MAST

Also called: Merkelized Abstract Syntax Tree, Merklized Alternative Script Trees, script tree, taptree, BIP 114.

MAST commits to many alternative spending scripts in a Merkle tree so only the branch actually used is revealed; Taproot implements it as script trees.

MAST stands for Merkelized Abstract Syntax Tree (it is also expanded as Merklized Alternative Script Trees). Instead of writing every possible spending condition into one script, each alternative goes into a leaf of a Merkle tree and the output commits only to the root. To spend, you reveal just the branch you use plus the hashes linking it to the root.

Why MAST helps

With an ordinary P2SH or P2WSH script, every branch is published when you spend, even the ones you didn't use. That wastes block space and reveals the whole contract. As BIP 114 puts it, MAST reduces the data needed from O(n) to O(log n) for n branches, allows conditions too large for a single script, and keeps unused branches private. A wallet with an everyday 2-of-2 policy and several timelocked recovery paths, for example, only ever publishes the path it uses.

MAST proposals and Taproot

• BIP 114, by Johnson Lau, proposed a new witness program type built around a Merkle tree of scripts.
• BIP 116 (MERKLEBRANCHVERIFY) and BIP 117 (tail call execution), by Mark Friedenbach, Kalle Alm and BtcDrak, proposed a more general version built from two pieces.

Neither was activated. MAST was realized through Taproot (BIP 341), which cites both approaches. A P2TR output commits to a script tree whose leaves are Tapscript scripts. A script path spend reveals one leaf and a control block of 33 + 32m bytes, where m is the leaf's depth (at most 128). Taproot adds one more step: if everyone agrees, the output is spent with a single key and no script is revealed at all.

Wallets describe these trees with tr() output descriptors, and BIP 360 proposes an output type that keeps the script tree but removes the key path.