<ol>
<li><p>By the definition in BIP341, the leaf version is the first byte of the control block, after masking out its bottom bit. It is certainly not the entire first byte.</p>
</li>
<li><p>Yes, exactly.</p>
</li>
<li><p>Currently only one leaf version is defined, namely 0xc0, in BIP342. Using any other leaf version is non-standard, and has no associated semantics (meaning that any spend of it is valid, as long as it's properly revealed as described in BIP341). Thus wallets absolutely shouldn't use any other leaf versions (until more are defined, and their consensus rules deployed).</p>
</li>
<li>
<ul>
<li>The leaf version <strong>can</strong> be any even byte value, except 0x50 (because that would make it conflict with the annex). So it's not illegal for wallets to construct transactions that use any leaf version but 0x50 (but see the previous point why they shouldn't).</li>
<li>It is <strong>advisable</strong> for future consensus changes to Bitcoin to pick leaf versions from that list in BIP341, because that permits certain kinds of contextless analysis: the ability to recognize what leaf version a transaction input uses without knowing the output. This ability may or may not turn out to be useful, but because adding leaf versions is probably very rare, it's unlikely to be burdensome to stick to this list. This is a suggestion for future protocol changes, but has no bearing on wallet software (before such changes happen).</li>
</ul>
</li>
</ol>

CC BY-SA 4.0
2023-11-17T03:08:57.303Z
1) So **the leaf version** actually, as you said, represents just the top 7 bits of the first byte within control block since the content of that byte is masked with the `11111110` and by that the first (bottom) bit is not important. 3) Does it mean that we can make some script with the leaf version of, for example, `0xc4`, create MAST with such a script and thereby make one of the paths of the three (MAST) as `anyone-can-spend`?
LeaBit
CC BY-SA 4.0
2023-11-17T12:27:20.310Z
Right, if someone were to reveal the script path with leaf 0xc4, then the script and script inputs don't matter.
Pieter Wuille
CC BY-SA 4.0
2023-11-17T17:09:04.317Z
You also mentioned that the other leaf versions are "**not-standard**". Do you, by saying "**non-standard**", refer to the rules for "relaying" transactions or in this case "**non-standard**" has some other context? So transactions with leaf version other than 0xc0 (or sometimes 0xc1 if you look at the entire first byte within control block) won't be relayed, but will be consensus acceptable?
LeaBit
CC BY-SA 4.0
2023-11-17T17:30:35.213Z
That's correct. BIP341 only controls the consensus rules, and according to those, any leaf version is fine. By the standard relay policy implemented in Bitcoin Core today, only leaf version 0xc0 is relayed.
Pieter Wuille
CC BY-SA 4.0
2023-11-17T02:55:28.077Z
2023-11-17T02:55:28.077Z
Pieter Wuille
<p>I asked a few questions within this one. They are all related to the <em><strong>leaf version</strong></em>, so I didn't find it necessary to split them into multiple separate questions as they can all be answered in 1/2 a sentence (at least I assume).</p>
<p>Thanks to all in advance.</p>
<ol>
<li>What is <em><strong>leaf version</strong></em>?
<ul>
<li>In <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki" rel="nofollow noreferrer">BIP341</a> they say that leaf represents a logical AND between the first byte of the control block and <code>0xfe</code>.
<ul>
<li>I quote: &quot;<em>Let v = c[0] &amp; 0xfe and call it the leaf version</em>&quot;</li>
</ul>
</li>
<li><em>Pieter Wuille</em> said in his <a href="https://bitcoin.stackexchange.com/a/107159/143602">answer</a> that only the top 7 bits of the first byte of the control block (<code>11111110</code>) represent leaf version while the first (bottom) bit (<code>00000001</code>) of the same byte is a sign.
<ul>
<li>I quote: &quot;<em>Its first byte stores the leaf version (#3) (top 7 bits) and the sign bit (#6) (bottom bit).</em>&quot;</li>
</ul>
</li>
<li>In some answers/articles I also read that the leaf version represents entire first byte of the control block.</li>
</ul>
</li>
<li>What is the purpose of <strong>leaf version</strong>?
<ul>
<li>As I understand it, it is a way to indicate which <strong>type of script</strong> is used, i.e. that some special opcodes can be found within that script or that the existing ones have a different meaning, or that the content of that script has some totally new special meaning. Therefore, each leaf (script), has its version that defines the way in which we observe its content (something similar to the witness version in segWit). So, when we use a script from MAST, we must also specify its version in order to know how its content is treated (but also to correctly calculate the complete tree). Am I right?</li>
</ul>
</li>
<li>What is the <strong>leaf version</strong> value for using the normal (standard) Bitcoin scripts if its even possible to use them inside taproot? (with normal script I mean on scripts used in non-segwit outputs or in P2SH etc.)</li>
<li>What are the all possible values for the <strong>leaf version</strong>?
<ul>
<li><a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#cite_note-7" rel="nofollow noreferrer">BIP341[7]</a> and <a href="https://bitcoin.stackexchange.com/a/114829/143602">Pieter Wuille</a> gave some answers, but I still do not understand. I understand why it cannot be 0x50 (so as not to be confused with the annex) and why it can be only even value (because logical AND is done with 11111110), but it is not clear to me why there must be only those values listed there in the BIP341[7]/Pieter Wuille's answer.</li>
</ul>
</li>
</ol>

<taproot>
What is the leaf version in Taproot and how is it used?
LeaBit
# What is the leaf version in Taproot and how is it used?

