Overview

GOAT Network is a Bitcoin-native zkRollup, purpose-built to turn $BTC from a passive store of value into a sustainable yield-generating asset. It functions as a Type-1 zkEVM, offering full EVM compatibility while preserving Bitcoin’s economic security.

The technical architecture of GOAT consists of: (1) Ziren for high-performance ZK proof generation, (2) a GOAT BitVM2 verification layer designed for zkRollups that provides operator double-spend resistance, is compatible with decentralized sequencers, and uses a multi-round randomized challenge protocol to reach economic finality within 24 hours; and (3) a decentralized PoS sequencer network with slashing to provide censorship resistance and ensure continuous network operation. State commitments/challenge scripts are enforced via BitVM2, with ZK proofs submitted to Bitcoin.

A universal operator model is implemented where all participants rotate through the roles of sequencer, prover, publisher, and challenger. This structure balances costs and rewards through cross-subsidization. All gas fees are paid in satoshis, and the rotating PoS sequencer set recycles those fees—along with its block rewards and captured MEV—back to participants as real yield, which is denominated in $BTC. This ties yield generation directly to real network usage, creating an activity-driven economic model.

Problem Statement

$BTC is valued as a secure and liquid asset, primarily used as a long-term store of value. Yet there is still no reliable way to earn $BTC-denominated yield directly onchain. Most $BTC holders seeking returns must rely on CeFi solutions or convert their assets into wrapped versions of other tokens (held by custodians and issued on other chains).

While these methods are widely adopted, they introduce trust assumptions involving third parties and move away from Bitcoin’s principles of transparency and self-custody. The yield they provide is not native; it is typically subsidized by token emissions, liquidity mining programs, or staking rewards issued by other protocols, often on Ethereum or alternative L1 chains. In many cases, the underlying activity generating this yield involves lending, complex DeFi strategies, or exposure to volatile assets.

Attempts to build Bitcoin L2 solutions, including rollups, have exposed both economic and operational challenges. In many designs, roles such as transaction ordering and state verification are concentrated in a small group of participants. This concentration introduces centralization risks and creates weak incentive structures for cost-intensive roles like data publication, fraud detection, and state validation, which are essential for building credible, long-term public infrastructure. Withdrawal periods back to Bitcoin can last up to two weeks, which limits capital efficiency and downgrades the user experience.

Value Proposition

GOAT Network aims to transform $BTC from a passive store-of-value into an active, yield-generating asset without compromising Bitcoin’s core principles of decentralization, trustlessness, and security.

By using $BTC as gas and integrating decentralized sequencers and trust-minimized bridges, GOAT creates a Bitcoin-secured network that delivers real yield to $BTC holders. Users can stake $BTC, $DOGE, and $BTCB (and other tokens in the future) to earn rewards sourced from onchain gas, MEV, and dApp activity.

GOAT Network ensures unconditional exit rights. Users have the option to withdraw any amount of assets from L2 to L1 via atomic swaps at any time for added security, capital efficiency, and better user experience.

• No Bitcoin Fork Required: GOAT runs on native Bitcoin script using enhanced BitVM2, requiring no protocol changes on the Bitcoin blockchain itself.
• Decentralized Sequencers (Operators): The decentralized sequencer model contrasts with many rollups that rely on a single centralized party. On GOAT, the sequencers perform multiple roles (rotating from one to another): verifying, ordering, and compressing transactions.
• Real-Time zkProofs: GOAT employs in-house Ziren technology to generate validity proofs. These ZK proofs are ultimately submitted to Bitcoin for settlement and verification.
• Native $BTC Yield: $BTC is the gas token, ensuring that revenue from L2 activity (fees) can be directly returned to stakers as rewards. This mechanism forms the basis of the yield model.
• Multi-Asset Staking: At the time of writing, users can stake $BTC, $DOGE, and $BTCB ($BTC on Binance Chain).
• Sequencer Reward Tokenization: Sequencer rewards are wrapped as $yBTC, a yield-bearing $BTC derivative. These can be traded or split into principal and yield, forming the foundation for a $BTC yield market.

Technical Overview

GOAT Network extends Bitcoin’s capabilities by combining offchain computation (on GOAT) with onchain verification (on Bitcoin) without changing Bitcoin’s consensus rules. BitVM2 and BitVM3 are offchain fraud-proof systems that enforce L2 state validity on Bitcoin using Tapscripts, one-time signatures, and pre-signed transactions. When the operator posts a claimed L2 state as a Bitcoin UTXO, it can be challenged within a certain time window using BitVM2 and BitVM3. This is an upgrade to the original BitVM protocol that removes the two-party limitation and allows any participant to challenge invalid computation.

The sequencer, after running Ziren and producing a new valid L2 state, publishes a Tapscript UTXO on Bitcoin. This UTXO commits to the latest L2 state and contains a Tapscript with two branches: one for asserting the state if unchallenged, and one for disproving it if a fraud is revealed. These paths are then used together with a set of pre-signed transactions on BitVM2 & 3 to enforce the verification steps during a potential challenge.

Under the assumptions of optimistic computation, challengers continuously monitor the UTXOs being posted on Bitcoin and, through a multi-round randomized challenge mechanism, validate transactions to detect potential fraud.

At a high level, GOAT Network:

1. Executes EVM computations on GOAT.
2. Compresses the result (L2 state) into a succinct ZK proof using Ziren. That proof is ultimately posted on Bitcoin.
3. Posts a Taproot-locked UTXO to Bitcoin containing the ZK proof, with BitVM2 & 3 logic (dispute path) added to the script.
4. Allows anyone to challenge invalid state transitions via fraud proofs using the BitVM2 & 3 mechanism.

At the core of GOAT’s design is Ziren, its in-house zkVM. Ziren turns EVM transactions on GOAT into constant-sized Groth16 proofs that are posted on Bitcoin. Ziren significantly reduces proof generation time, making GOAT’s implementation of BitVM2 practical for use as a Bitcoin zkRollup.

GOAT introduces a universal operator model that combines multiple roles, sequencer, prover, operator, publisher, and challenger, into a single pool of staked participants, helping to balance the risks and benefits of various specific roles. This model sets a dynamic equilibrium of costs and revenues through role rotation, thereby lowering participation thresholds for small nodes, enhancing decentralization, and improving overall network stability and security. The network uses decentralized sequencers to batch transactions, order L2 blocks, and post state root + proof hash to Bitcoin.

The sequencer or operator posts a bond when submitting the UTXO to Bitcoin, which is slashed in the event the operator is challenged and proven wrong. In GOAT’s optimistic protocol, challengers, not the system by default, trigger Tapscripts in BitVM2 & 3. Without a challenge, these scripts remain inactive, and enforcement hinges on an active dispute.

Computation Layer

Type-1 zkEVM and Modified Op-geth Execution Engine

GOAT is a Type-1 zkEVM that generates validity proofs for standard EVM transactions:

GOAT’s Execution layer repurposes op-geth (Ethereum EVM) for Bitcoin, making EVM smart contracts possible. The Consensus layer runs CometBFT (modern Tendermint). After a transaction goes into a sequencer’s private mempool, validators run a BFT round to agree on the next block. Op-geth executes that block, and blocks are finalized when ≥ 2/3 of validators sign them and live as long as < 1/3 of validators are faulty.

Ziren Proof Generation

Ziren is a production-ready zkVM built by ZKM on the stable and deterministic MIPS32r2 instruction set. This simplifies development because if an app logic has already been audited, there’s no need to re-audit the ZK proof circuits.

Ziren is architecture-agnostic; its core components, the zkCompiler, prover, and verifier, work together to convert high-level code into polynomials, generate ZK proofs, and verify them trustlessly through smart contracts or Bitcoin covenants. Bitcoin covenants are a way for a UTXO to restrict how it can be spent in the future.

Ziren also supports segment verifier circuits, compresses public input commitments, and reduces Bitcoin script complexity via cryptographic hints. These optimizations allow GOAT to implement a challenge-based verification model using native Bitcoin scripts.

