AL #63: Were Rollups Meant to be on Bitcoin All Along?
Does the store-of-value chain care about execution?
Would Vitalik have built Ethereum as a separate chain if Bitcoin rollups were possible in 2013?
Perhaps not.
Vitalik’s first DeFi project was colored coins and he plead with the community to consider execution upgrades (a more complicated scripting language) so he certainly was biased to make it work on the chain that started it all.
A rollup expands a network by cheaply and provably storing transactions and deriving state from them
Considering rollups in the Bitcoin context creates unique challenges that don't have a good analogy for Ethereum.
Before we start, it’s important we form a first principles understanding of what a rollup is.
Doing things is expensive
The basic idea of rollups is that doing everything (transaction ordering, block building, transaction storage, execution and settlement) on a main chain (e.g., Ethereum) is expensive.
Ethereum handles all the above through proof-of-stake consensus which results in significant transaction fees and limited transaction throughput even for simple transfers.
Rollups: just store transactions and settle them on the main chain
In practice, only transaction storage and settlement need to happen on a main chain to preserve most of the security properties of blockchains that we care about.
Why?
Storing transactions on the main chain is essential to prevent disputes around transaction inclusion and ordering.
Transaction settlement on the main chain is essential to prevent disputes around asset ownership.
Everything else can be moved out of the main network and that’s exactly how rollups work.
Rollups replay and prove state from the transaction ordering
Users in rollups send transactions to a dedicated service called the sequencer which orders, batches and compresses them and posts them to the main chain.
At that point either the sequencer or other designated operators can determine the resulting state from the sequence of transactions and use a form of economic proof (in optimistic rollups) or cryptographic proof (in validity rollups) to enshrine the state as canonical.
This canonical state then allows the rollup to send messages to other contracts on the main chain or release assets to users (typically through a rollup contract and a rollup bridge).
Bitcoin is becoming rollup ready
Just three key upgrades define the Bitcoin rollup roadmap.
SegWit (2017) expanded block space to 4MB.
Taproot (2021), reduced the footprint of more complex Bitcoin transactions and removed bounds on script size. This enabled sovereign rollups and optimistic rollups with a permissioned validator set on Bitcoin.
OP_Cat (expected to undergo review in 2025) will introduce a new opcode that can concatenate two elements on the stack and enabling Merkle root constructions. These are essential for trustless bridges which in turn enable trustless validity rollups on Bitcoin.
What rollup architectures are possible?
Sovereign rollups
Sovereign rollups, pioneered by Celestia only publish transaction ordering to the main chain (which effectively becomes the DA layer), using a separate network to derive and validate state changes.
They use consensus to determine the canonical rules of the rollup as opposed to a smart contract on the main network. In principle, this allows them to be more decentralized, relying on soft and hard forks for upgrades.
However, to facilitate withdrawals they need to communicate back to the main network. A trustless bridge is possible but by definition will not be canonical.
BitVM optimistic rollups
In 2023, Robin Linus of ZeroSync published a whitepaper called Compute Anything on Bitcoin which introduced BitVM, a virtual machine that can be used to run Turing complete contracts on Bitcoin. This can enable optimistic rollups on Bitcoin without any consensus changes.
However, BitVM comes with its shortcomings, a longer interactive proving period and the necessity to use a finite validator set for fault proofs.
The finite validator set shortcoming has already largely been overcome with BitVM2.
BitLayer claim to have an architecture that builds a validity rollup without OP_Cat.
OP_Cat validity rollups
Adding OP_Cat to Bitcoin script allows it to compute Merkle root verifications, an essential function of current validity rollup designs.
StarkWare has proposed that with OP_Cat they would be able to adapt Starknet (currently an Ethereum rollup) to settle on Bitcoin.
This would not only significantly expand Bitcoin’s transaction throughput and execution capabilities, it would also bring the full merits of Cairo and its developer ecosystem to the network.
Positioning for dominance
It’s fairly likely that the Bitcoin rollup meta will converge to a different equilibrium than Ethereum’s.
Ethereum’s rollup paradigm is different in many ways:
Ethereum network participants are fully bought in to the value of Turing-complete execution so rollups (apart from Starknet, Aztec and M2) specifically didn't extend execution capabilities instead opting for EVM compatibility
Ether is accepted as a staked productive and inflationary asset whereas Bitcoin is seen as a scarce store of value asset. This likely would affect the DeFi economy and flywheels in unpredictable ways
Ethereum largely doesn't care about transaction privacy, Bitcoin participants value scalability and privacy of payments above execution improvements
Ethereum has an overabundance of different rollups, driven by many L1 apps. This has made interoperability a crucial battleground leading to solutions like the Superchain and AggLayer. Bitcoin has no L1 smart contracts or apps, only some on its sidechains
Ethereum users more readily trust multisigs and centralized offchain operators as Ethereum protocols have operated that way also. The Bitcoin community values decentralization and trustlessness more.
While it's hard to predict how the ecosystem will evolve, it’s likely that Bitcoin rollups would get significant adoption despite philosophical challenges.
Starknet seems to be well placed as most of their stack is already built (validity rollup complexity is in the proving stack, not verification while optimistic rollup fraud games have to be built on chain). So providers like Optimism and Arbitrum would not be able to migrate their codebases easily to a BitVM architecture.
Another advantage Starknet has is a path to privacy through Cairo and the ability to interconnect with existing DeFi TVL on the Ethereum settled chain.
However EVM compatible Bitcoin rollups will still have some advantages such as an easier time migrating developers and the ability to reuse large amounts of developer tooling. But by 2025 when OP_Cat is expected to be added, the landscape could already look very different.