(Asked by: username_0 on 2023-11-17)

I asked a few questions within this one. They are all related to the ***leaf version***, so I didn't find it necessary to split them into multiple separate questions as they can all be answered in 1/2 a sentence (at least I assume).

Thanks to all in advance.

1. What is ***leaf version***?
   * In [BIP341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki) they say that leaf represents a logical AND between the first byte of the control block and `0xfe`.
     + I quote: "*Let v = c[0] & 0xfe and call it the leaf version*"
   * *username_1 username_1* said in his [answer](https://bitcoin.stackexchange.com/a/107159/143602) that only the top 7 bits of the first byte of the control block (`11111110`) represent leaf version while the first (bottom) bit (`00000001`) of the same byte is a sign.
     + I quote: "*Its first byte stores the leaf version (#3) (top 7 bits) and the sign bit (#6) (bottom bit).*"
   * In some answers/articles I also read that the leaf version represents entire first byte of the control block.
2. What is the purpose of **leaf version**?
   * As I understand it, it is a way to indicate which **type of script** is used, i.e. that some special opcodes can be found within that script or that the existing ones have a different meaning, or that the content of that script has some totally new special meaning. Therefore, each leaf (script), has its version that defines the way in which we observe its content (something similar to the witness version in segWit). So, when we use a script from MAST, we must also specify its version in order to know how its content is treated (but also to correctly calculate the complete tree). Am I right?
3. What is the **leaf version** value for using the normal (standard) Bitcoin scripts if its even possible to use them inside taproot? (with normal script I mean on scripts used in non-segwit outputs or in P2SH etc.)
4. What are the all possible values for the **leaf version**?
   * [BIP341[7]](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#cite_note-7) and [username_1 username_1](https://bitcoin.stackexchange.com/a/114829/143602) gave some answers, but I still do not understand. I understand why it cannot be 0x50 (so as not to be confused with the annex) and why it can be only even value (because logical AND is done with 11111110), but it is not clear to me why there must be only those values listed there in the BIP341[7]/username_1 username_1's answer.

**Tags:** taproot


---

## 1 answers

### Answer by username_1 on 2023-11-17. Score: 1 | Accepted answer

1. By the definition in BIP341, the leaf version is the first byte of the control block, after masking out its bottom bit. It is certainly not the entire first byte.
2. Yes, exactly.
3. Currently only one leaf version is defined, namely 0xc0, in BIP342. Using any other leaf version is non-standard, and has no associated semantics (meaning that any spend of it is valid, as long as it's properly revealed as described in BIP341). Thus wallets absolutely shouldn't use any other leaf versions (until more are defined, and their consensus rules deployed).
4. * The leaf version **can** be any even byte value, except 0x50 (because that would make it conflict with the annex). So it's not illegal for wallets to construct transactions that use any leaf version but 0x50 (but see the previous point why they shouldn't).
   * It is **advisable** for future consensus changes to Bitcoin to pick leaf versions from that list in BIP341, because that permits certain kinds of contextless analysis: the ability to recognize what leaf version a transaction input uses without knowing the output. This ability may or may not turn out to be useful, but because adding leaf versions is probably very rare, it's unlikely to be burdensome to stick to this list. This is a suggestion for future protocol changes, but has no bearing on wallet software (before such changes happen).

> **Comments:**
> **username_0**: 1) So **the leaf version** actually, as you said, represents just the top 7 bits of the first byte within control block since the content of that byte is masked with the `11111110` and by that the first (bottom) bit is not important. 3) Does it mean that we can make some script with the leaf version of, for example, `0xc4`, create MAST with such a script and thereby make one of the paths of the three (MAST) as `anyone-can-spend`?  
> **username_1**: Right, if someone were to reveal the script path with leaf 0xc4, then the script and script inputs don't matter.  
> **username_0**: You also mentioned that the other leaf versions are "**not-standard**". Do you, by saying "**non-standard**", refer to the rules for "relaying" transactions or in this case "**non-standard**" has some other context? So transactions with leaf version other than 0xc0 (or sometimes 0xc1 if you look at the entire first byte within control block) won't be relayed, but will be consensus acceptable?  
> **username_1**: That's correct. BIP341 only controls the consensus rules, and according to those, any leaf version is fine. By the standard relay policy implemented in Bitcoin Core today, only leaf version 0xc0 is relayed.  

---

