diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index fcf5898a5d..e8b3efd81a 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -313,7 +313,8 @@ test_fuzz_fuzz_SOURCES = \
  test/fuzz/txrequest.cpp \
  test/fuzz/utxo_snapshot.cpp \
  test/fuzz/validation_load_mempool.cpp \
- test/fuzz/versionbits.cpp
+ test/fuzz/versionbits.cpp \
+ test/fuzz/witness_program.cpp
 endif # ENABLE_FUZZ_BINARY
 
 nodist_test_test_bitcoin_SOURCES = $(GENERATED_TEST_FILES)
diff --git a/src/crypto/sha256.cpp b/src/crypto/sha256.cpp
index c91172fc08..0ff5bff334 100644
--- a/src/crypto/sha256.cpp
+++ b/src/crypto/sha256.cpp
@@ -705,6 +705,59 @@ void CSHA256::Midstate(unsigned char hash[OUTPUT_SIZE], uint64_t* len, unsigned
     }
 }
 
+std::vector<unsigned char> CSHA256::Save() const {
+    size_t buf_size = bytes % 64;
+    std::vector<unsigned char> result(40 + buf_size);
+
+    WriteBE32(&result[ 0], s[0]);
+    WriteBE32(&result[ 4], s[1]);
+    WriteBE32(&result[ 8], s[2]);
+    WriteBE32(&result[12], s[3]);
+    WriteBE32(&result[16], s[4]);
+    WriteBE32(&result[20], s[5]);
+    WriteBE32(&result[24], s[6]);
+    WriteBE32(&result[28], s[7]);
+
+    WriteLE64(&result[32], bytes << 3);
+
+    if (buf_size) memcpy(&result[40], buf, buf_size);
+
+    return result;
+}
+
+bool CSHA256::Load(const std::vector<unsigned char>& vch) {
+    if (vch.size() < 40) return false;
+
+    uint64_t bits = ReadLE64(&vch[32]);
+    size_t buf_size = (bits >> 3) % 64;
+
+    if ((bits & 0x07) != 0 || vch.size() != 40 + buf_size) return false;
+
+    // We want to leave the internal state of the object unchanged if false is returned.
+    // So no member variables can be modified until now.
+
+    s[0] = ReadBE32(&vch[ 0]);
+    s[1] = ReadBE32(&vch[ 4]);
+    s[2] = ReadBE32(&vch[ 8]);
+    s[3] = ReadBE32(&vch[12]);
+    s[4] = ReadBE32(&vch[16]);
+    s[5] = ReadBE32(&vch[20]);
+    s[6] = ReadBE32(&vch[24]);
+    s[7] = ReadBE32(&vch[28]);
+
+    bytes = bits >> 3;
+    if (buf_size) memcpy(buf, &vch[40], buf_size);
+
+    return true;
+}
+
+bool CSHA256::SafeWrite(const unsigned char* data, size_t len) {
+  const uint64_t SHA256_MAX = 0x1FFFFFFFFFFFFFFF; // SHA256's maximum allowed message length in bytes.
+  if (SHA256_MAX < bytes || SHA256_MAX - bytes < len) return false;
+  Write(data, len);
+  return true;
+}
+
 CSHA256& CSHA256::Reset()
 {
     bytes = 0;
diff --git a/src/crypto/sha256.h b/src/crypto/sha256.h
index 7cdcde1956..79d5ad8b82 100644
--- a/src/crypto/sha256.h
+++ b/src/crypto/sha256.h
@@ -8,6 +8,7 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <string>
+#include <vector>
 
 /** A hasher class for SHA-256. */
 class CSHA256
@@ -26,7 +27,10 @@ public:
     //TODO: Midstate is a hack'ish speedup that probably should make way for something
     //akin to the SHA256D64 speedups
     void Midstate(unsigned char hash[OUTPUT_SIZE], uint64_t* len, unsigned char *buffer);
+    std::vector<unsigned char> Save() const;
+    bool Load(const std::vector<unsigned char>& vch);
     CSHA256& Reset();
+    bool SafeWrite(const unsigned char* data, size_t len);
 };
 
 /** Autodetect the best available SHA256 implementation.
diff --git a/src/pubkey.cpp b/src/pubkey.cpp
index 0857b80022..56dadafc22 100644
--- a/src/pubkey.cpp
+++ b/src/pubkey.cpp
@@ -186,12 +186,20 @@ bool XOnlyPubKey::IsFullyValid() const
     return secp256k1_xonly_pubkey_parse(secp256k1_context_verify, &pubkey, m_keydata.data());
 }
 
-bool XOnlyPubKey::VerifySchnorr(const uint256& msg, Span<const unsigned char> sigbytes) const
+bool XOnlyPubKey::VerifySchnorr(const Span<const unsigned char> msg, Span<const unsigned char> sigbytes) const
 {
     assert(sigbytes.size() == 64);
     secp256k1_xonly_pubkey pubkey;
     if (!secp256k1_xonly_pubkey_parse(secp256k1_context_verify, &pubkey, m_keydata.data())) return false;
-    return secp256k1_schnorrsig_verify(secp256k1_context_verify, sigbytes.data(), msg.begin(), 32, &pubkey);
+    return secp256k1_schnorrsig_verify(secp256k1_context_verify, sigbytes.data(), msg.data(), msg.size(), &pubkey);
+}
+
+// ELEMENTS: this is preserved from an old version of the Taproot code for use in OP_TWEAKVERIFY
+bool XOnlyPubKey::CheckPayToContract(const XOnlyPubKey& base, const uint256& hash, bool parity) const
+{
+    secp256k1_xonly_pubkey base_point;
+    if (!secp256k1_xonly_pubkey_parse(secp256k1_context_verify, &base_point, base.data())) return false;
+    return secp256k1_xonly_pubkey_tweak_add_check(secp256k1_context_verify, m_keydata.begin(), parity, &base_point, hash.begin());
 }
 
 static const CHashWriter HASHER_TAPTWEAK_ELEMENTS = TaggedHash("TapTweak/elements");
@@ -215,6 +223,18 @@ bool XOnlyPubKey::CheckTapTweak(const XOnlyPubKey& internal, const uint256& merk
     return secp256k1_xonly_pubkey_tweak_add_check(secp256k1_context_verify, m_keydata.begin(), parity, &internal_key, tweak.begin());
 }
 
+bool CPubKey::TweakMulVerify(const CPubKey& untweaked, const uint256& tweak) const
+{
+    assert(this->IsCompressed());
+    secp256k1_pubkey pk;
+    if (!secp256k1_ec_pubkey_parse(secp256k1_context_verify, &pk, untweaked.data(), untweaked.size())) return false;
+    if (!secp256k1_ec_pubkey_tweak_mul(secp256k1_context_verify, &pk, tweak.data())) return false;
+    unsigned char out_pk[CPubKey::COMPRESSED_SIZE];
+    size_t out_len = CPubKey::COMPRESSED_SIZE;
+    if (!secp256k1_ec_pubkey_serialize(secp256k1_context_verify, out_pk, &out_len, &pk, SECP256K1_EC_COMPRESSED)) return false;
+    return *this == CPubKey(out_pk, out_pk + out_len);
+}
+
 std::optional<std::pair<XOnlyPubKey, bool>> XOnlyPubKey::CreateTapTweak(const uint256* merkle_root) const
 {
     secp256k1_xonly_pubkey base_point;
@@ -226,7 +246,7 @@ std::optional<std::pair<XOnlyPubKey, bool>> XOnlyPubKey::CreateTapTweak(const ui
     std::pair<XOnlyPubKey, bool> ret;
     secp256k1_xonly_pubkey out_xonly;
     if (!secp256k1_xonly_pubkey_from_pubkey(secp256k1_context_verify, &out_xonly, &parity, &out)) return std::nullopt;
-    secp256k1_xonly_pubkey_serialize(secp256k1_context_verify, ret.first.begin(), &out_xonly);
+    secp256k1_xonly_pubkey_serialize(secp256k1_context_verify, ret.first.data(), &out_xonly);
     assert(parity == 0 || parity == 1);
     ret.second = parity;
     return ret;
diff --git a/src/pubkey.h b/src/pubkey.h
index 5ac7c769da..abbe67c24a 100644
--- a/src/pubkey.h
+++ b/src/pubkey.h
@@ -216,6 +216,9 @@ public:
 
     //! Derive BIP32 child pubkey.
     bool Derive(CPubKey& pubkeyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc, std::vector<unsigned char>* tweak = nullptr /* ELEMENTS: vector of key tweak values that are filled out if non-null */) const;
+
+    //! Verify that when this public key is tweaked with tweak, the result is res
+    bool TweakMulVerify(const CPubKey& res, const uint256& tweak) const;
 };
 
 class XOnlyPubKey
@@ -249,7 +252,10 @@ public:
      *
      * sigbytes must be exactly 64 bytes.
      */
-    bool VerifySchnorr(const uint256& msg, Span<const unsigned char> sigbytes) const;
+    bool VerifySchnorr(const Span<const unsigned char> msg, Span<const unsigned char> sigbytes) const;
+
+    // ELEMENTS: this is preserved from an old version of the Taproot code for use in OP_TWEAKVERIFY
+    bool CheckPayToContract(const XOnlyPubKey& base, const uint256& hash, bool parity) const;
 
     /** Compute the Taproot tweak as specified in BIP341, with *this as internal
      * key:
@@ -275,6 +281,7 @@ public:
     const unsigned char* end() const { return m_keydata.end(); }
     unsigned char* begin() { return m_keydata.begin(); }
     unsigned char* end() { return m_keydata.end(); }
+    unsigned char* data() { return m_keydata.begin(); }
     bool operator==(const XOnlyPubKey& other) const { return m_keydata == other.m_keydata; }
     bool operator!=(const XOnlyPubKey& other) const { return m_keydata != other.m_keydata; }
     bool operator<(const XOnlyPubKey& other) const { return m_keydata < other.m_keydata; }
diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index cdad6b07cb..0244737d97 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -5,6 +5,7 @@
 
 #include <script/interpreter.h>
 
+#include <consensus/consensus.h>
 #include <crypto/ripemd160.h>
 #include <crypto/sha1.h>
 #include <crypto/sha256.h>
@@ -14,6 +15,10 @@
 
 typedef std::vector<unsigned char> valtype;
 
+// These asserts are consensus critical for elements tapscript arithmetic opcodes
+static_assert(static_cast<uint64_t>(std::numeric_limits<int64_t>::max()) == UINT64_C(0x7FFFFFFFFFFFFFFF));
+static_assert(static_cast<uint64_t>(std::numeric_limits<int64_t>::min()) == UINT64_C(0x8000000000000000));
+
 namespace {
 
 inline bool set_success(ScriptError* ret)
@@ -60,6 +65,78 @@ static inline void popstack(std::vector<valtype>& stack)
     stack.pop_back();
 }
 
+static inline int64_t cast_signed64(uint64_t v)
+{
+    uint64_t int64_min = static_cast<uint64_t>(std::numeric_limits<int64_t>::min());
+    if (v >= int64_min)
+        return static_cast<int64_t>(v - int64_min) + std::numeric_limits<int64_t>::min();
+    return static_cast<int64_t>(v);
+}
+
+static inline int64_t read_le8_signed(const unsigned char* ptr)
+{
+    return cast_signed64(ReadLE64(ptr));
+}
+
+static inline void push4_le(std::vector<valtype>& stack, uint32_t v)
+{
+    uint32_t v_le = htole32(v);
+    stack.emplace_back(reinterpret_cast<unsigned char*>(&v_le), reinterpret_cast<unsigned char*>(&v_le) + sizeof(v_le));
+}
+
+static inline void push8_le(std::vector<valtype>& stack, uint64_t v)
+{
+    uint64_t v_le = htole64(v);
+    stack.emplace_back(reinterpret_cast<unsigned char*>(&v_le), reinterpret_cast<unsigned char*>(&v_le) + sizeof(v_le));
+}
+
+static inline void pushasset(std::vector<valtype>& stack, const CConfidentialAsset& asset)
+{
+    assert(!asset.IsNull());
+    stack.emplace_back(asset.vchCommitment.begin() + 1, asset.vchCommitment.end()); // Push asset without prefix
+    stack.emplace_back(asset.vchCommitment.begin(), asset.vchCommitment.begin() + 1); // Push prefix
+}
+
+static inline void pushvalue(std::vector<valtype>& stack, const CConfidentialValue& value)
+{
+    valtype vchinpValue, vchValuePref;
+    if (value.IsNull()) {
+        // If value is null, explicitly push the explicit prefix 0x01
+        vchValuePref = {0x01};
+        vchinpValue.assign(8, 0x00);
+    } else if (value.IsExplicit()) {
+        // Convert BE to LE by using reverse iterator
+        vchValuePref.assign(value.vchCommitment.begin(), value.vchCommitment.begin() + 1);
+        vchinpValue.assign(value.vchCommitment.rbegin(), value.vchCommitment.rbegin() + 8);
+    } else { // (value.IsCommitment())
+        vchValuePref.assign(value.vchCommitment.begin(), value.vchCommitment.begin() + 1);
+        vchinpValue.assign(value.vchCommitment.begin() + 1, value.vchCommitment.end());
+    }
+    stack.push_back(std::move(vchinpValue)); // if value is null, 0(LE 8) is pushed
+    stack.push_back(std::move(vchValuePref)); // always push prefix
+}
+
+static inline void pushspk(std::vector<valtype>& stack, const CScript& scriptPubKey, const uint256& scriptPubKey_sha)
+{
+    int witnessversion;
+    valtype witnessprogram;
+    if (scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram)) {
+        stack.push_back(std::move(witnessprogram));
+        stack.push_back(CScriptNum(witnessversion).getvch());
+    } else {
+        stack.emplace_back(scriptPubKey_sha.begin(), scriptPubKey_sha.end());
+        stack.push_back(CScriptNum(-1).getvch());
+    }
+}
+
+/** Compute the outpoint flag(u8) for a given txin **/
+template <class T>
+inline unsigned char GetOutpointFlag(const T& txin)
+{
+    return static_cast<unsigned char> ((!txin.assetIssuance.IsNull() ? (COutPoint::OUTPOINT_ISSUANCE_FLAG >> 24) : 0) |
+            (txin.m_is_pegin ? (COutPoint::OUTPOINT_PEGIN_FLAG >> 24) : 0));
+}
+
 bool static IsCompressedOrUncompressedPubKey(const valtype &vchPubKey) {
     if (vchPubKey.size() < CPubKey::COMPRESSED_SIZE) {
         //  Non-canonical public key: too short
@@ -356,6 +433,17 @@ public:
 };
 }
 
