Ark VTXOs

VTXOs (Virtual Transaction Outputs) are the fundamental building blocks of the Ark protocol. Just as UTXOs are to bitcoin, VTXOs are to Ark—they're how you hold your balance and make payments within the protocol.

When you have bitcoin on Ark, that bitcoin is represented by one or more VTXOs in your wallet. When you want to send bitcoin to someone else on the same Ark server, you spend your VTXOs to create new VTXOs for the recipient—similar to how bitcoin transactions consume UTXOs to create new UTXOs.

Under the hood, a VTXO is a series of pre-signed bitcoin transactions held off-chain by a user that essentially provide the user the ability to create an on-chain UTXO at a later time, if required. Converting a VTXO into a UTXO can be performed without any third-party interaction, and is known as a "unilateral exit". This unilateral exit feature is fundamentally what ensures Ark users are always in control of their bitcoin.

Offboards vs. exits

Under normal circumstances, a user that wants to move their bitcoin off Ark will instead perform an offboard or Lightning payment cooperatively with the server, by forfeiting their VTXO (instead of broadcasting it). This is more efficient and cheaper.

VTXO types overview

There are three types of VTXO in the Ark protocol:

Board VTXO: The simplest type, created when moving bitcoin onto Ark. Completely trustless after creation.
Refresh VTXO: Created during periodic server rounds. Trustless like board VTXOs but with more complex transaction trees that enable cost sharing among users.
Spend VTXO: Created instantly for payments within Ark. Extends board and refresh VTXOs. Unilateral exit requires trusting that previous senders haven't colluded with the server to double-spend.

Each VTXO type uses a different transaction structure, resulting in different trust models and cost profiles.

Diagram showing all three VTXO types side by side — Comparison of board VTXO, refresh VTXO, and spend VTXO structures

VTXO type comparison

Aspect	Board VTXO	Refresh VTXO	Spend VTXO
Structure	Root → Leaf (2 txs)	Root → Branches → Leaf (3+ txs)	Extended leaf from existing VTXO
Creation timing	On-demand, needs on-chain confirmations	Periodic rounds only	On-demand, instant
Trust assumptions	Trustless	Trustless	Assumes sender + server don't collude
Cost	Full on-chain fee	Partial on-chain fee + liquidity	Marginal
Exit depth	2 (root + leaf)	3+ (root + branches + leaf)	Same as source VTXO + 1 additional
Expiry	~30 days	~30 days	Inherited
Typical use case	Moving bitcoin onto an Ark	Refreshing VTXOs	Sending payments

Transaction trees

All VTXOs are built on "transaction trees"—structures that enable multiple users to share one large on-chain UTXO while maintaining individual unilateral exit rights. A transaction tree consists of pre-signed bitcoin transactions held off-chain, interconnected with strict spending conditions that create a "pseudo covenant".

Diagram of a simple transaction tree — A transaction tree with four users, each controlling their individual balance within one on-chain UTXO

Transaction trees contain three transaction types:

Root: The only on-chain transaction, creating the VTXO when confirmed
Branch: Off-chain transactions that split the root's value among multiple users
Leaf: Individual exit transactions that deliver bitcoin to user-controlled addresses

Transaction spend paths

Each transaction in the tree enforces two mutually exclusive spend paths:

Spend path 1: Cooperative multisig between users and server. Root and branch transactions use n-of-n multisigs (MuSig2) between all users sharing that branch plus the server for emergency exits. Leaf transactions use 2-of-2 multisigs between user and server for forfeits and payments.

Spend path 2: Timelocked recovery mechanisms. Root and branch transactions use absolute CLTV timelocks (<expiry-height> OP_CHECKLOCKTIMEVERIFY), while leaf transactions use relative CSV timelocks (<144> OP_CHECKSEQUENCEVERIFY) for user exits.