Ziren generates validity proofs for offchain computations that are produced per L2 block. ZKM’s Decentralized Proof Network takes these initial Ziren proofs (Root proofs), aggregates them using an aggregation prover, and then passes them to the SNARK prover, which converts them into succinct Groth16 zkSNARKs. Proof generation time reduced to approximately 40 seconds for a block of 100 transactions using GPU acceleration and pipelined proof architecture.

Proof Generation Pipeline

Proving is divided into subtasks, where programs like Minigeth or zkML are compiled into MIPS ELF binaries and sent to a task pool managed by the Stage Service, which splits and assigns them to provers. The prover system, made up of a root prover (generates Ziren proofs), aggregation prover (combines them), and SNARK prover (generates Groth16 proofs), feeds final proofs to the GOAT Node.

The resulting Groth16 proofs are posted to Bitcoin by the operator. In BitVM2, SNARKs are verified offchain and disputes enforce outcomes onchain via pre-signed paths, avoiding script-level SNARK checks and preserving Bitcoin’s security while enabling L2 challenges on L1.

Verification & Dispute

BitVM2 Optimistic Verification

BitVM2 is GOAT’s onchain verification and bridging protocol. Rather than executing computations directly, BitVM2 verifies them, making it conceptually similar to optimistic rollups. Paired with Ziren and decentralized sequencing, it delivers efficient, secure Bitcoin zkRollups. The protocol uses pre-signed transactions and one-time signatures for programmability.

GOAT Network’s optimistic computation enables secure, decentralized asset transfers between Bitcoin and the GOAT Network. It is secured through a one-time Winternitz signature scheme for transaction integrity, a 1-of-n honesty assumption to prevent theft, and a dual slashing mechanism across both the GOAT and Bitcoin layers.

Each phase of the dispute process—Kick-off, Challenge, Assert, and Disprove—is represented as a leaf in a Tapscript tree, each using a Winternitz one-time signature (WOTS) and a corresponding Tapscript. These WOTS keys are pre-generated and pre-signed, ensuring that each step can be used exactly once. All leaves together form a Merkle tree, which combines with an internal key to create the Tapscript output key. This structure is compact onchain and reveals no dispute logic unless one of the branches is spent.

During the multi-round randomized challenge period, anyone can challenge an operator by posting a bond and invoking a challenge script. The operator must then provide computation traces to prove validity. If the challenge succeeds, the challenger earns the operator’s bond; if not, the challenger forfeits theirs.

The mechanism rapidly selects sequential challengers. If an early challenger fails to act on fraud and a later one does, the inactive challenger is slashed and the active one rewarded, creating a fast and economically secure resolution system.

BitVM3

BitVM3 is the natural progression in offchain SNARK proof verification on Bitcoin, building on models like BitVM2 and Delbrag’s protocol. BitVM2 introduced an optimistic computation model, and Delbrag used Yao’s Garbled Circuits (GC) for Groth16; both faced scalability and usability challenges.

Earlier bridges demanded high onchain collateral, tying up capital; BitVM3 slashes this from over $10,000 to under $100 by introducing BitHash and shifting most computation offchain via garbled circuits. This, combined with a ~280 GB offchain storage need costing under $10 per challenger, makes trust-minimized Bitcoin L2 bridges economically viable.

Coordination & Infrastructure

Decentralized PoS Sequencer Network

GOAT is a Bitcoin-native zkRollup that assigns sequencer roles by stake-weighted random rotation. By rotating duties based on each operator’s stake, no single operator can dominate sequencing. The rotation-based design creates balanced incentives and economic fairness.

Operators may incur costs as provers or publishers during one epoch, but they are likely to serve as sequencers and earn transaction fees in another. With sequencing privileges taking turns, no single operator can game the system. Since no operator controls transaction ordering for long, this process keeps incentives balanced and the network resilient.

As operators rotate between roles, the cost burden of resource-intensive tasks like proving is not continuous, lowering the barrier to entry for smaller participants. This enables a broader range of actors to join the network, further decentralizing control. In the event of an operator outage, the rotation mechanism reassigns responsibilities, keeping the network operational.

Sequencers are held accountable through bonded slashing mechanisms. Operators who fail to perform their duties, such as missing their block proposal or experiencing downtime, may be skipped and penalized, while the network proceeds to the next eligible participant.

Universal Operator Abstraction & Economic Model

Universal operator abstraction extends the concept of decentralized sequencers into a broader, unified system where a single set of universal operators shares all critical operational roles.

The primary difference between decentralized sequencers and the universal operator abstraction lies in their scope and incentive design. Decentralized sequencers focus only on distributing the transaction ordering role, while the universal operator model distributes all critical roles.

Each operator must stake $goatBTC ($BTC on GOAT) to be eligible for participation and be held accountable for their assigned roles. If the sequencer double-signs, goes offline, or cheats, the protocol burns their stake and jails their node. Scripts enforce penalties, prevent early exits, and reward honest behavior.

Some roles, like filing a challenge or posting UTXOs to Bitcoin, require locking up an extra bond in the script tree. Anyone can challenge an operator, but if the challenge fails, the challenger’s bond goes to the operator. If an early challenger misses fraud and a later one proves it, the early challenger can be slashed, too. All slashed funds go to the committee, which rewards successful challengers on the L2.

Profits earned during sequencing cycles are used to offset the costs of proving and publishing. Operators can justify occasional high-cost tasks by expecting to earn back during other cycles. The universal operator abstraction also lowers the barrier to entry across all roles. Even if running a proof-of-stake node in certain roles is computationally demanding, operators only need to perform that task periodically.

Trust-minimized Bitcoin-GOAT Bridge

The trust-minimized bridge protocol enables secure asset transfers between Bitcoin and the GOAT Network, guaranteeing that assets pegged into the system are non-custodial under specific security assumptions.

At the core of this architecture is the GOAT BitVM2 operating under a 1-of-n honesty assumption. Computations occur offchain, and Bitcoin intervenes only to resolve disputes, verifying outcomes using Bitcoin Script.

The GOAT Federation, a DAO composed of operators, oversees peg-out requests and triggers offchain computations. Operators act as provers, generating validity proofs for L2-to-L1 withdrawals. The bridge supports two asset transfer types: Peg-In (L1→L2) for deposits into GOAT, and Peg-Out (L2→L1) for withdrawals back to Bitcoin.

Peg-in (Bitcoin to GOAT Network)

• The peg-in process uses Simplified Payment Verification (SPV) to confirm Bitcoin transactions within the GOAT Network. A user initiates a Bitcoin transaction paying into a Taproot script with a 1‑of‑n honesty assumption, with operators preparing two pre-signed transactions.
• Relayers submit the latest Bitcoin block headers to the GOAT Node, which maintains an SPV Merkle root inside the GOAT smart contract. The user then submits a claim and SPV proof to GOAT. Upon verification, the EVM on the L2 PoS layer mints wrapped tokens, while the original $BTC remains locked in the multisig script.

Peg-out (GOAT Network to Bitcoin)

In a typical peg-out where the user requests to withdraw $BTC, the operator advances $BTC to them immediately through an atomic swap. To recover this amount, the operator requests $BTC from the peg-out pool and submits supporting proof.

• Each block finalized on GOAT contains a validity proof, a challenge script, and an asset script, all submitted to Bitcoin by an operator. The process includes three phases: inclusion (user initiates peg-out), commit (proof submitted to Bitcoin), and challenge period (monitoring alerts).
• During the challenge phase, any user may dispute the claim by depositing collateral (e.g. 0.5 $BTC) and demanding that the operator reveal intermediate computation steps. If fraud is proven, the challenger earns a portion of the operator’s funds, while a larger amount is burned. If the challenge fails, the challenger forfeits their deposit, and the operator receives the full amount after a delay.
• Final redemption occurs through a multisig redemption script, which activates once the challenge period ends without dispute. Execution traces for peg-outs are committed using MAST (Merkleized Abstract Syntax Tree) and Tapscript, with each leaf encoding intermediate computation steps. This structure allows verifiers to submit fraud proofs if conflicting trace values are published.
• Multi-round randomized challenge mechanism rapidly selects sequential challengers to finalize the approval.

Data Availability Layer

Data availability (DA) on GOAT runs through a decentralized sequencer commitment scheme integrated with BitVM2. Instead of relying on a centralized party to publish state data, GOAT periodically commits the entire sequencer set (public keys for upcoming sequencers over a two-week window) to the Bitcoin L1 using Tapscript transactions.

This commitment allows any participant to verify the authenticity of sequencer-signed data and reconstruct the full L2 state. Sequencer outputs are signed and linked to this onchain roster, enabling light clients and watchtowers to validate and retrieve state updates independently. The approach eliminates reliance on a single entity, ensuring that state data can always be recovered or challenged by any honest participant.

BitVM2 handles fraud proofs by verifying L2 block execution using Ziren, while assertions reference the committed sequencer set, allowing challenges to confirm both the validity and availability of state transitions.

Target Market

Bitcoin was created to be a permissionless and censorship-resistant peer-to-peer currency. That design choice intentionally favors decentralization and security over throughput and expressiveness: block space is scarce, and the base-layer scripting language is limited. As demand for yield grew, but rich programmability wasn’t feasible on L1, DeFi activity shifted to offchain lenders and wrapped $BTC on more programmable chains, introducing new trust, custody, and censorship assumptions.

To address those tradeoffs without giving up on Bitcoin’s assurances, a new wave of Bitcoin L2s anchors to L1 for settlement while adding EVM-class programmability and higher throughput. On these L2s, $BTC (natively or via representations) can back lending/borrowing, decentralized exchanges, derivatives, synthetics, and performance-linked structures, allowing microtransactions and complex contract execution. Given that $BTC is the largest crypto asset with deep liquidity and persistent demand for yield, these platforms naturally attract both users and developers.

As adoption scales, the combination of Bitcoin’s credibility and security at L1 with extended functionality at L2 can turn idle balances into productive capital for institutions. Governments, public finance bodies, and impact-driven organizations with meaningful $BTC holdings are beginning to explore how Bitcoin-secured L2s might be integrated into public-benefit programs, from sovereign treasury optimization to delivery of social services and climate-resilience initiatives, while keeping settlement anchored to Bitcoin.

Primary Users

GOAT is used by retail and institutional $BTC holders seeking yield, and it extends similar opportunities to $DOGE holders. It also serves DeFi users, liquidity providers, and EVM builders, each with distinct benefits and risks.

Users can choose between different strategies for the $BTC yield generation.

• Safebox solution for people who want Bitcoin investment security without giving up custody control. After depositing into the vault, the user gets a timelocked UTXO directly in their BTC wallet. Once the Timelock expires, $BTC can be spent.
• BTCB/DOGEB Vault receives rewards from sequencer rewards and gas fees.
• Sequencer PoS staking, rewards from gas yield, sequencer rewards, and MEV incentives.
• $BTC derivatives and DeFi yield opportunities on GOAT (lending, liquid staking, DEX LP, etc).

Tokenization Mechanism

The revenue collected by sequencers is tokenized into $yBTC that can be further decomposed to principal $pBTC and $yToken, the pure yield portion, separated from the principal.

The yield mechanism works as follows:

1. Lock $goatBTC into the system (via the sequencer collateral pool). $yBTC is the initial yield-bearing asset, which can then be decomposed into $pBTC and $yToken.
2. The system mints $yTokens and $pBTC.
3. $yToken is the yield portion.
4. It’s possible to:
   • Hold $yToken to accumulate yield.
   • Sell $yToken on the market.
   • Hold $pBTC until maturity to redeem for the underlying $BTC.

The yield is separated from the principal and can be freely traded or used before the lock period ends. A $yToken does not represent a fixed amount of $BTC but a claim on a share of future $BTC-denominated yield. The amount is unknown and variable.

Economic Design

GOAT’s economic model is built around four main ideas that work in synergy to keep the system secure, fair, and rewarding for participants.

