The challenge period shrank from 14 days to 1 day, GOAT Network released the GOAT BitVM2 white paper to accelerate the implementation of Bitcoin zkRollup

On May 7, 2025, Eastern Time, GOAT Network officially released the GOAT BitVM2 white paper , proposing the first Bitcoin native zkRollup protocol that can be implemented. Based on inheriting the advantages of the original BitVM2 protocol, this protocol proposes a number of innovations, systematically solves its key issues in security, challenge mechanisms and economic incentives, and lays the foundation for the expansion and programmability of the Bitcoin ecosystem.

The potential and reality bottleneck of BitVM2

The BitVM2 protocol proposed by Robin Linus and ZeroSync team in 2024 is an innovative path to verify arbitrary computing on the chain without changing the Bitcoin mainnet protocol, creating possibilities for Bitcoin zkRollup and cross-chain bridges. However, when moving towards practical applications, BitVM2 is used for production-level cross-chain bridges, the following key issues still exist:

• Operator Double Spend Attack : Currently BitVM2 allows operators to submit verifiable but actually fraudulent status (for example from a forked chain), which may trigger a double spend attack when a user withdraws coins.
• Challenge process inefficiency : The existing mechanism adopts a one-to-one (staking, challenge) relationship and the challenge cycle is long, resulting in high computational and coordination costs. At the same time, it does not support flexible withdrawal amounts, reducing capital utilization and user experience.
• Lack of effective incentive mechanisms : The protocol lacks effective incentives to drive the participation of various roles in the Rollup ecosystem, especially the challenger is not rewarded in most cases, resulting in insufficient willingness to launch challenges honestly and in a timely manner. In systems that rely on crowdfunding incentives, there may also be a problem that rewards are assigned to the wrong participants, further weakening the accuracy and effectiveness of incentives.

GOAT BitVM2: Three major mechanism innovations

GOAT Network has launched the GOAT BitVM2 enhancement solution from an engineering perspective and has deployed it as the core execution system of GOAT Network, pushing Bitcoin zkRollup to actual implementation for the first time. The program makes fundamental improvements around three mechanisms:

1. Cryptoeconomic Security Layer

Combining Bitcoin native Script verification and the dual punishment mechanism of the consensus layer of the GOAT network, it greatly increases the cost of operators doing evil. The mechanism also maintains a reasonable scale operator set, ensuring high system activity under the “1-of-n Honesty Node” assumption.

2. Accelerated Dispute Resolution

The use of multiple rounds of challenger rotation mechanism greatly shortens the challenge processing cycle and reduces the effective final time to less than 1 day.

3. Incentive-Aligned Challenge Economic Model

Successful challengers can receive a "fraud bounty" composed of a pledge for malicious proposers. This mechanism improves challenge participation rates and achieves economic incentive alignment between challenge behavior and operator risk of malicious operations.

**General Operator Model: Integrated Restructuring of Economy and

Architecture**

To implement the above mechanism, GOAT Network integrates and refactors the complex and separated role systems in BitVM2.

In the traditional BitVM2 architecture, the Rollup system includes a variety of roles, such as Sequencer, Challenger, Operator, and Committee Member. Due to the significant differences in responsibilities and costs of these roles, designing a fair and efficient Rollup economic model and incentive mechanism has become a challenging task.

The core innovation of GOAT Network lies in unifying these roles into a single identity - Universal Operator (Universal Operator (Author) and through role rotation mechanism, all participants take turns to assume different responsibilities at different times. All operators need to be pledged on L2, and each round will be assigned to a specific role, bringing the following four major advantages:

• Benefit and cost balance : The GOAT network ensures that revenue and expenditure are relatively balanced over the long term by rotating operators between profitable and high-cost roles, avoiding some operators from bearing high computing costs for a long time.
• Incentive mechanism alignment : The cross-subsidy mechanism between different roles smooths out earnings fluctuations, incentivizing operators to remain honest in any role.
• Lower the threshold for participation : Small and medium-sized nodes do not need to continue to assume high-cost roles, but can also easily participate to improve the degree of decentralization and openness of the system.
• Enhanced system resilience : Even if individual operators are disconnected, the system can still maintain operation through flexible role allocation, avoiding dependence on single points.

In summary, GOAT Network unifies the behavioral roles such as sorter, calculator, challenger, etc. into a role pool composed of pledge operators, and all operators take turns to assume responsibilities and are bound by the punishment mechanism. Proposers submit fraud status will be punished, and challengers fail to perform their duties or malicious challenges will be punished. This mechanism ensures that honest behavior is economically optimal, while preventing roles from being concentrated in specific individuals for a long time through a clear rotation mechanism, thereby reducing centralized risks.

