BABE: Verifying Proofs on Bitcoin Made 1000x Cheaper

Endowing Bitcoin with the ability to verify succinct proofs has been a longstanding problem with important applications such as scaling Bitcoin and allowing the Bitcoin asset to be used in other blockchains trustlessly. It is a challenging problem due to the lack of expressiveness in the Bitcoin scripting language and the small Bitcoin block space. BitVM2 [LAA + 25] is the state-of-the-art verification protocol for Bitcoin used in several mainnets and testnets [Bit25a, Cit25, BOB25a], but it suffers from very high on-chain Bitcoin transaction fees in the unhappy path (over $14, 000 in a recent experiment [LAA + 25]). Recent research BitVM3 dramatically reduces this on-chain cost by using a garbled SNARK verifier circuit to shift most of the verification off-chain [Rub24, Lin24], but each garbled circuit is 42 GiBytes in size, so the off-chain storage and setup costs are huge. This paper introduces BABE, a new proof verification protocol on Bitcoin, which preserves BitVM3's savings of on-chain costs but reduces its off-chain storage and setup costs by three orders-of-magnitude. BABE uses a witness encryption scheme for linear pairing relations [GKPW24] to verify Groth16 proofs. Since Groth16 verification involves non-linear pairings, this witness encryption scheme is augmented with a secure two-party computation protocol implemented using a very efficient garbled circuit for scalar multiplication on elliptic curves. The design of this garbled circuit builds on the recent work of Argo MAC [EL26], a garbling primitive that efficiently computes homomorphic MACs on such curves.