Probabilistic Atomic Swaps for Bitcoin and Friends

Abstract: Atomic swaps are a fundamental primitive for the trustless exchange of digital assets across blockchains: they guarantee that either both parties receive the agreed assets or neither party transfers. While this all-or-nothing guarantee is powerful, it also imposes an inherent determinism that rules out exchanges whose intended outcome is probabilistic. As a result, existing atomic swaps cannot realize trustless exchanges in which one party pays for a fixed chance of receiving a larger asset or reward, as in lotteries, randomized allocation mechanisms, and probabilistic cross-chain trades. We introduce probabilistic swaps, a new cryptographic primitive that extends atomic swaps to the probabilistic setting. In a probabilistic swap, one party's transfer is executed with a fixed, publicly specified probability embedded in the protocol and cannot be biased by either party. This yields a trustless mechanism for randomized exchange with verifiable odds and no trusted intermediary. Our construction combines adaptor signatures with oblivious pseudorandom functions (OPRFs) to realize the desired probabilistic outcome while ensuring that neither party can predict or bias it in advance. Along the way, we introduce a new mechanism for the atomic exchange of OPRF evaluations for payments, which may be of independent interest. A key feature of our approach is that it preserves the minimal on-chain footprint of modern atomic-swap protocols. The protocol relies only on standard Bitcoin scripts, such as digital signatures and timelocks, and is deployable on any blockchain that already supports atomic swaps. Consequently, probabilistic swaps are indistinguishable from ordinary on-chain transactions, which helps preserve privacy and fungibility. We provide formal security foundations and demonstrate practicality through a probabilistic swap in the Bitcoin testnet and in the Lightning Network.

• The paper introduces a probabilistic atomic swap mechanism that extends deterministic atomic swaps by enabling chance-based asset exchanges with precisely defined odds.
• It employs adaptor signatures and OPRFs to ensure fairness, privacy, and resistance to bias while keeping the on-chain footprint minimal and compatible with Bitcoin scripts.
• Empirical results demonstrate sub-millisecond cryptographic operations and feasibility across Bitcoin/Litecoin networks, including cross-chain and Lightning Network implementations.

Probabilistic Atomic Swaps: A Cryptographic Extension of Deterministic Atomic Exchanges

Introduction and Motivation

Atomic swaps are a fundamental trustless mechanism for exchanging digital assets across blockchains, enforcing strong atomicity: either both parties receive their agreed assets, or neither does. However, classical atomic swaps guarantee deterministic outcomes, which are insufficient for scenarios—such as lotteries, wagers, or randomized allocation—where the outcome should be probabilistic with precisely specified odds. The paper "Probabilistic Atomic Swaps for Bitcoin and Friends" (2605.04975) extends this core primitive to probabilistic atomic swaps, enabling one party to pay for a publicly verifiable chance of obtaining an asset, while ensuring fairness, cryptographic bias resistance, and retaining the minimal on-chain footprint of standard atomic swaps.

Limitations of Prior Work

Previous blockchain-based solutions to lotteries or probabilistic exchanges have required complex smart contracts and on-chain logic, incurring significant costs in transaction size, fees, script distinguishability, and reduced compatibility across script-limited blockchains. For example, Bitcoin lottery schemes have involved elaborate scripting or multi-party coordination, while atomic swaps remained strictly deterministic. Such approaches limit portability and fungibility and do not provide a minimal and private abstraction for probabilistic exchange.

Cryptographic Construction: Combining Adaptor Signatures and OPRFs

The proposed construction introduces the "probabilistic swap" primitive, in which one party (the "dealer") locks an asset and another party (the "player") submits a payment for a fixed probability $p$ of winning the asset. Crucially, this protocol preserves privacy and atomicity: the outcome is determined only after both parties are committed, and neither party can bias the process or abort strategically based on knowledge of the outcome.

The protocol's design is anchored by two key cryptographic components:

1. Adaptor Signatures: These enable a transaction to be unlocked only upon revelation of a witness for a hard cryptographic relation—used extensively in scriptless atomic swaps.
2. Oblivious Pseudorandom Functions (OPRFs): A two-party protocol where the dealer (holding a secret key) enables the player to evaluate a PRF on an input such that the dealer never learns the input, and the player never acquires the key.

