TU Wien Researchers Prove Ark Protocol’s Formal Security, Identify Testnet Attacks

Researchers at TU Wien formally defined the Ark protocol and proved its security, while identifying two attacks in a testnet implementation of the Bitcoin (BTC) layer-2 design.

Ark moves transfers represented by virtual UTXOs, or VTXOs, off-chain on Bitcoin (BTC). An operator combines them into on-chain commitments. Users can receive off-chain payments without first locking funds, and only users involved in a state update need to participate.

The evaluation found an on-chain footprint of about 200 virtual bytes for batches of arbitrarily many VTXOs. For unilateral exits, the analysis estimates O(log n) transactions, each about 150 virtual bytes per VTXO in a batch of n.

The team disclosed the testnet attacks and proposed fixes that were later integrated into the mainnet implementation discussed in the analysis. The security proof applies to the protocol as formally modeled; it does not establish that every Ark implementation is free of vulnerabilities. The research does not establish a market impact.