Atomic Swap

This is an expanded and hopefully clarified version of https://en.bitcoin.it/wiki/Atomic_swap

Two parties A and B want to swap two payments in a way where both sides receive payment or neither side does. The process is general enough that each payment can be from a different blockchain as long as both blockchains have certain similar properties. Bitcoin can be traded for Dogecoin, for example.

To describe the process in an analogy, one side creates a mailbox key and puts a locked mailbox at the end of their driveway where the offer to the other party is placed. The other party creates a locked mailbox on their own driveway with the same locking mechanism and their offer even though they do not have the key. When first side goes to open the other's mailbox, the key becomes public information which enables the other side to unlock the first side's mailbox. These mailboxes automatically return their contents to the owner if they're not emptied inside a set amount of time.

What follows are specific steps for the process. Party A has an amount of coins to send at address AS and wants to receive coins at address AR. Party B, similarly, has coins at BS and receives at BR. AS/BR are on one Blockchain, bitcoin for example, and BS/AR are on another "compatible" blockchain such as Dogecoin.

An initial communication needs to happen between A and B to communicate each side's amount, send address, and receive address to each other. We proceed assuming each side has the other's amount and addresses. We'll use the value of 1 bitcoin from A that is being traded for 1000000 dogecoin from B.

One party has to initiate the process, lets choose party A.

Party A picks a secret S which is an unguessable random value. We also use the hash of the secret, labled SH.

Party A builds a transaction that says pay 1 Bitcoin from address AS to address BR with a script that allows two different conditions for spending. A redeem script must provide either a signature from B and the value S or a signature from party A and party B. The first condition allows spending by B if they have the secret and the second condition allows A to reclaim the funds. Lets call this the offer transaction from A (OTA).

Party A builds a second transaction that says pay 1 bitcoin from address BR to address AS once a time has passed. This reverses OTA. Lets call this the reject transaction from A (RTA). Party B owns the value at BR so for RTA to be valid, Party A must send the transaction to B and receive the transaction with B's signature. This transaction is the insurance for party A that returns funds after a timeout.

At this point, Party A is setup and Party B needs to setup it own transactions. A critical piece of information is the secret hash SH. Its of no value for A to simply communicate SH to B because it needs to be validated that A's offer transaction actually uses SH. So the step here is to have party A publish OTA to the bitcoin blockchain.

Note that at this point party A has offered their value, with conditions, without party B having offered their value. Because of RTA, this value can be reclaimed after a time period, and B cannot move the value out of OTA immediately because the secret has not yet been revealed.

Party B monitors the bitcoin blockchain for transaction OTA, looks at the transaction script and takes SH from it.

Party B builds their offer transaction (OTB) of 1000000 Doge from BS to AR using the same redemption requirements. Party B also makes a reject transaction (RTB), sends it to A for approval, and receives a signed transaction.

Now that party B is setup, party B publishes OTB to the blockchain. Party A monitors the blockchain for OTB which means that the offered value is in Party A's mailbox.

Party A publishes a transaction that moves the value out of OTB with a script that reveals the secret. Moving the value out of OTB is necessary because the reject transaction still applies to OTB. Party B monitors the blockchain for this transaction and once found, retrieves the secret. Using the secret, party B creates a transaction to move their coins out of OTA. The transaction is complete.

tags: