LTCVM
Mac app
LTCVM technical roadmap
LTCVM is a Litecoin-compatible chain running as a Layer 1 on Metal Blockchain, joined to Litecoin by a one-for-one LTC bridge. This page covers what is built, how it works, what it doesn't do yet, and the order in which we'll close those gaps, starting with the launch.
Where it stands. The chain, the bridge and the web wallet are built for Litecoin: Litecoin's address formats and script rules with SegWit and Taproot from the first block, SegWit deposit addresses, payouts at Litecoin's live fee rate that are sped up with a child transaction if they're slow, deposits paid from MWEB, and key rotation, all tested against Litecoin Core 0.21.5.8. LTCVM is built on BTCVM, the same design already running for Bitcoin. The mainnet beta is launching at metalltc.com, with the bridge on separate signers from the start.
Next: launch and the first round trip
A small amount goes each way on mainnet: a deposit from Litecoin, credited on LTCVM, then a withdrawal paid back to Litecoin. Each step will have a transaction on each chain, visible in the explorer, and proof of reserves must match throughout: LTC locked on Litecoin equal to LTC circulating on LTCVM plus deposits waiting to be credited.
What is built
| Component | What it does | State |
|---|---|---|
| LTCVM L1 | Litecoin's transaction, script and address rules, with SegWit and Taproot active from the first block, and standard relay rules, except that a payment costs 1 litoshi and there's no dust limit (you can send 1 litoshi), with Snowman consensus: a transaction is final once it is in a block, in seconds. No mining reward, and no MWEB. | Built |
| Peg reserve | LTC is created only in the chain's reserve blocks, which consensus enforces. That supply is locked to the peg signers and released only against LTC locked on Litecoin. | Built |
| Bridge | Watches both chains through Litecoin Core 0.21.5.8 and an LTCVM node. It credits deposits after enough Litecoin confirmations for the amount (12 by default, never fewer than 6 on mainnet), and pays out withdrawals once they are final on LTCVM, at Litecoin's current fee rate. Litecoin nodes don't accept replacements by default, so a payout still unconfirmed after 30 minutes gets a child transaction (CPFP) paying the current rate, funded from the peg's surplus. It stops moving funds if the solvency check fails. | Built |
| MWEB deposits | A deposit address can be paid from MWEB coins. The bridge credits such a deposit after the full confirmation count, whatever its size. Its sender is private, so a refund of one goes to an address the depositor gives. | Built |
| Web wallet | One key, one native SegWit (ltc1q…) address on both networks: Litecoin and LTCVM balances side by side, and a one-click move between them. Keys stay in the browser, optionally encrypted to a passkey, and every payment is shown for review, read from the transaction itself, before it's signed there. The page checks the deposit address and every coin it spends itself, rather than trusting the server, and refuses MWEB addresses it can't pay. It installs as an app on Mac, iPhone and Android. | Built |
| Explorer | Shows bridge activity with the transaction on each chain, proof of reserves output by output, and LTCVM blocks, transactions and addresses. | Built |
| Monitoring | Checks the peg, overdue transfers, both nodes and the validator's fee balance every minute, and sends Telegram alerts. | Built |
| Separate signers | A signer service for each key holder, and ltcvm signer-setup, the ceremony that brings new signers in. The bridge launches on them: a coordinator with no keys and three signers, each its own service, user and Litecoin Core wallet, on one server for now. Independent operators follow. | Built |
| Key rotation | A new signer set names the one it replaces; the retired signers move the locked LTC and the reserve to it, and later deposits to old addresses are moved and credited too. | Built |
| macOS wallet | LTCVM Wallet, a native Mac app for both networks: review every payment before it's signed, Touch ID for each signature, the key kept encrypted to the Mac's Secure Enclave, signed automatic updates, and importing keys from a Litecoin Core wallet.dat. Being built from the BTCVM Wallet. | In progress |
| Litecoin node | The bridge's own Litecoin Core node, which the bridge and the wallet's Litecoin balances read, checking every block itself. | Launching |
LTCVM's VM ID on Metal Blockchain, from the name ltcvm:
- VM ID
- pmL3MUsaBCgrTSaEiSy2NL6vXGtUcosT3TyXUL421W9hGa2g5
How LTC moves
Every LTC on LTCVM is backed by LTC locked on Litecoin, and anyone can check both sides. The bridge enforces one invariant: locked on Litecoin ≥ circulating on LTCVM + pending. If that ever fails, it stops.