+// Check the script has sufficient sigops budget for checksig(crypto) operation
+inline bool update_validation_weight(ScriptExecutionData& execdata, ScriptError* serror)
+{
+    assert(execdata.m_validation_weight_left_init);
+    execdata.m_validation_weight_left -= VALIDATION_WEIGHT_PER_SIGOP_PASSED;
+    if (execdata.m_validation_weight_left < 0) {
+        return set_error(serror, SCRIPT_ERR_TAPSCRIPT_VALIDATION_WEIGHT);
+    }
+    return true;
+}
+
 static bool EvalChecksigPreTapscript(const valtype& vchSig, const valtype& vchPubKey, CScript::const_iterator pbegincodehash, CScript::const_iterator pend, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* serror, bool& fSuccess)
 {
     assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0);
@@ -382,6 +470,47 @@ static bool EvalChecksigPreTapscript(const valtype& vchSig, const valtype& vchPu
     return true;
 }
 
+static bool EvalTapScriptCheckSigFromStack(const valtype& sig, const valtype& vchPubKey, ScriptExecutionData& execdata, unsigned int flags, const valtype& msg, SigVersion sigversion, ScriptError* serror, bool& success)
+{
+    // This code follows the behaviour of EvalCheckSigTapscript
+    assert(sigversion == SigVersion::TAPSCRIPT);
+
+    /*
+     *  The following validation sequence is consensus critical. Please note how --
+     *    upgradable public key versions precede other rules;
+     *    the script execution fails when using empty signature with invalid public key;
+     *    the script execution fails when using non-empty invalid signature.
+     */
+    success = !sig.empty();
+    if (success) {
+        // Implement the sigops/witnesssize ratio test.
+        // Passing with an upgradable public key version is also counted.
+        if (!update_validation_weight(execdata, serror)) return false; // serror is set
+    }
+    if (vchPubKey.size() == 0) {
+        return set_error(serror, SCRIPT_ERR_PUBKEYTYPE);
+    } else if (vchPubKey.size() == 32) {
+        if (success) {
+            if (sig.size() != 64)
+                return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_SIZE);
+            const XOnlyPubKey pubkey{vchPubKey};
+            if (!pubkey.VerifySchnorr(msg, sig))
+                return set_error(serror, SCRIPT_ERR_SCHNORR_SIG);
+        }
+    } else {
+        /*
+         *  New public key version softforks should be defined before this `else` block.
+         *  Generally, the new code should not do anything but failing the script execution. To avoid
+         *  consensus bugs, it should not modify any existing values (including `success`).
+         */
+        if ((flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_PUBKEYTYPE) != 0) {
+            return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_PUBKEYTYPE);
+        }
+    }
+
+    return true;
+}
+
 static bool EvalChecksigTapscript(const valtype& sig, const valtype& pubkey, ScriptExecutionData& execdata, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* serror, bool& success)
 {
     assert(sigversion == SigVersion::TAPSCRIPT);
@@ -396,11 +525,7 @@ static bool EvalChecksigTapscript(const valtype& sig, const valtype& pubkey, Scr
     if (success) {
         // Implement the sigops/witnesssize ratio test.
         // Passing with an upgradable public key version is also counted.
-        assert(execdata.m_validation_weight_left_init);
-        execdata.m_validation_weight_left -= VALIDATION_WEIGHT_PER_SIGOP_PASSED;
-        if (execdata.m_validation_weight_left < 0) {
-            return set_error(serror, SCRIPT_ERR_TAPSCRIPT_VALIDATION_WEIGHT);
-        }
+        if (!update_validation_weight(execdata, serror)) return false; // serror is set
     }
     if (pubkey.size() == 0) {
         return set_error(serror, SCRIPT_ERR_PUBKEYTYPE);
@@ -442,6 +567,10 @@ static bool EvalChecksig(const valtype& sig, const valtype& pubkey, CScript::con
     assert(false);
 }
 
+const CHashWriter HASHER_TAPLEAF_ELEMENTS = TaggedHash("TapLeaf/elements");
+const CHashWriter HASHER_TAPBRANCH_ELEMENTS = TaggedHash("TapBranch/elements");
+static const CHashWriter HASHER_TAPSIGHASH_ELEMENTS = TaggedHash("TapSighash/elements");
+
 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror)
 {
     static const CScriptNum bnZero(0);
@@ -1587,29 +1716,521 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
                     valtype& vchSig    = stacktop(-3);
                     valtype& vchData   = stacktop(-2);
                     valtype& vchPubKey = stacktop(-1);
+                    bool fSuccess;
+                    // Different semantics for CHECKSIGFROMSTACK for taproot and pre-taproot
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0)
+                    {
+                        // Sigs from stack have no hash byte ever
+                        if (!CheckSignatureEncoding(vchSig, (flags | SCRIPT_NO_SIGHASH_BYTE), serror) || !CheckPubKeyEncoding(vchPubKey, flags, sigversion, serror)) {
+                            //serror is set
+                            return false;
+                        }
 
-                    // Sigs from stack have no hash byte ever
-                    if (!CheckSignatureEncoding(vchSig, (flags | SCRIPT_NO_SIGHASH_BYTE), serror) || !CheckPubKeyEncoding(vchPubKey, flags, sigversion, serror)) {
-                        //serror is set
-                        return false;
+                        valtype vchHash(CSHA256::OUTPUT_SIZE);
+                        CSHA256().Write(vchData.data(), vchData.size()).Finalize(vchHash.data());
+                        uint256 hash(vchHash);
+
+                        CPubKey pubkey(vchPubKey);
+                        fSuccess = pubkey.Verify(hash, vchSig);
+                        // CHECKSIGFROMSTACK in pre-tapscript cannot be failed.
+                        if (!fSuccess)
+                            return set_error(serror, SCRIPT_ERR_CHECKSIGVERIFY);
+                    } else {
+                        // New BIP 340 semantics for CHECKSIGFROMSTACK
+                        if (!EvalTapScriptCheckSigFromStack(vchSig, vchPubKey, execdata, flags, vchData, sigversion, serror, fSuccess)) return false;
                     }
-
-                    valtype vchHash(32);
-                    CSHA256().Write(vchData.data(), vchData.size()).Finalize(vchHash.data());
-                    uint256 hash(vchHash);
-
-                    CPubKey pubkey(vchPubKey);
-                    bool fSuccess = pubkey.Verify(hash, vchSig);
-
                     popstack(stack);
                     popstack(stack);
                     popstack(stack);
                     stack.push_back(fSuccess ? vchTrue : vchFalse);
                     if (opcode == OP_CHECKSIGFROMSTACKVERIFY)
-                        popstack(stack);
+                    {
+                        if (fSuccess)
+                            popstack(stack);
+                        else
+                            return set_error(serror, SCRIPT_ERR_CHECKSIGVERIFY);
+                    }
+                }
+                break;
 
