#17 Are ZK Rollups on Bitcoin Even Possible?

In this post, we tried to understand the technical complexities around building a zk rollup on Bitcoin Blockchain.

This is my second long thread on Bitcoin L2. I've explained various Bitcoin off-chain scaling solutions in my previous thread.

You should also read that to build more understanding about this topic.

Detailed Thread on Bitcoin L2s

Why we need a Bitcoin L2?

Because Bitcoin has an average block size of 2MB, which can only accommodate up to 5000 transactions per block.

So, during peak blockspace demand, we usually see mempool congestion and transaction cost spikes in the Bitcoin network.

Especially after the rise of Ordinals and BRC20 tokens, the blockspace demand of Bitcoin has skyrocketed, impacting the overall user experience of the Bitcoin Network.

The Problem statement here is how to scale Bitcoin?

And the solution could be to follow proven off-chain scaling designs that could offload some demand for Bitcoin blocks, increase throughput, and enhance the overall user experience for end-users. In that context, Rollups are considered proven off-chain scaling designs.

Since Satoshi identified the benefits of zk-proofs 13 years ago, and some Bitcoin developers have also started exploring research around enabling zk-proofs on Bitcoin, it makes sense to think about scaling Bitcoin using zk rollups.

In the zk rollups design, a separate L2 network could execute transactions from their end, put multiple L2 transactions in a single batch, and settle that on the Bitcoin Blockchain, along with state updates which include validity proofs.

Now, the question is: Is it even possible to build a Zk Rollup on Bitcoin?

If it's possible, then how could it be achieved, what impact could it bring to Bitcoin, and what are the risks involved? Let's discuss that.

Bitcoin uses a scripting language called Script, which has some OPcode limitations that technically don't allow zk rollups on Bitcoin. But there's a catch: you could make zk rollups possible on Bitcoin by using some extra opcodes in the design.

In March 2022, Trey Del Bonis wrote a post on Bitcoin Rollups where he mentioned two opcodes called OP_EVAL and PUSHSCRIPT, which could reduce the cost and make rollups more efficient on Bitcoin.

Giving full nodes the ability to verify validity proofs is another change needed to support in order to make Zk rollups possible on Bitcoin. Del also pointed out the use for Recursive Covenants.

Recursive Covenants

Recursive covenants allow developers to specify conditions in Script to manage state changes, ensuring that BTC that is locked in a rollup script and hasn't been withdrawn by their owner yet remains in the script from one rollup state update to the next.

Recursive covenants changes to the Script have been considered by the Bitcoin community for a long time. In the future, We might see proposals that could make recursive covenants changes to the script, which we need for building zk rollups on Bitcoin.

Del also suggested some other opcodes like OP_EVAL and PUSHSCRIPT to reduce the rollup script size, decrease the amount of blockspace used, eventually making rollups cheaper to use.

The Rollup design proposed by Del is one way to build rollups on Bitcoin. There are some alternative approaches, such as converting elements @Blockstream sidechain into a zk rollup by implementing validity proofs, as they have support for recursive covenants.

Cost of Using Zk Rollup on Bitcoin

While it's logical to think that Account model-based Zk Rollups could enable 35 times more transactions in a Bitcoin block, you also need to consider the cost involved in computing validity proofs, which is very high.

Zk Proofs usually take 2ms-5ms for verification, while Bitcoin transaction verification time is 0.125ms. So, in that context, a rollup should batch at least 16 transactions to achieve breakeven on verification cost, and a larger batch size could reduce overall cost.

Risks Involved

Rollups could potentially attract corruption on the Bitcoin Network. There are some known EVM-related issues like Block Reorg, and MEV could be observed after the implementation of Rollups on Bitcoin.

I've shared a basic overview of this topic based on the research done by the BitcoinRollups team. You should check out this blog by @lightcoin for a detailed understanding of this topic.