Optimistic ZK verification using MATT

In MATT, OP_CAT is only used for the purpose of creating vector commitments, as that enables checking Merkle proofs; other opcodes like OP_PAIRCOMMIT/VECTORCOMMIT would do the job, too.

About the need for a covenant: it is used in order to execute a protocol as an arbitrary state machine across multiple UTXOs, where each ‘transition’ can do some computation on the state committed in it (if any), and dynamically compute the state for the ‘next step’ (which corresponds to a different node in the state machine of the protocol). Fraud proofs for any computation are a use case. Notably, no presigned transaction is needed for such protocols, as all the possible futures are directly preprogrammed in Script thanks to the covenant.

I sketched the fraud proofs in the initial post about MATT (starting from Commitments to computation and fraud challenges), with a toy example here. There’s also a python implementation of the bisection protocol, which contains a formal description in the comments.

I collect all the resources related to MATT at https://merkle.fun, if you’re interested to go more in-depth on any of these topics, or check the existing code. Please don’t hesitate to reach out if you have any question.

3 Likes