Tangerine Upgrade: BitVM Activation on Clementine & Core Protocol Upgrades

Today, we’re introducing Tangerine, the second ever Citrea testnet fork. This upgrade brings our most significant changes yet — across proving performance, protocol security, account abstraction, and developer tooling. Tangerine represents a feature-complete version of the Citrea’s state-transition-function, meaning future upgrades will likely consist only of bug fixes, code refactors, and improvements. This marks a significant step toward our mainnet launch.

But most notably, Tangerine activates full BitVM support in Clementine — a major milestone in our effort to make Bitcoin programmable. This milestone marks the first time Bitcoin has been tested for optimistically verifying a fully programmable layer.

BitVM in Clementine: A New Era for BTC Bridges

With the Tangerine upgrade, Clementine now supports full BitVM flow in its codebase, integrating contributions from the BitVM Alliance and Citrea’s own solutions to implementing BitVM into a bridge design.

This includes:

• A clean integration of the BitVM, enabling single-round fraud proofs for Citrea settlement on Bitcoin
• A production-ready environment to test BitVM-based two-way peg mechanism
• Clementine-specific improvements over the original BitVM2 design, such as improved and secure Bitcoin Light Client design and capital efficiency of operators

Clementine's whitepaper, published last week, documents how Citrea implements BitVM into a Bitcoin bridge design. The whitepaper explains Citrea's novel solutions to two main research topics in BitVM-based bridge implementation, namely Bitcoin chain fork selection and capital efficiency of operators.

• Bitcoin Chain Fork Selection: This is related to ensuring that the bridge follows the longest Bitcoin chain and its security depends on a Bitcoin Light Client Design. Citrea introduces a new Bitcoin Light Client design that uses succinct Header Chain Proofs of Bitcoin. These proofs are aggregated by operators into a single BitVM proof.
• Capital Efficiency of Operators: This has been another limitation of implementing BitVM efficiently into a bridge design. With Citrea’s approach to non-standard Bitcoin transactions, operators can now process hundreds of withdrawals in parallel with a single collateral. Disproving only one withdrawal is enough to stop other malicious withdrawal processes.

Read Clementine whitepaper for a detailed explanation.

The activation of BitVM in Clementine is expected to occur a few days after the Tangerine fork, primarily because the light client proofs need to sync the chain before BitVM-enabled withdrawals can be safely activated.

Removing Backwards Compatibility from Codebase: Cleaner Codebase for Reviewers

With Tangerine, we’ve taken the opportunity to remove backwards compatibility from the codebase. This allowed us to adopt cleaner and more modern libraries and architectural patterns.

As part of this, we intentionally replayed the chain using the latest codebase, which results in a new state root that diverges from pre-Tangerine blocks.

Since this is a testnet and BitVM is just being deployed, this change will not cause any sync issues for node runners who follow the official upgrade guidelines.

This shift makes it easier for us to:

• Audit the codebase
• Avoid legacy edge cases
• Ship new features with higher confidence

It’s a reset that prepares Citrea for broader use — with less baggage, and more clarity.

Increased Block Gas Limit: Giving Applications More Room Per Block

As part of the Tangerine upgrade, we’ve increased the block gas limit from 8 million to 10 million.

This gives applications more room per block, especially helpful for:

• Complex contract deployments
• High-throughput use cases
• Testing scalability features ahead of mainnet

Combined with other optimizations in Tangerine, this sets the stage for more ambitious use cases on Citrea.

Proving Pipeline: Rewritten for Performance

We’ve completed a full rewrite of Citrea’s batch proof and light client proof systems. The changes are significant:

• ~50% reduction in cycle counts for batch proofs, enabled by internal optimizations and the upgrade to RISC Zero v2.
• Constant-sized light client proofs, making them more scalable and easier to verify inside the bridge circuit.
• Finality redefined: a sequencer commitment now directly implies finalization at the light client level.

These improvements make Citrea’s core ZK architecture faster, lighter, and closer to production-readiness.

Schnorr & p256r1 Precompiles: Expanding the Design Space for ₿apps

We’ve added two new signature verification precompiles:

• Schnorr signature verification — native to Bitcoin and used widely across Taproot wallets
• p256r1 (NIST P-256) — used in secure enclaves and traditional financial systems

These additions expand the design space for wallets, bridges, and account-abstraction (AA) contracts, particularly for apps interfacing with both Bitcoin and external signing standards.

Account Abstraction: Ready for Pectra

Tangerine brings support for EIP-7702, the successor to EIP-3074, expected in Ethereum’s upcoming Pectra upgrade.

This makes Citrea one of the first ZK rollups — on any chain — to integrate 7702, aligning with Ethereum’s evolving AA stack.

System Transactions: Re-architected

We rewrote the system transaction pipeline from scratch:

• System txs are now modular and extensible, enabling features like free withdrawals in the near future
• Fixed a subtle bug where a sequencer and prover could collaboratively advance the L2 state to a non-existent L1 block

This makes the protocol more robust — and opens the door to custom infra-level operations via system transactions.

Storage Layer Rewrite: Smaller DA Consumption

We’ve refactored the storage system to produce smaller state diffs, reducing the proving and execution cost of common transactions.

This upgrade is especially impactful for apps with frequent storage updates, like rollup bridges, oracles, or on-chain orderbooks.

New Debug RPCs: Improving the DevEx

Citrea’s RPC now supports:

• debug_traceCall
• All debug_trace* methods with JS-based tracers

This brings Citrea one step closer to full tooling parity with Ethereum, improving the dev experience for smart contract developers.

Wrap Up

Tangerine is the most foundational upgrade since Citrea’s inception — activating full BitVM support in Clementine, rewriting the proving system, and laying the groundwork for more flexible system logic.

You can explore the new APIs, start testing full Clementine flow, or start experimenting with EIP-7702 wallets on testnet today.

Upgrade your node. Say hi to Tangerine!

When Will Tangerine Be Activated on Testnet?

The maintainers have been working diligently on Testnet since the Kumquat upgrade. As of last week, all tests were passing, and the testnet was successfully upgraded. 

Please join our Discord to stay updated!