Home › Glossary › Tapscript

Tapscript

Also called: BIP 342, BIP342, Taproot scripts, OP_CHECKSIGADD, OP_SUCCESSx.

Tapscript is the script language for Taproot script paths (BIP 342): Bitcoin Script with Schnorr signature checks, OP_CHECKSIGADD and OP_SUCCESS hooks.

Tapscript is the version of Bitcoin Script used when a Taproot output is spent through its script path. It is defined in BIP 342 by Pieter Wuille, Jonas Nick and Anthony Towns, and activated with Taproot at block 709,632 in November 2021. A Taproot leaf with leaf version 0xc0 is a tapscript.

What's different from legacy Script

  • Schnorr signatures. OP_CHECKSIG and OP_CHECKSIGVERIFY verify BIP 340 Schnorr signatures against 32-byte x-only keys, signing the BIP 341 sighash message.
  • OP_CHECKSIGADD replaces CHECKMULTISIG. OP_CHECKMULTISIG and OP_CHECKMULTISIGVERIFY are disabled. The new OP_CHECKSIGADD (0xba) counts valid signatures, so a 2-of-3 multisig becomes <A> CHECKSIG <B> CHECKSIGADD <C> CHECKSIGADD 2 NUMEQUAL, which supports batch verification.
  • Simpler limits. The 10,000-byte script size limit and the 201-opcode limit don't apply. Instead each input has a signature budget of 50 plus its witness size in bytes, and each signature check uses 50.
  • MINIMALIF is consensus. The argument to OP_IF and OP_NOTIF must be exactly empty or exactly 0x01, removing a malleability vector.

Built for upgrades

Opcodes 80, 98, 126-129, 131-134, 137-138, 141-142, 149-153 and 187-254 became OP_SUCCESSx: a script containing one succeeds unconditionally, so a future soft fork can give it a meaning. Proposals such as OP_CAT (BIP 347, using OP_SUCCESS126), BIP 348 and BIP 443 build on this. Unknown public key types and leaf versions are reserved the same way; BIP 118 proposes a new key type.

Look up any opcode in the opcode reference.

BIPs that define Tapscript

  • BIP 342 (Tapscript): Validation of Taproot Scripts: Deployed. Specifies Tapscript, the updated scripting rules used when a Taproot output is spent through one of its hidden alternative conditions. It switches signature checks to Schnorr, removes some old…
  • BIP 341: Taproot: SegWit version 1 spending rules: Deployed. Taproot introduces a new kind of Bitcoin output that can be spent either with a single signature or by revealing just one of many possible alternative spending conditions, kept hidden in a tree…
  • BIP 340: Schnorr Signatures for secp256k1: Deployed. Defines a standard for Schnorr signatures, a simpler and more flexible signing method than the ECDSA scheme Bitcoin originally used, on the same elliptic curve. Schnorr signatures are compact (64…
  • BIP 347: OP_CAT in Tapscript: Complete. Brings back OP_CAT, an instruction that joins two pieces of data together, which was disabled in Bitcoin's early days over security concerns. Re-enabled only inside Taproot scripts, this simple…
  • BIP 118: SIGHASH_ANYPREVOUT for Taproot Scripts: Draft. Proposes SIGHASH_ANYPREVOUT, a signature type for Taproot scripts that does not commit to the exact coin being spent, so one signed transaction can be attached to any compatible coin. This would…

Related terms

  • Taproot: Taproot is the 2021 Bitcoin soft fork (BIPs 340, 341, 342) that added Schnorr signatures and P2TR outputs which hide unused spending conditions.
  • Bitcoin Script: Bitcoin Script is the simple stack-based language that sets the conditions for spending each output, such as which signatures or timelocks are required.
  • Opcode: An opcode is a one-byte instruction in Bitcoin Script, such as OP_CHECKSIG (0xac) or OP_RETURN (0x6a), that pushes data or acts on the stack.
  • Schnorr signatures: Schnorr signatures are the 64-byte digital signatures standardized in BIP 340 and used by Taproot. They are simpler and more flexible than ECDSA.

Learn more

Guides