Since its inception in 2009, Bitcoin (BTC), as the world’s first cryptocurrency, has gradually become the cornerstone of digital assets and decentralized finance. However, as the number of users and transaction volumes grow, several issues with the BTC network have become increasingly apparent:
In this article, we refer to technologies such as the Lightning Network, Sidechains, and Rollup collectively as BTC Layer2 scaling solutions. These technologies enable fast, low-cost transactions while maintaining the decentralization and security of the BTC network. The introduction of Layer2 technologies can enhance transaction speed, reduce transaction costs, optimize user experience, and expand network capacity, providing crucial technical support and innovation for BTC’s future development.
Currently, Beosin has become the official security partner for several BTC Layer2 projects like Merlin Chain and has audited multiple BTC ecosystem protocols, including Bitmap.Games, Surf Protocol, Savmswap, and Mineral. In past audits, numerous well-known public chains, such as Ronin Network, Clover, Self Chain, and Crust Network, have successfully passed Beosin’s public chain security audits. Beosin now offers a comprehensive audit solution for BTC Layer2, providing reliable and thorough security auditing services for the entire BTC ecosystem.
The initial concept behind the Lightning Network was known as a “payment channel.” The design philosophy was to continuously update the status of unconfirmed transactions through transaction replacement until they were eventually broadcast to the Bitcoin network. When Satoshi Nakamoto created Bitcoin in 2009, he had already proposed the idea of payment channels, even including a draft code for payment channels in Bitcoin 1.0. This draft allowed users to update the transaction status before it was confirmed by the network. However, it wasn’t until the release of the white paper titled The Bitcoin Lightning Network: Scalable Off-Chain Instant Payment that the Lightning Network truly came into existence and gained public attention.
Today, the implementation of payment channels and the Lightning Network has become quite mature. As of now, the Lightning Network consists of 13,325 nodes and 49,417 channels, with a total of 4,975 BTC staked.
In the Lightning Network, ensuring the security of users’ assets during transfers is crucial. Below, we will explain how the Lightning Network operates and how it protects the security of user assets, based on the scale of network nodes.
Both parties involved submit two transactions to the Bitcoin mainnet: one to open the channel and another to close it. The process generally involves three steps:
1.Channel Opening:
First, both users stake Bitcoin into a multi-signature wallet on the BTC network through the Lightning Network. Once the Bitcoin is successfully staked and locked, the payment channel is opened, allowing both parties to conduct off-chain transactions within this channel.
2.Off-chain transactions:
Once the channel is opened, all transfer transactions between the users are processed within the Lightning Network, and there is no limit to the number of these off-chain transactions. These transactions do not need to be immediately submitted to the Bitcoin mainnet but are instead instantly completed through the Lightning Network’s off-chain mechanism.
This off-chain processing method significantly increases transaction speed and efficiency, avoiding congestion on the Bitcoin mainnet and high transaction fees.
3.Channel Closure and Ledger Settlement:
When either user decides to exit the channel, a final ledger settlement occurs. This process ensures that all funds in the channel are distributed according to the most recent state. Both users then withdraw their respective settled balances from the multi-signature wallet, reflecting the actual distribution of funds at the time the channel is closed. Finally, the transaction representing the final state of the ledger is submitted to the Bitcoin mainnet.
The advantages of the Lightning Network include:
Challenges faced by the Lightning Network include:
The security of the Lightning Network directly impacts Bitcoin’s off-chain scalability and the safety of user funds. Therefore, in addition to the common audit items for public chains (detailed in the appendix at the end of this document), the Lightning Network also needs to address the following key security risks:
Unlike the Lightning Network, a sidechain is an independent blockchain that operates parallel to the mainchain (such as the BTC blockchain) and interoperates with it through a mechanism known as a two-way peg (2WP). The purpose of sidechains is to enable additional functionality and scalability without altering the mainchain’s protocol.
A sidechain, as an independent blockchain, has its own consensus mechanism, nodes, and transaction processing rules. It can adopt different technologies and protocols according to the needs of specific application scenarios. Through the two-way peg mechanism, the sidechain communicates with the mainchain, ensuring that assets can be transferred freely and securely between them. The operation of the two-way peg mechanism generally involves the following steps:
The user locks BTC on the mainchain. A trusted entity then obtains and uses Simplified Payment Verification (SPV) to confirm whether the user’s lock transaction has been confirmed.
The trusted entity issues an equivalent amount of tokens to the user on the sidechain.
After completing their transactions, the user locks the remaining tokens on the sidechain.
After verifying the transactions’ legitimacy, the trusted entity unlocks and releases the corresponding value of BTC to the user on the mainchain.
Note 1: Trusted entities play a critical role in the two-way peg mechanism, managing the locking and releasing of assets. These entities must possess high levels of trustworthiness and technical capability to ensure the security of users’ assets.
