From Passive Storage to Native Yield: Alea Deep Dive into How GOAT Network Creates a Secure BTCFi New Paradigm

Overview

GOAT Network is a Bitcoin-native zkRollup aimed at transforming $BTC from a passive store of value into a sustainable income-generating asset. The ecosystem adopts a Type-1 zkEVM architecture, ensuring full compatibility with EVM while inheriting Bitcoin's native economic security during operation.

The technical architecture of GOAT consists of three parts:

1. Ziren: for high-performance ZK proof generation;

2. GOAT BitVM2 verification layer: specifically designed for zkRollup, this layer provides double-spending resistance for operators, supports decentralized ordering, and achieves economic finality within 24 hours through a multi-round random challenge protocol;

3. Decentralized PoS sequencer network: achieves censorship resistance through a penalty mechanism and ensures continuous operation of the network. The enforcement of state commitments and challenge scripts is implemented by BitVM2, with corresponding ZK proofs submitted to the Bitcoin network.

GOAT adopts a generalized operator model, where all participants take turns acting as sequencers, provers, publishers, and challengers, balancing costs and benefits through cross-subsidization.

All gas fees are paid in $BTC, and the rotating PoS sequencers cyclically distribute these fees along with block rewards and captured MEV to participants, forming real returns denominated in $BTC. This mechanism directly links income generation to actual network usage, creating an activity-driven economic model.

Problem Statement

$BTC is viewed as a secure and liquid asset primarily used for long-term value storage. However, to date, there has been no truly reliable mechanism for individuals to earn Bitcoin-denominated returns directly on-chain. Most $BTC holders seeking returns have to rely on centralized finance (CeFi) solutions or convert their assets into wrapped tokens held by custodians on other chains.

Although these methods have been widely adopted, they introduce trust assumptions on third parties, deviating from Bitcoin's principles of transparency and self-custody. The returns they offer are not native returns, often arising from token issuance, liquidity mining programs, or staking rewards from other protocols (such as Ethereum or other L1 chains). In many cases, the underlying yield activities involve lending, complex DeFi strategies, or exposure to highly volatile assets.

Previous attempts to build Bitcoin Layer 2 solutions (including Rollups) have exposed numerous economic and operational challenges. Many designs concentrate roles such as transaction ordering and state validation among a few participants, introducing centralization risks and creating weak incentive structures for high-cost roles like data publication, fraud detection, and state validation, which are critical for building trustworthy, long-term public infrastructure. Additionally, the process of withdrawing funds back to Bitcoin's mainnet can take up to two weeks, limiting capital efficiency and harming user experience.

Value Proposition

GOAT Network is dedicated to transforming Bitcoin from a passive store of value into an active asset capable of generating returns, all while preserving its core principles of decentralization, trustlessness, and security.

By using $BTC as gas and integrating decentralized sequencers with a trust-minimized bridge, GOAT builds a network anchored in Bitcoin's security, providing real returns to $BTC holders. Users can stake $BTC, $DOGE, and $BTCB (with more tokens to be supported in the future) to earn rewards from on-chain gas, MEV, and dApp activities.

GOAT Network ensures users have unconditional exit rights: any user can withdraw any amount of assets from the Bitcoin Layer 2 network to Layer 1 at any time through atomic swaps, enhancing security, capital efficiency, and user experience.

• No need for Bitcoin forks: GOAT operates on native Bitcoin scripts, fully utilizing the enhanced BitVM2 without requiring changes to the Bitcoin protocol itself.

• Decentralized sequencers (operators): Unlike many Rollups that rely on a single centralized entity, sequencers on GOAT take on multiple roles (validation, ordering, and transaction compression) through a rotation mechanism.

• Real-time ZK proofs: GOAT uses its proprietary Ziren technology to generate validity proofs, ultimately submitting ZK proofs to Bitcoin for settlement and verification.

• Native $BTC returns: As the gas token, $BTC ensures that the returns (fees) generated from Bitcoin Layer 2 network activities can be directly returned as rewards to stakers, forming the basis of the income model.

• Multi-asset staking: Currently, users can stake $BTC, $DOGE, and $BTCB (wrapped $BTC on the BNB chain).

• Tokenized sequencer rewards: Sequencer rewards are encapsulated as $yBTC, an interest-bearing $BTC derivative that can be traded or split into principal and yield, forming the foundation of the $BTC yield market.

Technical Overview

GOAT Network expands Bitcoin's functionality through a combination of off-chain computation (on GOAT) and on-chain verification (on Bitcoin) without changing Bitcoin's consensus rules. BitVM2 serves as an off-chain fraud-proof system, utilizing Tapscripts, one-time signatures, and pre-signed transactions to enforce the validity of Layer 2 network states on Bitcoin. When operators publish the claimed Layer 2 network state in the form of Bitcoin UTXOs, they can initiate challenges using BitVM2 within a specific time window. This is an upgrade to the original BitVM protocol, eliminating the two-party restriction and allowing any participant to challenge invalid computations.

After the sequencer runs Ziren to generate a new Layer 2 state, it publishes a Tapscript UTXO on Bitcoin. This UTXO records the latest state and contains two branches: one for confirmation when there are no challenges, and one for denial in case of fraud. These paths are then combined with a set of pre-signed transactions from BitVM2 to enforce verification steps during potential challenges.

Under optimistic computation assumptions, challengers continuously monitor UTXOs published on Bitcoin and validate transactions through a multi-round random challenge mechanism to detect potential fraud.

At a higher level, GOAT Network:

1. Executes EVM computations on its network;

2. Uses Ziren to compress the results (Layer 2 network state) into concise ZK proofs, ultimately submitting them to the Bitcoin mainnet;

3. Writes a Taproot-locked UTXO to the Bitcoin mainnet, which carries the ZK proof and integrates the dispute path logic of BitVM2 at the script level;

4. Allows anyone to challenge invalid state transitions using BitVM2's fraud-proof mechanism.

The core of GOAT's design is its proprietary zkVM—Ziren. Ziren converts EVM transactions on GOAT into fixed-size Groth16 proofs and publishes them to the Bitcoin mainnet. GOAT's Ziren significantly shortens proof generation time, making the practical implementation of BitVM2 in Bitcoin zkRollup possible.

After addressing the core issues of computation and proof layers, GOAT further institutionalizes the network operation mechanism. In short, GOAT introduces a generalized operator model that merges multiple roles such as sequencer, prover, operator, publisher, and challenger into a unified pool of staked participants, balancing the risks and rewards of different roles. This model achieves dynamic equilibrium of costs and revenues through role rotation, thereby lowering the participation threshold for small nodes, enhancing decentralization, and strengthening overall network stability and security. The network is operated by decentralized sequencers who package transactions, order Layer 2 blocks, and submit state roots and proof hashes to Bitcoin.

When submitting UTXOs to Bitcoin, operators need to stake collateral; if an operator is challenged and proven wrong, that collateral will be forfeited. GOAT's optimistic mechanism means that the triggering rights of Tapscripts are in the hands of challengers rather than being automatically executed by the system. If there are no challenges, these scripts remain dormant, and execution depends on whether an actual dispute occurs.

Computation Layer

Type-1 zkEVM and Improved Op-geth Execution Engine

GOAT belongs to Type-1 zkEVM, capable of generating validity proofs for standard EVM transactions.

A comparison chart of different types of zkEVM shows the trade-offs between compatibility and performance from Type-1 to other designs.

GOAT's execution layer applies a modified op-geth (Ethereum EVM) to Bitcoin, enabling the execution of EVM smart contracts. The consensus layer runs CometBFT (a modern Tendermint). When a transaction enters the sequencer's private memory pool, validators run a round of BFT consensus to agree on the next block. Op-geth then executes that block, and once ≥2/3 of validators sign, the block is finalized; as long as the number of faulty validators is less than 1/3, the block can continue to operate normally.

Ziren Proof Generation

Ziren is a zkVM built by ZKM, running on a stable, deterministic MIPS32r2 instruction set, and has reached production level. This makes development easier, as if the application logic has been audited, there is no need to re-audit the ZK proof circuit.

Ziren does not rely on a specific architecture. Its core modules include zkCompiler, prover, and verifier, which work together to transform high-level code into polynomials, generate ZK proofs, and verify them in a trust-minimized environment through smart contracts or Bitcoin contracts. The essence of a Bitcoin contract is to allow a UTXO to specify future spending rules.

Ziren has the capability of segmenting verification circuits, compressing the commitment data of public inputs while reducing the complexity of Bitcoin scripts with cryptographic hints. With these optimizations, GOAT can build a challenge-based verification model relying on Bitcoin's native scripts.

ZKM's decentralized proof network takes these initial Ziren proofs as root proofs, first completing aggregation with an aggregator prover, then handing them over to a SNARK prover to convert them into concise Groth16 zkSNARK proofs. Thanks to GPU acceleration and a pipelined proof architecture, generating proofs for blocks containing one hundred transactions takes about forty seconds.

Proof Generation Process

The entire proof process is broken down into several subtasks. Programs like Minigeth and zkML are compiled into MIPS ELF binaries and sent to a task pool managed by Stage Service, which splits and assigns them to provers for execution. The proof system consists of three types of components: the root prover generates Ziren proofs, the aggregator prover is responsible for merging, and the SNARK prover outputs Groth16 proofs, which are ultimately sent to GOAT nodes.

The final Groth16 proof is submitted by the operator to the Bitcoin mainnet. In BitVM2, SNARK verification occurs off-chain, while the results of disputes are enforced on-chain through pre-signed transaction paths, thus avoiding SNARK checks at the script level, preserving Bitcoin's security while supporting challenges to the Bitcoin Layer 2 network on the mainnet.

Verification and Disputes

BitVM2 Optimistic Verification

BitVM2 is GOAT's on-chain verification and cross-chain protocol. It does not directly execute computations but verifies the results of computations, conceptually similar to optimistic Rollups. By combining Ziren with a decentralized ordering mechanism, BitVM2 achieves efficient and secure Bitcoin zkRollup. The protocol implements programmability through pre-signed transactions and one-time signatures.

GOAT Network's optimistic computation model allows assets to flow between Bitcoin and GOAT Network in a secure and decentralized manner. The security of the protocol is based on three aspects: first, a one-time Winternitz signature scheme ensures the integrity and immutability of transactions; the 1-of-n honest assumption prevents asset theft; and the dual penalty mechanism across GOAT and Bitcoin layers increases the cost of violations exponentially.

During a dispute, the four stages of initiation, challenge, assertion, and rebuttal correspond to the leaf nodes in the Tapscript tree. Each leaf uses a one-time Winternitz signature (WOTS) and a corresponding Tapscript. Relevant keys are pre-generated and signed, ensuring that each step is used only once. All leaf nodes combine to form a Merkle tree, which is then combined with internal keys to generate the Tapscript output key. This compresses the on-chain structure while not exposing the dispute logic before branches are used.

During the random multi-round challenge period, anyone can stake collateral and invoke challenge scripts to question the operator. The operator must submit a computation trace to prove correctness. If the challenge is successful, the challenger receives the operator's collateral; if it fails, the challenger's collateral is forfeited.

This mechanism quickly selects priority challengers. If the previous challenger does nothing about fraud while the subsequent challenger takes action, the former will be penalized, and the latter will be rewarded, thus establishing an efficient and secure economic incentive system.

BitVM3

When BitVM2-GC is mentioned in subsequent documents, it refers to the same mechanism as BitVM3.

BitVM3 is the natural evolution of off-chain SNARK proof verification for Bitcoin, built on models such as BitVM2 and Delbrag protocols. BitVM2 introduced the optimistic computation model, while Delbrag used Yao's garbled circuits (GC) to handle Groth16, but both have limitations in scalability and usability.

Early cross-chain bridges required high on-chain collateral, leading to significant capital being tied up. BitVM3 reduces costs to below one hundred dollars by introducing BitHash and moving most computations to off-chain via garbled circuits. The off-chain storage requirement for challengers is about 280GB, but costs less than $10, further enhancing economic feasibility.

Table: Comparison of Features between BitVM3 and BitVM2

Coordination and Infrastructure

Decentralized PoS Sequencer Network

GOAT is a Bitcoin-native zkRollup. The network selects sequencers randomly based on staking ratios. Operators may take on high-cost roles such as provers or publishers in one cycle and act as sequencers to earn transaction fees in another. With this mechanism, no operator can monopolize sequencing rights for an extended period, ensuring balanced economic incentives and making the network more robust.

The rotation mechanism also lowers the threshold for participation. Resource-intensive tasks will not be long-term handled by the same operator, allowing smaller nodes the opportunity to enter the network, further solidifying the decentralized foundation. If an operational node goes down, the system activates the rotation mechanism to reassign responsibilities, ensuring the network continues to operate.

Sequencers must adhere to staking and penalty constraints. If they fail to perform their duties, such as missing block proposals or experiencing downtime, they will be skipped and penalized, while the network automatically hands over to the next qualified node to continue execution.

Generalized Operator Abstraction and Economic Model

The generalized operator abstraction evolves from the concept of decentralized sequencers. It expands the single sequencing role into a unified system, allowing the same group of operators to be responsible for all core tasks simultaneously.

The main difference between the two lies in the scope and incentive mechanisms. Decentralized sequencers are only responsible for the distribution of transaction ordering, while the generalized operator model incorporates all key roles into rotation and allocation.

Operators must stake $goatBTC (i.e., $BTC on GOAT) to qualify for participation and are accountable for their roles. If a sequencer double-signs, goes offline, or cheats, the protocol will destroy their stake and freeze the node. Relevant scripts will automatically execute penalties to prevent operators from exiting prematurely while incentivizing honest behavior.

Certain specific responsibilities, such as initiating challenges or creating corresponding UTXOs on the Bitcoin mainnet, require participants to lock additional collateral in the script tree. Anyone can challenge an operator, but if the challenge fails, the challenger's collateral will go to the operator. If an earlier challenger fails to detect fraud while a subsequent challenger succeeds in proving it, the former may also be penalized. All forfeited funds will go to the committee, which will then reward successful challengers in the Layer 2 network.

The profits from sequencing cycles can be used to cover the costs of proof and publication. Operators may occasionally take on high-cost tasks, but with the revenues from other cycles and the periodic rotation of roles, these burdens can be effectively balanced. The generalized operator abstraction thus lowers the participation threshold for all roles.

Trust-Minimized Bitcoin–GOAT Cross-Chain Bridge

This bridging protocol allows secure asset transfers between Bitcoin and GOAT Network, ensuring that anchored assets in the system do not rely on custodians under established security assumptions.

GOAT BitVM2 is the core of this architecture, with its operational logic based on the 1-of-n (at least one party is honest) assumption. All computations are executed off-chain, with Bitcoin only intervening during disputes to verify results through scripts.

The decentralized autonomous organization composed of operators, GOAT Federation, is responsible for reviewing withdrawal requests and triggering off-chain computations. Operators assume the role of provers during cross-chain withdrawals, generating validity proofs for withdrawals from the Layer 2 network to the mainnet. The bridge supports two types of asset transfers: Peg-In (depositing from Layer 1 to Layer 2) and Peg-Out (withdrawing from Layer 2 to Layer 1).

Peg-In (Bitcoin to GOAT Network)

• The Peg-In process uses Simplified Payment Verification (SPV) to confirm users' Bitcoin transactions. Users initiate a Bitcoin transaction, paying to a Taproot script with the 1-of-n honest assumption, while operators prepare two pre-signed transactions as a safeguard path for subsequent execution.

• Relay nodes send the latest Bitcoin block headers to GOAT nodes, which store the SPV Merkle root in smart contracts. Users then submit a claim request along with SPV proof. Upon verification, the Layer 2 proof-of-stake layer (PoS layer) EVM mints equivalent wrapped tokens, while the original $BTC remains locked in a multi-signature script.

Peg-Out (GOAT Network to Bitcoin)

In a typical Peg-Out, users request to withdraw $BTC, and operators will first immediately provide Bitcoin to the users via atomic swaps. Operators then retrieve the corresponding Bitcoin from the Peg-out pool and submit proof.

• Each confirmation block from GOAT will include validity proofs, challenge scripts, and asset scripts, submitted to the Bitcoin chain by operators. The process consists of three steps: user initiation, proof submission, and entering the challenge period.

• During the challenge period, any user can stake collateral (e.g., 0.5 $BTC) to question the request, demanding operators disclose intermediate computation steps. If fraud is confirmed, the challenger receives part of the operator's funds, with a larger portion being destroyed; if the challenge fails, the challenger's collateral is forfeited, and the operator fully recovers after a delay.

