Adapting CoinSwap for a Fungibility Market

coinswap.txt

In the protocol all parties are assumed to have private communications channels.

Phase 0. Sets up the escrows and their timeout refunds.
Phase 1. Makes it so that if Bob gets paid there is no way for Alice to fail to get paid.
Phase 2. Just releases the escrows directly because everyone is happy that cheating isn't possible.

  Alice                           Bob
  =========================================================
0. Compute TX_0: A>2of2{A,B'} | Compute TX_1: B>2of2{B,A'} \
1. Send TX_0 TXID ------------>                             |
2.                <------------ Send TX_1 TXID              |
3. Compute TX_1 locked refund | Compute TX_0 locked refund  |  Phase 0
4.                <------------ Send TX_0_refund            |
5. Send TX_1_refund ---------->                             |
6. Announces TX_0 to network  | Announces TX_1 to network  /
8.     Network confirms TX_0: Alice >  2of2{A,B'}
9.     Network confirms TX_1: Bob   >  2of2{B,A'}
A. Selects secret value X     |                            \
E. Sign(TX_2: TX_0>B"+X, A')  |                             |
F. Send TX_2 template   ------------->                      |  Phase 1
G.                            | Sign(TX_3: TX_1>A"+X, B')   |
H.               <------------- Send TX_3 template         /
     from now on, Alice can defect (but reveal X)
J.                            | Computes TX_4: TX_1>A'     \
K.               <------------- Send TX_4                   |
L. Signs and announces TX_4   |                             |
M.     Network confirms TX_4: Bob > Alice via 2of2 {B,A'}   | Phase 2
N. Computes TX_5: TX_0 > B'   |                             |
O. Send TX_5      ------------>                             |
P.                            |Signs and announces TX_5     |
Q.     Network confirms TX_5: Alice > Bob via 2of2 {A,B'}  /
  =========================================================

gmaxwell's original notes:

Note that Alice could also pay the role of Bob, so that Bob doesn't have to take part in the protocol. She could then send on the freshly disconnected coins directly to Bob in the final release.

Also note that care related to mutability is required for the refunds until transaction mutability is solved.

Another key point is that Carol also receives unlinked coins (from Alice), and so in a P2P network a party could equally play the role of Alice or Carol, taking on whichever position was required.

TX_0_refund must have a further future locktime than TX_1_refund. Otherwise Bob can delay step (I.) in the protocol until the refunds become valid and then announce TX_3 while Alice announces TX_0_refund in order to try to cause Alice to get refunded while Bob still gets paid.

Proposal by @AdamISZ with some discussion here