Here is what the wallet I built does. When it refreshes, it doesn't merge everything into one VTXO. It sets aside a few small "hot" coins for everyday payments and gathers the rest into a single "cold" coin (the names are my own). And when it pays, it uses a single coin whenever it can, because merging spreads the contagion.

Which coin it uses is also fixed: the most worn-out one first. The measure is the amount minus the exit cost, that is, what I could actually salvage on the worst day. The coin where that number is lowest, or already negative, gets spent first. A coin whose exit cost has passed its amount has nothing left to salvage, so piling a hundred more payments onto it costs me nothing further. Spending from a clean coin, on the other hand, eats into money I could have recovered in full.

Done this way, no matter how fast exit cost builds up, it stays quarantined inside one hot coin, and ownership of most of the balance remains intact.


Here is the actual state of my ark wallet. At refresh I split it into three hot coins of 5,000 sats each and one cold coin, then routed every payment through one of the hot coins. While that coin's balance fell by about 600 sats, it accumulated 123 transactions, and its exit cost is now around 87,000 sats. That is 20 times the coin's value, and more than the wallet's entire balance of about 67,000. Had I been spending from one merged coin, everything I own would be impossible to exit (possible, strictly speaking, but pointless). Yet the 52,000-sat cold coin can still leave for about 2,400 sats, 5% of its amount.

As you can see, an Ark wallet has a lot to get right, especially if it is to guarantee ownership without sacrificing usability. But I don't count that as a weakness, because everything that has to be done sits on the local side. What matters for ownership is not whether the logic is complicated, but whether it has dependencies. Even the simplest thing isn't fully mine if it needs someone else's cooperation. Something a bit complicated that depends only on client logic just takes some care to build.

Once a coin has been refreshed, the worst an ASP can do is refuse to cooperate, and then I simply exit. But if that exit costs more than the money, the promise is hollow. Keeping the exit cost down to a reasonable level is what makes it real. And if users can walk away cheaply, the only one ruined by a refusal is the ASP itself, so it has no reason to refuse in the first place.

Over the last four posts I looked at how Ark gains scalability while staying self-custodial. Today I want to look at another of its drawbacks: cost. In the first post I said that most criticisms of Ark are things a well-behaved client can overcome. This is the biggest of them.

Ark's self-custody rests on the right to exit unilaterally. But unlike Lightning, where a unilateral exit takes just two onchain transactions no matter how heavily the channel has been used, an Ark exit has no fixed size. To exit a VTXO, I have to replay its offchain transaction history onchain, in order. Not all the way back, of course; only as far as the last refresh. Still, if I've been spending actively offchain, that can mean dozens or even hundreds of transactions, and whoever exits pays the fees for all of them.

So every time a VTXO is spent, an "exit cost" quietly piles up behind it, separate from its face value. An onchain transaction costs a few hundred sats, so each time I pay a few dozen sats offchain, the onchain value of that coin drops by far more than what I spent. Keep going, and at some point the exit cost exceeds the amount of the coin itself. From then on, my cryptographic ownership of it is ownership in name only.

It gets worse, because exit cost is contagious. If I put a heavily used VTXO and a clean one into the same payment, the change inherits the history of both. Nothing I do offchain can shrink it. Only a refresh resets it to zero.

And a wallet left to its defaults drifts straight into the worst case. A refresh merges my whole balance into a single VTXO, so every small payment after that raises the exit cost of everything I own. Even when I do hold several VTXOs, the SDK's default coin selection reaches for the largest one first.

So is the unilateral exit an empty promise for anyone who actually uses Ark? No. And once again, the fix is entirely up to the client.

On my way to work, I didn’t realize until I got to the office that I’d taken my laptop home over the weekend. I really want to die. When am I ever going to achieve FIRE? Even if I can’t do that, I’d be perfectly happy just to get a job at a company that lets me work from home.

This is where Ark's greatest achievement comes in. Many people can take part in an Ark refresh at the same time, and yet the transaction size does not grow in proportion to the number of participants; it stays fixed. In other words, unlike other onchain transactions, the transactions generated by Ark activity don't consume block space exclusively for a single person. They consume truly O(1) block space, which is qualitatively different from something like the batched withdrawals commonly seen at exchanges (a batched withdrawal needs as many outputs as there are recipients).

