Unlocking Bitcoin's Economy with L2s | Orkun, Citrea Co-founder

Transcript

we believe that Bitcoin is a real currency uh but without having a real economy around it it's not actually a currency it's just like payment tool payment token let's say uh so uh with citr what we want to enable is an economy around Bitcoin we've teed up with the Wormhole Foundation stewards of the Wormhole protocol the leading interoperability platform powering Crossing transfers for 200 plus multi-chain teams came your unique worm NFD just for your ex research listeners today pair is an Innovative pair trading exchange built on top of Simo users can trade trending narratives with one click from Blue Chip narratives such as long BTC short e right through the whiff versus Bonk the

Hat stays on Sim's intense Centric architecture enables deep liquidity source offchain and Broad onchain and combined with pair has democratized access to complex trading strategies typically reserved for institutional Traders before we get into today's episode just a quick disclaimer the views expressed on this podcast by either myself or any guests are their personal views and do not represent the views of any Associated organization nothing in this episode should be construed or relied upon as Financial technical tax legal or other advice all right let's jump into the episode all right guys welcome back to another episode of zerox research we have a great episode lined up with Orin the co-founder over at chain Wick which is the entity behind citria today is Monday March 25th as a reminder be sure to use

code 0x research 10 at at app. blockworks research.com for 10% off your annual subscription on to the interview with Orin thank you so much for coming on hi guys he thank you for having me today yeah before we dive into the specifics of CA let's start at a super high level let's define what an L2 is and what the current trust assumptions are with Bitcoin L2 so for starters what makes an L2 and L2 great so it's kind of tricky in Bitcoin ecosystem and the answer to your question what makes an L2 and L2 so in in regular things we call L2 that is like it is a system that allows you to un Lally exit from the

system so let's say a go UPS today most of them we got full ZK proofs no multi6 there's like no I think one dgate and like maybe f are like examples of that so there and which allows you to trust LLY and un exit so in Bitcoin because of the scripts limitations there only like one Sol that that is actually to light because like it's a channel between two parties if you're trusting yourself then you can exit so in Bitcoin there is this tricky thing it is technically nothing is an al2 on bitcoin but uh as we broadly Define L2 as like gaining some use case from the actual token and also uh

expands the security of the L1 to the L2 so by this definition yeah L2 Al on bit coin is usually defined by their like ability to do more with the BTC let's say adding programmability and the other is implementing some security inherited from the Bas there so in Bitcoin and like in general the definitions are a little bit different but uh I'm more in favor of the first one that is using the correct definition if we are using that there's no Al onit lightning but it's too speculative and Technical and I'm going to ask a lot of stupid questions this episode because I I think a lot of us are pretty confused on a lot of the nomenclature so how would you define like stacks for example

um would that be more of a side chain and and if so like what are the differences between uh a project trying to be a Bitcoin L2 versus a Bitcoin side chain yeah so uh site chains are like definitely not an alus uh so they because they introduced additional risk of the additional consensus plus the additional risk uh of the uh Bridge mechanism itself uh so in this sense tax is like kind of has it's a it's an it's own Al one with a multis bridge in between so they with this multi Bridge with the new upgrade you can just take tokens and like become the members but eventually it's on majority multis with a totally different chain yes it inherit some like reor guarantees and such but

the side chain Miners and block producers can steal from you and that's definitely not inside L2 definition but with like rollups and lightning the operation of the L2 the block producer of the L2 cannot steal from you I think that's that's the most important thing for making this distinction between stacks and like other rollups and stuff and then there's this concept of sovereign rollups so what is really the difference between a sovereign rollup and a regular rollup does It ultimately just come down to a vast majority of the uh tvl being the base asset and having that trustless bridge between the two I I think maybe there are not that much

difference like it is just like two technical two think we were discussing with like this with celesa team and eventually maybe there is not much difference because roll up by definition is like an L2 that uses the underlying CH data availability and consus guarantees so Sovereign roll up regular roll up it is just using the same thing but regular roll up has a validating bridge in the L1 so that you can Bridge the assets but then we ask this question what if like we can build an Bridge To The Sovereign roll up but the bridge doesn't Define the al2 it is just a bridge that operates and it can reor so in that sense I don't think there are like lot lot of difference uh but in in a traditional way yeah we know that Sovereign rollups don't usually have a

bridge between the Lan if they become like build a bridge they either become like roll up or lose some of their sovereignty maybe they need to add some delays and such a sovereign Roll Up is usually known as lack of ability to bring from the Bas you mentioned the bridge a few times um and you said you know like the bridge doesn't Define the rup and I think for most people they would say the bridge gives a a view into the RO of um and I think most are relatively familiar with bridges in terms of like ethereum based rollups on bitcoin side is a trust list or I guess more accurately like trust minimized bridge between Bitcoin and a 2 possible today if not what needs to change in order to make it possible yeah

so uh today you can like only trustless Bridge it is not even a bridge it's lightning that you can simply like onboard your BTC to lightning but in rollups as you cannot like compute the ZK proof permission list all the full Network or like verify the FR proofs on full Network it is not trustless so we call this trust minimize let's say C setup we have this BVM where like I think the earliest team working on the BVM today building the first application on it so we have built a ZK verifier in bitm so as long as one of this n people let's say 10 people or 100 people is honest then the ZK P verifier is actually launched and like uh applied on

chain so uh it is back then it is on chain but before that it is not on chain it is simple like offchain checking with all the members so we call this trust minimize it is not trustless because if you are running a note and you are still trusting the one of and of the committee so this is trust minimiz but if you are simple like just running a note and everything is correct then we call this trust so in order Bitcoin to have this trustless let's say bridge to the craa then we need to enable a ZK verifier of code on bitcoin script so that and maybe like a recursive Covenant to make the withdrawals so that it can actually verify the L2 on full not on the all of the full notes so that we can have this

adjust set I guess following that um this is going to be another city question but you mentioned that in a trusta setup you would need that uh ZK ver verifier um and I would assume that you also need some entity or some node to sort of generate that ZK proof why would that be defined as trustless rather than trust minimize because I I don't know if this is a hot take but I don't really think anything in crypto is like truly trustless as long as you're like trusting one entity to like do something and then like at least being able to verify that proof that ZK proof or whatever so what how would you make the distinction I guess between like trustless and Trust minimized yeah to R

like trustless it is only trustless if you have only like have need in the like L1 note so if you have L one not if everything is safe then it is trustless so in the zkp verification if the prover is permissionless it is only trust St so if Pro is only like single centralized entity which is like authorized by signatures and stuff it is not trustless because yeah you are trusting that entity to generate the proof but uh in the long term if you like eliminate all the other needs Pro decentralization and like permissionless provs are relatively easy compared to the other Concepts uh so making it permissionless on having everything ready on the base there I think makes it trustless because you you as a person run as ekp appr generate the

proof send it to bitcoin and make it verified on all of the full notes so uh this is what if I Stressless TR so on ethereum you have Smart contracts which you know typically for an L2 you have one contract on the base layer and that's kind of like the canonical Bridge contract but with Bitcoin obviously that's not possible considering we don't have Smart contracts on bitcoin so you mentioned bit VM and I'm a complete novice on bit VM so if you could kind of explain bitm and how that actually enables this process that would be great yeah so BVM is simply like offchain computer with onchain front Pro uh protocol so you simply build an offchain program that

runs between the several parties let's say one operator and verifiers and Guardians validators whatever you say uh so we run this program of chain uh The Operators Supply some input to the all others to run in their program and if they encounter an issue during their execution of the program they can go on chain and send the fra proof challenging to operator and operator responds than the verifier challeng I guess so at the end of several transactions Bitcoin utxo can know that whether the verifier win or the properly so by using this setup we are building the CK verifier between a single operator and multiple verifiers uh and in the in the long long term like what we are doing is make this

process as trust as possible with multiple verifiers so that if any of them are Hest they can simply uh challenge this uh operators input the ZK profound chain so they can guard the peg actually okay got it and you also mentioned earlier something about covenants and those are not super clear to me uh and I was under the understanding that op cat was needed in order to enable covenants so could you maybe explain what those are and also what opcat is and what it enables okay so in Bitcoin there's this utxo and you can spend it only you know how to spend it but Bitcoin doesn't enforce you to where to spend it so by by spending a

utxo you are creating new utxos but Bitcoin doesn't care about where they go but if you have covenants then Bitcoin also can restrict where they you this UT exos they can actually go so you can also program a single utx and say that okay I want this utx to only be spent with this inputs by just making this Rule and I want this utx to only go to this person's controlled utxo set such all this is the basic uh definition of corut it's not basic but yeah woro is the leading interoperability platform for multi-chain Bridges and applications with over 1 billion messages sent and 40 billion in value transferred wormo leads the industry and cross chain message

volume and total value transferred if you're a builder woro has an extensive sued of tools and infrastructure to securely build multi-chain applications you can use Wormhole to power def5 nfts governance and so much more and Wormhole supports over 30 blockchains and six different run times came your unique Wormhole NFD just for ZX research listeners today fill out a form prove that you've listened to today's episode to receive a PO app and you'll get an email over the coming weeks to claim your limited edition nft pair is an Innovative pair trading exchange built on top of Simo users can trate trending narratives with one click from Blue Chip narratives such as long BTC short e right through the whiff versus bunk the Hat stays on Sim's intense Centric

architecture enables deep liquidity short offchain and brought onchain and combined with pair has democratized access to complex trading strategies typically reserved for institutional Traders I wanted to follow up on sort of like the bit VM side of things right I think for most people that using etherum rups there are relatively familiar at least say for example like optimistic rups right when you want to bridge funds over to the L2 you go to I don't know like bridge. arbitrum doio or whatever the website is uh you send your e for example to the smart contract uh full nodes on the r up basically wait for like finalization on the L1 and then at after like whatever

