How CTV Can Help Scale Bitcoin

OP_CHECKTEMPLATEVERIFY has once again become a focal point in the conversation about improvements to scale Bitcoin. This time around there are many more alternative designs for covenants being proposed, and actual concrete designs that make use of CTV as scaling solutions (Timeout Trees and Ark). The conversation has a much larger depth of concepts to take into consideration, both in terms of alternatives that could be adopted as well as concrete proposals that CTV could enable.

One narrative circulating from the camp of people against CTV is that “CTV doesn’t scale Bitcoin.” Let’s charitably interpret that to mean that CTV itself does not scale Bitcoin, things you can build with it do. Well, then that is not a coherent argument. Segregated Witness did not scale Bitcoin. CHECKLOCKTIMEVERIFY and CHECKSEQUENCEVERIFY did not scale Bitcoin. But the Lightning Network, which those three proposals enabled, do scale Bitcoin. They add a massive amount of overhead for transactional throughput to grow beyond the constraints of the blockchain itself.

Lightning literally couldn’t exist without those base layer primitives. The problem with Lightning though, is it only scales the number of transactions that can be processed. It does not in any way help improve the scalability of ownership over UTXOs, or increase the number of users who can control one. Lightning is currently not capable of doing that with its current design and the current set of consensus primitives available in Bitcoin script.

CTV can change that.

UTXOs And Virtual UTXOs

Part of the problem of Lightning’s shortcoming regarding scalability of Bitcoin ownership is that in order to open a channel, or control a UTXO, you actually have to transact on the base layer. After that Lightning can facilitate a very large number of transactions off-chain, but a user must still transact on-chain to onboard themselves to Lightning. It massively increases the number of transactions Bitcoin can process, but it does nothing at all to increase the number of people who can own bitcoin.

This is another big problem CTV can help with. Burak coined the term “virtual UTXO” for his Ark proposal, but I think this terminology is a perfect general term useful far beyond the context of Ark. A virtual UTXO is one committed to being created in the future, through mechanisms like a pre-signed transaction, but that hasn’t actually been created on-chain yet. Bitcoin does not have the blockspace for everyone to create a single UTXO at the scale of the world population, but there is definitely potential for people to have their own independent virtual UTXO if the process of committing to those can be made scalable.

Scaling the creation of commitments to vUTXOs is the problem. Right now there is no way to create them except through the use of pre-signed transactions, and this introduces a bottleneck that must be addressed. The number of vUTXOs any real UTXO can commit to is bounded by the size of the multisig set signing these transactions. To trustlessly create vUTXOs, the owner of every vUTXO must be part of the multisig key that is signing the transactions that commit to creating them, otherwise they have no guarantee that conflicting transactions will not be generated that voids their ability to claim their vUTXO if necessary. The problem of coordinating the signing of this between every member of the set introduces practical considerations that will ultimately severely limit the size any pool of vUTXOs can grow to. The only other alternative is to have some trusted party or parties sign the transactions committing to everyone’s vUTXOs, and simply trusting them to not steal those funds from the rightful owners.

CTV offers a solution to both of these problems. By being able to non-interactively commit to a set of future transactions the same way pre-signed transactions do, but without requiring every owner of the vUTXOs those transactions create to coordinate signing, it solves the coordination problem. At the same time because no one needs to interact, a single person could take the role of funding the CTV output that commits to everyone’s vUTXOs unfurling on-chain, and zero trust in that person after the funding transaction is confirmed is required. Once that real UTXO is confirmed in a block, the person who funded it has no ability to undo or double spend the future transactions it has committed to.

Keep in mind that a vUTXO can be whatever you want it to be. It can be a Lightning channel, a multisig script for cold storage, etc. CTV does what the current form of Lightning does not, it scales actual ownership of Bitcoin, not just the number of transactions it can process.

Cut Through The Shortcut

One of the other criticisms of CTV as “not scaling Bitcoin” is that by committing to future transactions you do not escape the need to put them on-chain eventually, and so therefore CTV doesn’t actually help improve scalability. I like to call this “the OP_IF fallacy.” i.e. once people start talking about CTV they forget OP_IF exists, and that scripts can actually have multiple spending conditions to choose from.

The most powerful things about Taproot are the ability to construct multisigs by just adding two public keys together and sign for them with a single aggregate signatures, and to only selectively reveal a single “IF” branch of a script that has multiple ways to be spent. Combined with CTV, this offers a very powerful way to make use of vUTXO commitments. Rather than make a chain of transactions using purely CTV, they can be constructed with the CTV spending path buried inside a taproot tree. The end of the chain of transactions are all the individual vUTXOs each participant owns, locked to that user’s public key alone. As you go backwards towards the root of the tree, each set of keys that are below any node in the tree can simply be added together and used as the Schnorr multisig key that the CTV spend path is buried under.

This means that at any point in the chain of transactions unfurling on-chain to actually turn the vUTXOs into real UTXOs where you can get every participant in an intermediate UTXO to coordinate with each other, everyone can simply cooperatively sign a transaction moving their coins where they want to go in a more efficient way than simply letting the pre-defined transaction flow unfurl all the way to morph their vUTXOs into real ones. This allows small sub groups to escape needing to actually unfurl the entire set of transactions pre-committed to on-chain, without introducing any trusted parties to rely on or weakening the security of each user’s claim to their own vUTXOs.

These two simple realities offer a massive gain in scalability for Bitcoin without compromising on individual sovereignty or security in doing so, and all we need in order to realize them is CTV.

Acknowledgements: I would like to thank everyone who participates at the Chicago Bitdevs for helping me formulate these observations in a concise way through discussion.