Bitvm Overview: Introduce the validity proof into Bitcoin

Bitvm is the latest popular agreement in the Bitcoin ecosystem, which has the potential to benefit each project built on Bitcoin.Let’s talk about the design of Bitvm and its new possibility it opens to Bitcoin.

Introduce the fraud certificate into Bitcoin

“Bitcoin Season 2^{[3]“In the preaching, developers and users are excited about building projects on Bitcoin and bringing new use cases and new methods to solve the eternal challenge on Bitcoin.}

Bitcoin does not have scalability.Due to limited block space, transaction costs may fluctuate sharply during network congestion.Only 7 transactions are processed per second. Each block contains only about 1MB of data. If you want to use Bitcoin to use Bitcoin, it is not enough to rely on Bitcoin alone.You need to expand the solution^[4]Essence

In Bitcoin L2S^{[5](Layer2 blockchain) A lot of work has been done to improve the scalability of Bitcoin and the introduction of new functions.There are dozens of projects built on Bitcoin today^{[6]One of the most prospective research and innovation areas is Bitcoin Rollups^{[7]EssenceAt high levels, Bitcoin Rollups enables the transaction to occur under the chain, and then “roll” into a single state change to the blockchain. At the same time, there is a cryptography proof system so that the participants can verify that the state of the submission status is accurate accurate.Essence}}}

However, there is a challenge to introduce this proof system into Bitcoin, which is the role of Bitvm.

What is BITVM?

Bitvm^{[8]It is an agreement/rule set that can be achieved on the Bitcoin. Developers can immediately use this agreement to achieve various use cases on Bitcoin, including Bitcoin Rollups, and the minimum trust bridge.The core design of BITVM will be calculated to the chain, and a fraudulent certificate mechanism is implemented on the Bitcoin blockchain.}

Bitvm can achieve fraud proof on Bitcoin.

BITVM White Paper was released by Robin Linus in October 2023 (It is worth noting that Robin is Zerosync^{[9]One member of the team, the project is committed to developing a zero -knowledge certification system for Bitcoin), and developers have been experimenting with the agreement in the past few months, and they are becoming more and more interested.}

You can treat Bitvm as a distributed protocol/rule set that participants agreed in advance, rather than actual virtual machines (such as Ethereum virtual machines) implemented by software.Similar to Bitcoin Ordinals^{[10]The working method is part of the social consensus. Participants choose to join the rules, and these rules have not been fully implemented at the agreement level.}

The reason why Bitvm is so exciting is that it provides a challenge for verifying any circuit on Bitcoin-response protocol-you can make a statement under the chain (for example, this certificate is valid) and use Bitcoin L1 to verify.Among them, “on Bitcoin” is the key, because it is very difficult to build on Bitcoin. If it is implemented, the BITVM protocol can be used to build an optimistic ROLLUPS, two -way BTC anchor, etc.Essence

What is the problem with bitvm?

Any project built on Bitcoin know how difficult it is to interact with chain (in Hiro, we have experienced this pain in person).One of the challenges built on Bitcoin is that Bitcoin does not have the ability to process complex computing.

There is no smart contract.No virtual machine.Programming is limited to the operator that can pass through the operation code^{[11](Operation code) Construction content, and this function is limited.The introduction of new operating codes requires BIP and Bitcoin forks (this is very difficult).}

Therefore, we can only use limited programming without a fork and new operating code.In the case of expanding Bitcoin, this limit is mainly reflected in two aspects:

If you want to build a two -way BTC anchor, it is difficult to remove trust from the equation.Most BTC anchors involved the custodian today. Whether it is a single institution or controlling multiple alliances to handle deposit/withdrawal.Sometimes it is described as “writing problems”.In the Stacks ecosystem, the upcoming NAKAMOTO upgrade^{[12]Including the design for the minimum trust bridge -detailed introduction later.}
If you want to move the calculation or transaction to the chain through Rollup, it is difficult to verify and verify the data under the Bitcoin itself.This is a verification problem.

For these two issues, BITVM can unlock dramatic design improvements by achieving challenge/response protocols on the Bitcoin L1.

How to work in bitvm?

It is a good way to treat Bitvm as a protocol or a set of rules.If the two parties agree to follow these rules in advance (which means they need to cooperate with each other), they can play any challenge-response game.Theoretically, this can be used to verify/prove arbitrary complex programs on Bitcoin (the actual execution of these programs occurs under the chain).

Let’s give a specific example.

Suppose that Alice and Bob wants to play a coin game.The two players each put 0.5 BTC in the prize pool.Win 1 BTC on the front.Alice holds the coin and will throw the coin first.Bob wants to ensure that Alice will not cheat.The following is how they use BITVM to play this game (for simplicity, many details have been omitted):

Alice and Bob agreed to follow the Bitvm protocol.
Suppose that the front is expressed by the value H0, and the negative value H1 is represented.Alice has selected two other values, such as P0 and P1, and has hash on H0 and H1.Therefore, have (p0) = H0 and Hash (P1) = H1.P0 is called the “original image” of H0, and P1 is called the original image of H1.
Alice shares H0 and H1 with BOB (in fact, Alice “commitment” has “promised” hash values, so she cannot later claim to have different values).Bob does not know that the original image P0 and P1 (and “guessing” these values are very difficult, so we can safely assume that BOB will not magically discover these values).
Alice and Bob signed two transactions in advance: one for challenge and the other for response.