Deposit: Litecoin to LTCVM
- The wallet gives each user a personal Litecoin deposit address, a P2WSH (ltc1q…) address that any wallet can send to. Its script commits to the user's LTCVM address, followed by a 2-of-3 multisig of the peg signers. The browser derives the address itself and refuses to show one that doesn't match.
- After enough Litecoin confirmations for the deposit's size (12 by default, about half an hour; never fewer than 6 on mainnet), the signers release the same amount from the peg reserve to the user's LTCVM address, less the bridge fee. The release is tagged with the deposit it pays for, so a deposit can't be credited twice.
- A deposit paid from MWEB coins counts once Litecoin lets it be spent, after 6 confirmations, and is credited after the full confirmation count, whatever its size.
- Deposits over the beta cap, or arriving while the total is at its limit, are held and can be refunded on Litecoin. An MWEB deposit's sender is private, so its refund needs an address from the depositor.
Withdrawal: LTCVM to Litecoin
- The user sends LTC back to the peg reserve with a tag naming a Litecoin address.
- Once that transaction is final on LTCVM, which takes seconds, the signers pay the Litecoin address from the locked LTC, less the Litecoin network fee at Litecoin Core's current estimate, kept within the signers' policy range. The payout usually confirms within a few minutes.
- Litecoin nodes don't accept replacement transactions by default, so payouts are never replaced. If one is still unconfirmed after 30 minutes and fees have risen, the bridge adds a child transaction (CPFP) that spends the payout's change back to the peg, paying enough fee for miners to take both. Every signer checks the child is exactly the one it would build, and its fee comes from the peg's surplus.
Who holds the keys
The peg is a 2-of-3 multisig: any two of the three signer keys together can move funds. Those keys control both sides of the bridge.
On Litecoin
The locked LTC: the peg address and every personal deposit address. These are the real coins users sent in.
On LTCVM
The reserve created by consensus in the chain's first block. Releasing it is how a deposit is credited, so it decides how much bridged LTC exists.
Two key holders acting together could take the locked LTC, or credit LTC with nothing behind it. The defence is independence: separate people, on separate machines, each checking the chains through their own nodes.
In the separate-signer design, the bridge process holds no keys. It proposes each transaction, and every signer checks it against its own view of both chains:
- The action is really owed: a confirmed deposit not yet credited, a final withdrawal not yet paid, or a refund its operator approved.
- The transaction is exactly the one the signer would build itself, down to every amount and address.
- The signer has not already signed another transaction that could pay the same thing twice.
- It stays within that signer's own daily limit.
A compromised bridge server can then delay transfers but can't move locked LTC.
Signing is automatic. Each signer is a service that applies these rules by itself, so deposits and withdrawals go through in the time it takes to reach the required confirmations, with no one approving them by hand. People act only to approve refunds and to change the rules, which means a new signer set that every operator joins.
Bringing signers in: the setup ceremony
ltcvm signer-setup takes each operator through setup. Only public information changes hands: no private key, password or token is ever sent to anyone. It runs interactively for a person, or with flags for automated operators. Without a terminal, the join step requires the fingerprint the operators confirmed, so no script can approve a signer set on its own.
| Step | Who | What happens |
|---|---|---|
init | Each operator | Makes a key on their own machine, or imports one at a hidden prompt, and produces a public signer card signed with that key. |
coordinator | Bridge operator | Makes the key that signs every request to the signers. |
assemble | Bridge operator | Checks the cards and builds the signer set: the keys, how many must sign, the networks, the fees and caps. Prints a short fingerprint. |
join | Each operator | Shows the set; operators confirm the fingerprint with each other on a call; writes a ready-to-install service. |
check | Anyone | Checks the key, both nodes, sync, and that the service refuses unsigned requests. |
Each operator runs a Litecoin Core node, an LTCVM node and the signer service. The tests run the whole ceremony, then a deposit and a withdrawal signed by separate signers.
