BIP 341 — Taproot: SegWit Version 1 Spending Rules

BIP 341: Taproot: SegWit Version 1 Spending Rules

Authors: Pieter Wuille, Jonas Nick, Anthony Towns Status: Final Type: Standards Track Created: 2020-01-19 Activated: 2021-11-14 (Block 709,632)

Abstract

Taproot introduces a new SegWit version 1 output type that combines a Schnorr public key with an optional Merkelized tree of script conditions. In the common case, spending requires only a single Schnorr signature, regardless of the underlying complexity.

Core Concept

Every Taproot output encodes a single public key. This key can be spent in two ways:

Key path spend — A single Schnorr signature (the cooperative case). Thanks to key aggregation, all parties can combine their keys and sign together, making the transaction indistinguishable from a simple payment.
Script path spend — Reveals one branch of a Merkle tree of scripts. Only the executed script is revealed; all other conditions remain hidden.

How MAST Works

A Merkelized Abstract Syntax Tree organizes multiple spending conditions into a Merkle tree:

        Root
       /    \
    Hash01   Hash23
    /  \      /  \
  S0    S1  S2    S3

To spend via script S2, you reveal only S2 and the hashes needed to reconstruct the root (Hash01). Scripts S0, S1, and S3 remain hidden.

Privacy Benefits

Cooperative closes look identical — Whether it’s a 2-of-3 multisig, a Lightning channel, or a single-sig wallet, the key path spend looks the same on-chain
Unused conditions stay private — Only the executed script branch is ever revealed
Reduced on-chain footprint — Key path spends are smaller than equivalent P2SH or P2WSH transactions

Activation

Taproot was activated via the Speedy Trial mechanism on November 14, 2021, at block height 709,632. It was the first soft fork activated since SegWit in 2017.

Significance

Taproot represents a paradigm shift in Bitcoin’s smart contract capabilities. It:

Makes Bitcoin’s most common multi-party constructions indistinguishable from simple payments
Enables more complex scripting while reducing on-chain data
Provides the foundation for future improvements like cross-input signature aggregation
Completes the vision enabled by SegWit’s script versioning (BIP 141)