So, taking all of this into account, Ark scales Bitcoin significantly, but in a completely different direction from Lightning. To use internet speed as an analogy, Lightning offers low latency, while Ark offers high throughput. Ark doesn't guarantee Lightning-level immediacy for large amounts, but in most transactions, amounts above a certain size don't really need immediacy anyway; what matters is throughput. And once full ownership has been secured through a refresh, I can spend freely from then on. The resulting VTXOs will still be marked as theoretically double-spendable, but since the only person who could double-spend them is me, their safety is guaranteed.

Ark also lets users send and receive payments and transfers across ASPs "atomically" through the Lightning nodes run by ASPs, without bearing the burden of running a node themselves. This should vastly improve on Lightning's weakness in reliability and dramatically reduce failure rates. Being able to receive without keeping anything running is another great advantage.

Of course, users do bear a liveness requirement. It's true that anyone who wants a fully unilateral exit needs to be fairly diligent about maintaining that liveness. But only those who want that need to do so.

In conclusion, I believe Ark can be called self-custodial when used with a precise understanding of how it works, and I expect that, thanks to its overwhelming convenience, it will play the most important role if a world where people pay with bitcoin ever arrives.

Therefore, as long as the client-side wallet app behaves properly, nearly complete self-custody can be guaranteed for nearly everyone. In particular, for people whose usage pattern is occasionally receiving large sums and spending them in small amounts, it can guarantee almost total ownership, provided the wallet app pairs a sensible refresh strategy with coin control. And that is not difficult at all, because it requires no cooperation from the ASP; it is entirely up to the client.

Receiving a substantial amount on Layer 2 while knowing it could still be double-spent may be hard to accept. But this, too, is the kind of problem that can be managed with the right mental model. The answer is simply to refresh right away and not count the funds as received until the refresh is done. In other words, they should be treated the same as zero-confirmation funds onchain.

Having explained this far, I expect the following objection:

"The whole point of a Layer 2 is that onchain is slow and expensive. If certainty requires a refresh, and a refresh is an onchain transaction, then why bother using it at all? Doesn't that mean waiting for onchain block confirmations anyway? Besides, the reason Lightning isn't a complete solution is that even though channels can be used freely once opened, the chain could never handle it if every person made even a single onchain transaction. Isn't this the same thing? In fact, unlike Lightning, where a channel can be reused indefinitely once opened, this has to be done every time a lump sum comes in, so doesn't it require even more onchain transactions?"

So what does it mean that someone other than me can touch my funds on Layer 2? It means that if the previous owner of a VTXO I hold (essentially, bitcoin on Layer 2) colludes with the ASP, a double spend becomes possible. I may think I've received the money, but in reality it could have been double-spent so that someone else receives it too, and if that person withdraws onchain first, I have no recourse.

Some might conclude from this that it isn't self-custody at all, but that's not the case. A VTXO can have its history reset through a process called "refresh," either periodically or whenever its owner wants. Put simply, a refresh is an onchain transaction, and through it the VTXO becomes something only I can withdraw. This is cryptographically guaranteed.

And since the only party who can wrongfully touch my VTXO is its previous owner, once I've refreshed, every change VTXO that comes back to me as I spend from then on belongs to me alone, because every previous owner is me.

I really like the Lightning Network, but there's one thing its critics say that I can't help but agree with: Lightning alone cannot solve Bitcoin's scaling problem. In fact, that was the very first thing I asked the Bitcoiners here publicly when I first came to Nostr (though I never got a single answer).

This is obvious to anyone who can do a bit of arithmetic, which is why everyone is exploring new Layer 2s to complement Lightning. I'm no exception, and of all of them, I consider Ark the most promising. Its detractors call it a "fake L2" or even a "scam." So which side has the stronger case? Let's look at whether their arguments actually hold up.

For a Layer 2 to be called self-custodial, it must satisfy the following conditions:

An onchain deposit must atomically result in Layer 2 funds.
A Layer 2 withdrawal must atomically result in an onchain UTXO.
I must be able to perform #2 entirely on my own, without any help from the Ark Service Provider, and even in an adversarial environment.
No one but me should be able to touch my funds on Layer 2.

Ark satisfies 1, 2, and 3. The only one it doesn't fully satisfy is #4, and that is the strongest criticism against Ark. There are other criticisms too, but most of them are drawbacks that can all be overcome as long as the client behaves correctly. I see those as UX issues, not something to be addressed from a custody standpoint.

most usful nostr app