RootScope: deterministic reconstruction of Taproot script-path commitments

RootScope is a specialized tool designed for the detailed inspection of Taproot script-path spends, a task known for its complexity due to the necessity of reconstructing the full commitment chain which includes several sequential steps such as TapLeaf, TapBranch, TapTweak, and output key leading to the bech32m address. Each of these steps comes with its unique set of challenges including tagged hash label, byte order, parity bit, and lexicographic ordering, where errors can lead to silent mismatches. The tool aims to streamline this process by deterministically performing this reconstruction and revealing every intermediate value involved in the computation. This includes the TapLeaf hash, each TapBranch step along the Merkle path, the TapTweak and the tweaked output key, and finally, the bech32m address. An optional feature allows for an expected-address match check to validate the accuracy of the reconstructed address against expectations.

RootScope extends its functionality through a fetch-witness helper that specifically targets real transaction inspection. By accepting a transaction ID (txid) and a vin, it can automatically resolve the witness information from a block explorer and prefill the necessary inputs for analysis. Validation of RootScope’s effectiveness was conducted using the BIP 341 wallet-test-vectors.json, wherein it successfully passed all 12 script-path paths across six test cases. These cases included multi-path and mixed-depth examples, providing a comprehensive coverage of possible scenarios. Additional vectors from the resource "Mastering Taproot" further demonstrate RootScope's capability to accurately reconstruct single-leaf, dual-leaf, and balanced as well as unbalanced tree structures from different control block depths to the same output key. It’s important to note that the tool is implemented purely in Python utilizing only the standard library, making it accessible but not intended for high-speed signing purposes.

An area of potential improvement highlighted involves the handling of annexes within witnesses. Currently, if a witness contains an annex (indicated by a final entry starting with 0x50), the control block position shifts, which the tool does not presently accommodate, potentially leading to incorrect results. This limitation suggests an area for future development to ensure accuracy across all types of transactions.

The repository for RootScope is hosted on GitHub at https://github.com/aaron-recompile/rootscope, which also includes full reproducibility instructions and documentation for batch mode operations. The developer, Aaron Zhang, has expressed interest in receiving feedback regarding potential missed edge cases in the reconstruction flow, the approach to script-template labeling — whether a conservative, manually confirmed classification is preferable over automatic pattern matching — and suggestions for public datasets of script-path spends that could enhance batch processing capabilities.

For more detailed insights and to explore the code, interested parties are encouraged to visit the provided GitHub link. The document also references additional resources for mastering Taproot, available at https://github.com/aaron-recompile/mastering-taproot, offering further contextual understanding and technical depth on the subject matter.