-                    if (!fSuccess)
-                        return set_error(serror, SCRIPT_ERR_CHECKSIGVERIFY);
+                case OP_SHA256INITIALIZE: // (in -- sha256_ctx)
+                {
+                    // OP_SHA256INITIALIZE is only available in Tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    CSHA256 ctx;
+                    valtype& vch = stacktop(-1);
+                    if (!ctx.SafeWrite(vch.data(), vch.size()))
+                        return set_error(serror, SCRIPT_ERR_SHA2_CONTEXT_WRITE);
+
+                    popstack(stack);
+                    stack.push_back(ctx.Save());
+                }
+                break;
+
+                case OP_SHA256UPDATE: // (sha256_ctx in -- sha256_ctx)
+                {
+                    // OP_SHA256UPDATE is only available in Tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    CSHA256 ctx;
+                    valtype& vchCtx = stacktop(-2);
+                    if (!ctx.Load(vchCtx))
+                        return set_error(serror, SCRIPT_ERR_SHA2_CONTEXT_LOAD);
+
+                    valtype& vch = stacktop(-1);
+                    if (!ctx.SafeWrite(vch.data(), vch.size()))
+                        return set_error(serror, SCRIPT_ERR_SHA2_CONTEXT_WRITE);
+
+                    popstack(stack);
+                    popstack(stack);
+                    stack.push_back(ctx.Save());
+                }
+                break;
+
+                case OP_SHA256FINALIZE: // (sha256_ctx in -- hash)
+                {
+                    // OP_SHA256FINALIZE is only available in Tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    valtype& vchCtx = stacktop(-2);
+                    CSHA256 ctx;
+                    if (!ctx.Load(vchCtx))
+                        return set_error(serror, SCRIPT_ERR_SHA2_CONTEXT_LOAD);
+
+                    valtype& vch = stacktop(-1);
+                    if (!ctx.SafeWrite(vch.data(), vch.size()))
+                        return set_error(serror, SCRIPT_ERR_SHA2_CONTEXT_WRITE);
+
+                    valtype vchHash(CHash256::OUTPUT_SIZE);
+                    ctx.Finalize(vchHash.data());
+
+                    popstack(stack);
+                    popstack(stack);
+                    stack.push_back(std::move(vchHash));
+                }
+                break;
+
+                case OP_INSPECTINPUTOUTPOINT:
+                case OP_INSPECTINPUTASSET:
+                case OP_INSPECTINPUTVALUE:
+                case OP_INSPECTINPUTSCRIPTPUBKEY:
+                case OP_INSPECTINPUTSEQUENCE:
+                case OP_INSPECTINPUTISSUANCE:
+                {
+                    // Input inspection opcodes only available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    int idx = CScriptNum(stacktop(-1), fRequireMinimal).getint();
+                    popstack(stack);
+
+                    auto inps = checker.GetTxvIn();
+                    const PrecomputedTransactionData *cache = checker.GetPrecomputedTransactionData();
+                    // Return error if the evaluation context is unavailable
+                    // TODO: Handle accoding to MissingDataBehavior
+                    if (!inps || !cache || !cache->m_bip341_taproot_ready)
+                        return set_error(serror, SCRIPT_ERR_INTROSPECT_CONTEXT_UNAVAILABLE);
+                    const std::vector<CTxOut>& spent_outputs = cache->m_spent_outputs;
+                    // This condition is ensured when m_spent_outputs_ready is set
+                    // which is asserted when m_bip341_taproot_ready is set
+                    assert(spent_outputs.size() == inps->size());
+                    if (idx < 0 || static_cast<unsigned int>(idx) >= inps->size())
+                        return set_error(serror, SCRIPT_ERR_INTROSPECT_INDEX_OUT_OF_BOUNDS);
+                    const CTxIn& inp = inps->at(idx);
+                    const CTxOut& spent_utxo = spent_outputs[idx];
+
+                    switch (opcode)
+                    {
+                        case OP_INSPECTINPUTOUTPOINT:
+                        {
+                            // Push prev txid
+                            stack.emplace_back(inp.prevout.hash.begin(), inp.prevout.hash.end());
+                            push4_le(stack, inp.prevout.n);
+
+                            // Push the outpoint flag
+                            stack.emplace_back(1, GetOutpointFlag(inp));
+                            break;
+                        }
+                        case OP_INSPECTINPUTASSET:
+                        {
+                            pushasset(stack, spent_utxo.nAsset);
+                            break;
+                        }
+                        case OP_INSPECTINPUTVALUE:
+                        {
+                            pushvalue(stack, spent_utxo.nValue);
+                            break;
+                        }
+                        case OP_INSPECTINPUTSCRIPTPUBKEY:
+                        {
+                            pushspk(stack, spent_utxo.scriptPubKey, cache->m_spent_output_spk_single_hashes[idx]);
+                            break;
+                        }
+                        case OP_INSPECTINPUTSEQUENCE:
+                        {
+                            push4_le(stack, inp.nSequence);
+                            break;
+                        }
+                        case OP_INSPECTINPUTISSUANCE:
+                        {
+                            if (!inp.assetIssuance.IsNull()) {
+                                pushvalue(stack, inp.assetIssuance.nInflationKeys);
+                                pushvalue(stack, inp.assetIssuance.nAmount);
+                                // Next push Asset entropy
+                                stack.emplace_back(inp.assetIssuance.assetEntropy.begin(), inp.assetIssuance.assetEntropy.end());
+                                // Finally push blinding nonce
+                                // By pushing the this order, we make sure that the stack top is empty
+                                // iff there is no issuance.
+                                stack.emplace_back(inp.assetIssuance.assetBlindingNonce.begin(), inp.assetIssuance.assetBlindingNonce.end());
+                            } else { // No issuance
+                                stack.push_back(vchFalse);
+                            }
+                            break;
+                        }
+                        default: assert(!"invalid opcode"); break;
+                    }
+                }
+                break;
+
+                case OP_PUSHCURRENTINPUTINDEX:
+                {
+                    // OP_PUSHCURRENTINPUTINDEX is available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    // Even tough this value should never 2^25(MAX_SIZE), this can set to any value in exotic custom contexts
+                    // safe to check that this in 4 byte positive number before pushing it
+                    // TODO: Handle accoding to MissingDataBehavior
+                    if (checker.GetnIn() > MAX_SIZE)
+                        return set_error(serror, SCRIPT_ERR_INTROSPECT_CONTEXT_UNAVAILABLE);
+                    stack.push_back(CScriptNum(static_cast<int64_t>(checker.GetnIn())).getvch());
+                }
+                break;
+
+                case OP_INSPECTOUTPUTASSET:
+                case OP_INSPECTOUTPUTVALUE:
+                case OP_INSPECTOUTPUTNONCE:
+                case OP_INSPECTOUTPUTSCRIPTPUBKEY:
+                {
+                    // Output instropsection codes only available post tapscript is available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    int idx = CScriptNum(stacktop(-1), fRequireMinimal).getint();
+                    popstack(stack);
+
+                    auto outs = checker.GetTxvOut();
+                    const PrecomputedTransactionData *cache = checker.GetPrecomputedTransactionData();
+                    // Return error if the evaluation context is unavailable
+                    // TODO: Handle accoding to MissingDataBehavior
+                    if (!outs || !cache || !cache->m_bip341_taproot_ready)
+                        return set_error(serror, SCRIPT_ERR_INTROSPECT_CONTEXT_UNAVAILABLE);
+                    assert(cache->m_output_spk_single_hashes.size() == outs->size());
+
+                    if (idx < 0 || static_cast<unsigned int>(idx) >= outs->size())
+                        return set_error(serror, SCRIPT_ERR_INTROSPECT_INDEX_OUT_OF_BOUNDS);
+                    const CTxOut& out = outs->at(idx);
+
+                    switch (opcode)
+                    {
+                        case OP_INSPECTOUTPUTASSET:
+                        {
+                            pushasset(stack, out.nAsset);
+                            break;
+                        }
+                        case OP_INSPECTOUTPUTVALUE:
+                        {
+                            pushvalue(stack, out.nValue);
+                            break;
+                        }
+                        case OP_INSPECTOUTPUTNONCE:
+                        {
+                            if (out.nNonce.IsNull()) {
+                                stack.push_back(vchFalse);
+                            } else {
+                                stack.emplace_back(out.nNonce.vchCommitment);
+                            }
+                            break;
+                        }
+                        case OP_INSPECTOUTPUTSCRIPTPUBKEY:
+                        {
+                            pushspk(stack, out.scriptPubKey, cache->m_output_spk_single_hashes[idx]);
+                            break;
+                        }
+                        default: assert(!"invalid opcode"); break;
+                    }
+                }
+                break;
+
+                case OP_INSPECTVERSION:
+                case OP_INSPECTLOCKTIME:
+                case OP_INSPECTNUMINPUTS:
+                case OP_INSPECTNUMOUTPUTS:
+                case OP_TXWEIGHT:
+                {
+                    // Transaction introspection is available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    switch (opcode)
+                    {
+                        case OP_INSPECTVERSION:
+                        {
+                            push4_le(stack, static_cast<uint32_t>(checker.GetTxVersion()));
+                            break;
+                        }
+                        case OP_INSPECTLOCKTIME:
+                        {
+                            push4_le(stack, checker.GetLockTime());
+                            break;
+                        }
+                        case OP_INSPECTNUMINPUTS:
+                        {
+                            auto inps = checker.GetTxvIn();
+                            // TODO: Handle according to MissingDataBehavior
+                            if (!inps)
+                                return set_error(serror, SCRIPT_ERR_INTROSPECT_CONTEXT_UNAVAILABLE);
+                            auto num_ins = inps->size();
+                            assert(num_ins <= MAX_SIZE);
+                            stack.push_back(CScriptNum(static_cast<int64_t>(num_ins)).getvch());
+                            break;
+                        }
+                        case OP_INSPECTNUMOUTPUTS:
+                        {
+                            auto outs = checker.GetTxvOut();
+                            // TODO: Handle according to MissingDataBehavior
+                            if (!outs)
+                                return set_error(serror, SCRIPT_ERR_INTROSPECT_CONTEXT_UNAVAILABLE);
+                            auto num_outs = outs->size();
+                            assert(num_outs <= MAX_SIZE);
+                            stack.push_back(CScriptNum(static_cast<int64_t>(num_outs)).getvch());
+                            break;
+                        }
+                        case OP_TXWEIGHT:
+                        {
+                            push8_le(stack, checker.GetTxWeight());
+                            break;
+                        }
+                        default: assert(!"invalid opcode"); break;
+                    }
+                }
+                break;
+
+                case OP_ADD64:
+                case OP_SUB64:
+                case OP_MUL64:
+                case OP_DIV64:
+                case OP_LESSTHAN64:
+                case OP_LESSTHANOREQUAL64:
+                case OP_GREATERTHAN64:
+                case OP_GREATERTHANOREQUAL64:
+                {
+                    // Opcodes only available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    valtype& vcha = stacktop(-2);
+                    valtype& vchb = stacktop(-1);
+                    if (vchb.size() != 8 || vcha.size() != 8)
+                        return set_error(serror, SCRIPT_ERR_EXPECTED_8BYTES);
+
+                    int64_t b = read_le8_signed(vchb.data());
+                    int64_t a = read_le8_signed(vcha.data());
+
+                    switch(opcode)
+                    {
+                        case OP_ADD64:
+                            if ((a > 0 && b > std::numeric_limits<int64_t>::max() - a) ||
+                                (a < 0 && b < std::numeric_limits<int64_t>::min() - a))
+                                stack.push_back(vchFalse);
+                            else {
+                                popstack(stack);
+                                popstack(stack);
+                                push8_le(stack, a + b);
+                                stack.push_back(vchTrue);
+                            }
+                        break;
+                        case OP_SUB64:
+                            if ((b > 0 && a < std::numeric_limits<int64_t>::min() + b) ||
+                                (b < 0 && a > std::numeric_limits<int64_t>::max() + b))
+                                stack.push_back(vchFalse);
+                            else {
+                                popstack(stack);
+                                popstack(stack);
+                                push8_le(stack, a - b);
+                                stack.push_back(vchTrue);
+                            }
+                        break;
+                        case OP_MUL64:
+                            if ((a > 0 && b > 0 && a > std::numeric_limits<int64_t>::max() / b) ||
+                                (a > 0 && b < 0 && b < std::numeric_limits<int64_t>::min() / a) ||
+                                (a < 0 && b > 0 && a < std::numeric_limits<int64_t>::min() / b) ||
+                                (a < 0 && b < 0 && b < std::numeric_limits<int64_t>::max() / a))
+                                stack.push_back(vchFalse);
+                            else {
+                                popstack(stack);
+                                popstack(stack);
+                                push8_le(stack, a * b);
+                                stack.push_back(vchTrue);
+                            }
+                        break;
+                        case OP_DIV64:
+                        {
+                            if (b == 0 || (b == -1 && a == std::numeric_limits<int64_t>::min())) { stack.push_back(vchFalse); break; }
+                            int64_t r = a % b;
+                            int64_t q = a / b;
+                            if (r < 0 && b > 0)      { r += b; q-=1;} // ensures that 0<=r<|b|
+                            else if (r < 0 && b < 0) { r -= b; q+=1;} // ensures that 0<=r<|b|
+                            popstack(stack);
+                            popstack(stack);
+                            push8_le(stack, r);
+                            push8_le(stack, q);
+                            stack.push_back(vchTrue);
+                        }
+                        break;
+                        break;
+                        case OP_LESSTHAN64:            popstack(stack); popstack(stack); stack.push_back( (a <  b) ? vchTrue : vchFalse ); break;
+                        case OP_LESSTHANOREQUAL64:     popstack(stack); popstack(stack); stack.push_back( (a <= b) ? vchTrue : vchFalse ); break;
+                        case OP_GREATERTHAN64:         popstack(stack); popstack(stack); stack.push_back( (a >  b) ? vchTrue : vchFalse ); break;
+                        case OP_GREATERTHANOREQUAL64:  popstack(stack); popstack(stack); stack.push_back( (a >= b) ? vchTrue : vchFalse ); break;
+                        default:                       assert(!"invalid opcode"); break;
+                    }
+                }
+                break;
+                case OP_NEG64:
+                {
+                    // Opcodes only available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    valtype& vcha = stacktop(-1);
+                    if (vcha.size() != 8)
+                        return set_error(serror, SCRIPT_ERR_EXPECTED_8BYTES);
+
+                    int64_t a = read_le8_signed(vcha.data());
+                    if (a == std::numeric_limits<int64_t>::min()) { stack.push_back(vchFalse); break; }
+
+                    popstack(stack);
+                    push8_le(stack, -a);
+                    stack.push_back(vchTrue);
+                }
+                break;
+
+                case OP_SCRIPTNUMTOLE64:
+                {
+                    // Opcodes only available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    int64_t num = CScriptNum(stacktop(-1), fRequireMinimal).getint();
+                    popstack(stack);
+                    push8_le(stack, num);
+                }
+                break;
+                case OP_LE64TOSCRIPTNUM:
+                {
+                    // Opcodes only available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    valtype& vchnum = stacktop(-1);
+                    if (vchnum.size() != 8)
+                        return set_error(serror, SCRIPT_ERR_EXPECTED_8BYTES);
+                    valtype vchscript_num = CScriptNum(read_le8_signed(vchnum.data())).getvch();
+                    if (vchscript_num.size() > CScriptNum::nDefaultMaxNumSize) {
+                        return set_error(serror, SCRIPT_ERR_ARITHMETIC64);
+                    } else {
+                        popstack(stack);
+                        stack.push_back(std::move(vchscript_num));
+                    }
+                }
+                break;
+                case OP_LE32TOLE64:
+                {
+                    // Opcodes only available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    valtype& vchnum = stacktop(-1);
+                    if (vchnum.size() != 4)
+                        return set_error(serror, SCRIPT_ERR_ARITHMETIC64);
+                    uint32_t num = ReadLE32(vchnum.data());
+                    popstack(stack);
+                    push8_le(stack, static_cast<int64_t>(num));
+                }
+                break;
+                case OP_ECMULSCALARVERIFY:
+                {
+                    // OP_ECMULSCALARVERIFY is available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    valtype& vchRes = stacktop(-3);
+                    valtype& vchGenerator = stacktop(-2);
+                    valtype& vchScalar = stacktop(-1);
+
+                    CPubKey pk(vchGenerator);
+                    CPubKey res(vchRes);
+                    if (!pk.IsCompressed() || !res.IsCompressed())
+                        return set_error(serror, SCRIPT_ERR_PUBKEYTYPE);
+
+                    if (!update_validation_weight(execdata, serror)) return false; // serror is set
+
+                    if (vchScalar.size() != 32 || !res.TweakMulVerify(pk, uint256(vchScalar)))
+                        return set_error(serror, SCRIPT_ERR_ECMULTVERIFYFAIL);
+
+                    popstack(stack);
+                    popstack(stack);
+                    popstack(stack);
+                }
+                break;
+
+                //crypto opcodes
+                case OP_TWEAKVERIFY:
+                {
+                    // OP_TWEAKVERIFY is available post tapscript
+                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+
+                    valtype& vchTweakedKey = stacktop(-3);
+                    valtype& vchTweak = stacktop(-2);
+                    valtype& vchInternalKey = stacktop(-1);
+
+                    if (vchTweakedKey.size() != CPubKey::COMPRESSED_SIZE || (vchTweakedKey[0] != 0x02 && vchTweakedKey[0] != 0x03)
+                        || vchInternalKey.size() != 32 || vchTweak.size() != 32)
+                        return set_error(serror, SCRIPT_ERR_PUBKEYTYPE);
+
+                    if (!update_validation_weight(execdata, serror)) return false; // serror is set
+
+                    const XOnlyPubKey tweakedXOnlyKey{Span<const unsigned char>{vchTweakedKey.data() + 1, vchTweakedKey.data() + CPubKey::COMPRESSED_SIZE}};
+                    const uint256 tweak(vchTweak);
+                    const XOnlyPubKey internalKey{vchInternalKey};
+                    if (!tweakedXOnlyKey.CheckPayToContract(internalKey, tweak, vchTweakedKey[0] & 1))
+                        return set_error(serror, SCRIPT_ERR_ECMULTVERIFYFAIL);
+
+                    popstack(stack);
+                    popstack(stack);
+                    popstack(stack);
                 }
                 break;
 
@@ -1757,14 +2378,6 @@ public:
     }
 };
 
-/** Compute the outpoint flag(u8) for a given txin **/
-template <class T>
-inline unsigned char GetOutpointFlag(const T& txin)
-{
-    return (unsigned char) ((!txin.assetIssuance.IsNull() ? (COutPoint::OUTPOINT_ISSUANCE_FLAG >> 24) : 0) |
-            (txin.m_is_pegin ? (COutPoint::OUTPOINT_PEGIN_FLAG >> 24) : 0));
-}
-
 /** Compute the (single) SHA256 of the concatenation of all outpoint flags of a tx. */
 template <class T>
 uint256 GetOutpointFlagsSHA256(const T& txTo)
@@ -1873,6 +2486,35 @@ uint256 GetSpentScriptsSHA256(const std::vector<CTxOut>& outputs_spent)
     return ss.GetSHA256();
 }
 
+/** Compute the vector where each element is SHA256 of scriptPubKeys spent by a tx. */
+std::vector<uint256> GetSpentScriptPubKeysSHA256(const std::vector<CTxOut>& outputs_spent)
+{
+    std::vector<uint256> spent_spk_single_hashes;
+    spent_spk_single_hashes.reserve(outputs_spent.size());
+    for (const auto& txout : outputs_spent) {
+        // Normal serialization using the << operater would also serialize the length, therefore we directly write using CSHA256
+        uint256 spent_spk_single_hash;
+        CSHA256().Write(txout.scriptPubKey.data(), txout.scriptPubKey.size()).Finalize(spent_spk_single_hash.data());
+        spent_spk_single_hashes.push_back(std::move(spent_spk_single_hash));
+    }
+    return spent_spk_single_hashes;
+}
+
+/** Compute the vector where each element is SHA256 of output scriptPubKey of a tx. */
+template <class T>
+std::vector<uint256> GetOutputScriptPubKeysSHA256(const T& txTo)
+{
+    std::vector<uint256> out_spk_single_hashes;
+    out_spk_single_hashes.reserve(txTo.vout.size());
+    for (const auto& txout : txTo.vout) {
+        // Normal serialization using the << operater would also serialize the length, therefore we directly write using CSHA256
+        uint256 out_spk_single_hash;
+        CSHA256().Write(txout.scriptPubKey.data(), txout.scriptPubKey.size()).Finalize(out_spk_single_hash.data());
+        out_spk_single_hashes.push_back(std::move(out_spk_single_hash));
+    }
+    return out_spk_single_hashes;
+}
+
 template <class T>
 uint256 GetRangeproofsHash(const T& txTo) {
     CHashWriter ss(SER_GETHASH, 0);
@@ -1944,6 +2586,8 @@ void PrecomputedTransactionData::Init(const T& txTo, std::vector<CTxOut>&& spent
         m_issuance_rangeproofs_single_hash = GetIssuanceRangeproofsSHA256(txTo);
         m_output_witnesses_single_hash = GetOutputWitnessesSHA256(txTo);
         m_spent_scripts_single_hash = GetSpentScriptsSHA256(m_spent_outputs);
+        m_spent_output_spk_single_hashes = GetSpentScriptPubKeysSHA256(m_spent_outputs);
+        m_output_spk_single_hashes = GetOutputScriptPubKeysSHA256(txTo);
         m_bip341_taproot_ready = true;
     }
 }
@@ -1961,10 +2605,6 @@ template void PrecomputedTransactionData::Init(const CMutableTransaction& txTo,
 template PrecomputedTransactionData::PrecomputedTransactionData(const CTransaction& txTo);
 template PrecomputedTransactionData::PrecomputedTransactionData(const CMutableTransaction& txTo);
 
-static const CHashWriter HASHER_TAPSIGHASH_ELEMENTS = TaggedHash("TapSighash/elements");
-const CHashWriter HASHER_TAPLEAF_ELEMENTS = TaggedHash("TapLeaf/elements");
-const CHashWriter HASHER_TAPBRANCH_ELEMENTS = TaggedHash("TapBranch/elements");
-
 PrecomputedTransactionData::PrecomputedTransactionData(const uint256& hash_genesis_block)
         : m_tapsighash_hasher(CHashWriter(HASHER_TAPSIGHASH_ELEMENTS) << hash_genesis_block << hash_genesis_block) {}
 
@@ -2346,6 +2986,49 @@ bool GenericTransactionSignatureChecker<T>::CheckSequence(const CScriptNum& nSeq
     return true;
 }
 
