GOAT Network released the GOAT BitVM2 White Paper, accelerating the implementation of Bitcoin zkRollup.

This article is provided by GOAT and does not represent the views of Wu Shuo.

On May 7, 2025, Eastern Time, GOAT Network officially released the GOAT BitVM2 white paper, proposing the first practical Bitcoin-native zkRollup protocol. This protocol builds on the advantages of the original BitVM2 protocol and introduces multiple innovations, systematically addressing key issues in security, challenge mechanisms, and economic incentives, laying the foundation for the scalability and programmability of the Bitcoin ecosystem.

The potential and real bottlenecks of BitVM2

The BitVM2 protocol, proposed by Robin Linus and the ZeroSync team in 2024, is an innovative path that allows on-chain verification of arbitrary computations without changing the Bitcoin mainnet protocol, creating possibilities for Bitcoin zkRollup and cross-chain bridges. However, there are still the following key issues when moving towards practical application and using BitVM2 for production-level cross-chain bridges:

● Operator ( Double Spend Attack: Currently, BitVM2 allows operators to submit verifiable but actually fraudulent states (e.g., originating from a forked chain), which may trigger the risk of a double spend attack when users withdraw funds.

● Low efficiency in challenge processes: The current mechanism uses one-to-one ) staking, challenges ( relationships, and has a lengthy challenge period, resulting in high computation and coordination costs. At the same time, it does not support flexible withdrawal amounts, reducing capital utilization and user experience.

● Lack of effective incentive mechanisms: The protocol lacks effective incentives to drive the participation of various roles in the Rollup ecosystem, especially challengers who often do not receive rewards, leading to insufficient willingness to honestly and timely initiate challenges. In systems that rely on crowdfunding incentives, there may also be issues with rewards being allocated to the wrong participants, further undermining the accuracy and effectiveness of incentives.

GOAT BitVM2: Three Major Mechanism Innovations

The GOAT Network, from an engineering perspective, has launched the GOAT BitVM2 enhancement plan, which has been deployed as the core execution system of the GOAT Network, marking the first practical implementation of Bitcoin zkRollup. This plan fundamentally improves on three mechanisms:

1. Cryptoeconomic Security Layer

By combining the native Bitcoin Script verification with the dual penalty mechanism of the GOAT network consensus layer, the cost of malicious actions by operators is significantly increased. This mechanism also maintains a reasonably sized set of operators, ensuring high system activity under the "1-of-n honest nodes" assumption.

2. Accelerated Dispute Resolution

By adopting a multi-round challenger rotation mechanism, the challenge processing cycle has been greatly shortened, effectively reducing the finality time to less than 1 day.

3. Incentive-Aligned Challenge Economy

Successful challengers can receive a "fraud bounty" composed of the stake from malicious proposers. This mechanism increases the participation rate of challenges and aligns the economic incentives between the act of challenging and the operator's risk of wrongdoing.

Universal Operator Model: Integrated Reconstruction of Economy and Architecture

To achieve the above mechanism, the GOAT Network integrates and reconstructs the complex and separated role system in BitVM2.

In the traditional BitVM2 architecture, the Rollup system includes various roles such as Sequencer, Challenger, Operator, and Committee members. Due to the significant differences in responsibilities and costs among these roles, designing a fair and efficient Rollup economic model and incentive mechanism has become a highly challenging task.

The core innovation of the GOAT Network lies in unifying these roles into a single identity - the Universal Operator (referred to as Operator) - and implementing a role rotation mechanism that allows all participants to take on different responsibilities at different times. All Operators are required to stake on L2, and each round will be assigned to a specific role, bringing the following four major advantages:

● Revenue and Cost Balance: The GOAT network ensures a relative balance between income and expenditure over the long term by rotating operators between profitable roles and high-cost roles, avoiding the situation where some operators bear high computing costs for extended periods.

● Alignment of incentive mechanisms: The cross-subsidy mechanism between different roles smooths out income fluctuations, encouraging operators to remain honestly engaged in any role.

● Lowering participation thresholds: Small and medium-sized nodes do not need to continuously bear high-cost roles, making it easier for them to participate and enhance the system's decentralization and openness.

● Enhance system resilience: Even if individual operators go offline, the system can maintain operation through flexible role allocation, avoiding dependence on a single point.

In summary, the GOAT Network unifies roles such as validators, calculators, and challengers into a role pool composed of staking operators, who take turns assuming responsibilities and are subject to a penalty mechanism. Proposers who submit fraudulent states will be punished, and challengers who fail to fulfill their duties or challenge maliciously will also be penalized. This mechanism ensures that honest behavior is economically optimal, while a clear rotation mechanism prevents roles from being concentrated in specific individuals for extended periods, thereby reducing centralization risk.

