LibraryScaling2017Design paperCorpus record
A scalable verification solution for blockchains
TrueBit. Jason Teutsch and Christian Reitwiessner.
Pay a solver to run a heavy computation off-chain, and pay a verifier only when they find a lie. An interactive game narrows the lie to one step. A jackpot is there so verifiers show up even when solvers are usually honest.
TrueBit pays someone to re-run a heavy computation only when they smell a lie. An interactive game pins the lie to one step. A jackpot pays verifiers so they still show up when solvers are usually honest.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 4
- Records linked
- 5
Code
Source, repository, and what is actually hosted
- TrueBit white paperhttps://people.cs.uchicago.edu/~teutsch/papers/truebit.pdf
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
The verifier's dilemma
If solvers are almost always honest, checking does not pay, so nobody checks, so solvers can stop being honest. The jackpot manufactures an occasional error so the business of checking does not die.
Claim 02 · Paper model
Bisection
Challenger and solver narrow the execution trace until one instruction is in dispute. The chain executes that instruction, not the program. That is the scalability claim.
Claim 03 · Paper model
Deposits make lying expensive
The solver bonds the result. A lost game pays the verifier. Without a bond, the game is a debate club.
Claim 04 · Paper model
The window is the attack
If the verifier cannot get the challenge on-chain before the timeout, the false result stands. Censorship of challenges is the solver's strategy.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 The verifier's dilemma
Observation
What the study says
If solvers are almost always honest, checking does not pay, so nobody checks, so solvers can stop being honest. The jackpot manufactures an occasional error so the business of checking does not die.
Model
What has to hold
At least one verifier is watching and can post a challenge in time.
Falsifier
What would retire it
Who is paid to verify when results are usually correct?
02 Bisection
Observation
What the study says
Challenger and solver narrow the execution trace until one instruction is in dispute. The chain executes that instruction, not the program. That is the scalability claim.
Model
What has to hold
The execution trace can be bisected. A program that cannot be stepped cannot be judged this way.
Falsifier
What would retire it
Can the trace be bisected to a single step the chain can run?
03 Deposits make lying expensive
Observation
What the study says
The solver bonds the result. A lost game pays the verifier. Without a bond, the game is a debate club.
Model
What has to hold
At least one verifier is watching and can post a challenge in time.
Falsifier
What would retire it
Can the trace be bisected to a single step the chain can run?
04 The window is the attack
Observation
What the study says
If the verifier cannot get the challenge on-chain before the timeout, the false result stands. Censorship of challenges is the solver's strategy.
Model
What has to hold
At least one verifier is watching and can post a challenge in time.
Falsifier
What would retire it
How long is the challenge window, and can challenges be censored?
03 Sequence
One action, as an operating tape
- 01A solver posts a result and a deposit for a task the chain will not re-run.
- 02Verifiers re-execute off-chain.
- 03A verifier who disagrees starts a challenge before the timer ends.
- 04Both parties bisect the trace over several rounds until one step remains.
- 05The chain computes that step. The loser pays. If nobody challenges, the result is accepted.
04 Load-bearing
The argument, and where a pitch drops it
Incentives are part of correctness
The cut
A dispute game with no one paid to play is an honour system. TrueBit's awkward jackpot is an admission that the cryptography of the game is not the whole mechanism. The economics have to keep a verifier alive.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Optimistic rollups took the dispute-game idea and changed the virtual machine, the bonds, and the data rules. They are not TrueBit.
Optimistic rollups inherited the shape and dropped the jackpot
The cut
They assume someone will challenge because a bond pays them, and they publish the data so a challenge can be built. They are descendants, not deployments of this paper. The virtual machine and the bond math differ.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Optimistic rollups took the dispute-game idea and changed the virtual machine, the bonds, and the data rules. They are not TrueBit.
05 Register
What has to be true
Model · Not re-measured
At least one verifier is watching and can post a challenge in time.
Model · Not re-measured
The execution trace can be bisected. A program that cannot be stepped cannot be judged this way.
Model · Not re-measured
The on-chain step executor matches the off-chain interpreter. A mismatch decides the game wrongly.
Model · Not re-measured
Deposits exceed the profit from a successful lie.
06 Divergence
What happened after the paper
TrueBit did not become the standard scaling layer. Optimistic rollups took interactive fraud proofs, added a publication rule for the data, and attached them to Ethereum. The verifier's dilemma the paper named is still the right objection to any system that says 'someone would have challenged'.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
Every node re-running every heavy program does not scale. TrueBit asks how a chain can check a result it cannot afford to recompute, without trusting the solver.
What the design proposes
- Solvers post results and a deposit.
- Verifiers can challenge. The game bisects the execution trace.
- A forced error, the jackpot, gives verifiers a reason to exist when challenges are rare.
How the mechanism is specified
- The chain judges one instruction, not the whole trace. That is the cost saving.
- The jackpot taxes honest solvers occasionally so the verification market does not die of boredom.
- The timeout of the game is a liveness parameter. A censored verifier is the way the solver wins.
What this page does not treat as proven
- Interactive games delay finality by the length of the challenge window.
- The paper's incentive story is delicate. A verifier market that nobody joins does not secure the result.
- Optimistic rollups took the dispute-game idea and changed the virtual machine, the bonds, and the data rules. They are not TrueBit.
Why the desk still reads it
Any design that says 'we only re-execute on challenge' owes this paper an answer: who is paid to look, and what happens if they are censored until the window closes.
09 Lexicon
Terms, opened into the record
- Verifier's dilemma
- If cheating is rare, checking does not pay, so cheating can become safe.
- Bisection game
- A challenge that repeatedly halves an execution trace until one disputed step remains.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.