+template <class T>
+uint32_t GenericTransactionSignatureChecker<T>::GetLockTime() const
+{
+    return txTo->nLockTime;
+}
+
+template <class T>
+int32_t GenericTransactionSignatureChecker<T>::GetTxVersion() const
+{
+    return txTo->nVersion;
+}
+
+template <class T>
+const std::vector<CTxIn>* GenericTransactionSignatureChecker<T>::GetTxvIn() const
+{
+    return &(txTo->vin);
+}
+
+template <class T>
+const std::vector<CTxOut>* GenericTransactionSignatureChecker<T>::GetTxvOut() const
+{
+    return &(txTo->vout);
+}
+
+template <class T>
+uint64_t GenericTransactionSignatureChecker<T>::GetTxWeight() const
+{
+    // line copied from GetTransactionWeight() in src/consensus/validation.h
+    return ::GetSerializeSize(*txTo, PROTOCOL_VERSION | SERIALIZE_TRANSACTION_NO_WITNESS) * (WITNESS_SCALE_FACTOR - 1) + ::GetSerializeSize(*txTo, PROTOCOL_VERSION);
+}
+
+template <class T>
+const PrecomputedTransactionData* GenericTransactionSignatureChecker<T>::GetPrecomputedTransactionData() const
+{
+    return txdata;
+}
+
+template <class T>
+uint32_t GenericTransactionSignatureChecker<T>::GetnIn() const
+{
+    return nIn;
+}
+
 // explicit instantiation
 template class GenericTransactionSignatureChecker<CTransaction>;
 template class GenericTransactionSignatureChecker<CMutableTransaction>;
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index b21719bd9e..e9476b2afc 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -173,7 +173,9 @@ struct PrecomputedTransactionData
     uint256 m_issuances_single_hash;
     uint256 m_output_witnesses_single_hash;
     uint256 m_issuance_rangeproofs_single_hash;
-    //! Whether the 10 fields above are initialized.
+    //! transaction outputs scriptpubkey sha single hash
+    std::vector<uint256> m_output_spk_single_hashes;
+    //! Whether the 11 fields above are initialized.
     bool m_bip341_taproot_ready = false;
 
     // BIP143 precomputed data (double-SHA256).
@@ -182,6 +184,8 @@ struct PrecomputedTransactionData
     bool m_bip143_segwit_ready = false;
 
     std::vector<CTxOut> m_spent_outputs;
+    //! ELEMENTS: spent outputs scriptpubkey sha single hash
+    std::vector<uint256> m_spent_output_spk_single_hashes;
     //! Whether m_spent_outputs is initialized.
     bool m_spent_outputs_ready = false;
 
@@ -237,7 +241,7 @@ static constexpr size_t WITNESS_V0_KEYHASH_SIZE = 20;
 static constexpr size_t WITNESS_V1_TAPROOT_SIZE = 32;
 
 static constexpr uint8_t TAPROOT_LEAF_MASK = 0xfe;
-static constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT = 0xc0;
+static constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT = 0xc4;
 static constexpr size_t TAPROOT_CONTROL_BASE_SIZE = 33;
 static constexpr size_t TAPROOT_CONTROL_NODE_SIZE = 32;
 static constexpr size_t TAPROOT_CONTROL_MAX_NODE_COUNT = 128;
@@ -272,6 +276,41 @@ public:
          return false;
     }
 
+    virtual const std::vector<CTxIn>* GetTxvIn() const
+    {
+        return nullptr;
+    }
+
+    virtual const std::vector<CTxOut>* GetTxvOut() const
+    {
+        return nullptr;
+    }
+
+    virtual uint32_t GetLockTime() const
+    {
+        return 0;
+    }
+
+    virtual int32_t GetTxVersion() const
+    {
+        return 0;
+    }
+
+    virtual uint64_t GetTxWeight() const
+    {
+        return 0;
+    }
+
+    virtual const PrecomputedTransactionData* GetPrecomputedTransactionData() const
+    {
+        return nullptr;
+    }
+
+    virtual uint32_t GetnIn() const
+    {
+        return std::numeric_limits<uint32_t>::max();
+    }
+
     virtual ~BaseSignatureChecker() {}
 };
 
@@ -308,6 +347,14 @@ public:
     bool CheckSchnorrSignature(Span<const unsigned char> sig, Span<const unsigned char> pubkey, SigVersion sigversion, const ScriptExecutionData& execdata, ScriptError* serror = nullptr) const override;
     bool CheckLockTime(const CScriptNum& nLockTime) const override;
     bool CheckSequence(const CScriptNum& nSequence) const override;
+    const std::vector<CTxIn>* GetTxvIn() const override;
+    const std::vector<CTxOut>* GetTxvOut() const override;
+    uint32_t GetLockTime() const override;
+    int32_t GetTxVersion() const override;
+    uint64_t GetTxWeight() const override;
+
+    const PrecomputedTransactionData* GetPrecomputedTransactionData() const override;
+    uint32_t GetnIn() const override;
 };
 
 using TransactionSignatureChecker = GenericTransactionSignatureChecker<CTransaction>;
diff --git a/src/script/script.cpp b/src/script/script.cpp
index 4cca6c39ba..97dac97d01 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -147,6 +147,45 @@ std::string GetOpName(opcodetype opcode)
     // Opcode added by BIP 342 (Tapscript)
     case OP_CHECKSIGADD            : return "OP_CHECKSIGADD";
 
+    // Elements Tapscript opcodes
+    case OP_SHA256INITIALIZE       : return "OP_SHA256INITIALIZE";
+    case OP_SHA256UPDATE           : return "OP_SHA256UPDATE";
+    case OP_SHA256FINALIZE         : return "OP_SHA256FINALIZE";
+    case OP_INSPECTINPUTOUTPOINT   : return "OP_INSPECTINPUTOUTPOINT";
+    case OP_INSPECTINPUTASSET      : return "OP_INSPECTINPUTASSET";
+    case OP_INSPECTINPUTVALUE      : return "OP_INSPECTINPUTVALUE";
+    case OP_INSPECTINPUTSCRIPTPUBKEY : return "OP_INSPECTINPUTSCRIPTPUBKEY";
+    case OP_INSPECTINPUTSEQUENCE   : return "OP_INSPECTINPUTSEQUENCE";
+    case OP_INSPECTINPUTISSUANCE   : return "OP_INSPECTINPUTISSUANCE";
+    case OP_PUSHCURRENTINPUTINDEX  : return "OP_PUSHCURRENTINPUTINDEX";
+    case OP_INSPECTOUTPUTASSET     : return "OP_INSPECTOUTPUTASSET";
+    case OP_INSPECTOUTPUTVALUE     : return "OP_INSPECTOUTPUTVALUE";
+    case OP_INSPECTOUTPUTNONCE     : return "OP_INSPECTOUTPUTNONCE";
+    case OP_INSPECTOUTPUTSCRIPTPUBKEY : return "OP_INSPECTOUTPUTSCRIPTPUBKEY";
+    case OP_INSPECTVERSION         : return "OP_INSPECTVERSION";
+    case OP_INSPECTLOCKTIME        : return "OP_INSPECTLOCKTIME";
+    case OP_INSPECTNUMINPUTS       : return "OP_INSPECTNUMINPUTS";
+    case OP_INSPECTNUMOUTPUTS      : return "OP_INSPECTNUMOUTPUTS";
+    case OP_TXWEIGHT               : return "OP_TXWEIGHT";
+
+    // 64 bit LE arithmetic opcodes
+    case OP_ADD64                  : return "OP_ADD64";
+    case OP_SUB64                  : return "OP_SUB64";
+    case OP_MUL64                  : return "OP_MUL64";
+    case OP_DIV64                  : return "OP_DIV64";
+    case OP_NEG64                  : return "OP_NEG64";
+    case OP_LESSTHAN64             : return "OP_LESSTHAN64";
+    case OP_LESSTHANOREQUAL64      : return "OP_LESSTHANOREQUAL64";
+    case OP_GREATERTHAN64          : return "OP_GREATERTHAN64";
+    case OP_GREATERTHANOREQUAL64   : return "OP_GREATERTHANOREQUAL64";
+    case OP_SCRIPTNUMTOLE64        : return "OP_SCRIPTNUMTOLE64";
+    case OP_LE64TOSCRIPTNUM        : return "OP_LE64TOSCRIPTNUM";
+    case OP_LE32TOLE64             : return "OP_LE32TOLE64";
+
+    // Crypto opcodes
+    case OP_ECMULSCALARVERIFY      : return "OP_ECMULSCALARVERIFY";
+    case OP_TWEAKVERIFY            : return "OP_TWEAKVERIFY";
+
     case OP_INVALIDOPCODE          : return "OP_INVALIDOPCODE";
 
     default:
@@ -415,6 +454,7 @@ bool IsOpSuccess(const opcodetype& opcode)
     return opcode == 80 || opcode == 98 || (opcode >= 137 && opcode <= 138) ||
             // ELEMENTS: Don't mark OP_INVERT , OP_AND, OP_OR, OP_XOR. OP_LSHIFT, OP_RSHIFT as success
            (opcode >= 141 && opcode <= 142) || (opcode >= 149 && opcode <= 151) ||
-           // ELEMENTS: Exclude OP_DETERMINISTICRANDOM, OP_CHECKSIGFROMSTACK(VERIFY), OP_SUBSTRLAZY
-           (opcode >= 187 && opcode <= 191) || (opcode >= 196 && opcode <= 254);
+           // ELEMENTS: Exclude OP_DETERMINISTICRANDOM(192), OP_CHECKSIGFROMSTACK(VERIFY)(192-193), OP_SUBSTRLAZY(195)
+           // ELEMENTS: Tapscript extension from OP_SHA256INITIALIZE(196) till OP_TWEAKVERIFY(228)
+           (opcode >= 187 && opcode <= 191) || (opcode >= 229 && opcode <= 254);
 }
diff --git a/src/script/script.h b/src/script/script.h
index 89bcb90f0f..efff5fcfaf 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -213,11 +213,61 @@ enum opcodetype
     // Opcode added by BIP 342 (Tapscript)
     OP_CHECKSIGADD = 0xba,
 
+    // Elements: Tapscript (Streaming sha2 opcodes)
+    OP_SHA256INITIALIZE = 0xc4,
+    OP_SHA256UPDATE = 0xc5,
+    OP_SHA256FINALIZE = 0xc6,
+
+    // Introspection opcodes
+    //inputs
+    OP_INSPECTINPUTOUTPOINT = 0xc7,
+    OP_INSPECTINPUTASSET = 0xc8,
+    OP_INSPECTINPUTVALUE = 0xc9,
+    OP_INSPECTINPUTSCRIPTPUBKEY = 0xca,
+    OP_INSPECTINPUTSEQUENCE = 0xcb,
+    OP_INSPECTINPUTISSUANCE = 0xcc,
+
+    // current index
+    OP_PUSHCURRENTINPUTINDEX = 0xcd,
+
+    // outputs
+    OP_INSPECTOUTPUTASSET = 0xce,
+    OP_INSPECTOUTPUTVALUE = 0xcf,
+    OP_INSPECTOUTPUTNONCE = 0xd0,
+    OP_INSPECTOUTPUTSCRIPTPUBKEY = 0xd1,
+
+    // transaction
+    OP_INSPECTVERSION = 0xd2,
+    OP_INSPECTLOCKTIME = 0xd3,
+    OP_INSPECTNUMINPUTS = 0xd4,
+    OP_INSPECTNUMOUTPUTS = 0xd5,
+    OP_TXWEIGHT = 0xd6,
+
+    // Arithmetic opcodes
+    OP_ADD64 = 0xd7,
+    OP_SUB64 = 0xd8,
+    OP_MUL64 = 0xd9,
+    OP_DIV64 = 0xda,
+    OP_NEG64 = 0xdb,
+    OP_LESSTHAN64 = 0xdc,
+    OP_LESSTHANOREQUAL64 = 0xdd,
+    OP_GREATERTHAN64 = 0xde,
+    OP_GREATERTHANOREQUAL64 = 0xdf,
+
+    // Conversion opcodes
+    OP_SCRIPTNUMTOLE64 = 0xe0,
+    OP_LE64TOSCRIPTNUM = 0xe1,
+    OP_LE32TOLE64 = 0xe2,
+
+    // Crypto opcodes
+    OP_ECMULSCALARVERIFY = 0xe3,
+    OP_TWEAKVERIFY = 0xe4,
+
     OP_INVALIDOPCODE = 0xff,
 };
 
 // Maximum value that an opcode can be
-static const unsigned int MAX_OPCODE = OP_SUBSTR_LAZY; // 0xc3
+static const unsigned int MAX_OPCODE = OP_TWEAKVERIFY; // 0xe4
 
 std::string GetOpName(opcodetype opcode);
 
diff --git a/src/script/script_error.cpp b/src/script/script_error.cpp
index fadc04262c..438e86f2f2 100644
--- a/src/script/script_error.cpp
+++ b/src/script/script_error.cpp
@@ -115,6 +115,20 @@ std::string ScriptErrorString(const ScriptError serror)
             return "Using OP_CODESEPARATOR in non-witness script";
         case SCRIPT_ERR_SIG_FINDANDDELETE:
             return "Signature is found in scriptCode";
+        case SCRIPT_ERR_SHA2_CONTEXT_LOAD:
+            return "Invalid Sha256 context object read";
+        case SCRIPT_ERR_SHA2_CONTEXT_WRITE:
+            return "Invalid Sha256 context object write";
+        case SCRIPT_ERR_INTROSPECT_CONTEXT_UNAVAILABLE:
+            return "Introspection opcode used without correct evaluation context";
+        case SCRIPT_ERR_INTROSPECT_INDEX_OUT_OF_BOUNDS:
+            return "Introspection index out of bounds";
+        case SCRIPT_ERR_EXPECTED_8BYTES:
+            return "Arithmetic opcodes expect 8 bytes operands";
+        case SCRIPT_ERR_ARITHMETIC64:
+            return "Arithmetic opcode error";
+        case SCRIPT_ERR_ECMULTVERIFYFAIL:
+            return "EC scalar mult verify fail";
         case SCRIPT_ERR_UNKNOWN_ERROR:
         case SCRIPT_ERR_ERROR_COUNT:
         default: break;
diff --git a/src/script/script_error.h b/src/script/script_error.h
index e9b41c8178..1e9862454e 100644
--- a/src/script/script_error.h
+++ b/src/script/script_error.h
@@ -86,10 +86,20 @@ typedef enum ScriptError_t
 
     // ELEMENTS:
     SCRIPT_ERR_RANGEPROOF,
-    SCRIPT_ERR_PEDERSEN_TALLY
+    SCRIPT_ERR_PEDERSEN_TALLY,
+
+
+    /* Elements: New tapscript related errors */
+    SCRIPT_ERR_SHA2_CONTEXT_LOAD,
+    SCRIPT_ERR_SHA2_CONTEXT_WRITE,
+    SCRIPT_ERR_INTROSPECT_CONTEXT_UNAVAILABLE,
+    SCRIPT_ERR_INTROSPECT_INDEX_OUT_OF_BOUNDS,
+    SCRIPT_ERR_EXPECTED_8BYTES,
+    SCRIPT_ERR_ARITHMETIC64,
+    SCRIPT_ERR_ECMULTVERIFYFAIL
 } ScriptError;
 
-#define SCRIPT_ERR_LAST SCRIPT_ERR_ERROR_COUNT
+#define SCRIPT_ERR_LAST SCRIPT_ERR_ECMULTVERIFYFAIL
 
 std::string ScriptErrorString(const ScriptError error);
 
diff --git a/src/test/fuzz/witness_program.cpp b/src/test/fuzz/witness_program.cpp
new file mode 100644
index 0000000000..5f45b8f49d
--- /dev/null
+++ b/src/test/fuzz/witness_program.cpp
@@ -0,0 +1,145 @@
+// Copyright (c) 2009-2021 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <policy/policy.h>
+#include <pubkey.h>
+#include <secp256k1.h>
+#include <secp256k1_schnorrsig.h>
+#include <script/interpreter.h>
+#include <span.h>
+#include <streams.h>
+
+#include <test/fuzz/fuzz.h>
+
+class DummySigChecker : public MutableTransactionSignatureChecker {
+    bool CheckECDSASignature(const std::vector<unsigned char>& vchSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion, unsigned int flags) const override { return !vchSig.empty() && vchSig[0] > 0x80; }
+
+    bool CheckSchnorrSignature(Span<const unsigned char> sig, Span<const unsigned char> pubkey, SigVersion sigversion, const ScriptExecutionData& execdata, ScriptError* serror = nullptr) const override { return !sig.empty() && sig[0] > 0x80; }
+
+public:
+    DummySigChecker(const CMutableTransaction* txToIn, unsigned int nInIn, const CConfidentialValue& amountIn, const PrecomputedTransactionData& txdataIn, MissingDataBehavior mdb) : MutableTransactionSignatureChecker{txToIn, nInIn, amountIn, txdataIn, mdb} {}
+};
+
+void initialize_witness_program()
+{
+    static const ECCVerifyHandle verify_handle;
+}
+
+FUZZ_TARGET_INIT(witness_program, initialize_witness_program)
+{
+    CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
+    try {
+        CMutableTransaction tx;
+        unsigned int nIn;
+        CConfidentialValue amountIn;
+        ds >> tx;
+        ds >> nIn;
+        ds >> amountIn;
+
+        if (tx.vin.empty() || tx.witness.vtxinwit.size() != tx.vin.size()) {
+            return; // if we have no inputs then our script environment doesn't make sense
+        }
+        nIn %= tx.vin.size();
+        PrecomputedTransactionData txdata{};
+
+        CScriptWitness witness;
+        int fuzz_control;
+        int flags;
+        ds >> fuzz_control;
+        ds >> witness.stack;
+        ds >> flags;
+
+        if ((flags & SCRIPT_VERIFY_CLEANSTACK) != 0) {
+            flags |= SCRIPT_VERIFY_P2SH;
+            flags |= SCRIPT_VERIFY_WITNESS;
+        }
+        if ((flags & SCRIPT_VERIFY_WITNESS) != 0) {
+            flags |= SCRIPT_VERIFY_P2SH;
+        }
+
+        /* segwit v0 */
+        std::vector<unsigned char> program;
+        ds >> program;
+
+        if (fuzz_control & 1) {
+            unsigned char hash_program[32];
+            CSHA256().Write(&program[0], program.size()).Finalize(hash_program);
+            CScript scriptPubKey = CScript{} << OP_0 << std::vector<unsigned char>(hash_program, hash_program + sizeof(hash_program));
+            witness.stack.push_back(program);
+
+            std::vector<CTxOut> spent_outs{};
+            for (unsigned int i = 0; i < tx.vin.size(); i++) {
+                CConfidentialAsset asset;
+                CConfidentialValue value;
+                ds >> asset;
+                ds >> value;
+                if (asset.IsNull() || value.IsNull()) {
+                    // this asserts in the interpreter, and are impossible to hit with real transactions
+                    return;
+                }
+                if (i == nIn) {
+                    spent_outs.push_back(CTxOut{asset, value, scriptPubKey});
+                } else {
+                    CScript script;
+                    ds >> script;
+                    spent_outs.push_back(CTxOut{asset, value, script});
+                }
+                tx.witness.vtxinwit[i].scriptWitness.stack.push_back(program);
+            }
+            txdata.Init(tx, std::move(spent_outs));
+            DummySigChecker checker{&tx, nIn, amountIn, txdata, MissingDataBehavior::ASSERT_FAIL};
+
+            VerifyScript(/* scriptSig */ CScript{}, scriptPubKey, &witness, flags, checker, /* serror */ NULL);
+        /* segwit v1 (taproot) */
+        } else {
+            /* Generate keys */
+            uint256 xonlypk;
+            ds >> xonlypk;
+            XOnlyPubKey intkey(xonlypk);
+
+            uint256 tapleaf_hash = (CHashWriter(HASHER_TAPLEAF_ELEMENTS) << uint8_t(TAPROOT_LEAF_TAPSCRIPT) << program).GetSHA256();
+            auto extkey_parity = intkey.CreateTapTweak(&tapleaf_hash);
+            if (!extkey_parity) {
+                return;
+            }
+
+            /* Serialize keys */
+            CScript scriptPubKey = CScript{} << OP_1 << std::vector<unsigned char>(extkey_parity->first.begin(), extkey_parity->first.end());
+            witness.stack.push_back(program);
+
+            std::vector<unsigned char> control;
+            control.push_back(TAPROOT_LEAF_TAPSCRIPT | extkey_parity->second);
+            control.insert(control.end(), intkey.begin(), intkey.end());
+            witness.stack.push_back(control);
+
+            std::vector<CTxOut> spent_outs{};
+            for (unsigned int i = 0; i < tx.vin.size(); i++) {
+                CConfidentialAsset asset;
+                CConfidentialValue value;
+                ds >> asset;
+                ds >> value;
+                if (asset.IsNull() || value.IsNull()) {
+                    // this asserts in the interpreter, and are impossible to hit with real transactions
+                    return;
+                }
+                if (i == nIn) {
+                    spent_outs.push_back(CTxOut{asset, value, scriptPubKey});
+                } else {
+                    CScript script;
+                    ds >> script;
+                    spent_outs.push_back(CTxOut{asset, value, script});
+                }
+                tx.witness.vtxinwit[i].scriptWitness.stack.push_back(program);
+                tx.witness.vtxinwit[i].scriptWitness.stack.push_back(control);
+            }
+            txdata.Init(tx, std::move(spent_outs));
+            GenericTransactionSignatureChecker checker{&tx, nIn, amountIn, txdata, MissingDataBehavior::ASSERT_FAIL};
+
+            VerifyScript(/* scriptSig */ CScript{}, scriptPubKey, &witness, flags, checker, /* serror */ NULL);
+        }
+    } catch (const std::ios_base::failure&) {
+        return;
+    }
+}
+
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index fc3d95861b..f8e1341ba1 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1469,7 +1469,7 @@ BOOST_AUTO_TEST_CASE(script_HasValidOps)
     BOOST_CHECK(script.HasValidOps());
     script = ScriptFromHex("ff88ac"); // Script with OP_INVALIDOPCODE explicit
     BOOST_CHECK(!script.HasValidOps());
-    script = ScriptFromHex("88acc4"); // Script with undefined opcode: one higher then MAX_OPCODE
+    script = ScriptFromHex("88ace5"); // Script with undefined opcode: one higher then MAX_OPCODE
     BOOST_CHECK(!script.HasValidOps());
 }
 
