Reminder, basic Taproot transactions are more expensive than Segwit

I see many posts advocating the reduced transaction size in taproot, but many fail to note that they are assuming multisig transactions. For basic, non-multisig, single-signer transactions, segwit is still smaller (and cheaper) than taproot.

Taproot has smaller multisig transactions than multisig-segwit, and this is what most are referring to.

For a 1-in / 2-out transaction, P2WPKH is 9.6% cheaper than P2TR. But in a 1-in / 1-out the savings drops to 1.5%

^(Update: found a better TXN size estimator than mine, so I linked it)

View Reddit by brianddkView Source

Leave a Reply

Your email address will not be published.

GIPHY App Key not set. Please check settings


  1. That’s misleading.

    Older styles permitted the shorter outputs that only have 80 bit security, that isn’t really considered adequate any more (heck Bitcoin itself has done on the order of 2^94 work). Segwit allowed either 80 bit or 128 bit security addresses, if you use 128-bit security addresses each output takes 12 more bytes to encode.

    In taproot only the 128-bit security address type exists but everything else is smaller. So much smaller that in terms of bytes it’s always smaller than segwit, but in terms of weight it isn’t because those extra 12 bytes from the longer addresses go into the utxo set so they cost more weight while most of the savings are witness bytes which count for less.

    So if you make an apples to apples comparison using 128-security taproot is both considerably lower weight and smaller. If you make a comparison with more inputs than outputs, taproot is lower weight and smaller. And if you note that the recipients chooses their own address, so you normally have control over only zero or one of the outputs, which again means taproot is equal (or nearly, your 1/1 example has it be 1.5 vbyte higher) or lower weight for the part you control.

    (actually somewhat less than 1.5vbyte because everything except core produces even larger signatures for ecdsa than these calculators assume)

    The cases where transaction fees get really high are when you need to spend a lot of inputs at once to satisfy a transaction and make something like a 20-in, 2-out transaction (where you only control at most one of the outputs), and in that case you end up with something like a 14.1% weight savings from using taproot, no multisig involved.

    Beyond 80-bits not being enough security, supporting multiple lengths also needlessly fragmented the anonymity set… and using a 80-bit address also makes the total size of transactions some 20 bytes larger, because of the need to send the hash and pubkey (it’s just that 20 bytes witness savings doesn’t offset 12 bytes of non-witness cost when it comes to weight calculations).

    So TLDR: You shouldn’t include the cost of outputs except for change because the user doesn’t control those, once you do that you’ll find that in lowest fee cases P2TR is only behind by ~1.5 vbyte. But in high fee cases where the wallet needed to use many inputs P2TR gets substantially lower fees. It also upgrades address security from 80 bits to 128 bits and will eliminate that extra degree of address size choice as a privacy loss vector. If you were already using 128-bit secure addresses (always the case if multisig or any scripting were used) it’s much smaller.

    [of course, if any multisig or scripting were used the savings can be astronomical, but you’re specifically not addressing that case]

    Encouraging people keep using the older stuff because it supports using a less secure address length only to at most save a tiny amount of fees in the cases were fees were already the lowest doesn’t really seem like the right move to me.

    Taproot also has other advantages, e.g. for offline signers and hardware wallets taproot dramatically reduces the amount of data you need to deliver to the signing device so that it can be sure it’s not getting robbed via fees.

What do you think?

Litecoin Price Prediction

LTC/USD Slips Below $220 Level

Algorand Price Analysis: Aave is bearish today