Universal Atomic Swaps: Secure Exchange of Coins Across All Blockchains

### Overview In this talk, Arvind, a postdoctoral researcher at Carnegie Mellon University, presents joint research with Giulio (MPI) and Pedro (IMDEA) on universal atomic swaps across blockchains. Cross-currency token exchange is a fundamental economic activity, yet existing trustless solutions struggle with atomicity—ensuring that either both parties receive their swapped coins or neither does. Traditional solutions rely on centralized exchange services (which require high availability and risk coin theft), third-party smart contract blockchains (which can be complex and expensive), or Hashed Time-Locked Contracts (HTLCs) within payment channels. However, HTLCs rely on specialized scripting, limiting interoperability with simpler blockchains, incurring high on-chain fees, and degrading token fungibility. The authors introduce a universal, multi-asset atomic swap protocol that eliminates the need for HTLCs and special scripts, requiring only standard signature verification scripts.

### Key Topics - **Limitations of HTLCs**: HTLCs require specialized script support, increase on-chain transaction costs, and harm token fungibility because transactions stand out on-chain. - **Multi-Asset Atomicity Notion**: In multi-asset exchanges, traditional definitions can allow a malicious party to claim a subset of coins and refund their own assets. The proposed model enforces that if Alice claims even a single coin on her side, Bob is guaranteed the ability to claim all coins on his side. - **Adaptor Signatures**: A cryptographic primitive defined over an NP relation and signature scheme that links signature validity to the revelation of a witness, allowing off-chain atomic linkage. - **Verifiable Timed Discrete Logarithms (VTD Log)**: A cryptographic commitment tool used to replace on-chain lock-time/timeout scripts for handling refunds privately and off-chain.

### Technical Details The core construction focuses on Schnorr and ECDSA signatures and operates across four main phases: 1. **Setup Phase**: Alice and Bob establish payment channels where channel addresses are shared public keys with distributed secret key shares. To handle timeouts without on-chain lock-time scripts, parties exchange Verifiable Timed Discrete Logarithm (VTD log) commitments to their secret key shares (set to duration $T$ for Alice and $T + \Delta$ for Bob), which both parties begin brute-forcing immediately. 2. **Lock Phase**: Alice selects a statement-witness pair for an NP relation. Using a two-party computation protocol, Bob obtains pre-signatures for his outgoing transactions under Alice's statement. Similarly, pre-signatures are generated for Alice's incoming transactions using the identical statement instance. 3. **Swap Complete Phase**: Alice uses her witness to adapt the pre-signatures into valid signatures, publishing them on-chain to claim her coins. Bob observes the published signature on any blockchain, extracts the underlying witness using the adaptor signature extraction algorithm, adapts his own pre-signatures, and posts them to claim all corresponding coins on his side. 4. **Timeout Phase**: If the swap does not complete, users finish brute-forcing the VTD log commitments after time $T$ (or $T + \Delta$). Recovering the counterparty's key share gives the party the full channel private key, enabling immediate unilateral refund of unswapped coins via standard transactions without revealing lock-time scripts or channel expiry logic on-chain.

### Takeaways The proposed universal atomic swap construction makes cross-chain swap transactions look like ordinary payment transactions, lowering on-chain gas costs (demonstrated on Ethereum) and protecting token fungibility and privacy across any cryptocurrency supporting basic digital signatures. Open problems include mitigating denial-of-service risks where participants go offline to trigger refunds, and achieving scriptless atomic swaps that allow unconditional redemption regardless of timeouts.