<p>It looks like your outpoints are serialized incorrectly. Txids are always displayed in reverse byte order, so when serializing them, they need to be in the reverse order of what everything displays them as.</p>

CC BY-SA 4.0
2023-05-21T15:35:17.053Z
2023-05-21T15:35:17.053Z
Ava Chow
<p>I wrote a program that verifies signatures for Taproot transactions using the <a href="https://github.com/bitcoin-core/secp256k1" rel="noreferrer">secp256k1</a> library. My program works perfectly for <code>SIGHASH_ALL</code>, <code>SIGHASH_NONE</code> and <code>SIGHASH_SINGLE</code>. But in February, we saw the beginning of a huge wave of Taproot transactions using 0x83 as the SIGHASH byte. I also know of one Taproot transaction that uses SIGHASH byte 0x81. My program fails on transactions that include the <code>SIGHASH_ANYONECANPAY</code> bit and I can't figure out why. These are all keypath spent transactions, which should be relatively simple to verify.</p>
<p>The problem must be that I am not producing the same message that was signed for these SIGHASH types, but I can't find where the error is. I am using the <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#user-content-Taproot_key_path_spending_signature_validation" rel="noreferrer">Signature validation rules</a> section of <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki" rel="noreferrer">BIP341</a> to determine which parts of the transaction to include.</p>
<p>The transaction that uses SIGHASH byte 0x81 is <a href="https://blockstream.info/tx/c0b767665e68916510126d704c1e96903275ed9e8c97e6782568cd23a4e8ef09?expand" rel="noreferrer">c0b767665e68916510126d704c1e96903275ed9e8c97e6782568cd23a4e8ef09</a>, input 0. My program produces a message of 126 bytes as follows:</p>
<pre><code>    Zero byte: 00
      Sighash: 81
   Tx Version: 02000000
  Tx Locktime: 00000000
 Outputs Hash: d32241d6cf9637a786922b700fc5c34385dc2a738d84734cae914b39ef595cfe
   Spend Type: 00
     Outpoint: 7eac3298e596858e44bdf23a06409133bf5eb5b886dda2891de452b991a7489400000000
       Amount: 3954000000000000
Output Script: 225120fd784aba5e91d18306ba722f3af50ecdaf056caf19a3632a39b1b64a2109ecf6
     Sequence: ffffffff
</code></pre>
<p>The outputs hash is a single SHA256 of the following bytes:</p>
<pre><code>Output 0 Amount: e803000000000000
Output 0 Script: 225120fd784aba5e91d18306ba722f3af50ecdaf056caf19a3632a39b1b64a2109ecf6
Output 1 Amount: 3d46000000000000
Output 1 Script: 225120fd784aba5e91d18306ba722f3af50ecdaf056caf19a3632a39b1b64a2109ecf6
</code></pre>
<p>A transaction that uses SIGHASH byte 0x83 is <a href="https://blockstream.info/tx/2e46f5b63deb421dee85cfea240a74b99d14b3286c195189f223f6260ea13943?expand" rel="noreferrer">2e46f5b63deb421dee85cfea240a74b99d14b3286c195189f223f6260ea13943</a>, input 1. My program produces a message of 126 bytes as follows:</p>
<pre><code>    Zero byte: 00
      Sighash: 83
   Tx Version: 02000000
  Tx Locktime: 00000000
   Spend Type: 00
     Outpoint: 19ad63e54efbd351f94496789035483cd4c6962c9d63fe83dc9babcead677f4b00000000
       Amount: 1027000000000000
Output Script: 2251208102001190c6aad9a015dff1540dc9a7bda31613b8ab05a58268c4bff53fae82
     Sequence: ffffffff
  Output Hash: a29ce7981f103591964c176f85cb171e098c4d86d31ec711b2a91c0d59134adf
</code></pre>
<p>The output hash is a single SHA256 of the following bytes:</p>
<pre><code>Output 1 Amount: 1027000000000000
Output 1 Script: 2251208102001190c6aad9a015dff1540dc9a7bda31613b8ab05a58268c4bff53fae82
</code></pre>
<p>Everything else is working fine. I'm using the <code>TapSighash</code> tag and everything else correctly, otherwise none of the other transactions would verify either. The problem is only happening for <code>SIGHASH_ANYONECANPAY</code> types. What am I missing?</p>

