What Is Citrea? A Beginner’s Guide to Bitcoin’s First ZK-Rollup

The Bitcoin ecosystem is set to expand with the expected launch of Citrea later in 2024. Citrea, which is being developed by Chainway Labs, is a new Layer 2 protocol that scales Bitcoin differently. 

Read on to learn more about Citrea and how it works. 

What is Citrea?

Citrea is a Layer 2 (L2) network that aims to scale Bitcoin with zkEVM, an EVM-equivalent virtual machine that uses zero-knowledge (ZK) rollups to verify transactions. 

The new Bitcoin L2 expands the capabilities of Bitcoin’s blockchain without changing the base layer’s consensus rules. According to the developers, it also allows building anything on this blockchain. 

Citrea plans to settle transactions on the Bitcoin base layer through the Bitcoin Virtual Machine (BitVM), a still-in-development computational engine that should enable more complex smart contracts on Bitcoin. Citrea takes all the data needed to transact on the rollup from the Bitcoin blockchain.

Orkun Mahir Kılıç and Murat Karademir, co-founders of Chainway Labs, announced Citrea in February 2024. The company also raised $2.7 million in a seed funding round that closed in 2023. Galaxy Ventures led the investment round, which included participation from Delphi Ventures, Figment Capital’s Managing Partner James Parillo, Taproot Wizards’ co-founder Eric Wall, Igor Barinov, the founder of Blockscout, and others. 

What Are ZK-Rollups? 

ZK-rollups, a scaling solution utilized by Layer 2 protocols, process and execute transactions off-chain, minimizing congestion on Layer 1 blockchains. Rollups batch multiple transactions into a single block and then generate a ZK proof, which is submitted to the base layer. 

ZK proofs demonstrate that the outcome achieved after bundling transactions is correct without revealing the non-essential details about those transactions.

ZK-rollups rely on a smart contract deployed on the Layer 1 blockchain to maintain their state. So, once a zero-knowledge proof is submitted to the main chain, the smart contract validates it before the final settlement.

How Does Citrea Work? 

Let’s take a look at the different components of Citrea’s operations.

zkEVM

Citrea utilizes a zkEVM, fully equivalent to the Ethereum Virtual Machine. That means it brings enhanced programmability, allowing developers to deploy complex smart contracts for their decentralized applications (dApps). 

The zkEVM is built using RISC Zero’s ZK infrastructure. RISC Zero is a software company focused on providing infrastructure and tools to help projects leverage zero-knowledge technology.

Citrea’s zkEVM uses ZK-rollups to “roll up” multiple transactions into batches before submitting them to the main chain for verification and settlement. Therefore, the zkEVM is the execution layer where Layer 2 transactions are processed. In the zkEVM environment, users can interact with a wide range of dApps, including DeFi applications

The design of Citrea aims to make VMs interoperable. Chainway Labs is currently researching multiple VM compatibility and interoperability.

Network Participants

Citrea has the following participants:

• Full nodes: Citrea’s full nodes host the complete transaction record on the Layer 2 network. They also verify zero-knowledge proofs and receive transactions from users bridging from L1 to L2.
• Sequencers: Sequencers receive bridging transactions from the full nodes, which they soft confirm to speed up the user transaction process. They are also responsible for producing blocks.
• Provers: Provers get the soft confirmed transactions from the sequencer and “roll them up” into batches. They then generate a ZK proof for the batch, enabling anyone to check its accuracy. Provers also produce state differences, the variance between the original and latest network status.
• Light nodes: These are nodes that can validate full-node responses with minimal storage and bandwidth requirements. They do this by using the state root accessed from the light client proof (a ZK proof generated during the peg-out process). Anyone running a Bitcoin light node (SPV) or a Bitcoin full node can act as a Citrea light node. The state root contains information about the transactions in a batch. 

Peg In Transactions

Citrea will utilize a BitVM-based two-way peg bridge called Clementine, which is still a work in progress. The bridge system consists of an operator and a verifier and allows users to “move” BTC from the base layer to the Layer 2 network. 