checks they need to do they Min a corresponding amount of rapd for example on the L2 and conversely when someone wants to exit the L2 you send funds uh back to the bridge contract and then you wait for the 7 Day fraud proof challenge for you to occur and then those funds are released on the L one if you had to describe that same sequence of events but for a Bitcoin L2 would that's like a generic one or one such as like CRA How would you like walk us through that process I think I cannot just describe the other Bitcoin outs because like it's is too broad and almost all of them are just using multis like sending the money like coding the money and giving you the money so I won't describ it but in craa

we described this program as Clementine we recently op sourced it with like code the design as well so what what is happening is yeah you are going to a web page and inputting your evm address and it says okay deposit your money to this utxo so you send your BTC into that utxo after collecting enough signatures operator simply spans that utxo and put it into somewhere some utxo that is controlled by the BVM output and by showing this transaction proof on Citra you mint your cbtc it is exact BTC but we named it cbtc don't make the distinction and you use the sray all the time like you do def you do Landing you

do Bing need stable coins and you want it to go back to the main so there are several options that you can do one you can do atomic swap you can find someone who wants to get in and without trusting to that person you can simply go in and go out so this is the easiest way to get in and gets out from the Citra and other is using the native BM bridge and in that you simply burn your BTC on D 2 and request a withdrawal from Del one and once the proof containing this transaction is finalized on bitcoin operator gives you money from his pocket and you are good to go and after six months operator goes to the ban program and shows a ZK proof saying that this was like canonical chain I did all the

withdrawals these are the proofs for withdrawals and I want my uh let's say 10 BTC back because I did 10 BTC of withdraw and it claims the money back so in the optimistic scenario you are not waiting you are only waiting for proof let's say 1 hour or two hour to generate and you get your money but in the pessimistic case if the operator is malicious you L six months and the operator getting slashed and kicked out of the committee and you get your money from other verifiers so uh as it is like has a huge like issue of like sing and stuff it won't ever happen because it is not incentivized to do such thing and it cannot even steal it can just like prevent but it still gets slashed so you

can assume that withdrawals will happen once the proof is finalize or you can simply use Atomic swaps all the time without getting sensored you mentioned the number in there which is six months in the PES pessimistic scenario why is that time period so long that seems like abnormally long in the grand scheme of things yeah so so in eum uh you have this chest CL what we call is like as an operator like you are the verifier and you challenge me and I respond immediately and you respond immediately so we can immediately go through the steps but on bitcoin there is no relative time so we have to Pride everything with one week in the steps so if this round in the worst case takes 40

transaction then you need to uh wait 40 times 7 days because there's no relative time so in the worst case if this happens we need to protect the peg against it so the 6 months should be longer than the actual uh worst case FR out prooof that's why we choose six mons I wanted to dive into sort of like the primary design trade-offs because there are a lot of like design decisions that one can take when designing a Bitcoin L2 or just like any L2 to be honest on any sort of Base there so could you explain the primary design tradeoffs that teams are making in the Bitcoin L2 space today yeah so uh you can go with side chain right like uh it is the most common way

to build uh building a side chain is not that hard you simply fork ethereum or like any ethereum client or like most anything that you can uh do you can Fork but the issue is how to bridge the BTC because the Bitcoin doesn't know about about side chain so you usually put some multis it is like the one option is it is like permissions on Federation like close M you select five people I said trust this five people they willon Ste your money and you can build the bridge and other is if you have any other token negative token then you can make it stake like Stakes so that the Staker of that token becomes the multi members that is the one way so inside chain you

have this two ways for the Peg and it's very straightforward other than the peg mechanism and on the other side you can build channels like lightning or like Mercury which are very limited in terms of programmability and like uh Capac and the design and other is you can build troll ups I don't think any like legit teams other nria building an actual Bitcoin rollup they uh they usually do like easiest thing build a multi verifier commit and build a rollup on it so it is kind of roll up with multisig Bridge which are not very useful because the value itself is actually the BTC Bridge so and other is what we are doing the hardest day and like the most uh maybe uh challenging way to do it to

build the ACT actual ZK verifier in bfia can you also dive into citria VM I believe it's evm equivalent so I'm curious about the design Choice there I assume just given the like you know the the sheer amount of developer mind share on on solidity and the evm in general would be the answer but would love to get your thoughts there as well as uh I guess your thoughts on interoperability with citria and maybe ethereum l2s or other Bitcoin l2s or how you're thinking about that problem yeah uh so we choose the evm because like you said we think that it is like for the adaption it is like the best by far uh and it is like most secure even though