How far the trust can be spread
Releasing locked LTC will always need a threshold of signers: Litecoin's script can check signatures and time locks, but not what happened on another chain. So the bridge can be decentralised, with many independent signers, but not made trustless on the Litecoin side until Litecoin itself changes. What can change is how many parties must collude, who they are, and what it costs them.
| Stage | What you trust | State |
|---|---|---|
| One operator | The beta: three separate signers, but all on one server run by one operator. The caps limit what's at risk. | At launch |
| Independent signers | That fewer than the threshold of known, separate key holders collude: 2 of 3, then 3 of 5. | Next |
| Metal validators as signers | That no two-thirds of the chain's own validators collude: the same assumption that secures LTCVM itself. | Planned |
| Bonded signers | As above, but signing anything the rules don't allow forfeits collateral worth more than the signer could take. | Planned |
| Deposits on proofs | No one, for deposits: validators check the Litecoin deposit themselves. Signers only guard withdrawals. | Planned |
What an operator runs. Metal validators already run metalgo, so a signer adds a Litecoin Core node, LTCVM on their node, and the light signer service. The plan is to package all of it as one install, plus the ceremony.
Two limits. A multisig script holds at most 20 keys, so a larger signer set needs threshold signatures, where many signers produce one ordinary signature together. And every change to the signer set moves the locked LTC to a new multisig address, which is what key rotation does.
Safety built in
- Consensus-enforced supply. Blocks that create reserve LTC in the wrong amount, to the wrong address or at the wrong height are invalid, so no other code path can create LTC.
- Solvency check before every action. The bridge audits both chains and moves nothing unless locked LTC covers circulating LTC plus pending transfers.
- Beta caps. A cap on each deposit and on the total circulating on LTCVM can be set, so the most that can be at risk is known in advance.
- A wallet that checks the server. The browser verifies deposit addresses and the value of every coin it spends against the raw transactions, caps fees, and computes transaction IDs itself. A strict content security policy limits what the page can load.
- Refunds, a pause and alerts. Held deposits can be returned on Litecoin. An emergency pause stops all signing. Health checks alert on insolvency, overdue transfers, stalled nodes and a low validator balance.
- No secrets in the source. Every commit and push is scanned for private keys, tokens and passwords, both locally and in CI, and GitHub push protection is on. Keys live only on the machines that use them.
- Tests. Consensus, VM, bridge and wallet tests, including ones that run the bridge against Litecoin Core 0.21.5.8 on a private test network, and one that runs the browser's signing code and checks its transactions against the Go script engine.
Known limits
These are the gaps between the launch beta and a bridge that can hold significant value. Every phase below closes one or more of them.
| Limit | Why it matters | Closed in |
|---|---|---|
| Signer keys aren't yet held by independent operators | Until they are, the 2-of-3 multisig doesn't protect against a single operator: the three signers run on one server. The software and setup ceremony to fix this are built; switching over needs independent operators. | Phase 2 |
| One validator | The chain stops if that node stops, and consensus is only as trustworthy as one operator. | Phase 2 |
| The signers credit deposits | Two signers acting together could credit LTC on LTCVM that isn't backed on Litecoin. | Phase 4 |
| No external audit | The bridge and consensus changes have only been reviewed internally. | Phase 3 |
| A single Litecoin node | The bridge sees Litecoin through one node it runs itself. | Phase 3 |
| Beta caps | Deliberate for now; they're raised only once the items above are done. | Phase 6 |
Roadmap
Each phase ends at a check anyone can verify, and the next phase starts only once it passes.
-
Launch the mainnet beta
Launching- BuiltLTCVM on Metal Blockchain's current release, with Litecoin's address formats and rules, SegWit and Taproot active from the first block, 1-litoshi fees and no dust limit, and the consensus-enforced peg reserve.
- BuiltBridge speaking Litecoin Core 0.21.5.8, with personal SegWit deposit addresses, MWEB deposits, payouts at Litecoin's live fee rate sped up by CPFP, a solvency audit, caps, refunds, key rotation and a health monitor.
- BuiltWeb wallet with native SegWit addresses, an address book, explorer and proof of reserves.
- NextLaunch the L1 on Metal mainnet, and serve this site from it at metalltc.com.
- NextSync the bridge's Litecoin Core node with Litecoin.
- NextThe bridge on separate signers from the start: a coordinator with no keys, and three signer services on one server.
- NextThe first mainnet deposit credited on LTCVM, and the first withdrawal paid back to Litecoin.
- NextHTTPS, and daily encrypted backups of the keys, bridge state and the deposit registry, with copies off the server, and a restore checked against the live keys.
Done when each direction has transaction IDs on both chains, visible in the explorer, and proof of reserves matches.
