Citrea's BitVM-Based Bitcoin Bridge - Clementine's Latest Design

About a year ago, Citrea proposed one of the first Bitcoin bridge designs using BitVM. Citrea's native Bitcoin bridge, named Clementine, enables Citrea to inherit validity from Bitcoin, therefore the safest and most trust-minimized way to use BTC in decentralized finance. Clementine ensures the validity of state transitions on Citrea by optimistically verifying zero-knowledge proofs on Bitcoin. In addition to verifying these state transitions, Clementine also manages peg-ins and peg-outs to Citrea in a trust-minimized manner.

A Brief Overview of Clementine's Latest Design

Clementine's original design was based on BitVM 1. However, the complexities and inefficiencies of BitVM 1 led researchers to improve its design and introduce a novel variant, BitVM2. With BitVM2, Clementine’s design has been significantly improved, eliminating the complexities around verification logic and simplifying the peg-in and peg-out processes.

Clementine's latest design introduces three distinct roles to manage peg-ins and peg-outs: signers, operators, and watchtowers.

Change 1: Replacing Verifiers with Signers and Watchtowers

The new Clementine design replaces verifiers with two distinct roles: signers and watchtowers. Previously, verifiers were responsible for both handling peg-ins and challenging malicious operators. In the new Clementine design, these responsibilities have been separated:

• Signers form an N-of-N multisig to manage peg-ins.
• Watchtowers are tasked with monitoring operators and challenging any malicious behavior. Watchtowers are incentivized to disprove malicious operators.
• Operators, a group of profit-seeking entities, temporarily cover users’ withdrawals and are later reimbursed through a structured process.

Change 2: Decreasing Finality to 2 Weeks

In the old Clementine design, disproving relied on an interactive challenge-response scheme, which delayed finality since each party had a week to respond. New Clementine design eliminates this interactive process, allowing disproving with a single transaction, significantly reducing finality time.

Change 3: Anyone Can Disprove ZK Proof After a Watchtower Challenge

Old Clementine design’s disproving logic allowed only a limited set of verifiers to disprove, as the finality could have been delayed by a malicious verifier. Eliminating the interactive challenge-response scheme also eliminates this problem, allowing anyone to disprove a zero-knowledge proof after Watchtower challenges.

Conclusion and Further Reading on Clementine

Clementine's new design reduces the complexity around the disproving logic and simplifies the peg-in and peg-out processes. This new version focuses on being more efficient without giving up on Bitcoin security. These improvements mark a significant step toward making BTC more accessible in decentralized finance.

Clementine's new design was recently published in Stanford Blockchain Review. Refer to the article for a detailed overview of the recent design.

Yusuf Ozmiş