like it is some known drawbacks but uh it secures billions of dollars which other ecosystems probably don't other than Sola so we choose evm because of like it is proven security and track record and the develop consist we are building a type 2 ZK evm which is like fully evm compatible you can simply Port your all applications from eor marit optimism the casing the casing is not not equivalent so you need to do something but eum can easily Port we do did this choice and but our like no software is very modular so in the uh future we want to add vasm VM to enable like lower cost computation with like much more data like much more uh

resource and you can also implement CVM like move move VM because of the not software but the priority is implement the evm and make it work fully correctly uh other than that I think other Bitcoin alos with interoperability if there are an actual Bitcoin al2 then you can connect this through lightning simply like you can open Lightning channels between the rollups maybe and if they share the same da layer which is Bitcoin in our case they can also communicate through the da layer uh this is a interesting design but I don't think any other roll up working on pure Bitcoin da so it won't be possible and for other ecosystems are not software will include IBC integration our not

software is like a fork of s SDK in the future it won't be we will adopt changes to the SDK as well but as of now it is kind of like uh similar to the SDK and with the IBC connection coming to their uh not software that we will be connected to the cosmos ecosystem as well following up on that uh on CRA VM which is for the evm equivalent just walking through for the listeners like what is possible so is it all of the dabs that you see on it's your maina and it's l2s you know the Dex some money markets those are all entirely possible within the C of VM and the followup question is if you wanted to like mint new tokens on like this Bitcoin L2 like what does that

look like is it more or less exactly the same as like one would do on like ethereum or an ethereum based l you it is exactly the same like you simply change the RPC end point of your tool link or add some Network to metamask it works exactly if you are meting erc2 you do exact same things that you do on the gotcha um then following of there since you mentioned RPC in terms of infrastructure um more so in terms of like wallet providers the RPC providers people like indexing the chain for like data analytics are there any like interesting nuances to such VM versus like for example like existing companies where they need to tailor their

infrastructure somehow to sort of make it work with such VM or will it just work like out of the box I think very small tricks are required for like explorers it is just EV like we support most of the rpcn points they they need so they can but if also they want to like track the AL finality which I think none of the ter to explorers does right now uh the exact finaly not the confirmation I think they need to like do some small Arrangements obviously other than I tell you but the big biggest part of it is just changing the rpcu at all it is very easy I want to dive in a little bit into the block production process because on ethereum l2s you have centralized sequencers today and it's a big pain

point we're trying to decentralize though to get closer to that you know falic touted type one uh status for a rollup is is are you going to see the same problems for citria and how are you thinking about working through those yes so we have a single sequencer at the beginning uh just like another roll up I think uh it is okay to like have until we have like consistent uh technology like secure everything is secure than audited and such what our plans is like very straightforward we will Implement proof of stake like mechanism uh for sequencers so uh there will be multiple sequencers decentralized sequencer Network and they will produce blocks either with like tender M con or round R

fashion uh and users can just like put a note and connect to that sequencer Network and with that we will also enable this volution model uh which is simply like offchain da and onchain da combined so in a single evm runtime you have the both options if you are deploying a contract you can choose to deploy to the craa data and you can choose to deploy to the Bitcoin data when is uh the perfectly secure Bitcoin and expensive and the other cheap and if you are running a full not that is also trustless to you so with this this the centralized sequencer Network we will also enable uh not only like decentralize the sequen but enable the a boost of the

scalability uh following up the sequencer uh conversation you know most ethereum based rups have soft confirmations from the sequencer so with the sequencer Foria also offer like the same soft confirmation quotequote like guarantees for users and how fast can users expect those soft confirmations yeah uh so our our current Block action is like two seconds uh the block interval is 2 seconds and it is yes soft confirmations until the batch is inscribed into Bitcoin so let's say if the block goes in 10 minutes then the order guaranteed by the sequenc is for 10 minutes okay that makes sense and then I wanted to followup ask and and ask something about finalization I think

when people think about L2 finalization a there's like a few different ways of thinking about it one is for example like the base chain finalizing after for example the transaction C data and the state rot has been posted to the base there another way of thinking about is finalization from like the bridge contract point of view and that only takes place for example after a 7-Day uh fraud Pro a fraud challenge window how would you sort of like explain and think about finalization for AA and I guess what does that look like from like different stakeholders perspective yeah so we are using State tips which means that we are only like inscribing the data after the proof is generated and there can be like longer waiting

times until the proof generate is like say 1 hour or two hour so in order to like keep the order guarant same we're inscribing C closer commitment to the Bitcoin in every single block which means that c closer inscribes a commitment and says that the ordering is the hash like ordering hashes this so in ourz case circuit in our appr we are checking against the sequencer commitments so that the ordering isn't changed until the the batch is proven so if you're like regular user doing some regular transactions you are trust you can trust to the sequencer Commitment if you want you keep the ordering and ordering won't change and the proof is will come after that if you are fine with that you can just close your

