MIME-Version: 1.0
From: Haoyu LIN <chris.haoyul@gmail.com>
Date: Fri, 9 Aug 2019 21:35:19 +0800
Message-ID: <CAEtgg6GOdceubg+b=-MvH66CKGBy-67mbQR01JpG3L1YJ1jaVw@mail.gmail.com>
To: bitcoin-dev@lists.linuxfoundation.org
Content-Type: multipart/alternative; boundary="000000000000758090058faf3f47"
Cc: jiangshan.yu@monash.edu, runchao.han@monash.edu
Subject: [bitcoin-dev] OP_LOOKUP_OUTPUT proposal
Precedence: list

--000000000000758090058faf3f47
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi everybody!

Runchao, Jiangshan (both CC'ed) and I bring up a BIP draft that describes a
new opcode OP_LOOKUP_OUTPUT, which is used for mitigating the arbitrage
risk in a HTLC-based Atomic Swap.

The problem is called the "free premium problem", where the initiator can
abort the deal (i.e. have optionality) without any penalty. See
https://lists.linuxfoundation.org/pipermail/lightning-dev/2018-May/001292.h=
tml
and
https://lists.linuxfoundation.org/pipermail/lightning-dev/2018-December/001=
752.html
for detail.

We have investigated this problem in very detail. We analysed how
profitable the arbitrage can be given the default timelock setting (24/48
hrs). Our result shows that the profit can be approximately 1% ~ 2.3%,
which is non-negligible compared with 0.3% for stock market. This can be
attractive as it's totally risk-free. Please refer to our paper
https://eprint.iacr.org/2019/896, and the related code
https://github.com/HAOYUatHZ/fair-atomic-swap if interested.

Several studies have proposed for solving this problem e.g.,
http://diyhpl.us/wiki/transcripts/scalingbitcoin/tokyo-2018/atomic-swaps/
and https://coblox.tech/docs/financial_crypto19.pdf. Their basic idea is
that, the transaction for the premium needs to be locked with the same
secret hash but with a flipped payout, i.e. when redeemed with the secret,
the money goes back to Alice and after timelock, the premium goes to Bob as
a compensation for Alice not revealing the secret. However, this introduces
a new problem: Bob can get the premium without paying anything, by never
participating in.

To solve this, the transaction verifier needs to know the status of an
dependent transaction. Unfortunately, Bitcoin does not support the stateful
transaction functionalities. Therefore, we propose the new opcode:
OP_LOOKUP_OUTPUT. It takes the id of an output, and produces the address of
the output=E2=80=99s owner. With OP_LOOKUP_OUTPUT, the Bitcoin script can d=
ecide
whether Alice or Bob should take the premium by `<output> OP_LOOKUP_OUTPUT
<pubkeyhash> OP_EQUALVERIFY`.

Assume that Alice and Bob exchange asset1 and asset2, and using premium
(same asset type as asset2) as the collateral.

A sample premium transaction implementation of Atmoic Swap for Spot based
on this opcode is:

```
ScriptSig:
    Redeem: <Bob_sig> <Bob_pubkey> 1
    Refund: <Alice_sig> <Alice_pubkey> 0
ScriptPubKey:
    OP_IF // Normal redeem path
        // the owner of <asset2_output> should be Alice
        // which means Alice has redeemed asset2
        <asset2_output> OP_LOOKUP_OUTPUT <Alice_pubkeyhash> OP_EQUALVERIFY
        OP_DUP OP_HASH160 <Bob_pubkeyhash>
    OP_ELSE // Refund path
        // the premium timelock should be expired
        <locktime> OP_CHECKLOCKTIMEVERIFY OP_DROP
        OP_DUP OP_HASH160 <Alice pubkey hash>
    OP_ENDIF
    OP_EQUALVERIFY
    OP_CHECKSIG
```

We also explore the Atomic Swaps in American Call Options scenario, which
is different from the Spot scenario. Alice should pay for the premium
besides the underlying asset, regardless of whether the swap is successful
or not. In reality, the option sellers are trustworthy - the option sellers
never abort the contract. However, in Atomic Swaps, Bob can abort the
contracts like Alice. To keep the Atomic Swap consistent with the American
Call Options, the premium should follow that: Alice pays the premium to Bob
if 1) Alice redeems Bob=E2=80=99s asset before Bob=E2=80=99s timelock, or 2=
) Bob refunds
his asset after Bob=E2=80=99s timelock but before Alice=E2=80=99s timelock.=
 If Alice=E2=80=99s
timelock expires, Alice can refund her premium back.

A sample premium transaction implementation of Atmoic Swap for Option based
on this opcode is:

```
ScriptSig:
    Redeem: <Bob_sig> <Bob_pubkey> 1
    Refund: <Alice_sig> <Alice_pubkey> 0
ScriptPubKey:
    OP_IF // Normal redeem path
        // the owner of the asset2 should not be the contract
        // it should be either (redeemde by) Alice or (refunded by) Bob
        // which means Alice has redeemed asset2
        <asset2_output> OP_LOOKUP_OUTPUT <Alice_pubkeyhash> OP_NUMEQUAL
        <asset2_output> OP_LOOKUP_OUTPUT <Bob_pubkeyhash> OP_NUMEQUAL
        OP_ADD 1 OP_NUMEQUALVERIFY
        OP_DUP OP_HASH160 <Bob_pubkeyhash>
    OP_ELSE // Refund path
        // the premium timelock should be expired
        <locktime> OP_CHECKLOCKTIMEVERIFY OP_DROP
        OP_DUP OP_HASH160 <Alice pubkey hash>
    OP_ENDIF
    OP_EQUALVERIFY
    OP_CHECKSIG
```

Again, please refer to https://eprint.iacr.org/2019/896 if you need more
detail. The BIP draft can be found at
https://github.com/HAOYUatHZ/bips/blob/bip-lookup_output/bip-lookup_output.=
mediawiki

To conclude, in order to avoid the risk-free optionality in Atomic Swap, we
propose a new opcode OP_LOOKUP_OUTPUT, using premium to mitigate the risk
of Atomic Swap both in Spot and in Option.

