Tapleaf

A tapleaf is one leaf of the Merkle tree that Taproot commits to alongside its internal public key. Each tapleaf bundles a leaf version byte with a complete Bitcoin script, and the pair is hashed into a tagged TapLeaf hash. Every alternative spending condition a Taproot output supports is encoded as its own tapleaf, and only the leaf actually used has to be revealed on-chain when the output is spent.

Structure and Leaf Version

The TapLeaf hash is computed over the leaf version, a compact-size length prefix, and the script bytes. The standard leaf version is 0xc0, which selects the Tapscript validation rules defined in BIP342. Leaf versions must be even (the lowest bit is reserved for Y-coordinate parity in the control block) and cannot be 0x50, the value reserved for the annex. This reserved structure leaves room for future script versions to be added by soft fork without breaking existing leaves.

Role in the Tree

Individual tapleaves are hashed pairwise up the tree to a single Merkle root, which is then tweaked into the output key. Because only the executed leaf and its Merkle path are disclosed, unused conditions stay private and the on-chain footprint stays small no matter how many leaves the tree holds.

To spend a tapleaf, a spender supplies the script and a control block (Taproot) proving the leaf belongs to the committed tree. This is the script-path side of the choice described in key path vs script path spend.