computer and other than that if you have like bitco full node then you can see the data inscribed and after that it is just like your threshold because if you have a Bitcoin note you like yourself has some threshold for finance right some people wait one Bitcoin blocks some people weigh six Bitcoin blocks I think it depends on like value of the user uh transaction that it actually cares but the regular uh thing in Bitcoin like exchanges and stuff wait for one block or two block and the usual indexes and such like four blocks or five blocks six blocks is like almost a hard confirmation it is probabilistic not hard confirmation uh but I think for blocks is like very standard if you're

are doing some like big amount of transfers following up on the the sequencer uh conversation I think one thing that's really changed with l2s on ethereum recently was IP 4844 through the denin upgrade and you saw a lot of changes in sort of like the fee Dynamics especially in terms of The Da posting cost for CA and a sequencer how do you think about or what do you think like gross margins for the sequencer looks like and what might be some of like the leverage that can change the profitability of the sequencer yeah Bitcoin da is like obviously expensive than like Proto Lang sharding and like otheres so I think the Seer margin is a

little bit higher because of that because of the cost is all bit like higher than that so A ter is is like rollup Centric road map but Bitcoin has this like nothing Centric road map it is just like work and like adopt some changes if it makes better in like every let say two years or three years so uh in the shortterm Bitcoin is like quite issue for the uh like price and stuff but it's obviously the most secure way to scale the actual L1 and in the future with the volution I think this issue is also solved for regular R like everyday users because they have them options with like cheap ta with the same security if they had the full note how do you Bitcoin uh reorgs at the

Bas layer affect the user experience on citria like if if you are you know transacting and then something gets posted or inscribed to bitcoin and then it comes out after the fact that actually that block was reordered like does that affect the user's balance on the L2 or or what does that actually look like in practice uh so we are like sending this um proofs after generating the proofs to bitcoin and if like it reworks we send it again so the L2 never works because we are building the L2 blocks on top of the confirmed L1 blocks so there's no risk but there's this delay to access to the Bitcoin data we are waiting for blocks to access to the Bitcoin data but as a result I to never roll backs Al one if there's like some not deep R but

after the proof is inscribed like I said it is users preference to choose whatever like time they want to wait they can wait one block and close their computer they can wait four blocks they can wait six blocks it depends on the I think user choice but there's no r on the L2 because of that and then zooming out like why do you think there's demand to use a Bitcoin L2 over an ethereum L2 like it like it feels like we're kind of you know taking a step backwards in a way in terms of you know 10-minute block times long withdrawal times you know long time to finality like why is this ultimately something that you decided this is something I need to devote all my time to yeah so I think there are several things that we need to discuss

here one is like Bitcoin is the like most valuable asset in the blockchain right now it is more than one Tron and it is untapped and with orinal and like BRC and other things we saw that there's actually a demand for using Bitcoin it is not doing like shitcoin stuff or it is not doing nft stuff it is actually about we want to transact using Bitcoin we want to use Bitcoin in the economy we want to pay with Bitcoin so we we solve the demand with oral and VC uh that's the main reason that we are building it because there's demand from users actually use within they do VC wi is because there is no option to build un on bitcoin natively that's why and other is everyone in in the like crypto

has BTC in their portfolio I think that's for sure like may maybe like less than 1% of the people don't have any BTC in their portfolio but usually this BTC sits in The Ledger treas like cold volet or like Bitcoin main chain um I personally don't trust wbtc some people don't trust ethereum some people don't trust other things so uh the issue is like but these people want to use Bitcoin want to yield Bitcoin want to like uh land their Bitcoin and borrow us instead of selling it so I think there's some demand from the Bitcoin base here we saw that with orals and there but with C this will

also accelerate because most of the Ean people actually don't know how they can use the Bitcoin in their economy because it is not possible to use in a trust minimized way but with CA it you can now use the BTC in a trust minimized way in the real Eon following up on that um you mentioned how you don't trust wbtc which is I think a very fair take I think it's still currently custody by uh bigo even though they've been doing it for a really long time without any sort of of incidents conversely if someone wanted to sort of w say ethereum or usdc from etherum on to C like a Bitcoin L2 what does that process look like and maybe

what's like the most trust minized minimized version of like rap e that you can build on citria so we are not that natively building Anum bridge but if there is someone like who wants to build I can give some advice on C we have this single sux in proof for all the state right I mentioned the proof that is actually verified in bitv is a single proof verifies all the CRA blockchain so you can actually move this proof from the Bitcoin base here to the etherum smart contract and make this gross 16 proof verify there right as a step one then etherum actually now verifies Citra in a trust mean wise way so this is the one side of the bridge now etherum knows Citra actually holds the assets so how

