BitVM 2: Opening Up The Playing Field

Last October Robin Linus from Zerosync dropped a spot of a weaponry successful the signifier of BitVM. One of the longest moving criticisms of Bitcoin is that it is not imaginable to marque arbitrary programs to power however wealth is spent oregon locked. Bitcoin lone has a precise constricted magnitude of programmability successful its scripting language, and the primitives disposable are highly constrained. You tin cheque a signature, you tin adhd a timelock to something, you tin manipulate information successful a fewer elemental ways, but that’s it.

You tin programme a Bitcoin UTXO to necessitate a signature check, a timelock verification, etc. But you cannot programme it to unlock based connected immoderate arbitrary conditions. Robin’s penetration with BitVM was that 1 azygous primitive successful the tract of computing could beryllium enforced successful Bitcoin script: a NAND gate, 1 of the basal primitives of computing astatine the physical/electrical level. Every computation that is imaginable tin beryllium constructed retired of NAND gates.

Script tin really verify a NAND gross owed to a neat instrumentality utilizing OP_BOOLAND and OP_NOT. OP_BOOLAND is an AND operation, the other of NAND. OP_NOT takes a binary 1 oregon 0 worth and inverts it. This unneurotic allows you to really enforce a azygous NAND cognition successful publication directly. In operation with hashlocks, a NAND gross publication tin beryllium made wherever each input and output tract has 2 imaginable hashlocks to “unlock” that spending path, each 1 pushing a 1 oregon 0 to the stack to execute the NAND operation. Each publication besides has a way wherever if you tin uncover both preimages to a azygous spot value, you tin instantly assertion the funds. This is truthful that erstwhile idiosyncratic decides what to input to the NAND gate, they cannot alteration their caput without losing money.

A monolithic magnitude of NAND gross scripts tin each beryllium compacted into a taproot tree, and erstwhile idiosyncratic commits to the spot values off-chain to input to that computation, the different enactment tin situation them connected immoderate idiosyncratic measurement successful the computation to beryllium it is being executed correctly connected chain. Each “challenge” allows the challenged enactment to beryllium that the idiosyncratic gross was computed correctly, different the different enactment tin assertion the funds aft a timelock. Going backmost and distant similar this if a computation is contested, it is guaranteed that the cheating enactment volition yet beryllium caught and suffer funds.

The limitations

The main regulation of BitVM is that lone the radical progressive successful creating a BitVM declaration tin participate, and the roles are precise limited. There is the prover, the idiosyncratic asserting however the computation happened off-chain, and the verifier, the idiosyncratic who tin situation the computation and unit it to beryllium proven on-chain if the prover does not implicit the computation off-chain oregon tries to prevarication astir the results.

One of the reasons for designing BitVM was to found 2 mode pegs to sidechains oregon different systems. The strategy offers a precise almighty primitive successful that usage case, the quality to really enforce funds beryllium fixed to 1 enactment oregon the different based connected the correctness of an arbitrary computation, i.e. a validity cheque connected whether a pegout is valid according to a sidechains rules. The occupation is, lone the radical who clasp keys to that BitVM UTXO tin really spell “Hey, you’re cheating!” erstwhile idiosyncratic is, and prosecute successful the situation protocol. This yet makes the strategy inactive trusted.

Another regulation is that the situation effect protocol tin beryllium precise long. If idiosyncratic realizes the result of the computation is going to effect successful them losing wealth and they halt responding, the verifier has to fundamentally conjecture wherever the idiosyncratic NAND gross is successful the computation that the prover would person to prevarication astatine and uncover some preimages to a spot that would springiness the verifier the funds. Until that circumstantial gross is challenged on-chain, the prover tin inactive respond correctly to a situation and resistance it out. This tin beryllium precise clip consuming and inefficient.

Some improvements to this plan person been made since the archetypal connection to let for aggregate verifiers to beryllium successful the strategy with the prover, to make a 1-of-n spot exemplary wherever lone a azygous verifier is required to situation a dishonest prover. However, this requires the instantiation of aggregate BitVM instances successful parallel to accomplish, and truthful increases the inefficiencies with the archetypal 2 enactment design.

BitVM 2

Robin precocious projected a plan strategy for BitVM 2. This strategy seeks to marque a fewer commercialized offs successful examination to the archetypal plan for the payment of mitigating its 2 large shortcomings. BitVM 2 shortens the challenge/response protocol magnitude from an indeterminate bid of transactions that could beryllium upwards of dozens successful the worst lawsuit scenario, to 2 rounds successful the challenge/response. In summation to this, with the usage of connector outputs it allows anyone to enactment arsenic a verifier. It does not necessitate idiosyncratic to beryllium a subordinate progressive successful establishing the BitVM to situation a dishonest prover.

