Statechains:
Off-chain Transfer ofUTXO Ownership
Ruben Somsen
Email: rsomsen@gmail.com
Twitter: @SomsenRuben

What Statechains Achieve

What Statechains Achieve- L2 scaling by avoiding on-chain transactions

What Statechains Achieve- L2 scaling by avoiding on-chain transactions- Advantage over Lightning:unrestricted coin movement (has synergy)

What Statechains Achieve- L2 scaling by avoiding on-chain transactions- Advantage over Lightning:unrestricted coin movement (has synergy)- Advantage over Federated Sidechains:federation doesn’t have full control

What Statechains Achieve- L2 scaling by avoiding on-chain transactions- Advantage over Lightning:unrestricted coin movement (has synergy)- Advantage over Federated Sidechains:federation doesn’t have full control- Unique limitation: can only move full UTXO amountWhat Statechains Build On- Schnorr signatures- Adaptor signatures- Eltoo- GraftrootWhat Statechains Build On- Schnorr signatures- Adaptor signatures- Eltoo- GraftrootWorks on any cryptocurrency that supports the above1 BTC

High-level Overview

ABACAD1 BTC

High-level Overview- Change UTXO ownership off-chainABACAD

1 BTC

High-level Overview- Change UTXO ownership off-chain

AB- Guaranteed on-chain redemption (D)ACAD

1 BTC

High-level Overview- Change UTXO ownership off-chain

AB- Guaranteed on-chain redemption (D)- Facilitated by “statechain entity” (A)ACAD

1 BTC

High-level Overview- Change UTXO ownership off-chain

AB- Guaranteed on-chain redemption (D)- Facilitated by “statechain entity” (A)AC- A can collude with prior owners (B, C)

AD

1 BTC

High-level Overview- Change UTXO ownership off-chain

AB- Guaranteed on-chain redemption (D)- Facilitated by “statechain entity” (A)AC- A can collude with prior owners (B, C)- Collusion/cheating always provableADBob locks up 1 BTC with Alice...
inoutBAB

on-chainBob locks up 1 BTC with Alice...
inout

B

AB

on-chain…but who owns it?

Bob owns it
inoutinout

BABABB

on-chainoff-chaineltoo: AB orB in 5 days

Bob owns it
inout

inoutBABABB

on-chainoff-chain

Can Bob transfer this off-chain to Carol?
inout

inoutBABAB

B

on-chainoff-chain

Can Bob transfer this off-chain to Carol?
Sort of, but Carol has no control over itinoutinoutBAB

AB

C

on-chainoff-chain

So Bob uses a transitory key X instead
inoutinout

B

AXAX

B

on-chainoff-chain

So Bob uses a transitory key X insteadand passes the key on to Carol
inoutinout

BAX

AX

C

on-chainoff-chain

The role of the statechain entity (A)The role of the statechain entity (A)- Promises to only cooperate with the last owner

The role of the statechain entity (A)- Promises to only cooperate with the last owner- Can be a federation

Schnorr:
A1+A2+A3=A

The role of the statechain entity (A)- Promises to only cooperate with the last owner- Can be a federation- Updates the statechain:Schnorr:
A1+A2+A3=A- listing all UTXOs it controls (no duplicates)- every transfer has a signature (e.g. B to C)Bitcoin
1 BTC
B

AX

Bitcoin
1 BTC
B

AX

AX

B

BitcoinStatechain

1 BTC

1 BTC

B

AX

AXBX

BitcoinStatechain

1 BTC

1 BTC

B

AXX

AXB

B

BitcoinStatechain

1 BTC

1 BTC

B

AXX

AX

B

B

AXC

C

eltooBitcoinStatechain

1 BTC

1 BTC

B

AX

X

AX

B

B

AX

CC

Problem: who goes first?
1 BTC

1 BTC

B

AX

X

AX

B

B

Statechain entity A goes first…?
1 BTC

1 BTC

B

AX

X

AX

B

B

AX

C

User B goes first…?
1 BTC

1 BTC

B

AX

X

AX

B

B
C

Solution: Adaptor Signatures
1 BTC

1 BTC

B

AX

X

AX

B

B

Everyone shares an incomplete signature
1 BTC

1 BTC

B

AX

X

AX

B

B

AX

C

C

Completing the statechain signature...
1 BTC

1 BTC

B

AX

X

AX

BBAXCC...automatically completes the bitcoin signature
1 BTC

1 BTC

BAXX

AXB

B

AXCC

Security Model

Bitcoin:
A+X
Statechain: B / C / D / E (knows X)
Owner:
Prev. Last

Security Model

Bitcoin:
A+X
Statechain: B / C / D / E (knows X)
Owner:
Prev. Last

- Moving the coins always requires the permission of:a. Statechain entity A (typically a federation)b. a transitory key holder (who held the UTXO)

Security Model

Bitcoin:
A+X
Statechain: B / C / D / E (knows X)
Owner:
Prev. Last

- Moving the coins always requires the permission of:a. Statechain entity A (typically a federation)b. a transitory key holder (who held the UTXO)- Entity must cooperate with LAST transitory key holder