how can know ethereum also of asset so you can also have this ethereum light client proof which is not trust minimized actually it's like syn Comm there is happening around validators but it works it's also you can rra it into like R6 proof the suction team did this for like no Chain Bridge I think so you can also get this proof and verify on craa so now in the both sides you actually verify the ZK proof one is very trust minimized and the other is the light proof so BL chain knows their latest State then you can build a almost trust minimize eum bre to Brum liquidity as well I think that's like a more concrete thing how we can build but we

are not na building any solution for that okay that that makes sense um then I guess an open invite to anyone that wants to build this bridge I wanted to go back to the the sequencer and sort of like the fee conversation so for most l2s there's the your L2 transaction fee is comprised of two components the first is the L1 data posting cost and then the second is the L2 execution fee I guess I'm quite curious about how you guys are going to calculate the L2 execution fee are you going to get like add an extra so for example like Factor will you like dynamically is it going to be like EIP 1559 style how are you guys thinking about this execution fee yeah that will

be like the implemented but be the like uh data fee plus a base fee for the proven cost uh and the uh extra tip will be if go goes to like sequencer so but in the future yeah we need to like arrange a fee markets according to the like actual proof generation because proof generation G is like proof generation cost is not exactly same with the evm cost evm guest cost but that requires threedimensional fees which no support today right even even with Maas we are just with arbit optimism it has like it adds some da cost but the wellet actually doesn't like support it I think that's like

quite big problem but uh before going to like with three uh phase fee market with the proving cost the tip and the da C we first need to solve the compatibility issues with all the buets but after that yeah we will implement this multie Market how large in terms of data are these proofs going to be because I see like a lot of people talking about Celestia and salana and and obviously Proto sharting and like da throughput so how much can Bitcoin actually handle uh from like a like because you you'd imagine like if you start throwing in fixed interval inscriptions and then there's multiple l2s like this could get

you know into a bidding war pretty quickly especially if there's user demand so what does the capacity actually look like yeah so Bitcoin has this 4 megabyte per 10 minutes uh you can use it with anything about either like regular payment transaction or incription uh so we are using State diffs and like we are Bing as many transactions as possible and uh so with State you cannot say like exact TPS or exact thing because it depends on the usage but we SLE several eum blocks and if you do like 10 times more TPS than Bitcoin you only take like quarter of the Bitcoin block and we like leave space for other transactions as well so I think in the short term it is enough to scale which Bitcoin because of

the like newly boost stopping demands and like new use cases but in the long term yeah we need alternative da uh to solve this in our think it is volition which is like the native da combined with Bitcoin da but others can choose to like build validum usings LDA optimums or maybe even self custom da Solutions with like payment Focus rups but in our case volution is the uh solution for the long-term da problem I guess uh you mentioned like the possibility of using alternative da Bridges just now um for Bitcoin rollups would the implementation of that be exactly the same as sort of like

ethereum based rollup would you also require for example like a blob stream I forget the exact name but like the gravity Bridge from like Celestia to bitcoin would someone need to build that in order for Celestia for example to be used as an LDA layer for Bitcoin rollup yeah if someone wants to build like Bitcoin L2 Bitcoin validum or Optimum with celesti DA they need to get like our bridge and they need to replace this light client proof combined with like blob stream proof or like vector proof of Thea so that they can also get the guarantee of the like other chains data commit that breaches the actual data attestation uh it is like not easy thing to do it needs like aggregational

gross improv and such but yeah it is doable but it is not Roa gotcha n that makes sense um I wanted to dive into your proof generation editor given that's a pretty cor component of s so there's a few components and moving parts that I would like to dive into the first one are the batch proofs that are produced for every few uh sorry for every Bitcoin block could you dive into exactly what's happening here and perhaps how the badge proof circuit is configured to scan Bitcoin proof sorry bash descriptions uh via inclusion and sound as proof sorry that was a super long question no no I think it's fair question so uh like I said we inscrib the sequencer

commitments on the bitco like per 10 minutes uh this helps us to like keep the ordering the same but while doing the proof generation of zkm we also need to consider these sequen of commitments right but you can simply input the sequen of commitments but if you cannot like you cannot constraint them so that approver can lie above sequencer commitments and change the order in order to prevent this our circuits with like this is a feature coming from The Sovereign code base as well uh we have this inclusion and Solus proofs so you have the block header you have the blobs extracted from the Block According to some Rule and you have the inclusion and complet proof against it so inclusion proofs simply check that this commitment

is actually included in the block it is simple by just checking the morle proofs against the block header and the second is the com uh solness proof the uh completion proof so with that we are also checking that there is no other commitments other than this proved FS so it is a little bit trickier to implement but it simply uh looks to the Bitcoin had to run like several transaction H and say okay this is the only possible blob that can be included in this block and with that we can uh in the ZK circuit we can make sure that the sequencer commitments are Trust they are not coming from a trusted Source like Prov and then we are make proving the

