TokenSwap: Cross-Chain Atomic Exchange

• TokenSwap is a decentralized exchange mechanism that enables atomic, cryptographic transfers of digital assets across distinct blockchain ecosystems.
• The mechanism utilizes hashed timelock contracts (HTLCs) to ensure either complete exchange or safe asset recovery, reducing counterparty risk.
• Advanced variants incorporate multi-party coordination, predicate-based fault tolerance, and threshold cryptography to handle shared asset ownership and economic incentives.

TokenSwap denotes a class of decentralized exchange facilities in which digital assets are exchanged directly under cryptographic conditions rather than through a centralized intermediary. In the blockchain literature, the term is used most prominently for wallet-to-wallet exchange of cryptocurrencies and other digital tokens, including “coloured coins” such as deeds, stocks, bonds, or intellectual property, across separate ledgers. Its defining property is atomicity in the database sense: either the exchange completes in full or each party safely recovers its original position. The core motivation is interoperability across otherwise isolated blockchain ecosystems, coupled with reduced reliance on legacy exchanges, reduced counterparty exposure, and extension of exchange primitives from monetary tokens to broader tokenized assets (Miraz et al., 2019).

1. Origins and historical trajectory

The early TokenSwap trajectory begins with attempts to remove centralized exchanges from cross-chain trading. A precursor, P2PTradeX, was proposed by Sergio Demian Lerner in 2012 as a wallet-to-wallet trade mechanism, but it remained incomplete because Alice could still be exposed to Bob’s refusal to complete after Alice had already committed. The first full atomic cross-chain swap procedure is attributed to Tier Nolan in 2013. The first known practical execution occurred in September 2017 between Decred (DCR) and Litecoin (LTC), followed shortly by LTC-BTC swaps. The period also saw an Ethereum-Bitcoin atomic swap by Altcoin.io, and incorporation of atomic-swap ideas by projects such as 0x, Lightning Labs, and Komodo/BarterDEX. At that stage, deployment was real but still early-stage rather than mainstream (Miraz et al., 2019).

A parallel line of work formalized TokenSwap as a distributed coordination problem. In "Atomic Cross-Chain Swaps" (Herlihy, 2018), a swap is modeled as a directed graph $\mathcal D=(V,A)$, where vertices are parties and arcs are proposed asset transfers. The protocol-theoretic guarantees are: if all parties conform, all swaps take place; if some coalition deviates, no conforming party ends up worse off; and no coalition has an incentive to deviate. The paper proves that a uniform swap protocol for $\mathcal D$ is atomic iff $\mathcal D$ is strongly connected, and gives a constructive hashed-timelock protocol with time complexity $O(\mathrm{diam}(\mathcal D))$ and space complexity $O(|A|^2)$ (Herlihy, 2018).

2. Canonical HTLC-based TokenSwap

The canonical TokenSwap construction is the Hashed Timelock Contract (HTLC). In the bilateral form, Alice generates a secret value $x$, computes its hash $H(x)$, and deposits her asset into a contract that can be redeemed either by revealing $x$ with the appropriate signature or by refund after a time lock. Alice sends $H(x)$ to Bob, who creates a corresponding contract on his chain using the same hash. Alice redeems Bob’s asset by revealing $x$, and the on-chain revelation of $\mathcal D$0 allows Bob to redeem Alice’s asset. If either side fails to proceed, the timelock enables refund. This structure makes the two legs of the exchange cryptographically linked and removes the default-risk problem of ordinary cross-chain trades (Miraz et al., 2019).

Within this architecture, the minimum requirements for on-chain HTLC-based swaps are explicit: both blockchains must support the same type of hashing function, both must support time-locked contracts, and both must support specialized programming functions to encode the swap protocol. The literature distinguishes on-chain swaps, which occur directly on the respective blockchains and are generally slower, from off-chain swaps on second layers such as the Lightning Network, which can be much faster or “instantaneous.” In the Bitcoin stack, SegWit and the Lightning Network are identified as layered solutions relevant to this model (Miraz et al., 2019).

