On HTLC-Based Protocols for Multi-Party Cross-Chain Swaps

TL;DR

A comprehensive study of HTLC-based protocols, in which all asset transfers are implemented with HTLCs, and a full characterization of swap digraphs that have such protocols.

Abstract

In his 2018 paper, Herlihy introduced an atomic protocol for multi-party asset swaps across different blockchains. His model represents an asset swap by a directed graph whose nodes are the participating parties and edges represent asset transfers, and rational behavior of the participants is captured by a preference relation between a protocol's outcomes. Asset transfers between parties are achieved using smart contracts. These smart contracts are quite involved and they require storage and processing of a large number of paths in the swap digraph, limiting practical significance of his protocol. His paper also describes a different protocol that uses only standard hash time-lock contracts (HTLC's), but this simpler protocol applies only to some special types of digraphs. He left open the question whether there is a simple and efficient protocol for cross-chain asset swaps in arbitrary digraphs. Motivated by this open problem, we conducted a comprehensive study of \emph{HTLC-based protocols}, in which all asset transfers are implemented with HTLCs. Our main contribution is a full characterization of swap digraphs that have such protocols.

Figures (11)

• Figure 1: Four types of acceptable outcomes. Solid arrows represent transferred assets and dotted arrows represent those that are not.
• Figure 2: An example of a preference relation of a node $v$ whose neighborhoods are ${N_{v}^{in}} = { \left\{ {a,b} \right\} }$ and ${N_{v}^{out}} = { \left\{ {x,y} \right\} }$. Arrows represent preferences.
• Figure 3: Illustration of Cases 1 and 2 in the proof of Lemma \ref{['lem: live+safe->nash']}. Solid arrows represent transferred assets and dotted arrows represent those that are not. In the figure on the left, $j=6$. In the figure on the right, $k = 7$ and $j=3$.
• Figure 4: Protocol ${\textsf{BDP}}$, with the protocol of the leader on the left, and the protocol of the followers on the right. Each bullet-point step takes one time unit. To check correctness of an incoming contract, the buyer verifies if the seller created it according to the protocol; in particular, whether the contract contains the desired asset and whether the timeout values are correct.
• Figure 5: An example of a bottlebeck digraph $G$ and the timeout values for Protocol ${\textsf{BDP}}$ for $G$. The longest cycle in $G$ is $\ell,b,f,g,h,d,e,j,\ell$, so ${D^\ast} = 8$.

Theorems & Definitions (36)

• Theorem 1
• Lemma 1
• proof
• Theorem 2
• proof
• Theorem 3
• proof
• Lemma 2
• proof
• Lemma 3