In 2023, Robin Linus, co-founder of blockchain infrastructure developer ZeroSync, proposed a scaling solution called BitVM. This solution aims to introduce smart contract-like programmability to the Bitcoin infrastructure network without changing the Bitcoin mainnet's consensus rules. Unlike many scaling approaches that require significant changes to the underlying protocol and result in slow development, BitVM leverages optimistic mechanisms and fraud proofs to convert arbitrary computations into a form verifiable by Bitcoin Script, thereby enabling Turing-complete computation on the Bitcoin infrastructure network with minimal changes.
With the rapid growth of BitVM's community and developer attention in recent years, especially after the release of BitVM2, the Layer 2 ecosystem built around it has gradually emerged, further promoting the development of financial applications within the Bitcoin infrastructure ecosystem. GOAT Network, in particular, has built Bitcoin's ZK Rollup based on BitVM2. By systematically optimizing the functions and roles of Operator nodes, it has overcome potential bottlenecks in BitVM2's security, fairness, and efficiency, and implemented a "real-time proof" mechanism within the Bitcoin ecosystem. Officially, GOAT BitVM2, the core component of the GOAT Network, can generate ZK proofs (zero-knowledge proofs) for Layer 2 blocks in approximately 2.6 seconds. This demonstrates that the GOAT Network has further broken through the limitations of scalability and verification efficiency within the BitVM theoretical framework, providing a viable foundation for supporting large-scale ecosystem applications and cross-chain verification.
So, how does BitVM actually operate? How does GOAT Network optimize BitVM? Besides BitVM, what key components does GOAT Network introduce, and what technological innovations does it achieve? This research report will explain each one.
Author: ShirleyLi
Cover: Logo from this project
Word count: Approximately 12,700+ words
background
Bitcoin was originally designed as a peer-to-peer electronic cash system, essentially a decentralized distributed ledger. Therefore, as a first-generation blockchain, it lacked complex contract functionality. However, as the Bitcoin infrastructure network expanded, this design became a bottleneck restricting the throughput and confirmation speed of the Bitcoin mainnet. Furthermore, due to the highly decentralized governance structure of the Bitcoin infrastructure network, network upgrades are extremely difficult and challenging for developers to implement. These factors, combined, have become the fundamental reason why the Bitcoin infrastructure network struggles to scale.
Against this backdrop, developers of the Bitcoin infrastructure network have attempted a series of "roundabout" expansion plans, attempting to improve network processing capabilities, reduce interaction costs, and empower the Bitcoin infrastructure network with smart contract capabilities without directly changing the Bitcoin mainnet.
For example, the Lightning Network proposes state channels, which establish a bidirectional payment channel between two nodes to facilitate multiple off-chain transactions with a single on-chain settlement. This provides a fast path for small, high-frequency transactions. RGB, on the other hand, uses a client-side verification model, attempting to reduce the cost of verifying global data by having each participating node verify only its own data. However, these solutions face several limitations: the Lightning Network's application scenarios are relatively narrow; and RGB, which began development in 2019 but only officially launched its mainnet in August of this year, has significantly slowed its deployment.
In January 2023, the Ordinals protocol emerged, ushering in a major explosion in the Bitcoin ecosystem and spawning a large number of emerging Layer 2s. Inspired by the Rollups model in the Ethereum ecosystem, developers began to explore how to better introduce this model into the Bitcoin ecosystem.
From a core perspective, the Rollup design concept is to execute transactions outside the Ethereum mainchain and submit the execution results and related data to the mainchain. This approach significantly reduces the computational burden on the mainchain while ensuring security. Based on the submission method, the current mainstream Rollups can be divided into two types: Optimistic Rollup and ZK Rollup. Optimistic Rollup assumes all transactions are trustworthy and submits them directly to the Ethereum mainnet in batches, but it reserves a window for anyone to question or challenge the submitted data. ZK Rollup, on the other hand, submits a "validity proof" to all validators simultaneously with the data submitted to the mainnet.
However, due to the significant computational overhead required to generate ZK proofs, ZK Rollup struggled to gain widespread adoption within the Ethereum ecosystem for a long time. However, with the maturity of ZK infrastructure, ZK Rollups have begun to be implemented at an accelerated pace, ushering in a new era for Ethereum's scalability ecosystem.
At the same time, within the Bitcoin infrastructure network, BitVM, a key computational paradigm, was proposed. Its core value lies in its ability to indirectly verify the logic of complex applications on the Bitcoin infrastructure network's mainnet through a specific verification mechanism within the network's limited scripting system. This means that BitVM can introduce even more powerful computational verification capabilities to the Bitcoin infrastructure network, precisely addressing the computational verification needs of ZK Rollup. In particular, following the release of the BitVM3 whitepaper in July 2025, BitVM3 significantly reduces the transaction costs of the entire verification process by significantly reducing the size of on-chain transactions involved, making it more economically feasible and thus creating the prerequisites for implementing complex computational verification within the Bitcoin network.
How does GOAT Network introduce ZK Rollup to the Bitcoin infrastructure network ?