-
Remove single points of failure
Planned- Independent operators. At least two people or organisations besides us, each running their own Litecoin and LTCVM nodes and a signer, brought in through the ceremony. Then grow from 2-of-3 to 3-of-5.
- Rotate onto their keys. Key rotation is built: move the live peg onto keys made by independent operators, retiring the launch keys.
- Metal validators as signers. A one-command install of the signer, a Litecoin node and LTCVM for Metal validators, who already run the infrastructure. Grow to 5 to 7 validator signers with a two-thirds threshold, so the bridge is secured by the same operators as the chain.
- Hardware-backed storage for signer keys.
- At least three validators run by different operators, with a validator manager, so validators can be added and replaced without relaunching the chain.
Done when no single machine or operator can move locked LTC or halt the chain.
-
Audit and harden
Planned- An outside security review of the consensus changes, bridge and wallet signing before larger amounts, then fix what it finds.
- Have signers cross-check Litecoin through more than one node.
- More transfers from separate wallets, including a deposit over the beta limit, held, and its refund, and an MWEB deposit.
- BuiltAn emergency pause that stops all signing, and a written runbook for incidents, refunds and restoring from the daily encrypted backups. Next: rehearse it once, and a public bug bounty.
- Bonded signers. Each signer locks collateral that is forfeited if they sign anything the rules don't allow. Theft stays possible in principle, but it becomes costly.
- Delays on large withdrawals. Withdrawals above a set size wait a few hours before they're paid, giving the monitor and the other signers time to pause the bridge if anything looks wrong.
Done when the audit report is published with every finding closed or explained.
-
Deposits without signers
Planned- An LTCVM upgrade in which the validators follow Litecoin's block headers themselves, and the reserve releases a deposit's LTC only with proof that the deposit is buried enough blocks deep in Litecoin's chain.
- No signer is involved in crediting a deposit, and nobody, the signers included, can create LTCVM LTC that isn't backed by LTC locked on Litecoin.
- Signers remain for withdrawals only. Litecoin's script can check signatures and time locks but not another chain, so releasing locked LTC needs signers until Litecoin itself changes.
Done when the upgrade has been audited, activated by the validators, and deposits are credited on proofs alone.
-
Native passkey accounts
Planned- An LTCVM upgrade that accepts passkey signatures (WebAuthn, P-256) alongside Litecoin's own, as Ethereum is doing with RIP-7212. Touch ID, Face ID, password managers, and any FIDO security key (even older U2F-only keys) can then sign LTCVM transactions directly.
- No seed phrase and no private key held in the browser: the passkey is the account, backed up and synced by the user's password manager or kept on a hardware key.
- Recovery built in: an account can name a second passkey or a time-delayed recovery key.
- Today's wallet already uses passkeys to encrypt the key. That works only where the passkey supports the PRF extension, as many password managers do. Native accounts remove that limit.
- Scope: LTCVM only. LTC on Litecoin itself still needs a Litecoin key, since Litecoin's rules are not ours to change.
Done when the upgrade has been audited, activated by the validators at a set block height, and a passkey-only wallet has made a round trip through the bridge.
-
Open up
Planned- Raise the caps in steps, with the proof of reserves at each step.
- Threshold signatures. Beyond 20 signers, a multisig no longer fits, so every Metal validator could sign only through threshold signatures: many signers producing one ordinary signature. It's substantial cryptography, taken on once the signer set needs to grow past a multisig.
- Atomic swaps. LTCVM runs Litecoin's own script language, so LTC on Litecoin can be swapped for LTC on LTCVM with hash-locked payments: both sides complete, or both are refunded. It needs no bridge and no signers, only someone on the other side of the swap, such as a market maker, which makes for fast, trustless exits alongside the bridge.
- Support for wallets and developer tools beyond the web wallet: standard RPC endpoints and a documented API.
- Public infrastructure: open RPC nodes and a hosted explorer with an uptime history.
Done when the caps are lifted without new trust assumptions.
Verify it yourself
- Use the bridge and explorer at metalltc.com once it launches. Proof of reserves lists every locked Litecoin output, and each links to a public Litecoin explorer.
- Read or build the source at github.com/MetalBlockchain/ltc-vm, which has the VM plugin, bridge, wallet and deployment scripts. LTCVM is built on BTCVM.
This roadmap describes engineering work and its order; it isn't a schedule.