Hi Weiji,

Could you please expand more on how you plan to "implement a SNARK verifier on Bitcoin’s base layer"?
First, I should clarify that I see this as a long-term option, which will take years. If Simplicity gets activated, we could use it to implement a SNARK verifier on Bitcoin's base layer. But for now, we just plan to experiment with Simplicity on the Liquid sidechain when it gets activated.


For your information, I happen to be the one proposing a new opcode OP_ZKP to enable the Bitcoin network to verify zkp proofs. My proposal requires a soft fork. You may find more information from the email archive here: https://www.mail-archive.com/bitcoin-dev@lists.linuxfoundation.org/msg12601.html

I've seen it; however, I suppose it is hard to establish consensus over some particular kind of op_snark_verify opcode because there are so many competing proof systems with different trade-offs. For example, STARKs are great for a chain state proof as they are scalable and allow for processing huge circuits; however, I would not favor STARKs for an on-chain verifier because there are other proof systems, such as Plonky2, with much smaller proof sizes.

A nice thing about SNARK verifiers is that once we have any verifier, we can use it to wrap other proofs. E.g., we could "compress" the size of a STARK by verifying it in a Plonky2 proof.
Still, Simplicity offers much more flexibility and allows to update verifiers as the research advances.


We might be tackling similar issues and probably could benefit from each other. 

Sounds good! Please join our Telegram group, if you would like to chat about SNARKs on Bitcoin https://t.me/zerosync_chat



Cheers,
Robin