In-depth Analysis of Merlin Chain: How to Fortify the Security Line of 3 Billion TVL

Merlin Chain is launched by the well-known development teams behind BRC-420 Blue Box and Bitmap, supporting multiple types of native Bitcoin assets and an EVM-compatible ZK Rollup Bitcoin layer-two network. From the market perspective, both BRC-420 and Bitmap have shown promising performance in the early stages.

BRC-420 is a new protocol in the Bitcoin ecosystem, with the Blue Box representing its assets. They correspond to the BRC-20 protocol and ORDI cipher. The total supply of Blue Boxes is 10,000, with a floor price of 0.6 BTC. The total trading volume is close to 480 BTC, and the current floor market value is 400 million. Bitmap corresponds to the Metaverse version of the Ordinals protocol, producing blocks along with BTC. Currently, Bitmap adds 144 new blocks per day. On Magic Eden, the trading volume is approximately 600 BTC, equivalent to 40 million, with a floor price of 0.0037558 BTC. The total supply is around 833.2K, with a floor market value of about 200 million.

The success of BRC-420, Blue Box, and Bitmap has indeed helped Merlin Chain build a strong community consensus. Since its launch in early February this year, Merlin’s Seal, which focuses on Fair Launch and Community First, has seen rapid growth in TVL, surpassing $3 billion in less than a month. Partnering projects include MPC wallet service provider Cobo, staking service providers Meson and Stakestone, Layer2 ZKFair, and veteran Bitcoin data platform GeniiData, as well as multi-chain DeFi data aggregator Defillama. Among the $3 billion TVL, Bitcoin accounts for over 50%, with approximately $100 million each in ETH and stablecoin assets. Besides BRC420 and Bitmap, other high-quality assets in the Bitcoin ecosystem, such as ORDI and SATS, also have substantial staking volumes.

While congratulating on the success of Merlin’s Seal, it’s important to understand that Merlin’s Seal should not be equated directly with Merlin Chain. For instance, the impressive TVL data assets supporting Merlin’s Seal at the moment are not directly linked to Merlin Chain. Additionally, since L2Beat has not yet included Merlin Chain, we manually checked and summed up the BTC asset balance of Merlin Chain, which corresponds to an approximate TVL of 500+ BTC, or around $32.5 million, based on L2Beat’s statistical criteria.

Next, we will analyze the prospects of the project from the perspectives of Merlin’s account structure, asset types, security measures, and technical solutions, as well as its ecosystem development.

Chain-Agnostic’s account abstraction

The mainstream wallet address formats for Bitcoin include Legacy-P2PKH, Nested SegWit-P2SH-P2WPKH, Nested SegWit-P2WPKH, and Taproot-P2TR. They represent different encoding rules applied to the same public key derived from a single private key using the Elliptic Curve Digital Signature Algorithm (ECDSA). Additionally, Bitcoin’s mnemonic phrase is a product of HD wallets (Hierarchical Deterministic Wallet), where the same mnemonic can derive multiple private keys, thus controlling multiple public key addresses and corresponding address formats.

For Ethereum, its wallet, public key, and private key system is similar to Bitcoin’s, with the key difference being Ethereum’s use of a different encoding hash function (Keccak-256). To ensure and achieve compatibility with the Ethereum Virtual Machine (EVM), Merlin Chain adopts Ethereum’s existing address scheme, making it highly convenient for users familiar with the EVM ecosystem. However, the challenge lies in how to associate Bitcoin’s public and private key addresses with this system.

To address this challenge, we found the answer in the official documentation: Particle Network’s BTC Connect. Here, Ethereum’s externally owned account (EOA) address can be calculated using Bitcoin’s public key, which is then used to control smart contract accounts for on-chain interactions (please refer to the architecture diagram of BTC Connect for details). It’s worth noting that rather than directly using Bitcoin’s public key to compute the EOA address, the approach involves introducing smart accounts implementing the ERC-4337 protocol. This decision demonstrates courage and foresight. The benefit is that ERC-4337 enables rapid upgrades and iterations involving signature abstraction, paymasters, bundlers, and future features like social login. However, the downside is that key foundational infrastructure (wallets and blockchain explorers) needs to be optimized and adapted accordingly, and ecosystem dApps projects need to synchronize and adapt alongside these changes. For users, this approach may involve a higher learning curve in understanding the concepts and requires some adjustment to past usage habits.

Below are some notes on the experience using the OKX Wallet (BTC):

1. By default, the OKX Wallet (BTC) uses the Taproot-P2TR format to calculate the EVM’s EOA address (Abstract Account Address). When interacting, it uses the BTC wallet for authorization and control of the abstract address.

2. When initiating transactions on MerlinSwap, they are directly signed using the OKX Wallet (BTC) format. At present, there is no option to view or edit gas fees, and the transaction content cannot be confirmed immediately.

