Alpha Leak | The Bull Case for zkBTC

In this episode, David is joined by John Light of Sovryn and Eric Wall, who moonlights David on the Bitcoin technical details throughout the interview. The three go over the bull case for ZK-Rollups on Bitcoin. It’s undoubtedly the frontier. ------ 📣 Infura | Join the New Decentralized Infrastructure Network Early Access Program www.bankless.cc/infura http://www.bankless.cc/infura ------ 🚀 SUBSCRIBE TO NEWSLETTER: https://newsletter.banklesshq.com/?utm_source=banklessshowsyt 🎙️ SUBSCRIBE TO PODCAST: http://podcast.banklesshq.com/ ------ BANKLESS SPONSOR TOOLS: ⚖️ ARBITRUM | SCALING ETHEREUM https://bankless.cc/Arbitrum 👯 DESO | DECENTRALIZED SOCIAL BLOCKCHAIN https://bankless.cc/Deso 🦁 BRAVE | THE BROWSER NATIVE WALLET https://bankless.cc/Brave 📡 TRUEFI | CRYPTO FINANCIAL HUB https://bankless.cc/TrueFi 👾 SEQUENCE | ALL-IN-ONE PLATFORM https://bankless.cc/Sequence ⚡️FUEL | THE MODULAR EXECUTION LAYER https://bankless.cc/fuel ----- Topics Covered 0:00 Intro 5:10 John’s Background 8:24 How zkBTC Works? 11:00 Eric’s Interest 15:43 A Better Lightning Network? 21:33 Rollups on ETH vs. Lightning Network 25:50 Rollup Potential 29:24 Optimism 32:15 Expressivity 43:53 Limitless Bitcoin Applications 46:29 Layer 3 Protocols 50:25 What Needs to Happen 52:05 Forks & Flippening Effects 58:00 Proof Systems & Recursive Covenants 1:09:40 Next Steps 1:12:00 Research 1:14:12 Eric’s Thoughts on Bitcoin 1:16:50 Closing & Disclaimers ------ Resources: John Light https://twitter.com/lightcoin Eric Wall https://twitter.com/ercwl Validity Rollups on Bitcoin https://bitcoinrollups.org/ ----- Not financial or tax advice. This channel is strictly educational and is not investment advice or a solicitation to buy or sell any assets or to make any financial decisions. This video is not tax advice. Talk to your accountant. Do your own research. Disclosure. From time-to-time I may add links in this newsletter to products I use. I may receive commission if you make a purchase through one of these links. Additionally, the Bankless writers hold crypto assets. See our investment disclosures here: https://www.bankless.com/disclosures

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:02David Hoffman?

  Today on this AlphaLeak episode, we are exploring ZK rollups on Bitcoin, which I didn't even know was possible until I stumbled upon this website called bitcoinrollups.org, which is a research endeavor out of this man, John Light, who got a grant to go research, what can you do when you put a rollup on Bitcoin? Is that even possible? And so it turns out, a lot is possible. Also in this episode, I bring on Eric Wall, who's also a Bitcoiner, a technical Bitcoiner, to help me co-moderate this conversation, because this is something that Eric Wall, I know is just very interested in and wants to see happen on Bitcoin. So, we talk about rollups on Bitcoin, of course, what that means for the Lightning Network, what you can do on a rollup on Bitcoin? Is it just a payments network? That is a better Lightning Network?

• 0:45David Hoffman?

  Or is it the full suite of smart contracts, tokens? What's it take to put rollups on Bitcoin? Do we have to hard fork? Is it just a soft fork? How complex is this? How is the community going to receive this? Because the Bitcoin community is generally resistant to change. But we've kind of been seeing a tide shift in the Bitcoin community lately. Maybe there's more Bitcoiners that are more interested in something like rollups on Bitcoin. And overall, I'm just really fascinated about this concept, rollups on Bitcoin. And it's kind of restored my interest in Bitcoin. It's one of the most innovative things I've seen out of the Bitcoin space in a really long time. And so this is something that I hope to see coming for the future of Bitcoin. So I hope you enjoy this exploration into the world of ZK rollups on Bitcoin with my two guests, John Light and Eric Wall, right after we talk to some of these fantastic sponsors

• 1:30David Hoffman?

  that make the show possible. If you've been listening to Bankless, you know that we're fans of the modular blockchain thesis. The idea that blockchains will separate execution from data availability and consensus, allowing all three to become the best versions of themselves. And Fuel has built the fastest modular execution layer in the industry. By supporting parallel transaction execution, Fuel unlocks significantly faster throughput for the Web3 world. Fuel also goes beyond the limitations of the EVM with its own Fuel VM, which is more efficient and optimized, opening up the design space for developers. And lastly, Fuel brings a powerful developer experience with its own domain-specific language, Sway, and a supportive tool chain called Fork. With Fuel, you can have the benefits of smart contract languages like Solidity while adopting the improvements made by the Rust tooling ecosystem,

• 2:15David Hoffman?

  letting the Fuel development environment go beyond the limitations of the EVM. If you want to learn more, there's a link in the show notes to see how you can get involved with a Fuel network. Sequence is the all-in-one developer platform you need to build Web3 games and applications. For your users, Sequence is a smart wallet, and it's the easiest, most intuitive onboarding your users will ever experience, and comes with all the features users need to feel empowered in the Web3 world: multi-chain support, NFT display, and users can buy SFTs, NFTs, and crypto directly with a credit or debit card. For developers, Sequence is the plug-and-play platform for Web3 games and apps. Their APIs let you bring NFTs, SFTs, and tokens into your game or application. And a Sequence relayer enables gasless transactions for your users. Sequence already powers some

• 2:59David Hoffman?

  of the best Web3 games like Skyweaver, NFT projects like Cool Cats, and marketplaces like NiftySwap. And Sequence is compatible with all the EVM chains, including Ethereum, Polygon, Binance Smart Chain, Arbitrum, Optimism, and Avalanche. So go to sequence.xyz/banklist to start building, or speak with the Sequence team today. TrueFi is DeFi's largest credit protocol, connecting global lenders with institutional-grade lending opportunities. TrueFi has completed over $1.7 billion in originations and paid out nearly $35 million to lenders, proving that DeFi is ready to take its next big leap into the $8 trillion credit market. TrueFi gives lenders like you access to sustainable, high-yield opportunities backed by real-world investments, usually reserved

• 3:41David Hoffman?

  for high-net-worth individuals. At the same time, fund managers use TrueFi's financial infrastructure to bring their portfolios on-chain, benefiting from the global liquidity, cost savings, and transparency of DeFi. TrueFi is a decentralized financial utility. The protocol is owned and governed by the TrueFi DAO, and TrueFi is here to bring DeFi into the golden age, bridging the power and access of crypto with institutional-grade lending opportunities and portfolio tooling. Explore the diverse financial opportunities available on TrueFi, or launch your own portfolio at truefi.io. Welcome, Bankless Nation, to a very special episode of AlphaLeak. Today, I'm joined with John Light. And John Light currently works at the head of product for Sovereign, but also Moonlights as a Bitcoin researcher in his free time, and recently got a grant

• 4:24David Hoffman?

  from the Human Rights Foundation to do research on how to do ZK rollups on Bitcoin. And this is what piqued my attention and why I wanted to do a show on this, because ZK rollups on Bitcoin, I didn't know that that was possible. But according to John's research, it is possible. John, welcome to Bankless.

• 4:43Speaker 01

  Yeah, thanks so much for having me.

• 4:46David Hoffman?

  And also, because I am not always the best person to ask Bitcoin questions, we're bringing in some help. We're bringing in Eric Wall, who's going to be my technical co-host, my Bitcoiner co-host, to ask me and ask John some better questions, more than just the higher level stuff. So Eric, thank you so much for helping me do the show today.

• 5:06Speaker 02

  Thanks for having me, David.

• 5:09David Hoffman?

  Cheers. All right, John, let's get into it. Explain a little bit about yourself, give yourself our bio, and kind of how you came to be working on the intersection of ZK rollups and Bitcoin.