• $BTC-denominated gas fees.
• A decentralized sequencer architecture.
• A proof-of-stake (PoS) mechanism.
• An integrated tech-economic framework that ties everything together.

GOAT generates revenue primarily through onchain activity. The revenue collected by sequencers is tokenized into $yBTC. Additional revenue streams are $BTC bridging from the GOAT Network back to the Bitcoin mainnet, where a fixed percentage service fee is applied to the amount being transferred, in addition to the Bitcoin gas fee.

The value is generated by users on GOAT’s dApps, driving onchain activity. With increased activity, more gas fees and MEV are collected by sequencers, resulting in more yield for stakers. As sequencers are chosen based on stake-weighted random rotation, it is in their interest to distribute as much yield as possible, attracting more stakers and increasing their frequency of being a block proposer as a result. With attractive yields across the ecosystem, more participants are interested in staking and thus bridge into the GOAT ecosystem.

The universal operator mechanism balances income and costs, creating an equilibrium in incentives. All operators must stake within the GOAT Network, so they need $goatBTC. This rotation + staking + economic returns mechanism constructs an incentive loop.

Risks and Safeguards

GOAT Network’s architecture combines Bitcoin scripting, the BitVM2 & 3 challenge protocols, Ziren zero-knowledge computation, and decentralized sequencer rotation. While this design aims to deliver high security and scalability, each component introduces inherent risks. At the network layer, flaws in bridge scripts, proof verifiers, or challenge logic could compromise the integrity of all transactions and assets on the L2. At the application layer, dApps running on GOAT face the same execution risks as traditional smart contracts, including logic errors and malicious exploitation.

In addition to technical vulnerabilities, GOAT’s yield-generating mechanisms—such as Safebox and staking—depend on sustained user activity and transaction volume. If active usage declines, the yield flywheel could be impacted, reducing incentives for participation and weakening the broader ecosystem. The table below outlines key risks tied to these technologies and the economic model, along with mitigation strategies.

Risks and Safeguards broken down for chain-level and DeFi-level overview:

FAQ

What is the GOAT Network, and how does it enhance Bitcoin?
GOAT Network is the first decentralized Bitcoin L2 enabling smart contracts, dApps, and native $BTC/$DOGE yields while preserving Bitcoin’s security. It uses BitVM2 for trustless computation, Ziren for fast proof generation, and decentralized sequencers for secure, permissionless transaction ordering.

How does GOAT Network ensure security and decentralization?
GOAT inherits Bitcoin’s security through BitVM2, allowing for proof verification on Bitcoin without forking the underlying chain. It uses decentralized sequencing, a dual slashing mechanism, and an optimistic computation to prevent fraud and ensure honest behavior.

How does GOAT handle asset bridging?
Users deposit $BTC into a multisig, submit an SPV proof, and receive wrapped $BTC on GOAT ($goatBTC). Withdrawals burn wrapped $BTC ($goatBTC), generate a zero-knowledge proof, and release $BTC after a challenge period, with BitVM2 enabling atomic swaps for native security.

What do sequencer nodes do, and how are they rewarded?
Sequencers handle transaction ordering, block production, ZK proof generation, and security commitments. They earn $BTC but face slashing for malicious activity.

What are Ziren and ZKM?
Ziren is a MIPS-based zkVM that allows fast, EVM-compatible smart contract execution with verifiable proofs. ZKM handles proof generation, asset bridging, and efficient Bitcoin verification through a layered zkSNARK architecture.

How does GOAT’s yield model work for $BTC and DOGE holders?
Users earn sustainable native $BTC yield through $BTC-denominated gas, sequencer rewards, and tokenized yield (like $yBTC/$yDOGE).

What tools are available for developers?
Developers can build with Solidity, deploy via Hardhat, and access GOAT’s testnet, faucet, core contracts, and extensive docs. GOAT uses $BTC as gas and includes built-in oracles, a bridge, and full EVM compatibility.

Links

Website

App

BLOG

X

Telegram

Discord

GitHub

GOAT explorer