The graph-theoretic HTLC formulation generalizes the bilateral mechanism to many parties. In Herlihy’s construction, leaders generate secrets, followers publish outgoing contracts only after observing all incoming contracts, and secrets then propagate backward through the swap graph. The designated leaders must form a feedback vertex set: removing them makes the follower subgraph acyclic. This condition is not merely convenient; the paper proves it is necessary for a uniform hashed-timelock implementation. The result is a two-phase protocol in which contracts propagate forward and claimability propagates backward, preserving safety for conforming parties (Herlihy, 2018).

3. Multi-party topologies, shared ownership, and expressive generalizations

Later work sharpened the structural boundary of HTLC-only TokenSwap. "On HTLC-Based Protocols for Multi-Party Cross-Chain Swaps" (Clark et al., 2024) studies multi-party asset swaps represented as strongly connected directed graphs $\mathcal D$1, with liveness, safety, and strong Nash equilibrium as the core objectives. Its central theorem states that a swap digraph $\mathcal D$2 has an atomic HTLC-based protocol iff $\mathcal D$3 is a reuniclus digraph. Reuniclus digraphs generalize bottleneck digraphs—the earlier single-leader digraphs—into a hierarchy of bottleneck components arranged in a tree. This result shows that HTLC-only TokenSwap is not universal for arbitrary multi-party topologies: the admissible class is exact rather than heuristic (Clark et al., 2024).

A different limitation appears when assets are not singly owned. "Atomic cross-chain exchanges of shared assets" (Narayanam et al., 2022) introduces a generalized asset exchange model $\mathcal D$4 over ledgers $\mathcal D$5, party set $\mathcal D$6, asset sets $\mathcal D$7, and ownership mappings $\mathcal D$8. Ownership is modeled as co-ownership by non-empty subsets of parties. The paper defines the ownership partitions

$\mathcal D$9

corresponding to givers, keepers, and takers, and classifies exchanges as ULT, CLR, and CLS, together with generalized forms gULT, gCLR, and gCLS. The core conclusion is that standard HTLC is fundamentally designed for two adversarial parties with sole ownership of one asset each, and breaks under collusion when assets are jointly owned or when one side of the trade contains multiple assets (Narayanam et al., 2022).

To address this, the same paper proposes MPHTLC, which augments HTLC with secure multi-party computation and collective signing. Co-owners on one side jointly compute

$\mathcal D$0

lock all relevant assets with hash $\mathcal D$1, and later jointly derive a public preimage

$\mathcal D$2

such that $\mathcal D$3. The design goal is that no single co-owner can reveal the secret prematurely or unilaterally control the exchange. The paper gives proof-of-concept implementations in Hyperledger Fabric and Corda, and shows how MPHTLC can be realized in Hyperledger Labs Weaver by augmenting its existing HTLC protocol (Narayanam et al., 2022).

TokenSwap also became more expressive through predicate-based fault tolerance. "Invited Paper: Fault-tolerant and Expressive Cross-Chain Swaps" (Xue et al., 2022) allows participants to run multiple alternative swaps in parallel and later complete an acceptable subset rather than requiring strict all-or-nothing execution across all proposals. Each proposed transfer is represented by a Boolean arc variable, and each party states safety and liveness predicates, such as

$\mathcal D$4

The paper gives two protocols: ProtocolA, which favors fast settlement but requires higher collateral, and ProtocolB, which reduces collateral by reusing escrow across alternatives but imposes a hard timeout and slower settlement. This shifts TokenSwap toward predicate-defined acceptable outcomes rather than a single monolithic swap (Xue et al., 2022).

