Interoperability
withCryptocurrency-backed Tokens
Alexei Zamyatin

Dominik Harz

Joshua Lind, Panayiotis Panayiotou, Arthur Gervais, William Knottenbelt

Scaling Bitcoin 2018, Tokyo

Motivation

PrivacyConsensus
Finality

Scalability

Challenge:
Secure, privacy preserving,scalable and decentralized
cross-chain communication

Different
Properties
Security

Transparency

Today:
Over 2000 heterogeneous
cryptocurrencies

Scaling Bitcoin 2018

Expressiveness

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_2

A History of Theft and Loss

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_3

A History of Theft and Loss

DecentralizedExchanges?

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_4

Cross-Chain Communication Today
Centralized exchanges (CeX)• Predominant method to exchange assets cross-chain• > 99% of volume

Decentralized Exchanges (DeX):• < 1% of volume• Mostly limited to ERC20 tokens on Ethereum Not „Cross-chain“!

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_5

Atomic Cross-Chain Swaps* (2012)• Ensure A  B and A  B occur atomically• Hashed Time-Lock Contracts (HTLCs)

Challenges:
All parties must be online- No standardized interface for locks- Need out-of-band channel- Race conditions, mempool sniffing, …

-(censoring!)- Require monitoring of all involved
chains*we refer to the base form of ACCS. Other constructions possible
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_6

Cryptocurrency-Backed Tokens
Tokens / on-chain assets backed 1:1 by an existing cryptocurrency
e.g. Bitcoin-backed tokens on Ethereum
Generality
Fungibility
Divisibility
Value Redeemability
Transfer Atomicity
Consistency
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_7

Challenge: Conditional Locks in Bitcoin
Goal:Unlock funds on Bitcoin only when tokens are burned
Challenge:
We cannot verify the state of e.g. Ethereum
Can we use hashlocks?
Publicly verifiable contracts cannot generate random secret We need an intermediary
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_8

System Model and Principles
Creator: locks coins to issue tokens
Redeemer: burns tokens to receive coins
Sender/Receiver: Send/receive backed
tokensIssuer: ensures correct issuing/redeeming on
backing chain.
Non-trusted and collateralized
Treasury: responsible for issuing, trading andredeeming on issuing chain
Publicly verifiable smart contract
Scaling Bitcoin 2018

Intermediaries

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_9

Treasury Contract
Base functionality:
Issue - Transfer - Redeem
Chain Relay:• Verify PoW• Verify TX inclusion proof

Collateralization:• Lock• Conditional release

Optional: Verify HTLC
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_10

System Requirements
Backing Chain

Issuing Chain(Smart Contracts)
Chain relays• Verify PoW of backing chain• Verify transaction inclusion

Hashed-timelock contracts(optional)

On-chain assets / meta information• Tokens, colored coins, ….
Conditional payments• Collateralization

e.g. Bitcoin, Ethereum, EthereumClassic, Litecoin, …

Scaling Bitcoin 2018e.g. Ethereum, Ethereum Classic,
Zilliqa, Cardano?, …

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_11

Cryptocurrency-Backed Tokens
Achievable advantages:+ Non-interactive+ Standardized token interface+ Logic handled by publicly verifiable+ Wallet in backing chain only needed

smart contract

when redeeming+ No need to monitor backing chains

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_12

Cryptocurrency-Backed Tokens
Achievable advantages:+ Non-interactive+ Standardized token interface+ Logic handled by publicly verifiable+ Wallet in backing chain only needed

smart contract

when redeeming+ No need to monitor backing chains Can be traded on decentralized exchanges
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_13

Protocols

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_14

IssueScaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_15

Issue: Precondition

 Over-collateralization to mitigate exchange rate fluctuations
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_16

IssueScaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_17

IssueScaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_

18

IssueScaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_

19

IssueScaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_20

IssueOnly issue if Issuer locked sufficient collateral!
 Challenge: race conditions
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_21

Issue – Race Conditions
Potential Problems:•

Simultaneous issuing•

Issuer withdraws collateral before Alice can finalize process••••••

Alice and Carol try to lock same portion of Issuer‘s collateral
Loser of the race looses BTC

Security waiting period for inclusion proof
Ethereum transaction inclusion timeLatencyDoS

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_22

Mitigation 1 – Delayed Collateral Withdraw
Issuer must announce withdrawal of unused collateral:
1) Announce2) Delay• finalize pending requests• users know race conditions are now possible
3) Withdraw

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_23

Mitigation 2 – Collateralized Commitments

Alice registers issue commitment in treasury
 Temporarily locks Issuer‘s eth collateral
Requirement: Alice must provide collateral to prevent griefing
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_24

Mitigation 3 – HTLCs

1) Alice locks funds in HTLC on Bitcoin
2) Reveals pre-image via treasury ONLY IF Issuer’s collateral available3) Issuer withdraws from HTLC
Requirement: treasury must verify HTLC  Give Issuer enough time to withdraw
Scaling Bitcoin 2018Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_25

Trade…

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_26

Trade…

Simple ERC20 transfer!
Alice  Bob

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_27

Redeem

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_28

Redeem

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_29

RedeemIssuer
3) Observe / Verify
Bitcoin

EthereumX2) Signal to„unlock btc“X1) Lock / BurnXBobBob

Ethereum transaction
Bitcoin transaction
Off-chain/other interaction
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_30

Redeem

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_31

Redeem

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_32

Redeem

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_33

RedeemIf the Issuer cannot provide proof of correct
behavior:
 Collateral slashed Bob reimbursed
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_34

Implementation

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_35

Trustless via BTC Relay

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_36

Optimization 1: SGX Relay

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_37

Optimization 2: SGX Issuer

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_38

Performance and Costs
Protocol# TxCost

SGX relay

SGX Issuer

Issue - HTLC

40.63 USD

- 35%
(0.41 USD)

- 35%(0.41 USD)

Issue – Collateral

30.36 USD

- 33%
(0.24 USD)

- 33%
(0.24 USD)

Trade

10.02 USD+/- 0%(0.02 USD)+/- 0%(0.02 USD)

Redeem30.39 USD

- 32%
0.26 USD- 73%
0.10 USDBTC Relay cost per day ~25 million gas ~27 USD* Exchange rate: USD 220 / ETH; Gas cost: 5 gwei
Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_39

Security Challenges
ChallengeMitigation

Infrastructure DoS

Multiple issuers and/or chain relays to distributeresponsibility

Eclipse Attacks
Collateral deterioration

Over-collateralize issuer

Chain reorganizations
and forking attacks

Dynamic contestation period based on tx value
Encrypt the public key of redeeming address

User privacy (cross-chain linking)Mixing services in treasury contract
Privacy techniques (zk-proof and ring-signatures)

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_40

Challenges and Ongoing Work
Feasibility of chain relays

Multi-signatures to prevent theft•

Off-chain verification games: TrueBit,Arbitrage, …

•Fund freeze still possible
 Collateral on backing-chain?

•Compact proofs: NiPoPoWs, …

•Higher costs and less usable payment channels?

Issuer committees

Exchange rate stabilization•

Optimistic improvement of safety andliveness•

Optimal parametrization of security
parameters?

•Single view for users despite dynamicmembership•

Interactive re-negotiation of collateral

Scaling Bitcoin 2018

Cryptocurrency-backed Tokens - @alexeiZamyatin @nud3l_41

Questions?
Alexei Zamyatin

Dominik Harz

@alexeiZamyatin@nud3l_a.zamyatin@imperial.ac.uk

d.harz@imperial.ac.uk

Resources
Paper(pre-print):

Posteron multisigs:

Join our Slack: