Pinned post
Shielded CSV ⛊
Verified account This account is verified. Learn more@ShieldedCSV
1 Following 5.6K Followers 133 Posts
Latest posts 5
Excited to open-source Argo!
The most practical trust-minimized Bitcoin bridging:
• Setup time: ~100ms
• Offchain cost: ~10MB
• Onchain cost: ~$8
🤖 Throw your clankers at it and help us harden it
github.com/idealgroup/arg…
The most practical trust-minimized Bitcoin bridging:
• Setup time: ~100ms
• Offchain cost: ~10MB
• Onchain cost: ~$8
🤖 Throw your clankers at it and help us harden it
github.com/idealgroup/arg…
github.com GitHub - idealgroup/argo: Argo: Arithmetic Garbling for SNARK Verifiers Argo: Arithmetic Garbling for SNARK Verifiers. Contribute to idealgroup/argo development by creating an account on GitHub. ⛊ BitVM2 enabled SNARK verification on Bitcoin, but disputes required 4 MB of onchain data.
⛊ BitVM3 cut that to 200 bytes — at the cost of 50 GB of offchain data.
⛊ Argo reduces the offchain data to about 10 MB, making BitVM bridges highly practical.
👨💻 Open-sourcing this week!
eprint.iacr.org/2026/2165
⛊ BitVM3 cut that to 200 bytes — at the cost of 50 GB of offchain data.
⛊ Argo reduces the offchain data to about 10 MB, making BitVM bridges highly practical.
👨💻 Open-sourcing this week!
eprint.iacr.org/2026/2165
Aggregated lattice-based signatures offer another approach to making Shielded CSV quantum-resistant without compromising on throughput
x.com/LayerZero_Core…
x.com/LayerZero_Core…
New from LayerZero Research: Aerie.View quoted post on X
A new system capable of aggregating 32,000 post-quantum Falcon signatures in just 0.65 seconds on a MacBook Pro.
ML-DSA, NIST’s standardized default, is already working inside Aerie at high performance.
layerzero.network/blog/introduci…
Shielded CSV lets us do post-quantum Bitcoin transactions without sacrificing throughput—large proofs stay off-chain, the chain only stores a tiny nullifier.
Post-quantum transactions that require only 96 bytes on-chain:
@will_wjk (Imperial College) et al. published a very interesting variant of Shielded CSV, called Compact Shielded CSV.
I've always thought the CSV model is attractive in a PQ setting: the blockchain only stores the nullifier, so miners don't have to verify a signature before it gets into a block. Compact Shielded CSV goes a step further: the on-chain nullifier carries no signature at all, only what they call a "degriefer". Pre-quantum that's more than Shielded CSV's 64 bytes, but post-quantum it's much less.
Unlike Shielded CSV, which operates on top of Bitcoin, Compact is its own blockchain. That matters for the degriefer: a Compact miner who includes a nullifier with an invalid degriefer can't claim the block reward. Shielded CSV could adopt the degriefer, but on Bitcoin there is no such penalty. Anyone who sees your nullifier before it's confirmed can front-run it with bogus copies for ~100 bytes of fees each, and your spending proof then has to show for every one of them that it's invalid. This is something we deliberately avoided in the design of Shielded CSV. With PQ signatures as large as they are, it probably is a reasonable trade-off.
Compact also never discusses reorgs, which are a significant part of the Shielded CSV design. Integrating the degriefer into Shielded CSV would require combining it with the existing reorg handling.
arxiv.org/pdf/2609.32015View quoted post on X
