Download presentation

Presentation is loading. Please wait.

Published byEthel Elliott Modified over 3 years ago

2
Cross-Chain Swaps CS1951 L Spring 2019 2 April 2019 Maurice Herlihy Brown University

3
Carol has wants C

4
Alice has wants A

5
Bob has wants B

6
A B C

7
A B C

8
**A B C Three-Way Swap? If all parties conform to protocol…**

All swaps happen If some parties deviate… C No conforming party ends up worse off.

9
Smart Contracts Scripts that run on the blockchain Not contracts, not smart

10
**Cryptographic Hash Functions**

Easy x Hard H(x)

11
**I know H(s), will pay $$$ if you provide s**

Hashlock Secret s Hashlock H(s) Contract I know H(s), will pay $$$ if you provide s

12
**But if secret not provided before t, refunds for everyone!**

Time lock Contract But if secret not provided before t, refunds for everyone! is enough time to publish & notice contract

13
Alice Has a Secret s A H(s) Time: t

14
**Alice Publishes Contract with Bob**

Pay altcoins to B hashlock ℎ timelock 6 secret 𝑠, ℎ=𝐻(𝑠) C Time: t+

15
**Bob Publishes Contract with Carol**

Pay bitcoins to C hashlock ℎ timelock 5 C Time: t+2

16
**Carol Publishes Contract with Alice**

Pay Cadillac to A hashlock ℎ timelock 4 C Time: t+3

17
**Alice Triggers Contract with Carol**

reveal 𝑠 A B learn 𝑠 C Time: t+4

18
**Carol Triggers Contract with Bob**

learn 𝑠 A B reveal 𝑠 C Time: t+5

19
**Bob Triggers Contract with Alice**

reveal 𝑠 A B C Time: t+6

20
What Could Go Wrong? A B C

21
What Could Go Wrong? A B Refund! Refund! Refunds for all C

22
What Could Go Wrong? Only faulty party loses A B Refund! C

23
**Contract Deployment Order?**

B C

24
**Contract Deployment Order?**

B ???!!!! C

25
Timelock calculation ???!!!! Timeout! 5 A B Reveal s 5 C

26
Irrational Behavior Reveal s prematurely A B No Cadillac for you! C

27
**Atomic Swap Protocol If all parties conform, all swaps take place**

If some parties deviate, no conforming party worse off No coalition has an incentive to deviate

28
**Questions When is this even possible? How can we do this?**

How much does it cost?

29
Digraphs

30
Vertex

31
Arc

32
Path

33
Cycle

34
Reachable

35
**Every vertex reachable from every other**

Strongly Connected Every vertex reachable from every other

36
**Removal makes digraph not strongly connected**

Feedback Vertex Set Removal makes digraph not strongly connected

37
**Clients publish transactions Algorithm unimportant**

Blockchain Distributed Ledger Clients publish transactions Smart Contracts Algorithm unimportant

38
Swap Digraph Alice Bob Felix David Carol Ellen

39
**Proposed asset transfer**

Swap party Proposed asset transfer party

40
**A swap is a cooperative game**

A protocol is a strategy for that game Parties can form coalitions, committing to common strategy Result is payoff

41
**At least one entering arc triggered No leaving arc triggered**

Payoffs FreeRide At least one entering arc triggered No leaving arc triggered Something for nothing

42
**All entering arcs triggered Some leaving arc not triggered**

Payoffs Discount All entering arcs triggered Some leaving arc not triggered Cheaper than expected

43
**All entering arcs triggered All leaving arcs triggered**

Payoffs Deal All entering arcs triggered All leaving arcs triggered Successful Deal

44
**No entering arcs triggered No leaving arcs triggered**

Payoffs NoDeal No entering arcs triggered No leaving arcs triggered Unsuccessful Deal

45
**Some entering arc not triggered Some leaving arc triggered**

Payoffs Underwater Some entering arc not triggered Some leaving arc triggered Chaos

46
Payoffs Payoffs better worse

47
Payoffs Payoffs better Deal NoDeal worse Otherwise, why join?

48
**Payoffs Payoffs better Discount Deal NoDeal worse**

Cheaper than expected!

49
**Payoffs Payoffs better Discount FreeRide Deal NoDeal worse**

Something for nothing!

