Taro is heralded as a new protocol that will bring assets to Bitcoin in a scalable way and enable new use cases. It has the potential to transform Bitcoin into a multi-asset network, on which users can have instant, global, and final settlement for low fees, with the stability of their preferred currency.
What exactly is Taro? How does it work? And when can users expect to see it live on the Bitcoin and Lightning network?
What Is Taro?
Taro (Taproot Asset Representation Overlay) is a proposed protocol that will allow people to issue digital assets on the Bitcoin blockchain. These digital assets can be fungible currencies such as stablecoins, or non-fungible, unique tokens such as NFTs or collectibles. Today such assets largely reside on other blockchains due to easier implementation, lower transaction costs, or higher scalability, but Taro could shift this balance.
Taro assets can be transferred over the Bitcoin network through an on-chain transaction. Additionally, fungible Taro assets can also be transferred instantly, at low cost, and more privately over the Lightning Network when deposited into a channel. The latter is expected to be the main network for Taro asset transfers, due to the overwhelming practical advantages.
If adopted, Taro could increase the activity and use cases of both networks without requiring a change in the user experience. Taro would increase Bitcoin’s network effects and thus also benefit users who are not interested in additional assets beyond bitcoin.
The first proposal for Taro was announced by Lightning Labs in April 2022. It is not the first project that attempts to enable different assets on top of Bitcoin, but it is the first to make use of Bitcoin’s Taproot upgrade to make the implementation more elegant and scalable. Another project attempting to achieve similar goals is the RGB protocol.
How Does Taro Work?
Before diving into how Taro works on a technical level, it is useful to take a moment to think about what properties are desirable in a system that allows you to transfer (non-)fungible assets:
- The ability to use any type of asset on the same network.
- Cheap asset transfers that work 24/7.
- Assets that are not controlled by a centralized entity.
- An easily auditable supply.
- A very high degree of security, both for the individual asset as well as the network it is transferred on.
- User-controlled privacy.
- Global accessibility for everyone.
Below we look into what technologies the Taro protocol uses to address these desired properties.
Taro Uses the Bitcoin Network
Taro assets are registered on the Bitcoin blockchain in the form of hashed metadata attached to a transaction. Storing all of the metadata directly on the blockchain would take up more space and would thus be more expensive. This cost is avoided by using a hash, a one-way transformation of data which cannot be forged and is easy to verify.
Since there is no limitation to the amount of data that can be represented by a hash, one transaction on the blockchain can represent millions of transactions. This holds true for Taro asset transfers as well, and will be elaborated upon further in the Merkle tree section.
A transaction containing a Taro asset can be transferred over the Bitcoin network like any other Bitcoin transaction. Given Bitcoin’s 99.98% uptime since its inception in 2009, and no downtime since 2013, it is an exceptionally reliable network to transfer assets, which gives Taro users a high degree of certainty that their assets are always safe and transferable. The Bitcoin network also ensures that a Taro asset cannot be double spent, just like bitcoin itself.
Taro Uses the Lightning Network
Taro uses the Lightning Network for fungible Taro assets (such as stablecoins) to achieve higher transaction speeds, better scalability and lower fees than if it were to only use the Bitcoin base layer. This is similar to how transferring bitcoin itself is faster, cheaper, and more scalable over the Lightning Network.
Non-fungible Taro assets (such as NFTs) would not work on the Lightning Network, as these cannot be split up and get partially transferred across a Lightning channel.
It is important for Taro to be compatible with the Lightning Network for fungible assets, as Bitcoin itself cannot scale to billions of users on the base layer. Bitcoin’s base layer has a built-in limitation in transaction throughput that ensures the network can be joined by nodes on average computers. This ensures the network remains decentralized. If each Taro asset transfer would require an individual on-chain transaction, there would in turn be major limitations to the scalability of Taro.
With the proposed implementation of Taro, the Lightning Network itself would not need to be changed. To route a payment denominated in a Taro asset, only the participants in the first and last payment channels would need to be aware of the Taro asset transfer. For any routing nodes in between, the transfer would look like any lightning transfer as they would be moving bitcoin.
Taro assets would most frequently be exchanged for other assets at the edges of the network, similar to how in the traditional financial world, not everyone engages in asset swaps. They are mostly facilitated by specialized services such as foreign exchange offices.
Taro Introduces Brokerage on the Lightning Network
The fact that only senders and receivers of the first and last hop would need to be aware of the existence of the asset is a major game-changer for anyone looking to issue new assets.
Before Taro, when a new asset is created, a marketplace must be found to list it, and enough users need to be interested in exchanging the asset on that specific marketplace.
If Taro is released, this marketplace can be entirely decentralized and many nodes in the Lightning Network may choose to operate as a brokerage, taking in one form of asset and exchanging it for another as a market maker. When a user is looking to exchange a Taro asset, their wallet may simply find the fastest and cheapest place near them in the network to exchange it, for the best possible price.
Taro Uses Taproot
Taproot is an upgrade made to Bitcoin in 2021. It allows users to create spending conditions for a transaction output (UTXO) in such a way that only the condition that is actually met is revealed on-chain to all observers. This makes a Taproot transaction look similar to any regular bitcoin transaction, which is great for privacy, and ensures that nodes don’t even need to know that Taro exists.
The conditions that are created to send a Taproot transaction are organized in a tree structure called a Taproot script tree. This structure minimizes the amount of data needed to validate the transaction, which reduces the burden on nodes. The tree also ensures that observers can’t tell if there were other conditions to spend this transaction, as only the hash of the tree is included in the transaction output.
Taro uses Taproot to embed asset metadata into a transaction output, and to set specific rules on how to interact with and validate this new asset data. Because the root hash of the Taro asset script is all that is included in the Taproot transaction, no observer can tell if it was a Taro transaction, as the hash could represent anything.
The use of Taproot makes Taro quite different from asset solutions built on other blockchains. In many cases these blockchains use account models rather than UTXOs, which means information about balances is usually revealed.
Taro Uses Merkle Trees
A Merkle tree is a structure that can store a lot of data, while making it easy to prove that specific data exists in the tree. It is also easy to verify if data in the tree has been tampered with, and exactly where the changes happened.
If you’re not familiar with Merkle trees yet, we recommend to read up on them quickly to understand the next part.
Taro uses a specific variant of a Merkle tree, called a Merkle-Sum Sparse Merkle tree (MS-SMT). This is a combination of a Merkle Sum tree and a Sparse Merkle tree.
A Merkle-Sum tree is used to make it efficient to verify that there is no change in the value or distribution of the leaves of a Merkle tree, by assigning a numeric value to each leaf. If Taro assets are stored in a Merkle tree, then a Merkle Sum tree makes it much quicker to verify that the assets still add up to the same amount and are in the same places as before.
A Sparse Merkle tree is used to make it efficient to verify if any data is not in the tree. In this particular Merkle tree, all of the leaves are indexed. If a Taro asset transfer is done, the specific leaf where the asset used to be becomes empty, which makes it possible to prove that a Taro asset was transferred or it would still be in this position.
Combining all of the above properties, a Merkle-Sum Sparse Merkle tree has the following properties:
- Scalable for a high number of assets.
- Allows a user to prove a certain asset is stored in a Merkle tree, of which the root is metadata in a bitcoin transaction.
- Tamper-resistant or the Merkle Root would change.
- An easily auditable supply without having to reveal all the information.
- Makes it possible to split and merge fungible Taro assets, as long as they continue to add up to the total supply.
- Allows a user to prove a certain asset is no longer stored in a Merkle tree and has been transferred. This is also called proof of non-membership.
How Taro Assets Will Be Issued and Transferred
Taro assets can be transferred over the Bitcoin blockchain or the Lightning Network. For a user, there will be little practical difference besides additional assets being displayed in their wallet, and an off-chain place to store data that proves the Taro asset is authentic.
On a technical level, Taro asset transfers are more complicated, as can be identified by the usage of asset scripts, Taproot and Merkle-Sum Sparse Merkle trees.
Beyond those technical components that construct a Taro asset transaction, there is also a difference between how non-fungible assets such as NFTs or collectibles are transferred, and how this works for fungible assets such as stablecoins.
NFTs on Taro
Non-fungible assets are issued in a single, limited edition batch in an on-chain transaction. These assets cannot be split or merged, they can only change ownership, which will happen off-chain by transferring the unique identifier of the asset and its verification file of historical transaction data that proves the authenticity. This information is stored in Taro Asset Universes, which fulfill a similar role to a block explorer, and can be run by anyone with an interest in the assets.
The new owner of a Taro asset can examine the data in a Taro Asset Universe and use it to reconstruct the metadata in the blockchain to verify their ownership. They can also amend the metadata with their own proofs before passing on the asset.
Stablecoins on Taro
A fungible asset on Taro such as a stablecoin can be split and merged. This means that if a user has an asset, it can change ownership inside an existing group of users that all have assets within that same Merkle tree, or the assets could be transferred to a user in a different Merkle tree. An updated version of the Merkle tree would simply show that the total supply of the asset hasn’t changed, but the balances of the different owners have updated.
Transfer a Taro Asset, Transfer its Rules
We previously mentioned in the Taproot section that Taro assets have specific rules on how to interact with them and validate them. These rules are stored in the asset script, a set of rules created by a developer that define how this specific asset can be transferred. This asset script becomes part of the Merkle-Sum Sparse Merkle tree.
The knowledge of how to handle Taro assets needs to be transferred to the new owner, so that this person knows how to transfer the asset after receiving it and can prove to the next owner that they have this knowledge. To make this possible, Taro will use an address format based on bech32 that will include the asset script hash. The owner can then prove that they have the knowledge on how to spend this Taro asset, by providing the next owner with the asset script, who can hash it to verify that it matches the asset script hash that is attached.
When Will Taro Be Usable?
The first version of the Taro daemon has been released as of 28 September 2022. Developers can now mint, send and receive Taro assets on the test network of the Bitcoin blockchain.
These are still early stages for Taro, and more enhanced features will be added to the Taro daemon over the next months, including the previously mentioned Taro asset universes.
Once this stage is complete, the Taro protocol will be integrated into the Lightning implementation lnd, which will bring Taro to the Lightning Network as well.
There is still a ways to go until Taro will be usable by the average user. During this period any issues or feedback can be processed and implemented.
We’ve seen a similar process for the Lightning Network itself, which was first proposed in early 2016, became usable in 2018 for users willing to accept the risks of novel software, and has been rapidly growing and maturing since. We expect the rollout of Taro to follow a similar path, but perhaps accelerated given that no new network needs to be created.
Taro at River
At River, we are invested in the success of the Lightning Network. We’ve been operating Lightning nodes since 2019 and have grown into some of the biggest nodes in the network by capacity. With our team of dedicated Lightning developers, we’re eager to support and adopt cutting edge technology like Taro once it is ready.
If you’re interested in transacting on Lightning through River, you can sign up for a River account. To stay up-to-date on our latest research, subscribe to our newsletter.
Key Takeaways
- Taro is a proposed protocol that will allow the issuance of digital assets on the Bitcoin blockchain.
- Taro assets can be fungible currencies such as stablecoins, or non-fungible, unique tokens such as NFTs or collectibles.
- Taro assets can be transferred over the Bitcoin network, or instantly, at low cost and more privately over the Lightning Network.
