S15 E43: Sergio Demian Lerner on BitVMX & Layer 2s

The first time I recorded with Sergio Demian Lerner, I nearly missed my flight out of Buenos Aires. The second time, the internet nearly missed him. Halfway through his opening explanation his video froze while his voice kept going, then the picture came back and the audio turned to soup. So we did the sensible thing for a technical deep dive: camera off, thumbnail on, and the architect of Bitcoin's first sidechain talking straight into the livestream from the Argentinian winter.

The backstory lives in S15 E7: the Patoshi research, the early Bitcoin Core bug reports, and the origins of Rootstock, the merge-mined smart contract sidechain he designed. At La Bitconf 2023 he told me BitVM was the best thing to happen in Bitcoin in a long time. A few months later, he and his colleagues had taken Robin Linus's idea apart, rebuilt it around a RISC-V processor, and published the BitVMX whitepaper. I joked that the X stands for ten, so it should be ten times better. "It is in terms of cost," he replied.

From NAND Gates to a CPU

Sergio insisted we start at the beginning. The original BitVM paper let two parties agree on a program far more complex than standard Bitcoin script and use it to decide whether funds move. The catch: your logic had to be translated into a giant circuit of NAND gates. "It would be like hundreds of terabytes of circuit data," as he told me. Exciting and wildly impractical.

The trick that makes any of this work on Bitcoin is that nobody runs the whole program on chain. Only a single step (one gate, or one CPU instruction) ever gets executed there, and only when someone disagrees. Sergio traced the paradigm back to TrueBit on Ethereum in 2017 and prefers his own label. His words: "I would call it the disputable computing paradigm."

You assert something on chain; if nobody challenges you, it stands, and if somebody does, a dispute protocol settles it objectively. Robin's next move was a CPU written in Bitcoin script, with a binary search between prover and verifier to find the one bad instruction in the execution trace. The other gem, in Sergio's view, was using Lamport signatures to carry information between transactions, since Bitcoin script is stateless and each UTXO knows nothing about anything else.

Why Sergio Started From Scratch

As soon as Robin started coding that CPU, Sergio and his friends at Fairgate spotted the problem. "It was very inefficient the way that he was trying to build the CPU," he said. BitVM1 lived for three or four months before being abandoned for BitVM2, which uses a single round and focuses on verifying SNARKs, since the main use case is bridges to sidechains and rollups. The problem is the cost of entering a dispute: you post the intermediate states of the whole computation, which can fill a couple of blocks. "It could cost like $50,000 in fees."

For a sidechain meant to be a financial inclusion tool, where pegging in and out costs tens of dollars, that's a dealbreaker. So Fairgate Labs teamed up with Rootstock Labs to start over, open source and built for production. The result is a RISC-V CPU, which means you can compile ordinary code with GCC and run it in the dispute game. Total dispute cost for both parties, at the time we recorded: "about $400," with a couple of methods on the table to cut that to maybe a third.

That price unlocks new toys. One idea he had been playing with the week before: payment channels built on BitVMX, with none of Lightning's revocation machinery, secured by bonds "below $100." The honest drawback is that, without covenants, BitVMX needs a committee. The good news is the assumption: "you only need one person of this committee to be honest." The committee can also be open, so anyone deploying a protocol on Rootstock can join the bridge's security permissionlessly. "For me that's game-changing," he said.

Covenants & the Planning Trap

What covenant would make sidechains truly trust minimized? "Any covenant will do," Sergio said, OP_CAT included. Then came the footnote bridge marketers skip: a theoretical impossibility result, which he credited to Alexei Zamyatin, says a perfectly trustless bridge can't exist. Long dispute periods and censorship protections get you very close. "But it's never going to be perfect, that's for sure."

His strategic advice was sharper. He has watched teams promise to enter the Bitcoin L2 business as soon as some opcode lands in six months. His verdict on building a roadmap around a soft fork: "That is just ruin your life, wasting your time." The process is too complex and political, and any new proposal can stall the last one. Rootstock's whitepaper instead promises to adopt the best decentralization technology when it arrives, and meanwhile gives Latin America decentralized finance now. (For more on how Alexei thinks about bridges, see S15 E19; for the opcode fight itself, Andrew Poelstra on OP_CAT vs OP_CTV.)

What Makes a Sidechain a Sidechain

I complimented Sergio for skipping the BIP crusade when Rootstock launched and letting miners merge mine. He corrected the romance: they just published, answered questions, and let it grow organically. Fees help, but miners stay for another reason: "they're going to support you if there is an alignment of values between Bitcoin and your sidechain."

That alignment is his real definition. A Bitcoin sidechain has no money token competing with bitcoin. If there's no token you have to pump or stake, "then it's probably a Bitcoin sidechain." Layer 2 is murkier. I brought up wrapped BTC and Citrea; he brought up BOB, an Ethereum rollup calling itself a Bitcoin Layer 2. In his view the strict definition, with an uncensorable exit, will never be reached on Bitcoin, so he uses a softer one: anything that lets you get in and out in the most decentralized way possible. Lightning is a layer 2, but not a sidechain, because a sidechain is actually a blockchain.

Rootstock vs. Liquid & the Return of SPV Proofs

My hot take: Blockstream wrote the sidechains whitepaper, then settled for a federation and called Liquid finished, while Rootstock still aspires to trust minimization. Sergio agreed on the aspiration. He wrote a Drivechain BIP draft himself, and Rootstock's federation was always meant to be temporary. That's why its pegnatories earn nothing for the job. "That was key," he said, because paid members become entrenched and stage a political strike the day a better peg arrives. The HSMs are built on cheap Ledger hardware wallets, and the keys never leave the device even if the host computer is hacked.

Then the part that made me sit up. Blockstream's original SPV sidechain proposal had a proof and a counterproof: I present sidechain blocks with some cumulative work, and you answer with a heavier chain that contradicts mine. BitVMX supports that, he said, while BitVM1, BitVM2 and BitSNARK don't. The verifier can submit a second input to the same program, so anyone secretly self-mining a dishonest chain loses unless they outwork the honest one. "I think we are getting super close to the original Blockstream SPV," he said, except the sidechain no longer has to look like Bitcoin. An Ethereum-style chain like Rootstock works fine.

Bitcoin for the People, Not the Elite

That opened the philosophical core of the episode. You can be a perfectionist and do nothing until the perfect solution arrives, or solve people's problems now with something secure enough to protect them. Sergio picks the second path. "If Bitcoin is for the elite then it's going to be co-opted," he said, "taken over by banks and by ETFs." BitVMX and Rootstock are his "small grain" of contribution. When I ranted about ETF-watching culture, he offered a better frame: bitcoiners hold an ace up their sleeve called unpredictable innovation. "If we do not change Bitcoin in any way then we are very predictable, and then we are in danger."

I unloaded my Lightning grievances next: force-closed channels during the fee spike, rings of fire on Telegram, Raspberry Pis routing over Tor, the drift toward LSPs and custodial ecash. Sergio refused to pile on. "We should not pick the winners," he said. Let there be many sidechains and layer 2s, and let people choose.

He did note that Lightning fees are tied to Bitcoin fees through channel opens and closes, and that rollups posting compressed data to Bitcoin make the same mistake. What's missing is the connected ecosystem Ethereum built, "with all the bad things that they did." On wallets, beyond MetaMask, he said there are probably 20 or more that support Rootstock; his current pick is Enkrypt, a multichain browser extension that plugs into a Ledger or Trezor.

Blind Merge Mining & a Live Message From Paul Sztorc

I pitched fee-paying sidechains as an answer to the security budget problem (Peter Todd's tail emission being the other extreme). Sergio cooled it down. Rootstock's fees to miners are "moderate," extra income rather than a change in the game. If many chains pay miners and some miners can't mine all of them, centralization creeps in, and his fix is Paul Sztorc's blind merge mining (BIP 301), which he stressed is separate from Drivechains. Since BIP 301 only suits ten-minute block chains, he once proposed by email a fast sidechain whose only job is running blind merge mining auctions for the others, dropping old UTXOs: "a super lightweight sidechain that has no past."

He's pro Drivechain, with a builder's caveat: "It must be tried in practice." With BitVMX you can already build something Drivechain-like plus a committee, and since every BitVM-family protocol assumes miners won't censor, each one is "kind of a Drivechain hidden there."

Right on cue, Paul messaged the livestream: LayerTwo Labs had a working Ethereum sidechain with ten-minute blocks and planned a twelve-second EVM layer on top (plus a dig that it was summer in the US). Sergio doubted it solves fast blind merge mining, then conceded, "I should read it first." His real critique was approach: waiting for a soft fork means the tech never gets stress-tested, which he called "kind of, I don't know, sad." Rootstock prefers to build, improve, and prove "this is not just a mind game." Paul's own marathon is S15 E16, and Robin's BitVM story is S15 E13.

Building on BitVMX (Soon)

Outside developers were already asking to contribute. The code is open source on Fairgate Labs' GitHub, but three or four full-time developers were still finishing the core before accepting outside pull requests. The status report was concrete: every CPU instruction coded in the local RISC-V emulator, about half implemented in Bitcoin script, and a proof of concept "in a couple of months." The end goal is a stable interface where you write your app once and "pick your security back end," BitVMX or BitVM2, without changing it. We agreed on a live demo episode once it's ready.

Carbon Credits, Identity & NFTs

I had to ask about a claim from a hugely popular podcast I won't name: a guest said Rootstock works with three-letter agencies to tokenize carbon credits and enslave humanity. "No, I have no idea," Sergio said. He had read a roughly 40-page piece on it that he suspected ChatGPT wrote, name-checking Argentinians he knew from college and meetups. Rootstock is a decentralized chain where anyone can build anything, and Rootstock Labs is transparent enough that he'd have heard of a secret plan. His conclusion: the only connection between all these people "is that they are all from Argentina."

On on-chain identity (I brought up Charles Hoskinson's Kenyan school records), he was blunt: personal data on a permanent ledger depends on cryptography that might break. "I'm skeptical." On NFTs, he's "not particularly interested," but if you want them, "do not spam the Bitcoin network"; put them on a proof-of-work-secured sidechain where they're cheaper and work as DeFi collateral. (In fairness, I did inscribe something live with David Bailey earlier this season.) He also mentioned Rootstock's parallel transaction processing engine, which he said may already be on testnet and lets several threads process EVM transactions at once to push fees down.

The OP_CAT Forecast & No Process

His prediction for the next soft fork: OP_CAT, because it's less controversial and is a kind of fixed point you can't really improve. Timeline: one to three years, two if it happens at all. I called that pessimistic. "That's super optimistic for me," he laughed. I argued it's twelve lines of code, smaller than SegWit. Size isn't the point, he said; the conceptual change is that Bitcoin could restrict future transactions and, recursively, create "kind of non-fungible bitcoins." His hope is that a working BitVM stack shows people the benefits and speeds things up.

When I said one unhappy developer can stall a proposal for years, Drivechains being exhibit A, he didn't pretend to have a fix. Bitcoin has no upgrade process and probably never will, "because as soon as you establish a process you can try to hijack the process." His only wish was discussions that are "a lot less aggressive and more civilized."

That's the Sergio Demian Lerner method in one episode: admit the bridge can't be perfect, cut the dispute bill from $50,000 to a few hundred dollars, ship with what Bitcoin has today, and keep a seat open for covenants if they ever show up. You can follow his writing on Bitslog, his updates on X, and the project at bitvmx.org.

Listen to Sergio Demian Lerner on Spotify, Apple Podcasts, YouTube, and More

Watch on YouTube

Time stamps:

00:00:31 – Introduction: Sergio... again!
00:02:18 – Evolution of BitVM
00:13:26 – Improvements in BitVMX
00:17:11 – Trust-minimized Computing
00:18:34 – The politics of Bitcoin software
00:20:06 – Decentralization and financial inclusion
00:20:55 – Miners' role in supporting sidechains
00:22:09 – Sidechain vs. Layer Two
00:24:44 – Comparison between Rootstock and Liquid
00:28:11 – Technical aspects of BitVMX
00:30:44 – Integration of Ethereum innovations into Bitcoin
00:34:03 – Contributing to the Bitcoin ecosystem
00:34:05 – Bitcoin Culture and Price Dynamics
00:36:10 – Innovation and Staying Ahead
00:37:21 – Failure and Disruption
00:39:36 – Competition and Lightning Network
00:43:18 – Bitcoin Layers and Ecosystem
00:44:28 – Rootstock Wallets and Multichain Integration
00:45:41 – Sidechains and Bitcoin Miners
00:48:10 – Blind Merge Mining and Fast Sidechains
00:49:42 – The development of lightweight sidechains
00:50:50 – Implementing Drivechains with BitVMX
00:51:31 – Proposed blockchain structure and limitations
00:53:18 – Comparing development approaches
00:54:31 – Encouraging BitVMX community contributions
01:00:12 – Addressing conspiracy theories about Rootstock
01:03:07 – Skepticism about identity projects on blockchain
01:04:30 – Live demo plans and promoting Rootstock
01:05:43 – NFTs on Rootstock
01:07:10 – Parallel Transaction Processing Engine
01:08:08 – Prediction for Bitcoin Soft Forks
01:09:56 – Debate on Bitcoin Upgrades
01:12:24 – Challenges of Bitcoin Improvement
01:13:20 – Conclusion