Presentation is loading. Please wait.

Presentation is loading. Please wait.

Cross-Chain Swaps CS1951 L Spring April 2019 Maurice Herlihy Brown University.

Similar presentations


Presentation on theme: "Cross-Chain Swaps CS1951 L Spring April 2019 Maurice Herlihy Brown University."— Presentation transcript:

1

2 Cross-Chain Swaps CS1951 L Spring 2019 2 April 2019 Maurice Herlihy Brown University

3 Carol has wants C

4 Alice has wants A

5 Bob has wants B

6 A B C

7 A B C

8 A B C Three-Way Swap? If all parties conform to protocol…
All swaps happen If some parties deviate… C No conforming party ends up worse off.

9 Smart Contracts Scripts that run on the blockchain Not contracts, not smart

10 Cryptographic Hash Functions
Easy x Hard H(x)

11 I know H(s), will pay $$$ if you provide s
Hashlock Secret s Hashlock H(s) Contract I know H(s), will pay $$$ if you provide s

12 But if secret not provided before t, refunds for everyone!
Time lock Contract But if secret not provided before t, refunds for everyone!  is enough time to publish & notice contract

13 Alice Has a Secret s A H(s) Time: t

14 Alice Publishes Contract with Bob
Pay altcoins to B hashlock ℎ timelock 6 secret 𝑠, ℎ=𝐻(𝑠) C Time: t+

15 Bob Publishes Contract with Carol
Pay bitcoins to C hashlock ℎ timelock 5 C Time: t+2

16 Carol Publishes Contract with Alice
Pay Cadillac to A hashlock ℎ timelock 4 C Time: t+3

17 Alice Triggers Contract with Carol
reveal 𝑠 A B learn 𝑠 C Time: t+4

18 Carol Triggers Contract with Bob
learn 𝑠 A B reveal 𝑠 C Time: t+5

19 Bob Triggers Contract with Alice
reveal 𝑠 A B C Time: t+6

20 What Could Go Wrong? A B C

21 What Could Go Wrong? A B Refund! Refund! Refunds for all C

22 What Could Go Wrong? Only faulty party loses A B Refund! C

23 Contract Deployment Order?
B C

24 Contract Deployment Order?
B ???!!!! C

25 Timelock calculation ???!!!! Timeout! 5 A B Reveal s 5 C

26 Irrational Behavior Reveal s prematurely A B No Cadillac for you! C

27 Atomic Swap Protocol If all parties conform, all swaps take place
If some parties deviate, no conforming party worse off No coalition has an incentive to deviate

28 Questions When is this even possible? How can we do this?
How much does it cost?

29 Digraphs

30 Vertex

31 Arc

32 Path

33 Cycle

34 Reachable

35 Every vertex reachable from every other
Strongly Connected Every vertex reachable from every other

36 Removal makes digraph not strongly connected
Feedback Vertex Set Removal makes digraph not strongly connected

37 Clients publish transactions Algorithm unimportant
Blockchain Distributed Ledger Clients publish transactions Smart Contracts Algorithm unimportant

38 Swap Digraph Alice Bob Felix David Carol Ellen

39 Proposed asset transfer
Swap party Proposed asset transfer party

40 A swap is a cooperative game
A protocol is a strategy for that game Parties can form coalitions, committing to common strategy Result is payoff

41 At least one entering arc triggered No leaving arc triggered
Payoffs FreeRide At least one entering arc triggered No leaving arc triggered Something for nothing

42 All entering arcs triggered Some leaving arc not triggered
Payoffs Discount All entering arcs triggered Some leaving arc not triggered Cheaper than expected

43 All entering arcs triggered All leaving arcs triggered
Payoffs Deal All entering arcs triggered All leaving arcs triggered Successful Deal

44 No entering arcs triggered No leaving arcs triggered
Payoffs NoDeal No entering arcs triggered No leaving arcs triggered Unsuccessful Deal

45 Some entering arc not triggered Some leaving arc triggered
Payoffs Underwater Some entering arc not triggered Some leaving arc triggered Chaos

46 Payoffs Payoffs better worse

47 Payoffs Payoffs better Deal NoDeal worse Otherwise, why join?

48 Payoffs Payoffs better Discount Deal NoDeal worse
Cheaper than expected!

49 Payoffs Payoffs better Discount FreeRide Deal NoDeal worse
Something for nothing!

50 Payoffs Payoffs better Discount FreeRide Deal NoDeal worse Underwater

51 Payoffs Payoffs better Discount FreeRide Deal NoDeal Acceptable
Unacceptable worse Underwater

52 Uniform Swap Protocol If all parties conform,
they finish with payoff Deal If any coalition deviates, no conforming party finishes with payoff Underwater

