This is only true in a very loose and rather useless sense. This isn't because of some weakness of the BitVM construction, these are products of limitations of

This is only true in a very loose and rather useless sense. This isn't because of some weakness of the BitVM construction, these are products of limitations of Bitcoin itself. As far as I understand, all possible settlement pathways have to be predetermined. They can't be chosen/constructed on the fly according to the circuit. It also has a pretty restrictive prover-verifier relationship. If the prover lies then the verifier can force a recovery pathway, but if the verifier fails to perform their duties then the prover can choose the settle the construction in any of the predetermined settlement pathways. The only ways that that would work would require some trusted third party to sign off on the other outcomes. They can also, of course, collude to settle the contract in any arbitrary way, meaning that the verifier has to be trusted by third parties. There's also no obvious way to chain instances of this construction in an arbitrary data-dependent way. There's also large communication costs, where two hashes have to be exchanged for each wire in the circuit, which adds up a lot when you'd want to do nontrivial circuits. Although I can imagine someone could invent some clever construction to deterministically generate wire commitments in a way that each party could agree on, but I'm not sure what it would look like though given the constraints Bitcoin has. So it's only possible to build a "Bitcoin-on-Bitcoin" with it if you don't care about moving funds between it and the host Bitcoin ledger or being able to be trusted by anyone other than the parties actively involved in executing the construction (like you could do with a rollup), which means it's useless as a thing to improve throughput. It states in the paper that a more practical construction should be used in a real use-case. I'm still a little bit fuzzy on the details so I might be slightly off here. It's a very cool construction, and it's pretty neat that it's doable on Bitcoin today without modifications to the core protocol. Bitcoin only needs a couple of very minor modifications in order to enable basically anything-on-Bitcoin, which I sketched out [1] a while back that got some attention and further work [2]. [1] https://tr3y.io/articles/crypto/bitcoin-zk-rollups.html https://tr3y.io/articles/crypto/bitcoin-zk-rollups.html [2] https://bitcoinrollups.org/ https://bitcoinrollups.org/