Note 2: SPV verification allows a node to verify the validity of a specific transaction without downloading the entire blockchain. SPV nodes only need to download the block headers and use the Merkle Tree to verify whether the transaction is included in the block.
CKB (Nervos Network) \
Nervos Network is an open-source public blockchain ecosystem designed to leverage the security and decentralization benefits of Bitcoin’s Proof of Work (PoW) consensus mechanism while introducing a more scalable and flexible UTXO model to handle transactions. At its core is the Common Knowledge Base (CKB), a Layer 1 blockchain built on RISC-V and using PoW as its consensus mechanism. It extends the UTXO model into the Cell model, allowing it to store any data and support scripts written in any language to execute as smart contracts on-chain.
Stacks
Stacks connects each Stacks block with a Bitcoin block through its Proof of Transfer (PoX) mechanism. To facilitate the development of smart contracts, Stacks has designed the Clarity programming language. In Clarity, the get-burn-block-info?
function allows the input of a Bitcoin block height to retrieve the block’s header hash, while the burn-block-height
keyword retrieves the current block height of the Bitcoin chain. These functions enable Clarity smart contracts to read the state of the Bitcoin base chain, allowing Bitcoin transactions to trigger contracts. By automatically executing these smart contracts, Stacks extends Bitcoin’s functionality. For a detailed analysis of Stacks, you can refer to Beosin’s previous research article: What is Stacks? What Challenges Might BTC Layer 2 Network Stacks Face?
Advantages of Sidechains
Challenges of Sidechains
Layer 2 is a complete blockchain system, so the general audit items for public blockchains also apply to sidechains. For details, please refer to the appendix at the end of this article.
Additionally, due to its unique characteristics, sidechains require some extra audits:
Rollup is a Layer 2 scaling solution designed to enhance blockchain transaction throughput and efficiency. By aggregating a large number of transactions (“Rolling up”) and processing them off-chain, it reduces the load on the main chain, submitting only the final results back to it.
Rollup comes in two main types: zk-Rollup and op-Rollup. However, unlike Ethereum, Bitcoin’s lack of Turing completeness prevents the use of smart contracts for zero-knowledge proof (ZKP) verification directly on its network. This means that traditional zk-Rollup solutions cannot be implemented on Bitcoin. So, how can zk-Rollup be used to achieve Bitcoin Layer 2 scaling? Let’s explore the B² Network project as an example:
To perform ZKP verification on Bitcoin, B² Network has developed a Taproot script that integrates zk-Rollup’s zero-knowledge proof verification with op-Rollup’s incentive challenge mechanism. Here’s how it works:
Advantages of Rollup:
Challenges of Rollup:
Given that Rollup is used, its key security audit items are consistent with those of Ethereum’s Layer 2.
In addition to traditional BTC Layer 2 solutions, some new third-party protocols related to the BTC ecosystem have emerged, such as Babylon:
Babylon aims to transform 21 million BTC into decentralized staking assets. Unlike other BTC Layer 2 solutions, Babylon does not focus on scaling the BTC network. Instead, it is a unique blockchain with a specialized BTC staking protocol designed primarily to interface with Proof of Stake (PoS) chains. The goal is to stake BTC to enhance the security of PoS chains, addressing issues like long-range attacks and centralization risks.
The architecture is divided into three layers:
Babylon operates by signing final blocks on the BTC chain to secure PoS chains. This essentially extends the base protocol with an additional round of signatures. These signatures in the final +1 round have a unique feature: they are Extractable One-Time Signatures (EOTS). The goal is to integrate PoS checkpoints onto the BTC chain, addressing the issues of long unbinding periods and long-range attacks in PoS systems.
Advantages of Babylon:
Challenges of Babylon:
The security focus varies depending on the specific implementation of third-party protocols. For Babylon, some key security audit points include:
1. Smart Contract Security: Staking contracts on BTC are implemented through UTXO scripts, which require careful attention to their security.
2. Signature Algorithm Security: The security of the signature algorithm used to manage staking in the contract is critical, as it affects the generation and verification of signatures.
3. Economic Model Design: The economic model of the protocol, particularly in terms of rewards and penalties, needs to be scrutinized to ensure it doesn’t lead to the loss of user assets.
As one of the earliest blockchain security companies globally specializing in formal verification, Beosin focuses on a comprehensive “security + compliance” ecosystem. The company has established branches in over 10 countries and regions worldwide. Its services encompass one-stop blockchain compliance products and security services, including code security audits before project launches, real-time security risk monitoring and interception during project operation, stolen asset recovery, anti-money laundering (AML) for virtual assets, and compliance assessments that meet local regulatory requirements. We welcome projects with auditing needs to contact the Beosin security team.