The protocol mechanism operates as follows:

• The dealer selects a secret "target value" in a domain of size $m$ and encodes it as a statement for the adaptor signature.
• The player chooses a guess and engages the dealer as an OPRF server to obtain the function evaluation on the guess.
• The OPRF evaluation itself is encrypted and tied—via an adaptor signature—to the party-to-dealer payment transaction; the player receives the OPRF output (and hence the opportunity to adapt the dealer's pre-signature and claim the asset) if and only if the dealer is paid.
• The probability of success is precisely $1/m$, and the outcome is information-theoretically hidden from both parties until after their commitments.

The protocol also devises a general "atomic OPRF evaluation for payment" subroutine, which may be more broadly useful in OPRF-driven applications.

Security Model and Protocol Analysis

The paper provides a simulation-based security framework, generalizing prior atomic swap ideal functionalities to the probabilistic context. The security definition guarantees "probabilistic atomicity": either the protocol executes such that the dealer is compensated and the player receives the asset with probability $p$, or no transfer happens and neither learns the outcome. Critically, revelation or aborts cannot be conditioned on outcome knowledge.

The security proof leverages the extractability and adaptability guarantees of modern adaptor signatures, along with the pseudorandomness and input-privacy of OPRFs. The coin lockings are realized via standard Bitcoin scripts (digital signatures and timelocks), maintaining compatibility and stealth with ordinary transactions and incurring no additional on-chain distinguishability.

Implementation and Empirical Results

The protocol was instantiated using Schnorr-based adaptor signatures and a 2Hash-DH OPRF, with well-formedness proofs provided both via Bulletproofs (constant-size, but random oracle model) and a scalable cut-and-choose strategy. The implementation demonstrates:

• Bitcoin/Litecoin on-chain swaps: Executed using four Taproot transactions per swap, indistinguishable from standard transfers.
• Cross-chain swaps: Feasibly executed between Bitcoin and Litecoin testnets, leveraging the protocol's dependence only on signature verification and timelocks.
• Lightning Network variant: Realized via adaptation to HTLC-based channels, with off-chain proofs where necessary.

Performance benchmarks indicate sub-millisecond cryptographic operations outside the well-formedness proofs, with Bulletproofs offering constant-size proofs and cut-and-choose being preferential for moderate domain sizes. Microbenchmarking places all relevant cryptographic protocol steps well within practical constraints for user experience.

Extensions, Trade-offs, and Theoretical Implications

The construction admits several extensions and explicitly addresses its limitations:

• Generalization to arbitrary rational probabilities: By allowing multiple concurrent guesses, the win probability can be set to $a/b$ for $a, b \in \mathbb{N}$.
• Post-quantum instantiability: The protocol structure can leverage PQ-safe building blocks (PQ OPRFs, PQ adaptor signatures, PQ encryption).
• Avoidance of on-chain timelocks: Optionally, verifiable timed signatures can replace script-level locking in systems that support them.
• Deployment on Layer-2 and Payment Channels: The protocol requires only primitives that are being adopted for PTLCs on Lightning and is compatible with off-chain execution.

A fundamental impossibility result precludes fully symmetric two-sided probabilistic swaps on scriptless blockchains without additional trust or fairness primitives, as the party learning the outcome first could always abort when disadvantageous.

Conclusion

This work rigorously extends the atomic swap primitive to the probabilistic domain without sacrificing privacy, compatibility, or on-chain minimalism. By leveraging adaptor signatures and OPRFs, it allows protocol-level realization of lotteries, wagers, and probabilistic asset exchange on Bitcoin-compatible blockchains and payment channels. The cryptographic and protocol frameworks developed are robust, and the implementation results confirm the practicality and efficiency of the approach. This advancement unlocks a broader set of decentralized financial applications, filling a gap in existing atomic swap paradigms without enlarging the trust or privacy surface of blockchain protocols (2605.04975).