<p>Your transaction is a key path spend, not a script path spend (it only has one witness item, the signature). Perhaps you've calculated the sighash for a script path spend but then only included the signature in the witness stack, you also need to include the script and the control block.</p>

CC BY-SA 4.0
2023-11-15T12:32:48.397Z
2023-11-15T12:32:48.397Z
Vojtěch Strnad
<p>I'm building a Bitcoin wallet, and I'm trying to spend a Taproot output via a script spend path, but I keep running into this &quot;Invalid Schnorr signature&quot; error from my RPC node:</p>
<pre><code>{
    &quot;result&quot;: null,
    &quot;error&quot;: {
        &quot;code&quot;: -26,
        &quot;message&quot;: &quot;non-mandatory-script-verify-flag (Invalid Schnorr signature)&quot;
    },
    &quot;id&quot;: null
}
</code></pre>
<p>The Taproot script I'm trying to spend is fairly straight-forward. It looks something like:</p>
<pre><code>OP_PUSHBYTES_32 f24c112b21c9712042a0ba081261b2f447ac8e927230665417d0929a243e8fda
OP_CHECKSIG
OP_0
OP_IF
OP_PUSHBYTES_3 ...
OP_PUSHBYTES_1 ...
OP_PUSHBYTES_24 ...
OP_0
OP_PUSHBYTES_54 ...
OP_ENDIF
</code></pre>
<p>I've triple checked that the private key I'm using to sign with is associated with the public key <code>f24c112b21c9712042a0ba081261b2f447ac8e927230665417d0929a243e8fda</code>. I've also looked at <a href="https://github.com/bitcoin/bitcoin/blob/830583eb9d07e054c54a177907a98153ab3e29ae/src/script/interpreter.cpp#L1696" rel="nofollow noreferrer">Bitcoin Core</a> and see that its failing the Schnorr verification, but the Schnorr verification passes locally. (I use <a href="https://github.com/paulmillr/scure-btc-signer" rel="nofollow noreferrer">scure/btc-signer</a> for signing).</p>
<p>I'm not sure what additional information I can provide that would help debug. I can provide the commit tx id that creates the script spend output:</p>
<pre><code>f3bab70b18ed3bef960d7df2a7b35839077c764c8d7791ffa8f8ec6c06d28102
</code></pre>
<p>whose transaction hex looks like:</p>
<pre><code>020000000001012a1187fd23fa30932ec9dba59ec0e8d9032c6820d4bd20c860eb1c5c4c0545fc0100000000fdffffff0274670000000000002251201b09ce3a37ee16dbcb0a8dbf262a362996254af51d69a47379de9f3548d719a9bb030100000000002251208dace6f04076ca1ea4eb168dcdad6ad61f695ca1c16a3df6b9586cdca1c71db80140c16f410d7f98dc3ba17991ce61e5329350ae98e68dd8d3994afb6e44076e5c6c28185fd1934a0ff2d345dc755fb27aaa6a4b55381d29482b910941e46cb1a9dc00000000
</code></pre>
<p>And the reveal transaction hex that I'm trying to broadcast that is rejected with the &quot;Invalid Schnorr signature&quot; looks like:</p>
<pre><code>02000000000102927d72fed0a50c351f0cd7c0d3a35714835ca6f133b8a4b311f9eb830d418f0a0100000000fdffffff65fb61cb2ecfad91c1c681b99dafcb221d6cb4fe577c8f60b67f069e9edaeebc0000000000fdffffff0274670000000000002251201c573b23ee8b7661095cad641f1f898d126794fc25cfbf61c8d9cbcaf529fd32a1a60100000000002251208dace6f04076ca1ea4eb168dcdad6ad61f695ca1c16a3df6b9586cdca1c71db80140b722450ec2fcb97dcd64f288b1b880d3a87bb72bb40563ddb3f7bad2a7267f694f2a427df52a91996c518d90848849cce6b204df71ee9c1126939ad57d35eb630140d4bbdf0a1ae79a96a90c48d34816ef29e69220faa292da04b682c7c9cc962184337cce55ea745cdc105744c0b8cfa5999551ca68623193136b247d524c615ca500000000
</code></pre>
<p>Any thoughts or help would be immensely appreciated. Thank you in advance!</p>