The cardinal displacement present is moving distant from straight utilizing publication NAND gates to instrumentality the earthy computational hint directly, and moving to utilizing them to instrumentality a wide SNARK zero cognition impervious verifier (one of the halfway primitives Robin intended from the commencement to instrumentality utilizing BitVM). Instead of putting the earthy input into the earthy computational trace, and moving it gross by gross successful their ain tapleaf scripts, the input of the BitVM 2 lawsuit would simply beryllium a zero cognition impervious input successful operation with an asserted output of the computation.

In summation to abstracting distant the computation implementation with a ZKP, the tapleaf scripts are being massively expanded from a azygous NAND gross per leafage to an full sub-function of the ZKP verifier. Instead of the situation effect protocol being based astir the verifier guessing astatine which NAND gross the prover attempted to cheat at, selectively challenging astatine a azygous gate, the verifier tin beryllium an full sub-function’s output is invalid according to the input.

Just similar BitVM 1, the declaration is pre-negotiated utilizing pre-signed transactions and branching scripts. Funds pegged into the BitVM are sent to an n-of-n multisig which signs 2 imaginable execution transactions, 1 successful which nary situation occurs, and 1 successful which a situation occurs. To commencement the process of executing the contract, the prover initiates a footwear disconnected transaction. This footwear disconnected transaction commits to the output worth ‘y’ they assertion the computation produces, and includes 3 outputs: a timelocked output that is included successful the nary situation execution transaction, a connector output A, and a connector output B, some of which besides are spent successful the nary situation transaction.

Here is wherever the plan allows for anyone to enactment arsenic a verifier. Connector output A has a 2nd pre-signed transaction that tin walk it, the situation transaction. This is simply a pre-signed transaction that pays the prover a enslaved successful bitcoin, but the connector output A is not capable to money it. Literally anyone tin adhd their ain inputs to money the transaction and walk connector output A, which invalidates the nary situation withdrawal transaction for the prover (one of the inputs it needs nary situation exists).

This forces the situation path. Connector output B is besides spendable utilizing a pre-signed transaction, the asseverate transaction, to the output of each sub-function successful the full BitVM 2 contract. This requires a ample transaction with a batch of data, but remember, the eventual output ‘y’ the prover is claiming the computation produced was already committed to successful the footwear disconnected transaction. This creates 2 outputs. One is simply a timelocked output, the different is simply a connector output C. Both of these outputs, successful summation to the archetypal pegged successful funds, are each spent successful the 2nd palmy withdrawal transaction for the prover aft the timelock.

Connector output C is besides spendable by anyone who tin beryllium that immoderate sub-function output successful the BitVM 2 declaration produces an invalid output. This requires a precise ample transaction, due to the fact that the publication indispensable to beryllium an full conception of the BitVM computation is incorrect is massive, but successful this azygous transaction a verifier tin assertion the coins successful the connector output with a valid proof. This invalidates the 2nd withdrawal transaction for the prover and efficaciously burns the coins. The lone mode to retrieve them astatine this constituent is if the prover and all of the verifiers successful the archetypal n-of-n backing multisig each cooperate to retrieve them (in the lawsuit of a setup ceremonial involving cardinal deletion this betterment anticipation does not exist). Connector output B successful the footwear disconnected transaction tin besides beryllium spent aft a overmuch longer timeout than nary situation withdrawal to invalidate some the nary situation and the asseverate transaction, burning the pegged coins.

This reduces what could beryllium a ridiculous concatenation of transactions successful the archetypal BitVM connection to enforce the close declaration outcome, to astatine astir 4 transactions (although admittedly precise monolithic ones), portion successful the process making the acceptable of verifiers for the BitVM 2 lawsuit virtually anyone with bitcoin who volition money the situation transaction.

BitVM 2 could upwind up being a important breakthrough successful regards to the question of rollups and different furniture 2s aiming to usage BitVM arsenic a 2 mode peg. The relation of a rollup (the prover successful the BitVM) tin usage their ain funds to screen withdrawals of users who person pegged into the system, and periodically retreat those funds from the BitVM to compensate themselves. Any idiosyncratic oregon funny enactment would past beryllium capable to penalize them by burning their funds if they could nutrient impervious the relation was not processing each withdrawals correctly.

It is important to enactment that yet the information of a BitVM 2 lawsuit is backstopped by the n-of-n keyholder, adjacent though radical not participating successful it tin inactive situation the prover arsenic a verifier. But due to the fact that the prover has an businesslike exit successful the lawsuit of nary challengers, and anyone tin money the situation transaction to enactment arsenic a verifier, the n-of-n backing multisig could travel a setup and cardinal deletion ceremonial akin to the Zcash motorboat to amended its security.

BitVM 2 volition astir apt upwind up being a important breakthrough successful presumption of improving the flexibility and spot exemplary of 2 mode pegs that marque usage of BitVM. Once again, Robin has proven himself a existent wizard.