# Aborting a three-way swap

Suppose Alice has 1 BTC, Bob has 1 LTC, and Carol has 1 NMC. Alice wants NMC for BTC, Bob wants BTC for LTC, and Carol wants LTC for NMC. Assume each cryptocurrency has the same value and can be 1-to-1 transferred. They need to make a three-way swap: Alice will transfer BTC to Bob, Bob will transfer LTC to Carol, and Carol will transfer NMC to Alice. However, there is no trusted authority/intermediary. Preliminary:

H is a cryptographic hash function. Hashlock h indicates that if A sends the contract a value s, (i.e., a secret) such that h = H(s), then the contract irrevocably transfers ownership of those altcoins from B to A. Timelock T indicates that if A fails to produce that secret before time T elapses, then the escrowed altcoins are refunded to B. Here, T is the enough time for one user to publish a smart contract on any blockchain, and for the other user to detect that the contract has been published.

Detailed swap is as follows.

Step 1: Alice creates a secret s, such that h = H(s). Then, she publishes a contract on the BTC blockchain with hashlock h (timelock 6T in the future), to transfer her BTC to Bob.

Step 2: Bob first confirms whether Alice’s contract has been published on the BTC blockchain or not. If true, he publishes a contract on the LTC blockchain with the same hashlock h (with timelock 5T in the future), to transfer his LTC to Carol.

Step 3: Carol first confirms whether Bob’s contract has been published on the LTC blockchain or not. If true, she publishes a contract on the NMC blockchain with the same hashlock h (timeout 4T in the future), to transfer her NMC to Alice.

Step 4: Alice first confirms whether Carol’s contract has been published on the title blockchain or not. If true, she sends the secret s to Carol’s contract, while acquiring 1 NMC and revealing s to Carol.

Step 5: Carol then sends s to Bob’s contract, while acquiring 1 LTC and revealing the secret s to Bob.

Step 6: Bob finally sends s to Alice’s contract, while acquiring the 1 BTC. The swap is completed.

Questions:

a) If Bot halts in Step 2, what is the result?

b) If Carol halts in Step 5, what is the result?

c) If Carol posts her contract with Alice before Bob posts his contract with Carol, what is the result?

d) If Carol’s contract with Bob were to expire at the same time as Bob’s contract with Alice, what is the result?

e) If Alice reveals the secret s before Step 3 completes, what is the result?

a) If Bob aborts before step 2, then Alice will not reveal `s`. `6T` will elapse and Alice will get her BTC back. If Bob aborts after step 2, then Alice will not reveal `s`, as she has no incentive to do so - only Carol is paid, so why would Alice reveal `s` and lose her BTC for nothing? Again the timeout is reached.
d) This would be a problem if Alice's contract expires in `6T`, but both Bob's and Carol's expire in `4T`. Alice could wait until time `3T` has elapsed to claim the coins from Carol's contract. As soon as `s` is seen on the NMC blockchain by Bob and Carol, time `4T` has elapsed. In this case, Carol can no longer claim her coins, as Bob's contract has now expired. Hence, the 1 LTC is returned to Bob. However, Bob can also claim the 1 BTC. So, in case Carol sees that Bob's contract has an expiration of `4T` she should refused to create her contract.
e) In case Alice reveals `s` prior to step 3, Carol has not yet created the smart contract. If she is rational, she will not continue executing the protocol. If both Bob and Carol are rational, Bob can take the 1 BTC and Carol can take the 1 LTC. Then Alice is left without any money. Hence, Alice can only harm herself by revealing `s` early.