The bridge operator facilitates users’ peg-ins and peg-outs and covers withdrawals from L2 to L1. The verifier checks the validity of peg-in and peg-out transactions. 

When bridging from L1 to L2, a user sends BTC to the bridge operator. This BTC is held in a BitVM smart contract. The verifier then signs the peg-in transaction to approve the BTC deposit. The user is then required to submit a Simplified Payment Verification (SPV) proof of the transaction to a smart contract on Citrea. 

Once the smart contract receives the SPV proof, it mints an equivalent amount of cBTC, Citrea’s two-way peg token. cBTC is pegged to BTC at a ratio of 1:1.

Transaction Life Cycle

Once on Citrea, the user can interact with various dApps. Any transactions made while here are sent to the full node and then to the sequencer. The sequencer then sends the soft confirmed transactions to the prover. 

Multiple transactions are bundled at this stage, generating a state difference. The state difference,  or a special form where Citrea keeps the data, takes up less block space than full transactional data, reducing costs and optimizing storage space. 

Additionally, each transaction in a batch becomes cheaper as more transactions are added. As a result, the prover will keep collecting more transactions until the cost of producing a zero-knowledge proof for the batch is at an optimal level. While the prover is producing ZK proofs, the sequencer inscribes the Merkle root of the batch to the base layer every ten minutes. The Merkle root is a summary of the transactions in a batch.

Peg Out Transactions

To peg out (move from L2 to L1), a user submits a withdrawal transaction to the Citrea full node and sends their Bitcoin address and cBTC to a smart contract, where the token is burned. 

This triggers the Citrea transaction life cycle, which results in the production of a light client ZK proof with a withdrawal root. The proof is inscribed on Bitcoin, verified using BitVM, and then finalized. If the proof is incorrect, the BitVM verifier challenges it using a fraud-proof. Just like optimistic rollups, BitVM uses fraud proofs to identify invalid transactions. 

The bridge operator covers the withdrawal from its own pocket and later claims the withdrawn BTC from BitVM using an SPV proof. 

Citrea’s Vision for Bitcoin

Citrea wants to make Bitcoin “the foundation for the world’s finance.” 

To achieve this, the Layer 2 protocol plans to scale Bitcoin with ZK-rollups and a programmable execution layer capable of hosting an array of various activities. This could boost participation in the Bitcoin network while giving miners an extra source of revenue.

Unlike other scaling solutions that use independent consensus mechanisms and different settlement layers, Citrea is using Bitcoin as its data availability, settlement, and verification layer, allowing users to benefit from Bitcoin’s core principles of decentralization, security, transparency, and censorship resistance. 

What’s Next for Citrea?

Chainway Labs aims to use the funds from the seed round to launch Citrea on the testnet in Q2 2024, followed by a mainnet Beta rollout in Q4 2024. 

As this development progresses, the company will also be researching how Citrea can integrate with the Lightning Network (LN) and trustless atomic swaps. This research aims to give users an alternative way to “peg out” from Citrea. Therefore, users can exit the Layer 2 protocol using trustless atomic swaps to Bitcoin or LN rather than using the two-way peg bridge.

Furthermore, Chainway Labs is researching compatibility and interoperability with different VMs where any VM can be implemented on the Layer 2 network. Other tasks on its research to-do list are a decentralized sequencer network and a volition model. 

If implemented, the former can help make sequencers trustless, while the latter will give users a choice to store transaction data on-chain or off-chain. The off-chain option will offer low fees and less security, while the on-chain choice comes with regular fees and Bitcoin’s full security.

Xverse: Your Gateway to Web3 Built on Bitcoin

Xverse is a Web3 wallet for the Bitcoin ecosystem that supports BTC, Ordinals, Runes, BRC-20, and Layer 2 protocols like Stacks. The Xverse team also plans to support other Layer 2s in the future. 

Wallet integration is facilitated by Sats Connect, an API that allows Bitcoin dApps to extract users’ wallet addresses and request that they sign transactions. Bitcoin L2 projects can use this guide to learn more Sats Connect. 

Download Xverse today to enter the exciting new world of Bitcoin Layers.