Since its inception in 2009, Bitcoin (BTC), as the world’s first cryptocurrency, has gradually become the cornerstone of digital assets and decentralized finance. However, as the number of users and transaction volumes grow, several issues with the BTC network have become increasingly apparent:
In this article, we refer to technologies such as the Lightning Network, Sidechains, and Rollup collectively as BTC Layer2 scaling solutions. These technologies enable fast, low-cost transactions while maintaining the decentralization and security of the BTC network. The introduction of Layer2 technologies can enhance transaction speed, reduce transaction costs, optimize user experience, and expand network capacity, providing crucial technical support and innovation for BTC’s future development.
Currently, Beosin has become the official security partner for several BTC Layer2 projects like Merlin Chain and has audited multiple BTC ecosystem protocols, including Bitmap.Games, Surf Protocol, Savmswap, and Mineral. In past audits, numerous well-known public chains, such as Ronin Network, Clover, Self Chain, and Crust Network, have successfully passed Beosin’s public chain security audits. Beosin now offers a comprehensive audit solution for BTC Layer2, providing reliable and thorough security auditing services for the entire BTC ecosystem.
The initial concept behind the Lightning Network was known as a “payment channel.” The design philosophy was to continuously update the status of unconfirmed transactions through transaction replacement until they were eventually broadcast to the Bitcoin network. When Satoshi Nakamoto created Bitcoin in 2009, he had already proposed the idea of payment channels, even including a draft code for payment channels in Bitcoin 1.0. This draft allowed users to update the transaction status before it was confirmed by the network. However, it wasn’t until the release of the white paper titled The Bitcoin Lightning Network: Scalable Off-Chain Instant Payment that the Lightning Network truly came into existence and gained public attention.
Today, the implementation of payment channels and the Lightning Network has become quite mature. As of now, the Lightning Network consists of 13,325 nodes and 49,417 channels, with a total of 4,975 BTC staked.
In the Lightning Network, ensuring the security of users’ assets during transfers is crucial. Below, we will explain how the Lightning Network operates and how it protects the security of user assets, based on the scale of network nodes.
Both parties involved submit two transactions to the Bitcoin mainnet: one to open the channel and another to close it. The process generally involves three steps:
1.Channel Opening:
First, both users stake Bitcoin into a multi-signature wallet on the BTC network through the Lightning Network. Once the Bitcoin is successfully staked and locked, the payment channel is opened, allowing both parties to conduct off-chain transactions within this channel.
2.Off-chain transactions:
Once the channel is opened, all transfer transactions between the users are processed within the Lightning Network, and there is no limit to the number of these off-chain transactions. These transactions do not need to be immediately submitted to the Bitcoin mainnet but are instead instantly completed through the Lightning Network’s off-chain mechanism.
This off-chain processing method significantly increases transaction speed and efficiency, avoiding congestion on the Bitcoin mainnet and high transaction fees.
3.Channel Closure and Ledger Settlement:
When either user decides to exit the channel, a final ledger settlement occurs. This process ensures that all funds in the channel are distributed according to the most recent state. Both users then withdraw their respective settled balances from the multi-signature wallet, reflecting the actual distribution of funds at the time the channel is closed. Finally, the transaction representing the final state of the ledger is submitted to the Bitcoin mainnet.
The advantages of the Lightning Network include:
Challenges faced by the Lightning Network include:
The security of the Lightning Network directly impacts Bitcoin’s off-chain scalability and the safety of user funds. Therefore, in addition to the common audit items for public chains (detailed in the appendix at the end of this document), the Lightning Network also needs to address the following key security risks:
Unlike the Lightning Network, a sidechain is an independent blockchain that operates parallel to the mainchain (such as the BTC blockchain) and interoperates with it through a mechanism known as a two-way peg (2WP). The purpose of sidechains is to enable additional functionality and scalability without altering the mainchain’s protocol.
A sidechain, as an independent blockchain, has its own consensus mechanism, nodes, and transaction processing rules. It can adopt different technologies and protocols according to the needs of specific application scenarios. Through the two-way peg mechanism, the sidechain communicates with the mainchain, ensuring that assets can be transferred freely and securely between them. The operation of the two-way peg mechanism generally involves the following steps:
The user locks BTC on the mainchain. A trusted entity then obtains and uses Simplified Payment Verification (SPV) to confirm whether the user’s lock transaction has been confirmed.
The trusted entity issues an equivalent amount of tokens to the user on the sidechain.
After completing their transactions, the user locks the remaining tokens on the sidechain.
After verifying the transactions’ legitimacy, the trusted entity unlocks and releases the corresponding value of BTC to the user on the mainchain.
Note 1: Trusted entities play a critical role in the two-way peg mechanism, managing the locking and releasing of assets. These entities must possess high levels of trustworthiness and technical capability to ensure the security of users’ assets.
