Why bring ZKPs to Bitcoin?

Since late 2023 there has been a surge of interest in bringing zero-knowledge proofs (ZKPs) to Bitcoin. For Ethereum, ZKPs are the hope for scalability. For Bitcoin, they are the enabler for complex and flexible smart contracts — something many thought was impossible. This is achieved by moving smart contract execution off-chain and relying on verification of ZKPs on-chain to preserve the benefits of a blockchain.

While Bitcoin communities including us are proud to achieve ZKP verifications on-chain, there is in fact an outstanding set of tricky questions that need to be answered, or at least discussed.

If Bitcoin can do what Ethereum can do, so what? Why do we need two blockchains that do the same thing? Are there any differences?

Of course, for a healthy market, it’s always better to have more than one option. There are also many people believing that Bitcoin is more secure than Ethereum due to its hash power, but surely there is no consensus on that. Any more convincing arguments?

Yes, there is a subtle difference between Bitcoin and Ethereum smart contracts. That is, Bitcoin is UTXO-based and Ethereum is account-based. To some extent, one can simulate the other. However, fundamentally, they can induce different use cases. The subtlety comes from the fact that in most use cases the difference can be by-passed at solution-design level.

An Ethereum smart contract is stored on-chain with a fixed account address and is expected to be called by multiple users or multiple times. On the other hand, a Bitcoin smart contract is expected to be called by one entity once. This is the defining nature of a UTXO-based blockchain: an unspent transaction output can only be spent once. For a Bitcoin smart contract to be called by multiple users or multiple times, new instances must be created based on published templates which may be customised as needed. Please see Figure 1 for illustration.

If we take these insights at face value, we can wave our hands and say that Bitcoin is better for one-time contracts and/or private contracts, while Ethereum is better for contracts that are intended for the public and/or used frequently. But this statement is nowhere near absolute. It gives a rough guideline when it comes to choosing which blockchain to build your smart contracts.

Taking peer-to-peer economy as an example, whether it is ride sharing, room renting or money lending, any interaction between two peers is different and is likely to be one-off. Bitcoin would be more situated for smart contracts in these use cases. On the other hand, ERC20 smart contracts that require interactions with many users and potentially other contracts may be better off on Ethereum.

There is a perception that Bitcoin is supposed to remain simple, like digital gold. In fact, when we submitted our academic paper about SNARK verification on Bitcoin for double-blind peer review, one of our reviewers made the same comment. This is a hard comment to respond to. After mulling it over, we realised that economic sustainability is the key to answering the challenge.

Securely maintaining Bitcoin is very costly and will get more expensive as technology advances. The miners are fully decentralised and governed by only one thing, economic incentive. Block rewards are halved every four years, and its contribution to the economic incentive is diminishing. They are essentially subsidies for a newly established industry. Any sustainable industry must be able to survive and thrive without subsidies. That puts all the pressure on transaction fees which are the other part of the economic incentive. The economic value of the transaction fees can be interpreted as fees in bitcoin multiplied by the price of bitcoin.

We think arguing that the price would go up is just wishful thinking. It might be the case, but if a miner invested so heavily to secure Bitcoin, they would expect to have a more sustainable business model that does not rely so much on the price of Bitcoin. Therefore, there must be enough fees in bitcoin to keep the economic incentive strong and the network secure. This implies better transaction services, or more specifically, scalability and functionality. Bringing complex and flexible smart contracts to Bitcoin can certainly help to achieve that.

We hope that we have answered the questions well enough to convince you that there is value in bringing ZKPs to Bitcoin. If not, we are happy to hear your arguments supporting or against it! 😊

research.enquiries@nchain.com