Does Bitcoin need ZK Rollup? Explaining the Bitcoin DA adapter solutions Chainway and Kasar Labs.
Original author: Namcios
Original translation: Deep Tide TechFlow
Bitcoin is about to embrace Zero Knowledge (ZK) Rollups. Recently, two different projects have turned this development into a reality, which not only helps Bitcoin achieve greater scalability but also provides additional privacy guarantees for users who decide to use it.
Chainway announced last week the open sourcing of its Data Availability (DA) Adapter, a technology that allows developers to build Rollups using the Sovereign Software Development Kit (SDK) while leveraging the security and finality of Bitcoin. Sovereign provides developers with bundled services for building different types of Rollups, and Chainway's release aims to achieve Bitcoin's first ZK Rollup.
Kasar Labs, in collaboration with Taproot Wizards, coincidentally released a DA Adapter for Bitcoin as well. This adapter allows developers to integrate the Madara stack into Bitcoin to run the Starknet Rollup, which is based on the Cairo programming language created by StarkWare.
What is a ZK Rollup?
Rollups batch process non-standard Bitcoin transactions, such as transactions from certain sidechains, and publish them to the blockchain's base layer, such as Bitcoin. This greatly reduces the computational cost of verifying these transactions while still benefiting from the security of the Layer-1 blockchain to some extent. In this sense, Rollup transactions exist on Bitcoin. Then, users run a node for that sidechain, which knows how to interpret the data published to Bitcoin and establish account balances. However, this means that everyone needs to run a full node of that other protocol, which is not scalable. This is where ZK comes into play.
ZK Rollup utilizes zero-knowledge proofs, a cryptographic proof that ensures computational integrity without compromising privacy. It allows the prover to prove the correctness of the computation statement to the verifier with mathematical certainty, without revealing specific information details used to compute the proof. In the context of Rollups, this is crucial because it only requires observers to know the final proof to verify these statements or transactions. By using ZK proofs, users of Rollups can obtain proof of the latest state from Bitcoin with mathematical certainty while maintaining complete privacy.
The benefits of ZK Rollup include the ability to receive payments without users being online, only needing to fetch on-chain payment data when necessary, no need to manage liquidity, and not relying on the low fees of the Bitcoin base layer. Additionally, with ZK Rollup, developers can add any desired programming environment on top of Bitcoin, such as Turing-complete smart contracts.
ZK proofs use two main mathematical techniques: SNARK and STARK. The former, succinct non-interactive argument of knowledge, predates the latter and has been applied in cryptocurrencies like Zcash, providing users with a high level of privacy. Scalable transparent argument of knowledge was developed later with the aim of offering better security and scalability on top of the desired privacy. This is because SNARK relies on trusted setups to generate proofs, while STARK aims to be completely trustless. Finally, SNARK is susceptible to quantum computation, but STARK is quantum-secure.
Given Bitcoin's history of almost no failures and resistance to deep reorganizations, it is the most suitable cryptocurrency for Rollup transactions. Rollup transactions rely on the main chain to access the critical data that users need to spend. The main chain also ensures that Rollup remains active and available.
In order to implement ZK Rollup correctly on Bitcoin and allow users to bridge their Bitcoin trustfully between Rollups, a soft fork is needed for Bitcoin. This soft fork adds a new opcode to the oldest cryptocurrency, enabling Bitcoin itself to be aware of and verify ZK proofs. If this happens, users only need to run a Bitcoin node to be able to trustfully verify the proofs published by specific Rollups, know their accounts and balances, and extract funds from the Rollup.
The two projects mentioned in the first part do not assume any consensus change in Bitcoin. Instead, they leverage the Ordinals protocol to avoid the need for new opcodes. More specifically, they make use of the concept of sealed envelopes introduced by Ordinals, which allows developers and users to encapsulate any type of data using specific flags and a few opcodes. In the case of Ordinal enclaves, the flag is "ord".
The flags and opcodes at the beginning of the envelope serve a dual purpose. First, they let Bitcoin nodes know that they can skip information envelopes that are unrelated to the Bitcoin network. Second, they have the opposite effect for users and applications that know the envelope, letting them know that it contains the content they are interested in. In the case of ZK Rollup, users can scan Bitcoin blocks to find these envelopes, understand the latest state of the Rollup, and perform mathematical verification using ZK proofs.
Now that we have an understanding of ZK proofs, let's go back to the two projects mentioned earlier and explore the unique aspects of their designs.
SOVEREIGN
The Sovereign SDK has three main objectives. First, it aims to provide a standard interface for communication between Rollup and DA layers, making it easier to deploy Rollups on new DA layers and enabling new chains to support existing Rollups. Second, it integrates with cryptographic compilers to transform the business logic of code into a form that can be cryptographically verified. Finally, it provides default implementations of common blockchain primitives such as tokens, non-fungible tokens, and cross-chain bridges.