--000000000000758090058faf3f47
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi everybody!<br><br>Runchao, Jiangshan (both CC&#39;ed) a=
nd I bring up a BIP draft=C2=A0that describes a new opcode OP_LOOKUP_OUTPUT=
, which is used for mitigating the arbitrage risk in a HTLC-based Atomic Sw=
ap.<br><br>The problem is called the &quot;free premium problem&quot;, wher=
e the initiator can abort the deal (i.e. have optionality) without any pena=
lty. See <a href=3D"https://lists.linuxfoundation.org/pipermail/lightning-d=
ev/2018-May/001292.html">https://lists.linuxfoundation.org/pipermail/lightn=
ing-dev/2018-May/001292.html</a> and <a href=3D"https://lists.linuxfoundati=
on.org/pipermail/lightning-dev/2018-December/001752.html">https://lists.lin=
uxfoundation.org/pipermail/lightning-dev/2018-December/001752.html</a> for =
detail.<br><br>We have investigated this problem in very detail. We analyse=
d how profitable the arbitrage can be given the default timelock setting (2=
4/48 hrs). Our result shows that the profit can be approximately 1% ~ 2.3%,=
 which is non-negligible compared with 0.3% for stock market. This can be a=
ttractive as it&#39;s totally risk-free. Please refer to our paper <a href=
=3D"https://eprint.iacr.org/2019/896">https://eprint.iacr.org/2019/896</a>,=
 and the related code <a href=3D"https://github.com/HAOYUatHZ/fair-atomic-s=
wap">https://github.com/HAOYUatHZ/fair-atomic-swap</a> if interested.<br><b=
r>Several studies have proposed for solving this problem e.g., <a href=3D"h=
ttp://diyhpl.us/wiki/transcripts/scalingbitcoin/tokyo-2018/atomic-swaps/">h=
ttp://diyhpl.us/wiki/transcripts/scalingbitcoin/tokyo-2018/atomic-swaps/</a=
> and <a href=3D"https://coblox.tech/docs/financial_crypto19.pdf">https://c=
oblox.tech/docs/financial_crypto19.pdf</a>. Their basic idea is that, the t=
ransaction for the premium needs to be locked with the same secret hash but=
 with a flipped payout, i.e. when redeemed with the secret, the money goes =
back to Alice and after timelock, the premium goes to Bob as a compensation=
 for Alice not revealing the secret. However, this introduces a new problem=
: Bob can get the premium without paying anything, by never participating i=
n.<br><br>To solve this, the transaction verifier needs to know the status =
of an dependent transaction. Unfortunately, Bitcoin does not support the st=
ateful transaction functionalities. Therefore, we propose the new opcode: O=
P_LOOKUP_OUTPUT. It takes the id of an output, and produces the address of =
the output=E2=80=99s owner. With OP_LOOKUP_OUTPUT, the Bitcoin script can d=
ecide whether Alice or Bob should take the premium by `&lt;output&gt; OP_LO=
OKUP_OUTPUT &lt;pubkeyhash&gt; OP_EQUALVERIFY`.<br><br>Assume that Alice an=
d Bob exchange asset1 and asset2, and using premium (same asset type as ass=
et2) as the collateral.<br><br>A sample premium transaction implementation =
of Atmoic Swap for Spot based on this opcode is:<br><br>```<br>ScriptSig:<b=
r>=C2=A0 =C2=A0 Redeem: &lt;Bob_sig&gt; &lt;Bob_pubkey&gt; 1<br>=C2=A0 =C2=
=A0 Refund: &lt;Alice_sig&gt; &lt;Alice_pubkey&gt; 0<br>ScriptPubKey:<br>=
=C2=A0 =C2=A0 OP_IF // Normal redeem path<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 //=
 the owner of &lt;asset2_output&gt; should be Alice<br>=C2=A0 =C2=A0 =C2=A0=
 =C2=A0 // which means Alice has redeemed asset2<br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 &lt;asset2_output&gt; OP_LOOKUP_OUTPUT &lt;Alice_pubkeyhash&gt; OP_E=
QUALVERIFY <br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 OP_DUP OP_HASH160 &lt;Bob_pubkey=
hash&gt;<br>=C2=A0 =C2=A0 OP_ELSE // Refund path<br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 // the premium timelock should be expired<br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 &lt;locktime&gt; OP_CHECKLOCKTIMEVERIFY OP_DROP<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 OP_DUP OP_HASH160 &lt;Alice pubkey hash&gt;<br>=C2=A0 =C2=A0 OP_=
ENDIF<br>=C2=A0 =C2=A0 OP_EQUALVERIFY<br>=C2=A0 =C2=A0 OP_CHECKSIG<br>```<b=
r><br>We also explore the Atomic Swaps in American Call Options scenario, w=
hich is different from the Spot scenario. Alice should pay for the premium =
besides the underlying asset, regardless of whether the swap is successful =
or not. In reality, the option sellers are trustworthy - the option sellers=
 never abort the contract. However, in Atomic Swaps, Bob can abort the cont=
racts like Alice. To keep the Atomic Swap consistent with the American Call=
 Options, the premium should follow that: Alice pays the premium to Bob if =
1) Alice redeems Bob=E2=80=99s asset before Bob=E2=80=99s timelock, or 2) B=
ob refunds his asset after Bob=E2=80=99s timelock but before Alice=E2=80=99=
s timelock. If Alice=E2=80=99s timelock expires, Alice can refund her premi=
um back.<br><br>A sample premium transaction implementation of Atmoic Swap =
for Option based on this opcode is:<br><br>```<br>ScriptSig:<br>=C2=A0 =C2=
=A0 Redeem: &lt;Bob_sig&gt; &lt;Bob_pubkey&gt; 1<br>=C2=A0 =C2=A0 Refund: &=
lt;Alice_sig&gt; &lt;Alice_pubkey&gt; 0<br>ScriptPubKey:<br>=C2=A0 =C2=A0 O=
P_IF // Normal redeem path<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 // the owner of t=
he asset2 should not be the contract<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 // it s=
hould be either (redeemde by) Alice or (refunded by) Bob<br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 // which means Alice has redeemed asset2<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 &lt;asset2_output&gt; OP_LOOKUP_OUTPUT &lt;Alice_pubkeyhash&gt; =
OP_NUMEQUAL<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 &lt;asset2_output&gt; OP_LOOKUP_=
OUTPUT &lt;Bob_pubkeyhash&gt; OP_NUMEQUAL<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 OP=
_ADD 1 OP_NUMEQUALVERIFY<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 OP_DUP OP_HASH160 &=
lt;Bob_pubkeyhash&gt;<br>=C2=A0 =C2=A0 OP_ELSE // Refund path<br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 // the premium timelock should be expired<br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 &lt;locktime&gt; OP_CHECKLOCKTIMEVERIFY OP_DROP<br>=C2=A0=
 =C2=A0 =C2=A0 =C2=A0 OP_DUP OP_HASH160 &lt;Alice pubkey hash&gt;<br>=C2=A0=
 =C2=A0 OP_ENDIF<br>=C2=A0 =C2=A0 OP_EQUALVERIFY<br>=C2=A0 =C2=A0 OP_CHECKS=
IG<br>```<br><br>Again, please refer to <a href=3D"https://eprint.iacr.org/=
2019/896">https://eprint.iacr.org/2019/896</a> if you need more detail. The=
 BIP draft can be found at <a href=3D"https://github.com/HAOYUatHZ/bips/blo=
b/bip-lookup_output/bip-lookup_output.mediawiki">https://github.com/HAOYUat=
HZ/bips/blob/bip-lookup_output/bip-lookup_output.mediawiki</a><br><br>To co=
nclude, in order to avoid the risk-free optionality in Atomic Swap, we prop=
ose a new opcode OP_LOOKUP_OUTPUT, using premium to mitigate the risk of At=
omic Swap both in Spot and in Option.<br></div>

--000000000000758090058faf3f47--