As mentioned earlier, Rollups are currently the most popular Layer 2 solution on Ethereum. Therefore, both Optimisic Rollup and ZK Rollup were originally designed for Ethereum scaling. However, due to the simplicity of Bitcoin's infrastructure network scripts, it is difficult to directly support ZK proof verification, and the high cost of direct on-chain verification. Therefore, building Rollups, especially ZK Rollups, on the Bitcoin infrastructure network is much more difficult to implement than on Ethereum. So, can the Rollups model be introduced to the Bitcoin infrastructure network? And how can computation results and data be submitted to the Bitcoin mainnet for verification?
GOAT Network offers a solution for implementing ZK Rollup on the Bitcoin network. By combining ZKM, BitVM2, and a decentralized sequencer, the network builds a ZK Rollup within Bitcoin's infrastructure, aiming to create a faster and more universal user experience by expanding Bitcoin's functionality.
According to official disclosures, Kevin Liu, a core contributor to the GOAT Network, is also the founder of Ethereum's Layer 2 Metis. Metis is an Ethereum Hybrid Rollup that combines the advantages of Optimistic Rollup and ZK Rollup to achieve high throughput and fast interaction capabilities.
In order to introduce the ZK proof mechanism into the Optimistic Rollup architecture and enable them to be transformed into Hybrid Rollups, the Metis Foundation incubated the zkVM framework - ZKM in July 2023. Its original intention was to be able to integrate ZK proofs into its Optimistic Rollup model, so that developers can use ZK proofs to confirm the final state and further improve the efficiency of cross-chain settlement. However, as development progressed, ZKM was no longer limited to the positioning of a single virtual machine, but gradually developed into a general ZK infrastructure. Among them, the zkMIPS (now renamed Ziren) launched by the team has become the core of its general proof system, dedicated to enabling different chains to interact in a unified ZK verification environment. Therefore, the team believes that the universality of ZKM can also help build a universal settlement network that is independent of virtual machines and can support all blockchains, and Bitcoin should also be included in this multi-chain system. [1]
Therefore, based on the underlying verification provided by ZKM, GOAT Network began to explore how to build a feasible ZK Rollup on the Bitcoin infrastructure network.
According to official disclosures, GOAT Network has now achieved real-time ZK proof generation in a production environment. This means that GOAT Network will be able to quickly generate verification proofs while packaging transactions.
In terms of implementation, in addition to utilizing the ZKM virtual machine Ziren as scalability infrastructure, the GOAT Network also deeply integrates with BitVM2, enabling ZK proofs to be written into Bitcoin scripts and verified on-chain, inheriting the security of the Bitcoin infrastructure network. Furthermore, through a decentralized sorter protocol, the GOAT Network will enable cross-chain messages to reach consensus between the Bitcoin infrastructure network and the GOAT Network, uniquely eliminating reliance on a single centralized node.
Next, we will analyze these components one by one and deeply analyze the operating logic of GOAT Network.
GOAT Network's technical path
Theoretical basis of GOAT Network — BitVM
BitVM is a scaling solution proposed in 2023 by Robin Linus, co-founder of blockchain infrastructure developer ZeroSync. Its goal is to introduce programmable capabilities similar to smart contracts to the Bitcoin infrastructure network without changing the consensus rules of the Bitcoin infrastructure network.
Unlike Ethereum's account model, the Bitcoin network infrastructure is built on a UTXO (Unspent Transaction Output) model. Bitcoin's script is essentially a simple conditional verification mechanism specifically designed to specify the conditions for spending UTXOs. Therefore, the expressive power of Bitcoin's script is very limited. Furthermore, once a UTXO is spent, the complete script conditions are also publicly disclosed, resulting in a lack of privacy in the spending process.
In 2021, the Bitcoin infrastructure network introduced a new transaction type, Pay-to-Taproot (P2TR), through the Taproot upgrade. One of the core mechanisms used by this transaction type is MAST (Merkelized Abstract Syntax Tree). The MAST mechanism allows the execution conditions in complex scripts to be split and woven into a Merkle tree. When spending UTXO, only the branches that are actually executed and the relevant proofs are published, without exposing the entire script. This approach not only improves the privacy of UTXO transactions, but also enhances execution efficiency. Developers can therefore write more complex scripts (such as multi-signature mechanisms, spending height, etc.). At the same time, since only the script branches that are actually executed need to be disclosed, the amount of data that needs to be uploaded to the chain is also significantly reduced.
BitVM utilizes the MAST mechanism, attempting to represent complex program logic in the form of a Merkle tree. Drawing on the concept of fraud proofs, it designates two roles: the prover and the verifier. The prover is responsible for executing the program's computation off-chain and asserting the correctness of its results, while the verifier is responsible for verifying the prover's results and challenging any disputed data. To ensure computational credibility, the prover compiles the program into a circuit consisting of logical operations and then maps this entire circuit into a massive Taproot MAST. Each logic gate corresponds to a leaf script in the Merkle tree. It's important to note that this mapping isn't an actual execution, but rather a "commitment" to the program's logic. The prover then generates a P2TR UTXO from the root of this tree, locks a deposit into it as a guarantee of their commitment, and then executes the entire program computation off-chain.
