I’m not sure whether this is the right category for this discussion, so please feel free to move it if needed.
Atomic swaps are listed under interoperability on the grants wishlist, and I’ve also seen considerable interest in them in previous community discussions. I’d be interested to hear how the community currently views their role in the Zcash ecosystem.
Recent regulatory developments seem to be creating a growing need and interest in exchange mechanisms that do not rely on centralized custody or identity requirements. Given Zcash’s strong focus on privacy, it seems like the two could be a natural fit.
I’d also be interested in hearing what people see as the main technical, security, or practical considerations surrounding atomic-swap projects.
I understand that liquidity is one of the main considerations for any exchange-related project. With that in mind, would integrating Zcash atomic swaps into an existing exchange system be viewed as a viable approach, rather than trying to build a completely separate system from scratch?
I’m mainly hoping to better understand the community’s perspective and priorities. Thanks.
The main issue with atomicity on Zcash is most so-called atomic swaps are not shielded, but transparent. At that point, you’re just copy pasting a Bitcoin HTLC.
Shielded swaps CAN technically be made atomic via adaptor signatures, but then the issue becomes mempool frontrunning largely (via chain reorganisations), but it is still an emerging field. Just a couple days ago I saw a paper to Asiacrypt that allows such adaptor signature swaps via NIZKs, for example.
But generally, then the issue becomes UX and user trust, since now the wallets have to individually implement a custom signature type. What is the guarantee that the signature won’t steal your funds? Conversely, most users are locked out of it, and thus nobody uses it.
So would you say swaps are still not that valuable if they use a transparent address, even though users can use a one-time address for the swap and move the funds in and out of the shielded pool afterward?
If the swap is going out of Zcash, then no, it’s not even a little bit valuable because it reveals the activity of the person during making the intent, which can be privacy destroying. Generally fine while bridging into ZEC though, but then you run into a UX issue: users who cannot be online when the swap completes will have their privacy compromised as they cannot claim the money without revealing when they are generally online.
Bottom line:
a) Swap from ZEC requiring a transparent address: shitty, not valuable at all
b) Swap into ZEC requiring a claim from the ZEC side: eh, kinda good, still breaks privacy
Could you clarify what activity is revealed in case (a)? If the user funds a fresh transparent address from the shielded pool, it seems like the observable activity is limited to the swap payment arriving and the funds subsequently being shielded. For a later swap, they could use another fresh address, so I’m not sure how that would be linked to the previous one or to the user’s broader activity.
The swap itself would still be observable through the order book or the other chain, even if the funds were sent directly into a shielded address. So is the main concern that the transparent address reveals the user’s claim timing or online activity, rather than that it reveals their identity or transaction history?
From the counterparty’s perspective, wouldn’t the user’s ZEC still be coming from the shielded pool through a one-time address, meaning they can observe the swap but not learn much about the person who made it?
It reveals the TIMING on Zcash. Say I wish to swap 10 ZEC for some BTC right now. So I unshield right now. An onlooker KNOWS that since I unshielded now and subsequently do the swap later, the INTENT to swap was established much before than the actual swap, at the time of unshielding. Further, the adversary knows how long it took for me to initiate the swap and actually do it. Literally nobody said anything about the address. Further, another issue becomes that shielded transaction fees: for complex transactions (such as HTLCs), transparent ZEC fees can change based on wallet. This is not an issue in shielded ZEC, where the fee is largely constant as there’s no complex logic, and thus wallets can be discerned.
… You can use a relayer service to relay the swap, rendering any obtained order book timing data meaningless, can you not?
But the counterparty is not the one you are defending against, it’s an abstract adversary who wants to punish you for using Zcash and you want to evade them.
How are ZSAs relevant here? They do not add any new scripting capabilities to Zcash shielded. A Zcash asset is simply a changed base point for calculations.
That… doesn’t involve ZSAs at all? It’s just an adaptor signature scheme, which I already mentioned is too fragile because adaptor signatures are NOT supported by default. It would need to be added as a custom signature type, and it is provable that your shielded wallet signed the swap (due to the adaptor signature) which leaves a trail.
EDIT: Clarifying, I said not supported for WALLETS.
Further, adaptor signatures have a risk of being frontrun, because the signature you reconstruct is still a signature that was signed by the other party and it can be overridden or frontrun. One only needs to pay a ~$90-ish fee to have a miner include their transaction first, with a decent probability they win if the pool is big enough. This happens because adaptor signatures have no concept of finality and you’re entirely vulnerable to being orphaned (a block reorganisation).
This is an example of an accelerator which claims to hold 81% of network hashpower in its consortium for a decent chunk of change ($1,144)
I never disagreed with that? The point is that the signature has to be recoverable (the signer must always be derivable from the signature) for validation to work, that’s literally how validation works. So it logically follows that someone with an adaptor signature can directly prove that you initiated an adaptor signature swap, a property known as non-repudiability (you cannot deny a swap ever took place using your wallet).
