The Case for Sovereign Rollups on Bitcoin. // Aayush Giri

The first Ordinals inscription landed on Bitcoin on December 14, 2022. Nothing in Bitcoin's consensus changed to let it happen. Two years later, a protocol designed to put images on Bitcoin is what every serious rollup design depends on.

The Bitcoin scaling conversation has moved past Lightning. It is now a three-way argument. Sovereign rollups that use Bitcoin only for data availability. Settled rollups that also verify state on Bitcoin via BitVM. And sidechains that inherit neither, despite marketing that suggests otherwise. Most projects currently labeled Bitcoin L2s are the third category. The distinction is the difference between your BTC being as safe on the L2 as it is on L1, and your BTC being as safe as a federation is honest.

Ordinals Was the Accidental Primitive

Casey Rodarmor's ordinal theory fits in one sentence.

Satoshis are numbered in the order in which they are mined, and transferred from transaction inputs to transaction outputs in first-in-first-out order.

It is a client-side interpretation of existing UTXO flow. A node running ord sees ordinals. A node not running ord does not. Bitcoin itself is unchanged.

The inscription mechanic is the part that matters for rollups. Data gets wrapped in an envelope tucked inside the witness of a Taproot script-path spend. The envelope never executes, but it stays on-chain forever, and witness data takes the 75% size discount SegWit introduced in 2017. Inscriptions can carry hundreds of kilobytes of arbitrary data per transaction at that discounted price. Every sovereign-rollup design on Bitcoin uses some variant of this envelope to post batches.

inscription envelope

ENVELOPE_PATTERN:
  OP_FALSE           # forces the OP_IF below to skip
  OP_IF              # conditional body never executes
    <data>           # arbitrary bytes, stored but never evaluated
  OP_ENDIF           # witness discount applies to the whole envelope

There was a fight about whether to allow it. In January 2024, Bitcoin Core contributor Luke Dashjr called inscriptions a bug and proposed filtering them. Core maintainer Ava Chow closed the pull request as controversial, with no hope of reaching a conclusion acceptable to everyone. Miners had earned more than $100 million in inscription fees during the first ten months of 2023. Declining that revenue was never going to be a policy decision.

The lesson for rollup designers is simple. Bitcoin's data-availability layer is priced by the market, not by policy.

Sovereign and Settled Are the Distinction That Matters

Celestia's definition is the canonical one. A sovereign rollup publishes its transactions to another blockchain for ordering and availability, but handles its own settlement. A smart-contract rollup (Arbitrum, Optimism, zkSync on Ethereum) uses its L1 contract as the validity oracle. A sovereign rollup's L1 is a bulletin board. Rollup full nodes verify state themselves.

That single choice has three consequences.

01Upgrades on a smart-contract rollup go through L1 contract governance. Upgrades on a sovereign rollup are forks, exactly like an L1's own.
02The bridge on a smart-contract rollup can be trust-minimized by design. The bridge on a sovereign rollup cannot, unless a separate mechanism like BitVM is layered on top.
03State validity on a smart-contract rollup is enforced by L1. On a sovereign rollup, it is enforced by the rollup's own node set.

Sovereignty buys uncapturable governance. No base-layer contract can be used to coerce an upgrade on rollup users. The cost is a weaker bridge. For Bitcoin, a chain whose culture resists any consensus change it does not need, that trade-off is close to ideal on paper.

On paper is the qualifier. A rollup that skips settlement to preserve its principles is elegant and unused.

Three Bitcoin L2 architectures side by side: sovereign rollup, settled rollup via BitVM, and sidechain, with their trust assumptions and relationship to Bitcoin L1 — Three architectures, three trust models. Only two inherit Bitcoin's state security.

Rollkit launched in February 2023. Its Bitcoin data-availability integration followed in March 2023. Nearly two years later, no production Bitcoin-DA Rollkit chain has reached mainnet. The design is philosophically pure. Users want bridges. Developers want settlement. That asymmetry is why BitVM matters.

BitVM Opened the Third Path

Robin Linus's BitVM paper, published in late 2023, did something the Bitcoin community had treated as off the table. It expressed arbitrary computation verifiable on Bitcoin without any consensus change.

The trick is a fraud-proof game committed to a Taproot tree. A prover commits to a program's entire execution trace. A verifier challenges any single step. Binary search narrows the disputed step. Only the one challenged step is settled on Bitcoin. Everything else stays off-chain.

bitvm cost model

BITVM_CHALLENGE_PATH:
  UNCONTESTED        = stays off-chain       # no Bitcoin txs when nobody challenges
  WORST_CASE         = 30-40 Bitcoin txs     # full challenge path down to one disputed step
  WITHDRAWAL_WINDOW  = ~1-2 weeks            # adversarial; Bitcoin confirmation depth dominates

BitVM2 followed in August 2024 and added the property that mattered most: permissionless challenging. The original scheme required pre-designated verifiers. BitVM2 lets anyone dispute a fraudulent proof, which is the difference between curated honesty and real 1-of-N honesty.

Before BitVM, a Bitcoin rollup had two honest options. A sidechain-like federation, or a sovereign rollup with a weak bridge. BitVM created a third. Settlement without consensus change. Every credible Bitcoin ZK rollup currently in development lives in that third category.

Citrea Is the Test Case

Citrea is built by the team formerly known as Chainway Labs. They published a paper in 2023 titled A Sovereign ZK Rollup on Bitcoin: Full Bitcoin Security Without a Soft Fork. They raised a $14 million Series A from Founders Fund in 2024. And the rollup they are actually shipping, running in public testnet with mainnet still ahead, is not sovereign. It is a settled BitVM rollup.

The stack is a type-2 zkEVM on RISC Zero, Bitcoin as the data-availability layer via inscription envelopes, and Clementine, a BitVM-based bridge that accepts ZK proofs and pays out BTC through the fraud-proof game. The trust model is 1-of-N honest verifier. As long as one network participant is honest, validity is enforceable on Bitcoin. That is dramatically weaker than Ethereum's enshrined-verifier rollups, and dramatically stronger than any federated peg.

I read the sovereign-to-settled pivot as the single most honest engineering story in Bitcoin L2 right now. A team that started with the purist position changed direction because settlement was the only path to a trust-minimized BTC bridge anyone would actually use.

OP_CAT and What Happens Next

BIP-347 is the official OP_CAT proposal. It was authored by Ethan Heilman and Armin Sabouri, and merged as a BIP on May 6, 2024. It activates via a soft fork that redefines OP_SUCCESS126 to OP_CAT in Tapscript. It is not activated. Merging as a BIP is editorial acceptance of the spec. Activation requires rough consensus plus miner and user signaling, and Bitcoin has not coordinated on that.

For anyone reading crypto press: BIP-420 is not OP_CAT. BIP-420 is a separate informal covenants proposal from the bip420 GitHub group. The two get conflated often enough to be worth calling out.

If OP_CAT activates, BitVM's worst-case challenge path drops from roughly 30 to 40 Bitcoin transactions to something on the order of one. Every serious Bitcoin rollup team is simultaneously shipping a BitVM-based design that works today, and quietly advocating for OP_CAT to make the bridge an order of magnitude cheaper. That is the classic Bitcoin L2 paradox. Build as if Bitcoin never changes, while lobbying for the one change that would clean up the whole design.

How the Pieces Fit

Ordinal Theory was not designed as rollup infrastructure. Rodarmor wanted a canonical numbering scheme for satoshis and a way to put images on Bitcoin. The side effect was proving that Bitcoin's data-availability layer could absorb consumer-grade demand for arbitrary blobs, that miners would price that blockspace competitively, and that Core could not coordinate filtering it off. The inscription envelope every Bitcoin rollup uses to post batches is the downstream effect of someone trying to make Bitcoin NFTs.

Sovereign rollups on Bitcoin are the philosophically cleanest scaling story. Zero consensus changes. Zero federations. Zero new validator sets. They push all trust into the rollup's own node set, which Bitcoin culture likes better than any alternative.

They are also not what the market is building. Rollkit on Bitcoin is two years old with nothing shipped on it. Citrea chose settlement over sovereignty and raised a Series A on the opposite thesis. Users want bridges, and BitVM is the route Bitcoin actually has to offer one without a soft fork.

Bitcoin is not going to scale by becoming Ethereum. It will scale by being the most credible data-availability and settlement layer on earth, while programmable state happens in rollups above it. Some of those rollups will be sovereign. Most of them, at least for now, will settle through BitVM. All of them will use an envelope pattern Rodarmor accidentally invented by trying to inscribe a picture.

The Case for Sovereign Rollups on Bitcoin.