Bitcoin and Cryptocurrency Technologies

10.5 Atomic Cross‐chain Swaps
In Bitcoin it’s straightforward to create a single transaction that swaps currency or assets controlled
by different people or entities. This is the intuition behind Coinjoin, which we studied in Chapter 6. It
is also useful for trading smart property, which we looked at briefly in Chapter 9 and will return to in
Chapter 11. The same idea enables selling domain names in Namecoin, as mentioned earlier in this
chapter.
But in all these cases, the swap transactions are confined to a single block chain, even if they involve
different types of assets within that block chain. In general, a transaction on one altcoin is entirely
independent of and has no way of referring to a transaction that happens on some other altcoin’s
transaction history. But is this a fundamental limitation, or is there some way to swap one type of coin
for another? That is, if Alice wants to sell a quantity ​a ​of altcoin to Bob in exchange for a quantity ​b​of
his bitcoin, can they do so in an atomic fashion, without having to trust each other or relying on an
intermediary, such as an exchange service? At first sight this seems impossible, because there is no
way to force transactions on two different block chains to happen simultaneously. If one of them, say
Alice, carries out her transfer before the other, what prevents him from reneging on his side of the
bargain?
The solution is clever, and involves cryptographic commitments and time‐locked deposits, both of
which are techniques we’ve seen before. Figure 10.6 describes the protocol. For the moment, assume
that blocks in the two block chains are generated in lockstep: one block is generated every time unit.
Let ​T ​represent the time at the start of the protocol.
1. Alice generates a refundable deposit of ​a​altcoins as follows:
1.1 Alice generates a random string ​x​and computes the hash ​h=H(x)
1.2 Alice generates ​DepositA​as shown below, but doesn’t publish it yet
1.3 Alice generates ​RefundA​, and gets Bob’s signature on it
1.4 Once Bob signs ​RefundA​, she publishes DepositA (but doesn’t publish ​RefundA​)
2. Bob generates a refundable deposit of ​b​bitcoins as follows:
2.1 Bob generates ​DepositB ​as shown below, but doesn’t publish it yet
2.2 Bob generates ​RefundB​, and gets Alice’s signature on it
2.2 Once Alice signs ​RefundB​, he publishes ​DepositB​(but doesn’t publish ​RefundB​)
3. Case 1: Alice goes through with the swap
3.1 Alice claims the bitcoins by time ​T​ 1​
, revealing ​x​to Bob (and everyone) in the process
3.2 Bob claims the altcoins by time ​T​ 2
Case 2: Alice changes her mind, does not claim the altcoins, does not reveal ​x​to Bob
3.1 Bob claims his altcoin refund at time ​T​ 1
3.2 Alice claims her Bitcoin refund at time ​T​ 2
280