Security Model

Bitcoin:
A+X
Statechain: B / C / D / E (knows X)
Owner:
Prev. Last

- Moving the coins always requires the permission of:a. Statechain entity A (typically a federation)b. a transitory key holder (who held the UTXO)- Entity must cooperate with LAST transitory key holder- Failure to do so will produce evidence of fraudWorst case scenario

Worst case scenario- Entity obtains a bunch of transitory keys (X, Y, Z…)

Worst case scenario- Entity obtains a bunch of transitory keys (X, Y, Z…)- Proceeds to (provably) steal the coins

Worst case scenario- Entity obtains a bunch of transitory keys (X, Y, Z…)- Proceeds to (provably) steal the coins- Uncompromised transitory keys withdraw on-chain

Worst case scenario- Entity obtains a bunch of transitory keys (X, Y, Z…)- Proceeds to (provably) steal the coins- Uncompromised transitory keys withdraw on-chain
Harmless without transitory keys (weak assumption):- The statechain entity gets hacked

Worst case scenario- Entity obtains a bunch of transitory keys (X, Y, Z…)- Proceeds to (provably) steal the coins- Uncompromised transitory keys withdraw on-chain
Harmless without transitory keys (weak assumption):- The statechain entity gets hacked- Court order to freeze/confiscate coinsSwapping to smaller amounts
1 BTC

1 BTC

2 BTCXYZBBCSwapping to smaller amounts
1 BTC

1 BTC

2 BTCXYZ

B

B

CCC

B

Possible with other coins
1 BTC

1 BTC

200 LTC

X

YZBB

CCCB

Microtransactions“Anything smaller than an economically viable UTXO”

Microtransactions“Anything smaller than an economically viable UTXO”- Required if Statechain entity wants to charge fees

Microtransactions“Anything smaller than an economically viable UTXO”- Required if Statechain entity wants to charge fees
- Needed when swapping between multiple currencies

Microtransactions“Anything smaller than an economically viable UTXO”- Required if Statechain entity wants to charge fees
- Needed when swapping between multiple currencies- Ideally solved without trusting the statechain entity(important legal reason: no custody over ANY coins)Lightning Channel Creation
1 BTC

1 BTC

B

AXX

AX

BB

Lightning Channel Creation
1 BTC

1 BTC

B

AXX

AX

B

B

AXBCBCLightning Channel Creation
1 BTC

1 BTC

B

AXX

AXB

B
0.9 BTC

BAX

BC

BC
C
0.1 BTCBC

Lightning on Statechains

Lightning on Statechains- Channel updated together with multi atomic swap

Lightning on Statechains- Channel updated together with multi atomic swap
- Small channels: up to the amount of the smallest UTXO

Lightning on Statechains- Channel updated together with multi atomic swap
- Small channels: up to the amount of the smallest UTXO
- Uncooperative close similar to regular EltooLightning on Statechains- Channel updated together with multi atomic swap
- Small channels: up to the amount of the smallest UTXO
- Uncooperative close similar to regular Eltoo- Close/reopen channel low-friction: it’s all off-chain!
(e.g. adding/removing bitcoins)Potential Use Cases

Potential Use Cases- Off-chain value transfer

Potential Use Cases- Off-chain value transfer- Platform for Lightning channels

Potential Use Cases- Off-chain value transfer- Platform for Lightning channels- Betting channels (multisig, Discreet Log Contracts)

Potential Use Cases- Off-chain value transfer- Platform for Lightning channels- Betting channels (multisig, Discreet Log Contracts)- Fork-agnostic ETF (UTXOs don’t move)Further topics

Further topics- Non-interactive version

Further topics- Non-interactive version- Use HSM to transfer transitory key (attestation)

Further topics- Non-interactive version- Use HSM to transfer transitory key (attestation)- Graftroot withdrawal (allows redeeming forks)

Further topics- Non-interactive version- Use HSM to transfer transitory key (attestation)- Graftroot withdrawal (allows redeeming forks)- Succinctly store and relay statechain (per UTXO)

Further topics- Non-interactive version- Use HSM to transfer transitory key (attestation)- Graftroot withdrawal (allows redeeming forks)- Succinctly store and relay statechain (per UTXO)- Variant using blind signatures:
Entity unaware which UTXOs it holds (unblind p2p)

Paper: goo.gl/RWQ4ue
Email: rsomsen@gmail.com
Twitter: @SomsenRuben

Thank You
Paper: goo.gl/RWQ4ue
Email: rsomsen@gmail.com
Twitter: @SomsenRuben

Thank You
Paper: goo.gl/RWQ4ue
Email: rsomsen@gmail.com
Twitter: @SomsenRuben

Bitcoinprior stateon-chain state
BAX

AX

AX or
B*

*timelock

AX

AX or
C*

new stateBitcoinon-chain stateB

AXStatechainprior state

“AX”

AX or
B*

B

AX

*timelock

AX

AX or
C*

new state

Clast ownerprior stateon-chain stateB

AX
1 BTC

AX

AX or
B*Lightning
0.9 BTC*timelock

AX

AX or
BC*B
BCC

new state

0.1 BTC