53 Strong Nash Equilibrium
Everyone follows one strategy … But if a coalition deviates… It won’t improve its payoff

54 Atomic Protocols redefined
A swap protocol is atomic if it is … Uniform and … A strong Nash equilibrium. 54

55 Theorem If D is strongly connected, then any uniform swap protocol is atomic Proof sketch: If a deviating coalition achieves a better payoff, then some honest party ends up Underwater (Uses strong connectivity)

56 Theorem If D is not strongly connected, then no uniform swap protocol is atomic

57 Weakly Connected Swap Graph

58 Weakly Connected Swap Graph
Subgraph U

59 Weakly Connected Swap Graph
Subgraph V Subgraph U

60 Weakly Connected Swap Graph
Arcs go from U to V, but not vice-versa Subgraph V Subgraph U

61 Weakly Connected Swap Graph
Arcs go from U to V, but not vice-versa Subgraph V Free Riders! Subgraph U

62 Weakly Connected Swap Graph
Arcs go from U to V, but not vice-versa Subgraph V Free Riders! Better payoff to defect Subgraph U

63 Theorem A uniform swap protocol is atomic if and only if D is strongly connected

64 Let’s construct a protocol.
Next Let’s construct a protocol.

65 Trigger if a𝐥𝐥 𝑠 𝑖 revealed before any one times out
Hashlock vectors Hashlocks: ℎ 0 , ℎ 1 … Trigger if a𝐥𝐥 𝑠 𝑖 revealed before any one times out

66 Swap Graph

67 Swap Graph ℎ 0 =𝐻( 𝑠 0 ) ℎ 1 =𝐻( 𝑠 1 ) Leaders know secrets

68 Leaders form feedback vertex set
Swap Graph Leaders form feedback vertex set

69 Theorem Leaders must form a feedback vertex set

70 Leader: publish contract on each outgoing arc
Swap Graph ℎ 0 =𝐻( 𝑠 0 ) ℎ 0 , ℎ 1 ℎ 0 , ℎ 1 ℎ 1 =𝐻( 𝑠 1 ) ℎ 0 , ℎ 1

71 Swap Graph ℎ 0 =𝐻( 𝑠 0 ) ℎ 1 =𝐻( 𝑠 1 )
Leader: publish contract on each outgoing arc Swap Graph Wait for contracts on incoming arcs … ℎ 0 =𝐻( 𝑠 0 ) ℎ 0 , ℎ 1 ℎ 0 , ℎ 1 ℎ 1 =𝐻( 𝑠 1 ) ℎ 0 , ℎ 1

72 Non-Leaders Wait for Contracts on all incoming arcs
ℎ 0 , ℎ 1 ℎ 0 , ℎ 1 Wait for Contracts on all incoming arcs ℎ 0 , ℎ 1 ℎ 0 , ℎ 1 Before publishing on outgoing arcs ℎ 0 , ℎ 1

73 Theorem No other order works

74 Every arc receives a contract in time O(diam(D))
Theorem Every arc receives a contract in time O(diam(D))

75 timeouts publish 𝑠 𝑖 A C B

76 publish 𝑠 𝑖 A unlocks ℎ 𝑖 within  C B

77 A C B publish sig( 𝑠 𝑖 ,𝐶)

78 A unlocks ℎ 𝑖 within 2 C B publish sig( 𝑠 𝑖 ,𝐶)

79 A unlocks ℎ 𝑖 within 3 C B publish sig( 𝑠 𝑖 ,𝐶,𝐵)

80 How Timeouts Work Secret si arrives along a path p from source
Each link is signed Unlocks hi if p is path from source, and received within time |p|

81 No compliant party ends up Underwater
Theorem No compliant party ends up Underwater

82 If all comply, swap finishes in time < O(diam D)
Theorem If all comply, swap finishes in time < O(diam D)

83 Bits on blockchain: O(|L| × |A|), where L = set of leaders,
Theorem Bits on blockchain: O(|L| × |A|), where L = set of leaders, and A = set of arcs

84 Other Applications? Cross-chain atomic transactions?
Off-chain transactions? Off-chain atomic transactions?

85 Cross-chain swap protocol
Ideas we covered in this lecture Swaps Hashed timelock contracts Digraphs Swap as game theory Cross-chain swap protocol Timeouts and paths


Download ppt "Cross-Chain Swaps CS1951 L Spring April 2019 Maurice Herlihy Brown University."

Similar presentations


Ads by Google