• 5:20Speaker 01

  Sure. So I'm a longtime Bitcoiner. Bitcoin is my first love, you could say, in cryptocurrency world. And I have had a fascination with cross-chain Bitcoin protocols. Even before sidechain, the term "sidechain" was even developed, I've been interested in this idea of like, could you move Bitcoin into other chains that have different sets of rules? And the Sidechains White Paper came out in 2014. I was really excited about that. Years went by, and the best kind of sidechains

• 6:03Speaker 01

  we've gotten so far are like federated multi-sigs that hold people's Bitcoin.

• 6:11Speaker 01

  And I've always been interested to know, can we do better than that? Can we have permissionless, trustless sidechains? Or at least bridges to other blockchains? And a couple of years ago, I was working on a project in the Ethereum world called Aragon. And this is a DAO creation tool.

• 6:40Speaker 01

  It was also around the time of like, well, first there was CryptoKitties, which kind of caused a lot of congestion on the blockchain and we were already starting to think about scalability around that time. So like late 2017, early 2018. Um, but throughout the, that, that, um, bear market, gas fees started coming down and it became less of an issue, but it was always something in the back of our mind. So, research was ongoing about how can we improve the scalability of this system so that it doesn't cost like a hundred dollars to cast a vote or something like that.

• 7:18Speaker 01

  Um, and eventually, um, you know, ideas like plasma and state channels and eventually rollups, um, were invented in the Ethereum community as ways to reduce congestion, move transactions off-chain, make transactions cheaper, more scalable, so on and so forth. And, and so that's how I first became familiar with rollups. And, um, eventually, um, these two interests of mine kind of converged where you know, I realized, okay, rollups are basically like trustless bridges.

• 8:02Speaker 01

  Um, that you can use to transfer coins to other blockchains. This is like, you know, kind of the original sidechains vision of like having, you know, trustless uh, bridges to other blockchains and you can move your coins between different blockchains. And I thought, you know, wouldn't this be, uh, cool to bring to Bitcoin?

• 8:24David Hoffman?

  John, I think the, the most interesting thing about this for me is that, uh, ZK rollups are a technic- technology that Just makes sense to me in the Ethereum ecosystem. It's the logical progression of like state channels to plasma to rollups has always felt very like a natural progression of scale for a blockchain. And so then when we talk about using this, which is just an inherently neutral technology, ZK rollups are just a neutral technology. The fact that we can allegedly, which is what we're going to unpack today, that we can apply a ZK rollup to Bitcoin gets me excited. It's one of the first things I saw a lot of potential out of the Bitcoin space in a long time. Like Lightning has never really interested me. Liquid has always been a joke.

• 9:09David Hoffman?

  But ZK rollups seem like if we can apply them to Bitcoin, it can open up a brand new world. And that's really what has gotten me excited here. And so really just to define these terms, we have ZK rollups on Ethereum. Is it simply as, is it as simple as just taking the technology that we've gotten and started to roll out in the Ethereum world and just applying it to Bitcoin? And then also it just like quote, works? Is it really that simple?

• 9:37Speaker 01

  Depending on how validity rollups are actually enabled on Bitcoin Layer 1, the smart contracts that secure the bridge between Layer 1 and the Layer 2 validity rollup could be practically identical to the smart contracts that are used for validity rollups on other chains. Or they could be quite different because Bitcoin uses a different state model than Ethereum, for example. So Ethereum uses a state model that's known as the account model. Bitcoin uses a state model that's known as the UTXO model.

• 10:18Speaker 01

  And this has implications for how you program smart contracts to interact with user funds, including in this use case, enabling users to transfer their funds into a Layer 2 protocol, such as a validity rollup. So while the rollup features will be or could be identical between rollups that you could build on Ethereum, for example, or rollups that you would build on Bitcoin, the actual mechanics of how the funds are secured on Layer 1 could be quite different.

• 11:00David Hoffman?

  Eric, I know you've always been an optimist about the future of Bitcoin innovation. I know that ZK rollups has been one of those things. When you saw this paper, and also for the listeners who have a computer handy, bitcoinrollups.org is a useful website, which is kind of the punchline of this whole show. Eric, when you saw this paper, when you read this paper and saw it out of John Light, what did you see? What got sparked in your imagination?

• 11:24Speaker 02

  Yeah, so just to give some context on how the research project came to be, the origin story here is that it was actually Udi Vertheimer that had some argument on Twitter that led to CMS Holdings making a $100,000 grant to a charity of Udi's choice. It might have been the podcast that you guys did with the BNB, BNB is Sound Money.

• 11:52David Hoffman?

  Hyper Sound Money or something, yeah.

• 11:54Speaker 02

  Right. So CMS sent $100,000 grant to the Human Rights Foundation. Human Rights Foundation partnered with Starkware. And Alex Gladstein, who's the Chief Strategy Officer at Human Rights Foundation, has been, like, he has his own, like, he's very idealistic with Bitcoin, and he wants, he really wants Bitcoin to succeed. And he's very, I would say, in many cases, he's very intellectually honest about what the complications for Bitcoin is. And then he uses the Human Rights Foundation sometimes to create grants and create research projects to solve the bottlenecks that he's seeing.

• 12:35Speaker 02

  So Alex Gladstein, he has been interested in trying to understand, like, can we use something like CK rollups as an alternative technology or as a complementary technology to the Lightning Network on Bitcoin? And then he did a combined grant between Starkware and the Human Rights Foundation to research this, basically. And I was helping Alex find the right candidate to do the research projects. We... Had a bunch of different applications and I've known John Light like from Twitter from before and I know that he's uh very clued in about what the technology stacks uh already looks like, so it's not gonna be completely new pieces to him.

• 13:15Speaker 02

  So we chose him basically because he was the best candidate and the uh the uh work that he's done uh we're we're very happy with with the work that that John has done. So uh from our uh from our end, uh the the research project I would say has been a success and uh it's incredibly interesting to listen to John speak about this because John was previous previous to to having done this work, he was a bit skeptical to whether or not rollups were actually a fitting technology on Bitcoin. I myself have been skeptical uh whether or not because one of the things that a rollup does, it's it uh it allows you to segregate state from the main chain to a s- a secondary layer.

• 13:57Speaker 02

  So one of the scalability bottlenecks in Ethereum is that the the main chain state is so bloated, but the rollup is a new state. Um and in Bitcoin, we don't really have, we have a UTXO set, which is the the closest equivalent to a state uh the way that we have it in Ethereum. But the uh state in Bitcoin isn't really, you know, it's not, it's not tens of gigabytes or hundreds of gigabytes large as it is in Ethereum. It's much smaller, it's it's much leaner. So for this reason, it hasn't been really clear, like, do we actually need rollups on Bitcoin? Do does it solve the, I mean Ethereum is an extremely computationally heavy product, right? Bitcoin doesn't really function in the same way. We don't really have the same type of scalability bottlenecks.

• 14:40Speaker 02

  So therefore, it really has been a question like, does does a ZK rollups on Bitcoin actually solve the correct type of scalability bottlenecks? And sort of the interesting thing that has come out of John's research is that it does address those specific bottlenecks. It is uh something that we can use to reach like orders of magnitude more scale in Bitcoin.

• 15:03David Hoffman?

  So when I hear a roll-up on Bitcoin, two things come to mind. One is a better Lightning network. My opinion on the Lightning network is that the UX is too difficult for it to be really adopted as a mainstream technology. And so with a ZK roll-up on Bitcoin, we might be able to have the scalability that we need in order to scale Bitcoin payments to the world. So I want to go down that rabbit hole. The other rabbit hole I want to go down is expressivity. It's like, okay, what other potential is unlocked by a ZK roll-up? Does it make Bitcoin more expressive than the Layer 1? And so we'll take those one at a time.

• 15:43David Hoffman?

  John, is a very simple ZK roll-up on Bitcoin just a better Lightning network? Is that something that we've unlocked here?

• 15:50Speaker 02

  By the way, could I just jump in here real quick?

• 15:52David Hoffman?

  Yeah, sorry. Let Eric hop in. He probably can ask the question better.

• 15:55Speaker 02

  Yeah, so, no, I just want to mention something that I thought was pretty funny. So I had a bet with the editor of Bitcoin Magazine about whether or not the merge would happen this year. And the bet was for a tungsten cube. And as we know, the merge happened this year. So he was going to send me $333 over the Lightning network yesterday. And I downloaded a wallet called the Wallet of Satoshi. And I sent him an invoice. And I wasn't sure it was going to work because the problem that you usually have with Lightning is that you don't have enough inbound liquidity. So in Lightning, you need liquidity locked up to be able to receive a payment, which is one of the most fundamental limitations of the Lightning network. And in this case, it actually worked.

• 16:40Speaker 02

  I didn't have to do any setup. I just received a payment of $333. I was like, holy shit, Lightning actually works! And I was this close to making like, because I feel like I have to be intellectually honest when good things are happening with Lightning. Like, if something really works and it impresses me, it would be intellectually dishonest if I said, you know, "I'm not going to publish it. I'm not going to tweet about that." So as I'm writing the tweet, I thought, you know, I'll just, I just have to go and look up that this is actually like a non custodial wallet and that it isn't a custodial wallet that handles all the Lightning channels. Turns out the Walls of Satoshi is a custodial Lightning wallet, so this was all like done in a centralized fashion. And I was like, okay, well, that's the reason that, you know, this works. It wasn't, it wasn't this discovery that the Lightning network suddenly works.

• 17:23Speaker 02

  Um, so I think, you know, the, this, this issue with Lightning is really, in my perspective, this is the reason why rollups has been such a huge interest for me. It's because these channel limitations that you have with Lightning, and, and John, you've looked at this, um. Like you, uh, in, in your, in your, uh, rollups paper, you've gone through like the sort of user experience bottlenecks or quirks with the Lightning networks and how rollups are sort of different. So it would be super interesting to, to hear like how you compare those two technologies.

• 17:54Speaker 01

  Yeah, yeah, I think it, from, from what I could tell, people's experience using Lightning varies. Some people have a great experience all the time. Some people have problems and it, it's very setup dependent. Like dependent on the wallet, dependent on what nodes you have, channels open to, depend on how much liquidity you have. Um, like I have used Phoenix Wallet and Breeze Wallet and Blue Wallet, all for Lightning. Um, I believe Blue Wallet's implementation of Lightning is custodial, but Breeze Wallet and Phoenix are mostly non custodial. Um, and I, I have, I haven't had any problems with, with any of those wallets. I think I've had

• 18:38Speaker 01

  two or three outbound payments that have ever failed, um, and it was because the person I was sending it to just didn't have enough uh, liquidity, um, and, uh.

• 18:52Speaker 01

  So whereas rollups, they're blockchains. So if you have funds on the chain, you can send it to any other address on the chain. Um, and you know, as long as your transaction gets included in a block, like the payment is going to complete. The trade off that you get is throughput. So lightning throughput on the network itself is not constrained in any way. You and I can pass back and forth, uh, you know, a Satoshi millions of times and.

• 19:30David Hoffman?

  It's not constrained by data.

• 19:31Speaker 01

  It's not, yeah, it's not constrained by the base layer, uh, you know, block size limit. Uh, yeah, good clarification. Um, it is constrained by bandwidth and like liquidity. Um, but it's not constrained by the base layer, um, transaction throughput. And the transactions on lightning have what is referred to as like local state. So only the parties to the transaction actually even know that really the transaction is happening. And that that's like where you get lightning's massive throughput and scalability gains from. Cause you don't need to tell your, your transaction to the entire world.

• 20:17Speaker 01

  You just keep those transaction details between the parties to a transaction. Whereas rollups have what is called global state. Where everybody who's using the protocol knows about all of the transactions. Because just like with the base layer blockchain, you're broadcasting these transactions to a global network.

• 20:39Speaker 01

  Some nodes out there that are performing the role of block producers are bundling those transactions into a block. And then that block has to get confirmed on the layer, uh, one or, or base layer blockchain. And so the amount of transactions that fits in a rollout block has to fit within the, the, the L1 data. Um, availability capacity, whether that's, you know, within the, the layer one block itself or in some like.

• 21:08Speaker 01

  Data blob that's attached to the block.

• 21:12Speaker 01

  And and so that's that's like kind of the fundamental trade off like you get these nice user experience benefits where it just feels like using any other blockchain. But you're you're fundamentally constrained in in throughput by the data availability uh capacity on on your base layer blockchain.

• 21:33David Hoffman?

  Okay, so is it is it fair to say if I um uh that we we've seen roll ups grow in adoption on the Ethereum side of things, we haven't seen the Lightning Network really become adopted on the Bitcoin side of things. Is it fair to say that like with roll ups on Bitcoin, we would have a payments network that is superior in its adoption potential than Lightning Network? Is that a fair thing to say?

• 22:01Speaker 01

  Well, I don't know that a fair comparison can be really be made between roll ups on Ethereum today and Lightning on Bitcoin. One, they're used for very different things. So you know, the amount of money that say circulates in a financial system for trading different types of assets is almost certainly going to be different than the amount of money that's circulating through, say, a peer to peer payments application or something like that. Um, another thing that you have to look at is not just the liquidity, but the actual like amount of users.

• 22:43Speaker 01

  Um, and there are thousands of Lightning nodes on the network and some of those are custodial, so they have like customers who are utilizing those nodes that it's hard to, you know, even say how many users they have unless they advertise it since they're hidden behind like a custodial uh interface. And so. Even the throughput on the network, because it's not a global state, we don't know how many transactions are happening um across the Lightning network, so. It's hard to make a compare a comparison, and even if you could compare them, like I said, I don't think it's quite comparing

• 23:29Speaker 01

  apples to apples. Um, with that having been said, I think that because of the UX benefits that you get from having this global state model and like being able to receive offline payments, being able to receive payments without requiring inbound liquidity and and having channel limitations and things like that. I think those features do overall improve the user experience. And so light uh rollups could be an alternative for certain use cases and not others.

• 24:11Speaker 01

  Um, like if you need really high capacity, high volume, low value transactions like micro payments or nano payments, then you know, a state channel network such as Lightning might still be the better option. But for simple Venmo like peer-to-peer payments or maybe even like, you know, business-to-business uh payments, rollups might be better, like a a better user experience, the the the constraints or requirements of that type of payment just might be better suited to to a rollup.

• 24:53Speaker 02

  So there's a there's a problem statement here that we don't really know the answer to, like, is the reason that the Lightning network is not taking off as quickly as, you know, other layers uh on Ethereum, for example. Is it because the user experience of Lightning is bad, or is it because people don't want to make payments with Bitcoin? We don't really know the answer to those questions. Like, I can speak for myself as a Bitcoiner, but I would probably make more transactions if. The Lightning Network was more reliable, then I would have a wallet with some funds in it, I would go, I would use it. Whereas with Lightning, it's always like, I pull up my wallet, it sort of has to sync, my channels are not always configured. And then that sort of leads me to go and put it into a custodial wallet, but I don't want to put a sizable amount of

• 25:37Speaker 02

  funds in a custodial wallet because I'm sort of worried that it's gonna disappear, so. It's not clear exactly what the, what the reason is that, that people are not using Lightning, whether it's user experience related, or if it's something else.

• 25:50David Hoffman?

  My, my perception is that it's, it, the, the property that it's the, the rollup on Bitcoin, a Bitcoin rollup, or rollups in general, are this persistent thing that has 100% uptime is a big unlock. Whereas like the Lightning Network is this more nebulous thing where parts of the Lightning Network go offline, then they come off online later. Uh, and that the Lightning Network is just this loosely, uh, connected, uh, network of nodes. When some of those nodes go offline, uh, versus a rollup where the rollup is one single blockchain with 100% uptime. I think that's the unlock that I think really, uh, gets me excited about the potential of

• 26:30David Hoffman?

  uh, a new layer on Bitcoin that, that sees a, a lot of demand. Um, uh, yeah, John, some, some thoughts on that?

• 26:39Speaker 01

  Yeah, well, to draw another comparison, I think today, rollups don't actually fit the full vision of like what we, uh, imagine a rollup to be, right? Or the full potential of a rollup, like today, they're uh, secured by multi-sigs, not by layer one consensus. Today, they have single block producers, not multiple block producers. And so there have been outages on rollups where users can't access their funds for 24, 48 hours or, or longer. Um, and, uh, and, and so, similar to the way that, you know, the Lightning Network, it's immature.

