Ark: Offchain Transaction Batching in Bitcoin

Abstract: Bitcoin is the cryptocurrency with the largest market capitalisation, but its widespread adoption is fundamentally limited by the scalability constraints of its consensus algorithm, which requires every transaction to be confirmed onchain. To address this, several Layer-2 scalability solutions have been proposed to move payments offchain -- most notably, the Lightning Network. However, their deployment remains hindered by cumbersome setup requirements: users must lock funds onchain to participate and engage in complex auxiliary protocols (e.g., for channel rebalancing, top-ups, and routing). Other solutions, like payment pools, sidechains and rollups, cannot be implemented in a non-custodial way on Bitcoin due to its limited scripting capabilities, or require all protocol participants to update the offchain state. In this work, we present Ark, the first Bitcoin-compatible commit-chain. Ark enables offchain transactions of virtual UTXOs (VTXOs), through an untrusted operator who aggregates them into succinct onchain commitments. A distinctive feature of Ark is its ease of deployment: users can receive offchain payments without locking any funds beforehand and Ark state updates can be performed only requiring the users involved in that update. We formally define the Ark protocol and prove its security. During this process, we identified two attacks affecting the testnet implementation, which we responsibly disclosed and proposed fixes for, which have been now integrated into the mainnet implementation. Our experimental evaluation demonstrates that Ark can commit onchain to batches of arbitrarily many VTXOs with a constant-sized footprint of approximately 200 vB. Cooperative exits add one output per user, while unilateral exits require $\mathcal{O}(\log n)$ transactions of roughly 150 vB per VTXO for a batch of $n$ VTXOs.

• The paper introduces Ark, a Bitcoin-compatible commit-chain that batches offchain transactions with VTXOs, eliminating the need for pre-funded channels.
• It details a design with cooperative and unilateral exits, achieving constant onchain commitment cost and logarithmic exit costs in worst-case scenarios.
• Experimental results demonstrate efficient commitment times and scalable performance under robust security guarantees while using only standard Bitcoin scripting.

Ark: Bitcoin-Compatible Commit-Chain for Offchain Transaction Batching

Introduction and Motivation

The scalability of Bitcoin is fundamentally constrained by its consensus protocol, capping throughput at approximately 10 transactions per second. Conventional solutions such as payment channel networks (e.g., Lightning) suffer from high onchain setup costs and liquidity fragmentation, and require users to pre-fund channels and engage in complex auxiliary protocols for routing and rebalancing. Other approaches—payment pools, sidechains, and rollups—are either incompatible with Bitcoin’s limited scripting or require global interactivity.

The Ark protocol (2605.20952) addresses these limitations by presenting a Bitcoin-compatible commit-chain construction that enables offchain transactions among users through “virtual UTXOs” (VTXOs), aggregated and committed to the blockchain by (primarily untrusted) operators. Key distinguishing features include entry without upfront onchain collateral, external fungibility of balances, opt-in fast finality, unilateral exit, and a minimal, constant-size onchain commitment footprint.

Ark Protocol Architecture

Ark’s architecture centers on three primitives: VTXOs (virtual UTXOs), batches (onchain outputs aggregating multiple VTXOs), and connectors (outputs enabling atomic swaps between VTXOs across batches). Users issue offchain requests for boarding (onramp), payments, swaps, and exits. The operator maintains shared liquidity and periodically constructs onchain commitment transactions, which establish the authoritative offchain state.

The protocol guarantees that:

• Users can onboard and receive payments without pre-locking funds onchain.
• Offchain payments require only operator and sender/receiver signatures, not global consensus.
• Users can unilaterally exit to onchain UTXOs at any time, independent of operator cooperation.
• Cooperative exits and batch commitments incur only a constant onchain cost, while worst-case (pessimistic) exit cost scales logarithmically in batch size.

  Figure 1: The full lifecycle of a user in Ark, from onboarding, offchain payments, cooperative and unilateral exits, to batch swaps, highlighting the interplay between onchain and offchain state.

Ark’s protocol flow (Figure 1) demonstrates a new user “boarding” with an onchain UTXO, receiving a VTXO in a batch, using it in an offchain payment to another user, and eventually exiting either cooperatively (with operator help) or unilaterally (posting a sequence of pre-signed virtual transactions).

Security, Atomicity, and Scalability Guarantees

The protocol’s formal security model—adapted from the Bitcoin backbone model—proves the following core properties:

• VTXO Security: Unexpired VTXOs in a batch cannot be spent without valid witnesses. Honest users, knowing the signing paths, can always unilaterally redeem their VTXOs onchain before batch expiry even in the presence of a malicious operator.
• Ark Atomicity: Any intent to change offchain state (boarding, transaction, swap, or exit) is either fully applied or not applied at all. There is no partial update or risk of “orphaned” offchain state.
• User and Operator Balance Security: Honest users can always claim their offchain balance onchain (modulo mining fees). The operator, if honest, can reclaim all liquidity it committed to the Ark, less operational and miner fees, after batch expiry.
• Opt-in Fast Finality: For users desiring instant finality, Ark supports an economic accountability mechanism via operator-bonded collateral and a co-signature committee. Double-spend attempts by the operator result in private key extraction and burning of the collateral. Payments are broadcast to a user subset, and receivers wait $2\Delta$ (network latency) to confirm uniqueness.

Ark leverages cryptographic constructs such as 2-of-2 MuSig2 aggregated Schnorr signatures (for efficient threshold signing), Taproot’s flexible key/script path spend policies, and presigned virtual transaction trees (VTXT) to implement atomic batch exits and swaps.

Figure 2: The transaction dependency structure within Ark, detailing collaborative and unilateral spend paths, timelock logic, and virtual transaction trees for efficient, batchable exits.

Fault Analysis and Protocol Corrections

The authors identify two classes of attacks in the testnet implementation: the hostage attack (where an operator cannot reclaim its funds due to naive VTXO chaining) and spam attack (where users repeatedly attempt to double-claim VTXOs). Attack surfaces are mitigated by the introduction of reset transactions and chaining logic which ensure that lost or uncooperative users cannot indefinitely block operator sweeps or batch updates.

Experimental results demonstrate that:

• Batch commitments to arbitrarily large sets of VTXOs incur a constant onchain transaction size of roughly 197 vB.
• Cooperative exits add a single output per user, while unilateral exits for a user from a batch of $n$ VTXOs cost $\lceil \log n \rceil \cdot 150 + 107$ vB.
• Finalizing a commitment transaction for 200 users requires approximately 2.7 seconds, dominating in MuSig2 signing and forfeit transaction construction.

These metrics substantiate the protocol’s strong scaling claims: control plane cost is independent, or at worst logarithmic, in the number of offchain recipients per batch.

Comparison with Existing Layer-2 and Commit-Chain Solutions

Ark is rigorously compared to Lightning, statechains, payment pools, sidechains, commit-chains, rollups, and recent work such as Bitcoin Clique. Ark’s key differentiator is Bitcoin compatibility (no non-standard opcodes or consensus changes), opt-in participation without pre-funding, and an open protocol where receivers can join after-the-fact without prior onchain activity.

• Lightning/PCNs: Requires pre-funding channels, high setup/collateral costs, rebalancing, and only supports transacting parties.
• Statechains: Rely on trusted operators, not robust under Byzantine adversaries.
• Rollups/Plasma: Not natively compatible with Bitcoin; dispute costs can be excessive.
• Payment Pools/CoinPool: Need expanded Bitcoin scripting, all-user interactivity, or consensus changes.

Ark’s approach is unique among commit-chains in allowing per-update participation (only affected users must be online) and minimizing onchain cost.

Practical and Theoretical Implications

Practically, Ark lowers the entry barrier to Layer-2 Bitcoin by eliminating the need for onchain pre-funding and explicit channel creation. The flexibility to receive payments without prior setup, and to exit at will, provides liquidity mobility. Operator obligations are well-defined, with risk mitigation via opt-in economic accountability schemes.

Theoretically, Ark demonstrates that minimal additions to the Bitcoin scripting set (using only standard Taproot) suffice to implement non-custodial, scalable commit-chains. The use of presigned virtual transaction trees and MuSig2 threshold signatures achieves effective covenants under existing consensus rules. The protocol sets a precedent for Layer-2 designs that do not require consensus changes or external committees beyond what is economically incentivized.

Future Directions

Outstanding directions for further work include:

• Multi-operator/federated Ark: Reducing operational centrality risk through distributed operator roles or TEE-based enforceability.
• Liquidity optimization: Mechanisms for external liquidity providers to participate under non-custodial, trust-minimized conditions.
• Reducing exit costs for small VTXOs: Alternative VTXT designs or swap policies to address tail-risk users in congestion scenarios.
• Dynamic committee and penalty design for the fast finality extension, ideally mitigating reliance on existentially honest members.
• MEV and sequencing analysis: Given operator sequencing power is limited to offchain-request aggregation, programmable MEV is structurally constrained, but side-channel application MEV (e.g., via BitVM) remains a sandboxed theoretical risk.
• Rational security against timelock bribes: Exploring integration with bribe-resilient timelock and dispute solutions on Bitcoin.

Conclusion

Ark advances the state of the art for Bitcoin offchain scalability by providing a robust, security-proven commit-chain protocol, with constant onchain cost per batch commitment, unilateral and opt-in fast finality exits, and the lowest-possible entry requirements for new users. Its open architecture, formal guarantees, and practical efficiency render it a viable candidate for scaling Bitcoin payments without protocol changes while maintaining non-custodial operation throughout (2605.20952).