From BIP341:
Why is the Merkle path length limited to 128? The optimally
space-efficient Merkle tree can be constructed based on the
probabilities of the scripts in the leaves, using the Huffman
algorithm. This algorithm will construct branches with lengths
approximately equal to log2(1/probability), but to have branches
longer than 128 you would need to have scripts with an execution
chance below 1 in 2128. As that is our security bound, scripts that
truly have such a low chance can probably be removed entirely.
This is an excellent explanation why one really doesn’t need a Merkle tree deeper than 128, but it doesn’t explain why it’s not allowed. Would this open the protocol to some sort of attack? I don’t see how a script path spend with a few thousand branch steps would be worse than multiple individual transactions with shorter branches. Or it is just a standard to set a limit like this in a protocol when confident enough that nobody could ever need to go over it?
