What is Tapscript (BIP 342)

1. What is Tapscript? (BIP 342)

Tapscript is the scripting language used inside Taproot script paths. It was introduced in November 2021 as part of the Taproot soft fork, defined in BIP 342. Tapscript is not an entirely new language — it is a refined version of Bitcoin Script with targeted modifications that make it safer, more upgradeable, and more efficient for complex spending conditions.

To understand Tapscript, you first need to understand where it lives. Taproot (BIP 341) introduced a new output type — P2TR (Pay-to-Taproot) — that can be spent in two ways: the key path and the script path. The key path allows spending with a single Schnorr signature against a tweaked public key. The script path reveals one of potentially many hidden scripts embedded in a Merkle tree structure called MAST (Merkelized Abstract Syntax Trees). When you take the script path, the script you reveal and execute is written in Tapscript.

Why Tapscript Was Needed

Legacy Bitcoin Script had accumulated limitations and quirks over twelve years of operation. Some of these were minor annoyances. Others were architectural problems that required careful workarounds. Tapscript addressed the most significant ones while preserving the fundamental nature of Bitcoin's scripting system.

The key problems Tapscript solved:

Signature hashing was quadratic in legacy transactions. In a transaction with many inputs, computing the signature hash required re-hashing transaction data for every input, leading to O(n²) hashing cost. SegWit v0 partially fixed this. Tapscript's signature hash algorithm (defined in BIP 341) fixes it completely.

OP_CHECKMULTISIG had an off-by-one bug. Legacy multisig required a dummy OP_0 at the start of the unlocking script due to a consensus bug that could never be fixed without a hard fork. Tapscript replaces OP_CHECKMULTISIG with OP_CHECKSIGADD, eliminating the bug entirely.

Script upgrades required soft forks. Adding new opcodes to legacy Script required deploying a soft fork, coordinating miner signaling, and waiting months for activation. Tapscript introduces OP_SUCCESS opcodes that allow much faster, cleaner upgrades.

The opcode count limit was a blunt instrument. The 201 non-push opcode limit in legacy Script was a rough approximation of execution cost. Tapscript removes this limit entirely, relying on transaction weight as a more accurate resource constraint.

BIP 342 in Summary

BIP 342 defines Tapscript by specifying:

1. Which opcodes are valid, disabled, or redefined compared to legacy Script

2. The new OP_SUCCESS upgrade mechanism

3. How OP_CHECKSIG, OP_CHECKSIGVERIFY, and OP_CHECKSIGADD work with Schnorr signatures

4. The new signature hash algorithm for Tapscript inputs

5. Resource limits specific to Tapscript execution

BIP 342 Key Facts:

- Activated: Block 709,632 (November 14, 2021)

- Deployed alongside: BIP 340 (Schnorr), BIP 341 (Taproot)

- Script version: leaf version 0xc0 in Taproot script paths

- Replaces: OP_CHECKMULTISIG and OP_CHECKMULTISIGVERIFY

- Removes: 201 opcode limit

- Adds: OP_SUCCESS opcodes for future upgrades

How Tapscript Fits Into the Taproot Architecture

P2TR Output (BIP 341)
└── Two spending paths:
    ├── Key Path: Single Schnorr signature against tweaked pubkey
    │   └── No script executed
    └── Script Path: Reveal a leaf from the MAST
        └── Execute the revealed script using Tapscript rules (BIP 342)

Every script inside a Taproot script path tree is a Tapscript. The leaf version byte (currently 0xc0 for BIP 342 Tapscript) identifies which script language version applies. Future script versions can use different leaf version bytes to define entirely different execution semantics.

Tapscript and Privacy

One of the most important properties of Tapscript is that it is hidden until spend time. A P2TR output on the blockchain looks identical whether it is a simple single-key spend or a complex multi-party contract with dozens of conditions. The Merkle root in the output commits to all the scripts, but reveals nothing about them. When you spend via the script path, you reveal only the specific leaf you are executing, not the other branches. This is a significant privacy improvement over legacy multisig, where all spending conditions are visible on-chain immediately.

Technical Insight

This topic covers essential mechanics for Chapter 11. Understanding these details is key to mastering advanced Bitcoin script constructions like Taproot and specialized covenants.