<blockquote>
<p>Does that mean there's no way to spend it? I.e. there's no possible key or script path.</p>
</blockquote>
<p>Correct.</p>
<p>It cannot be spent as a key path, because that would require a valid signature for the output point interpreted as a public key (which will fail even before getting to the signature validation part).</p>
<p>And it cannot be spent through a script path, because that requires providing an internal key which, when tweaked, yields the output point. Since the output point is not on the curve in this situation, the result of the tweaking can never be equal to it.</p>

CC BY-SA 4.0
2024-08-19T14:52:32.020Z
Indeed it's a witness _program_. I meant to point out that people interpret this program as an x-only public key, but that's not always the case. I edited the question to add the word "program".
Sjors Provoost
CC BY-SA 4.0
2024-08-19T15:04:31.920Z
Right; most script-related consensus rules only care about outputs at spending time. E.g. bare scriptPubKey keys can contain unknown opcodes, be too large, contain unbalanced OP_IF OP_ENDIFs, contain pushes that straddle the script boundary... all of these rules only apply when the output is attempted to be spent. At creation time, they're just byte arrays.
Pieter Wuille
CC BY-SA 4.0
2024-08-19T14:12:27.640Z
2024-08-19T15:05:51.083Z
2024-08-19T15:05:51.083Z
Pieter Wuille
<p>The first output of <a href="https://mempool.space/tx/f33ead0ef49900a782b83eede071f9b5f12142d2a403092452fd6ecf99f153c8" rel="nofollow noreferrer">f33ead0ef49900a782b83eede071f9b5f12142d2a403092452fd6ecf99f153c8</a> can't be parsed with <code>secp256k1_xonly_pubkey_parse</code>. [0]</p>
<p>Does that mean there's no way to spend it? I.e. there's no possible key or script path.</p>
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#script-validation-rules" rel="nofollow noreferrer">BIP341</a> says:</p>
<blockquote>
<p>A Taproot output is a native SegWit output (see BIP141) with version number 1, and a 32-byte witness program.</p>
</blockquote>
<p>Typically this witness <em>program</em> is a public key, sometimes a NUMS point with no corresponding private key. But it seems it can also be a coordinate off the curve, e.g. x &gt; 2^256 - 232 - 29 - 28 - 27 - 26 - 24 - 1.</p>
<p>[0] as discovered here: <a href="https://github.com/josibake/bitcoin/discussions/4#discussioncomment-10348541" rel="nofollow noreferrer">https://github.com/josibake/bitcoin/discussions/4#discussioncomment-10348541</a></p>

<consensus><p2tr>
Is a Taproot output with unparseable x-only pubkey unspendable?
Sjors Provoost
# Is a Taproot output with unparseable x-only pubkey unspendable?

(Asked by: username_0 on 2024-08-19)

The first output of [f33ead0ef49900a782b83eede071f9b5f12142d2a403092452fd6ecf99f153c8](https://mempool.space/tx/f33ead0ef49900a782b83eede071f9b5f12142d2a403092452fd6ecf99f153c8) can't be parsed with `secp256k1_xonly_pubkey_parse`. [0]

Does that mean there's no way to spend it? I.e. there's no possible key or script path.

[BIP341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#script-validation-rules) says:

> A Taproot output is a native SegWit output (see BIP141) with version number 1, and a 32-byte witness program.

Typically this witness *program* is a public key, sometimes a NUMS point with no corresponding private key. But it seems it can also be a coordinate off the curve, e.g. x > 2^256 - 232 - 29 - 28 - 27 - 26 - 24 - 1.

[0] as discovered here: <https://github.com/josibake/bitcoin/discussions/4#discussioncomment-10348541>

**Tags:** consensus, p2tr


---

## 1 answers

### Answer by username_1 on 2024-08-19. Score: 3 | Accepted answer

> Does that mean there's no way to spend it? I.e. there's no possible key or script path.

Correct.

It cannot be spent as a key path, because that would require a valid signature for the output point interpreted as a public key (which will fail even before getting to the signature validation part).

And it cannot be spent through a script path, because that requires providing an internal key which, when tweaked, yields the output point. Since the output point is not on the curve in this situation, the result of the tweaking can never be equal to it.

> **Comments:**
> **username_0**: Indeed it's a witness _program_. I meant to point out that people interpret this program as an x-only public key, but that's not always the case. I edited the question to add the word "program".  
> **username_1**: Right; most script-related consensus rules only care about outputs at spending time. E.g. bare scriptPubKey keys can contain unknown opcodes, be too large, contain unbalanced OP_IF OP_ENDIFs, contain pushes that straddle the script boundary... all of these rules only apply when the output is attempted to be spent. At creation time, they're just byte arrays.  

---

