Rootstock on the internet
Writing about Rootstock that is actually worth reading, sorted by what it is about. 45 pieces — explainers, protocol deep-dives, security analyses, post-mortems and research. Marketing is excluded wherever it was published, including on Rootstock's own channels.
Links last checked collected 8 Nov 2026 · how
How this list is chosen
One test: does the reader learn how something works? A piece qualifies if it explains a mechanism, analyses a design, reports what went wrong, or argues a case someone could disagree with. Nothing qualifies on its title alone — each entry carries a summary of what the article actually contains.
What does not qualify, regardless of where it appeared: price commentary, token promotion, partnership announcements, launch PR, listicles, and the genre of article that explains at length that a thing is exciting without explaining what it does. This exclusion applies to official Rootstock channels too — their blog is cited where a post is genuinely technical, such as an incident report, and not otherwise.
That rule removes more than it sounds like it should. A great deal of the writing about any blockchain project exists to be found by search engines rather than to be read. The exclusions at the bottom name the cases where something looked like it belonged here and did not, so the judgement is visible rather than silent.
The PowPeg, the bridge and its security
How bitcoin crosses to Rootstock and back, and what secures it.
-
Introducing Union Bridge on Testnet: Verifiable Bitcoin Bridging Begins
The testnet V1.5 announcement, notable for stating plainly that fraud proofs are not yet implemented.Listed despite being an announcement because it is the primary source for what is and is not deployed.
-
Union: A Trust-minimized Bridge for Rootstock
A BitVMX-based bridge needing only one honest participant: packets, enablers and stop-watch time-locks.
-
BitVMX: A CPU for Universal Computation on Bitcoin
How to verify an arbitrary program on Bitcoin without a consensus change, by disputing one instruction.
-
RSK PowHSM is Now Open Source
What the signing firmware actually enforces: SPV consensus checks, no key extraction, deterministic builds.
-
Measuring RSK Security
Argues no single metric captures blockchain security, then scores Rootstock across design, consensus and the peg.
-
RSKIP-201: Time-locked Emergency Multisignature
The escape hatch if every PowHSM fails at once, and why its long timelock is itself the defence.Also the direct cause of the October 2022 peg-out outage.
-
RSKIP-198: Minpeg, a miners' multisig in the peg
States the peg's security assumption as a formula, then proposes a miner-weighted multisig to break its weakest term.Status: Deferred. A design, not a deployed defence.
-
Building the Most Secure, Permissionless and Uncensorable Bitcoin Peg
The canonical statement of the PowPeg's defense-in-depth design, layer by layer, with comparisons to other bridges.Cited via the archived snapshot because Medium returns 403 to automated clients. Same byline, publication and date.
-
Simple change to the Bitcoin MERKLEBLOCK command to protect from Leaf-Node weakness
The concrete, non-forking mitigation for the leaf-node weakness.
-
Leaf-Node weakness in Bitcoin Merkle Tree Design
64-byte transactions can forge SPV proofs — and the RSK Bridge is named among the vulnerable.
-
How the PowPeg is secured
The official security claim: Bridge contract, PowHSM and proof-of-work requirements as layered defences.
Independent security audits
Reviews by people paid to find problems, with the findings published.
-
Public Report – IOV Labs powHSM Security Assessment
The only published independent audit of the PowPeg signing hardware: scope, method and outcome.
-
NCC Group / IOV Labs powHSM report (full PDF, v1.1)
The findings themselves: five low-severity and one informational issue, all reported fixed.
-
RSK Security Audit Results
Scopes both 2017 audits and links the primary reports. The index for the two above.
-
RSKj security assessment
Ten findings, two high severity, across the virtual machine, the Trie and the two-way-peg precompiles.
-
RSK audit: REMASC and the Bridge native contracts
Academic review of the earliest Bridge and miner-reward contracts, before mainnet.
Incidents and post-mortems
What broke, why, and what changed afterwards. Usually the most informative reading there is.
-
RSKIP-436: Network Upgrade (patch): Arrowhead 6.3.1
The emergency consensus patch for that overflow, citing the incident report as its reference.
-
Incident report: Rootstock peg-in / peg-out service outage on June 24th
A 12-byte signed chainwork field overflowed at Bitcoin block 849,138 and froze the Bridge's view of Bitcoin.
-
Sovryn - REKT
About $1.1M drained from Sovryn's lending pools on Rootstock. An application failure, not a protocol one.
-
Incident report: Rootstock peg-out service outage
The emergency redeem script tripped Bitcoin Core's sigop limit for standard transactions; testnet was too lenient to catch it.
Protocol and architecture
How the chain itself is put together.
-
RSK: A Bitcoin sidechain with stateful smart-contracts
The closest thing to a reviewable specification of Rootstock's consensus, virtual machine and peg.
-
SyncChain: Synchronized Sidechains for Improved Security and Usability
A research proposal: dual-parenting and coinbase anchoring to make pegs both faster and harder to attack.
-
RSKIP-16: Combined State Tree
The Unitrie: merging accounts, code and storage into a single world-state trie.