diff --git a/test/functional/feature_tapscript_opcodes.py b/test/functional/feature_tapscript_opcodes.py
new file mode 100755
index 0000000000..b3398f8dbb
--- /dev/null
+++ b/test/functional/feature_tapscript_opcodes.py
@@ -0,0 +1,590 @@
+#!/usr/bin/env python3
+# Copyright (c) 2014-2016 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#
+# Test for taproot sighash algorithm with pegins and issuances
+
+from random import randint
+from test_framework.util import BITCOIN_ASSET_BYTES, assert_raises_rpc_error, satoshi_round
+from test_framework.key import ECKey, ECPubKey, compute_xonly_pubkey, generate_privkey, sign_schnorr, tweak_add_privkey, tweak_add_pubkey, verify_schnorr
+from test_framework.messages import COIN, COutPoint, CTransaction, CTxIn, CTxInWitness, CTxOut, CTxOutNonce, CTxOutValue, CTxOutWitness, ser_uint256, sha256, tx_from_hex, uint256_from_str
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.script import CScript, CScriptNum, CScriptOp, OP_0, OP_1, OP_2, OP_3, OP_4, OP_5, OP_6, OP_7, OP_ADD64, OP_AND, OP_CAT, OP_CHECKSIGFROMSTACK, OP_DIV64, OP_DROP, OP_DUP, OP_ECMULSCALARVERIFY, OP_ELSE, OP_EQUAL, OP_EQUALVERIFY, OP_FALSE, OP_FROMALTSTACK, OP_GREATERTHAN64, OP_GREATERTHANOREQUAL64, OP_INSPECTINPUTASSET, OP_INSPECTINPUTISSUANCE, OP_INSPECTINPUTOUTPOINT, OP_INSPECTINPUTSCRIPTPUBKEY, OP_INSPECTINPUTSEQUENCE, OP_INSPECTINPUTVALUE, OP_INSPECTLOCKTIME, OP_INSPECTNUMINPUTS, OP_INSPECTNUMOUTPUTS, OP_INSPECTOUTPUTASSET, OP_INSPECTOUTPUTNONCE, OP_INSPECTOUTPUTSCRIPTPUBKEY, OP_INSPECTOUTPUTVALUE, OP_IF, OP_INSPECTVERSION, OP_LE32TOLE64, OP_LE64TOSCRIPTNUM, OP_LESSTHAN64, OP_LESSTHANOREQUAL64, OP_MUL64, OP_NEG64, OP_NOT, OP_INVERT, OP_NOTIF, OP_OR, OP_PUSHCURRENTINPUTINDEX, OP_SCRIPTNUMTOLE64, OP_SHA256FINALIZE, OP_SHA256INITIALIZE, OP_SHA256UPDATE, OP_SIZE, OP_SUB64, OP_SWAP, OP_TWEAKVERIFY, OP_TOALTSTACK, OP_TXWEIGHT, OP_VERIFY, OP_XOR, OP_XOR, TaprootSignatureHash, taproot_construct, SIGHASH_DEFAULT, SIGHASH_ALL, SIGHASH_NONE, SIGHASH_SINGLE, SIGHASH_ANYONECANPAY
+
+import os
+
+VALID_SIGHASHES_ECDSA = [
+    SIGHASH_ALL,
+    SIGHASH_NONE,
+    SIGHASH_SINGLE,
+    SIGHASH_ANYONECANPAY + SIGHASH_ALL,
+    SIGHASH_ANYONECANPAY + SIGHASH_NONE,
+    SIGHASH_ANYONECANPAY + SIGHASH_SINGLE
+]
+
+VALID_SIGHASHES_TAPROOT = [SIGHASH_DEFAULT] + VALID_SIGHASHES_ECDSA
+
+class TapHashPeginTest(BitcoinTestFramework):
+
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 1
+        self.extra_args = [
+            ["-initialfreecoins=2100000000000000",
+             "-anyonecanspendaremine=1",
+            "-blindedaddresses=1",
+            "-validatepegin=0",
+            "-con_parent_chain_signblockscript=51",
+            "-parentscriptprefix=75",
+            "-parent_bech32_hrp=ert",
+            "-minrelaytxfee=0",
+            "-maxtxfee=100.0",
+        ]]
+
+    def skip_test_if_missing_module(self):
+        self.skip_if_no_wallet()
+
+    def setup_network(self, split=False):
+        self.setup_nodes()
+
+
+    def get_utxo(self, fund_tx, idx):
+        spent = None
+        # Coin selection
+        for utxo in self.nodes[0].listunspent():
+            if utxo["txid"] == ser_uint256(fund_tx.vin[idx].prevout.hash)[::-1].hex() and utxo["vout"] == fund_tx.vin[idx].prevout.n:
+                spent = utxo
+
+        assert(spent is not None)
+        assert(len(fund_tx.vin) == 2)
+        return spent
+
+    def create_taproot_utxo(self, scripts = None, blind = False):
+        # modify the transaction to add one output that should spend previous taproot
+        # Create a taproot prevout
+        addr = self.nodes[0].getnewaddress()
+
+        sec = generate_privkey()
+        pub = compute_xonly_pubkey(sec)[0]
+        tap = taproot_construct(pub, scripts)
+        spk = tap.scriptPubKey
+
+        # No need to test blinding in this unit test
+        unconf_addr = self.nodes[0].getaddressinfo(addr)['unconfidential']
+
+        raw_tx = self.nodes[0].createrawtransaction([], [{unconf_addr: 1.2}])
+        # edit spk directly, no way to get new address.
+        # would need to implement bech32m in python
+        tx = tx_from_hex(raw_tx)
+        tx.vout[0].scriptPubKey = spk
+        tx.vout[0].nValue = CTxOutValue(12*10**7)
+        raw_hex = tx.serialize().hex()
+
+        fund_tx = self.nodes[0].fundrawtransaction(raw_hex, False, )["hex"]
+        fund_tx = tx_from_hex(fund_tx)
+
+        # Createrawtransaction might rearrage txouts
+        prev_vout = None
+        for i, out in enumerate(fund_tx.vout):
+            if spk == out.scriptPubKey:
+                prev_vout = i
+
+        tx = self.nodes[0].blindrawtransaction(fund_tx.serialize().hex())
+        signed_raw_tx = self.nodes[0].signrawtransactionwithwallet(tx)
+        _txid = self.nodes[0].sendrawtransaction(signed_raw_tx['hex'])
+        tx = tx_from_hex(signed_raw_tx['hex'])
+        tx.rehash()
+        self.nodes[0].generate(1)
+        last_blk = self.nodes[0].getblock(self.nodes[0].getbestblockhash())
+        assert(tx.hash in last_blk['tx'])
+
+        return tx, prev_vout, spk, sec, pub, tap
+
+    def tapscript_satisfy_test(self, script, inputs = [], add_issuance = False,
+        add_pegin = False, fail=None, add_prevout=False, add_asset=False,
+        add_value=False, add_spk = False, seq = 0, add_out_spk = None,
+        add_out_asset = None, add_out_value = None, add_out_nonce = None,
+        ver = 2, locktime = 0, add_num_outputs=False, add_weight=False, blind=False):
+        # Create a taproot utxo
+        scripts = [("s0", script)]
+        prev_tx, prev_vout, spk, sec, pub, tap = self.create_taproot_utxo(scripts)
+
+        if add_pegin:
+            fund_info = self.nodes[0].getpeginaddress()
+            peg_id = self.nodes[0].sendtoaddress(fund_info["mainchain_address"], 1)
+            raw_peg_tx = self.nodes[0].gettransaction(peg_id)["hex"]
+            peg_txid = self.nodes[0].sendrawtransaction(raw_peg_tx)
+            self.nodes[0].generate(101)
+            peg_prf = self.nodes[0].gettxoutproof([peg_txid])
+            claim_script = fund_info["claim_script"]
+
+            raw_claim = self.nodes[0].createrawpegin(raw_peg_tx, peg_prf, claim_script)
+            tx = tx_from_hex(raw_claim['hex'])
+        else:
+            tx = CTransaction()
+
+        tx.nVersion = ver
+        tx.nLockTime = locktime
+        # Spend the pegin and taproot tx together
+        in_total = prev_tx.vout[prev_vout].nValue.getAmount()
+        fees = 1000
+        tap_in_pos = 0
+
+        if blind:
+             # Add an unrelated output
+            key = ECKey()
+            key.generate()
+            tx.vout.append(CTxOut(nValue = CTxOutValue(10000), scriptPubKey = spk, nNonce=CTxOutNonce(key.get_pubkey().get_bytes())))
+
+            tx_hex = self.nodes[0].fundrawtransaction(tx.serialize().hex())
+            tx = tx_from_hex(tx_hex['hex'])
+
+        tx.vin.append(CTxIn(COutPoint(prev_tx.sha256, prev_vout), nSequence=seq))
+        tx.vout.append(CTxOut(nValue = CTxOutValue(in_total - fees), scriptPubKey = spk)) # send back to self
+        tx.vout.append(CTxOut(CTxOutValue(fees)))
+
+        if add_issuance:
+            blind_addr = self.nodes[0].getnewaddress()
+            issue_addr = self.nodes[0].validateaddress(blind_addr)['unconfidential']
+            # Issuances only require one fee output and that output must the last
+            # one. However the way, the current code is structured, it is not possible
+            # to this in a super clean without special casing.
+            if add_pegin:
+                tx.vout.pop()
+                tx.vout.pop()
+                tx.vout.insert(0, CTxOut(nValue = CTxOutValue(in_total), scriptPubKey = spk)) # send back to self)
+            issued_tx = self.nodes[0].rawissueasset(tx.serialize().hex(), [{"asset_amount":2, "asset_address":issue_addr, "blind":False}])[0]["hex"]
+            tx = tx_from_hex(issued_tx)
+        # Sign inputs
+        if add_pegin:
+            signed = self.nodes[0].signrawtransactionwithwallet(tx.serialize().hex())
+            tx = tx_from_hex(signed['hex'])
+            tap_in_pos += 1
+        else:
+            # Need to create empty witness when not deserializing from rpc
+            tx.wit.vtxinwit.append(CTxInWitness())
+
+        if blind:
+            tx.vin[0], tx.vin[1] = tx.vin[1], tx.vin[0]
+            utxo = self.get_utxo(tx, 1)
+            zero_str = "0"*64
+            blinded_raw = self.nodes[0].rawblindrawtransaction(tx.serialize().hex(), [zero_str, utxo["amountblinder"]], [1.2, utxo['amount']], [utxo['asset'], utxo['asset']], [zero_str, utxo['assetblinder']])
+            tx = tx_from_hex(blinded_raw)
+            signed_raw_tx = self.nodes[0].signrawtransactionwithwallet(tx.serialize().hex())
+            tx = tx_from_hex(signed_raw_tx['hex'])
+
+
+        suffix_annex = []
+        control_block = bytes([tap.leaves["s0"].version + tap.negflag]) + tap.internal_pubkey + tap.leaves["s0"].merklebranch
+        # Add the prevout to the top of inputs. The witness script will check for equality.
+        if add_prevout:
+            inputs = [prev_vout.to_bytes(4, 'little'), ser_uint256(prev_tx.sha256)]
+        if add_asset:
+            assert blind # only used with blinding in testing
+            utxo = self.nodes[0].gettxout(ser_uint256(tx.vin[1].prevout.hash)[::-1].hex(), tx.vin[1].prevout.n)
+            if "assetcommitment" in utxo:
+                asset = bytes.fromhex(utxo["assetcommitment"])
+            else:
+                asset = b"\x01" + bytes.fromhex(utxo["asset"])[::-1]
+            inputs = [asset[0:1], asset[1:33]]
+        if add_value:
+            utxo = self.nodes[0].gettxout(ser_uint256(tx.vin[1].prevout.hash)[::-1].hex(), tx.vin[1].prevout.n)
+            if "valuecommitment" in utxo:
+                value = bytes.fromhex(utxo["valuecommitment"])
+                inputs = [value[0:1], value[1:33]]
+            else:
+                value = b"\x01" + int(satoshi_round(utxo["value"])*COIN).to_bytes(8, 'little')
+                inputs = [value[0:1], value[1:9]]
+        if add_spk:
+            ver = CScriptOp.decode_op_n(int.from_bytes(spk[0:1], 'little'))
+            inputs = [CScriptNum.encode(CScriptNum(ver))[1:], spk[2:len(spk)]] # always segwit
+
+        # Add witness for outputs
+        if add_out_asset is not None:
+            asset = tx.vout[add_out_asset].nAsset.vchCommitment
+            inputs = [asset[0:1], asset[1:33]]
+        if add_out_value is not None:
+            value = tx.vout[add_out_value].nValue.vchCommitment
+            if len(value) == 9:
+                inputs = [value[0:1], value[1:9][::-1]]
+            else:
+                inputs = [value[0:1], value[1:33]]
+        if add_out_nonce is not None:
+            nonce = tx.vout[add_out_nonce].nNonce.vchCommitment
+            if len(nonce) == 1:
+                inputs = [b'']
+            else:
+                inputs = [nonce]
+        if add_out_spk is not None:
+            out_spk  = tx.vout[add_out_spk].scriptPubKey
+            if len(out_spk) == 0:
+                # Python upstream encoding CScriptNum interesting behaviour where it also encodes the length
+                # This assumes the implicit wallet behaviour of using segwit outputs.
+                # This is useful while sending scripts, but not while using CScriptNums in constructing scripts
+                inputs = [CScriptNum.encode(CScriptNum(-1))[1:], sha256(out_spk)]
+            else:
+                ver = CScriptOp.decode_op_n(int.from_bytes(out_spk[0:1], 'little'))
+                inputs = [CScriptNum.encode(CScriptNum(ver))[1:], out_spk[2:len(out_spk)]] # always segwit
+        if add_num_outputs:
+            num_outs = len(tx.vout)
+            inputs = [CScriptNum.encode(CScriptNum(num_outs))[1:]]
+        if add_weight:
+            # Add a dummy input and check the overall weight
+            inputs = [int(5).to_bytes(8, 'little')]
+            wit = inputs + [bytes(tap.leaves["s0"].script), control_block] + suffix_annex
+            tx.wit.vtxinwit[tap_in_pos].scriptWitness.stack = wit
+
+            exp_weight = self.nodes[0].decoderawtransaction(tx.serialize().hex())["weight"]
+            inputs = [exp_weight.to_bytes(8, 'little')]
+        wit = inputs + [bytes(tap.leaves["s0"].script), control_block] + suffix_annex
+        tx.wit.vtxinwit[tap_in_pos].scriptWitness.stack = wit
+
+        if fail:
+            assert_raises_rpc_error(-26, fail, self.nodes[0].sendrawtransaction, tx.serialize().hex())
+            return
+
+
+        self.nodes[0].sendrawtransaction(hexstring = tx.serialize().hex())
+        self.nodes[0].generate(1)
+        last_blk = self.nodes[0].getblock(self.nodes[0].getbestblockhash())
+        tx.rehash()
+        assert(tx.hash in last_blk['tx'])
+
+
+    def run_test(self):
+        self.nodes[0].generate(101)
+        self.wait_until(lambda: self.nodes[0].getblockcount() == 101, timeout=5)
+        # Test whether the above test framework is working
+        self.log.info("Test simple op_1")
+        self.tapscript_satisfy_test(CScript([OP_1]))
+
+        # Test streaming sha256
+        # All preimages upto len 80 can be filled in a single standard witness element
+        # Testing only random even len for speedup
+        self.log.info("Testing streaming SHA256")
+        for k in range(0, 81, 2):
+            preimage = os.urandom(k)
+            hash = sha256(preimage)
+            self.tapscript_satisfy_test(CScript([OP_SHA256INITIALIZE, OP_SWAP, OP_SHA256FINALIZE, hash, OP_EQUAL]), inputs = [bytes(0), preimage])
+
+        # All preimages greater than 80 require Cating the elements
+        # But this only works till 520 bytes, streaming opcodes can
+        # be when dealing with more than 520 bytes
+        # Also adds a test when the sha256 buffer is full
+        for pre_len in [64*i for i in range(2, 10)] + [100, 520, 521, 800, 1000, 10000]:
+            preimage = os.urandom(pre_len)
+            hash = sha256(preimage)
+            # Split into chunks of 80
+            wit = [preimage[i:min(i + 80, len(preimage))] for i in range(0, len(preimage), 80)]
+            script = CScript([OP_SHA256INITIALIZE] + [OP_SWAP, OP_SHA256UPDATE]*(len(wit)-2) + [OP_SWAP, OP_SHA256FINALIZE, hash, OP_EQUAL])
+            self.tapscript_satisfy_test(script, wit[::-1])
+
+        # Test introspection opcodes
+        # 1a. No Pegins/issuances
+        self.log.info("Instrospection tests: outpoint flag")
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTOUTPOINT, b'\x00', OP_EQUALVERIFY, OP_DROP, OP_DROP, OP_1]))
+        # 1b. Add a pegin (Test pegin input must be 0x40)
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTOUTPOINT, b'\x40', OP_EQUALVERIFY, OP_DROP, OP_DROP, OP_1]), add_pegin=True)
+        # 1c. Add pegin (The non-pegin input must be push 0x00)
+        self.tapscript_satisfy_test(CScript([OP_1, OP_INSPECTINPUTOUTPOINT, b'\x00', OP_EQUALVERIFY, OP_DROP, OP_DROP, OP_1]), add_pegin=True)
+        # 1d. Add an issuance
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTOUTPOINT, b'\x80', OP_EQUALVERIFY, OP_DROP, OP_DROP, OP_1]), add_issuance=True)
+        # 1e. Both issuance and pegins together
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTOUTPOINT, b'\xc0', OP_EQUALVERIFY, OP_DROP, OP_DROP, OP_1]), add_pegin = True, add_issuance=True)
+        # 1f. Failure test case
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTOUTPOINT, b'\x00', OP_EQUALVERIFY, OP_DROP, OP_DROP, OP_1]), add_pegin = True, add_issuance=True, fail="Script failed an OP_EQUALVERIFY operation")
+
+        # Test opcode for inspecting prev tx
+        self.log.info("Instrospection tests: inputs")
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTOUTPOINT, b'\x00', OP_EQUALVERIFY, OP_TOALTSTACK, OP_EQUALVERIFY, OP_FROMALTSTACK, OP_EQUAL]), add_prevout=True)
+
+        # Test taproot asset with blinding.
+        self.tapscript_satisfy_test(CScript([OP_1]), blind=True)
+
+        # 2 Test asset(explicit and conf)
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTASSET, 1, OP_EQUALVERIFY, BITCOIN_ASSET_BYTES, OP_EQUAL]))
+        for _ in range(5): # run multiple times for wallet to select conf utxos
+            self.tapscript_satisfy_test(CScript([OP_1, OP_INSPECTINPUTASSET, OP_TOALTSTACK, OP_EQUALVERIFY, OP_FROMALTSTACK, OP_EQUAL]), blind=True, add_asset=True)
+
+        # 3 Test asset(explicit and conf)
+        amt = 12*10**7
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTVALUE, 1, OP_EQUALVERIFY, amt.to_bytes(8, 'little'), OP_EQUAL]))
+        for _ in range(5): # run multiple times for wallet to select conf utxos
+            self.tapscript_satisfy_test(CScript([OP_1, OP_INSPECTINPUTVALUE, OP_TOALTSTACK, OP_EQUALVERIFY, OP_FROMALTSTACK, OP_EQUAL]), blind=True, add_value=True)
+
+        # 4 Test scriptpubkey
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTSCRIPTPUBKEY, OP_TOALTSTACK, OP_EQUALVERIFY, OP_FROMALTSTACK, OP_EQUAL]), add_spk = True)
+
+        # 5 Test nSequence
+        one, two = 1, 2
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTSEQUENCE, one.to_bytes(4, 'little'), OP_EQUAL]), seq = 1)
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTSEQUENCE, two.to_bytes(4, 'little'), OP_EQUAL]), seq = 1, fail="Script evaluated without error but finished with a false/empty top stack element")
+
+        # 6 Test issuances
+        # No issaunce
+        self.tapscript_satisfy_test(CScript([OP_0, OP_INSPECTINPUTISSUANCE, OP_FALSE, OP_EQUAL]))
+        # Issuance with 2 units
+        asset_issue_amount = 2*COIN
+        self.tapscript_satisfy_test(CScript([
+            OP_0, OP_INSPECTINPUTISSUANCE,