Note 2: SPV verification allows a node to verify the validity of a specific transaction without downloading the entire blockchain. SPV nodes only need to download the block headers and use the Merkle Tree to verify whether the transaction is included in the block.
CKB (Nervos Network) \
Nervos Network is an open-source public blockchain ecosystem designed to leverage the security and decentralization benefits of Bitcoin’s Proof of Work (PoW) consensus mechanism while introducing a more scalable and flexible UTXO model to handle transactions. At its core is the Common Knowledge Base (CKB), a Layer 1 blockchain built on RISC-V and using PoW as its consensus mechanism. It extends the UTXO model into the Cell model, allowing it to store any data and support scripts written in any language to execute as smart contracts on-chain.
Stacks
Stacks connects each Stacks block with a Bitcoin block through its Proof of Transfer (PoX) mechanism. To facilitate the development of smart contracts, Stacks has designed the Clarity programming language. In Clarity, the get-burn-block-info?
function allows the input of a Bitcoin block height to retrieve the block’s header hash, while the burn-block-height
keyword retrieves the current block height of the Bitcoin chain. These functions enable Clarity smart contracts to read the state of the Bitcoin base chain, allowing Bitcoin transactions to trigger contracts. By automatically executing these smart contracts, Stacks extends Bitcoin’s functionality. For a detailed analysis of Stacks, you can refer to Beosin’s previous research article: What is Stacks? What Challenges Might BTC Layer 2 Network Stacks Face?
Advantages of Sidechains
Challenges of Sidechains
Layer 2 is a complete blockchain system, so the general audit items for public blockchains also apply to sidechains. For details, please refer to the appendix at the end of this article.
Additionally, due to its unique characteristics, sidechains require some extra audits:
Rollup is a Layer 2 scaling solution designed to enhance blockchain transaction throughput and efficiency. By aggregating a large number of transactions (“Rolling up”) and processing them off-chain, it reduces the load on the main chain, submitting only the final results back to it.
Rollup comes in two main types: zk-Rollup and op-Rollup. However, unlike Ethereum, Bitcoin’s lack of Turing completeness prevents the use of smart contracts for zero-knowledge proof (ZKP) verification directly on its network. This means that traditional zk-Rollup solutions cannot be implemented on Bitcoin. So, how can zk-Rollup be used to achieve Bitcoin Layer 2 scaling? Let’s explore the B² Network project as an example:
To perform ZKP verification on Bitcoin, B² Network has developed a Taproot script that integrates zk-Rollup’s zero-knowledge proof verification with op-Rollup’s incentive challenge mechanism. Here’s how it works:
Advantages of Rollup:
Challenges of Rollup:
Given that Rollup is used, its key security audit items are consistent with those of Ethereum’s Layer 2.
In addition to traditional BTC Layer 2 solutions, some new third-party protocols related to the BTC ecosystem have emerged, such as Babylon:
Babylon aims to transform 21 million BTC into decentralized staking assets. Unlike other BTC Layer 2 solutions, Babylon does not focus on scaling the BTC network. Instead, it is a unique blockchain with a specialized BTC staking protocol designed primarily to interface with Proof of Stake (PoS) chains. The goal is to stake BTC to enhance the security of PoS chains, addressing issues like long-range attacks and centralization risks.
The architecture is divided into three layers:
Babylon operates by signing final blocks on the BTC chain to secure PoS chains. This essentially extends the base protocol with an additional round of signatures. These signatures in the final +1 round have a unique feature: they are Extractable One-Time Signatures (EOTS). The goal is to integrate PoS checkpoints onto the BTC chain, addressing the issues of long unbinding periods and long-range attacks in PoS systems.
Advantages of Babylon:
Challenges of Babylon:
The security focus varies depending on the specific implementation of third-party protocols. For Babylon, some key security audit points include:
1. Smart Contract Security: Staking contracts on BTC are implemented through UTXO scripts, which require careful attention to their security.
2. Signature Algorithm Security: The security of the signature algorithm used to manage staking in the contract is critical, as it affects the generation and verification of signatures.
3. Economic Model Design: The economic model of the protocol, particularly in terms of rewards and penalties, needs to be scrutinized to ensure it doesn’t lead to the loss of user assets.
As one of the earliest blockchain security companies globally specializing in formal verification, Beosin focuses on a comprehensive “security + compliance” ecosystem. The company has established branches in over 10 countries and regions worldwide. Its services encompass one-stop blockchain compliance products and security services, including code security audits before project launches, real-time security risk monitoring and interception during project operation, stolen asset recovery, anti-money laundering (AML) for virtual assets, and compliance assessments that meet local regulatory requirements. We welcome projects with auditing needs to contact the Beosin security team.