<p>Basically this depends on the knowledge of random number <em>X</em> :</p>

<p><strong>Bitcoin</strong></p>

<pre><code>      TX1      (To redeem: reveal secret number X or refund)
A   -------&gt; B  ----&gt;
</code></pre>

<p><strong>Altcoin</strong></p>

<pre><code>     TX2       (To redeem: reveal secret number X or refund)
B   -------&gt; A  ----&gt;
</code></pre>

<ul>
<li>So in both cases the refund transaction(signed by both A and B) is a lock time transaction so that the sender can claim back the money after a given time</li>
<li>Now to claim the money in TX2, A will reveal <em>X</em> on altcoin blockchain (through spending script)</li>
<li>B will read this secret <em>X</em> from altcoin blockchain and redeem money from TX1 in bitcoin blockchain</li>
</ul>

<p>Now let us look at some cases:</p>

<ul>
<li>If A never reveals the secret <em>X</em> : First B gets his refund and then after 24 hours A gets his refund. The difference in refund times is there to avoid  case where A gets the refund and then reveals X to keep both bitcoin and altcoins. </li>
<li>A reveals the secret <em>X</em> on altcoin blockchain:  B has to reveal <em>X</em> on bitcoin blockchain before A's refund transaction lock time kicks in.</li>
</ul>

CC BY-SA 3.0
2017-06-05T08:22:22.013Z
2017-06-05T08:32:02.600Z
2017-06-05T08:32:02.600Z
dark knight
<p>I think this is easier to understand if you abstract a little bit. On a high level, an atomic swap is very simple: the two parties set up transactions such that they can both take their coins be revealing the preimage to some (pre-decided) hash <code>H</code>. Initially one party knows the preimage. They must reveal it to take their coins, so the act of taking their coins is sufficient to enable the other party to take their coins.</p>

<p>More specifically the Tier Nolan in the OP works as follows.</p>

<ol>
<li>A chooses a random <code>x</code> and gives <code>H(x)</code> to B.</li>
<li>A sends her coins to a 2-of-2 output that can be taken by B if he reveals <code>x</code>. Similarly B sends his coins to a 2-of-2 output that can be taken by A if she reveals <code>x</code>. These are TX1 and TX3, respectively.</li>
<li>(Before broadcasting these, they create locktimed "refund" transactions TX2 and TX4. It's important that A's locktime is much longer than B's, so that if she gets her refund, B has had a long time to take his refund, and is not at risk of A revealing <code>x</code> to also take his coins.)</li>
<li>At this point, A takes her coins, revealing <code>x</code>.</li>
<li>Seeing this, B learns <code>x</code> and takes his coins.</li>
</ol>

<p>There is a variant of this called <a href="https://bitcointalk.org/index.php?topic=321228" rel="noreferrer">coinswap</a> where <code>x</code> does not hit the blockchain, where steps (4) and (5) are replaced by A revealing <code>x</code> off-chain and then the signers just give each other the coins, only using <code>x</code> as a fallback. This complicates the locktime structure and also requires differently-shaped transactions to keep <code>x</code> and its hash off the blockchain, which unfortunately make the protocol look super scary, but that's all that's going on.</p>

CC BY-SA 3.0
2017-06-05T17:43:44.420Z
2017-06-05T17:43:44.420Z
Andrew Poelstra
<p>I'm reading up the wiki page here: <a href="https://en.bitcoin.it/wiki/Atomic_cross-chain_trading" rel="noreferrer">https://en.bitcoin.it/wiki/Atomic_cross-chain_trading</a></p>

<p>I understand a user can create a transaction without <em>signing</em> it and not <em>broadcasting</em> it to the network. I know this is the main concept to get atomic swaps to work. But I'm a bit confused on how each step works exactly. Can someone explain each line? </p>

<pre><code> A picks a random number x

 A creates TX1: "Pay w BTC to &lt;B's public key&gt; if (x for H(x) known and signed by B) or (signed by A &amp; B)"

 A creates TX2: "Pay w BTC from TX1 to &lt;A's public key&gt;, locked 48 hours in the future, signed by A"

 A sends TX2 to B

 B signs TX2 and returns to A

 1) A submits TX1 to the network

 B creates TX3: "Pay v alt-coins to &lt;A-public-key&gt; if (x for H(x) known and signed by A) or (signed by A &amp; B)"

 B creates TX4: "Pay v alt-coins from TX3 to &lt;B's public key&gt;, locked 24 hours in the future, signed by B"

 B sends TX4 to A

 A signs TX4 and sends back to B

 2) B submits TX3 to the network

 3) A spends TX3 giving x

 4) B spends TX1 using x

 This is atomic (with timeout).  If the process is halted, it can be reversed no matter when it is stopped.

