Issues with Verifying Schnorr Adaptor Signatures for P2TR

Trying to create a schnorr adaptor signature here. I’ve got a message hash for a p2tr transaction. My goal is to: 1. Make an adaptor signature using oracle's private key and alice's x-only public key. 2. Finish the signature with alice's private key. Here’s what I generated so far: - Lender x-only pubkey: 35dfcbda618c2f3386eb523acc6087d44137fa3803416a40b849c877c0f14562 - Oracle x-only pubkey: 6bee714f4df6d3a3a3cb45ea623876359c49676e00274473968adb3c3a18e889 - Message hash: ebf6e6f7d50b43019dacf6ae0ae19902784314de0a9569b35ac890264a1382c6 - Completed sig: ddd56d569940d52555f95dc4e0dc88e10ec5d8d2a36f5e

Looks like you’re trying to validate your adaptor signature (let’s call it s) with the lender's public key like you would a normal signature. You should verify the adaptor signature manually by multiplying the plain signature 's_hat' with G, then adding the oracle’s public key, which I’ll call T. Also, try using clearer variable names in your code. And pro tip: I usually find it easier if scalars are lower case. Just my two cents, didn’t run the code though, just a quick glance.

A few common pitfalls for Schnorr adaptor signatures in P2TR: Make sure you’re verifying the right thing. A pre-signature won’t verify with a standard Schnorr verifier and the lender's pubkey. The public check for the adaptor pre-sig is: s_hatG = R_hat + eQ + Y where Y = t*G (oracle/adaptor pubkey), Q is the signing pubkey, and e = H_bip340(x(R_hat+Y) || x(Q) || m). Note that e uses R_final = R_hat + Y, not R_hat. Key-path spend: Q has to be the TWEAKED key (Q = P + H_tapTweak(P, merkle_root)*G), and the signing secret is x' = x + H_tapTweak(...). If you’re checking against the untweaked pubkey, it just won’t work.