Skip to content

Instantly share code, notes, and snippets.

@moonsettler

moonsettler/shot-htlc.md

Last active September 6, 2025 08:22
Show Gist options
  • Save moonsettler/eee3e283e70751154fdf5bc0ac7c1283 to your computer and use it in GitHub Desktop.
Save moonsettler/eee3e283e70751154fdf5bc0ac7c1283 to your computer and use it in GitHub Desktop.
Download ZIP
SHOT - Schnorr HTLC Obfuscation Technique
Raw
shot-htlc.md

SHOT - Schnorr HTLC Obfuscation Technique

Taproot internal key aggregation

  • P = p·G taproot internal public key
  • p = a·b taproot internal private key

Alice and Bob reveal each other their pubkey for the session, and then both can generate the same address.

  • A = a·G Alice (buyer of UTXO)
  • B = b·G Bob (seller of UTXO)
  • P = A·b = a·B DH key exchange

Bob can use hardened derivation to generate a one-time use private-public keypair for each session.

An LN invoice is created by Bob with b used as secret and H(b) as the hash lock. Alice upon paying the invoice learns the internal taproot private key and can spend unilaterally.

Taproot scriptspend

There is no way to prove the relationship between B = b·G and H(b), but that is why you have the HTLC as a fallback. On the happy path if Bob is playing honestly Alice can spend without revealing this was a swap. It just looks like a taproot keyspend. if not, then it falls back to an HTLC on script path.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment