How Citrea Combines Optimistic and ZK Proving to Build a Bitcoin Rollup
The Founders Fund backed aspiring Bitcoin rollup that's leveraging what works.
Check Part 2 of this series on Starknet becoming a Bitcoin L2.
In our quest to understand the impact of Starknet becoming a super-rollup connecting Ethereum and Bitcoin, we’re diving deeper and deeper into the existing Bitcoin Layer 2 ecosystem.
Today we look at Citrea, an aspiring Bitcoin rollup in development that represents the frontier of what is possible today.
CITREA’S KEY IDEA
There are two major technical difficulties of creating a trustless rollup on Bitcoin (compared to Ethereum).
No smart contracts to program bridge logic. In Why Bitcoin Has No Rollups, we explained the difficulty of creating a trustless rollup bridge on Bitcoin:
You could already post state roots (effectively hashed state) of any blockchain on Bitcoin for persistence but the point of a rollup is to allow you to deposit and withdraw Bitcoin from the main network.
The lack of smart contracts means that it is difficult to create the type of programmatic rules that make up a rollup bridge.
Without being able to rely on Bitcoin validators (miners) to execute bridge transactions, Bitcoin rollups have to minimally rely on external operators for UTXO propagation.
Limited blocksize. Bitcoin blocks are capped at 4 MB, which in itself is not a small amount of data compared to Ethereum blocks. The problem is that compared to the EVM, which has several powerful opcodes and even precompiles, Bitcoin Script is very inefficient for writing any algorithm.
Citrea’s core idea is to combine the following:
BitVM2, an engine for optimistically proving any program on Bitcoin.
In 2023, Robin Linus of ZeroSync published a whitepaper called Compute Anything on Bitcoin which introduced BitVM, a virtual machine that can be used to run Turing complete contracts on Bitcoin. This can enable optimistic rollups on Bitcoin without any consensus changes.
Used to build their bridge (Clementine).
Zero Knowledge Proofs to radically compress the DA requirements. Instead of trying to build an optimistic rollup on Bitcoin, Citrea is building a ZK rollup that is using optimistic verification of the ZK proof as a placeholder until ZK proving becomes viable on Bitcoin.
This pragmatic approach relying on externally maintained tooling (BitVM, Risc0) has allowed Citrea to get ahead from a time-to-market perspective, recently raising a $14M Series A led by Founders Fund:
WHAT’S GOING WELL
With some impressive backers, Citrea’s got several things going for it:
+ Has a Type2 zkEVM allowing Ethereum contracts to be ported
+ Launched devnet
+ Building an initial app ecosystem with Citrea Origins
+ Seeing atomic interop solutions to Bitcoin & Lightning
+ Uses state diffs like efficient ZKRs on Ethereum (Starknet)
+ Exploring further improvements such as Decentralized Sequencing
CHALLENGES AHEAD
There are several open questions as Citrea as developing.
Bridge UX
The UTXO model currently imposes limitations on withdraw/deposit amounts when using the direct bridge.
Other intent based approaches do exist but may suffer from weaker trust assumptions.
Unique technical moats
Citrea’s strength seems to be in rapidly bundling external innovations into a working rollup. Even many of its optimizations are already pioneered by well known Ethereum ZKRs, for example, “off-chain contracts” is very similar to Starknet’s contract classes approach:
Ecosystem strategy
Citrea seems to be under-emphasizing liquidity. Their “request for apps” suggest a stronger interest in payments & privacy (as derived from Bitcoin’s own intended use cases) and there’s only one AMM currently listed in their ecosystem page which looks like a Uniswap v2 clone.
But payments & privacy are still developing on Ethereum and seem to require full-stack specialization. Consider Ethereum’s own World Chain which incorporates several payment focused functions building on the World Id system. Or Aztec’s futuristic privacy programming primitives.
A much more straightforward strategy especially for a EVM compatible rollup would focus on bringing Ethereum BTCfi “back home” first.
Interop
Building on the point above, optimizing for payments vs. BTCfi requires different interop priorities. While the Bitcoin rollup ecosystem is much more nascent than Ethereum’s, the importance of interop in an Ethereum context is now clear and may also drive capital flows in the Bitcoin rollup ecosystem.
It’s not clear that interop with Lighting Network is more relevant for an EVM compatible Bitcoin rollup as opposed to interop with other rollups on Ethereum.
IS BEING FIRST ENOUGH?
In short, Citrea’s strategy and positioning as “the first Bitcoin rollup” seems to be focused on moving fast and they’ve found a way to iterate quickly thanks to some very pragmatic technology choices.
But while the first Ethereum L2s benefited from proven mainnet applications that wanted to continue growing their usage through cheaper block space, Bitcoin has few such applications today.
So it’s less clear what applications and users will be jumping on Citrea when it launches.