Update bip-0352.mediawiki

Co-authored-by: Sebastian Falbesoner <[email protected]>

bip-0352.mediawiki

@@ -242,7 +242,7 @@ The sender uses the private key corresponding to the taproot output key (i.e. th
 
     witness:      <optional witness items> <leaf script> <control block>
     scriptSig:    (empty)
-    scriptPubKey: 0 <32-byte-x-only-key>
+    scriptPubKey: 1 <32-byte-x-only-key>
                   (0x5120{32-byte-x-only-key})
 
 Same as a keypath spend, the sender MUST use the private key corresponding to the taproot output key. If this key is not available, the output cannot be included as an input to the transaction. Same as a keypath spend, the receiver obtains the public key from the ''scriptPubKey'' (i.e. the taproot output key)<ref name="why_always_output_pubkey">''' Why not skip all taproot script path spends? ''' This causes malleability issues for CoinJoins. If the silent payments protocol skipped taproot script path spends, this would allow an attacker to join a CoinJoin round, participate in deriving the silent payment address using the tweaked private key for a key path spend, and then broadcast their own version of the transaction using the script path spend. If the receiver were to only consider key path spends, they would skip the attacker's script path spend input when deriving the shared secret and not be able to find the funds. Additionally, there may be scenarios where the sender can perform ECDH with the key path private key but spends the output using the script path.</ref>.