3. The blockchain explorer displays the Smart Account as the initiator of the transaction rather than our EOA address. The corresponding called function feature is handleOps, and the parameters encapsulate the actual interaction function.

4. OKX Wallet is a wallet with built-in support for multiple chains. Although we are only using the BTC wallet, OKX Wallet also calculates the associated EVM address in the background. This address may differ from the EOA address generated by Merlin Chain, leading to potential confusion where BTC bridged assets (Merlin_BTC) appear not to have been received.

The entry and exit of native Bitcoin assets

No matter whether it’s Layer2, homogeneous chains, or heterogeneous chains, when it comes to the entry and exit of native assets, the core issue that can never be bypassed is security. Let’s explore some unforgettable memories within the community.

🔹On August 10, 2021, the cross-chain protocol Poly Network was hacked, resulting in over $600 million being stolen. Fortunately, for some reason, the hacker chose to return the funds.

🔹On February 2, 2022, the cross-chain protocol Wormhold was attacked by hackers, resulting in the loss of approximately 120,000 wETH. It wasn’t until February 25, 2023, that Jump Crypto, in collaboration with MakerDAO’s Oasis, initiated a counter-attack to recover the stolen funds from the hacker’s vault.

🔹On March 29, 2022, the multi-signature validator system managing funds on the game side chain Ronin was compromised, resulting in a loss of over $600 million.

🔹On June 24, 2022, the multi-signature system of the Horizon bridge, the main feature of the sharding-based public chain Harmony, was breached, resulting in a loss of approximately $100 million.

🔹On August 2, 2022, the cross-chain bridge Nomad was subjected to a money grab attack, resulting in a loss of approximately $150 million.

In the mournful year of 2022, not only did we witness the collapse of LUNA, the bankruptcy of 3AC, and the scandal of FTX, but also multiple on-chain hacking incidents. We often say that if the entire ecosystem is entrusted with funds in the billions, then the vast funds often accompany a thriving ecosystem, but also imply the Damocles’ sword hidden in the dark forest.

Understanding how the official bridge of Merlin Chain achieves the entry and exit of native assets helps us further analyze the security of assets. Currently, Merlin Chain only supports BTC assets and does not yet support emerging assets such as BRC-20, EVM series tokens, and NFTs. The unified receiving address for Merlin Chain on the Bitcoin network is bc1qgxdqf7837dxe8xkhvctgc499kwh5xw7ap3uwhs. The UTXOs bridged by users are transferred to this P2WPKH address, controlled by a single signature address, without directly setting up a multi-signature mechanism. Referring to how Merlin’s Seal handles BTC, we speculate that it probably uses the Cobo MPC co-management solution.

Returning to Merlin Chain’s bridge asset module, the minting and burning of assets are handled by the BTCLayer2Bridge contract. The minting logic function is unlockNativeToken, which takes the transaction hash for preventing double-spending, the recipient address, and the amount. After authentication and verification of double-spending, the bridged asset minting can be realized. We have not fully experienced the process of burning bridged assets, but from the BTCLayer2Bridge contract, we can see the burn function lockNativeToken, which internally processes the bridge fee. However, we have not yet found the specific code for transferring and depositing the bridged assets into a black hole.

Furthermore, the BTCLayer2Bridge already includes ERC20 and ERC721 minting and burning code. Therefore, Merlin Chain may soon support the bridging of ETH and EVM series assets.

The data displayed on the official bridge page of Merlin Chain is very user-friendly, allowing users to easily find the required address and TxId, and the associated blockchain explorer also provides accurate information. The only downside is that the blockchain explorer may be subjected to DDoS attacks, resulting in data indexing issues.

After experiencing the official Merlin Chain bridge , I also tried using Meson’s Bridge. Transferring BTCB from BNB Chain to Merlin Chain was a smooth process, and the transaction fees were much cheaper compared to the official bridge. Meson’s fee was 0.0009 BTC (approximately 5-7 U), while the official bridge charged a fixed fee of 0.0003 BTC plus dynamic fees, totaling around 20 U or more. It’s worth noting that Meson’s bridge assets use smart contracts deployed on the Merlin Chain itself. After initiating a directRelease transaction on-chain, the assets can only be viewed on the Meson platform initially, and it takes some time before they can be confirmed on platforms like MerlinSwap.

Inherit the security of Bitcoin

Merlin Chain is a zkEVM Layer2 developed by the Lumoz team based on the Polygon CDK framework. The official website summarizes it as a sequencer that sends Layer2 transaction data to the Bitcoin network through decentralized oracles. To understand the specific solution, we refer to documentation from Polygon CDK and Lumoz.

In the Polygon CDK architecture, there are two types of architectures: Rollup and Validium. Merlin Chain adopts the CDK Validium architecture. CDK Validium is described on the Polygon side as a combination of Polygon zkEVM + DAC. This solution provides validity proofs in the form of Ethereum chain multisignatures.

