Tapscript

BIP-342 defines it, and the leaf version byte 0xc0 marks a branch of a taptree as tapscript rather than as something invented later. Against the script language used everywhere else, it drops the limit of 201 non-push operations and the 10,000-byte script size cap, and it disables OP_CHECKMULTISIG. If you spend a Taproot coin by revealing a script, this is the language that script is written in.

How it works

A tapscript spend hands the network three things on the witness stack: the arguments the script wants, the script itself, and a control block proving the script belongs to the address.

Signature checking changed first. OP_CHECKSIG and OP_CHECKSIGVERIFY now expect a 32-byte x-only public key and a 64-byte Schnorr signature, or 65 bytes when a non-default sighash type is appended. OP_CHECKMULTISIG and OP_CHECKMULTISIGVERIFY fail outright, and OP_CHECKSIGADD takes their place.

Resource accounting changed second, and this is the part with real consequences. The old counters, 201 operations per script and a global sigop tally, are gone. Each input instead gets a validation budget that starts at 50 weight units plus the size of its own witness, and every successful signature check subtracts 50 from it. You buy verification work with bytes, which is a cleaner rule than a fixed count and means a script can hold as many keys as you are willing to pay for.

Two doors were left open for future upgrades. Opcodes 80, 98, 126 to 129, 131 to 134, 137, 138, 141, 142, 149 to 153 and 187 to 254 became OP_SUCCESS: if any of them appears anywhere in the script, even in a branch that never executes, the script succeeds immediately. Public keys of any length other than 32 bytes are treated as an unknown key type and pass. Both rules let a later soft fork assign real behaviour without a hard fork. What survived unchanged is the 520-byte cap on a single stack element and the 1,000-element stack limit.

Where you see it

Tapscript shows up whenever a Taproot output is spent the hard way, by revealing a branch instead of signing with the aggregated key.

The heaviest real user is data storage. An ordinals inscription is a tapscript envelope, a chunk of content pushed 520 bytes at a time between OP_FALSE OP_IF and OP_ENDIF, and it exists in that form precisely because tapscript removed the 10,000-byte script limit and put the witness discount behind it. Whatever you think of the practice, it is the reason most people have seen a tapscript spend without knowing it.

The uses closer to a saver are quieter. Timelocked recovery branches, escrow fallbacks and Lightning's newer channel scripts all live as tapscript leaves, and Bitcoin Core can build and sign them through Miniscript inside a tr() descriptor.

Tapscript vs Bitcoin Script

Bitcoin Script is the family; tapscript is one member of it. Three script versions are live on the network at once: the legacy language, the SegWit version 0 language, and tapscript, and a node picks between them from the output being spent, not from anything in the script itself.

That matters when you copy a script from a tutorial. A two-of-three written with OP_CHECKMULTISIG is valid in a P2WSH output and invalid in a taptree leaf. A script that pushes 4,000 bytes is over the consensus limit in a P2WSH witness script and fine in tapscript. Same opcodes on the page, different rulebook underneath.