In challenging transactions, the BOB will contain a script. The script basically checks whether the input provided by the inspection is one of the known hash Ho or H1 -if the hash is H0, the BOB knows that the value is positive; if the value is positive; if the value is positive; if the value is positive; if the value is positive;It is H1, which is the opposite.In addition, the script has a time lock. If the response is not received before the deadline, the BOB will get the prize pool.
In response to transactions, Alice can “reveal” the coin results by “revealing” the coin results by containing the corresponding original P0 or P1.If Alice does not include any value, two values or any value other than P0 or P1, the BOB will get the prize pool.Otherwise, if the value is P0 (front), Alice won the prize pool.

Now we are ready to start the game.Alice throw a coin but has not revealed the results.BOB issued a challenge transaction, and then Alice responded to the transaction.Through the script described earlier, the logic of “fraud detection” is performed on the chain.Obviously, this is a trivial and deliberate example, but it shows key ideas.For a slightly complicated example, consider a well -written chess game designed by a developer named Super Testnet.You can view the GitHub repository here^{[13], Even today, you can play “Bit Tac Toe^{[14]“Super testnet actually shows this game to Hiro, you can watch below:}}

Bitvm Crash Course on YouTube^[15]

The following is the premium component of the game:

Jingzi chess is a 9th palace.The first player Alice can take a maximum of 5 steps, so there are 45 pre -image and hash (9 per round).The second player can take up to 4 steps at most, so there are 36 hash.
There are 3 “cheating” methods in Jingzi: Players can place multiple X / O in their rounds; players can cover the squares they used before; players can cover the opponent’s previous squares.Therefore, the challenge/response protocol is built around the test.
Challenge the transaction will force another player to “reveal” which square of them placed X or O.
Response transactions will have a script, which will be checked for all three of the above. If fraud is not detected, the game continues (or the game is over because someone wins).If fraud was detected, the challenger won and the proof of the proof failed.

Please note that in these two cases, fraud proves are handmade, and it is designed for the use of the use: the fraud proven by the chess chess does not work for throwing coins or anything else.

Back to the overall situation, the Bitvm white paper describes a general method: For any program, it provides a way to build the validity proof of the program.The key opinions are as follows:

From the example of throwing the coin, we see how to verify a single bit: Let us call it a “Bit commitment” proof.
With Bitter commitment, we can build a logical door commitment: Considering the Boolean and / or operator -for any two inputs (each value is 0 or 1), the operator defines a single output.Therefore, using 2 Bit commitments as input and 1 Bit commitment as output, we can create effective proofs for any logical door.Bitvm white paper uses a NAND logic door.
Finally, any of any calculation can be represented by a series of logical doors.Bitvm white paper calls it “binary circuit”.Such a circuit can be effectively represented by TapScript, and the leaves in each TAP tree represent a single door commitment.
The challenge/response protocol basically involves the output of a specific door commitment.In the worst case, you may need to verify the output of each single door.

Check this repository^{[16], Understand a way to convert any program to a TAPLEAF circuit.}

How does stacks adapt?

The two obvious and most related applications of Bitvm in the Stacks ecosystem are:

Improve the trust assumption of SBTC
Add effective proof of effectiveness to the Stacks block on Bitcoin

Why choose these two applications?Current SBTC design^{[17]It is already one of the safest and minimized two -way bidirectional anchors in Bitcoin.Nevertheless, in security models and trust assumptions^{[18]There is still room for improvement.Different from the request for at least 30%of the honest signatures or trusting a set of high reputation signatures, Bitvm -based methods can theoretically make SBTC only need an honest participant to run.}}

Similarly, although each Stacks block is settled on Bitcoin, the current design only allows you to independently verify Stacks data when a copy of a chain state.If you use BITVM, Stacks block also includes effective proof, then you can not only check the integrity (the data in the given Stacks block is consistent with the hash stored on the Bitcoin), and you can also check the correctness (you can check the storage storage by viewing the storageThe proof of the Bitcoin verification verification is the actual execution of the transaction in a given Stacks block).In other words: This will enable Stacks to develop into a optimistic ROLLUP on Bitcoin.

How to use BITVM to implement the specific methods of these applications require more research and development.But we can try to outline some ideas at high levels.

Bitvm and SBTC

Consider the example of SBTC: The anchor process is very simple, and only the Bitcoin transaction is required to complete.However, in the current design, the anchor exit process depends on the signature to process the request (on Stacks).This brings some constraints:

Exit may take time, depending on how many signatures are offline/honesty.
You need to trust this signature network and more widely trust the entire Stacks.

If you change (or maybe), generate an effective proof on Bitcoin and use BITVM^[19],So:

Exit can be optimistic (therefore, it can be treated faster on the road of happiness).
The anchor only requires an honest participant to run; you don’t need to trust 30%of the signature network.

The key is to accurately find out how to build a proof of validity.The brute force method described in Bitvm white paper can work, but it may lead to a very large TAPLEAF circuit (billions of nodes).This in turn means that any challenge will take a long time (it may take weeks or longer), let alone the cost of attention and resources (transaction costs!).As we can see in the example of Jingziqi, we can build a more concise proof, which is customized for specific cases. Similar methods may be more effective for this situation.

Bitvm and stacks

As for the effectiveness of the entire Stacks block, there are many design space worth exploring.For example, the granularity of a single transaction or the particle size of the entire block is between the two (such as a transaction that constituted the cause and effect dependency chain)?Is it possible to adopt a gradual method, such as a proof of a simple token transfer, and then gradually add a Clarity contract?Is this a good use of Bitcoin block space, because Stacks miners and network participants already have economic incentives to maintain the complete history of the Stacks chain state?

in conclusion

Bitvm is an exciting theme that needs more research, thinking and experiments than blog articles, but I hope this will help clarify one of the recent exciting development in Bitcoin.