Coincidentally, this aligns with Bitcoin’s Taproot support for multisignatures. In other words, Merlin Chain’s decentralized oracle effectively acts as a DAC. The sequencer of Merlin Chain is responsible for collecting and packaging user transactions, which are then verified and handed over to the aggregator and prover of ZKP proofs (this part is handled by Lumoz’s ZK-POW feature). Through the decentralized oracle, Layer2 transaction data is packaged with hashes and signatures and sent to the Bitcoin network.

We believe that such a solution caters to both the Bitcoin and Ethereum communities, as it allows for maintaining EVM compatibility to swiftly establish an ecosystem, while also rapidly maximizing Bitcoin’s security inheritance. However, there is limited public information available on certain technical details, such as adapting the EVM account model to the Bitcoin UTXO model and the decentralized routing of the sequencer. We look forward to the official documentation being updated in the future to provide more information, at which point we will conduct further research.

A clear stream of ecology

Perhaps due to the need for Merlin Chain to accommodate both Bitcoin and EVM-based abstract accounts, or perhaps because of Bitcoin’s native gas characteristics, the ecosystem development of Merlin Chain faces more challenges and difficulties compared to some purely EVM Layer2 solutions.

As of now, Merlin Chain’s ecosystem overview on DefiLlama shows only one mainstream dApp, MerlinSwap, which contributes almost all of the TVL, reaching $14 million. Currently, no lending and derivatives platforms, as well as NFT marketplaces, have been discovered. However, through official social media channels and various AMA sessions, we have discovered that there are actually many more ecosystem projects in collaboration. These include wallets, infrastructure projects, DeFi platforms, and more.

Apart from some well-known products and platforms, we tend to focus on projects that have innovative mechanisms specific to Bitcoin and a native community atmosphere, such as bitSmiley. From a protocol perspective, bitSmiley can be understood as a combination of the stablecoin MakerDAO and the lending protocol Compound. However, in implementation, bitSmiley proposes an extended version of the bitRC-20 protocol and designs a different liquidation insurance mechanism (bitInsurance and CDP) to overcome the limitations of Bitcoin’s block confirmation time and to be compatible with the BRC-20 protocol. As a key ecosystem product for unlocking Bitcoin liquidity, bitSmiley is worth looking forward to. Previously, bitSmiley released its OG Pass black card through whitelist and public Free Mint, granting holders priority access to bitSmiley products and protocols, as well as future benefits such as bonus points. In the future, we will share further updates based on the progress of bitSmiley.

To avoid security pitfalls, when experiencing ecosystem projects on public chains or Layer2 solutions, we typically check whether the project has undergone security audits and endorsements from security companies, or if they collaborate with bug bounty platforms for rewards. While it may not lead to a direct correlation, considering ecosystem stability and user asset security, Merlin Chain has clearly put a lot of thought into this aspect. Recently, it formed the Merlin Security Council in collaboration with several well-known security companies such as SlowMist, BlockSec, Salus, Secure3, and ScaleBit. In our view, this proactive step is aimed at providing robust support for the future development and construction of the ecosystem.

Based on the aforementioned research, we should all pay more attention to Merlin Chain, especially considering the significant TVL attracted by Merlin’s Seal alone, which demonstrates the future potential of Merlin Chain. Its TVL is expected to reach at least several billion levels. Therefore, after carefully understanding Merlin Chain’s account system, asset bridging, and security, experiencing its ecosystem as much as possible may indeed be the best journey to accompany the ecosystem.

References

Particle Network的BTC Connect：https://developers.particle.network/reference/introduction-to-btc-connect

Polygon CDK：https://docs.polygon.technology/cdk/architecture/cdk-validium-option/

Lumoz:https://docs.lumoz.org/miners-pow/set-up-prover/polygon-zkevm

TVL data and details of Merlin’s Seal:https://geniidata.com/ordinals/index/merlin

bitSmiley’s white paper:https://github.com/bitSmiley-protocol/whitepaper/blob/main/BitSmiley_White_Paper.pdf

Founder Twitter:https://twitter.com/BitmapTech

Geek Web3:https://twitter.com/eternal1997L

0xWizard：https://twitter.com/0xcryptowizard

Bitrili:https://twitter.com/lilyanna_btc

Statement:

1. This article is reproduced from [ArkStream Capital], the original title is “In-depth analysis of Merlin Chain: How to build a secure defense line of 3 billion TVL”. If you have any objections to the reprint, please contact Gate Learn Team, the team will handle it as soon as possible according to relevant procedures.

2. Disclaimer: The views and opinions expressed in this article represent only the author’s personal views and do not constitute any investment advice.

3. Other language versions of the article are translated by the Gate Learn team, not mentioned in Gate.io, the translated article may not be reproduced, distributed or plagiarized.