• 27:24Speaker 01

  People are still building out tools for managing liquidity and figuring out the user experience uh ed- rough edges. I think some of those rough edges are going to be able to be smoothed out. Some of them might, you know, might never be able to be smoothed out. Um similarly, you know, with rollups, I think there is a potential there to get to an ideal state of trustlessness, security, uptime, um and we might never reach that full ideal. In the same way that even with base layer blockchains today, there are bugs and there are there are there are US challenges.

• 28:03Speaker 01

  Um but like, we can move incrementally closer to that ideal. And I think the ideal state of a rollup, again, for certain use cases, is arguably superior than Lightning or other Layer Two protocols that we can build on Bitcoin today. So that's that's one of the things that makes me excited about rollups is that I think they can fulfill particular use cases, they can fill a particular potential that that just isn't possible today.

• 28:33Speaker 02

  Yeah, and one one example of that that I think is super interesting is that, like, I can say to you, David, like, um, by the way, I just sent you uh forty dollars on the uh ZK Sync rollup. Or on the Arbitrum rollup. And you're you're like, oh, uh, and you're like, okay, so do I go and claim it with my ENS name, like davidhoffman.e? And then you can, then you have access to those funds. And you we didn't have to coordinate on which layer, like, we didn't need to do any setup process before that. I just sent you those funds, like an email, like I just know your email address, you now have those assets. Uh, so that's something that you can do on a rollup. You could do that on a rollup on Bitcoin also. That you just send them funds without them even downloading a rollup on it. You can send them funds.

• 29:16Speaker 02

  And that's something that you cannot do with with Lightning Network, the way that it's currently uh, the way that it currently exists.

• 29:24David Hoffman?

  Right, because as a user, as a Lightning user, I need to initialize my Lightning node and then also maintain that Lightning node in order to have like my email address being able to receive emails, which is just like not a UX that people are used to and perhaps is like is insurmountably difficult for global adoption. But this idea where you have this persistent address that exists at any layer that works universally and you don't have to maintain a node or initialize a node in the first place to be able to access this, I think that's just a UX that is more resonant with the internet-going people of the modern age.

• 30:02Speaker 01

  I don't know if this is a problem that could be solved, but you do have to be careful about that because I remember there was a problem with some tokens on Optimism that the Optimism team was distributed to, I think, an investor or something like that.

• 30:17David Hoffman?

  Wintermu, it was a trading firm, but there was actually a nuance there is that it was a Gnosis multi-sig and it was a very early version of the Gnosis multi-sig, so it was a bit of software on top of a layer and that particular software.

• 30:32Speaker 02

  Contract address was a bit different.

• 30:33David Hoffman?

  Right, it was a contract address, so it didn't actually have anything to do with the fact that it was on a new layer, it was a specific multi-sig implementation that created a new address that was different from the address on the layer one, so that was more of an application layer difference than a protocol layer difference.

• 30:51Speaker 01

  I thought it was something like the case was like they had the contract address on layer one, the Optimism team sent the tokens to the address on layer two and somebody else deployed the contract to the Optimism rollup and was able to basically create a wallet with the same address and therefore like they were the owners of those tokens.

• 31:19David Hoffman?

  That is what happened, but that's an application layer thing, not a blockchain layer thing, it was the specific code of the actual multi-sig that created that property that was allowed to be exploited rather than the actual like layer itself, does that make sense?

• 31:35Speaker 01

  Yeah, yeah, yeah. I just, I bring it up to say like, I don't know if it's you, it's uh, you can a hundred percent assume that a user is going to, you know, have the same address on, on all layers. So you, you wanna be careful about that, but um,

• 31:49David Hoffman?

  Sure.

• 31:50Speaker 01

  Assuming, like I said at the beginning, like, I don't know if that problem can be solved. Uh, but if, you know, maybe when it can and you can reliably, assume that, then, then you get to kind of this Nirvana state where you can just like, you know, somebody's address, you can send them money anywhere and just tell them like, hey, your money's over here, go get it. Um, I think that would be a really great place to end up.

• 32:15David Hoffman?

  Certainly. Okay. So I, I think we've unpacked the differences between the payment properties of a Bitcoin rollup versus Lightning. Uh, I wanna get into expressivity. Uh, and so when we get into a, a new layer on top of Bitcoin, that's a ZK, ZK rollup. Uh, what other things can we do on a layer on top of Bitcoin that's a ZK rollup that we can't actually do on the Bitcoin layer one? Like, what, what kind of new features are unlocked for us? So are we getting like the full scope of like, tokens and smart contracts and ENS names, or is it something more, more simple? Like, what, what do we, what is, what are the new things that are unlocked here?

• 32:51Speaker 01

  Um, potentially, yeah, any, anything that you could do with a blockchain. Um, you can.

• 32:58David Hoffman?

  Full Turing complete expressivity?

• 33:00Speaker 01

  Yeah. Yeah. I mean, you, you, you need to have a, a verifier on, layer one that is capable of verifying the, the proofs of that computation. Um, and I discussed in the, the report that I wrote up about how, if Bitcoin developers did not want to enable that level of expressivity for some reason, they could restrict.

• 33:32Speaker 01

  The complexity or or power of the computations that are able to be verified on layer one. Basically intentionally handicapping the the verifier um on layer one. Um but if you if you weren't weren't to do that, then yeah theoretically you could have any kind of blockchain converted to a rollup. And layer one doesn't need to know how to like execute those transactions, it just needs to know how to verify the proofs. And as long as it can verify the proofs, the state can

• 34:18Speaker 01

  be updated and users can safely make withdrawals and the rollup just works.

• 34:25Speaker 02

  So so this is one of the like mind blowing uh facts about rollups on Bitcoins that they actually enable fully Turing complete uh virtual machines. So this was like when I was I was interested in rollup since two thousand nineteen and it wasn't like a couple of years after that I realized actually wait. A start proof can encode an entire virtual machine. Uh it does that on Ethereum and then of course it should it you can also do the exact same thing on Bitcoin. So the way that you can think about the the the validity proofs uh that you implement on the mainnet is that they're almost like adapters, like like they're almost like a power adapters that that can change the the entire virtual machine of the system that that is validating.

• 35:08Speaker 02

  So it opens up basically like limitless potential, any new type of virtual machine, which is why like the the limitation, the the the comparison between the Lightning Network and a rollup is sort of limp because it doesn't really even address this whole new paradigm of applications that the rollup potentially unlocks. Um it would be interesting to think a little bit about, okay, so we've talked about the transaction throughput benefits when we're only talking about like account to account transfers in a rollup. If we're talking about like Turing complete smart contracts. Would it even be feasible to run uh like one like Uniswap or like?

• 35:48Speaker 02

  Could we even run one um like smart contract application as they exist on Ethereum? Without like breaking the scalability boundaries of of Bitcoin, that I don't know. Uh, cause we've only really looked at like account to account transfers where the uh on-chain footprint is kind of it's like small, like twelve bytes per transaction.

• 36:07Speaker 01

  I would say so. I mean, if you look at if you look at the size of like even just a raw, uncompressed uh Uniswap transaction on-chain, it's, you know, not even kilobytes, like uh it, you know, it's it's a very small amount of data to actually update the the state of of the Uniswap contract, so. I think I think you could, the same way that we're able to confirm not just a single transaction, but batches of EVM compatible transactions within Ethereum blocks, which even accounting for call data are much smaller than Bitcoin blocks.

• 36:49Speaker 01

  Um, yeah, I think I think uh it shouldn't be a problem on Bitcoin.

• 36:54Speaker 02

  So maybe it's fair to say then, so the the the hardest thing maybe to achieve here. Cause when I when I read your research, we you also looked at like enabling Zcash style, fully private transactions uh through a rollup and then the uh scalability of the system actually goes like it it actually decreases. So you can't make as many Zcash style transactions using a ZK rollup on Bitcoin as the mainnet uh Bitcoin layer can do regular transaction itself. So if you go into like the the ZK, the Zcash uh style paradigm through a rollup, then so if Bitcoin does like four transactions per transaction, four transactions per second right now,

• 37:38Speaker 02

  it'll only be able to do like three transactions per second if it tried to do ZK uh Zcash style uh transactions using a rollup, right?

• 37:48Speaker 01

  Yeah, yeah, shielded transactions because you have to in like the transactions end to end encrypted. It like blow this blows up the size of the the transaction. Um, even with, you know, the the most efficient proofs that we have today. Um, it it ends up being bite for bite. Um, about twenty percent bigger, uh, twenty twenty five percent bigger than a a normal. One input, two output Bitcoin layer one transaction. Um, I think, you know, it you could it that's not a huge uh hit.

• 38:29Speaker 01

  And it's you're getting a much better privacy profile, like if you tried to have a similar. Similarly, private Bitcoin transaction like you just couldn't even do it. Like you couldn't fit enough inputs and outputs to match the anonymity set of like a shielded transaction. Um, so they're not completely comparable, but um.

• 38:53Speaker 01

  Uh, yeah, I think it's I think it's worth the additional twenty twenty five percent size to to get that. Strong level of privacy, but um, it's up to each user to decide, really.

• 39:06Speaker 02

  Yeah, you could potentially also maybe run an application like Tornado Cash. Now, that's ma- maybe that's not the the one application that you'll see developer rushing into developing right now. But you could potentially run an application like that also if you wash just wanna get like a mixer that runs on Bitcoin. Because I mean, we have coin joints on Bitcoin. Um, but the privacy is not perfect, the scalability is not very high. Maybe something like Tornado Cash through a ZK rollup. Maybe that could be um, a use case for people that want to get better privacy. Uh, or do you think that maybe um, Zcash style transactions are are the better use case here?

• 39:46Speaker 01

  I think, I think mixers have a lot of foot guns involved because there are a lot of like rules that you have to follow to use a mixer safely, so you don't de-anonymize yourself. And as a consequence, damage the anonymity of everybody else using the mixer. Um, so, you know, I would, I would advocate, you know, if people want privacy, the direction that we need to move in is, is getting people to store their money in shielded pools and to make shielded transactions. Um, simply depositing your money into a shielded pool and then taking it out a couple of days later. Uh, I don't, I, you know,

• 40:30Speaker 01

  that does, I don't, I don't think that really solves the problem because then you have

• 40:33Speaker 02

  Staying inside the shielded pool and making all the transactions there is sort of more elegant solution to the privacy problem than going in and out of mixer all the time.

• 40:41Speaker 01

  Right? Yeah, you, like, you're, you're, you're less susceptible to timing attacks, uh, you're less, uh, you, the, the, your, like, questions about post-mix privacy are uh, easier to reason about. Um, and of course, you know, Z to Z, you know, fully shielded transactions are kind of the gold standard, so I would hope that most peer-to-peer payments, um, that don't need to have any kind of public component move in that direction.

• 41:11David Hoffman?

  The reality today is that five corporations control the entire world of social media. They own our names, they restrict our content, they monitor our every move. And their time is up, thanks to our sponsor, DSO. DSO is a Layer One blockchain built from the ground up to decentralize and scale social networks. With DSO, you can own your own identity, content, and social graph, and take it with you across hundreds of applications already built on the censorship-resistant DSO blockchain. DSO's storage advantages make it finally possible to build infinite state applications that can efficiently store and index large amounts of content and data fully on-chain. DSO also offers multiple crypto-native monetization primitives for developers and creators, including social NFTs, social DAOs, social tokens, and social tipping.

• 41:56David Hoffman?

  So in order to experience the social layer of Web3, go to deso.com and claim your username. That's D E S O dot com. The Brave Wallet is your secure, multi-train on-ramp into Web3, and it's built directly into the Brave Privacy Browser. Gone are the days of managing multiple wallet extensions that put you at risk of phishing, spooks, and tracking. With the Brave Wallet, you can securely manage your crypto assets across more than 100 different chains, including Ethereum, Layer 2s, Solana, and more, all without downloading risky extensions. The Brave Wallet is easy to set up and removes the headache of jumping between wallets and extensions. It's lightweight but packed with great features, like built-in token swaps, buying and holding NFTs with a gallery view, and support for hardware wallets. But also much more than that,

• 42:40David Hoffman?

  because Brave is shipping new features every single month with a mission to make Web3 easier to navigate for its over 55 million users. Wallet extensions are a thing of the past, so get started with Brave's Web3-ready browser today and experience a decentralized web seamlessly without all the clutter. You can download the browser at brave.com/banklist and click the wallet icon to get started. Arbitrum One is pioneering the world of secure Ethereum scalability and is continuing to accelerate the Web3 landscape. Hundreds of projects have already deployed on Arbitrum One, producing flourishing DeFi and NFT ecosystems. With the recent addition of Arbitrum Nova, gaming and social dApps like Reddit are also now calling Arbitrum home. Both Arbitrum One and Nova leverage the security and decentralization of Ethereum

• 43:24David Hoffman?

  and provide a builder experience that's intuitive, familiar, and fully EVM-compatible. On Arbitrum, both builders and users will experience faster transaction speeds with significantly lower gas fees. With Arbitrum's recent migration to Arbitrum Nitro, it's also now 10 times faster than before. Visit arbitrum.io, where you can join the community, dive into the developer docs, bridge your assets, and start building your first app. With Arbitrum, experience Web3 development the way it was meant to be: secure, fast, cheap, and friction-free. So just to make sure that I'm tracking this conversation, what we're talking about is there's various applications that we can do on a ZK rollup, perhaps limitless, and it's really a function of the constraints of the Bitcoin Layer 1 block space. And so now we're talking about, all right,

• 44:09David Hoffman?

  like what applications are like high priority? What applications on a ZK rollup on Bitcoin do we want to? emphasize first, and I totally understand that private payments probably resonates with Bitcoin culture more than tokens. And so maybe that's that's kind of where we start and kind of open up the design space for for stuff that kind of resonates with Bitcoin culture. But in theory, so long as there's block space on the Bitcoin layer one, there is potential on a Bitcoin ZK rollup on its own layer two. And that that potential is really just only constrained by the imaginations of the developers that can build on it. This is my takeaway. Is that is that correct?

• 44:50Speaker 02

  Yeah, but it should be said, though, that Bitcoiners have recently, they are recently waking up to this idea that in order to win the payments use case for any blockchain system, it's a good idea to start out with stablecoins. So if you can, if you can build a stablecoin payments rails that becomes universally adopted, that'll be much easier to later introduce your own native token into that. So if the Lightning Network, for example, becomes the leading solution to transfer stablecoins around, then Bitcoin gets an edge relative to Ethereum. And if if rollups become the leading solution and they're based on Ethereum to to transfer stablecoins,

• 45:31Speaker 02

  it'll be easier to sort of sneak Ether into that mix and and transfer those tokens. So but I do think that transferring stablecoins on the Lightning Network is not that easy. They have a solution currently which involves swapping the stablecoin in and out of Bitcoin multiple times just to complete the payment, which means that they're going to incur like multiple spreads on those payments. So they won't necessarily be very cheap and the UX, as we know, isn't perfect with Lightning either. So something like a ZK rollup on Bitcoin where you make stablecoin payments would potentially be advantageous even to the like the

• 46:12Speaker 02

  the path to adoption that the Bitcoiners have already sort of understood is is is optimal. So the rollups could fill a use case there where you're using them to transfer tokens also. And I don't think that Bitcoiners necessarily would be like against that idea.

• 46:28Speaker 01

  One of the things that um we we didn't mention that I think is interesting is like this idea of building layer three protocols on top of a layer two roll up in order to compensate for any shortcomings that would be on the roll up such as you know transaction capacity due to layer one throughput limitations. So like you could have layer three protocols like validity ums or volitions or things like that. Um where you actually have off chain data availability. You reduce the security model a little bit. It still ends up being a stronger security model than like your typical federated side chain.

• 47:10Speaker 01

  Um and you're not constrained by the base layer um throughput capacity. So if you wanted to say onboard an entire country like El Salvador um to Bitcoin. Um you might say, well, we don't want just everybody to have custodial accounts because that's not the Bitcoin way. Um but they're not all going to fit on layer one or maybe even layer two. Can we do something that's like in the middle? And I think uh a validity um built on top of a a roll up could be that sweet spot where it's still not custodial.

• 47:54Speaker 01

  There's a strong guarantee that users can get their funds out with data of uh eh with if the data is available. And um and and at the same time, you have basically unlimited throughput. I mean, just as as much throughput as the sequencer or block producers are are willing to uh allow for to to to produce their blocks. But um yeah, that's that's, I think, an interesting way as we were talking about those those limitations uh of throughput on the base layer. That's like an interesting way that you can use ZK rollups or validity rollups to

• 48:37Speaker 01

  um enable these these new protocols that that aren't possible on Bitcoin today that offer interesting security and scalability uh trade offs.

• 48:48Speaker 02

  Yeah, and you mentioned in your, in your paper, you mentioned the ability to build Lightning Network on top of a ZK rollup. So in order to improve the scalability of the Lightning Network, you could run it on, on a ZK rollup on Bitcoin. So that could be like a layer three. But it's true that you point out that, I mean, the Lightning Network, the way it's, the way that the Lightning Network is constructed, it's, it's designed the way that it's designed because of the limitations of the Bitcoin base layer, the script language, the scripting language of Bitcoin. But if you have a ZK rollup, you could build a little bit different, like a little bit different scripting language and build a little bit different Lightning Network that

• 49:33Speaker 02

  solves some, so for example, if you want L2 or other things that people are waiting for in, in Lightning, you could sort of enable those things with a ZK rollup module and then you could build more interesting or more user-friendly or more secure, perhaps even Lightning Networks on top of that rollup. So that's a, do you agree with that, with that assessment?

• 49:55Speaker 01

  Yeah, yeah, I think, I think enabling developers to try more things more quickly without having to wait for base layer consensus changes, I think will help advance the state of L2 or like off-chain protocol development. And yeah, that's, that's an exciting possibility.

• 50:18Speaker 02

  We sort of have to sort of get into what exactly needs to be done on the Bitcoin base layer to even enable this. I think this is a, should we get into that discussion maybe?

• 50:28David Hoffman?

  Yeah, that's exactly where I was going to go next because I've had this discussion with other people who are familiar with building on the Bitcoin blockchain. It's like, all right, like, how do we get Bitcoin trustlessly over to Ethereum? How do we build like bridges that are trustless? And every time I like ask developer-minded friends, like, how do we do this thing on Bitcoin? They're like, well, we're going to need to change the opcodes. And as, as soon as I hear that line, change the opcodes, my mind just goes like, well, that's not going to happen because that means a hard fork and that Bitcoin just doesn't hard fork. It's like, that's the vibe, that's the social contract. And so, John, what does it take to actually get a ZK rollup into Bitcoin? Like, what changes do we need? How do we actually arrive at this, at this future state that we all want for Bitcoin?

• 51:13Speaker 01

  So there will need to be new opcodes, but the good news is that it it doesn't take a hard fork.

• 51:18David Hoffman?

  Okay.

• 51:18Speaker 01

  So the way that opcodes have been added or disabled in Bitcoin over the years, uh, pretty much since the Satoshi days is using a style of fork called a soft fork, which is considered backwards compatible.

• 51:33David Hoffman?

  Okay.

• 51:34Speaker 01

  So old nodes don't need to update their software in order to remain on the network and in consensus and able to send and receive coins with other nodes that have upgraded and uh, adopted the, the new opcodes. So this is how, uh, for example, P two S H, which we use for multi-sig uh, in Bitcoin was adopted. This is how SegWit was adopted and most recently Taproot.

• 52:04David Hoffman?

  Okay, so Bi- Bitcoin does soft forks, like very successful, it has successfully implemented soft fork upgrades in its history. So it's reasonable to assume that we can do this again if the Bitcoin community wants ZK rollups.

• 52:19Speaker 01

  Yeah, yeah, for sure.

• 52:21Speaker 02

  Well, um, I mean, this, this still introduces, if, if we think about the risks that a ZK rollup introduces on Bitcoin, I think a lot of people are afraid if you introduce a Turing complete virtual machine module through a ZK rollup on Bitcoin, then you can have very complex smart contract, smart contract languages run basically on top of Bitcoin. And if there's an exploit, a bug, like, let's say like a DAO hack in that second layer, then the base, it sort of becomes the base layer's problem. So now if you have to sort of uh, save all the users in the second layer because there was a bug there.

• 53:02Speaker 02

  Then maybe you need to do that through a soft fork on the on the on the base layer. So so the problems that can happen in these external layers can sort of trickle down to the base layer itself. And also issues like MEV, for example, if you have a rollup generating lots and lots of MEV. And then the miners that get to include the the proofs of the rollup on the on the on the mainnet. Maybe there's like getting to include those proofs pay way more than any other transactions do. So then miners are all of a sudden incentivized to sort of reorganize the blockchain to be the ones that get to include these proofs. Instead of just like mining the blockchain as usual.

• 53:42Speaker 02

  So the same similar this this the same critiques or similar critiques that have been levied against drive chains. Are theoretically, in my opinion, could be levied also against ZK rollups. But the advantage that ZK rollup sort of has here is that it's it's it's it's different. It doesn't have the same political baggage that drive chains do. All the conflicts between the core developers and Paul Storch, who was the pioneer of drive chains, is not relevant anymore. And ZK rollups also, they have they have stronger security guarantees, right? So it might be worthwhile actually doing this for ZK rollups.

• 54:24Speaker 02

  While for drive chains, it it wasn't really worthwhile because you still it was just a merge mind sidechain, basically. So I would I think that there's still a conflict that would need. It's not just a matter of a technical improvement that when we have time, we will get it into Bitcoin. It's a whole ideological question of whether or not this upgrade makes sense to Bitcoiners. And I think like from my perspective, what really would need to happen for people in the Bitcoin ecosystem to seriously evaluate this. Is if Ethereum started to flip and Bitcoin, then it would be like, OK, you know, maybe maybe we need to try something new. But unless that happens and Bitcoin just keeps this very dominant role.

• 55:08Speaker 02

  I think people will more think of ZK rollups as something for the future, maybe. I don't know. Those are my thoughts.

• 55:18Speaker 01

  I'm less uh. Convinced that Ethereum hypothetically flipping Bitcoin would. Cause that. Deep of soul searching to say change the. Calculus of whether or not it would be worth. Implementing EVM or Turing complete. ZK rollups on Bitcoin. Um, I think, uh. There's a, there's a view in the Bitcoin community that Ethereum is like a tech platform. And so Ethereum flipping Bitcoin would be. No more noteworthy than a tech startup, you know.

• 56:02Speaker 01

  Stock market cap post IPO flipping Bitcoin or something like that. Um. At least I'm sure people would try to explain it away um in that way and. That might not even be uh that invalid of of of a viewpoint, but um. I think that. Part of the debate. It involves even more nuance. It's like. We could enable Z uh ZK rollups on Bitcoin without enabling fully Turing complete. Uh EVM compatible or or other kinds of fully expressive ZK rollups. We could say. We're going to.

• 56:45Speaker 01

  Enable the verifier to verify transactions that are. Uh. No more complex than Bitcoin is today, like you can't do you it just can't it isn't capable of verifying. Hmm comput computation heavier than that. Um. And so you would be you would be limited in the types of scripts that you could. Build on the the layer two rollup. And you know Bitcoiners might say like, you know, we can start there and maybe in. You know, a few years down the line after we've done more research on, say. Cross layer MEV or these other like more.

• 57:29Speaker 01

  Subtle economic game theoretical concerns. Um, you know, w- we'll we'll make a decision about whether we want to enable. These more expressive rollups. Um. So I I do think that. We could see.

• 57:47Speaker 01

  Um validity rollups on Bitcoin before we even have answers to like those those questions about the more expressive rollups.

• 57:59David Hoffman?

  So the the perspective that I'm seeing here is that like in in the Ethereum land, anyone can build a rollup and deploy it at any time. There's no like changes to the base layer. Like we can have a bajillion different rollups of a different, different uh bajillion different varieties. What I what I'm seeing here, John, is that like that's not true in the Bitcoin land. The Bitcoin social contract needs to come to consensus about what flavor of rollup they want to enable. And that kind of makes that future rollup more enshrined than Ethereum rollups. Where Ethereum rollups are all kind of commercial. They're all built as like a second layer to Ethereum. That don't they and they don't really impact the base layer because they don't have requirements upon the base layer.

• 58:40David Hoffman?

  A Bitcoin ZK rollup would require things of the Bitcoin Layer One. And if the Bitcoin Layer One changed itself via a soft fork to enable a specific kind of rollup, that kind of enshrines that rollup as like a more of a first-class citizen to Bitcoin than than Ethereum does to its own its own rollups. Eric, Eric, did that make sense? And do you agree with that?

• 59:03Speaker 02

  I agree with that. And also, one of the things that I think that you almost touched on is that in the Bitcoin world, then we we don't have the ability to plug in any type of rollup into the Bitcoin system. We have to decide on a specific proof system and then enable that specific proof system. So and this is one of the the big complications of it, like how do we even decide which proof system we want to enable? Like there's Plong's, there's Redshift, there's Groth, there's all these different types of cryptographic mechanisms. I I mean, we know in Bitcoin that we sort of prefer cryptographic systems with the least amount of new assurance, least amount of assumptions. So we want something that is maybe Stark-based. You can go into this also, John. So we we want something that creates the the least amount of risk

• 59:48Speaker 02

  by using something that is as tested as possible, and we don't want any trusted setups. But we still have to choose a specific proof system, and then we have to stick to that. And then if there's a new one that comes along, then that would involve a new soft fork. So this makes the way to enable rollups on Bitcoin way like we have to be way more thoughtful, and we can't just be willy-nilly about it. Go ahead, John.

• 1:00:12Speaker 01

  Yeah, I mean, there there might be ways in which you could. Say. Um, enable proofs such that. Like the the miners verify them, but the rest of the full node network doesn't have to, so it's still kind of like a soft fork. But um. But the, you know, the rest of the network doesn't have to verify it and it becomes almost like an SPV. Security model, but yeah, if you want, if you want the full network to verify it. For each new proving system you you enable, you might, you might need to, uh.

• 1:00:57Speaker 01

  You know, if you don't, if you don't kind of have like a a very generic uh system from the start. You're, yeah, you're gonna have to do. Se- a sequence of of soft forks. Um, and if we get to the point where like Bitcoin ossifies and like can never fork again because coordination is just too difficult. Then. We're stuck with what we've got and, you know, good enough will have to be good enough. I think at that point, we might see. Uh, the innovation is shift to higher layers. Um, but uh, yeah, it's. There there there is some path dependency there that the community is going to have to think about.

• 1:01:41Speaker 01

  Um, you know, really think down, far down the line like. How much can we future proof this without enabling things that we might consider dangerous? Um, and so, yeah, there there there are a bunch of decisions to make here, um, and. It's an open question as to how the community would actually make those decisions. Um, how the community actually enables soft forks in general is kind of an ongoing conversation in the Bitcoin community. Um, cause with Taproot, we had speedy trial, with Segwit, we had, you know. The the the lock-in plus like the US, the the UA, uh, the lock-in deadline plus UASF.

• 1:02:26Speaker 01

  Like, there, you know, Bitcoin has has has tried all of these different things and there's not really. Consensus on on what is the best way to to go about. Soft forks yet, uh, let alone soft forks with so many different.

• 1:02:41Speaker 01

  Options that that have to be considered along with them.

• 1:02:44Speaker 02

  And I I noticed that we didn't fully really respond to what needs to. There's more things than just enabling a proof system on in on Bitcoin that you need to enable for a ZK rollup to exist. So there's two parts to it that you people usually talk about. The first one is being able to validate a a a validity validity proof, a ZK proof. And the second one is a covenant, right? And you talk in your paper about recursive covenants. Maybe we should also mention, like, talk about what's this other part that needs to be enabled? Why does it need to be enabled and and what exactly is it?

• 1:03:18Speaker 01

  Yeah, so. We talked about the the proof systems and yeah, the other major piece is enabling recursive covenants. And a covenant, for those who aren't familiar, is a a type of smart contract that restricts the outputs of your transaction. So, for example, you could have, you could lock your coins in a covenant that says you can only spend those coins to a specific address.

• 1:03:54Speaker 01

  And then when you go to spend those coins, you can only spend them to the the address that's defined in the in the covenant. And a recursive covenant is where you are able to apply restriction to the outputs of your outputs of your outputs of your outputs, like, almost in or actually potentially indefinitely uh restrict how a coin could be spent. Um, and we use recursive covenants for validity rollups basically to enforce that.

• 1:04:36Speaker 01

  When the uh state of the rollup is updated, that all of the coins that are currently held in the rollup remain in the rollup script as those coins are being basically spent in the rollup trans uh state transition uh transaction. They're they're rolling over into the same script. Always um unless there's a valid withdrawal uh transaction coming out of the rollup. In which case, the covenant is restricting uh the script such that users can only spend to a valid withdrawal address. Um that has been

• 1:05:22Speaker 01

  validated using the validity proof. Um so like if a user deposits some funds into the rollup, it's going into a script on on layer one. Then the block producer on the rollup produces a rollup block, so so updates the state uh of the rollup. They basically spend all of the coins that are in the rollup script to an identical copy of the rollup script. So they're like moving the coins from the the rollup script at state A into the rollup script at at state B. And they're including a validity uh proof that says, you know, this state transition is valid. And then a user comes along and they say, I want to make a withdrawal from the rollup.

• 1:06:06Speaker 01

  So then the rollup block producer again is going to produce another block. They're going to roll over the the coins from the script at state B to state C. And then they're also going to specify, well, some of the coins are going to come out of the script and be sent to this uh destination address. And the script is going to consider that valid because there's a validity proof which proves to the layer one full nodes. You know, everything about this transaction, including this withdrawal, is valid according to the the rules of the rollup. Um so the recursive covenant is basically needed just because of

• 1:06:52Speaker 01

  how the mechanics of like a Bitcoin transaction works with with the UTXO model.

• 1:06:58Speaker 02

  So it's not like the most sexy part of a row of the covenant part, but it's sort of a required element. Because a, a, an easier way to sort of explain it would be like in Bitcoin, you can't have a variable that you update. So you don't really have a persistent state that you can update. Like, let's say you want X to be four and then some transactions happen. Now you want X to be six and you sort of want to store that variable. You can't really do that in Bitcoin because there's no way to store a variable. There's no way to store state on Bitcoin. But the covenant would sort of allow that. And it also is worthwhile pointing out that the covenant that has been discussed in Bitcoin, the OPC TV, the check, uh, check time, what's it called?

• 1:07:40Speaker 01

  Check template.

• 1:07:41Speaker 02

  Check time verify.

• 1:07:42Speaker 01

  Check template.

• 1:07:44Speaker 02

  Check template where verified. Yeah, this one isn't sufficiently general to enable, uh, to enable something like ZK rollups on Bitcoin. Because it's sort of a very specific type of covenant. So that thing doesn't allow us to, to, to get to, to the rollup vision.

• 1:08:04Speaker 01

  Yeah, yeah, you need, you need the fully recursive covenants because you need to be able to restrict essentially forever. Like as long as the rollup is an operation, this, you need to be able to enforce this rolling over of the UTXO from the script, uh, from one state to the next. And the only way to do that is with recursive covenants. Unless you change, you know, you were to change like the, the state model of Bitcoin completely to like an account model. Um, but like I said, that, that would probably be too radical of a, of a change. I don't, I don't know if that would fare very well politically.

• 1:08:44Speaker 02

  We, we both need to decide on which covenant do we want? And which proof system do we want before we can enable ZK rollups on Bitcoin? And both of those things are sort of, uh, complex questions for, for implementation wise for, for Bitcoin, for the Bitcoin system and community to sort of decide on.

• 1:09:02Speaker 01

  Yeah, there have been a number of different um proposals for how to get even like recursive covenants specifically into Bitcoin. Um, some developers have talked about like uh OP TX. Um, some have talked about uh or simplicity, like just enabling the simplicity language. Um, uh, there was a recommend, there was a suggestion for Chia Lisp. Um, so yeah, there's, there's a lot of ideas floating around, but no consensus yet of how to enable these kinds of generalized or recursive covenants.

• 1:09:40David Hoffman?

  Well, amazing guys, I I feel very, very educated to the way that Bitcoin works a little bit, a little bit better and how ZK rollups might actually get there. John, um, what are there like clear next steps? Like what, what, what are the next steps for getting this done if the Bitcoin community agrees that is, this is the next step?

• 1:09:59Speaker 01

  Well, I think it's going to take experimentation with those different options to see what's uh, what makes sense, maybe some more research to find out what is the minimal set of changes that would be required if we wanted to enable only validity rollups. I think there tends to be a preference in the Bitcoin developer community that if we're going to make a soft fork, it should be usable for multiple different kinds of use cases and not just a single use case, so. Um, you might be able to argue like validity rollups enable a bunch of different use cases.

• 1:10:40Speaker 01

  So even if we were to soft fork only for validity rollups, we unlock all of these other use cases. And so that kind of specialized soft fork might be justifiable. You might also say, well, if your validity world can only do Bitcoin style transactions anyways. Uh, then, you know, it would be nice if the opcodes that we enabled for validity rollups were also useful for other use cases. Um, and so then we might, you know, have, have a bit of a, a conversation about, about the tradeoffs there. Um, but yeah, I think more research, more experimentation.

• 1:11:20Speaker 01

  There are already some developers that are like working towards an MVP, just getting like a basic Bitcoin style validity rollup, working on a test network, uh, somewhere. Um, and so I'm sure, you know, they'll be thinking through these questions. Um, but, uh, yeah, they, I, I would encourage like there to be multiple work streams, multiple different, you know, experimentation, uh, experiments going on. And, um, you know, we can all compare notes and, and, and see what works, see what doesn't, where are the tradeoffs? And eventually, hopefully, come to consensus on something so we can bring this to Bitcoin and, uh, allow users to experience the benefits.

• 1:12:05Speaker 02

  I have to ask one like last, uh, question here. So in your paper, you talk about how rollups enable potentially fifty times more transactional throughput with similar security guarantees that Bitcoin has on its base layer. So this is, I mean, this is pretty, um, a pretty staggering result, right? But why do you think that this research is coming from like the Human Rights Foundation? And we found like a non-core Bitcoin developer to do this research? And what like, why isn't this type of very interesting research coming from within the Bitcoin core? That like the, the regular, the traditional Bitcoin developer ecosystem itself?

• 1:12:45Speaker 02

  Like, why did it have to come from this like satellite route, like of, of Ethereum interested people in order to, to, to explore this area?

• 1:12:55Speaker 01

  Uh, I don't know if I could answer that question. I mean, everybody's got their own projects going on. Um, there have been a number of different research, uh, papers that have come out, uh, pertaining Bitcoin specifically through non, you know, not directly from, from Bitcoin core contributors. Um, for example, like BitMix sponsors a bunch of interesting research. Um, there's a bunch of interesting research that has historically come out of like academia. Um, so, yeah, I think just people, you know, certain people get interested in certain things and, and, uh, and, and the research bubbles up from, from those domains.

• 1:13:37Speaker 01

  Um, so, yeah, uh, it's, uh, it would be hard to, to answer that question any other way. Cause like I said, I think everybody's interested in, in, in different aspects of, of the Bitcoin system and just because of my own unique, you know, personal and professional history, I happen to have a background in, in both, you know, EVM and, and, and roll up research as well as like Bitcoin cross-chain protocols. And it just made sense for me to combine those areas of research and, and see what was possible with Bitcoin.

• 1:14:13David Hoffman?

  And Eric, I, I, I think this, this story of rollups on Bitcoin is like personal for you. Cause, uh, I, I consider you like a frustrated Bitcoiner. Uh, where you're a Bitcoiner who wants Bitcoin to do more. Uh, just like, can you, for me, put me in the shoes of Eric Wall. Like when you see ZK rollups on Bitcoin, like, uh, uh, does it make you optimistic for Bitcoin? Like, what's it like to be you in, in the middle of this discussion?

• 1:14:39Speaker 02

  Yeah. I mean, uh, this is the, the, the rollup discussion that I tried to bring to Bitcoin back in 2019 was one of the things that led to like my departure from the Bitcoin community because I had built up this reputation within the Bitcoin ecosystem for a very long time as the altcoin slayer, like someone that was extremely critical to technologies built on altcoins. So I thought that like when I discovered rollups and I looked at them and I thought, holy shit, this architecture, like this way of architect, uh, teching a scalability solution on top of a base layer is actually genuinely interesting. So now that I've built up over these years, now that I've built up this social capital, can I just get?

• 1:15:20Speaker 02

  My Bitcoin peers to look at this technology and think, oh, like, maybe we should explore uh that way of architecting a layer two and discuss how to implement that on Bitcoin. But i- i- the whole conversation got completely derailed when people discovered like, Eric, are you proposing that we uh that we even accept that research is happening on the Ethereum side is actually valid, like, aren't you, don't you know that everything that comes out of Ethereum is a scam? I'm like, doesn't matter where it come from, it doesn't doesn't matter like who made it, just look at how it's constructed and then we can have a technical conversation around that. But I I would, I I completely failed to make that conversation happen in 2019. Uh and that was like when I started to entertain the idea that the intellectual center was

• 1:16:04Speaker 02

  sort of leaving Bitcoin and get going, moving into other, like the Ethereum ecosystem more. And that's why I've been spending so much time in in in in the Ethereum ecosystem is is because that's where I can have like stimulating conversations around this. But I am happy, though, that now, at long last, we are starting to see interest in the Bitcoin ecosystem, like, these ideas are starting to to become accepted and we can discuss them again in in Bitcoin. So I'm happy about that, but it's been like three years out in the cold, like, being called a a an idiot and a shitcoiner, when in reality, now, like, we've done the research now for ZK rollups, there is validity to those ideas and we can probably, for the first time, entertain that you don't have to be an evil person just to say like, maybe we should do this on Bitcoin.

• 1:16:49David Hoffman?

  Right. Well, I have even less social capital in the Bitcoin space than you, probably far less, uh yet, ZK rollups on Bitcoin, what we're seeing out of John's here is research uh on, and and again, bitcoinrollups.org to to learn more, uh is like probably the most in- interesting and exciting thing I've seen out of Bitcoin since I've been in crypto. Uh and so I I'm hoping this conversation continues, uh and I I definitely want to be a part of a part of that story as well, because Bitcoin can be more expressive and deserves to be expressed more. And I see ZK rollups as the first legitimate path to to getting that done. Uh so, John, thank you for all of your all of your research and and also coming on the show and and talking to me and Eric about it here.

• 1:17:35Speaker 01

  Yeah, definitely. Thank you so much for your interest.

• 1:17:39David Hoffman?

  And Eric, thank you for helping me navigate an area that, a muscle that I don't flex very often. So I needed some help on that one. So thank you so much for your help.

• 1:17:46Speaker 02

  Thanks for having me.

• 1:17:48David Hoffman?

  All right. Cheers, guys. Bankless Nation, risks and disclaimers, of course. ETH is risky, crypto is risky, DeFi is risky, ZK rollups on Bitcoin are perhaps the new frontier. You could lose what you put in. We are headed west. This is the frontier. It's not for everyone, but we are glad you are with us on the bankless journey. Thanks a lot. Hey, we hope you enjoyed the video. If you did, head over to Bankless HQ right now to develop your crypto investing skills and learn how to free yourself from banks and gain your financial independence. We recommend joining our daily newsletter, podcasts and community as a Bankless Premium subscriber to get the most out of your Bankless experience. You'll get access to our market analysis, our alpha leaks and exclusive content, and even the Bankless token for airdrops, raffles and unlocks.

• 1:18:33David Hoffman?

  If you're interested in crypto, the Bankless community is where you want to be. Click the link in the description to become a Bankless Premium subscriber today. Also, don't forget to subscribe to the channel for in-depth interviews with industry leaders, Ask Me Anythings and weekly rollups where we summarize the week in crypto and other fantastic content. Thanks everyone for watching and being on the journey as we build out the Bankless Nation.