A footprint-minimal coinswap protocol. Alice gives a coin to the Server, provided the Server gives a coin to Bob. There is no trust involved. Because all swaps go through the Server and the timelock eventually expires in their favor, a large number of swaps can be aggregated in a single UTXO that is efficiently on-chain redeemable by them. This comes at the cost of not being able to instantly access their funds, meaning the Server ends up locking up a substantial amount of coins.
All transactions that are involved with A sending to B
Alice (A) holds coins with Server (S) that she can trustlessly redeem
On-chain UTXO_1 looks as follows:
A+S || S in 1 month
A has an off-chain REDEEM_TX (signed by S) that spends from UTXO_1 with the following output:
A+S || A in 1 month
Now A wants to send her coins to Bob (B)
S promises to fund and create new on-chain UTXO_2 that will look as follows:
B+S || S in 1 month
B receives an off-chain REDEEM_TX (signed by S) that spends from UTXO_2 with the following output:
B+S || B in 1 month
If UTXO_2 appears on-chain, B will be paid.
A wants to forfeit her claim on UTXO_1 (i.e. A to S) provided UTXO_2 appears on-chain (i.e. S to B)
In order to achieve this, A signs the following FORFEIT_TX that spends her REDEEM_TX:
S if UTXO_2 exists* || A in 1 month
*This kind of script is not possible today but is easier to explain, actual non-softfork version explained later
The effect is that S can claim the funds from UTXO_1 if UTXO_2 is published.
Ideal/expected outcome:
Spublishes UTXO_2, meaningBgot paidAwon't publish her REDEEM_TX- The timelock on UTXO_1 expires and
Sclaims the funds (timelock could be circumvented ifAreleases her privkey)
Outcome adversarial A:
Spublishes UTXO_2, meaningBgot paidApublishes her REDEEM_TXSpublishes the corresponding FORFEIT_TX and claims the funds
Outcome adversarial S:
Snever publishes UTXO_2, soBdid NOT get paidApublishes her REDEEM_TXSpublishes the corresponding FORFEIT_TX- The FORFEIT_TX timelock expires and
Aclaims the funds
Outcome offline A:
Afails to askSto transfer the funds toBAfails to publish her REDEEM_TX in time- The timelock on UTXO_1 expires and
SclaimsA's funds
The protocol that was described thus far isn't any more efficient than A simply sending an on-chain payment to B. The final trick is that a single UTXO can contain coins for multiple users.
UTXO_1 is being shared here by two users and is eventually fully claimable by S
For instance, let's say A and B both had coins in the same pool as illustrated above. UTXO 1 would then be A+B+S || S in 1 month and this would branch off in a tree to two off-chain UTXOs with A+S || S in 1 month and B+S || S in 1 month. If both A and B forfeit their claim as expected, the off-chain UTXOs will never go on-chain. This works with any number of users and is what makes the protocol efficient.
Creating this transaction structure currently requires A+B+S to pre-sign, meaning all recipients have to interact with each other whenever a new UTXO is being created. OP_CTV would remove that requirement (update: this scheme similarly reduces interactivity without requiring CTV).
A single user might publish a REDEEM_TX. That single user will have to pay the fees to expand the tree of off-chain transactions and reach their specific output. This is costly to that user and thus puts a economic limit on what the smallest viable denomination inside Ark could be.
Also, since the tree got expanded, S now has to spend log(n) outputs instead of 1 in order to claim the funds.
Instead of swapping for a new off-chain REDEEM_TX with S, it is also simply possible to swap for an on-chain output without any timelocks, allowing for an optimally efficient exit.
The transaction that contains UTXO_2 could contain another small ANCHOR_OUTPUT that can only be spent by S. A can then include it as an input to her FORFEIT_TX to S. Now the FORFEIT_TX can't be sent on-chain unless the transaction containing UTXO_2 as well as the ANCHOR_OUTPUT go on-chain first, thus fulfilling the "if UTXO_2 exists" condition.
The ANCHOR_OUTPUT can be kept off-chain by placing it inside an off-chain tree of transactions, though this does mean S has to expand the tree if it ever needed the anchor.
The main upside is the simplified interaction and no messy issues with eviction - spending coins doesn't require you to interact with all the people in the pool, just S.
The main downside is reduced liquidity - the coins the Server receives back won't be available to them immediately, so the faster coins move hands, the more of S's liquidity becomes locked up. If we assume a locktime of 30 days and on average 1BTC moving hands every 10 minutes, then S will end up having 6 * 24 hours * 30 days = 4320BTC locked up.
A transfer isn't complete until the relevant UTXO confirms on-chain. However, if the recipient is willing to trust S never to change transactions that are waiting to be confirmed, transfers could be subjectively viewed as instant.
The aim of this write-up was to concisely explain the core concepts behind Ark, as the original documentation has been difficult for many (myself included) to comprehend. Full accuracy was not the goal - and a lot of it was educated guess work / reverse engineering - so the actual Ark design will perhaps differ somewhat (though hopefully not massively) from what is written here.
Thanks! I think that substantially matches my understanding and
hopefully matches what we published in this week's optech newsletter,
although I was a bit more abstract there as I knew my attempt to
reconstruct the details of the protocol was likely to differ from the
particulars he had in mind, and I didn't want a minor error in the
details to imply that the broader description was invalid.
In your description, you assume the OP_UTXO_EXISTS_VERIFY opcode exists.
I didn't feel like Keceli was actually pushing for that, so I ignored it
and looked at just the anchors version. (Also OP_UTXO_EXISTS_VERIFY
seems like a huge footgun for S during a reorg.) I think anchors only is
actually simpler and makes it easier to compare the protocol to previous
work by other people.
Nitpick, this is obviously correct but it might be better to say "with
A's cooperation". Releasing privkeys is always kinda scary, and
according to an interview with Keceli on the Stephan Livera podcast
(around time index 20m, I'd guess), he's planning to use silent payment
style addresses where the release of A's privkey would compromise all
her other funds.
Your OP_CTV analysis here seems accurate, but FYI, I got the
impression that Keceli is really looking for something like
OP_TLUV or OP_EVICT that will allow A to exit from the pool
for a fixed cost and will keep S's costs constant no
matter how many exits there are.
I hadn't caught this implication, thanks!
I hadn't thought about it that way until reading this, but I think you
could call this an automatic evicting payment pool---if you don't pay
your monthly rent, you either need leave or the landlord gets all
your stuff.
I think maybe that idea could be applied to previously described payment
pools. E.g., the problem with n-of-n multisignature payment pools is
that it's combinatorial to create presigned eviction transactions for
each participant. But what if a pool of N "users" did:
...and also n-of-n presigned N transactions giving each "user" an exit
for their funds which returns the remaining funds to the remaining N-1
"users"? ("Users" in quotes because multiple users could be the same
person, and we'd want to be robust against that.)
The problems with that approach are (1) your ability to spend can be
blocked for up to 28 days and (2) having to take an action within 28
days or you lose your money is kinda scary. Both of those problems also
apply to Keceli's approach. (1) is mitigated to a reasonable degree by
the service provider losing reputation and income if they go offline;
(2) remains a problem AFAICT---you could leave your exit transaction
with watchtowers, but they'd have to be trusted watchtowers since one of
them could broadcast maliciously and burn your fees.
Also, nitpick, your text says "1 month" but all your diagrams say "1
week".
Thanks again for the awesome description! I really wish I had this when
I started digging into the proposal.