50
Payoffs Payoffs better Discount FreeRide Deal NoDeal worse Underwater

51
**Payoffs Payoffs better Discount FreeRide Deal NoDeal Acceptable**

Unacceptable worse Underwater

52
**Uniform Swap Protocol If all parties conform,**

they finish with payoff Deal If any coalition deviates, no conforming party finishes with payoff Underwater

53
**Strong Nash Equilibrium**

Everyone follows one strategy … But if a coalition deviates… It won’t improve its payoff

54
**Atomic Protocols redefined**

A swap protocol is atomic if it is … Uniform and … A strong Nash equilibrium. 54

55
Theorem If D is strongly connected, then any uniform swap protocol is atomic Proof sketch: If a deviating coalition achieves a better payoff, then some honest party ends up Underwater (Uses strong connectivity)

56
Theorem If D is not strongly connected, then no uniform swap protocol is atomic

57
**Weakly Connected Swap Graph**

58
**Weakly Connected Swap Graph**

Subgraph U

59
**Weakly Connected Swap Graph**

Subgraph V Subgraph U

60
**Weakly Connected Swap Graph**

Arcs go from U to V, but not vice-versa Subgraph V Subgraph U

61
**Weakly Connected Swap Graph**

Arcs go from U to V, but not vice-versa Subgraph V Free Riders! Subgraph U

62
**Weakly Connected Swap Graph**

Arcs go from U to V, but not vice-versa Subgraph V Free Riders! Better payoff to defect Subgraph U

63
Theorem A uniform swap protocol is atomic if and only if D is strongly connected

64
**Let’s construct a protocol.**

Next Let’s construct a protocol.

65
**Trigger if a𝐥𝐥 𝑠 𝑖 revealed before any one times out**

Hashlock vectors Hashlocks: ℎ 0 , ℎ 1 … Trigger if a𝐥𝐥 𝑠 𝑖 revealed before any one times out

66
Swap Graph

67
Swap Graph ℎ 0 =𝐻( 𝑠 0 ) ℎ 1 =𝐻( 𝑠 1 ) Leaders know secrets

68
**Leaders form feedback vertex set**

Swap Graph Leaders form feedback vertex set

69
Theorem Leaders must form a feedback vertex set

70
**Leader: publish contract on each outgoing arc**

Swap Graph ℎ 0 =𝐻( 𝑠 0 ) ℎ 0 , ℎ 1 ℎ 0 , ℎ 1 ℎ 1 =𝐻( 𝑠 1 ) ℎ 0 , ℎ 1

71
**Swap Graph ℎ 0 =𝐻( 𝑠 0 ) ℎ 1 =𝐻( 𝑠 1 )**

Leader: publish contract on each outgoing arc Swap Graph Wait for contracts on incoming arcs … ℎ 0 =𝐻( 𝑠 0 ) ℎ 0 , ℎ 1 ℎ 0 , ℎ 1 ℎ 1 =𝐻( 𝑠 1 ) ℎ 0 , ℎ 1

72
**Non-Leaders Wait for Contracts on all incoming arcs**

ℎ 0 , ℎ 1 ℎ 0 , ℎ 1 Wait for Contracts on all incoming arcs ℎ 0 , ℎ 1 ℎ 0 , ℎ 1 Before publishing on outgoing arcs ℎ 0 , ℎ 1

73
Theorem No other order works

74
**Every arc receives a contract in time O(diam(D))**

Theorem Every arc receives a contract in time O(diam(D))

75
timeouts publish 𝑠 𝑖 A C B

76
publish 𝑠 𝑖 A unlocks ℎ 𝑖 within C B

77
A C B publish sig( 𝑠 𝑖 ,𝐶)

78
A unlocks ℎ 𝑖 within 2 C B publish sig( 𝑠 𝑖 ,𝐶)

79
A unlocks ℎ 𝑖 within 3 C B publish sig( 𝑠 𝑖 ,𝐶,𝐵)

80
**How Timeouts Work Secret si arrives along a path p from source**

Each link is signed Unlocks hi if p is path from source, and received within time |p|

81
**No compliant party ends up Underwater**

Theorem No compliant party ends up Underwater

82
**If all comply, swap finishes in time < O(diam D)**

Theorem If all comply, swap finishes in time < O(diam D)

83
**Bits on blockchain: O(|L| × |A|), where L = set of leaders,**

Theorem Bits on blockchain: O(|L| × |A|), where L = set of leaders, and A = set of arcs

84
**Other Applications? Cross-chain atomic transactions?**

Off-chain transactions? Off-chain atomic transactions?

85
**Cross-chain swap protocol**

Ideas we covered in this lecture Swaps Hashed timelock contracts Digraphs Swap as game theory Cross-chain swap protocol Timeouts and paths

Similar presentations

© 2022 SlidePlayer.com Inc.

All rights reserved.

To make this website work, we log user data and share it with processors. To use this website, you must agree to our Privacy Policy, including cookie policy.

Ads by Google