Control Block (Taproot)

The control block is the witness element that makes a Taproot script-path spend verifiable. When a spender reveals a script (a tapleaf), the network needs proof that this script was actually committed to in the output. The control block carries exactly that proof: the internal public key plus the Merkle path connecting the revealed leaf back to the tree root.

Byte Layout

A control block is always 33 + 32m bytes long, where m is the number of Merkle path elements (0 to 128). The first byte packs two things: its upper seven bits hold the leaf version, and its lowest bit records the parity of the output key's Y coordinate. The next 32 bytes are the Taproot internal key. Everything after that is a sequence of 32-byte sibling hashes forming the Merkle proof.

Verification

To validate, a node recomputes the TapLeaf hash from the revealed script and leaf version, then folds in each sibling hash from the control block to rebuild the Merkle root. It tweaks the internal key by that root and checks the result matches the output key, parity included. If they match, the script was genuinely part of the committed tree and may execute.

The script being proven is a tapleaf, and the control block only appears on the script branch described in key path vs script path spend. Key-path spends need no control block at all.