ckvm bches and periodically check against the Seer commitment so the or drink and didn't even change okay yeah that makes sense there's another type of proofs which are light like client proofs and these recursively validate The Bash proofs and provides a signal proof for the full world up history right and this allows for things like trusters and instant like clients could you walk us through the process for light client proofs and perhaps some of the trust assumptions that this enables for light clients yeah so um with this PCH proofs we inscribing this PCH proofs on bitcoin right but later then we go over the Bitcoin block space and aggregate these proofs together so we simply extract the

proof from Bitcoin with inclusion Asus proofs again and then recursively verify this proofs together so in the end you have a single proof saying that I scanned all the Bitcoin block until this block has and I verified every single C block that I encountered so in the end if you verify this Cent proof and if you know the latest Bitcoin blockage with your like Bitcoin light node or like Bitcoin full node then you can make sure that this is the canonical C blockchain this proof helps us with like building theum bridge that I mentioned you can move this proof to the and verify that and also inm we are verifying outer proof also verify this proof as well so it's a very powerful concept similar to

mina that is like single SX proof for all the blockchain there's also one more exciting sort of newer concept that I don't think I've ever seen before and this is part of citus proof generation and it's a block space proving would you mind sort of just giving a quick rundown of what block SP block space proving is and why is it needed actually it is the name of this inclusion and S proofs so you are actually proving the block space that you extracted the proofs of commitments From the Block space you are proving that with inclusion ass proofs so it is the broader name of the concept that I described yeah okay got it got it and

then one other aspect of the Clementine blog post that we'll actually link to the show notes for the listeners to to read themselves but one of the questions that I had was the static utxo sizes and it sounds like it needs to be a fixed amount of Bitcoin when pegging in and pegging out can you explain why why that's the case and you probably already touched on it earlier but definitely like a lot to grasp in such a short amount of time yeah yeah yeah for sure lots of things to like talk it is not even like we haven't talk even most of the things but yeah with Clementine and the bfm usually there's no smart contracts that all the funds are collected right they are simply having this deposit utx SCE which are separate UT EXs but they are controlled by the BM

UT ex through some outputs and stuff but if you do Dynamic UT exercise someone can deposit one someone can deposit 10 someone can deposit five so once the withdraw will needed and let's say it is needed for three BTC you cannot even withdraw because there is no three BTC utxo you need to use the five BTC utxo but after that as you don't have coant you cannot make sure that the rest of the utxo the 2 BTC even come back to the Bitcoin Bridge so that's the issue uh of BM and not having covenants so we are having this fixed size utxo for pegging and Peg outs and is the idea that that will be

able to be changed SL upgraded in the future as Bitcoin kind of evolves as a dealer uh yeah I think if Bitcoin adops some changes like Co or maybe even in the future the zp verifier up code then yeah why not got it got it and then I I did want to touch on me because I did diagnose some like interesting me over on the stacks landscape and I'm wondering if you think there's a world because I've started seeing I think it was marathon is working on an L2 they're a large minor maybe they're incentivized to not pick up citria transactions and instead only include their own is that like a worse doomsday scenario that you've thought about I don't think this kind of exclusivity will ever ever happen

there's like only pool which is ocean that excludes like explicitly excludes ordinance transaction and it cost of like uh confusion and like issue in the community so Bitcoin miners are like economically they rally simply Mine Blocks with lots of fees uh the most fee block is uh that's in their like goal because they need to maximize their fees to like cover the hash rate cost the machine cost and electricity cost as such so if you pay enough fees I think Bitcoin doesn't even sensor you because like it has a Prov record on censorship resistance it is like way better than which like most blocks are like of comp and such but in Bitcoin there's like

only one issue happened in last couple of years that is like off vation address actually excluded so I don't think this kind of M will ever happen and we are using like single sequencer mechanism so also the m and like Sage kind of thing is not possible because we authorized the transactions with the signature but in the future let's say if you see base rollups on bitcoin and some other interesting constructions I think it can enable harmful M on bitcoin but it already happens with brc2 tradings because there's like some buying EV and you can maybe do the price even you cannot because it's not the am but there's some other ways to like front run or like back run some transactions on bitcoin you mentioned earlier um sort

of I'm really curious as to why you chose a zkr architecture over a optimistic architecture for suchia and I'm sure it ties into some like the proof generation uh factors that you mentioned just about would love to just hear why ZK over optimistic yeah so um the mainly because like uh the data issues like I said Bitcoin da is quite limited and if you are using optimistic rollup scenario then you need to post the full transaction data to the1 you cannot use State diffs because there's no State diffs you need to get all the transaction data to create the fronts we are mainly using CK for compression it compresses lots of data together so the scalability Improvement is way better

than the optimistic vops and in Bitcoin community in the future we are expecting to have like this zkp verifier up code in the base here in like next say five years so if it ever happens then having a zop is it will be too easy to switch just using that op code but there won't be like fraud proof uh op code maybe so as you decentralize like I can imagine the need for a slash able token how do you think about that do you think it makes sense to have like Bitcoin as that slash asset or I guess in your case C BTC um or do you think it makes more sense to like have like an external token but then of course you run into