+            # Check blinding nonce is zero
+            bytes(32), OP_EQUALVERIFY,
+            # Check the entropy is 32 bytes
+            OP_SIZE, 32, OP_EQUALVERIFY, OP_DROP,
+            # Check the explicit issue amount
+            1, OP_EQUALVERIFY, asset_issue_amount.to_bytes(8, 'little'), OP_EQUALVERIFY,
+            # Last inflation keys is null, check it as explicit `0` LE 8
+            1, OP_EQUALVERIFY, int(0).to_bytes(8, 'little'), OP_EQUAL
+        ]), add_issuance=True)
+
+        # Input index out of bounds
+        self.tapscript_satisfy_test(CScript([120, OP_1, OP_INSPECTINPUTASSET, OP_FALSE, OP_EQUAL]), fail="Introspection index out of bounds")
+        self.tapscript_satisfy_test(CScript([-1, OP_1, OP_INSPECTINPUTVALUE, OP_FALSE, OP_EQUAL]), fail="Introspection index out of bounds")
+
+        # Test current input
+        self.log.info("Instrospection tests: current input index")
+        self.tapscript_satisfy_test(CScript([OP_PUSHCURRENTINPUTINDEX, OP_0, OP_EQUAL]))
+        self.tapscript_satisfy_test(CScript([OP_PUSHCURRENTINPUTINDEX, OP_1, OP_EQUAL]), fail="Script evaluated without error but finished with a false/empty top stack element")
+
+        # Test Outputs
+        self.log.info("Instrospection tests: outputs")
+        for blind in [True, False]:
+            for out_pos in [0, 1]:
+                self.tapscript_satisfy_test(CScript([out_pos, OP_INSPECTOUTPUTASSET, OP_TOALTSTACK, OP_EQUALVERIFY, OP_FROMALTSTACK, OP_EQUAL]), blind=blind, add_out_asset=out_pos)
+                self.tapscript_satisfy_test(CScript([out_pos, OP_INSPECTOUTPUTVALUE, OP_TOALTSTACK, OP_EQUALVERIFY, OP_FROMALTSTACK, OP_EQUAL]), blind=blind, add_out_value=out_pos)
+                self.tapscript_satisfy_test(CScript([out_pos, OP_INSPECTOUTPUTNONCE, OP_EQUAL]), blind=blind, add_out_nonce=out_pos)
+                self.tapscript_satisfy_test(CScript([out_pos, OP_INSPECTOUTPUTSCRIPTPUBKEY, OP_TOALTSTACK, OP_EQUALVERIFY, OP_FROMALTSTACK, OP_EQUALVERIFY, OP_1]), blind=blind, add_out_spk=out_pos)
+
+        # Test that output index out of bounds fail
+        self.tapscript_satisfy_test(CScript([120, OP_INSPECTOUTPUTASSET, OP_FALSE, OP_EQUAL]), fail="Introspection index out of bounds")
+        self.tapscript_satisfy_test(CScript([-1, OP_INSPECTOUTPUTVALUE, OP_FALSE, OP_EQUAL]), fail="Introspection index out of bounds")
+
+        # Finally, check the tx instrospection
+        self.log.info("Instrospection tests: tx")
+        # Test version equality
+        self.tapscript_satisfy_test(CScript([OP_INSPECTVERSION, int(2).to_bytes(4, 'little'), OP_EQUAL]), ver = 2)
+        self.tapscript_satisfy_test(CScript([OP_INSPECTVERSION, int(5).to_bytes(4, 'little'), OP_EQUAL]), ver = 2, fail="Script evaluated without error but finished with a false/empty top stack element")
+
+        # Test nlocktime
+        self.tapscript_satisfy_test(CScript([OP_INSPECTLOCKTIME, int(7).to_bytes(4, 'little'), OP_EQUAL]), locktime = 7)
+        self.tapscript_satisfy_test(CScript([OP_INSPECTLOCKTIME, int(7).to_bytes(4, 'little'), OP_EQUAL]), locktime = 10, fail="Script evaluated without error but finished with a false/empty top stack element")
+
+        # Test num_inputs
+        self.tapscript_satisfy_test(CScript([OP_INSPECTNUMINPUTS, OP_1, OP_EQUAL]))
+        self.tapscript_satisfy_test(CScript([OP_INSPECTNUMINPUTS, OP_2, OP_EQUAL]), fail="Script evaluated without error but finished with a false/empty top stack element")
+
+        # Test num_outputs
+        self.tapscript_satisfy_test(CScript([OP_INSPECTNUMOUTPUTS, OP_EQUAL]), add_num_outputs= True)
+
+        # Test tx wieght
+        self.tapscript_satisfy_test(CScript([OP_TXWEIGHT, OP_EQUAL]), add_weight= True)
+
+        # short handle to convert int to 8 byte LE
+        def le8(x, signed=True):
+            return int(x).to_bytes(8, 'little', signed=signed)
+
+        def check_add(a, b, c, fail=None):
+            self.tapscript_satisfy_test(CScript([OP_ADD64, OP_VERIFY, le8(c), OP_EQUAL]), inputs = [le8(a), le8(b)], fail=fail)
+        def check_sub(a, b, c, fail=None):
+            self.tapscript_satisfy_test(CScript([OP_SUB64, OP_VERIFY, le8(c), OP_EQUAL]), inputs = [le8(a), le8(b)], fail=fail)
+        def check_mul(a, b, c, fail=None):
+            self.tapscript_satisfy_test(CScript([OP_MUL64, OP_VERIFY, le8(c), OP_EQUAL]), inputs = [le8(a), le8(b)], fail=fail)
+        def check_div(a, b, q, r, fail=None):
+            self.tapscript_satisfy_test(CScript([OP_DIV64, OP_VERIFY, le8(q), OP_EQUALVERIFY, le8(r), OP_EQUAL]), inputs = [le8(a), le8(b)], fail=fail)
+        def check_le(a, b, res, fail=None):
+            self.tapscript_satisfy_test(CScript([OP_LESSTHAN64, res, OP_EQUAL]), inputs = [le8(a), le8(b)], fail=fail)
+        def check_leq(a, b, res, fail=None):
+            self.tapscript_satisfy_test(CScript([OP_LESSTHANOREQUAL64, res, OP_EQUAL]), inputs = [le8(a), le8(b)], fail=fail)
+        def check_ge(a, b, res, fail=None):
+            self.tapscript_satisfy_test(CScript([OP_GREATERTHAN64, res, OP_EQUAL]), inputs = [le8(a), le8(b)], fail=fail)
+        def check_geq(a, b, res, fail=None):
+            self.tapscript_satisfy_test(CScript([OP_GREATERTHANOREQUAL64, res, OP_EQUAL]), inputs = [le8(a), le8(b)], fail=fail)
+        def check_neg(a, res, fail=None):
+            self.tapscript_satisfy_test(CScript([OP_NEG64, OP_VERIFY, le8(res), OP_EQUAL]), inputs = [le8(a)], fail=fail)
+        # Arithematic opcodes
+        self.log.info("Check Arithmetic opcodes")
+        check_add(5, 5, 10)
+        check_add(-5, -5, -10)
+        check_add(-5, 5, 0)
+        check_add(14231, -123213, 14231 - 123213)
+        check_add(2**63 - 1, 5, 4, fail="Script failed an OP_VERIFY operation")#overflow
+        check_add(5, 2**63 - 1, 4, fail="Script failed an OP_VERIFY operation")#overflow
+        check_add(-5, -2**63 + 1, -4, fail="Script failed an OP_VERIFY operation")#overflow
+
+        # Substraction
+        check_sub(5, 6, -1)
+        check_sub(-5, 6, -11)
+        check_sub(-5, -5, 0)
+        check_sub(14231, -123213, 14231 + 123213)
+        check_sub(2**63 - 1, 4, 2**63 - 5)
+        check_sub(-5, 2**63 - 1, -4, fail="Script failed an OP_VERIFY operation")#overflow
+        check_sub(2**63 - 1, -4, 5, fail="Script failed an OP_VERIFY operation")#overflow
+
+        # Multiplication
+        check_mul(5, 6, 30)
+        check_mul(-5, 6, -30)
+        check_mul(-5, 0, 0)
+        check_mul(-5, -6, 30)
+        check_mul(14231, -123213, -14231 * 123213)
+        check_mul(2**32, 2**31 - 1, 2**63 - 2**32)
+        check_mul(2**32, 2**31, 0, fail="Script failed an OP_VERIFY operation")#overflow
+        check_mul(-2**32, 2**31, -2**63)# no  overflow
+        check_mul(-2**32, -2**32, 0, fail="Script failed an OP_VERIFY operation")#overflow
+
+        # Division
+        check_div(5, 6, 0, 5)
+        check_div(4, 2, 2, 0)
+        check_div(-5, 6, -1, 1) # r must be in 0<=r<a
+        check_div(5, -6, 0, 5) # r must be in 0<=r<a
+        check_div(-5, 0, 0, 0, fail="Script failed an OP_VERIFY operation") # only fails if b = 0
+        check_div(-2**63, -1, 0, 0, fail="Script failed an OP_VERIFY operation") # failure on -2**63/-1
+        check_div(6213123213513, 621, 6213123213513//621, 6213123213513 % 621)
+        check_div(2**62, 2**31, 2**31, 0)
+
+        # Less than test
+        # Comparison tests
+        # Less than
+        check_le(5, 6, 1)
+        check_le(5, 5, 0)
+        check_le(6, 5, 0)
+
+        # Less than equal
+        check_leq(5, 6, 1)
+        check_leq(5, 5, 1)
+        check_leq(6, 5, 0)
+
+        # Greater than
+        check_ge(5, 6, 0)
+        check_ge(5, 5, 0)
+        check_ge(6, 5, 1)
+
+        # Greater than equal
+        check_geq(5, 6, 0)
+        check_geq(5, 5, 1)
+        check_geq(6, 5, 1)
+
+        # equal
+        check_neg(5, -5)
+        check_neg(-5, 5)
+        check_neg(5, 4, fail="Script evaluated without error but finished with a false/empty top stack element")
+        check_neg(-2**63, 0, fail="Script failed an OP_VERIFY operation")
+        check_neg(2**63-1, -2**63 + 1)
+
+        # Test boolean operations
+        for _ in range(5):
+            a = randint(-2**63, 2**63 -1)
+            b = randint(-2**63, 2**63 -1)
+            self.tapscript_satisfy_test(CScript([OP_AND, le8(a & b), OP_EQUAL]), inputs = [le8(a), le8(b)])
+            self.tapscript_satisfy_test(CScript([OP_OR, le8(a | b), OP_EQUAL]), inputs = [le8(a), le8(b)])
+            self.tapscript_satisfy_test(CScript([OP_INVERT, le8(~a), OP_EQUAL]), inputs = [le8(a)])
+            self.tapscript_satisfy_test(CScript([OP_XOR, le8(a ^ b), OP_EQUAL]), inputs = [le8(a), le8(b)])
+
+        # Finally, test conversion opcodes
+        self.log.info("Check conversion opcodes")
+        for n in [-2**31 + 1, -1, 0, 1, 2**31 - 1]:
+            self.tapscript_satisfy_test(CScript([le8(n), OP_LE64TOSCRIPTNUM, n, OP_EQUAL]))
+            self.tapscript_satisfy_test(CScript([n, OP_SCRIPTNUMTOLE64, le8(n), OP_EQUAL]))
+            self.tapscript_satisfy_test(CScript([n, OP_DUP, OP_SCRIPTNUMTOLE64, OP_LE64TOSCRIPTNUM, OP_EQUAL]))
+            self.tapscript_satisfy_test(CScript([le8(n), OP_DUP, OP_LE64TOSCRIPTNUM, OP_SCRIPTNUMTOLE64, OP_EQUAL]))
+            self.tapscript_satisfy_test(CScript([n.to_bytes(4, 'little', signed=True), OP_LE32TOLE64, le8(n), OP_EQUAL]), fail= "Script evaluated without error but finished with a false/empty top stack element" if (n < 0) else None)
+
+        # Non 8 byte inputs
+        self.tapscript_satisfy_test(CScript([OP_ADD64, OP_VERIFY, le8(9), OP_EQUAL]), inputs = [le8(0), int(9).to_bytes(7, 'little')], fail="Arithmetic opcodes expect 8 bytes operands")
+        # Overflow inputs
+        self.tapscript_satisfy_test(CScript([le8(2**31), OP_LE64TOSCRIPTNUM, 2**31, OP_EQUAL]), fail = "Arithmetic opcode error")
+
+
+        self.log.info("Check Crypto opcodes")
+
+        res = bytes.fromhex("03a0434d9e47f3c86235477c7b1ae6ae5d3442d49b1943c2b752a68e2a47e247c7")
+        scalar = bytes.fromhex("000000000000000000000000000000000000000000000000000000000000000a")
+        g = bytes.fromhex("0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798")
+        self.tapscript_satisfy_test(CScript([OP_ECMULSCALARVERIFY, OP_1]), inputs = [res, g, scalar])
+
+        res = bytes.fromhex("032c0158d0f6df4881e99e65fbea21f27321d817f79ad39e08eaf4f16f1419bb0c")
+        scalar = bytes.fromhex("e0f47c124f228b97bbdc0e4398aac9788869b9fbbc193d5323fdad9570609de6")
+        g = bytes.fromhex("0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798")
+        self.tapscript_satisfy_test(CScript([OP_ECMULSCALARVERIFY, OP_1]), inputs = [res, g, scalar])
+
+        # test that other random values fail correctly
+        res = bytes.fromhex("032c0158d0f6df4881e99e65fbea21f27321d817f79ad39e08eaf4f16f1419bb0c")
+        scalar = bytes.fromhex("e0f47c124f228b97bbdc0e4398aac9788869b9fbbc193d5323fdad9570609de6")
+        g = bytes.fromhex("0479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798")# y co-ordinate mutated
+        self.tapscript_satisfy_test(CScript([OP_ECMULSCALARVERIFY, OP_1]), inputs = [res, g, scalar], fail="Public key is neither compressed or uncompressed")
+
+        invalid_full_pks_33 = [
+            "0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81700" # invalid point on curve
+            ]
+        invalid_full_pks_non33 = [
+            "0979be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798", # 33 byte without 0x02,0x03
+            "0462b31419b87d5e095e9d7532f92aea39c39735253a48fbdaff48441d5cf706f9a7a946ce481411e4034143e0acad4e79aecb2a8212ee5cca26a7cc5fe5b45881", # compressed
+            "62b31419b87d5e095e9d7532f92aea39c39735253a48fbdaff48441d5cf706f9", # x-only key
+            "0262b31419b87d5e095e9d7532f92aea39c39735253a48fbdaff48441d5cf706f9f9f9" # 34 byte key
+        ]
+        invalid_tweaks = [
+            "e07c124f228b97bbdc0e4398aac9788869b9fbbc193d5323fdad9570609de6", # non 32 byte hash
+            "fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364143" # order + 2
+            ]
+        invalid_xonly_keys = [
+            "0379be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798", # 33 byte valid key
+            "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81700", # invalid point on curve
+            "0462b31419b87d5e095e9d7532f92aea39c39735253a48fbdaff48441d5cf706f9a7a946ce481411e4034143e0acad4e79aecb2a8212ee5cca26a7cc5fe5b45881", # compressed
+            "62b31419b87d5e095e9d7532f92aea39c39735253a48fbdaff48441d5cf706" # 31 byte x-only key
+        ]
+
+        valid_res = bytes.fromhex("032c0158d0f6df4881e99e65fbea21f27321d817f79ad39e08eaf4f16f1419bb0c")
+        valid_scalar = bytes.fromhex("e0f47c124f228b97bbdc0e4398aac9788869b9fbbc193d5323fdad9570609de6")
+        valid_g = bytes.fromhex("0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798")
+        valid_xonly_key = bytes.fromhex("79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798")
+
+        for invalid_tweak in invalid_tweaks:
+            self.tapscript_satisfy_test(CScript([OP_ECMULSCALARVERIFY, OP_1]), inputs = [valid_res, valid_g, bytes.fromhex(invalid_tweak)], fail="EC scalar mult verify fail")
+
+        self.tapscript_satisfy_test(CScript([OP_TWEAKVERIFY, OP_1]), inputs = [valid_res, bytes.fromhex(invalid_tweaks[1]), valid_xonly_key], fail="EC scalar mult verify fail")
+        self.tapscript_satisfy_test(CScript([OP_TWEAKVERIFY, OP_1]), inputs = [valid_res, bytes.fromhex(invalid_tweaks[0]), valid_xonly_key], fail="Public key is neither compressed or uncompressed")
+
+        for invalid_full_pk in invalid_full_pks_33:
+            self.tapscript_satisfy_test(CScript([OP_ECMULSCALARVERIFY, OP_1]), inputs = [bytes.fromhex(invalid_full_pk), valid_g, valid_scalar], fail="EC scalar mult verify fail")
+            self.tapscript_satisfy_test(CScript([OP_ECMULSCALARVERIFY, OP_1]), inputs = [valid_res, bytes.fromhex(invalid_full_pk), valid_scalar], fail="EC scalar mult verify fail")
+
+        for invalid_full_pk in invalid_full_pks_non33:
+            self.tapscript_satisfy_test(CScript([OP_ECMULSCALARVERIFY, OP_1]), inputs = [bytes.fromhex(invalid_full_pk), valid_g, valid_scalar], fail="Public key is neither compressed or uncompressed")
+            self.tapscript_satisfy_test(CScript([OP_ECMULSCALARVERIFY, OP_1]), inputs = [valid_res, bytes.fromhex(invalid_full_pk), valid_scalar], fail="Public key is neither compressed or uncompressed")
+
+        self.tapscript_satisfy_test(CScript([OP_TWEAKVERIFY, OP_1]), inputs = [valid_res, valid_scalar, bytes.fromhex(invalid_xonly_keys[0])], fail="Public key is neither compressed or uncompressed")
+        self.tapscript_satisfy_test(CScript([OP_TWEAKVERIFY, OP_1]), inputs = [valid_res, valid_scalar, bytes.fromhex(invalid_xonly_keys[1])], fail="EC scalar mult verify fail")
+        self.tapscript_satisfy_test(CScript([OP_TWEAKVERIFY, OP_1]), inputs = [valid_res, valid_scalar, bytes.fromhex(invalid_xonly_keys[2])], fail="Public key is neither compressed or uncompressed")
+        self.tapscript_satisfy_test(CScript([OP_TWEAKVERIFY, OP_1]), inputs = [valid_res, valid_scalar, bytes.fromhex(invalid_xonly_keys[3])], fail="Public key is neither compressed or uncompressed")
+
+        # Checksigfromstack tests
+        # 32 byte msg
+        def csfs_test(msg, mutute_sig = False, fail=None):
+            sec = generate_privkey()
+            msg = bytes.fromhex(msg)
+            pub = compute_xonly_pubkey(sec)[0]
+            sig = sign_schnorr(sec, msg)
+            if mutute_sig:
+                new_sig = sig[:63]
+                new_sig += (sig[63] ^ 0xff).to_bytes(1, 'little') # flip the last bit
+                sig = new_sig
+            self.tapscript_satisfy_test(CScript([msg, pub, OP_CHECKSIGFROMSTACK]), inputs = [sig], fail=fail)
+
+        csfs_test("e168c349d0d2499caf3a6d71734c743d517f94f8571fa52c04285b68deec1936")
+        csfs_test("Hello World!".encode('utf-8').hex())
+        csfs_test("Hello World!".encode('utf-8').hex(), fail="Invalid Schnorr signature", mutute_sig=True)
+        msg = bytes.fromhex("e168c349d0d2499caf3a6d71734c743d517f94f8571fa52c04285b68deec1936")
+        pub = bytes.fromhex("3f67e97da0df6931189cfb0072447da22707897bd5de04936a277ed7e00b35b3")
+        self.tapscript_satisfy_test(CScript([OP_0, msg, pub, OP_CHECKSIGFROMSTACK, OP_NOT]), inputs = [])
+        short_sig = bytes.fromhex("0102")
+        self.tapscript_satisfy_test(CScript([short_sig, msg, pub, OP_CHECKSIGFROMSTACK, OP_NOT]), inputs = [], fail="Invalid Schnorr signature size")
+
+        short_pub = bytes.fromhex("67e97da0df6931189cfb0072447da22707897bd5de04936a277ed7e00b35b3")
+        long_pub = bytes.fromhex("67e97da0df6931189cfb0072447da22707897bd5de04936a277ed7e00b35b30908")
+        sig = bytes.fromhex("3f67e97da0df6931189cfb0072447da22707897bd5de04936a277ed7e00b35b33f67e97da0df6931189cfb0072447da22707897bd5de04936a277ed7e00b35b3")
+        self.tapscript_satisfy_test(CScript([msg, short_pub, OP_CHECKSIGFROMSTACK]), inputs = [sig], fail="Public key version reserved for soft-fork upgrades")
+        self.tapscript_satisfy_test(CScript([msg, long_pub, OP_CHECKSIGFROMSTACK]), inputs = [sig], fail="Public key version reserved for soft-fork upgrades")
+
+if __name__ == '__main__':
+    TapHashPeginTest().main()
diff --git a/test/functional/test_framework/key.py b/test/functional/test_framework/key.py
index 26526e35fa..f1bfe59555 100644
--- a/test/functional/test_framework/key.py
+++ b/test/functional/test_framework/key.py
@@ -479,7 +479,7 @@ def sign_schnorr(key, msg, aux=None, flip_p=False, flip_r=False):
         aux = bytes(32)
 