Diagram of a transaction tree output with two spending conditions — Spending conditions in root and branch outputs

The cooperative path enables normal Ark operations such as spending, refreshing, and offboarding. The timelock paths serve different purposes: root and branch timelocks allow the server to recover bitcoin after expiry to minimize liquidity costs, while leaf timelocks enable users to unilaterally exit their VTXOs.

Quad tree structure

The diagrams show binary trees for illustration purposes only. The concepts remain the same, but in practice we use quad trees (each branch transaction splits into four outputs) because they minimize unilateral exit costs by reducing the number of transactions a user must broadcast.

Board VTXOs

Board VTXOs are created when users first move bitcoin onto Ark, representing the simplest VTXO construction.

Structure: The simplest transaction tree with just two transactions. The root spends directly to the user's leaf transaction, skipping the branch layer entirely.

Trust model: Board VTXOs are completely trustless after creation. Users can unilaterally exit at any time by broadcasting their leaf transaction, and the server cannot prevent this unless the user has previously signed a forfeit or spend transaction.

Exit cost: Users pay the full on-chain fee to broadcast both root and leaf transactions.

Expiry: By default, board VTXOs use the same expiry time as refresh VTXOs (~30 days). However, users can theoretically set custom expiry times during creation, though this depends on server policy. Custom expiries allow users to optimize for expected usage patterns—shorter expiries reduce costs for receivers who plan to refresh immediately.

Refresh VTXOs

Refresh VTXOs are created during Ark server rounds when users must refresh expiring VTXOs or when they want to gain trustless security after receiving spend VTXOs. Rounds are expected to occur roughly every hour, though this is a server-configurable parameter.

Structure: Full transaction trees with multiple branch layers. Users' VTXOs overlap with others in the tree (sharing branches but not leaves), and each user must hold pre-signed transactions for their entire path to exit.

Trust model: Like board VTXOs, refresh VTXOs are trustless after round completion. Users can unilaterally exit by broadcasting their portion of the transaction tree, and the server cannot prevent exits unless users have signed forfeits or spends.

Exit cost: Users pay individual fees for each of their branch and leaf transactions. In emergency scenarios where many users exit simultaneously, the first user to broadcast each branch transaction saves all other users on that branch from having to broadcast the same transaction. Therefore users exiting earlier subsidize users exiting later.

Expiry: Refresh VTXOs have server-defined expiry times, expected to be around 30 days. Users cannot customize this expiry time—it's set by the server's round policy.

Users don't hold VTXOs in every round

One common misconception is that all users of an Ark server participate in every round. This is not the case. Users only hold refresh VTXOs in rounds where they personally participated.

Spend VTXOs

Spend VTXOs are created instantly when users send payments within the same Ark server, using a technique known as arkoor (Ark out-of-round). This mechanism enables immediate transfers without waiting for the next server round. Most users will receive their first Ark balances as spend VTXOs (from friends, customers, or exchanges).

Structure: Spend VTXOs extend existing transaction trees by adding new leaf transactions. For unilateral exit, users must broadcast all transactions in the original tree plus the additional spend transaction, increasing exit length.

Trust model: Spend VTXOs follow the state chain security model. Users can still unilaterally exit, but they must trust that the sender and server don't collude to double-spend the leaf. As long as either the server or sender acts honestly, payments are secure. Read more on Ark's payment dynamics.

Exit cost: Users must pay transaction fees for their complete exit path: all transactions from the original VTXO tree (all branches and original leaf) plus fees for each additional arkoor transaction in the spending chain. Each spend that extends the chain adds one more transaction fee to the total exit cost. For example, if you receive a spend VTXO that's already been spent twice, you'll pay fees for the original tree plus three arkoor transactions when exiting.

Expiry: Spend VTXOs inherit the expiry time of their source VTXO. Spending doesn't refresh the expiry, so receivers of "old" VTXOs must refresh sooner but pay lower immediate refresh costs because the server deploys liquidity for a shorter time period. Receivers of "fresh" VTXOs can wait longer before refreshing but face higher costs if they want to refresh immediately.

Beyond the difference in trust model, spend VTXOs function like any other VTXO type and can serve as inputs for further payments, refresh transactions to convert to trustless refresh VTXOs, off-board transactions to exit cooperatively, or Lightning payments. Once spent in any of these ways, the spend VTXO security concerns become irrelevant, as the VTXO has been forfeited to the Ark server in exchange for verifiable on-chain or Lightning bitcoin.

Spend VTXO chains

Spend VTXOs can be chained, with each consecutive spend increasing the exit length by one. A user receiving a spend VTXO in a chain must trust that none of the previous senders colluded with the server to double-spend. However, individual senders cannot unilaterally double-spend—this requires server cooperation.

Diagram of a chain of spend VTXOs — A spend VTXO (arkoor) chain.

Spend VTXO chain length considerations

Long chains increase exit costs and expand the trust surface area. Wallet app developers may want to consider providing users with tools to limit spend VTXO chain length.

Spend VTXO change

Like spending UTXOs on-chain, users typically spend only a portion of a VTXO, creating two new spend VTXOs:

Payment: Sent to the recipient
Change: Returned to the sender

Diagram of spend VTXO change structure — How change works when partially spending a VTXO on Ark

Spend VTXO change inherits the trust properties of its source:

Change from trustless VTXOs: Change from board or refresh VTXOs remains trustless since users cannot collude against themselves.
Change from self-controlled chains: Change remains trustless when every transaction in the chain is the user's own (change or self-sends) and the chain originates from the user's own board or refresh VTXO.
Third-party chains: Once other users appear in the spending chain, change inherits the same trust requirements as regular spend VTXOs—users must trust that previous senders in the chain didn't collude with the server.

Multiple VTXOs for larger payments

Users can send multiple VTXOs simultaneously to complete a single larger payment, creating multiple outputs for the receiver. This approach offers significant advantages over creating multiple small UTXOs on-chain.

There are not the same downsides as doing this on-chain, where the on-chain transaction fees will linearly scale with the number of UTXOs. On the Ark protocol, the cost to send is marginal, and for the receiver, the cost to refresh is relative to the payment size and the amount of liquidity used—not the number of VTXOs being refreshed.

However, there is still one trade-off: sending multiple VTXOs to complete a single payment increases the unilateral exit costs for the receiver. If the receiver ever needs to perform an exit, they must broadcast an additional on-chain transaction for each spend VTXO they hold, multiplying their on-chain transaction fees accordingly.

Transaction tree scalability

Transaction trees scale efficiently with the number of users. The number of transactions a user must broadcast for a unilateral exit of a refresh VTXO is one plus the number of branch layers in the tree. The number of branch layers scales logarithmically (log base 4) with the number of users. For example:

4 users = 1 branch layer (2 total transactions to exit)
16 users = 2 branch layers (3 total transactions to exit)
64 users = 3 branch layers (4 total transactions to exit)
256 users = 4 branch layers (5 total transactions to exit)

This logarithmic scaling means even large numbers of users result in manageable exit transaction counts.

How users interact with VTXO types

Users don't directly choose which VTXO type to use—the VTXO type is determined by their behavior and circumstances:

Spend VTXOs are received when someone sends you a payment on Ark. Most users will first encounter Ark by receiving spend VTXOs from friends, customers, or exchanges.
Refresh VTXOs are created when users participate in server rounds, either to refresh expiring VTXOs or to convert spend VTXOs into trustless form.
Board VTXOs are primarily used by power users who want to move their bitcoin from on-chain onto Ark. Most casual users won't need to create board VTXOs.

Over time, users will cycle between spend and refresh VTXOs based on their usage patterns. After the expiry period (~30 days), all users must hold refresh VTXOs since expired VTXOs cannot be spent.

VTXO fees for users

While each VTXO type has different underlying costs, the fees charged to users may not directly reflect these costs. Servers may choose to abstract or subsidize fees as part of their business model. Fee schedules for Second's Ark server are still a work in progress, but you can read more about considerations on our fees page.