the risk of attacks with like you know derivatives and stuff like that I think uh if you can do something with Bitcoin you need to do this with Bitcoin so with this like sequencers taking and stuff we are looking ways to like do this with and Bitcoin staking maybe using like Bon similar protocol to like Bon to have the staking so if you like technologically can make it with bit Bitcoin I think it is always better to make it with Bitcoin I wanted to ask a question about bottlenecks um so for ethereum in the early days you saw a pretty high amount of bottleneck from the da sort of Da to put or amount of like data publishing capacity available

now with ip4 going for for you're seeing some bottlenecks with execution and specifically sort of like the VM execution environment what do you think is the main bottleneck for Bitcoin l2s today and how do you see that sort of evolving I think uh for the like rups the main issue is obviously the at output again which we will solve with volition and the other is the settlement issue yeah we are using pvm the security and like trust assumption is way way better than the multi6 but it is still very CL right if you had like this opz KP then we could imediately verify and settle on every single block and everyone will be happy H so I think there are lots of things to improve I don't think in the near term there will

be like block size increase or such in the like longer future I do think that will be block size increases but maybe like non consensus blob space for like small this kind of follow similar to prodction can be implemented on bitcoin and with like orals and stuff I do see like some members also think about this kind of solution but it is also not in near future again so our way is to like solve this problems on our own with volution model uh but the settlement yeah bit is the best thing that we have so far and until we have the ckp verifying I think uh settlement will always be some issue and like the trust not trust but trust minimized issue to

settl here that's actually all the questions that I had you know kind of prepped Ren so I don't know if you have any others but orun I would also love to just give you the chance because you know this stuff way better than I do is there anything that we missed on in this conversation that you think is worth uh chatting about for a bit I think from a techn technology perspective we covered lots of things and from the other perspective like the economy and stuff we believe that Bitcoin is the real currency uh but without having a real economy around it it's not actually a curreny it's just like payment tool payment tool toen let's say uh so uh with CRA what we want to enable is an economy around Bitcoin there is this

block for issue happens but if we had like n Costo deal Bitcoin Landing it won't ever happen because uh this the reason why we are ex is simply this we want to enable a Bitcoin Finance Bitcoin economy to make the Bitcoin as like the foundation for the world finance and make BTC is like the king of the asset it is already like the biggest asset but only use Cas today payments but there can be more uh so V provides um to all the developers is just Port dat applications from ethereum as well as building some uni applications to empower uh the Bitcoin Finance yeah completely AG Grove that I mean Bitcoin is the largest crypto asset I know people don't like that word but

crypto token by a large margin and it seems like with like ORD those nfts you it's become like evidently clear that people want something to do with that app said and some productive use case and I think Bitcoin outs are a fantastic way to sort of prove out that thesis just one last thing work in the listeners find out more about citria learn more about what you're working on yeah sure uh cit. XYZ is our like web page and on Twitter it isore XYZ so you can find like all the documentation link blog link and like Discord link there and if you have any question we have like developer channel on Discord and like General chat so they can drop and I usually answer some of them on like our

sessions and such uh yeah that's the all resource and I I'm sure you will put some links below so it will be easy for people to navigate I I do have one more question before you go are there any other projects building in this space that are taking an Innovative approach that you know maybe you're not an expert on but you you'd maybe highlight people to look into um and then also what is the timeline looking like for citria like when will there be a if there isn't already a test net or Main net like what are you targeting yeah so for uh test net we are targeting in two months so in early may we want to have this test net and uh let's say uh it's like in Q2 broadly the main net will become of like test n like all this

and such uh for other projects I like BBM obviously is like huge steing Stone and if you know like R like a little bit Bitcoin script you should contribute to itvm and other than that the same team building zero syn like ZK coins B they're all same team and they're all open source as well I think these are like worth looking and yeah babon is kind of like inovative on bitcoin saking and like checkpointing more than that I don't like quite think Bitcoin sing is like maybe something that is like desirable but the Bitcoin checkpointing and like proof of work fallback is kind of interesting to me awesome well this has been an awesome episode Ron we'll be sure to link to your Twitter as well you always post

some good stuff on there there um and we'll have to bring you on again come uh you know main net launch so we're looking forward to following along yeah for sure like thank you for this great technical questions as well uh it was my pleasure to be here awesome we'll catch you next time we have teamed up with the Wormhole Foundation stewards of the Wormhole protocol the leading interoperability platform powering Crossing transfers for over 200 plus multi-chain dabs Wormhole isn't just a bridge it's the leading interoperability platform for multi-chain applications so go and claim your un nfts just for zerox research listeners today hit the link in the description to fill out a form and to prove that you've listened to today's episode and receive a PO app you get an email over the coming weeks to claim your limited

edition [Music] nft