**Protocol architecture overview: System closed loop built around general

operators**

This architecture not only covers the cross-chain in-and-out process of assets (Bridge-In & Bridge-Out), but also implements trusted submission of the sorter set, on-chain coordination of the challenge process, and efficient generation and verification of zk proofs. Here are the core components of the GOAT BitVM2 protocol architecture:

Universal Operator Model

In GOAT BitVM2, each general operator runs the same software and stakes BTC to qualify for participation. Through deterministic rotation or random mechanisms based on stake weights, these operators take turns to play the roles: Sequencer (responsible for block production), Prover (prover, generate zkSNARK proof), Publisher (Publisher, submit status data to L1), and Challenger (Challenger, used to challenge fraud status). Each operator will experience a role that is both profitable and cost-bearing, thereby avoiding role concentration and improving the system's fault tolerance through diversity.

Deposit and withdrawal process (Bridge-in and Bridge-out)

• Deposit : The user locks in BTC and obtains PegBTC on L2.
• Withdraw (Withdraw/Peg-out) : No need to rely on L1 to verify complex BitVM2 withdrawal scripts. Instead, GOAT adopts an atomic exchange mechanism (Atomic Swap) to directly complete the withdrawal process with the operator, while ensuring security and reliability in combination with anti-fraud protocols.

Sequencer Set Commitment

• The operator submits the Merkle Root of its public key collection through the OP_RETURN of the Bitcoin main chain.
• L2 uses Transaction Introspection to verify historical BTC status and match it with the sorter set on L1. This design does not require modification of Bitcoin consensus rules, but also achieves strong alignment with the native state of BTC.

Efficient dispute handling and zkMIPS performance support

To be able to implement Bitcoin’s native zkRollup, it must have an efficient fraud detection and dispute handling system. GOAT BitVM2 makes the following designs in challenging models and demonstrating performance:

Multi-Round Random Challenger Selection

When a challenger is needed (such as during the operator reimbursement process), the system will randomly select the challenger from all pledged nodes. If the challenger fails to challenge in time, the system will randomly select a new challenger to substitute. If the new challenger successfully recognizes the fraud and initiates a challenge, all previous challengers who fail to perform their duties will be punished (pled is confiscated). It is worth noting that anyone can challenge in any round, so the security of the “1-of-n honest participant” assumption remains.

In addition, the random role allocation and a fully penalized pledge mechanism effectively prevent bribery attacks, system extortion and malicious interference.

On-Chain and Off-Chain Execution

Most computing logic (such as ZKP generation, fraud verification, BitVM2 interaction scripts, etc.) is executed in L2 and only the final result (status submission, challenge processing, confiscation operations, etc.) is uploaded to L1. This design significantly reduces on-chain Gas costs while ensuring verifiability of the entire system.

ZKP Performance Improvement: Self-developed zkMIPS

GOAT's self-developed zkMIPS is a zkVM compatible with the MIPS instruction set and is optimized for the STARK/SNARK backend. GOAT's prover achieves extremely cost-efficient by batch processing of multiple blocks and generating a unified proof periodically (such as per hour). In the challenge, you can also use BitVM2’s “truth-table” method to locate dispute locations to quickly resolve disputes.

Summarize

Comparing with original BitVM2: faster, more stable, more grounded

GOAT BitVM2 takes the Bitcoin network as the settlement layer and builds a decentralized sorter network as the computing layer. Under the assumption of "1-of-n Honest Participant", the plan successfully solved key issues in BitVM2 such as flexible amount withdrawal and insufficient challenger incentives. In order to accelerate optimistic verification, GOAT has introduced multiple rounds of challenge mechanisms, which has greatly improved the efficiency and effectiveness of fraud detection. In addition, combined with zkMIPS' ability to efficiently generate ZK proofs, GOAT BitVM2 has become the safest and most performant zkRollup protocol in the current Bitcoin ecosystem, and is expected to significantly accelerate the actual implementation of BitVM2 in the market.

Not only has made breakthroughs in technical architecture, GOAT BitVM2 has also built a powerful economic system based on general operator rotation . The system ensures that responsibilities such as sorter, prover, challenger, publisher, etc. are distributed fairly among all stakers. Through transaction fee sharing, fraudulent bounty and punishment mechanisms, the agreement encourages honest behavior and also imposes economic punishment on malicious behavior, thus creating a sustainable, fair and flexible decentralized ecosystem.

GOAT BitVM2, as the first truly implemented Bitcoin zkRollup protocol, implements:

• Native security and compatibility without hard forks
• Speedy challenge mechanism
• Economic incentive reconstruction
• Efficient zero-knowledge proof engine
• BitVM2 moves from theoretical model to engineering practice