You'll build the commitment yourself, then break it.

Everything runs on a small helper module, secp256k1.py. No installs.

from secp256k1 import *

# point_mul(k)        -> k·G
# point_add(A, B)     -> A + B
# hash_to_int(*parts) -> hash of the parts, as a scalar
# ser(P)              -> P as 32 bytes

Task 1: Build the commitment

Alice has a private key d and a contract. Compute the tweaked key Q.

Task 2: Check Alice can spend

If Q is a real public key, some private key must unlock it. Which one?

Task 3: Forge it

Now the attack. Alice wants a second contract that gives the same Q.

If your asserts pass, you just opened one Q to two different contracts.

Question

Alice never touched Q. She only changed her own key.

Why was that enough?