Simple Taproot Channels

Replaces the legacy 2-of-2 P2WSH funding output with a P2TR + MuSig2 aggregated key. Cooperative spends (the common case) are indistinguishable from single-sig outputs on chain.

Status: the extension BOLT bolt-simple-taproot.md was merged into lightning/bolts on 2026-05-04 (PR #995), so the scripts and feature bits are final. Taproot channels still cannot be announced on the public network — that needs the separate taproot gossip extension (lightning/bolts#1059), still an open draft as of September 2026 — so every taproot channel today is a private (unannounced) one.

Funding output

Pre-taproot:

P2WSH(MULTI 2 <pk1> <pk2> 2 CHECKMULTISIG)

Taproot channel:

P2TR(MuSig2(pk1, pk2))

Both parties run MuSig2 KeyAgg → single 32-byte x-only pubkey, which is the Taproot output key (potentially with empty taptree, or with emergency-script leaf).

Commitment tx

Outputs:

• to_local — Tapscript with revocation + delay.
• to_remote — simple P2TR(remote_static_pubkey) — looks like single-sig!
• to_local_anchor / to_remote_anchor — small-value Taproot.
• HTLC outputs — Tapscript leaves with hash/timeout/revocation paths.

Cooperative close

Cooperative close in taproot channels:

• Both parties sign a single Schnorr sig over the new tx (via MuSig2 on the funding output).
• Result: tx with single 64-byte witness — looks like ordinary Taproot single-sig.
• On-chain analysis cannot distinguish from a regular wallet spend.
• Under RBF cooperative close, each fee-bump round needs fresh nonces: the spec uses a JIT (just-in-time) nonce pattern, bundling the closer's nonce with its signature in closing_complete and rotating the closee's nonce in closing_sig per iteration.

Privacy gain

Force-close with Tapscript reveals the script branch used; the other branches stay private.

HTLC scripts in Tapscript

HTLC offered (Tapscript leaf):

<remote_htlc_pk> CHECKSIG
  <local_htlc_pk> CHECKSIGADD 2 NUMEQUAL  ; 2-of-2
  HASH160 <RIPEMD160(payment_hash)> EQUALVERIFY CHECKSIG

Simpler than legacy because:

• No P2WSH wrapper.
• Schnorr 64-byte sigs vs DER 71-byte.
• OP_CHECKSIGADD cleaner than OP_CHECKMULTISIG.

Funding key generation

Each party generates:

• funding_pubkey (will be aggregated via MuSig2).
• revocation_basepoint, delayed_payment_basepoint, htlc_basepoint, payment_basepoint (per-commitment-derivation basepoints).

MuSig2 KeyAgg of funding_pubkey_local + funding_pubkey_remote → funding output key.

Implementation challenges

• Nonce management: MuSig2 requires careful nonce state across signing rounds. Channel updates need MuSig2 sessions for the funding output spend.
• Hardware wallet support: lags. Most HW wallets don't support MuSig2 yet (Coldcard Mk4 has experimental).
• Splicing + taproot: splice tx needs both MuSig2 cooperative spend + new output construction; protocol coordination is more complex than legacy.

Compatibility

option_simple_taproot (bits 80/81) negotiated in init. The bits are defined in the extension BOLT bolt-simple-taproot.md, not in BOLT 9; option_simple_taproot_staging (180/181, the +100 staging pair) is the pre-finalization variant older deployments still speak. If only one side supports, channel falls back to legacy.

The feature bit is also a defined channel type. The spec says it SHOULD only be used with explicit channel negotiation — it cannot be an interchangeable default, because open_channel for this type MUST NOT set the announce_channel bit.

Implementations (as of September 2026)

LND requires the type explicitly; bare taproot now means the production variant, taproot-staging opens the staging variant and taproot-final is a deprecated alias:

lncli openchannel --channel_type=taproot ...

Eclair enables the feature by default (disable with eclair.features.option_simple_taproot = disabled) and opens with:

eclair-cli open --channelType=simple_taproot_channel --announceChannel=false ...

Common bugs

• MuSig2 nonce reuse across commitment updates → catastrophic key leak.
• Forgetting to commit empty taptree (or chosen leaves) on funding output construction → mismatched output key.
• Tapscript HTLC scripts with wrong sigops budget calculation.
• HW wallet signing without MuSig2 capability → channel cannot be opened or updated.

See also

• channels/SKILL.md
• htlcs/SKILL.md
• ../../cryptography/musig2/SKILL.md
• ../../protocol/taproot/SKILL.md