S15 E65: Avihu M. Levy on ColliderScript, Covenants Without Soft Forks & Bitcoin's Research Renaissance

The paper was four or five days old when I went live with one of its authors. I had been on a bus, turning over everything I thought I knew about OP_CAT and how it would let STARKs land on Bitcoin. Then ColliderScript showed up and made a lot of that homework feel obsolete. Here was a way to enforce covenants at a brutal cost, with no soft fork at all.

I called it one of the most important Bitcoin breakthroughs in months. "I think this is the hackiest thing since BitVM," I said at the top of Season 15 Episode 65. "It enables anyone to build covenants at a very high cost but without a soft fork." Price action is the predictable part of this industry. Permissionless script tricks are not.

I also introduced Avihu M. Levy as a scientist at StarkWare. That claim did not survive the first minute.

I'm No Scientist, I'm StarkWare CPO

"I'm no scientist, I'm StarkWare CPO," Avihu said, after thanking me for the invite and offering a tiny correction. Avihu has been with the company from the beginning and sounded proud of that, not defensive. This was a product person who had gone hunting through Bitcoin script, not someone asking to be filed under the lab coat.

Avihu has been actively involved in Bitcoin since 2011. The background is electrical engineering and physics, with a love of economics sitting next to that. Two things pulled Avihu in. One was "the revolutionary economical story and value and ideology" that felt familiar. The other was being a nerd who wanted to do things personally. Bitcoin was a beautiful opportunity for both, and Avihu has stayed involved ever since.

The Script Length Ceiling, Then Taproot

Avihu wanted to start with the longer story of covenants, not the PDF abstract. For a long time Bitcoin scripts were limited, and from Avihu's point of view the brutal constraint was not only the missing opcodes. It was length. People tried creative tricks, Avihu included. You could do beautiful things and still not get very far, because the script ran out of room.

About four years before this conversation, Avihu took a first real look at covenants and came away convinced that OP_CAT was the missing piece. "Without CAT, there are complex tricks that we can do, but the length of the script will make them all probably prohibitively expensive and impossible." So the idea went on the shelf.

Then 2024 got loud. Avihu first heard from the founder of a company called QED that people were experimenting with scripts that emulate various opcodes. I mentioned Bitcoin OS, which makes a similar claim about emulating covenants. Avihu pointed somewhere more structural. The root of BitVM, of the work around Robin Linus, and of ColliderScript itself was Taproot. "Suddenly people could write scripts that were up to 4 megabytes long."

That is a different planet from the old script ceiling. Multiplication is the toy example Avihu likes. Bitcoin used to have a multiply opcode; it has been gone for a long time. You can still emulate multiplication with a pile of additions, but before Taproot that ate a painful chunk of the maximum script. After Taproot the extra work fit. Once people could add, they could multiply. Once they could multiply, they could even emulate hash functions. Capabilities filed under impossible started coming back.

"Taproot, on purpose or by accident, brought back the scientists and researchers," Avihu said. People looking for innovation suddenly had room to play with more complex ideas.

A Research Renaissance, Not a Ruin

I could not resist the other half of that sentence. There are people, including what I called on air the Ocean mining cult members, who say Taproot ruined Bitcoin by inviting too many non-monetary use cases onto the chain. I do not share the funeral mood. "I am happy that the builders are coming back to this chain and they're discovering how to do stuff that was previously possible only on Ethereum but also in a more elegant way."

Avihu did not want that point turned into a cartoon about new casino chips. Plenty of serious people are aiming the same research at the old jobs: payments, swaps, privacy. "All those things will benefit eventually from this research." The work is not only about inventing a new cosmos of use cases. It is also about making the native ones better, more secure, less dependent on third parties, more efficient, more scalable.

Taproot unlocked BitVM. It unlocked ColliderScript. Avihu said, with a nice level of certainty, that we still do not know everything it unlocked. What we already know is that it enabled the complex operations that pull more cryptography and more researchers into Bitcoin. Bitcoin is better than gold because you can program it. That technological edge is part of why it has value, even if some commentators forget this while they explain the chart.

This conversation landed in the same November stretch as my talk with David A. Johnston about Bitcoin 2.0 and the old habit of telling builders to take their extra functionality somewhere else. They came back anyway. They just brought longer scripts.

Two Script Worlds That Could Not Talk

I had the Cryptology ePrint page open while we talked: paper 2024/1802, ColliderScript: Covenants in Bitcoin via 160-bit hash collisions. The authors are Ethan Heilman, Victor I. Kolobov of StarkWare, Avihu M. Levy of StarkWare, and Andrew Poelstra of Blockstream. I called Andrew the head of research at Blockstream and asked if that was right. Avihu said it was.

The technical picture, as Avihu told it, starts with a split inside Bitcoin script. On one side are the opcodes that can hash and verify signatures. The paper calls this family Big Script, or large script. On the other side is Small Script: arithmetic, bitwise operations, additions, emulated multiplications, even emulated hash functions. Small Script can do clever computation. It cannot see the transaction the way you need if you want a covenant.

Covenants need introspection. You have to know, from inside the script, what is in the transaction you are signing. Today the only way to get that information is by proxy through the signature, a compressed stand-in for the transaction data. That part is amazing. The trouble is the two families cannot share the news. In the large-script world you can verify a signature and know it represents the transaction, but you cannot open it and inspect the details. In the small-script world you can inspect claimed transaction data and check whatever you want, with no way to know the signature is valid. "Those worlds, they couldn't communicate with each other."

The missing bridge is almost embarrassingly specific. "You want the big script world to tell the small script world that they're dealing with the same signature. And if you have that, you have covenants."

Once Avihu saw that, the rest of the paper became a hunt for a messenger. Large script has only a few useful verbs: verify signatures or compute hashes. "I was forced basically to go to the hash path." The question is how a script can conclude that it is dealing with the same element by computing hash operations alone. The method is a hash-collision based equivalence check over 160-bit functions, announced on the bitcoin-dev mailing list a few days before we recorded. If the expensive collision lines up on both sides of the bridge, the two worlds are talking about the same object.

Covenants Add a Second Dimension

Before going further I had to pause for the people who pay for the lights. SideShift will swap your bull-market stablecoins for free-market money without an account. Layer Two Labs keeps pushing Drivechains and an alternative soft-fork path called CUSF, plus Signet sidechains you can actually try, including a Zcash sidechain and an Ethereum sidechain. Hodling.ch is the Swiss self-custody shop for people who suddenly have too much bitcoin and do not want a single point of failure. And StarkWare, whose work is the reason this episode exists, builds STARK-based ZK rollups that do not need a trusted setup. Nathan from their side had told me the previous week that I talk too fast.

Why bother with covenants at all? Bitcoin today has a simple spending rule. If you want to spend a UTXO, you need to know something. That something can be simple or elaborate, but anyone who knows it can take the coins and spend them however they like. Timelocks are the main exception. Ignoring those, you cannot enforce a specific way to spend. "Covenant adds another dimension. It basically says not only who can spend or what do they need to know in order to spend, but how can they spend?"

That second dimension is how you hold state and keep persistent logic on the Bitcoin chain, the thing people sometimes just call contracts. If you can do that, Avihu argued, you can improve scale and privacy. The community has spent years arguing about the safest, cheapest, most secure way to get there.

From StarkWare's side the motivation is concrete. The company works on STARK proofs as scaling technology. To matter for Bitcoin users, those proofs need a way to hold shared state: coins that belong to many people, the way a centralized exchange holds balances, except that the rules for claiming and transferring them run so that nobody can cheat, including whoever created or operates the system. "This requires covenants."

Avihu's read of the room in late 2024 was that the old debate is mostly over. "Most of the community are under the impression that covenants are good and desired property for Bitcoin, and the only question is how do you get to it rather than do you want it." The strongest evidence was the cluster of papers that had landed within a couple of months: BitVM, Bitcoin PIPEs, and ColliderScript. Three different breakthroughs, all circling more complex ways to scale Bitcoin, all either providing a path to covenants or benefiting from them. "Covenant is what will enable the really golden age for Bitcoin in terms of scale and privacy."

I put it more bluntly: it is not about the covenant itself, but about what you can build with it. Avihu agreed.

You Will Never Map Every Future

The average user still has no picture of how any of this changes a Saturday morning payment. I have also heard the darker version: if covenants let you build almost anything, they are dangerous, because you never know when something evil will crawl out and wreck the system.

Avihu has heard that argument many times. The reply was to look at Taproot. Nobody could predict everything it would bring. People asked whether it was good or bad for Bitcoin, pointed at benefits A, B, and C, and admitted some risks. "I don't have a machine in the inventory where I can say now I look and I see all the possible futures." What humans can do is debate the futures they can see and decide whether the net sum is good. If it is, do the change. If it is not, don't. "I can't live with a claim that says we don't know what exactly it will bring, because we will never know what exactly it will bring."

StarkWare tried to make that debate expensive in the useful sense. The company set aside a $1 million OP_CAT research fund and asked people to show both sides. Can you create good things with CAT? Can you create bad things with CAT? Write in, show the work, apply for a grant. Avihu said they had already received some very nice applications, not moon-math but things that could improve the life of bitcoiners today. If you think you can present a bad outcome of CAT or of any other covenant proposal, come and research it properly. That is how you reach a conclusion. Avihu gave the Bitcoin community credit for spending the last four or five years doing exactly that kind of homework.

33 Hours to Spend, 450,000 Years to Break

I read the abstract out loud, because the numbers are the whole joke and the whole warning. ColliderScript introduces a method for enforcing covenants on Bitcoin outputs without requiring any changes to Bitcoin, by designing a hash-collision based equivalence check that bridges limited Big Script to Small Script. "The work to spend our covenant is about 33 hours of the Bitcoin mining network, whereas breaking our covenant requires 450,000 years of the Bitcoin mining network."

Thirty-three hours of the entire mining network is a ridiculous way to move coins. It is also an honest proof of possibility.

The backstory is funnier than the abstract. In April, Avihu presented the idea internally, including to Victor I. Kolobov, a StarkWare researcher and product manager with a PhD in cryptography. They ran a couple of improvement rounds. The first version needed 2^80 memory, which is not feasible. Each pass reduced memory and improved the construction. Shortly after that, a StarkWare colleague named Francis heard Andrew Poelstra mention a similar direction at a conference, together with Ethan Heilman. Avihu emailed them immediately. They met over video. The ideas really were pointing the same way. Then the thread went quiet. Avihu was happy enough with the result, put it aside around May, thought about presenting it at a Bitcoin Prague event that did not happen, and moved on.

In July someone asked about it on Twitter after Andrew spoke about the idea on a podcast. Ethan messaged Avihu: what about actually writing this thing? They said yes. Avihu brought Victor. Ethan brought Andrew. They worked very hard for another two and a half months until it was not a slide deck but a specified way to create a script you could actually use. One moral Avihu wanted on the record: ask questions on Twitter. That is how the paper got written.

They are convinced it can get cheaper. Avihu would not sign a promise for a 50x improvement tomorrow, but the gut feeling was that implementation work and the off-chain side could move the cost a lot. "If the cost today is 50 million, maybe it can bring the cost down to 5 million or to 1 million," or even toward $500,000. It will remain expensive. At half a million dollars, some unpredictable use case might already want it. Somebody might even build hardware for it. Even if none of that happens, the contribution is already a construction that works, at a ridiculous price, with room to get less ridiculous.

A Beautiful Idea That Did Not Belong in a Drawer

I asked the cynical question, because it is the one covenant politics always reaches for. Did they build this just to prove what OP_CAT can do, so that a later soft-fork conversation about CAT, CTV, or some other covenant opcode would sound more serious? Show the use cases the hard way, then point out that a real opcode would do the same job for less?

"First of all, I will be 100% honest with you. I did it because it's cool and because it's fun." Working with Ethan, Andrew, and Victor was a pleasure. "It didn't make sense to keep such a beautiful idea in the drawer. We wanted the world to know about it as well." That was the first motivation.

The side effect is the political one I was probing. People can now say they have covenants on Bitcoin today. The first reaction, Avihu predicted, will be that this is nonsense: "covenants for $50 million aren't really covenants." Fine. Avihu is convinced the cost can be pushed toward around a million dollars. That is still not enough for 99% of use cases. Maybe 1% becomes interesting. Maybe someone finds a way to do a huge computation once and then make later covenant spends much cheaper. "We can't predict what innovations will follow."

Even if none of that arrives, the paper does what I hoped it would do. It sits next to the other workarounds: expensive covenants, cutting-edge cryptography covenants, pre-signed templates instead of covenants. The community clearly wants to do these things and is collecting hacks while it waits. ColliderScript is another workaround on the table. "It's a stronger and stronger signal that we need something instead of all those workarounds that is straightforward, inexpensive and secure." Avihu had just seen a slide from Ethan Heilman at OP_NEXT in Boston making the same point.

If We Could, We Would Have Built on Bitcoin a Long Time Ago

I had about a minute left and a question I keep hearing in comment sections. StarkWare is suddenly everywhere: conferences, research grants, an attempt to bring STARKs to Bitcoin. Some people treat any well-funded outsider as an attack. What is the endgame?

Avihu went back to 2011. Eli Ben-Sasson, whom I had on earlier this season for a longer walk through STARKs, rollups, and privacy, gave a talk at a Bitcoin conference in 2013 that preceded everything they did. "If we could, we would have built on Bitcoin a long time ago." Seven years before this interview, Avihu felt, the community was not ready and the technology was not in a form you could drop onto Bitcoin. Like many things in this ecosystem, you iterate elsewhere, make the design more concise, and come back when both the tech and the social layer can bear it.

What they want is not mysterious. "Enable Bitcoin and bitcoiners to do things in a more scalable way, in a more private way, in a more secure way," and unlock a wider set of opportunities. That is why they are looking at Bitcoin now, and why Avihu thinks Bitcoin may finally be more ready, technically and socially.

I asked whether Ethereum would keep sitting beside Bitcoin as extra functionality, or whether Bitcoin would absorb everything Ethereum currently does. Avihu would not make that prediction. The hope was simpler: more people using Bitcoin and blockchain technology, with scale, privacy, and a broader range of execution available on Bitcoin so those people can bring their work here.

Last question: the shortest possible explanation of why STARKs matter for Bitcoin. "In Bitcoin and in blockchain, it's very, very important that everyone verifies their own integrity, and usually you can't verify directly integrity of too many things. And STARKs just give you the ability of verifying the integrity of many, many, many, many things [in] just one operation. It's just like, instead of verifying integrity of the whole world, you verify integrity of one STARK proof and you're done."

That is the through-line from a 2011 nerd to a four-author hash-collision paper to a 44-minute live stream that about 500 people watched on short notice. Covenants without a soft fork are still a rich person's party trick. They are also proof that the builders came back, with one more expensive workaround sitting on the table.

Follow Avihu at @avihu28. Read the paper. Then decide whether you want the hack or the opcode.