Aborting a three-way swap

Question

Suppose Alice has 1 BTC, Bob has 1 LTC, and Carol has 1 NMC. Alice wants NMC for BTC, Bob wants BTC for LTC, and Carol wants LTC for NMC. Assume each cryptocurrency has the same value and can be 1-to-1 transferred. They need to make a three-way swap: Alice will transfer BTC to Bob, Bob will transfer LTC to Carol, and Carol will transfer NMC to Alice. However, there is no trusted authority/intermediary. Preliminary:

H is a cryptographic hash function. Hashlock h indicates that if A sends the contract a value s, (i.e., a secret) such that h = H(s), then the contract irrevocably transfers ownership of those altcoins from B to A. Timelock T indicates that if A fails to produce that secret before time T elapses, then the escrowed altcoins are refunded to B. Here, T is the enough time for one user to publish a smart contract on any blockchain, and for the other user to detect that the contract has been published.

Detailed swap is as follows.

Step 1: Alice creates a secret s, such that h = H(s). Then, she publishes a contract on the BTC blockchain with hashlock h (timelock 6T in the future), to transfer her BTC to Bob.

Step 2: Bob first confirms whether Alice’s contract has been published on the BTC blockchain or not. If true, he publishes a contract on the LTC blockchain with the same hashlock h (with timelock 5T in the future), to transfer his LTC to Carol.

Step 3: Carol first confirms whether Bob’s contract has been published on the LTC blockchain or not. If true, she publishes a contract on the NMC blockchain with the same hashlock h (timeout 4T in the future), to transfer her NMC to Alice.

Step 4: Alice first confirms whether Carol’s contract has been published on the title blockchain or not. If true, she sends the secret s to Carol’s contract, while acquiring 1 NMC and revealing s to Carol.

Step 5: Carol then sends s to Bob’s contract, while acquiring 1 LTC and revealing the secret s to Bob.

Step 6: Bob finally sends s to Alice’s contract, while acquiring the 1 BTC. The swap is completed.

Questions:

a) If Bot halts in Step 2, what is the result?

b) If Carol halts in Step 5, what is the result?

c) If Carol posts her contract with Alice before Bob posts his contract with Carol, what is the result?

d) If Carol’s contract with Bob were to expire at the same time as Bob’s contract with Alice, what is the result?

e) If Alice reveals the secret s before Step 3 completes, what is the result?

Answer 1

a) If Bob aborts before step 2, then Alice will not reveal s. 6T will elapse and Alice will get her BTC back. If Bob aborts after step 2, then Alice will not reveal s, as she has no incentive to do so - only Carol is paid, so why would Alice reveal s and lose her BTC for nothing? Again the timeout is reached.

b) If Carol aborts before step 5, Alice receives the NMC, but Carol's payment times out and so Carol does not receive the LTC (and it is given back to Bob, who will, at the end of the protocol, have both LTC and BTC). However, Bob can continue executing the protocol and receive his BTC, so Carol aborting is only harming her. If Carol aborts after step 5, she will get her LTC payment. Alice has already received her NMC and Bob can continue executing the protocol to receive his BTC.

c) This does not make any difference in the protocol.

d) This would be a problem if Alice's contract expires in 6T, but both Bob's and Carol's expire in 4T. Alice could wait until time 3T has elapsed to claim the coins from Carol's contract. As soon as s is seen on the NMC blockchain by Bob and Carol, time 4T has elapsed. In this case, Carol can no longer claim her coins, as Bob's contract has now expired. Hence, the 1 LTC is returned to Bob. However, Bob can also claim the 1 BTC. So, in case Carol sees that Bob's contract has an expiration of 4T she should refused to create her contract.

e) In case Alice reveals s prior to step 3, Carol has not yet created the smart contract. If she is rational, she will not continue executing the protocol. If both Bob and Carol are rational, Bob can take the 1 BTC and Carol can take the 1 LTC. Then Alice is left without any money. Hence, Alice can only harm herself by revealing s early.

Maurice Herlihy has written a paper on atomic swaps involving multiple parties which I recommend.

PS: Typically, stopping execution in the middle of a distributed protocol is called "aborting", not "halting". The "Halting problem" usually refers to something else in theoretical computer science.