<taproot><secp256k1><sighash><sighash-flags>
Can't verify Taproot signatures that use SIGHASH_ANYONECANPAY
Zephyrus
# Can't verify Taproot signatures that use SIGHASH_ANYONECANPAY

(Asked by: username_0 on 2023-05-21)

I wrote a program that verifies signatures for Taproot transactions using the [secp256k1](https://github.com/bitcoin-core/secp256k1) library. My program works perfectly for `SIGHASH_ALL`, `SIGHASH_NONE` and `SIGHASH_SINGLE`. But in February, we saw the beginning of a huge wave of Taproot transactions using 0x83 as the SIGHASH byte. I also know of one Taproot transaction that uses SIGHASH byte 0x81. My program fails on transactions that include the `SIGHASH_ANYONECANPAY` bit and I can't figure out why. These are all keypath spent transactions, which should be relatively simple to verify.

The problem must be that I am not producing the same message that was signed for these SIGHASH types, but I can't find where the error is. I am using the [Signature validation rules](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#user-content-Taproot_key_path_spending_signature_validation) section of [BIP341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki) to determine which parts of the transaction to include.

The transaction that uses SIGHASH byte 0x81 is [c0b767665e68916510126d704c1e96903275ed9e8c97e6782568cd23a4e8ef09](https://blockstream.info/tx/c0b767665e68916510126d704c1e96903275ed9e8c97e6782568cd23a4e8ef09?expand), input 0. My program produces a message of 126 bytes as follows:

```
    Zero byte: 00
      Sighash: 81
   Tx Version: 02000000
  Tx Locktime: 00000000
 Outputs Hash: d32241d6cf9637a786922b700fc5c34385dc2a738d84734cae914b39ef595cfe
   Spend Type: 00
     Outpoint: 7eac3298e596858e44bdf23a06409133bf5eb5b886dda2891de452b991a7489400000000
       Amount: 3954000000000000
Output Script: 225120fd784aba5e91d18306ba722f3af50ecdaf056caf19a3632a39b1b64a2109ecf6
     Sequence: ffffffff

```

The outputs hash is a single SHA256 of the following bytes:

```
Output 0 Amount: e803000000000000
Output 0 Script: 225120fd784aba5e91d18306ba722f3af50ecdaf056caf19a3632a39b1b64a2109ecf6
Output 1 Amount: 3d46000000000000
Output 1 Script: 225120fd784aba5e91d18306ba722f3af50ecdaf056caf19a3632a39b1b64a2109ecf6

```

A transaction that uses SIGHASH byte 0x83 is [2e46f5b63deb421dee85cfea240a74b99d14b3286c195189f223f6260ea13943](https://blockstream.info/tx/2e46f5b63deb421dee85cfea240a74b99d14b3286c195189f223f6260ea13943?expand), input 1. My program produces a message of 126 bytes as follows:

```
    Zero byte: 00
      Sighash: 83
   Tx Version: 02000000
  Tx Locktime: 00000000
   Spend Type: 00
     Outpoint: 19ad63e54efbd351f94496789035483cd4c6962c9d63fe83dc9babcead677f4b00000000
       Amount: 1027000000000000
Output Script: 2251208102001190c6aad9a015dff1540dc9a7bda31613b8ab05a58268c4bff53fae82
     Sequence: ffffffff
  Output Hash: a29ce7981f103591964c176f85cb171e098c4d86d31ec711b2a91c0d59134adf

```

The output hash is a single SHA256 of the following bytes:

```
Output 1 Amount: 1027000000000000
Output 1 Script: 2251208102001190c6aad9a015dff1540dc9a7bda31613b8ab05a58268c4bff53fae82

```

Everything else is working fine. I'm using the `TapSighash` tag and everything else correctly, otherwise none of the other transactions would verify either. The problem is only happening for `SIGHASH_ANYONECANPAY` types. What am I missing?

**Tags:** taproot, secp256k1, sighash, sighash-flags


---

## 1 answers

### Answer by username_1 on 2023-05-21. Score: 5 | Accepted answer

It looks like your outpoints are serialized incorrectly. Txids are always displayed in reverse byte order, so when serializing them, they need to be in the reverse order of what everything displays them as.


---