     assert len(key) == 32
-    assert len(msg) == 32
+    # Variable length signature message support is required for checksigfromstack
     assert len(aux) == 32
 
     sec = int.from_bytes(key, 'big')
diff --git a/test/functional/test_framework/script.py b/test/functional/test_framework/script.py
index aea92e4a36..c38dc71e05 100644
--- a/test/functional/test_framework/script.py
+++ b/test/functional/test_framework/script.py
@@ -33,7 +33,7 @@ MAX_SCRIPT_ELEMENT_SIZE = 520
 LOCKTIME_THRESHOLD = 500000000
 ANNEX_TAG = 0x50
 
-LEAF_VERSION_TAPSCRIPT = 0xc0
+LEAF_VERSION_TAPSCRIPT = 0xc4
 
 def hash160(s):
     return hashlib.new('ripemd160', sha256(s)).digest()
@@ -239,6 +239,8 @@ OP_CHECKSIG = CScriptOp(0xac)
 OP_CHECKSIGVERIFY = CScriptOp(0xad)
 OP_CHECKMULTISIG = CScriptOp(0xae)
 OP_CHECKMULTISIGVERIFY = CScriptOp(0xaf)
+OP_CHECKSIGFROMSTACK = CScriptOp(0xc1)
+OP_CHECKSIGFROMSTACKVERIFY = CScriptOp(0xc2)
 
 # expansion
 OP_NOP1 = CScriptOp(0xb0)
@@ -255,6 +257,50 @@ OP_NOP10 = CScriptOp(0xb9)
 # BIP 342 opcodes (Tapscript)
 OP_CHECKSIGADD = CScriptOp(0xba)
 
+# Elements Tapscript extension
+OP_SHA256INITIALIZE = CScriptOp(0xc4)
+OP_SHA256UPDATE = CScriptOp(0xc5)
+OP_SHA256FINALIZE = CScriptOp(0xc6)
+# inputs
+OP_INSPECTINPUTOUTPOINT = CScriptOp(0xc7)
+OP_INSPECTINPUTASSET = CScriptOp(0xc8)
+OP_INSPECTINPUTVALUE = CScriptOp(0xc9)
+OP_INSPECTINPUTSCRIPTPUBKEY = CScriptOp(0xca)
+OP_INSPECTINPUTSEQUENCE = CScriptOp(0xcb)
+OP_INSPECTINPUTISSUANCE = CScriptOp(0xcc)
+# current index
+OP_PUSHCURRENTINPUTINDEX = CScriptOp(0xcd)
+# outputs
+OP_INSPECTOUTPUTASSET = CScriptOp(0xce)
+OP_INSPECTOUTPUTVALUE = CScriptOp(0xcf)
+OP_INSPECTOUTPUTNONCE = CScriptOp(0xd0)
+OP_INSPECTOUTPUTSCRIPTPUBKEY = CScriptOp(0xd1)
+# transaction
+OP_INSPECTVERSION = CScriptOp(0xd2)
+OP_INSPECTLOCKTIME = CScriptOp(0xd3)
+OP_INSPECTNUMINPUTS = CScriptOp(0xd4)
+OP_INSPECTNUMOUTPUTS = CScriptOp(0xd5)
+OP_TXWEIGHT = CScriptOp(0xd6)
+
+# Arithmetic opcodes
+OP_ADD64 = CScriptOp(0xd7)
+OP_SUB64 = CScriptOp(0xd8)
+OP_MUL64 = CScriptOp(0xd9)
+OP_DIV64 = CScriptOp(0xda)
+OP_NEG64 = CScriptOp(0xdb)
+OP_LESSTHAN64 = CScriptOp(0xdc)
+OP_LESSTHANOREQUAL64 = CScriptOp(0xdd)
+OP_GREATERTHAN64 = CScriptOp(0xde)
+OP_GREATERTHANOREQUAL64 = CScriptOp(0xdf)
+
+# Conversion opcodes
+OP_SCRIPTNUMTOLE64 = CScriptOp(0xe0)
+OP_LE64TOSCRIPTNUM = CScriptOp(0xe1)
+OP_LE32TOLE64 = CScriptOp(0xe2)
+# Tapscript crypto opcodes
+OP_ECMULSCALARVERIFY = CScriptOp(0xe3)
+OP_TWEAKVERIFY = CScriptOp(0xe4)
+
 OP_INVALIDOPCODE = CScriptOp(0xff)
 
 OPCODE_NAMES.update({
@@ -371,6 +417,42 @@ OPCODE_NAMES.update({
     OP_NOP10: 'OP_NOP10',
     OP_CHECKSIGADD: 'OP_CHECKSIGADD',
     OP_INVALIDOPCODE: 'OP_INVALIDOPCODE',
+    OP_SHA256INITIALIZE : 'OP_SHA256INITIALIZE',
+    OP_SHA256UPDATE : 'OP_SHA256UPDATE',
+    OP_SHA256FINALIZE : 'OP_SHA256FINALIZE',
+    OP_INSPECTINPUTOUTPOINT: 'OP_INSPECTINPUTOUTPOINT',
+    OP_INSPECTINPUTASSET: 'OP_INSPECTINPUTASSET',
+    OP_INSPECTINPUTVALUE: 'OP_INSPECTINPUTVALUE',
+    OP_INSPECTINPUTSCRIPTPUBKEY: 'OP_INSPECTINPUTSCRIPTPUBKEY',
+    OP_INSPECTINPUTSEQUENCE: 'OP_INSPECTINPUTSEQUENCE',
+    OP_INSPECTINPUTISSUANCE: 'OP_INSPECTINPUTISSUANCE',
+    OP_PUSHCURRENTINPUTINDEX: 'OP_PUSHCURRENTINPUTINDEX',
+    OP_INSPECTOUTPUTASSET: 'OP_INSPECTOUTPUTASSET',
+    OP_INSPECTOUTPUTVALUE: 'OP_INSPECTOUTPUTVALUE',
+    OP_INSPECTOUTPUTNONCE: 'OP_INSPECTOUTPUTNONCE',
+    OP_INSPECTOUTPUTSCRIPTPUBKEY: 'OP_INSPECTOUTPUTSCRIPTPUBKEY',
+    OP_INSPECTVERSION: 'OP_INSPECTVERSION',
+    OP_INSPECTLOCKTIME: 'OP_INSPECTLOCKTIME',
+    OP_INSPECTNUMINPUTS: 'OP_INSPECTNUMINPUTS',
+    OP_INSPECTNUMOUTPUTS: 'OP_INSPECTNUMOUTPUTS',
+    OP_TXWEIGHT: 'OP_TXWEIGHT',
+    OP_INVALIDOPCODE: 'OP_INVALIDOPCODE',
+    OP_CHECKSIGFROMSTACK: 'OP_CHECKSIGFROMSTACK',
+    OP_TWEAKVERIFY: 'OP_TWEAKVERIFY',
+    OP_ADD64: 'OP_ADD64',
+    OP_SUB64: 'OP_SUB64',
+    OP_MUL64: 'OP_MUL64',
+    OP_DIV64: 'OP_DIV64',
+    OP_LESSTHAN64: 'OP_LESSTHAN64',
+    OP_LESSTHANOREQUAL64: 'OP_LESSTHANOREQUAL64',
+    OP_GREATERTHAN64: 'OP_GREATERTHAN64',
+    OP_GREATERTHANOREQUAL64: 'OP_GREATERTHANOREQUAL64',
+    OP_NEG64: 'OP_NEG64',
+    OP_SCRIPTNUMTOLE64: 'OP_SCRIPTNUMTOLE64',
+    OP_LE64TOSCRIPTNUM: 'OP_LE64TOSCRIPTNUM',
+    OP_LE32TOLE64: 'OP_LE32TOLE64',
+    OP_CHECKSIGFROMSTACKVERIFY: 'OP_CHECKSIGFROMSTACKVERIFY',
+    OP_ECMULSCALARVERIFY: 'OP_ECMULSCALARVERIFY',
 })
 
 class CScriptInvalidError(Exception):
@@ -948,4 +1030,4 @@ def taproot_construct(pubkey, scripts=None):
     return TaprootInfo(CScript([OP_1, tweaked]), pubkey, negated + 0, tweak, leaves)
 
 def is_op_success(o):
-    return o == 80 or o == 98 or (o >= 137 and o <= 138) or (o >= 141 and o <= 142) or (o >= 149 and o <= 151) or (o >= 187 and o <= 191) or (o >= 196 and o <= 254)
+    return o == 80 or o == 98 or (o >= 137 and o <= 138) or (o >= 141 and o <= 142) or (o >= 149 and o <= 151) or (o >= 187 and o <= 191) or (o >= 229 and o <= 254)
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index f2c76cf11e..b9c96a97f4 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -139,6 +139,7 @@ BASE_SCRIPTS = [
     'rpc_signer.py',
     'wallet_signer.py --descriptors',
     'feature_taphash_pegins_issuances.py',
+    'feature_tapscript_opcodes.py',
     # vv Tests less than 60s vv
     'p2p_sendheaders.py',
     'wallet_importmulti.py --legacy-wallet',