<script><taproot><schnorr-signatures><bitcoinjs><p2tr>
non-mandatory-script-verify-flag (Invalid Schnorr signature) when trying to reveal a TR output
Sherwin Li
# non-mandatory-script-verify-flag (Invalid Schnorr signature) when trying to reveal a TR output

(Asked by: username_0 on 2023-11-15)

I'm building a Bitcoin wallet, and I'm trying to spend a Taproot output via a script spend path, but I keep running into this "Invalid Schnorr signature" error from my RPC node:

```
{
    "result": null,
    "error": {
        "code": -26,
        "message": "non-mandatory-script-verify-flag (Invalid Schnorr signature)"
    },
    "id": null
}

```

The Taproot script I'm trying to spend is fairly straight-forward. It looks something like:

```
OP_PUSHBYTES_32 f24c112b21c9712042a0ba081261b2f447ac8e927230665417d0929a243e8fda
OP_CHECKSIG
OP_0
OP_IF
OP_PUSHBYTES_3 ...
OP_PUSHBYTES_1 ...
OP_PUSHBYTES_24 ...
OP_0
OP_PUSHBYTES_54 ...
OP_ENDIF

```

I've triple checked that the private key I'm using to sign with is associated with the public key `f24c112b21c9712042a0ba081261b2f447ac8e927230665417d0929a243e8fda`. I've also looked at [Bitcoin Core](https://github.com/bitcoin/bitcoin/blob/830583eb9d07e054c54a177907a98153ab3e29ae/src/script/interpreter.cpp#L1696) and see that its failing the Schnorr verification, but the Schnorr verification passes locally. (I use [scure/btc-signer](https://github.com/paulmillr/scure-btc-signer) for signing).

I'm not sure what additional information I can provide that would help debug. I can provide the commit tx id that creates the script spend output:

```
f3bab70b18ed3bef960d7df2a7b35839077c764c8d7791ffa8f8ec6c06d28102

```

whose transaction hex looks like:

```
020000000001012a1187fd23fa30932ec9dba59ec0e8d9032c6820d4bd20c860eb1c5c4c0545fc0100000000fdffffff0274670000000000002251201b09ce3a37ee16dbcb0a8dbf262a362996254af51d69a47379de9f3548d719a9bb030100000000002251208dace6f04076ca1ea4eb168dcdad6ad61f695ca1c16a3df6b9586cdca1c71db80140c16f410d7f98dc3ba17991ce61e5329350ae98e68dd8d3994afb6e44076e5c6c28185fd1934a0ff2d345dc755fb27aaa6a4b55381d29482b910941e46cb1a9dc00000000

```

And the reveal transaction hex that I'm trying to broadcast that is rejected with the "Invalid Schnorr signature" looks like:

```
02000000000102927d72fed0a50c351f0cd7c0d3a35714835ca6f133b8a4b311f9eb830d418f0a0100000000fdffffff65fb61cb2ecfad91c1c681b99dafcb221d6cb4fe577c8f60b67f069e9edaeebc0000000000fdffffff0274670000000000002251201c573b23ee8b7661095cad641f1f898d126794fc25cfbf61c8d9cbcaf529fd32a1a60100000000002251208dace6f04076ca1ea4eb168dcdad6ad61f695ca1c16a3df6b9586cdca1c71db80140b722450ec2fcb97dcd64f288b1b880d3a87bb72bb40563ddb3f7bad2a7267f694f2a427df52a91996c518d90848849cce6b204df71ee9c1126939ad57d35eb630140d4bbdf0a1ae79a96a90c48d34816ef29e69220faa292da04b682c7c9cc962184337cce55ea745cdc105744c0b8cfa5999551ca68623193136b247d524c615ca500000000

```

Any thoughts or help would be immensely appreciated. Thank you in advance!

**Tags:** script, taproot, schnorr-signatures, bitcoinjs, p2tr


---

## 1 answers

### Answer by username_1 on 2023-11-15. Score: 3 | Accepted answer

Your transaction is a key path spend, not a script path spend (it only has one witness item, the signature). Perhaps you've calculated the sighash for a script path spend but then only included the signature in the witness stack, you also need to include the script and the control block.


---

