Taproot: SegWit version 1 spending rules

Summary

The consensus rules for SegWit version 1 outputs (P2TR) and how they are spent. The aim is to reveal nothing on-chain about a coin's spending conditions beyond the part actually used. The output is a single 32-byte public key, built from an internal key P plus a commitment to the merkle root of a script tree: Q = P + int(hashTapTweak(P || merkle root))G. There are two ways to spend. On the key path, a single Schnorr signature in the witness is enough, and nothing about any script attached to the output ever appears. On the script path, the spender reveals the leaf script, its merkle path, and a control block — only the branch actually executed, so unused conditions never reach the chain. The intended shape is that cooperating parties settle through the key path and open a script only when cooperation fails. The signature message covers the amounts and scriptPubKeys of every input being spent, so an offline signer cannot be deceived about fees or execution conditions. Addresses are encoded in Bech32m and begin with bc1p.

Why it matters

Activated in November 2021 as a set with BIP340 (Schnorr signatures) and BIP342 (Tapscript). Combined with key aggregation, a multisig or contract spend can look exactly like an ordinary single-key payment, improving privacy and efficiency at once. The benefit is conditional, though: the moment the script path is used, the condition becomes visible on-chain.

Related BIPs

• BIP 86 — Key Derivation for Single Key P2TR Outputs
• BIP 340 — Schnorr Signatures for secp256k1
• BIP 342 — Validation of Taproot Scripts
• BIP 350 — Bech32m format for v1+ witness addresses

Related articles

• Privacy & Anonymity
• Transactions Deep Dive
• Ordinals, Inscriptions & Runes