6

Assuming users have upgraded their wallets to handle P2TR outputs and trust the validation rules of P2TR, would there be any advantage of using P2WSH over P2TR?

Murch
  • 75,206
  • 34
  • 186
  • 622
Darius
  • 789
  • 5
  • 16

1 Answers1

7

As far as I can tell, P2TR is better than P2WSH in almost every way. I cannot think of a case in which it would be a significant advantage to use P2WSH over P2TR, except that P2WSH is already established.

Privacy

P2TR outputs will stand out at first since there will be few of them. In the long term, the anonymity set of P2TR is likely to be larger since both single-sig and multisig will look the same until spent.

Engineering effort to adopt

Sending to P2TR addresses will require wallets to implement support for Bech32m. Wallets that want to receive and spend P2TR outputs will need to implement the Schnorr signing algorithm, and reengineer any OP_CHECKMULTISIG based schemas with the op-codes available in Tapscript.

Murch
  • 75,206
  • 34
  • 186
  • 622
  • "both single-sig and multisig will look the same until spent" - don't you mean "when spent"? – Vojtěch Strnad Jul 07 '21 at 15:19
  • @VojtěchStrnad: If you are thinking that the multiparty payment is implemented as an aggregated key, yes, either would be spent as a keypath-spend, but I was thinking here that the multisig would mean that the spenders use the scriptpath. – Murch Jul 08 '21 at 01:40
  • Yes, keypath spends are an obvious method of increasing privacy of multisig transactions. I'm not really sure what privacy benefits would come from revealing the multisig script only after the spend – I see privacy as not having to reveal something, ever. – Vojtěch Strnad Jul 08 '21 at 01:59