaves). Neighbors usually only see the front door — they never learn which side doors exist unless you open one.

Two ways to spend:

1. Key-path: sign with the tweaked output key — cheapest and most private
2. Script-path: reveal a script leaf + merkle proof + satisfy that script

Script-path leaves use Tapscript — Script with Taproot-specific rules and Schnorr CHECKSIG behavior. Multisig and timelock policies can live in leaves while cooperative spends stay on the key path (especially with MuSig-style aggregation).

Taproot output keys commit to an internal key tweaked by a merkle root of scripts (or a nothing-up-my-sleeve tweak when no scripts). Unused leaves remain hidden — a privacy win versus revealing a full redeem script every time (as with many P2SH spends).

If you support Taproot script trees, backups must include enough data to reconstruct spends for every leaf you might need — not only the key path.

Done when: You can contrast key-path vs script-path privacy in one sentence.

Step 3 — Try it: interactive + regtest (lab)

Complete Decoding Bitcoin’s Introduction to Taproot. Then:

ADDR=$(bitcoin-cli -regtest getnewaddress "" "bech32m")
bitcoin-cli -regtest getaddressinfo "$ADDR"

Note witness version / descriptor. Optionally fund and spend so you see a key-path-style spend on-chain. One sentence: what stays hidden until script-path is used?

Common mistakes

• Treating Taproot as “just a new address” without descriptors/backup of the script tree
• Losing the internal key / merkle info needed for script-path recovery
• Mixing Bech32 (v0) and Bech32m (v1) validation

Done when: Lab evidence (Decoding notes + bc1p/descriptor + privacy contrast) is complete.

Next lesson

Multisig & Timelocks — policies often hidden inside Taproot trees and Lightning scripts.