Citrea: a Bitcoin ZK rollup using RISC Zero and BitVM
Thread1,042 words
Explains Citrea's design: a Type 2 zkEVM in a STARK-based zkVM, proofs and state diffs inscribed on Bitcoin, BitVM-based optimistic verification, forced transactions for censorship resistance and reorg resistance after 6 confirmations.
Key claims
Only state diffs are posted to Bitcoin
Proof verification via BitVM with fraud proofs
Sequencer bond is slashed if forced transactions are not included
It's time for the first true Bitcoin-based ZK rollup!
This narrative will be big and today I will introduce you to what I think will be the leader in the Bitcoin L2 space!
A trust-minimized ZK rollup powered by @RiscZero and BitVM tech.
We are still early, anon!
Alpha-š§µ
1/ Bitcoin season is just about to get started.
Ordinals and inscriptions have impressively proven the demand for functionality on Bitcoin that goes beyond the transfer of value.
Programmable ZK rollups will make that possible.
2/ Secured by the most battle-tested chain out there, DeFi ecosystems will emerge, powered by BTC as the native currency & collateral.
Anticipating this trend, I researched the ecosystem of Bitcoin L2s.
3/ After hours of research, I found a trust-minimized multi-VM ZK rollup built using on @RiscZero's STARK-based proving tech that uses Bitcoin for data availability (DA).
This effectively generalizes the Bitcoin trust layer and runs programs on top of it (e.g. EVM).
4/ Do you understand how big this is anon?
@citrea_xyz, incubated by @chainway_xyz pioneers a revolutionary network architecture that gives rise to a new powerful new narrative and pushes the boundaries of innovation around Bitcoin.
Let me give you a TLDR of my research! šš
5/ Citrea processes zkEVM transactions off chain, batches them up and submits a succinct ZK proof that allows easy verification of the batch validity in an inscription-like envelope to Bitcoin.
A.k.a. rollup, just on Bitcoin.
6/ This allows Citrea to use only a small subset of Bitcoin blockspace and divide that blockspace among a large number of transactions.
Using ZK-powered verifiable computation, Citrea provides Bitcoin-equivalent security to a vast array of dApps on L2.
7/ The Citrea VM is a fully Ethereum Virtual Machine (EVM) equivalent VM running on Bitcoin and using cBTC as its native token.
Citrea zkEVM is classified as Type 2, which means full equivalency and a scalable and trustless proof system
8/ Citrea runs inside a generic STARK-based zkVM, meaning any virtual machine can be implemented and will produce execution proof.
Initially, Citrea implements EVM, however implementing different VMs like WASM or SVM is possible thanks to its future-proof design.
9/ Today, all major rollups run on centralized sequencers.
While trusted, this comes with scalability benefits.
However, this imposes a limit for censorship-resistance, uptime, and fair ordering.
x.com/zerokn0wledge_/status/1719682606953046130
10/ Citrea is working on a decentralized sequencer, which will allow multiple sequencers to produce and finalize blocks with sub-second (soft) finality.
Consensus among the sequencer set ensures censorship-resistance on the L2 level.
11/ To further bolster censorship resistance, Citrea also implements a mechanism called "Force Transactions".
Force transactions are directly inscribed in Bitcoin using a specific envelope and serialization format.
12/ Thanks to blockspace proofs, Citrea sequencers must include forced transactions (txs) inscribed on Bitcoin in Citrea blocks.
Citrea provers have the ability to scan Bitcoin block through inclusion & completeness proofs, and thus have access to all forced txs sent to Bitcoin.
13/ If any of the forced transactions is not included from the given Citrea block until some delay period has passed, the proof generation fails.
This results in slashing sequencer's bond for proposing an invalid Citrea block.
14/ An escape hatch mechanism (for the case Citrea halts or because of censorship) will be introduced later.
x.com/zerokn0wledge_/status/1752693426527916364
15/ But is this thing secure?
Yes! Citrea inherits full Bitcoin L1 security, including all four properties needed for its security. Let's investigate these key properties.
ā¦ Validity
ā¦ Data Availability
ā¦ Censorship Resistance
ā¦ Re-org Resistance
16/ ā
Validity
Each Citrea batch is processed inside the zkVM, resulting in a succinct ZK proof that attests to the validity of all the inputs, computation, and outputs.
17/ The proof is inscribed into Bitcoin, making it available all network participants.
this includes light nodes (SPVs) and Bitcoin script itself, through BitVM.
BitVM is a computing paradigm to express Turing-complete Bitcoin contracts.
18/ Using BitVM, Citrea proof verification is optimistically done on Bitcoin with fraud proofs.
Any verifier (or guard) from the committee can punish the prover (or proposer) if it submits an invalid Citrea proof.
19/ š Data Availability
Data availability by definition represents the availability of the data needed to construct state and verify the rollup.
Unlike existing L2 solutions on Bitcoin, Citrea keeps all the data needed to keep the rollup functional on Bitcoin.
20/ Because the data bandwidth is limited on Bitcoin though, Citrea only stores state differences (state diffs in short).
Instead of recording the full Citrea transaction data, only the state diff between two consecutive batches are recorded.
21/ Each Citrea proof outputs the state difference of the batch.
The proofs with outputs are inscribed in Bitcoin.
By scanning over proofs in Bitcoin blocks, anyone can build the latest state tree of the rollup, ensuring data is available.
22/ For low security use cases, Citrea will likely leverage a volition model.
A volition model is a type of L2 that offers both on-chain and off-chain data availability options to dApps & users while maintaining composability across DA options.
23/ š” Censorship Resistance
Citrea utilizes inscription-like forced transaction envelopes on the Bitcoin main chain.
Anyone can submit a Citrea transaction to Bitcoin within a specified encoding.
24/ Citrea's circuit ensures that every single forced transaction is included in the next batch via inclusion & soundness proofs over the corresponding Bitcoin block they are included within.
25/ ā Re-org Resistance
Citrea includes the most recent finalized Bitcoin block hash into the rollup block header.
26/ After the corresponding proof for the rollup block is sent to Bitcoin and finalized, it cannot be re-orged without re-orging the Bitcoin blockchain itself.
That's almost impossible after 6 block confirmations.
27/ That's it for @citrea_xyz (at least for today). I have previously covered some of the work @chainway_xyz is doing in the thread below. š
x.com/zerokn0wledge_/status/1745920580392718772
28/ This is definitely the most convincing framework for building programmable L2s on Bitcoin I have come across so far.
This narrative will be big and you are still early anon.
DYOR and position yourself now, don't fade.
I hope you've found this thread helpful! š«”
Make sure to follow me @zerokn0wledge_ to stay ahead of the curve on Bitcoin-based ZK rollups! šāØ
Like/Repost of the below post is also highly appreciated! šš
14 images on X
What came next Ā· since 07 Feb 2024
Show how the covered asset moved
This explainer walks through how things work without making a call on the token, so price moves since publication are shown as market context.
Mentioned for context
Since then
Zero has written 5 more pieces on Citrea since this one.
- Signals on Citrea: range-based BTC prediction market with CLMSROn Citrea
- Citrea TL;DR: Bitcoin's first ZK rollup and the bApps ecosystemOn Citrea
- Citrea deep dive: unlocking Bitcoin's $1.3T dormant liquidity with a ZK rollupOn Citrea
- 20 pre-TGE projects without Kaito leaderboards: ZK, privacy, AI and CLOB infraOn Citrea
Daily closes in USD from DefiLlama and Yahoo Finance. Only a bullish or bearish call in a thesis or market take is tracked; explainers, lists, maps and mentions are neutral context. Not financial advice.