Introduction

Citrea is the first rollup to use zero-knowledge technology to enhance Bitcoin’s block space functionality. It is the only scalability solution leveraging Bitcoin as a data availability and settlement layer through its trust-minimized BitVM-based two-way peg mechanism, Clementine. Citrea is fully compatible with EVM, enabling all EVM developers to build on Bitcoin easily.

Funding Background

Citrea completed two rounds of funding this year. The seed round was closed on February 21, 2023, raising $2.7M, led by Galaxy, with other investors including Delphi Ventures, Eric Wall, Anurag Arjun, BatuX, Igor Barinov, and James Parillo. The Series A round was completed on October 31, 2024, raising $14M, led by Founders Fund, with participation from Maven 11, Mirana Ventures, dao5, Axiom, and others.

Founding Team

The core team of Citrea consists of Orkun Mahir Kılıç, Esad Yusuf Atik, and Murat Karademir, all of whom have extensive experience in blockchain and are key members of Chainway Labs, which developed Citrea.

Challenges Facing Bitcoin

High Demand for Bitcoin Block Space

Due to Bitcoin’s security, decentralization, and censorship resistance, users seek to fulfill all their on-chain needs through Bitcoin. Over the past few months, interest in the Bitcoin ecosystem has grown exponentially, reflected in rising transaction fees. Users are eager to pay for space on the blockchain whether for payments or inscription transactions.

Ensuring sustainable participation in the Bitcoin network is critical to its long-term health and security budget. However, there is a tradeoff: high fees and necessary block size limitations inevitably exclude some transactions. Bitcoin must scale to accommodate more complex transactions without compromising its core principles. This growing interest highlights a significant issue with existing scalability proposals: their failure to meet the increasing demand for Bitcoin block space.

Limitations of Existing Scalability Proposals

Bitcoin’s Layer 2

Bitcoin has long struggled to process more transactions and support additional applications without compromising its security or core principles. This multifaceted challenge has proven difficult to resolve fully. Some solutions, like the Lightning Network, aim to improve Bitcoin’s payment efficiency, while others focus on expanding BTC’s functionality, like sidechains.

In the current landscape, the inherent demand for Bitcoin’s blockchain is being redirected to separate consensus protocols, namely sidechains. This approach creates a tradeoff—sacrificing Bitcoin’s security and misaligning with its incentive mechanisms in exchange for lower fees and broader BTC use cases. As a result, Bitcoin, dominated by sidechain-driven scalability solutions, faces challenges that fail to contribute meaningfully to its long-term health and incentives. These solutions do not bolster Bitcoin’s security or adequately scale its blockchain, turning the demand for sidechains into a divergence from genuine Bitcoin demand.

Execution Layer Replacing Sidechains

Traditional Sidechains vs. Citrea

Citrea is the only execution layer implemented on Bitcoin, the first to offer zero-knowledge proof verification, and the first general-purpose L2 verification within Bitcoin. Unlike monolithic sidechains, Citrea creates a modular ecosystem for Bitcoin through its execution shards, keeping settlement and data availability on-chain and within the Bitcoin network. [2]

Key Features

Citrea is the only execution layer on Bitcoin that settles transactions directly on Bitcoin. Every transaction that occurs on Citrea is fully protected by zero-knowledge proofs and verified by Bitcoin. Citrea’s execution environment is trustless relative to Bitcoin and accessible to all participants in the Bitcoin network. Therefore, Citrea ensures that it meets the same data availability, censorship resistance, and reorganization resistance guarantees as Bitcoin.

Bitcoin as the Foundation for Applications:

Citrea’s mission is to build a programmable liquidity layer on the most secure and decentralized blockchain—Bitcoin. We believe that Bitcoin block space must be used efficiently to address various financial activities, such as trustless BTC purchases, leveraging BTC, or lending BTC. While most current meta-protocols trying to provide these functions are trusted and inefficient, Citrea is the most efficient and secure platform for building applications on Bitcoin.

