Skip to content
Blockchain LabTHE VENTURE STUDIO

LibraryScaling2017Design paperCorpus record

A scalable verification solution for blockchains

TrueBit. Jason Teutsch and Christian Reitwiessner.

Pay a solver to run a heavy computation off-chain, and pay a verifier only when they find a lie. An interactive game narrows the lie to one step. A jackpot is there so verifiers show up even when solvers are usually honest.

TrueBit pays someone to re-run a heavy computation only when they smell a lie. An interactive game pins the lie to one step. A jackpot pays verifiers so they still show up when solvers are usually honest.

The five-minute read

The verifier's dilemma

If solvers are almost always honest, checking does not pay, so nobody checks, so solvers can stop being honest. The jackpot manufactures an occasional error so the business of checking does not die.

Bisection

Challenger and solver narrow the execution trace until one instruction is in dispute. The chain executes that instruction, not the program. That is the scalability claim.

Deposits make lying expensive

The solver bonds the result. A lost game pays the verifier. Without a bond, the game is a debate club.

The window is the attack

If the verifier cannot get the challenge on-chain before the timeout, the false result stands. Censorship of challenges is the solver's strategy.

One action, walked through

  1. A solver posts a result and a deposit for a task the chain will not re-run.
  2. Verifiers re-execute off-chain.
  3. A verifier who disagrees starts a challenge before the timer ends.
  4. Both parties bisect the trace over several rounds until one step remains.
  5. The chain computes that step. The loser pays. If nobody challenges, the result is accepted.

The argument, unpacked

Incentives are part of correctness

A dispute game with no one paid to play is an honour system. TrueBit's awkward jackpot is an admission that the cryptography of the game is not the whole mechanism. The economics have to keep a verifier alive.

Optimistic rollups inherited the shape and dropped the jackpot

They assume someone will challenge because a bond pays them, and they publish the data so a challenge can be built. They are descendants, not deployments of this paper. The virtual machine and the bond math differ.

What has to be true

  • At least one verifier is watching and can post a challenge in time.
  • The execution trace can be bisected. A program that cannot be stepped cannot be judged this way.
  • The on-chain step executor matches the off-chain interpreter. A mismatch decides the game wrongly.
  • Deposits exceed the profit from a successful lie.

What happened after the paper

TrueBit did not become the standard scaling layer. Optimistic rollups took interactive fraud proofs, added a publication rule for the data, and attached them to Ethereum. The verifier's dilemma the paper named is still the right objection to any system that says 'someone would have challenged'.

What to check before you use the idea

  • Who is paid to verify when results are usually correct?
  • How long is the challenge window, and can challenges be censored?
  • Can the trace be bisected to a single step the chain can run?
  • Is the bond larger than the gain from cheating?

Terms

Verifier's dilemma
If cheating is rare, checking does not pay, so cheating can become safe.
Bisection game
A challenge that repeatedly halves an execution trace until one disputed step remains.

The problem the paper names

Every node re-running every heavy program does not scale. TrueBit asks how a chain can check a result it cannot afford to recompute, without trusting the solver.

What the design proposes

  • Solvers post results and a deposit.
  • Verifiers can challenge. The game bisects the execution trace.
  • A forced error, the jackpot, gives verifiers a reason to exist when challenges are rare.

How the mechanism is specified

  • The chain judges one instruction, not the whole trace. That is the cost saving.
  • The jackpot taxes honest solvers occasionally so the verification market does not die of boredom.
  • The timeout of the game is a liveness parameter. A censored verifier is the way the solver wins.

What this page does not treat as proven

  • Interactive games delay finality by the length of the challenge window.
  • The paper's incentive story is delicate. A verifier market that nobody joins does not secure the result.
  • Optimistic rollups took the dispute-game idea and changed the virtual machine, the bonds, and the data rules. They are not TrueBit.

Why a venture studio still reads it

Any design that says 'we only re-execute on challenge' owes this paper an answer: who is paid to look, and what happens if they are censored until the window closes.

This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.

Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.