An Atomic Swap Is a Free Option

Jul 16, 2021 · 6 min

atomic swaps
fairness
options

An atomic swap moves coins across two chains with no intermediary. Each side locks its coin behind the hash of one secret, and the scripts are written so that either both legs settle or neither does. That is what atomicity buys, and it is all it buys.

Atomicity says nothing about who is exposed while the swap is in flight. The timelocks hand each party a stretch of time in which the other’s coin is already locked, its own is not yet committed, and abandoning the trade costs nothing. A day of that on a volatile pair is not a spot trade.

The claim

An atomic swap is an American call option with a premium of zero, handed out twice: once to the participant, once to the initiator. Nobody has to misbehave for this to be true. It is what the timelocks say.

The observation that a swap carries free optionality came out of a lightning-dev thread, from the developer posting as ZmnSCPxj. This thesis takes it as far as it goes: it writes the swap as an option, examines the premium mechanism proposed to fix it, shows the fix closes one of the two windows and leaves the other, and proposes what closes the second.

Two windows where nothing is committed

what it costs to walk away

participant lock x₂ Coin₂, or stay silent nothing

initiator reveal s, or stay silent nothing

dashed: the refund branch, reached only if the secret never appears. δ₂ to δ₁ is the shaded gap — the participant has his coin back and the initiator does not.

figure 1. the brackets are the windows. in each one, a party is already covered by the other's locked coin and has committed nothing of its own, so leaving is free.

The ordering of the timelocks is forced. The participant’s refund has to unlock before the initiator’s, or the initiator could take her coin back and then still redeem his with the secret. So her contract holds twice as long, and he is asked to publish inside the first half. Everything about the exposure follows from those two numbers.

Read the schedule for who is exposed rather than for what gets published. Until the participant locks his coin, he is looking at an asset he can buy at a rate fixed hours ago, and he can decline in silence. Once he has locked it, the initiator is in the same position: publishing the secret settles at the old rate, and not publishing it costs her nothing she has not already spent.

The same contract, under its own name

Initiate ≡ Advertise terms go up, at a rate fixed now
Participate ≡ Contract the counterparty commits
Redeem ≡ Exercise settle at the fixed rate
Refund ≡ Abort let the deadline pass

Π = π₁ paid with π₂ bought K strike A size T expiry C premium

initiator Coin₁Coin₂x₂/x₁x₂δ₂0

participant Coin₂Coin₁x₁/x₂x₁δ₁ − δ₂0

figure 2. phase for phase, the swap is an american call option. write each window as the option's own tuple and the two differ only in which side holds it — and in neither does the holder pay for it.

Advertise, contract, exercise, abort. The mapping is not an analogy; the four phases of the swap are the four phases of the option, and each window instantiates the tuple exactly. The strike is the rate the two parties agreed, the size is the coin on offer, the expiry is the timelock, and the premium is zero.

Zero is the entire finding. A premium is what a holder pays for the right to change their mind. At a premium of zero the holder’s payoff has a floor of zero: they cannot be worse off for having waited, so waiting is free and declining is free.

figure 3. the floor is what matters, not the slope. at c = 0 the holder never books a loss, so nothing about the trade punishes them for walking; a premium tilts the floor to −pr and moves break-even above the strike, which is what makes settling the preferred branch.

The counterparty in each window is short that option and collects nothing for writing it. Both parties are short one, in different halves of the swap, which is why the protocol is unfair to both rather than to one.

The other half is fees

Optionality is what the initiator loses on the trade. Fees are what she loses on the attempt. She has to publish her contract to start the swap and publish her refund to end it, and the participant can make her do both by doing nothing at all.

round the initiator publishes the participant publishes she is down

1 publish C₁publish R₁ nothing 2 fees

2 publish C₁publish R₁ nothing 4 fees

3 publish C₁publish R₁ nothing 6 fees

4 publish C₁publish R₁ nothing 8 fees

after 4 rounds, the initiator

8 fees

and holds what she started with

after 4 rounds, the participant

0 fees

and never signed anything

figure 4. declining is not merely free for the participant, it is expensive for the initiator. he can repeat it, and nothing in the protocol charges him for the round or bounds the number of rounds.

That is the draining attack. Its cost to the attacker is the reason it works: a threat that is free to make is one he can keep making, whether he is speculating on the pair or simply trying to bleed a counterparty.

A premium closes one window

The solution the thesis examines makes the initiator post a premium alongside her asset. It moves to the participant exactly when he has been left holding his own coin — the gap between his refund unlocking and hers — and it returns to her if he never participated at all. Her window is now priced. Declining to reveal the secret costs her the premium, so the floor of her option is no longer zero.

as specified the protocol as deployed + premium the solution this thesis examines + shared fees what this thesis adds

participant forfeits by aborting nothing nothing the other side's fee

initiator forfeits by aborting nothing the premium pr the premium pr

windows left free participant and initiator participant none

draining attack available available closed

figure 5. the premium is posted by the initiator and forfeited by the initiator, so it can only close her window. read the middle column: the participant still holds a free option, and still holds the fees.

The improvement is to make each party fund the mining fee of the transaction the other has to publish. The participant’s contribution does not need to be large, only non-refundable: once he has paid to have the initiator’s contract published, abandoning the swap costs him something, and that is all optionality needs in order to stop being free. It closes the draining attack in the same stroke, because the fees the initiator was left holding are now partly his.

What I would change

Three things, reading it back.

The mechanism is named, not written. Calling the fee contribution collateral is easy. Writing scripts in which one party’s fee payment is a condition of the other’s publication, across two chains that cannot see each other, is the actual problem, and the report does not solve it.
A fee is sized to the chain, not to the pair. The premium can in principle be priced against the volatility of the assets being swapped. A fee cannot. It bounds the incentive rather than removing it, and on a large enough position the free option is still worth taking. The honest claim is that the fee contribution makes the participant’s window cost something, not that it makes it fairly priced.
The argument is about signs, not magnitudes. It shows each abort branch now costs the aborting party something. It does not state the two payoffs and show that settling dominates aborting for every price path, which is what a claim of fairness needs.

Written at Shiraz University under Koorosh Ziarati, July 2021, as Fairness of Atomic Swap Transactions in Blockchain.

← all research