Citrea’s Fee Mechanism: Bitcoin Security at Scale
Citrea’s core value proposition is to enable greater expressivity and increase the utility of Bitcoin blockspace without ever leaving Bitcoin. To achieve this, Citrea keeps data availability and verifiability on-chain, on Bitcoin. Consequently, Citrea inscribes its state changes to Bitcoin and generates a zero-knowledge proof that asserts the validity of those changes. However, inscribing every state change, i.e. transaction, to Bitcoin is not feasible due to high transaction costs and Bitcoin's limited blockspace. Instead, Citrea inscribes the state differences, storage slot differences between the initial and latest state of the given batch, to Bitcoin.
While the state difference approach allows Citrea’s state to be reconstructed from Bitcoin with minimal essential data, Citrea uniquely applies additional compression and discount techniques to enable users to transact with Bitcoin security at a fraction of the cost.
In this article, we explore how Citrea optimizes state differences and how it reflects the savings from the optimizations to users based on Citrea’s comprehensive statistical analysis.
Optimizing State Differences
Although the state difference approach allows Citrea to scale Bitcoin efficiently, further minimizing the size of these differences allows for even greater cost efficiency in Bitcoin blockspace usage.
One major optimization is the use of off-chain contracts. Citrea researchers identified that storing the full smart contract code on-chain was not necessary from a trust-assumption perspective. Before the Kumquat fork, full contract code was inscribed to Bitcoin, making contract deployment more expensive than it needed to be. The fork removed this requirement, by using the code_hash field instead of the code field. This improvement reduced the size of state differences and, consequently, lowered inscription costs, resulting in lower fees for users.
Another optimization is the compression of state differences. Citrea’s Prover uses Brotli compression techniques. Brotli is a highly efficient compression algorithm often used for web data compression. For a detailed explanation of the compression algorithms used in Citrea, refer here.
Discounting Transaction Fees
Citrea reflects the savings from previously mentioned compression techniques by applying a discount to each transaction. Discounting transaction fees estimates a transaction’s actual contribution to the cumulative state difference. This method ensures fairness in applying fees to transactions.
Transactions vary in complexity, from simply sending cBTC, performing swaps or providing liquidity. Each transaction type impacts different state slots (e.g., balance, storage, nonce) and, therefore, contributes differently to the cumulative state difference. While some only change balance, the others change balance, storage and nonce. So transactions affecting multiple slots naturally contribute more significantly. The goal of fee discounts is to accurately reflect these varying impacts. To achieve this, the Citrea team conducted a comprehensive statistical analysis to estimate each transaction’s true contribution to the cumulative state difference.
Three Components of Transaction Fees
A transaction, or state change, modifies at least one of the four slots of Citrea’s state: balance, nonce, codeHash, or storageHash. A fee is charged for each transaction to prevent spam and help cover the costs of inscribing state differences to Bitcoin. On Citrea, transaction fees consist of three components: the base fee, the priority fee, and L1 fee.
Base fee is the minimum amount of fee that users are required to pay in order to include their transaction to a Citrea block, priority fee is the amount users are willing to pay for faster inclusion, and L1 fee is to cover the cost of inscribing state differences to Bitcoin, as inscribing state differences to Bitcoin comes at a high cost due to its limited blockspace.
L1 fee of a transaction is calculated as (size of state difference x L1 fee rate) + L1 fee constant. Note that the state difference refers to the individual state difference of a transaction in this formula. The individual state difference refers to the change that a transaction causes in the state.
Notably, the cumulative state difference size is typically smaller than the sum of individual state differences, as only the difference between the initial and latest slot values is inscribed. Thus, a transaction’s true contribution to the cumulative state difference is often smaller than its individual difference. To address this, the Citrea team conducted a statistical analysis to estimate a transaction’s true contribution to the cumulative state difference, allowing for a discount on the L1 fee.
Calculating Uniqueness Ratio for Applying Discounts to Transaction Fees
To estimate the discount on the L1 fee, a uniqueness ratio is calculated for each slot based on historical Ethereum block data. The uniqueness ratio is defined as: Number of unique addresses that changed the slot / Total number of changes to the slot. The discount rate is then: 1 - Uniqueness Ratio.
For example, if there are 3 transactions in a Citrea block where user A sends funds to users B, C, and D, the uniqueness ratio for this block would be 4 / 6. The number 4 represents the unique addresses involved (A, B, C, and D), while 6 is the total number of changes. A’s balance changes 3 times (once for each transaction), and B, C, and D each have their balance change once, resulting in a total of 6 changes. The discount would then be calculated as: 1 - 4/6 = 1/3. To be more accurate in the compression rate, the Citrea team analyzed hundreds of blocks when calculating the rate.
After calculating the individual state difference, the discount for each state slot (address, balance, nonce, and storage) is applied. To calculate the discounted fee, each slot is multiplied by its discount rate.
To apply an additional discount to the L1 fee, another statistical analysis is performed to determine the discount from Brotli compression. Ethereum’s historical block data is used to calculate the Brotli compression rate, which is given by: (Compressed size / Uncompressed size) * 100. The resulting compression discount rate is then applied to the L1 fee, which gives the final L1 fee.
Conclusion
Citrea’s approach to scaling Bitcoin relies on using Bitcoin blockspace actively and effectively to increase its expressivity and throughput. The Citrea team and its researchers have combined their extensive research on Ethereum’s historical data, state-of-the-art compression techniques and state differences to build the most efficient ZK rollup on Bitcoin.
Our approach makes Citrea significantly cheaper than Bitcoin mainnet while enabling the Bitcoin network to support diverse on-chain applications and platforms. Citrea keeps the demand for Bitcoin within its network and ensures that users transact with Bitcoin security at a fraction of the cost.
On Bitcoin, For Bitcoin.
Yusuf Ozmiş & Tuğçe Smith
Join the community and follow us on X to be an early adopter. You don’t want to miss any updates from Citrea!
- Follow Twitter | X
- Join Discord