In the initial design of BitVM, only a fixed set of validators could perform challenges. In addition, because interactive fraud proofs were used to locate the computations that caused the conflict, that is, to continuously narrow the scope of the problem through bisection, each challenge required a large number of on-chain interactions, which in turn caused the dispute to last for a long time. To solve the above problems, BitVM2 was proposed in 2024. This solution liberalized the challenge mechanism, allowing any user with a Bitcoin full node to initiate a challenge, and introduced SNARK (Succinct Non-interactive Argument of Knowledge) validators to reduce the number of challenge interaction rounds to 2-3, thereby improving verification efficiency. [2]
Specifically, BitVM2 is built on an optimistic mechanism. Assuming the prover's submitted computational results are honest and trustworthy, even if any verifier is allowed to initiate a challenge, as long as at least one of them is honest and can correctly compare the prover's submitted proof with the result, the prover's true behavior can be verified. Dishonest verifiers will be punished (their staked funds will be confiscated). This is the so-called 1-of-n honesty assumption.
To reduce the number of interaction rounds, BitVM2 utilizes a SNARK verifier to generate commitments for the entire computation process off-chain. However, due to limitations in Bitcoin Script, it cannot run the entire SNARK verification process in one go, as in Ethereum. Therefore, BitVM2 breaks the SNARK verifier into multiple subroutines, each of which is embedded in a leaf script of MAST. Therefore, in BitVM2's actual operation, the prover first generates a SNARK commitment offline, asserting that the computational results of the program they executed are correct. This SNARK commitment is then saved for future dispute resolution. If a verifier subsequently questions a particular computational step, they can directly challenge the verifier subroutine in a leaf, requesting that the prover disclose the corresponding inputs and outputs and then run the script on-chain for verification. If the prover fails to disclose the data within the agreed timeframe, or if the data disclosed is inconsistent with the actual data after the run, the verifier wins the prover's deposit. If no valid challenge is issued within the challenge period, the prover can ultimately recover their deposit.
Simply put, the original version of BitVM required gradually disclosing the entire computation process to the Bitcoin mainnet and navigating multiple rounds of interaction to locate disputed points, which resulted in lengthy verification times. BitVM2 addresses this issue by introducing an "optimistic execution + fraud proof" model. This model assumes computational results are correct by default, and only releases the disputed data on-chain when a challenge is initiated. This also compresses the number of verification interactions, improving verification efficiency.
Innovation based on BitVM——GOAT BitVM2
However, BitVM2 still has some shortcomings in its design, specifically:
- Because BitVM2 separates SNARK validators into the Taproot MAST structure, a single on-chain verification can only correspond to a specific computational step, rather than verifying the global validity of the entire state transition all at once like Ethereum does. Therefore, for the Bitcoin infrastructure network that adopts the "longest chain principle," if a malicious operator node submits a state commitment generated on a forked chain to the validator on BitVM2, BitVM2 theoretically will not check whether this state commitment originates from the "longest chain," creating a potential risk of a "double-spend attack."
- Although BitVM2 has improved verification efficiency by introducing SNARK verifiers, it is still based on the fraud proof mechanism and has a challenge cycle of 1-2 weeks. [2]
- To ensure the effectiveness of the challenge process, all participants are required to stake a certain amount of assets during the dispute period. However, due to the length of the dispute period, these staked funds are difficult to release quickly, which inadvertently increases the cost of participating nodes. Furthermore, if the challenge results do not reveal fraud (which is likely the norm), validators will face the situation of expending "labor" but receiving no "reward," further undermining the enthusiasm of challengers.
To address the above issues, GOAT Network has systematically optimized key issues such as security, challenge mechanism, and economic incentives by combining the verification architecture of BitVM2 and zkVM's support for the ZK proof mechanism, thereby promoting the implementation of the ZK Rollup solution on the Bitcoin infrastructure network.
Unlike Optimistic Rollup, the core feature of ZK Rollup is that it uses ZK proofs rather than fraud proofs. The prover needs to generate a ZK proof for each batch of transactions, and the verifier can directly verify the proof, thus avoiding lengthy interactive challenges.
Since BitVM2 has already integrated fraud proofs with SNARK verification, implementing a SNARK validator in a piecemeal manner, if the complete ZK proof verification logic for Rollup can be embedded into BitVM2's validator, enabling the Bitcoin infrastructure mainnet to directly confirm the validity of the ZK proof, it will be possible to support the ZK Rollup model on the Bitcoin infrastructure network. To this end, GOAT Network has optimized BitVM2 and developed GOAT BitVM2.
Optimizing cross-chain bridge mechanisms through GOAT Bridge
As mentioned earlier, BitVM2 is a computational framework capable of verifying the execution of complex logic on the Bitcoin infrastructure network. During operation, BitVM2 utilizes the Bitcoin mainnet as a settlement layer and, in the event of disputes, allows it to assume some of the responsibilities of the data availability layer. In other words, BitVM2 enables external systems to inherit the security of the Bitcoin infrastructure network while also facilitating interaction between Bitcoin infrastructure network assets and external networks. Therefore, based on BitVM2's verification capabilities in cross-chain scenarios, the BitVM2 cross-chain protocol was derived.
From an operational perspective, a cross-chain bridge connects the initiating and target chains. When assets "move" between the two chains, it's not a true cross-chain transfer; rather, it involves locking assets on one chain and releasing an equal amount on the other. For example, when a user locks a certain amount of mainnet assets on the Bitcoin infrastructure network, the BitVM2 cross-chain protocol maps an equal amount of wrapped assets on Layer 2. This process is called pegging. When the user wishes to unlock the locked assets from the Bitcoin infrastructure mainnet, the wrapped assets on Layer 2 are destroyed, and the corresponding assets on the Bitcoin infrastructure mainnet are released after verification. This process is also known as pegging out. Therefore, determining whether to release assets becomes a key mechanism for different bridging solutions.
Traditional bridging solutions typically rely on multi-signature mechanisms to confirm transactions, or deploy smart contracts on both the initiating and target chains, then have a group of staked nodes verify and execute cross-chain transactions. The BitVM2 cross-chain protocol, on the other hand, directly delegates the correctness of cross-chain transactions to BitVM2's verification mechanism, relying on a combination of SNARK validators and fraud proofs to facilitate the flow of assets between the Bitcoin mainnet and Layer 2. Therefore, the BitVM2 bridging protocol can be considered a "trust-minimized cross-chain bridge" solution.
During the cross-chain bridging process, BitVM2 designed three roles to ensure the security of the transmission process: Operator nodes (corresponding to the prover in BitVM), Verifier nodes (corresponding to the verifier in BitVM), and the Committee. Operator nodes are responsible for executing the work, requiring a stake and a commitment to honestly execute the SNARK verifier. During a peg-out, they submit the SNARK verifier's output to the Bitcoin mainnet as the claimed computation result. Verifier nodes are then responsible for challenging the Operator node's computation result. The Committee assists in signing transactions as an additional security measure.
Based on the cross-chain logic of BitVM2, GOAT Bridge has made some adjustments.
First, the Peg-out process on BitVM2 must be initiated by the user. On the GOAT Bridge, when a user intends to destroy their wrapped assets, the Operator node simultaneously initiates a payment of an equivalent amount of mainnet assets on the Bitcoin infrastructure mainnet. This process is subject to BitVM2's verification logic. If verification passes, the user receives the corresponding Bitcoin infrastructure mainnet assets, and their wrapped assets are destroyed. If verification fails, both transactions are rolled back. This mechanism allows Operator nodes to aggregate and liquidate multiple small Peg-outs, reducing execution costs, improving cross-chain efficiency, and optimizing the user experience.
Secondly, in order to prevent the Operator node from selecting a favorable set of sorters during the Peg-out phase, which would affect the transaction sorting and verification process, GOAT Bridge requires the committee to package and submit the public key list of the next set of sorters to the Bitcoin infrastructure mainnet in advance every two weeks, and broadcast it in the form of UTXO to achieve the purpose of public information.
Finally, the rewards obtained by the verification nodes after challenging the operator nodes will be pooled into a unified reward pool and distributed uniformly by the committee to maintain the sustainability of the incentive system.
Multi-round random challenge mechanism
To enhance the credibility of the verification process, BitVM2 introduces a challenge mechanism. However, if multiple people simultaneously challenge the same computation, this not only wastes resources but also slows down verification efficiency. Furthermore, if the Operator node remains free of fraudulent activity during multiple rounds of challenges, the Verifier node faces the problem of incurring costs but receiving no incentives. Therefore, GOAT BitVM2 introduces a multi-round randomized challenge mechanism to optimize this process.
Specifically, GOAT BitVM2 breaks down the 1-2 week challenge period found in traditional Optimistic Rollup. During this period, a group of validators are randomly selected and challenged in several rounds, with only one challenger in each round. For example, GOAT BitVM2 might select six validators (all of whom must stake a small amount of Bitcoin mainnet infrastructure assets), assign each a two-hour window, and require them to take turns validating. If a validator detects fraud during their round and submits a fraud proof, they are rewarded. If they fail to fulfill their responsibilities in the round, they are penalized.
The advantage of this mechanism is that it avoids the waste of resources caused by multiple nodes launching challenges simultaneously and improves verification efficiency. Furthermore, because validating nodes are randomly selected, this also invisibly improves the security of the verification process. According to official disclosures, GOAT BitVM2 uses this mechanism to shorten the challenge window to one day.
GOAT Network ’s Proof Engine — ZKM
In order to generate ZK proofs (zero-knowledge proofs) for Layer 2 blocks, GOAT Network used the virtual machine product of the ZKM team.
ZKM, a project incubated by the Metis Foundation in July 2023 and formerly known as Project M, initially aimed to introduce a zero-knowledge proof solution for hybrid Rollup architectures and build an open-source infrastructure layer for the Ethereum ecosystem. However, as development progressed, ZKM's relevance gradually evolved, moving beyond hybrid Rollup development to focus on creating a "cross-chain verification layer," enabling developers to use ZK proofs to uniformly verify execution results across different chains, thereby reducing reliance on centralized cross-chain bridges.
In June of this year, zkMIPS, the core virtual machine of ZKM, released version 1.0. It is dedicated to providing services for both the Ethereum and Bitcoin infrastructure networks, building a ZK Rollup infrastructure compatible with various chains. This further enhances the versatility of zkMIPS.
In terms of implementation, zkMIPS is a zkVM based on the MIPS32r2 instruction set architecture. The zkVM combines zero-knowledge proofs (ZK proofs) with a virtual machine (VM), offering more general features than the zkEVM. In other words, the zkVM not only supports smart contracts and cryptographic verification but can also run more general computational logic, extending its reach beyond the Ethereum ecosystem. Currently, teams such as Polygon and RISC Zero are advancing the development of the zkVM.
However, unlike the mainstream instruction set RISC-V used by RISC Zero, zkMIPS uses the MIPS32r2 instruction set. Before explaining this choice, let's first understand the relevant background of RISC-V.
RISC-V is an open source instruction set architecture (ISA) based on RISC principles. This instruction set originated in the field of Web2 computing and represents a set of instructions for general computing. The RISC-V instruction set includes instructions for performing operations and logic, for load and store operations, for jumps, and other different functions. Its basic instruction set has only more than 40 instructions, and even with the modular extension instructions, there are only dozens of them. Therefore, the RISC-V architecture has the characteristics of simplicity and flexibility, and is completely open source and highly versatile. [3]
However, this overly streamlined approach doesn't appear to be the best choice for zkMIPS, which aims to simultaneously serve the Bitcoin infrastructure. This is because, while RISC-V's basic instruction set is simple, implementing complex program logic requires numerous instructions, which in turn increases the size of the proof circuit and the cost of proof generation. MIP32r2, on the other hand, supports a richer instruction stream (implementing 62 instructions) and a more unified format, eliminating unnecessary steps. Furthermore, given that RISC-V is still in a state of continuous evolution, MIP32r2 is a better choice for zkMIPS that seeks long-term stability, cross-chain portability, and lower ZK proof generation costs.
In July of this year, the ZKM team further upgraded zkMIPS to the latest version, Ziren. This version significantly increases the speed of ZK proof generation through GPU acceleration and introduces a distributed node network to support parallel ZK proof generation.
Functionally, Ziren compiles programs developed in Rust or C (with support for Golang coming soon) into executable MIPS instructions, executes computations, and simultaneously generates ZK proofs to prove the correctness of the computations. For GOAT BitVM2, Ziren can generate ZK proofs for each state change in Layer 2 for each block produced. Operator nodes can aggregate these block-by-block proofs into a single SNARK proof and submit it to the Bitcoin mainnet when needed. According to the latest official data , Ziren can generate a ZK proof for a Layer 2 block in approximately 2.6 seconds, an Operator node can aggregate a batch of ZK proofs in approximately 2.7 seconds, and the time from proof aggregation to submission to the Bitcoin mainnet is approximately 10.38 seconds. These performance metrics clearly support the feasibility of real-time proof capabilities on the GOAT BitVM2 Beta testnet.
Decentralized sorting with the Universal Operator
So, how does GOAT Network submit data running on its network to the Bitcoin infrastructure network, thereby inheriting the security of the Bitcoin mainnet? This requires the use of GOAT Network’s decentralized sorter mechanism.
Because Layer 2 Rollups help the Layer 1 mainnet process transaction requests, they need to sort the transactions waiting in their network's Mempool to determine how to package them into blocks. Many early Rollups, including Arbitrum and Optimism, adopted a centralized approach to sorting, using a single official sorter and processing transactions on a first-come, first-served (FCFS) basis. This approach effectively maintains transaction order and efficiency, but carries the risk of centralization. A single sorter node going offline could cause the entire network to be unable to produce blocks for a short period of time.
Furthermore, how and by whom the sorting is performed often involves a competition for MEV. MEV (Maximal Extractable Value) is a behavioral concept related to economic interests. It refers to the process during block creation whereby nodes in a PoW network, or validators and block builders in a PoS network, extract value beyond the standard block reward and gas fees by including or excluding transactions within a block, altering the order of transactions within the block. Using a single sorter means that all MEV generated belongs to that sorter, which inadvertently reduces node profits.
To this end, the GOAT Network has expanded its challenger rotation mechanism to include all participating nodes in the entire network. In the actual operation of the GOAT Network, there are multiple roles, including Committee, Sequencer, Operator, Challenger, Watchtower (a type of challenger selected from the Sequencer candidate pool), and Relayer. These nodes have different divisions of labor, borne different costs, and enjoyed different benefits. For example, Operator nodes require much more computing power than other roles, while Sequencer nodes control MEV revenue.
To balance the power and cost pressures among nodes and mitigate the risk of centralization caused by a small number of certain node types, the GOAT Network introduces the concept of a Universal Operator. This unifies all roles and allows nodes to rotate through different responsibilities, thereby balancing costs and benefits across nodes and further motivating them. This means that nodes in the GOAT Network will not be fixed as either sorters or validators, but rather will rotate through roles. By design, Universal Operators require a stake before being randomly assigned to different roles on a round-by-round basis. However, the probability of a node being assigned a role is proportional to its staked share. For example, if a node's staked assets account for 5% of the total staking pool, it has a 5% chance of becoming a sorter node, a 5% chance of becoming an operator node, a 5% chance of becoming a challenger node, and so on. This allows nodes to rotate in both the cost of computing power and the benefits of the network.
However, this process can also present potential issues. For example, different operating nodes may have different hardware performance, resulting in different execution speeds. To address this issue, the GOAT Network has implemented a timeout mechanism. If a challenger or sorter node fails to complete its task on time, the system will directly switch to the next node and penalize the node that failed to complete its task in this round or forfeit the opportunity to take on the role next time.
Using EIP-1559 to reduce gas fees
In addition, GOAT Network has also made some optimizations to the Gas fee structure. The team is trying to reduce fees by utilizing the EIP-1559 mechanism.
EIP-1559 is an Ethereum improvement proposal proposed in 2019 to adjust the gas billing method, and was officially launched on August 5, 2021 as the core content of the London upgrade.
Before EIP-1559 was adopted, Ethereum's gas fee model was essentially an auction mechanism: Gas Price (how much the user is willing to pay for each unit of gas) × Gas Limit (the maximum amount of gas the user is willing to pay for the transaction; generally speaking, the actual amount consumed is less than this limit). [4] If the user offers a higher Gas Price, the node will prioritize packaging his order. As network congestion increases, users will need to continuously increase their gas fees. This will lead to extremely high fee volatility, making it difficult for users to predict the gas fees they should pay. For nodes, this volatility will also cause unfair competition and may even threaten the fairness and stability of the Ethereum network.
Therefore, EIP-1559 splits gas fees into two components: a base fee and a blocker tip, which is the fee structure currently used by the Ethereum network. The base fee is a mandatory fee paid by users, the amount of which is controlled by an algorithm and is directly burned to reduce the total amount of Ethereum network assets. The blocker tip, on the other hand, is an additional fee that users are willing to pay to expedite transaction processing. This approach makes gas fees more precise and controllable.
GOAT Network has introduced this model into its own Layer 2 network. The gas fee of this network also consists of two parts: the base fee and the block packer tip.
To ensure compatibility with Ethereum ecosystem tools, the GOAT Network directly adopts the EIP-1559 standard logic to calculate the base fee. Gas fees are expressed in Wei (Ethereum's smallest unit), but are converted to Bitcoin infrastructure network assets (BTC) for payment during the actual settlement process. However, the GOAT Network does not support EIP-4844 and therefore does not incur fees associated with using blobs. Furthermore, unlike the Ethereum network, the GOAT Network does not burn the base fee. Instead, it incorporates it into a unified reward pool and is subsequently redistributed to nodes as incentives.
summary
As can be seen, GOAT BitVM2, as the core execution system of GOAT Network, attempts to overcome the bottleneck problem of BitVM2 from three aspects:
1. Use a decentralized sequencer mechanism to reduce the risk of double-spending attacks by Operator nodes;
2. Improve verification efficiency by introducing the ZK proof mechanism, and introduce a multi-round random challenge mechanism in the challenge phase to increase the cost of malicious behavior by the challenger;
3. Optimize the incentive strategy for participating nodes through the design of Universal Operator.
Overall, the GOAT Network, a Layer 2 scaling solution for the Bitcoin infrastructure network, combines BitVM2 and ZKM to address challenges in verifying program computational logic within the Bitcoin infrastructure network, enabling cross-chain interactions, and generating ZK proofs. This approach not only maintains compatibility with the Ethereum EVM at the development level, but also inherits the security of the Bitcoin mainnet. GOAT Network also leverages a universal operator mechanism to distribute node costs and stake, uniquely implementing a decentralized ranking mechanism and striking a balance between efficiency and decentralization. Furthermore, the GOAT Network optimizes its gas mechanism by introducing the EIP-1559 model, fostering sustainable competition for nodes.
Notably, the BitVM3 whitepaper was officially released in July of this year. Building on BitVM2, it significantly optimizes performance and efficiency, moving the entire verification process, which previously required on-chain, off-chain, minimizing the amount of disputed data stored on-chain. Specifically, in BitVM2, verifying a SNARK proof typically required constructing a transaction of approximately 4MB. With BitVM3's optimizations, this data size has been compressed to the KB level, reducing dispute costs by nearly 1,000 times. This also significantly reduces the cost of node staking. This means that with BitVM3, the amount of data required to be on-chain will be even smaller, dispute costs will be lower, and the verification efficiency of ZK proofs will be significantly improved. This makes it practical to build ZK Rollup on the Bitcoin infrastructure network. It can be said that the emergence of BitVM3 will have even more far-reaching significance.
According to official disclosures, the GOAT Network has optimized and implemented BitVM3, advancing it from an "experimental concept" to a "deployable" stage. This move not only improves verification efficiency but also further advances the practical application of BitVM technology. If the Rollup built on BitVM2 still carries a certain element of optimism, then the implementation of support for BitVM3 signifies that the GOAT Network is gradually transitioning to a true ZK Rollup architecture.
GOAT Network's product progress and ecological development
To achieve efficient interoperability between the Bitcoin infrastructure network and the GOAT Network, the GOAT Network's Testnet3 Beta was officially launched on July 31, 2025. This launch also officially marks the realization of the GOAT Network's vision of supporting "real-time proof" Bitcoin ZK Rollup. This also means that with the GOAT Network, users no longer have to endure lengthy challenge cycles, but can complete verification promptly, resulting in a smooth user experience.
According to the latest data as of September 15, 2025, Testnet3 Beta has produced over 7.3 million blocks. The average time for generating ZK proofs for the last six blocks was approximately 2.17 seconds, the aggregation of the last six proofs took approximately 2.67 seconds, and the most recent SNARK proof took approximately 9.71 seconds. This shows that Testnet3 Beta has stabilized at a relatively fast speed during its current operational phase.
The author reminds you that this article is only intended to help readers understand the technical principles and formation of GOAT Network, and aims to promote the compliant development of Web3 and the blockchain industry. It does not constitute any proposal or offer. Please be aware that the issuance and investment of tokens are subject to regulatory requirements and restrictions of varying degrees of strictness in different countries and regions. In particular, the issuance of tokens in mainland China is suspected of "illegal issuance of securities" (readers in mainland China are strongly recommended to read the " Compilation and Key Summary of Laws and Regulations Related to Blockchain and Virtual Currency in Mainland China "). Therefore, please do not make any decisions based on this information, and please strictly abide by the laws and regulations of your country and region.
As of September 15, 2025, GOAT Network has officially announced 66 ecosystem partners, covering a variety of areas, including DeFi, infrastructure, cross-chain bridges, and blockchain gaming. Among them, global node infrastructure provider RockX, blockchain infrastructure company BenMo, and Hashkey Cloud, a cloud infrastructure service under HashKey Group, are the GOAT Network's currently disclosed collaborating sequencer node operators, responsible for supporting transaction ordering, block generation, and the execution and verification of ZK proofs within the GOAT Network.
Potential challenges facing GOAT Network at the product level
However, building ZK Rollup on the Bitcoin infrastructure network is still in the exploratory stage, and GOAT Network will face some potential risks and challenges.
For example, to ensure the normal operation of the system, the GOAT Network's node rotation policy stipulates that when a node times out, the system automatically switches to the next node. However, nodes in the network need to rotate in different node roles, especially Operator nodes, which implicitly places high demands on their computing performance. Although the losses suffered by nodes during their Operator rounds can be compensated by serving as Sorter nodes, which have lower computing power requirements and relatively higher incentives, thus balancing the benefits to a certain extent, over the long-term operation of the system, nodes will still form a "survival of the fittest" trend, and ultimately, only high-performance nodes may remain.
Furthermore, the GOAT Network relies heavily on BitVM to support smart contracts within the Bitcoin infrastructure network. However, BitVM itself is still undergoing ongoing optimization, and its performance and stability are subject to uncertainty, all of which could have a direct impact on the GOAT Network.
Furthermore, GOAT Network isn't the only Layer 2 platform built on BitVM in the current market; there are other direct competitors. Furthermore, BitVM isn't the only provider of smart contract support for Bitcoin's infrastructure network, meaning GOAT Network may face intense competition in its future development.
Horizontal comparison of GOAT Network and other scaling solutions
As mentioned earlier, with the launch and development of BitVM, in addition to GOAT Network, more projects are embarking on the same development path. These include: Citrea, Alpen, Hemi Network, and others. So, what exactly is the difference between these projects and GOAT Network?
Citrea is a Bitcoin ZK Rollup network that uses the BitVM mechanism for optimistic validation on the Bitcoin infrastructure network and anchors its Layer 2 state to the Bitcoin mainnet. Citrea uses the RISC Zero virtual machine for EVM compatibility, with plans to add support for additional virtual machines. Furthermore, Citrea incorporates multiple sorter nodes for decentralization.
Alpen is an EVM-compatible ZK Rollup built on the Bitcoin infrastructure network as its settlement layer. It utilizes the Bitcoin mainnet as the foundational layer for storing state commitments and valid state transition proofs. To enable cross-chain transfers between the Bitcoin infrastructure network and the Aplen network, the Aplen team has launched the Bitcoin bridge protocol, Strata Bridge, which also leverages the verification and dispute resolution mechanisms of BitVM2. The Aplen team is also developing validators based on optimistic mechanisms to achieve a balance between performance and security in various application scenarios.
The Hemi Network is a modular Layer 2 network. It seeks to integrate the Bitcoin and Ethereum infrastructure networks into a unified network, allowing users and developers to inherit the security of the Bitcoin infrastructure network while leveraging the smart contract capabilities of the Ethereum network. Hemi Network has developed its own hVM virtual machine based on the EVM, attempting to integrate a complete Bitcoin infrastructure network node directly into the EVM, enabling access to Bitcoin infrastructure network data. According to the official Hemi Network plan, the team will introduce the BitVM mechanism to use ZKP to prove the status of the Bitcoin infrastructure network, the Ethereum infrastructure network, and the Hemi Network.
| project | Product Positioning | Whether to introduce BitVM | Current core mechanics | Development Progress |
| Citrea | Bitcoin ZK Rollup | yes | Using its bridge developed based on BitVM, it is committed to making Bitcoin a settlement layer | Mainnet launch coming soon |
| Aplen | EVM-compatible Bitcoin ZK Rollup | yes | Use Strata Bridge to achieve transmission between the Bitcoin network and the Alpen network, and build it into the ZK settlement layer of the Bitcoin network | In April this year, the public beta was launched |
| Hemi Network | Modular Layer 2 | Introducing | Integrate a complete Bitcoin infrastructure network node directly into the EVM, giving it the ability to access Bitcoin infrastructure network data | In March this year, the main network was launched |
| GOAT Network | Bitcoin ZK Rollup | yes | By leveraging BitVM2, ZKM, and a decentralized sorter mechanism, the real-time generation of ZK proofs is achieved. | In July this year, the testnet Testnet3 Beta was officially launched |
As can be seen, while all of the aforementioned projects have introduced or are in the process of introducing the BitVM mechanism, Aplen and Citrea, similar to GOAT Network, clearly define themselves as Bitcoin ZK Rollup. However, Aplen, Citrea, and GOAT Network differ in their positioning: Aplen and Citrea primarily use cross-chain bridges to anchor Layer 2 state changes to the Bitcoin mainnet, thereby leveraging the Bitcoin infrastructure network's role as a data availability and settlement layer. In other words, their focus is on anchoring Layer 2 state changes to the Bitcoin mainnet, achieving the security and verifiability inherent in the Bitcoin network. GOAT Network, however, emphasizes the ability to generate ZK proofs in real time, striving to demonstrate the practical usability of ZK Rollup on the Bitcoin infrastructure network by improving network performance. Therefore, Aplen, Citrea, and GOAT Network will pursue different product paths in the future.
Future Outlook
Essentially, GOAT Network's core goal in building Bitcoin ZK Rollup is to further unlock the value of Bitcoin's infrastructure network ecosystem and inject more room for innovation. While global blockchain-related policies have recently become more inclusive, the compliance and regulatory strategies for distributed finance products remain unclear. Against this backdrop, GOAT Network must ensure its development complies with future regulatory frameworks while continuously advancing technological innovation.
Notably, in April of this year, Vitalik Buterin proposed the possibility of using RISC-V to replace the EVM (Ethereum Virtual Machine) in his article "Long-term L1 execution layer proposal: replace the EVM with RISC-V ." This suggests a major transformation for Ethereum—a complete reconstruction of its core computing layer, with the ZK proof system poised to become its core computing framework. This presents both an opportunity and a challenge for GOAT Network. This is because the ZKM currently used by GOAT Network is not based on the RISC-V instruction set, raising questions about whether it will face compatibility barriers during future cross-chain ecosystem integration. However, GOAT Network's strategy of investing in ZK technology within the Bitcoin ecosystem is expected to align with this trend.
Furthermore, the Ethereum Foundation recently proposed a "real-time proof" standard to the zkEVM team. This standard specifies parameters such as mainnet block latency, node cost, and proof size, aiming to enhance the feasibility and efficiency of ZK technology on the mainnet. For example, the standard stipulates that proof size must be kept below 300KB, and the initial cost of node hardware must not exceed $100,000. This closely aligns with the optimization goals of BitVM3: compressing the size of data required to be on-chain during the verification process and reducing interaction costs. Therefore, the GOAT Network's exploration of a "real-time proof" mechanism on the Bitcoin infrastructure network not only aligns with Ethereum's technological evolution path, but also demonstrates the potential of ZK technology within the Bitcoin infrastructure network ecosystem, while also meeting the needs of mainstream application developers for efficient interaction. Given this trend, whether the GOAT Network can unleash its greater potential and value in the future is worthy of continued attention and anticipation.
References
[1] Behind ZKM: An Interview with Co-Founder and CEO Kevin Liu on Building Blockchain Interoperability
[2] BitVM2: Bridging Bitcoin to Second Layers
[3] RISC-V | Baidu Encyclopedia
[4] EIP-1559: A Major Upgrade for Ethereum | Galaxy
[5] From Ethereum to Bitcoin: Two Ecosystem Revolutions in the Eyes of a Builder
[6] GOAT Network Economic Beigepaper 2.0
[7] Lightning Network Trilogy: Taproot Upgrade and the Initial Shift in Bitcoin’s Narrative
[8] What Is Pay-to-Taproot (P2TR)? - The Bitcoin Manual
[9] BitVM And Its Optimization Considerations | by Bitlayer | Medium
[11] BitVM: Unlocking Arbitrary Computation on Bitcoin Through Circuit Abstractions - ZKSecurity
[12] Why ZKM Chose MIPS32r2 Over RISC-V for zkMIPS | by ZKM | Medium
[13] zkMIPS 1.0: Built for Ethereum. Built for Bitcoin | by ZKM | Medium
[14] zkMIPS: a high-level specification
[15] Ziren: Build with Confidence. Deploy without Compromise
[16] GOAT Network Brings BitVM3 into Practical Use, Pioneering Scalable Native ZK Verification on Bitcoin
[17] BitVM3 Label Forward Propagation
[18] Ethereum may usher in its biggest upgrade in history: EVM goes offline, RISC-V takes over
[20] BitVM3s– Garbled Circuits for Efficient Computation on Bitcoin
Disclaimer: This report, prepared by Web3Caff, is for informational purposes only and does not constitute any forecast or investment advice, proposal, or offer. Investors should not rely on this information to purchase or sell any securities, cryptocurrencies, or adopt any investment strategy. The terminology used and opinions expressed in this report are intended to facilitate understanding of industry trends and promote the responsible development of the Web3 industry, including the blockchain industry. They should not be construed as definitive legal opinions or the views of Web3Caff. The opinions expressed in this report reflect the author's personal opinions as of the date stated, do not represent the views of Web3Caff, and are subject to change in light of subsequent circumstances. The information and opinions contained in this report are derived from proprietary and non-proprietary sources believed by Web3Caff to be reliable. They do not necessarily cover all data, and their accuracy is not guaranteed. Therefore, Web3Caff makes no warranty of any kind regarding its accuracy or reliability, and assumes no liability (including liability to any person for negligence) for errors and omissions arising in any manner whatsoever. This report may contain "forward-looking" information, which may include forecasts and projections. This report does not constitute a guarantee of any forecast. Reliance on the information contained in this report is entirely at the reader's discretion. This report is for reference only and does not constitute investment advice, proposal or offer to buy or sell any securities, cryptocurrency or adopt any investment strategy. Please strictly abide by the relevant laws and regulations of your country or region.
Welcome to join the Web3Caff official community : X (Twitter) account | Web3Caff Research X (Twitter) account | WeChat reader group | WeChat public account
