Cross-Chain Payment Protocols with Success Guarantees

Abstract

In this paper, we consider the problem of cross-chain payment whereby customers of different escrowsimplemented by a bank or a blockchain smart contract-successfully transfer digital assets without trusting each other. Prior to this work, cross-chain payment problems did not require this success or any form of progress. We introduce a new specification formalism called Asynchronous Networks of Timed Automata (ANTA) to formalise such protocols. We present the first cross-chain payment protocol that ensures termination in a bounded amount of time and works correctly in the presence of clock skew. We then demonstrate that it is impossible to solve this problem without assuming synchrony, in the sense that each message is guaranteed to arrive within a known amount of time. We also offer a protocol that solves an eventually terminating variant of this cross-chain payment problem without synchrony, and even in the presence of Byzantine failures.

A TLA+ Formal Proof of a Cross-Chain Swap

“…Although putting assets in escrow is present in most cross-chain protocols, this property makes the specification protocol dependent. The same analysis applies to [19]. Conversely, the P sw ap and [25] specification are completely protocol-agnostic.…”

“…The sub-transaction that characterises the bitcoin transfer will never occur. Thereby, we face the violation of the Atomicity and Commitment property [19] and [6] show that atomicity in a system in the presence of malicious participants cannot be all or nothing. They define an algorithm that can perform cross-chain transfers through intermediaries without asserting atomicity.…”

“…Unlike P sw ap , [6] and [25] describe the protocol in natural language, without using a formal approach (e.g. by a pseudo-code or an automaton, like in [19]). It is not intuitive to identify the exact behaviour of the protocol participants.…”

“…However, in the current literature, swap specifications do not agree on what a swap protocol should guarantee in terms of safety and liveness properties [7]. In addition, underlying timing and failure assumptions vary from a protocol to another [5][8] [25] [19]. In synchronous solutions [5] [8], based on timed actions, a swap can result in a correct but slow participant being worse-off at the end of the swap.…”