Overview of the Protocol Architecture: A Closed Loop System Built Around a General Operator

This architecture not only needs to cover the cross-chain entry and exit processes of assets (Bridge-In & Bridge-Out), but also to achieve trusted submission of the validator set, on-chain coordination of the challenge process, and efficient generation and verification of zk proofs. The following are the core components of the GOAT BitVM2 protocol architecture:

Universal Operator Model

In GOAT BitVM2, each universal operator runs the same software and stakes BTC to gain participation eligibility. Through deterministic rotation or a random mechanism based on staking weight, these operators take turns in the following roles: Sequencer (responsible for block production), Prover (generates zkSNARK proofs), Publisher (submits state data to L1), and Challenger (used to contest fraudulent states). Each operator will experience roles that are both profitable and cost-bearing, thereby avoiding role concentration and enhancing the system's fault tolerance through diversity.

Deposit and Withdrawal Process (Bridge-in and Bridge-out)

● Deposit: Users lock BTC and receive PegBTC in L2.

● Withdrawal/Peg-out: There is no need to rely on L1 to verify the complex BitVM2 withdrawal script. Instead, GOAT uses an atomic swap mechanism to complete the withdrawal process directly with the operator, while incorporating anti-fraud protocols to ensure security and reliability.

Sequencer Set Commitment

● The operator submits the Merkle Root of their public key set through the OP_RETURN of the Bitcoin main chain.

● L2 utilizes the Transaction Introspection feature to verify historical BTC states and match them with the set of sorters on L1. This design does not require modifications to the Bitcoin consensus rules while achieving strong alignment with the native state of BTC.

Efficient Dispute Resolution with zkMIPS Performance Boost

For Bitcoin's native zkRollup to be practical, it must have an efficient fraud detection and dispute resolution system. GOAT BitVM2 has made the following designs in terms of challenge models and proof performance:

Multi-Round Random Challenger Selection

When a challenger is needed (such as during the operator reimbursement process), the system will randomly select a challenger from all staked nodes. If the challenger fails to initiate a challenge in a timely manner, the system will randomly select a new challenger as a substitute. If the new challenger successfully identifies fraud and initiates a challenge, all previous challengers who did not fulfill their duties will be penalized (their stakes will be confiscated). It is worth noting that anyone can initiate a challenge in any round, thus maintaining the security of the "1-of-n honest participant" assumption.

In addition, the random role allocation and fully punishable staking mechanism effectively prevent behaviors such as bribery attacks, system extortion (ransom-style extortion), and malicious interference (griefing).

On-Chain and Off-Chain Execution

Most computational logic (such as ZKP generation, fraud verification, BitVM2 interactive scripts, etc.) is executed on L2, with only the final results (state submissions, challenge processing, penalty operations, etc.) uploaded to L1. This design significantly reduces on-chain Gas costs while ensuring the verifiability of the entire system.

ZKP Performance Improvement: Self-developed zkMIPS

GOAT's self-developed zkMIPS is a zkVM compatible with the MIPS instruction set, optimized for STARK/SNARK backends. By batch processing multiple blocks and generating a unified proof periodically (e.g., every hour), GOAT's prover achieves extremely high cost efficiency. The "truth-table" method of BitVM2 can also be used during challenges to locate disputed positions, allowing for quick resolution of disputes.

Summary

Compared to the original BitVM2: faster, more stable, more practical

GOAT BitVM2 uses the Bitcoin network as the settlement layer and builds a decentralized sorter network as the computation layer. Under the assumption of "1-of-n honest participants", this solution successfully addresses key issues in BitVM2 such as flexible amount withdrawals and insufficient challenger incentives. To accelerate optimistic verification, GOAT introduces a multi-round challenge mechanism, significantly increasing the efficiency and effectiveness of fraud detection. Additionally, combined with the zkMIPS capability to efficiently generate ZK proofs, GOAT BitVM2 becomes the most secure and high-performance zkRollup protocol in the current Bitcoin ecosystem, promising to significantly accelerate the practical implementation of BitVM2 in the market.

Not only has GOAT BitVM2 achieved breakthroughs in technical architecture, but it has also built a powerful economic system based on general operator rotation. This system ensures that responsibilities such as orderers, provers, challengers, and publishers are fairly distributed among all stakers. Through transaction fee sharing, fraud bounties, and penalty mechanisms, the protocol encourages honest behavior while economically penalizing malicious actions, thereby creating a sustainable, fair, and resilient decentralized ecosystem.

GOAT BitVM2, as the first truly implemented Bitcoin zkRollup protocol, has achieved:

● Native security and compatibility without the need for hard forks

● Fast Challenge Mechanism

● Economic incentives restructuring

● Efficient Zero-Knowledge Proof Engine

● BitVM2 moves from theoretical model to engineering practice

Please visit the full white paper at: