I've read a bunch of posts and articles about how BitVM works. But then something like Citrea comes along (#1420746), and I find that I'm mostly still confused.

Luckily, the good folks at Bitcoin++ did a write up explaining some of what is going on (#1423555). Their write up about BitVM and rollups was helpful to me in trying to wrap my head around these things.

It's a longish read, and wanting to see if I grasped the concept, here's my attempt to make a tl;dr out of it:

I don't know if I can do better than this line though:

A rollup is a blockchain that executes transactions off-chain and submits proofs of state transitions to the underlying blockchain for validation.

• Citrea is a kind of sidechain called a rollup. This is a blockchain that uses Bitcoin's mainchain for security, rather than it's own proof of work mining.
• Instead of miners, there's an thing called a sequencer. The sequencer picks the transactions that go in blocks, the order in which they go, and how frequently blocks are made.
• At predetermined intervals, the sequencer rolls up all the transactions from a set of blocks and includes the cumulative change in state in a bitcoin transaction.
• This is kind of like taking the UTXO set for the sidechain and making a hash out of it and including that in a Bitcoin transaction.
• Another entity does the math to prove that the the Sequencer isn't lying and also posts a hash (a proof) of the state changes.
• As long as the proof matches the hash submitted by the sequencer, users can be confident that any transaction the sequencer says has happened actually did happen.

I get the sense that there are many flavors of how this works. And I think I've probably skipped too many details to make this more than a roughly helpful explanation.

BitVM comes into this because a sidechain created in this manner still has a problem if it wants to use bitcoin on in its transactions. It seems like bitcoin doesn't exist anywhere but in Bitcoin transactions (are lightning sats real sats before your channels are closed?). Wrapped Bitcoin is really just a stablecoin pegged to bitcoin. The question is, how good is the peg?

BitVM comes into this because it may make it possible to create a bitcoin address to which people can send sats and get a math-based guarantee that some token equal to their number of sats has been created on a sidechain.