• Funds are ultimately released through a multi-signature redemption script, which automatically activates upon the successful conclusion of the challenge period. The execution process of Peg-out is submitted through MAST and Tapscript, with each leaf node encoding a computation step, allowing verifiers to submit fraud proofs in case of contradictions.

• The multi-round random challenge mechanism can quickly select sequential challengers to complete the approval.

Data Availability Layer

In the GOAT network, data availability is ensured by a decentralized sequencer commitment mechanism that operates in conjunction with BitVM2. It does not rely on a single centralized entity to publish state data but periodically submits the complete list of sequencers (including the public keys of sequencers for the next two weeks) to the Bitcoin mainnet through Tapscript transactions.

This commitment method allows any participant to verify the authenticity of sequencer-signed data and reconstruct the complete Layer 2 state accordingly. All outputs from sequencers are signed and bound to the on-chain list, enabling light clients and monitoring nodes to independently verify and obtain updates without relying on any centralized party. This ensures that state data can always be restored or questioned by any honest participant.

In this architecture, BitVM2 uses Ziren to verify Layer 2 block execution, completing fraud proofs. Assertions will reference the on-chain submitted sequencer list, allowing challengers to confirm that state transitions are both valid and available.

Target Market

The original intention of Bitcoin's creation was to serve as a permissionless, censorship-resistant peer-to-peer currency. This design choice prioritizes decentralization and security over high throughput and flexibility, leading to limited block space and insufficient underlying scripting capabilities. As the demand for yield rises, while the mainnet fails to achieve rich programmability, DeFi activities have gradually shifted towards off-chain lending platforms and other more programmable chains for wrapped $BTC, introducing additional trust, custody, and censorship risks.

To address these contradictions, a new generation of Bitcoin Layer 2 networks has emerged. They rely on the Bitcoin mainnet for settlement while introducing EVM-level programmability and higher processing efficiency at Layer 2. In such Layer 2 systems, $BTC (in its native or wrapped form) can support lending, exchanges, derivatives, synthetic assets, and yield structures, accommodating both microtransactions and complex contracts. Given that $BTC is the largest crypto asset with deep liquidity and sustained yield demand, these platforms naturally attract users and developers.

As usage scales up, the reputation and security of the Bitcoin mainnet, combined with the expanded functionalities of Layer 2, can transform a significant amount of idle capital into productive capital at the institutional level. Governments, treasury departments, and organizations with social impact goals have begun exploring how to incorporate Bitcoin Layer 2 networks into public projects, such as optimizing national finances, social services, and climate resilience initiatives, while still anchoring final settlement on the Bitcoin chain.

Key Users

GOAT's users include individual and institutional $BTC holders seeking yield, and it also provides similar opportunities for $DOGE holders. We serve DeFi users, liquidity providers, and EVM builders, each group enjoying different potential returns and facing various risks.

Users can choose different $BTC yield generation strategies on GOAT:

• Safebox plan: for those who want to ensure the security of their Bitcoin investments while retaining self-custody. After depositing, users will receive a time-locked UTXO in their wallets, which they can access after the lock-up period ends.

• BTCB/DOGEB treasury: earning returns through sequencer rewards and gas fees.

• Sequencer PoS staking: income comes from gas fees, sequencing rewards, and MEV.

• BTC derivatives and DeFi yields: such as lending, liquidity staking, market-making, etc.

Tokenization Mechanism

The income earned by sequencers is converted into $yBTC, which can further be broken down into principal $pBTC and $yToken, separating the pure yield portion from the principal.

The yield mechanism operates as follows:

1. Users need to stake $BTC into the system (via the sequencer collateral pool), generating the initial yield asset $yBTC. This asset can then be further broken down into $pBTC and $yToken.

2. The system mints $yToken and $pBTC.

3. $yToken represents the yield portion.
   Users can choose to:

• Hold $yToken to accumulate yield;

• Sell $yToken on the market;

• Hold $pBTC until maturity to redeem the underlying $BTC.

The separation of yield and principal allows for free trading or use before the lock-up period ends. $yToken does not represent a fixed amount of $BTC but rather a claim on future yield denominated in $BTC, with the quantity of shares being unknown and variable.

Economic Design

GOAT's economic model is built around four core concepts to ensure the system is secure, fair, and capable of providing returns to participants:

• Gas fees denominated in $BTC;

• Decentralized sequencer architecture;

• Proof of Stake (PoS) mechanism;

• A comprehensive technical and economic framework that connects all parts.

GOAT's revenue primarily comes from on-chain activities. The fees earned by sequencers are converted into $yBTC, and when funds are withdrawn from GOAT back to the Bitcoin mainnet, a fixed percentage service fee is charged on the amount, in addition to Bitcoin's gas fees.

GOAT's income derives from user interactions and trading activities within its application ecosystem. The more activity there is, the higher the gas and MEV income, and the greater the returns for stakers. Sequencers are generated randomly based on staking, and they tend to allocate more rewards to increase staking amounts and enhance their chances of being selected as block proposers. High yields attract more participants to stake, further driving capital into the GOAT ecosystem.

The generalized operator mechanism balances income and costs, achieving stability in incentives. Operators must stake in the GOAT network, thus needing to hold $goatBTC. Once the mechanism combining rotation, staking, and economic returns operates effectively, the system establishes an incentive loop.

Risks and Safeguards

The architecture of GOAT Network combines Bitcoin scripts, BitVM2 challenge protocols, Ziren ZK computation, and decentralized sequencer rotation. Although the design aims to provide higher security and scalability, each component faces potential risks. At the network layer, defects in cross-chain bridge scripts, proof validators, or challenge logic could jeopardize the integrity of all transactions and assets in the Layer 2 network. At the application layer, dApps on GOAT, like general smart contracts, are susceptible to logical vulnerabilities or exploitation.

Moreover, GOAT's yield mechanisms (such as Safebox and staking) rely on continuous user engagement and trading volume. If activity declines, the yield cycle may be affected, incentives weakened, and the ecosystem could weaken. The table below outlines key risk points and mitigation measures.

The risks and safeguards are categorized and explained from both chain-level and DeFi-level perspectives:

Frequently Asked Questions

Q: What is GOAT Network? How does it enhance Bitcoin?

A: GOAT Network is the first decentralized Bitcoin Layer 2 network that achieves smart contracts, dApps, and native $BTC/$DOGE yields while maintaining Bitcoin's security. The system utilizes BitVM2 to achieve trust-minimized computation, relies on Ziren for efficient proof generation, and ensures secure and open transaction ordering through a decentralized sequencing mechanism.

Q: How does GOAT Network ensure security and decentralization?
A: GOAT inherits Bitcoin's security through BitVM2, allowing proofs to be verified on Bitcoin without forking the underlying chain. It employs decentralized ordering, a dual penalty mechanism, and optimistic computation to prevent fraud and ensure honest behavior.

Q: How does GOAT handle cross-chain asset transfers?
A: Users deposit $BTC into a multi-signature address, and after submitting SPV proof, they receive wrapped $BTC ($goatBTC) on GOAT. Upon withdrawal, the wrapped $BTC is destroyed, generating ZK proofs, and the assets are released after the challenge period ends. BitVM2 provides native security through atomic swaps.

Q: What is the role of sequencer nodes? How do they earn rewards?
A: Sequencers are responsible for transaction ordering, block production, ZK proof generation, and security commitments. Sequencers directly earn $BTC as rewards, but they face penalties for malicious behavior.

Q: What are Ziren and ZKM?
A: Ziren is a MIPS-based zkVM that supports fast, EVM-compatible smart contract execution and generates verifiable proofs. ZKM handles proof generation, asset cross-chain transfers, and efficient Bitcoin verification through a layered zkSNARK architecture.

Q: How does GOAT's yield model serve $BTC and DOGE holders?
A: Users earn sustainable native Bitcoin yields through $BTC-denominated gas fees, sequencer rewards, and tokenized yields (such as $yBTC/$yDOGE).

Q: What tools are available for developers?
A: Developers can use Solidity programming, deploy via Hardhat, access the GOAT testnet, test token faucets, core contracts, and detailed documentation. GOAT uses $BTC as gas, with built-in oracles, cross-chain bridges, and full EVM compatibility.

Original Link