Understanding Taproot Formulas

Can someone explain taproot formulas to me? I’m trying to understand how the funding transaction works with a taproot address like [OP_1 push_bytes_32 KEY]. If the spending transaction contains the witness part, what’s the connection between SCRIPT, CBLOCK and KEY? Is it something simple like SHA256 (SCRIPT || CBLOCK) == KEY? I’m confused.

There’s no straightforward formula like that. The Control Block actually defines a key and a bunch of merkle branch hashes. You hash the script to get a leaf hash, then combine that with the merkle hashes to get the root hash. This root hash tweaks the internal key in the control block. Check BIP 341 for all the details in the Script Validation Rules.

Alright, what if we take the simplest P2TR transaction? For instance, let’s say we have a transaction txid that spends output xxxx:0. So I’d start by getting the taproot script from the witness part of the input and hashing it with sha256. We’d end up with a1=yyyy. What’s the next step?

1. Check the control block is the right size, which should be 33 bytes here. 2. The first byte of the control block gives you leaf_version after bitwise AND with 0xfe. 3. Pull out the p value from bytes 2 to 33. 4. Set P using p as the x coordinate and make sure the y coordinate is even. 5. Then to hash the script, use sha256(sha256("TapLeaf") || sha256("TapLeaf") || leaf_version || compact_size(script) || script). Finally compute t as sha256(sha256("TapTweak") || sha256("TapTweak") || p || k). This gets technical fast.