I'm reading this paper on atomic swap between BTC and XMR: https://arxiv.org/pdf/2101.12332.pdf and wonder if atomic swap with BTC is flawed by design.

My understanding is that, if Alice locks up XMR with a secret key s_a, she can then move the BTC Bob locked up after he broadcasts an adaptor signature by combining it with s_a. However, what if Alice's XMR wasn't locked with s_a but with another key? Bob would still broadcast the same adaptor signature and Alice could still move the BTC to her wallet. Bob can't spend the XMR and will be funded back to Alice.

Am I missing something?

1 Answer 1


It is a prerequisite for atomic swaps that funds must be staged in outputs under shared control of both trading parties in both networks. This is achieved with a output script construction that has two spending conditions, where one spending condition requires both parties to sign off and the other spending condition allows the original owner to reclaim the funds in case the swap fails after a timeout.

The atomic swap protocol is insecure if one retains sole control of the staged funds. That would allow that party to divert those funds back to themselves once the other side has sent their funds.

On networks without on-chain multisig primitives, shared custody can be achieved through MPC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.