Thread by @SomsenRuben

1/7 I often hear people say they want SNARKs (STARKs/zk-sync/zk-rollups) for #Bitcoin, but most are confused what that even means. Common misconceptions are that SNARKs provide something like 100x scaling and that this one "simple" change would enable any functionality they want.

2/7 Let's talk functionality first. SNARKs have only one function: non-interactive witness aggregation. Witness data is e.g. what proves that Alice satisfied the contract that allows her to send money to Bob. SNARKs can compress this data so it takes up much less bandwidth/CPU.

3/7 If you want more functionality, you also need a more expressive scripting language, as SNARKs can only do what you can actually express. And unless you want Bitcoin to inherit Ethereums scaling issues, this requires careful engineering, like the work being done on Simplicity.

4/7 Next, the 100x scaling claim – it's simply untrue. SNARKs only compress witness data, and Bitcoin blocks consist of 50% witness data, so even if you compress to 0 you'd get 2x at most. You can get more with address reuse, but at the cost of privacy – a questionable tradeoff.

5/7 So how does Eth get to 100x? An accounting trick. Eth blocks are limited by gas, and most of the gas is used up by CPU, not bandwidth. SNARKs take up little CPU and high bandwidth, so more data fits in the gas limit, but blocks get much bigger. A de facto block size increase.

6/7 So are SNARKs useful for Bitcoin? Yes, but it's not nearly the "easy 100x" people think. It won't solve on-chain scaling, but it may help to enable more complex contracts that require larger amounts of witness data & computation, provided we first improve Bitcoin's scripting.

7/7

Want more? You can learn more about SNARKs by reading my article, where I also cover how they can theoretically be applied to initial validation (IBD): medium.com/@RubenSomsen/s…

I also discussed SNARKs in a recent podcast with @sj_mackenzie (1h55m16s):