-
Drivechain using OP_COUNT_ACKS (BIP-R10)
Rootstock's original soft-fork drivechain opcode proposal, written out as a full specification.
-
Enabling Blockchain Innovations with Pegged Sidechains
The founding two-way-peg paper that Rootstock's design descends from.
-
Merged mining (concepts)
The canonical reference for how the coinbase commitment and the merge-mining proof actually work.
Merged mining and consensus
The relationship with Bitcoin's miners, and what it does and does not buy.
-
Merged mining (Part I)
History from Namecoin on, block-rate tradeoffs, and the standard criticisms of merged mining answered.
-
Merged Mining With RSK: Deep Dive
An outsider pulls apart a real RSK coinbase tag and questions the peg's incentives.Exploratory researcher's notes rather than rigorous analysis. Listed for the rare critical outside view.
-
Revisited: A Study on Profitability of Bitcoin Merged Mined Blockchains
The 2020 update: which merge-mined chains survived, with monthly miner revenue recomputed.
-
A Study on Profitability of Bitcoin Merged Mined Blockchains
Quantifies what miners actually earn from merge-mining each Bitcoin sidechain.
-
Armadillo: More Consensus Security for RSK
How Bitcoin-anchored tags expose a hidden competing Rootstock branch, and what the halt costs.
-
Safe merged-mining and the Bitcoin's Karma
The pre-Rootstock argument that Bitcoin's proof of work should secure every chain that wants it.
Virtual machine, state and scaling
Execution, storage cost and throughput.
-
The Dark Side of Ethereum 1/64th CALL Gas Reduction
Why Rootstock declined EIP-150's 1/64 rule, and what it does instead.
-
RSKIP-144: Parallel Transaction Execution for the Unitrie
Miners publish a conflict-free execution plan so nodes can run transaction groups concurrently.
-
Blockchain State Storage Rent Revised
Why unbounded state growth needs rent, and the cache-eviction design Rootstock specified for it.
-
RSKIP-239: Reprice Trie Read Opcodes
Argues state-read opcodes are badly underpriced, with measured costs for SLOAD.
Research and academic work
Peer-reviewed and preprint work on sidechains, merged mining and pegs.
-
Echoes of the Past: Recovering Blockchain Metrics From Merged Mining
Child chains preserve a long record of parent-chain forks and stale blocks that live monitoring misses.
-
Merged Mining: Curse of Cure?
Measures real merge-mined chains and finds pools repeatedly exceeding the security assumptions they rely on.Title is spelled thus on the ePrint page; the conference version reads "Curse or Cure?".
Independent analysis and critique
Writing by people with no stake in making Rootstock look good.
-
Rootstock (RSK): What Bitcoin's Longest-Running EVM Sidechain Gets Right and Wrong
Argues technical durability never converted into capital or developers, and picks at TVL concentration.Published by a competing Bitcoin layer, and its TVL figures are internally inconsistent. Read with that in mind.
-
[ARFC] Deploy Aave on Rootstock Network — risk review
An independent risk review: architecture, the PowPeg against the weaker token bridge, access control, bounty adequacy.
-
RSK, federated sidechains and Powpeg
Two Bitcoin-side reviewers talk through the shift from multisig to hardware, and what it does not fix.
-
Drivechains vs Sidechains
Why merge-mined sidechains and drivechains share a 51% weakness, and the case for a second layer.
-
Rootstock assessment
Rates Rootstock a merge-mined sidesystem carrying a high risk factor, driven by the permissioned peg.
Developer guides
Practical material for people building on or running the chain.
-
Introduction to Smart Contracts Development in RSK
Node setup, toolchain configuration and peg funding, written by an audit firm.Heavily dated — the toolchain and node versions it assumes are long superseded.
-
Deploy your first contract
End to end: write a contract, configure Hardhat for testnet, deploy it, call it.
What was left out
Considered and not listed, with the reason. Judgement calls, and you may disagree — say so.
| Item | Why |
|---|---|
| rootstock.io/blog — "Parallel Transaction Execution: Why Blockchain Needs to Learn to Multitask" and "Bridging Without Blind Trust" | Both load fine and both read as promotion rather than explanation. RSKIP144 and the Union paper cover the same ground with the detail intact. |
| rootstocklabs.com — "Rootstock Launches Powpeg, A Decentralized Pegging Mechanism" (8 December 2020) | An unbylined corporate launch announcement. It fixes the launch date and teaches nothing about the mechanism; the Medium article six days earlier does. |
| Hacker News discussion threads | Every Rootstock submission on Hacker News has zero comments; there is no discussion to link to. |
| A Coinspect audit of the PowPeg or the Bridge | Does not appear to exist publicly. Coinspect's published repository contains RIF and Sovryn reports only, despite third parties referring to a continuous-review arrangement. |
| L2BEAT's Rootstock page, and github.com/rsksmart/security | Both 404. Each is cited by third parties as a source for Rootstock risk data or audit reports; neither exists. |
Several genuinely technical Medium posts — on storage-rent performance, RSK against Ethereum, and a mining pool's account of why it merge-mines Rootstock — are absent because Medium refuses automated requests, so they could not be verified for listing. They are worth finding by hand.