 Before 1: Nothing public has been broadcast, so nothing happens
 Between 1 &amp; 2: A can use refund transaction after 72 hours to get his money back
 Between 2 &amp; 3: B can get refund after 24 hours.  A has 24 more hours to get his refund
 After 3: Transaction is completed by 2
 - A must spend his new coin within 24 hours or B can claim the refund and keep his coins
 - B must spend his new coin within 72 hours or A can claim the refund and keep his coins

 For safety, both should complete the process with lots of time until the deadlines.
</code></pre>

<sidechains><atomic-swap>
Can someone ELI5 to me for Bitcoin Atomic Swaps?
Patoshi パトシ
# Can someone ELI5 to me for Bitcoin Atomic Swaps?

(Asked by: username_0 on 2017-06-04)

I'm reading up the wiki page here: <https://en.bitcoin.it/wiki/Atomic_cross-chain_trading>

I understand a user can create a transaction without *signing* it and not *broadcasting* it to the network. I know this is the main concept to get atomic swaps to work. But I'm a bit confused on how each step works exactly. Can someone explain each line?

```
 A picks a random number x

 A creates TX1: "Pay w BTC to <B's public key> if (x for H(x) known and signed by B) or (signed by A & B)"

 A creates TX2: "Pay w BTC from TX1 to <A's public key>, locked 48 hours in the future, signed by A"

 A sends TX2 to B

 B signs TX2 and returns to A

 1) A submits TX1 to the network

 B creates TX3: "Pay v alt-coins to <A-public-key> if (x for H(x) known and signed by A) or (signed by A & B)"

 B creates TX4: "Pay v alt-coins from TX3 to <B's public key>, locked 24 hours in the future, signed by B"

 B sends TX4 to A

 A signs TX4 and sends back to B

 2) B submits TX3 to the network

 3) A spends TX3 giving x

 4) B spends TX1 using x

 This is atomic (with timeout).  If the process is halted, it can be reversed no matter when it is stopped.

 Before 1: Nothing public has been broadcast, so nothing happens
 Between 1 & 2: A can use refund transaction after 72 hours to get his money back
 Between 2 & 3: B can get refund after 24 hours.  A has 24 more hours to get his refund
 After 3: Transaction is completed by 2
 - A must spend his new coin within 24 hours or B can claim the refund and keep his coins
 - B must spend his new coin within 72 hours or A can claim the refund and keep his coins

 For safety, both should complete the process with lots of time until the deadlines.

```

**Tags:** sidechains, atomic-swap


---

## 2 answers

### Answer by username_2 on 2017-06-05. Score: 5 | Accepted answer

I think this is easier to understand if you abstract a little bit. On a high level, an atomic swap is very simple: the two parties set up transactions such that they can both take their coins be revealing the preimage to some (pre-decided) hash `H`. Initially one party knows the preimage. They must reveal it to take their coins, so the act of taking their coins is sufficient to enable the other party to take their coins.

More specifically the Tier Nolan in the OP works as follows.

1. A chooses a random `x` and gives `H(x)` to B.
2. A sends her coins to a 2-of-2 output that can be taken by B if he reveals `x`. Similarly B sends his coins to a 2-of-2 output that can be taken by A if she reveals `x`. These are TX1 and TX3, respectively.
3. (Before broadcasting these, they create locktimed "refund" transactions TX2 and TX4. It's important that A's locktime is much longer than B's, so that if she gets her refund, B has had a long time to take his refund, and is not at risk of A revealing `x` to also take his coins.)
4. At this point, A takes her coins, revealing `x`.
5. Seeing this, B learns `x` and takes his coins.

There is a variant of this called [coinswap](https://bitcointalk.org/index.php?topic=321228) where `x` does not hit the blockchain, where steps (4) and (5) are replaced by A revealing `x` off-chain and then the signers just give each other the coins, only using `x` as a fallback. This complicates the locktime structure and also requires differently-shaped transactions to keep `x` and its hash off the blockchain, which unfortunately make the protocol look super scary, but that's all that's going on.


---

### Answer by username_1 on 2017-06-05. Score: 3

Basically this depends on the knowledge of random number *X* :

**Bitcoin**

```
      TX1      (To redeem: reveal secret number X or refund)
A   -------> B  ---->

```

**Altcoin**

```
     TX2       (To redeem: reveal secret number X or refund)
B   -------> A  ---->

```

* So in both cases the refund transaction(signed by both A and B) is a lock time transaction so that the sender can claim back the money after a given time
* Now to claim the money in TX2, A will reveal *X* on altcoin blockchain (through spending script)
* B will read this secret *X* from altcoin blockchain and redeem money from TX1 in bitcoin blockchain

Now let us look at some cases:

* If A never reveals the secret *X* : First B gets his refund and then after 24 hours A gets his refund. The difference in refund times is there to avoid case where A gets the refund and then reveals X to keep both bitcoin and altcoins.
* A reveals the secret *X* on altcoin blockchain: B has to reveal *X* on bitcoin blockchain before A's refund transaction lock time kicks in.


---

