Skip to content

Instantly share code, notes, and snippets.

@RandyMcMillan

RandyMcMillan/shot-htlc.md

Forked from moonsettler/shot-htlc.md
Created October 22, 2025 11:33
Show Gist options
  • Save RandyMcMillan/d59e6bdad6f946aa855a4d20945c9e7e to your computer and use it in GitHub Desktop.
Save RandyMcMillan/d59e6bdad6f946aa855a4d20945c9e7e to your computer and use it in GitHub Desktop.
Download ZIP
SHOT - Schnorr HTLC Obfuscation Technique
Raw
shot-htlc.md

SHOT - Schnorr HTLC Obfuscation Technique

Taproot internal key aggregation

  • P = p·G taproot internal public key
  • p = a·b taproot internal private key

Alice and Bob reveal each other their pubkey for the session, and then both can generate the same address.

  • A = a·G Alice (buyer of UTXO)
  • B = b·G Bob (seller of UTXO)
  • P = A·b = a·B DH key exchange

Bob can use hardened derivation to generate a one-time use private-public keypair for each session.

An LN invoice is created by Bob with b used as secret and H(b) as the hash lock. Alice upon paying the invoice learns the internal taproot private key and can spend unilaterally.

Taproot scriptspend

There is no way to prove the relationship between B = b·G and H(b), but that is why you have the HTLC as a fallback. On the happy path if Bob is playing honestly Alice can spend without revealing this was a swap. It just looks like a taproot keyspend. if not, then it falls back to an HTLC on script path.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment