Level 9 · Advanced technical layer

Tapscript and script branches

How a Taproot script-path spend proves one leaf and how Tapscript changes signature opcodes.

Article: 90
Reading time: 15 minutes
Reviewed: 10 September 2026

In a nutshell

A Taproot script-path spend reveals one Tapscript leaf plus a control block proving that leaf belongs to the output's committed tree. BIP 342 defines the leaf's execution rules, including Schnorr checks and OP_CHECKSIGADD.

Leaves build a Merkle tree

Each branch is hashed as a TapLeaf and combined into TapBranch hashes. The root tweaks the internal key. Tree shape affects the proof size for each branch, so likely paths can be placed at shallower depths.

The control block proves membership

A script-path witness provides stack data, the executed script and a control block containing the internal key, parity and sibling hashes. The verifier rebuilds the commitment and rejects a mismatch.

Tapscript has its own rules

BIP 342 uses Schnorr signatures and disables the old CHECKMULTISIG opcode for Tapscript. CHECKSIGADD makes threshold constructions possible by adding successful signature checks before comparing a total.

Future versions need careful handling

Leaf versions and unknown public keys reserve upgrade space. That flexibility is not permission for wallet software to improvise: policy tools must understand the executed version, resource limits and recovery branches before receiving funds.

Level 9 · Advanced technical layer

Terms to know

TapLeaf: The versioned hash commitment to one Tapscript.
Control block: Data proving a revealed leaf belongs to a Taproot output.
OP_CHECKSIGADD: A Tapscript opcode that adds a successful signature check to a number.

Common misconception

A script-path spend reveals the complete Taproot policy.

A more accurate explanation

It reveals the executed leaf and its Merkle path; unused branches normally remain hidden, although observers learn that the script path was used.

A more accurate explanation

Why keep scripts if a key path is smaller?

The script tree can encode recovery, timeout or dispute paths that work when cooperation fails. Their value is resilience, even if the common path is a signature.