Bitcoin Blockchain and ZKrollup: Citrea’s idea to improve scalability and interoperability

In this article, we explore the innovative cryptographic project Citrea, which is building a ZKrollup scaling solution on the Bitcoin blockchain, leveraging zero-knowledge proof technology and the BitVM stack.

This type of second-layer networks called “Zero Knowledge Rollup” allows for significantly improving the scalability and interoperability of Bitcoin, in a manner similar to what happens on Ethereum, by wrapping more data and transactions outside of it and then bringing back a single batch to the main chain, which acts as the data availability (DA) layer.

Let’s see in detail how Citrea works and how it can evolve the performance of Bitcoin.

Citrea prepares for the launch of the first ZKrollup on the Bitcoin blockchain: advantages in terms of interoperability and scalability

Citrea is the first ZKrollup built on the Bitcoin blockchain, designed by developer Orkun Kilic, who by combining the concept of zero-knowledge computational proofs and the idea behind BitVM, is trying to improve the scalability and interoperability of the first cryptographic network ever built.

In a recent interview with Bitcoin Magazine, Orkun explained the motivations that are driving him to bring ZKproofs into such an “obsolete” blockchain with strong limitations on block size and script capabilities.

The developer believes that Bitcoin offers the best infrastructure around in terms of censorship resistance and cryptographic security, and that thanks to the historic code changes offered with SegWit and Taproot it is finally possible to inscribe data within individual transactions, using the network as a data availability layer.

These are the words of Orkun in the interview:

“What you can do with Bitcoin beyond simple payments is extremely limited today. We want to do more using the security of Bitcoin’s block space.”

Just as it happens on Ethereum, the concept of modularity can solve the problems of a blockchain that suffers from limited performance on scalability and external interoperability like Bitcoin.

Gli ZKrollup  aiutano a rimuovere parte del lavoro computazionale dell’infrastruttura spostano l’elaborazione delle transazioni al di fuori della rete principale, avvolgendo i dati attorni ad un singolo batch che poi viene rispedito indietro riducendo tempi e costi della validazione.

By building a rollup, developers can customize their stack to create various applications, such as payment rollup, gaming rollup, and EVM rollup. This flexibility allows for different optimizations that could scale blockchains without requiring changes to the main protocol.

All these advantages, however, are also countered by some limitations: in fact, the use of Bitcoin as a layer for data availability (a practice that derives from the concept of BitVM) requires structural compromises, as the Bitcoin chain is highly costly and inefficient for performing this kind of operations.

Let’s see specifically in the next paragraph what these compromises consist of and how Citrea succeeds in the goal of integrating a zkrollup to the Bitcoin blockchain.

In the meantime, Citrea has just launched the public devnet for developers and users, marking a historic milestone regarding the use of Bitcoin as a DA layer and the expansion to new cryptographic horizons.

Security and minimized trust: the first step to aggregate zk-proofs

The implementation of a ZKrollup on the Bitcoin blockchain, although it guarantees unprecedented security, simultaneously offers lower scalability compared to other infrastructures and limitations at the on-chain architecture level.

It is therefore essential to leverage Bitcoin as a DA level only when strictly necessary (when maximum security is needed), while for applications that require high throughput and low costs it is preferable to use other layers such as Celestia.

Furthermore, the incompatibility with EVM creates problems when coins need to be moved outside of Bitcoin: Citrea solves this step with “Clementine”, a bidirectional peg based on BitVM that optimistically verifies ZK proofs. This mechanism aggregates Bitcoin proofs, reducing the need for frequent settlements.

With Clementine, it is therefore possible to verify ZK proofs conveniently and securely, offering a solution in terms of scalability and interoperability that sees the aggregation of zk proofs within individual batches.

The main idea behind Clementine is to provide optimistic settlements for ZK rollups as stabilizing all batches at each block turns out to be a very costly practice on Bitcoin.  By thus periodically enrolling the data and aggregating the proofs, Clementine ensures that the state remains accurate and secure.

Initially, until the transfer of data from L1 to L2 and their synchronization become more economical, it will be necessary to introduce an external trust layer, which is however minimized as much as possible: hence the concept of “minimized trust”.

In these early stages of Citrea’s development, an external operator will initially cover users’ withdrawal requests out of their own pocket, then aggregate the necessary proofs in a single presentation to the network. If other operators suspect that the subject is engaging in dishonest actions, they can contest the submission and have it removed from the network.

This configuration introduces a minimized hypothesis of trust in which only one participant needs to be honest to ensure security.

In this regard, Orkun emphasized that:

“This is a significant improvement over traditional models that require a majority consensus for security.”

The next step for Citrea is to introduce volition, that is, a hybrid model that balances on-chain security with off-chain cost efficiency, allowing various applications to choose the most suitable data storage method based on specific needs.

Orkun has finished the interview with Coindesk emphasizing how the use of Bitcoin as a settlement layer for data availability offers a strong incentive to miners to continue with their activities seeing commissioni increasing for long-term security.