<p>The MuSig(2) protocol produces one aggregate signature that goes onchain. Multisig requires multiple signatures to go onchain. So if you are just talking transaction size MuSig(2) will always be smaller and cheaper. There are some setup and complexity costs to MuSig(2) but they don't impact the onchain transaction fee.</p>

CC BY-SA 4.0
2023-01-17T16:53:54.280Z
2023-01-17T16:53:54.280Z
Michael Folkson
<p>I assume that you are asking about MuSig being used to aggregate the participants' public keys and an input that spends directly using the aggregate pubkey in a keypath spend. In that case, the on-chain footprint is the same as any other P2TR keypath spend.</p>
<p>A P2TR keypath spend is cheaper than any (sensible¹) P2WSH multisig input, since even a 1-of-1 P2WSH input is more expensive. If the MuSig-aggregated key is used in a scriptpath spend, it depends on the depth of the leaf in the taptree, but for 2-of-2 the depths 0, 1, and 2 would still be cheaper. The scriptleaf would only be more expensive starting at a depth 3.</p>
<p>P2TR and P2WSH outputs both weigh 172 WU (43 vB).
A <a href="https://bitcoin.stackexchange.com/q/111395/5406">P2TR keypath input</a> weighs 230 WU (57.5 vB).
A <a href="https://bitcoin.stackexchange.com/q/108283/5406">2-of-2 P2WSH</a> input weighs 384 WU (96 vB), from the top of my head, a 1-of-1 P2WSH input should weigh 277 WU (69.25 vB).</p>
<p>The only output type that has a smaller on-chain weight across the whole lifecycle is P2WPKH. A P2WPKH input weighs 272 WU (68 vB), a P2WPKH output weighs 124 WU (31 vB) for a total weight of 396 WU (99 vB). P2TR (keypath) has a total weight of 402 WU (101.5 vB).</p>
<p>You may also find my blog post <a href="https://murch.one/posts/2-of-3-using-p2tr/" rel="nofollow noreferrer">2-of-3 inputs using P2TR</a> interesting, in which I detail a few alternative constructions and compare their weights.</p>
<hr />
<p><sub>¹ 0-of-0 and 0-of-1 P2WSH inputs would be cheaper but anyone-can-spend.</sub></p>

CC BY-SA 4.0
2023-01-17T22:21:42.127Z
2023-01-18T16:17:06.647Z
2023-01-18T16:17:06.647Z
Murch
<p>Taproot transactions aren't always cheaper onchain compared to their segwit native counterparts. How does the current MuSig spec fare compared to multisig onchain? Is one always cheaper than the other with regard to the number of participants? Is there a point where the number of participants impacts the comparative price onchain?</p>

<transaction-fees><multi-signature><taproot><transaction-weight><musig>
What's cheaper, musig or multisig?
arshbot
# What's cheaper, musig or multisig?

(Asked by: username_0 on 2023-01-17)

Taproot transactions aren't always cheaper onchain compared to their segwit native counterparts. How does the current MuSig spec fare compared to multisig onchain? Is one always cheaper than the other with regard to the number of participants? Is there a point where the number of participants impacts the comparative price onchain?

**Tags:** transaction-fees, multi-signature, taproot, transaction-weight, musig


---

## 2 answers

### Answer by username_2 on 2023-01-17. Score: 5 | Accepted answer

I assume that you are asking about MuSig being used to aggregate the participants' public keys and an input that spends directly using the aggregate pubkey in a keypath spend. In that case, the on-chain footprint is the same as any other P2TR keypath spend.

A P2TR keypath spend is cheaper than any (sensible¹) P2WSH multisig input, since even a 1-of-1 P2WSH input is more expensive. If the MuSig-aggregated key is used in a scriptpath spend, it depends on the depth of the leaf in the taptree, but for 2-of-2 the depths 0, 1, and 2 would still be cheaper. The scriptleaf would only be more expensive starting at a depth 3.

P2TR and P2WSH outputs both weigh 172 WU (43 vB).
A [P2TR keypath input](https://bitcoin.stackexchange.com/q/111395/5406) weighs 230 WU (57.5 vB).
A [2-of-2 P2WSH](https://bitcoin.stackexchange.com/q/108283/5406) input weighs 384 WU (96 vB), from the top of my head, a 1-of-1 P2WSH input should weigh 277 WU (69.25 vB).

The only output type that has a smaller on-chain weight across the whole lifecycle is P2WPKH. A P2WPKH input weighs 272 WU (68 vB), a P2WPKH output weighs 124 WU (31 vB) for a total weight of 396 WU (99 vB). P2TR (keypath) has a total weight of 402 WU (101.5 vB).

You may also find my blog post [2-of-3 inputs using P2TR](https://username_2.one/posts/2-of-3-using-p2tr/) interesting, in which I detail a few alternative constructions and compare their weights.

---

¹ 0-of-0 and 0-of-1 P2WSH inputs would be cheaper but anyone-can-spend.


---

### Answer by username_1 on 2023-01-17. Score: 2

The MuSig(2) protocol produces one aggregate signature that goes onchain. Multisig requires multiple signatures to go onchain. So if you are just talking transaction size MuSig(2) will always be smaller and cheaper. There are some setup and complexity costs to MuSig(2) but they don't impact the onchain transaction fee.


---

