Taproot script-path spends can be surprisingly difficult to inspect manually.

Given a witness, reconstructing the full commitment chain — ”TapLeaf → TapBranch → TapTweak → output key → bech32m address” — requires several sequential steps. Each step has its own failure modes: tagged hash label, byte order, parity bit, lexicographic ordering. Mistakes often produce silent mismatches.

RootScope is a small tool that performs this reconstruction deterministically and exposes every intermediate value.

Given script + control_block, it computes:

There is also a fetch-witness helper that accepts a txid + vin and resolves the witness from a block explorer, prefilling the inputs for real transaction inspection.

bitcoin

> *by AaronZhang*
>
> Taproot script-path spends can be surprisingly difficult to inspect manually.
>
> Given a witness, reconstructing the full commitment chain — ”TapLeaf → TapBranch → TapTweak → output key → bech32m address” — requires several sequential steps. Each step has its own failure modes: tagged hash label, byte order, parity bit, lexicographic ordering. Mistakes often produce silent mismatches.
>
> RootScope is a small tool that performs this reconstruction deterministically and exposes every intermediate value.
>
> Given script + control_block, it computes:
> 
> - TapLeaf hash
> - each TapBranch step up the Merkle path
> - TapTweak and the tweaked output key
> - bech32m address
> - optional expected-address match check
> #
> There is also a fetch-witness helper that accepts a txid + vin and resolves the witness from a block explorer, prefilling the inputs for real transaction inspection.
>
> [**...read more at delvingbitcoin.org**](https://delvingbitcoin.org/t/rootscope-deterministic-reconstruction-of-taproot-script-path-commitments/2322)