Bitcoin Settlement and Trust-Minimized Two-Way Peg:

Citrea implements the first trust-minimized two-way peg mechanism through Clementine, protected by ZK proofs and BitVM. As long as a single validator in the BitVM setup is honest, Clementine remains secure. This represents a significant improvement over existing solutions (such as open and closed federations). The design of Clementine, combined with Citrea’s trustless light client, minimizes the trust requirements of the two-way peg without the need for a soft fork. Key components of Clementine include: light client proofs (for both Bitcoin and Citrea) and ZKP validators in BitVM. The core process is as follows:

• In-Peg and Out-Peg
  Clementine, based on BitVM, allows only static-sized UTXOs for in-peg and out-peg transfers. For simplicity, let’s assume it is exactly 1 BTC.

• In-Peg

In-Peg Output Logic

To initiate the peg, the user locks 1 BTC into a UTXO that can only be accessed by the following parties: N+1 multisignature in N+1 (N-1 validators, the bridge operator, and the user) or the user will receive the funds after 200 blocks. After locking the UTXO, the user sends the transaction signature to the validators.

Once the transaction on Bitcoin is completed, the funds are transferred to a new N-of-N multisignature. The user can mint their pegged BTC by presenting an SPV proof to the smart contract on Citrea. The transaction includes an EVM address used to identify the user on Citrea.

• Out-Peg Logic
  To initiate a withdrawal, the user must transfer 1 BTC to a smart contract on Citrea and provide a Bitcoin address. This address is recorded as a new leaf in the “Withdrawal Merkle Tree,” and then the 1 BTC is destroyed on Citrea. For simplicity, we can assume that each Bitcoin address is unique, but this is not restrictive. Therefore, any transfer of 1 BTC to a given Bitcoin address on the Bitcoin network will result in a valid withdrawal.

• Connector Source UTXO

UTXO Principle

Clementine ensures that if the bridge operator tries to claim more BTC than the covered withdrawal amount, they will permanently lose access to the bridge funds.

The Connector Source UTXO is used by the operator to claim from Clementine. To gain access to the Connector Source UTXO, the operator uses the Connector UTXO tree, which is a UTXO tree that the operator uses to prove the amount of BTC they can claim for their covered withdrawals.

• Two-Way Peg Scheme

Defining the Timeline

Timeline

• Light Client Deadline: The BitVM commitment checks the block height for withdrawals.
• Submission Period: The time allocated for the operator to satisfy the remaining withdrawals and record the preimage.
• K-deep Assumption: Ensures the finalization of the last Bitcoin block. Since validators can challenge using the latest block’s PoW, the operator should not be able to use different block hashes for private forks.
• BitVM Challenge Response Period: The period during which validators challenge the operator and engage in an interactive validation game (if needed). At the end of this period, there are only two possible outcomes: \
  a. The Connector Source UTXO is available for the operator to use, allowing them to claim the BTC amount covered during the withdrawal. \
  b. The Connector Source UTXO is burned along with the BitVM response UTXO, revoking the operator’s access to the bridge funds.

The light client cutoff occurs every 6 months and continues indefinitely at the same interval.

Logic

In Clementine, once the proof, including the withdrawal, is finalized on Bitcoin, the operator is responsible for covering each withdrawal. After each period, the operator commits the amount of bridge funds claimed from Clementine by revealing log2(n) preimages on Bitcoin. This amount equals the total withdrawals the frontend covers since the last checkpoint.

EVM Equivalence

Citrea brings programmability to Bitcoin through the Ethereum Virtual Machine (EVM). Citrea’s EVM is zero-knowledge provable and customized for Bitcoin and BitVM. This execution environment allows users to deploy complex smart contracts beyond Bitcoin’s script capabilities. Citrea scales Bitcoin by aggregating thousands of transactions and generating compact validity proofs. Citrea proofs are inscribed on Bitcoin and can be optimistically verified on Bitcoin through BitVM. This model ensures on-chain data availability and verifiability.

• User Deposits

User Deposits

When the user sends BTC to the bridge operator, the pegging process begins. Validators (participants authorized to challenge the bridge operator) then sign the user’s transaction. This signature is submitted to the bridge operator, indicating that the validators approve the BTC deposit. Once this validation step is completed, the user can mint cBTC (CitreaBTC) by sending the SPV (Simplified Payment Verification) of the transaction to the smart contract on Citrea, in exchange for the BTC sent to the deposit address controlled by BitVM.

Alternatively, the user can enter Citrea through an atomic swap via Bitcoin or the Lightning Network, which is easier and cheaper than using the two-way peg deposit.

