<p>It is a prerequisite for atomic swaps that funds must be staged in outputs under shared control of both trading parties in both networks. This is achieved with a output script construction that has two spending conditions, where one spending condition requires both parties to sign off and the other spending condition allows the original owner to reclaim the funds in case the swap fails after a timeout.</p>
<p>The atomic swap protocol is insecure if one retains sole control of the staged funds. That would allow that party to divert those funds back to themselves once the other side has sent their funds.</p>
<p>On networks without on-chain multisig primitives, shared custody can be achieved through MPC.</p>

CC BY-SA 4.0
2023-12-08T16:39:07.340Z
2023-12-08T16:39:07.340Z
Murch
<p>I'm reading this paper on atomic swap between BTC and XMR: <a href="https://arxiv.org/pdf/2101.12332.pdf" rel="nofollow noreferrer">https://arxiv.org/pdf/2101.12332.pdf</a> and wonder if atomic swap with BTC is flawed by design.</p>
<p>My understanding is that, if Alice locks up XMR with a secret key <code>s_a</code>, she can then move the BTC Bob locked up after he broadcasts an adaptor signature by  combining it with <code>s_a</code>. However, what if Alice's XMR wasn't locked with <code>s_a</code> but with another key? Bob would still broadcast the same adaptor signature and Alice could still move the BTC to her wallet. Bob can't spend the XMR and will be funded back to Alice.</p>
<p>Am I missing something?</p>

<signature><schnorr-signatures><atomic-swap>
Is atomic swap flawed?
John M.
# Is atomic swap flawed?

(Asked by: username_0 on 2023-12-08)

I'm reading this paper on atomic swap between BTC and XMR: <https://arxiv.org/pdf/2101.12332.pdf> and wonder if atomic swap with BTC is flawed by design.

My understanding is that, if Alice locks up XMR with a secret key `s_a`, she can then move the BTC Bob locked up after he broadcasts an adaptor signature by combining it with `s_a`. However, what if Alice's XMR wasn't locked with `s_a` but with another key? Bob would still broadcast the same adaptor signature and Alice could still move the BTC to her wallet. Bob can't spend the XMR and will be funded back to Alice.

Am I missing something?

**Tags:** signature, schnorr-signatures, atomic-swap


---

## 1 answers

### Answer by username_1 on 2023-12-08. Score: 1

It is a prerequisite for atomic swaps that funds must be staged in outputs under shared control of both trading parties in both networks. This is achieved with a output script construction that has two spending conditions, where one spending condition requires both parties to sign off and the other spending condition allows the original owner to reclaim the funds in case the swap fails after a timeout.

The atomic swap protocol is insecure if one retains sole control of the staged funds. That would allow that party to divert those funds back to themselves once the other side has sent their funds.

On networks without on-chain multisig primitives, shared custody can be achieved through MPC.


---

