TSP-0001 Taproot

This proposal defines the Tondi chain as a blockchain network that inherits full backward compatibility with all Kaspa payment types while introducing native Taproot (P2TR) support with Bitcoin Taproot OP_SUCCESS compatibility.

Proposal Number: TSP-0001
Proposal Name: Support Kaspa-Compatible Payment Types with Extended Taproot
Proposal Status: Implemented
Author: Tondi Foundation Development Team
Creation Date: 2024-11-05
Target Version: Tondi Genesis (v2025a)
Protocol Scope: Transaction validation rules, script structure, signature algorithm

๐Ÿ” Overview

This proposal defines the Tondi chain as a blockchain network that inherits full backward compatibility with all Kaspa payment types while introducing native Taproot (P2TR) support with Bitcoin Taproot OP_SUCCESS compatibility. Specifically:

  • Legacy Kaspa-compatible outputs (P2PK, P2SH, multisig, etc.) remain valid;
  • Taproot (P2TR) outputs are added, supporting both key-path and script-path spending;
  • All Schnorr signatures in Taproot follow BIP-340, ensuring compatibility with Bitcoin's cryptography stack;
  • Bitcoin Taproot OP_SUCCESS opcodes are fully supported (OpSuccess, OpSuccess1, OpSuccess2);
  • Default address formats include both Kaspa-style encoding and Bech32m with prefix tondi for Taproot.

Note: Kaspa does not implement Bitcoin's SegWit/BIP-141, therefore P2WPKH (OP_0 <20-byte-pubkey-hash>) and P2PKH (OP_DUP OP_HASH160 <pubkey_hash> OP_EQUALVERIFY OP_CHECKSIG) are not supported in Kaspa's architecture. Tondi follows Kaspa's native ScriptPublicKey structure and address system.

This hybrid approach balances compatibility and innovation, allowing Tondi to support existing Kaspa tooling while enabling advanced features such as RGB contract anchoring and high-frequency validation.

๐ŸŽฏ Goals

  • Maintain backward compatibility with all Kaspa-standard payment types;
  • Introduce Taproot support for advanced contract anchoring and privacy;
  • Enable Bitcoin Taproot OP_SUCCESS compatibility for cross-chain tooling;
  • Preserve script-based programmability (P2SH, script path in Taproot);
  • Enable broader wallet and tooling compatibility from day one;
  • Establish a flexible foundation for future extensions and soft-fork upgrades.

๐Ÿ”ง Technical Details

  1. Output Type Specification

    • Supported outputs:

      • P2PK: OP_DATA_32 <32-byte-pubkey> OP_CHECKSIG
      • P2SH: OP_BLAKE3 <32-byte-script-hash> OP_EQUAL
      • Multisig scripts: OP_M <pubkey1> <pubkey2> ... <pubkeyN> OP_N OP_CHECKMULTISIG (implemented via P2SH)
      • Taproot (P2TR): OP_1 <32-byte-x-only-pubkey> (both key path & script path)

    • Kaspa Architecture Notes:

      • Kaspa uses a ScriptPublicKey structure: {version: u16, script: Vec<u8>}
      • Kaspa does not implement Bitcoin's SegWit/BIP-141 (no witness programs)
      • Kaspa does not support P2PKH or P2WPKH (Bitcoin-specific formats)
      • Address versions: PubKey(0), PubKeyECDSA(1), ScriptHash(8), Taproot(88)

    • Script examples:

      # Taproot key path
scriptPubKey = OP_1 || <32-byte x-only pubkey>

# Taproot script path (internal structure)
taproot_output = OP_1 || <tweaked-pubkey>
witness = [signature]  # for key path
witness = [script, control_block]  # for script path

  2. Signature and Verification

    • Legacy outputs: Validation rules remain identical to Kaspa consensus;
    • Taproot outputs:
      • Key path spend:
        • Uses BIP-340 Schnorr signatures (32-byte signatures)
        • Follows BIP-341 Taproot signature hash calculation
        • Witness format: [signature] (single 64-byte witness element)
        • Signature hash type: Default (0x00) or SIGHASH_ALL (0x01)
      • Script path spend:
        • Supports witness version 1 + control block
        • Witness format: [script, control_block] or [script, control_block, ...]
        • Control block: 33 bytes (1 byte version + 32 bytes merkle root)
        • Script execution follows Tapscript rules (BIP-342)
    • Hash algorithms:
      • Signature hash: SHA-256 (same as Kaspa)
      • Taproot tweaking: SHA-256 + tagged hash (BIP-341)
      • Merkle tree: SHA-256 for Taproot script trees

  3. Address Formats

    • Kaspa-compatible addresses: All existing Kaspa address formats remain valid and unchanged;
    • Address versions supported:
      • PubKey(0): 32-byte Schnorr public key
      • PubKeyECDSA(1): 33-byte ECDSA public key
      • ScriptHash(8): 32-byte script hash (BLAKE3)
      • Taproot(88): 32-byte x-only public key
    • Taproot addresses: Use Bech32m encoding (BIP-350) with network-specific prefixes:
      • Mainnet: tondi prefix
      • Testnet: tonditest prefix
      • Simnet: tondisim prefix
      • Devnet: tondidev prefix
    • Address structure: {prefix}:{data}{checksum}
    • Taproot address format: tondi:{32-byte-taproot-pubkey}{6-byte-checksum}
    • Example: tondi:trazle76u3gwal94drp4qlvlh9vkjddh7mjpv2hhe422xzjsrs8tvca30pn
    • Length: 59 characters total (5 prefix + 1 colon + 53 data/checksum)
    • Version byte: Taproot addresses use version byte 88 (0x58)

  4. Script Support

    • Script Path in Taproot: Fully enabled with Tapscript execution rules;
    • Existing script-based contracts: P2SH, multisig continue to function unchanged;
    • OP code restrictions: No additional restrictions beyond Kaspa's baseline consensus rules;
    • Tapscript features: Supports all standard Bitcoin script opcodes plus Taproot-specific features.

  5. Bitcoin Taproot OP_SUCCESS Compatibility

    • OP_SUCCESS Opcodes: Tondi implements Bitcoin Taproot's OP_SUCCESS opcodes (BIP-342) for enhanced compatibility:
      • OpSuccess (0x50): Converted from OpReserved, enables BTC OP_SUCCESS behavior
      • OpSuccess1 (0x89): Converted from OpReserved1, enables BTC OP_SUCCESS1 behavior
      • OpSuccess2 (0x8a): Converted from OpReserved2, enables BTC OP_SUCCESS2 behavior
      • Complete OP_SUCCESS Range: Bitcoin Taproot defines multiple OP_SUCCESS ranges:
        • 0x50, 0x62, 0x7e-0x81, 0x83-0x86, 0x89-0x8a, 0x8d-0x8e, 0x95-0x99, 0xbb-0xfe
        • All these opcodes cause immediate script success in Tapscript context
    • Behavior Changes:
      • Previous: These opcodes returned TxScriptError::OpcodeReserved (BAD_OPCODE)
      • Current: These opcodes now return Ok(()) (success) enabling script execution
      • Test Data: Updated to expect OK results instead of BAD_OPCODE for success opcodes
    • Backward Compatibility:
      • Alias Support: RESERVED keywords still parse as aliases for existing scripts
      • Script Execution: Maintains compatibility with existing script execution patterns
      • WASM Bindings: Updated to reflect new opcode names while maintaining API compatibility
    • Bitcoin Compatibility Benefits:
      • Taproot Scripts: Enables execution of Bitcoin Taproot scripts with OP_SUCCESS opcodes
      • Cross-Chain Tools: Allows Bitcoin tooling to work with Tondi Taproot outputs
      • Future-Proofing: Supports Bitcoin's soft fork mechanism for new opcodes
    • Implementation Details:
      • Opcode Mapping: Direct 1:1 mapping with Bitcoin's OP_SUCCESS opcodes
      • Execution Context: Works in both Tapscript and standard script contexts
      • Error Handling: Graceful fallback for unupgraded nodes

  6. Cryptographic Specifications

    • Elliptic Curve: secp256k1 (same as Bitcoin and Kaspa)
    • Hash Functions:
      • SHA-256: Primary hash function for signatures and merkle trees
      • BLAKE3: Used for P2SH script hashing (Kaspa compatibility)
      • Tagged Hash: SHA-256 with domain separation for Taproot tweaking
    • Signature Schemes:
      • ECDSA: For legacy outputs (P2PK, P2SH)
      • Schnorr: For Taproot outputs (BIP-340)
    • Key Formats:
      • Legacy: 33-byte compressed public keys
      • Taproot: 32-byte x-only public keys (BIP-341)
    • Witness Structure (Kaspa Context):
      • Legacy: No witness data (Kaspa does not implement SegWit)
      • Taproot Key Path: [signature] (64 bytes)
      • Taproot Script Path: [script, control_block, ...]
      • Note: Kaspa does not support Bitcoin-style witness programs (P2WPKH, P2WSH)

  7. OP_SUCCESSx Soft Fork Mechanism

    • Two Types of OP_SUCCESS Support:
      • Bitcoin Taproot OP_SUCCESS: 0x50, 0x89, 0x8a - For Bitcoin Taproot compatibility
      • Tondi Native Soft Fork Opcodes: 0xB2-0xBF (14 opcodes) - For Tondi-specific features
    • Opcode Ranges:
      • 0xB2-0xBF (14 opcodes) - Currently undefined, reserved for Tondi-specific soft fork activation
      • Additional ranges may be defined in future TSP proposals
    • Behavior: In Tapscript context, these opcodes always succeed (unconditional success), enabling soft fork compatibility.
    • Bitcoin Compatibility: This design mirrors Bitcoin's OP_SUCCESSx mechanism (BIP-342), reducing education and migration costs.
    • Future Extensions: Reserved for advanced features including:
      • Covenant primitives (CTV, Vault)
      • Channel factories and payment channels
      • Zero-knowledge proof integration
      • Cross-input signature aggregation
      • MuSig2 multi-signature support (TSP-0011)
    • Implementation: Specific opcode assignments will be determined in individual TSP proposals (e.g., TSP-0007, TSP-0008, TSP-0009, TSP-0012).
    • Soft Fork Safety: Unupgraded nodes treat OP_SUCCESSx as unconditional success, while upgraded nodes enforce new validation rules.

  8. Implementation Details

    • Script Public Key Versions:

      • Version 0: Standard script (P2PK, P2PKH, P2SH, P2WPKH, Multisig)
      • Version 1: Taproot (P2TR) outputs

    • Address Encoding Parameters:

      • Bech32m constants:
        • Generator: [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3]
        • Separator: : (colon)
        • Character set: qpzry9x8gf2tvdw0s3jn54khce6mua7l

    • Taproot Construction:

      # Internal key tweaking
tweaked_key = internal_key + hash_taproot_output_key(internal_key, merkle_root)

# Script tree merkle root
merkle_root = merkle_tree_root(script_leaves)

# Control block structure
control_block = version_byte || internal_key || merkle_proof

    • Signature Hash Calculation:

      # Taproot signature hash (BIP-341)
sig_hash = tagged_hash("TapSighash", 
                      sig_hash_type || 
                      epoch || 
                      prevouts_hash || 
                      amounts_hash || 
                      script_pubkeys_hash || 
                      utxos_hash || 
                      tx_hash)

  9. Implementation Status

    • Tondi Client Implementation: 100% complete for all Kaspa-supported payment types
    • Supported Payment Types:
      • โœ… P2PK: OP_DATA_32 <32-byte-pubkey> OP_CHECKSIG - Fully implemented
      • โœ… P2SH: OP_BLAKE3 <32-byte-script-hash> OP_EQUAL - Fully implemented
      • โœ… Multisig: Implemented via P2SH - Fully implemented
      • โœ… Taproot P2TR: OP_1 <32-byte-x-only-pubkey> - Fully implemented
    • Bitcoin Taproot OP_SUCCESS Compatibility:
      • โœ… OpSuccess (0x50): Converted from OpReserved - Fully implemented
      • โœ… OpSuccess1 (0x89): Converted from OpReserved1 - Fully implemented
      • โœ… OpSuccess2 (0x8a): Converted from OpReserved2 - Fully implemented
      • ๐Ÿ”„ Additional OP_SUCCESS Ranges: 0x62, 0x7e-0x81, 0x83-0x86, 0x8d-0x8e, 0x95-0x99, 0xbb-0xfe - Reserved for future implementation
      • โœ… Behavior Update: Opcodes now return Ok(()) instead of BAD_OPCODE - Fully implemented
      • โœ… Backward Compatibility: RESERVED aliases maintained - Fully implemented
      • โœ… WASM Bindings: Updated for new opcode names - Fully implemented
      • โœ… Test Data: Updated to expect OK results - Fully implemented
    • Not Applicable (Kaspa Architecture):
      • โŒ P2PKH: Not supported in Kaspa (Bitcoin-specific format)
      • โŒ P2WPKH: Not supported in Kaspa (requires SegWit/BIP-141)
    • Address System: All 4 Kaspa address versions fully supported
    • Script Engine: Complete Kaspa-compatible script execution with Bitcoin Taproot compatibility
    • Cryptography: Full BIP-340/341/342 compliance for Taproot
    • Soft Fork Ranges:
      • โœ… Bitcoin Taproot OP_SUCCESS: 0x50, 0x89, 0x8a - Fully implemented
      • ๐Ÿ”„ General Soft Fork Opcodes: 0xB2-0xBF (14 opcodes) - Reserved for future Tondi-specific features
      • ๐Ÿ“‹ Allocated Opcodes:
        • 0xB2-0xB4: TSP-0007 (ANYPREVOUT)
        • 0xB5-0xB7: TSP-0008 (CISA)
        • 0xB8: TSP-0009 (CheckTemplateVerify)
        • 0xB9: TSP-0012 (Channel Factories)
        • 0xBA-0xBD: TSP-0011 (MuSig2) - Pre-allocated
        • 0xBE-0xBF: Available for future TSPs

โš ๏ธ Backward Compatibility & Security

  • All Kaspa transaction types remain valid, ensuring smooth migration of tooling and wallets;
  • Taproot integration is additive, not disruptive;
  • Schnorr signatures (BIP-340) provide stronger privacy and batch-verification performance;
  • By retaining Script Path, developers can build advanced contracts natively without protocol redesign.

๐Ÿ“ Additional Notes

Upon approval of this proposal:

  • Tondi nodes must validate both Kaspa-compatible and Taproot outputs;
  • Subsequent proposals (e.g., TSP-0002, TSP-0003) will assume this hybrid compatibility model as the baseline;
  • Developers are encouraged to prefer Taproot for new applications, but legacy scripts remain supported indefinitely.

If there are no objections, this proposal shall be included as part of the Tondi Genesis Protocol, numbered TSP-0001.