• Transaction Process

User Transactions

Citrea’s EVM environment enables applications like DeFi, private transfers, or BTC swaps for BTC. Regardless of the user’s application, the technical process begins with the user sending a transaction to a full node. Once the transaction is received, the full node sends it to the sequencer for soft confirmation. Anyone accessing Citrea’s transaction history or query data can set up a Citrea full node.

The sequencer is a full node that soft-confirms transactions and builds blocks. It then propagates these soft confirmations (soft blocks) to every available full node. The purpose of soft confirmations is to provide users with a fast transaction experience. The next step involves a special full node for zero-knowledge aggregation, called the prover, which plays a key role in inheriting Bitcoin’s user transaction security.

Like all full nodes, the prover receives soft sequencer confirmation and stores the data. The key distinction of the prover is that it creates batches by aggregating the transactions that have been soft-confirmed by the sequencer. It then generates a zero-knowledge proof for this batch, which anyone can verify for validity.

The prover generates the proof and creates a data set called the state difference, which is the storage slot difference between the initial state and the latest state. The creation of the state difference is the reason why Citrea is efficient in utilizing Bitcoin block space. Since Bitcoin block space is limited and costly, Citrea records the state difference instead of full transaction data to minimize block space usage and data costs.

• User Withdrawals

User Withdrawals

To withdraw from the peg, the user can submit a withdrawal transaction to a Citrea full node or record it as a forced transaction on Bitcoin. In both cases, the bridge operator will cover the user’s withdrawal peg and request the pre-covered withdrawal from BitVM. \

The Citrea bridge utilizes BitVM for settlement on Bitcoin. BitVM is a computational paradigm that enables Turing-complete contracts on Bitcoin. As long as no one challenges it, the computation on BitVM is considered correct, making BitVM optimistic. Citrea uses BitVM to verify the zero-knowledge proofs inscribed on Bitcoin. Among N validators, a single honest validator is sufficient to protect the two-way peg mechanism, enabling Citrea to achieve trust minimization. \

Alternatively, the user can exit through an atomic swap via Bitcoin or the Lightning Network, which is easier and cheaper than using the two-way peg.

Future Development Directions

Multi-Virtual Machine Approach

Citrea is designed to be compatible with and interoperable across multiple virtual machines. It runs on the general-purpose STARK zkVM, meaning any virtual machine can be implemented and execution proofs generated. Initially, Citrea implemented EVM, but due to its forward-compatible design, it can support other VMs such as WASM or SVM.

Volition Model

Volition is a special type of data availability solution that combines off-chain and on-chain data. In simple terms, volitions allow users or applications to choose where the data for each transaction is stored. This model enables applications with different data locations to interoperate within a single blockchain. For instance, users can choose off-chain data availability for lower costs but reduced security or Bitcoin data availability for normal costs but full security. Regardless of the chosen data availability, each transaction will continue to be validated through ZK proofs.

Decentralized Sequencer Network

Citrea contributors are exploring solutions to support consensus among multiple sequencers without impacting latency and finality. One approach could involve implementing a PoS-like layer, but only for sequencing blocks. For users, the source of truth will always be the zero-knowledge proofs in Bitcoin. A decentralized sequencing layer will reduce short-term trust in sequencers to protect sequencing since sequencing will be finalized in a single timeslot on the sequencing layer. Several consensus mechanisms, such as CometBFT, Hotstuff, and MonadBFT, are currently being tested.

Trustless Atomic Swaps

Currently, research is underway into enabling trustless atomic swaps between Citrea and Bitcoin. These swaps will allow users to enter and exit Citrea without using the peg mechanism.

Lightning Network Integration

Research is being conducted into trustless atomic swaps between Citrea and the Lightning Network. This will allow Citrea users to directly pay Lightning invoices from the Citrea network or its entry and exit points without relying on the Bitcoin base layer.

Trustless Settlement

To achieve fully trustless Bitcoin settlement, an opcode for verifying ZK proofs and a contract opcode are needed. In the current architecture, BitVM provides trust-minimized settlement—a significant improvement over insecure sidechain solutions.

Conclusion

The core of the Citrea protocol lies in its unique positioning for dynamic data flow, providing an efficient and trustless solution for real-time data sharing and management. Its broad application scenarios and innovative technical architecture make it a significant player in the blockchain field. However, it still faces challenges regarding technology and user adoption to achieve broader applications.