As mentioned earlier, the Chainway DA Adapter is designed to make it easier for applications built using the Sovereign SDK to connect to Bitcoin. In other words, the adapter allows Sovereign Rollup to leverage Bitcoin as its DA layer, which was previously impossible. Data availability is crucial for Rollup because it enables computations conducted off-chain to be trustlessly validated and allows users to verify or modify their balances and make withdrawal requests from the Rollup.
To include Sovereign Rollup transactions in Bitcoin blocks, users pass their transactions to a so-called sorter. In the design of the Chainway DA Adapter, the sorter is operated by the Foundation itself and is responsible for establishing this connection between the side chain and Bitcoin, ensuring that all transactions passed by users are published on Bitcoin in the form of ZK proofs.
This may sound somewhat centralized, and indeed it is. However, given the existence of the validity proof technology - ZK-STARKs, the sorter is actually unable to act maliciously. This is because the proofs privately confirm the legitimacy of transactions and can be verified by anyone. For example, the sorter cannot misappropriate user funds or conduct unauthorized transactions. However, theoretically, they could scrutinize a user's transactions by not including them in Bitcoin blocks and retaining that data. If this were to happen, users can choose to publish their transaction data to Bitcoin by recording that information on Bitcoin.
Chainway states that in the future, they plan to achieve decentralized sorting through a small group of sorters, participation in which will be permissionless and based on staking.
STARKNET
Similar to Sovereign, Starknet also aims to enable the construction of Rollups. However, Starknet is a more opinionated ecosystem that includes explicit components such as Cairo, CairoVM, and Madara, which developers can leverage for building.
Starknet is currently a ZK Rollup operating on Ethereum, meaning the Rollup relies on the blockchain created by Vitalik Buterin as its DA layer. It employs STARK proofs to provide users with the required privacy and security assumptions, as well as enhance scalability and reduce transaction costs by batching transactions before publishing proofs and new states to Layer-1. Cairo is a Turing-complete programming language for writing provable programs, where one party can prove to another party that a certain computation has been correctly executed without the latter having to re-execute the same program. It is the first production-grade platform for generating STARK proofs for general computations.
The Cairo virtual machine receives bytecode generated by the compiler and runs it on a computer. The output of the execution is a program trace, which can then be sent to the STARK proof generator to prove the validity of the statements expressed in the Cairo code.
Madara is the sorter in the Starknet stack, helping developers support Starknet-based ZK Rollup.
Until recently, all of these software stacks could only be used on Ethereum. Now, Kasar Labs and Taproot Wizards have launched a DA adapter for Bitcoin, aiming to allow developers to anchor Rollups built on the open-source version of Starknet to the original and most secure cryptocurrency network.
Does Bitcoin need ZK Rollup?
Essentially, Bitcoin doesn't need it. It is functioning very well in its current state, and there's not much reason to believe that Bitcoin needs a major change. On the other hand, scalability is a real need, and technologies like the Lightning Network have proven to be very useful in enabling users who couldn't previously participate in Bitcoin's economic transactions.
ZK Rollup offers a different perspective of looking at Bitcoin. The above two projects don't require any actual changes to Bitcoin itself, but to achieve the full functionality of this technology, consensus changes need to be introduced by introducing new opcodes. The current research on Zero-Knowledge-based Rollup technology appears to be pushing the potential boundaries of Bitcoin, which is good for expanding the Bitcoin user base, just like the Lightning Network.
Similar to the Lightning Network, Rollup achieves functionality by batching multiple transactions together and then publishing a single source of information on Bitcoin. Of course, ZK Rollup takes a very different approach than the Lightning Network, and that's the right thing to do. This technology does not attempt to compete with the proven cheap payment second layer; Bitcoin users already love this approach. Instead, Rollup focuses on other issues and tries to provide alternative solutions.
For those who wish to perform more operations on Bitcoin, this extension technology that can ultimately achieve private, complex computation and rely on mathematical proofs sounds attractive. Even so, the ability to trustlessly bridge Bitcoin inside and outside of Rollup will depend on the introduction of the opcode. But even so, this idea exists.
It is currently unclear whether ZK Rollup will gain any attention on Bitcoin. Bitcoin already has a sidechain, Liquid, which has been active on Bitcoin for many years, but its transaction volume is still not high. It can be said that in the case of Liquid, the existence of the federated model is a disadvantage, while ZK Rollup has advantages in this respect. Perhaps Rollup may encounter the same fate as Liquid, with low transaction volume and low interest as Bitcoin users continue to choose to simply "HODL Bitcoin and hold it." Or it may open a new chapter in the development and use of Bitcoin.
Regardless of whether the end result is success or failure, the development of exploring these high-quality research efforts is a natural and necessary endeavor. Regardless of the outcome, new things can be learned from it. One thing is certain—Bitcoin will continue to perform hashing and generate blocks, allowing all users to enjoy the monetary determinism of hard money without worrying about any of these things.
