From 2857784d7a1ab972bd6c9ca61633972aa5b7e1de Mon Sep 17 00:00:00 2001
From: josie <josibake@protonmail.com>
Date: Thu, 14 Mar 2024 11:19:28 +0100
Subject: [PATCH] Update bip-0352.mediawiki

Co-authored-by: Sebastian Falbesoner <sebastian.falbesoner@gmail.com>
---
 bip-0352.mediawiki | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bip-0352.mediawiki b/bip-0352.mediawiki
index 49d8eb31ed..719eb74f4e 100644
--- a/bip-0352.mediawiki
+++ b/bip-0352.mediawiki
@@ -242,7 +242,7 @@ The sender uses the private key corresponding to the taproot output key (i.e. th
 
     witness:      <optional witness items> <leaf script> <control block>
     scriptSig:    (empty)
-    scriptPubKey: 0 <32-byte-x-only-key>
+    scriptPubKey: 1 <32-byte-x-only-key>
                   (0x5120{32-byte-x-only-key})
 
 Same as a keypath spend, the sender MUST use the private key corresponding to the taproot output key. If this key is not available, the output cannot be included as an input to the transaction. Same as a keypath spend, the receiver obtains the public key from the ''scriptPubKey'' (i.e. the taproot output key)<ref name="why_always_output_pubkey">''' Why not skip all taproot script path spends? ''' This causes malleability issues for CoinJoins. If the silent payments protocol skipped taproot script path spends, this would allow an attacker to join a CoinJoin round, participate in deriving the silent payment address using the tweaked private key for a key path spend, and then broadcast their own version of the transaction using the script path spend. If the receiver were to only consider key path spends, they would skip the attacker's script path spend input when deriving the shared secret and not be able to find the funds. Additionally, there may be scenarios where the sender can perform ECDH with the key path private key but spends the output using the script path.</ref>.