4. Alternative protocol families beyond classical HTLC

HTLC is canonical, but it is not the only execution model. "JugglingSwap: Scriptless Atomic Cross-Chain Swaps" (Shlomovits et al., 2020) replaces script-based locking with threshold cryptography and gradual transfer of secret-key shares. Its assumptions are weaker than earlier scriptless constructions: the underlying digital signature scheme need only admit a threshold variant and be based on the elliptic curve discrete logarithm problem (ECDLP). The new primitive, Juggling, is a public key verifiable encryption scheme that segments a discrete log,

$\mathcal D$5

and encrypts each segment separately using homomorphic ElGamal in the exponent. Range proofs and proofs of correct encryption make each released segment publicly verifiable. In the resulting swap protocol, fairness is partial rather than absolute: if one party aborts, the other is at most one segment ahead (Shlomovits et al., 2020).

A more lightweight alternative is Ping-Pong Swaps, which uses only unidirectional payment channels on both chains. Each side opens a channel on the chain from which it is paying, and the parties alternately exchange small off-chain micropayments in a “ping-pong” pattern until the full amounts have been transferred. The protocol is non-custodial and requires no escrow, bridge, or trusted intermediary, but its security is economic rather than strictly cryptographic: the maximum profitable deviation is bounded by the chosen granularity, i.e., the last installment (Grunspan et al., 2022).

The optionality embedded in HTLCs was further generalized in "Transferable Cross-Chain Options" (Engel et al., 2022). There, a standard atomic swap is treated as an option-like position whose leader or follower role can itself be transferred. The protocol manipulates two contracts, AB and BA, and introduces Mutate Lock, Consistency, and Replace/Revert phases for leader transfer, and Mutate plus Replace/Revert for follower transfer. The guarantees include No UNDERWATER, transfer atomicity, optionality preservation for follower transfer, and FCFS plus starvation freedom in the multiple-buyer leader-transfer variant (Engel et al., 2022).

Another departure from on-chain contract evaluation appears in "Unicity: Predicates and Atomic Swaps" (Buldas et al., 1 Jun 2026). Unicity generalizes token ownership from public-key possession to programmable predicates

$\mathcal D$6

evaluated off-chain by relying parties against proofs from the Unicity service. The paper proves that the security properties of the execution layer are preserved under reduction to predicate family unforgeability, and then implements trustless atomic swaps through preparation and swap states rather than secret revelation. This yields a symmetric swap construction grounded in inclusion proofs and time-bounded predicates (Buldas et al., 1 Jun 2026).

Cross-chain AMM research pushes TokenSwap in yet another direction. "Singularity Protocol for Cross Chain AMM without Intermediate Tokens or Bridges" (Vohra, 30 May 2025) argues that standard AMM invariants are bi-state and therefore poorly suited to cross-chain composability. It proposes a value-integral formulation,

$\mathcal D$7

with a univariate volatile-asset price curve

$\mathcal D$8

so that each chain computes locally and relays value-equivalence information rather than using an intermediate token or bridge. The paper presents this as eliminating intermediate-token and bridging risk, although its security model is conceptual rather than formal (Vohra, 30 May 2025).

5. Applications, advantages, and persistent limitations

The principal applications of TokenSwap arise from interoperability. The early literature presents atomic swaps as a way to improve interoperability so cryptocurrencies can compete better with fiat, eliminate reliance on legacy exchanges, reduce commissions and associated fees, and lower the number of intermediaries and single points of failure. The same reasoning extends beyond currency to securities settlement, direct holdings, cross-listing, and other non-monetary token applications. Off-chain forms are especially attractive where latency matters (Miraz et al., 2019).

The application space broadened as the exchange object itself diversified. The shared-asset literature explicitly connects atomic cross-ledger exchange to permissioned DLTs such as Hyperledger Fabric and Corda, and to delivery-versus-payment use cases such as CBDC-for-bond settlement (Narayanam et al., 2022). A related fair-exchange line treats TokenSwap as token-for-data exchange. In "Fair and Decentralized Exchange of Digital Goods" (Futoransky et al., 2020), a notary certifies a seller’s encrypted message $\mathcal D$9, a buyer opens a blockchain contract tied to $O(\mathrm{diam}(\mathcal D))$0, and the seller reveals $O(\mathrm{diam}(\mathcal D))$1 to trigger payment and enable decryption. The paper proves UC realization of the secure exchange functionality and emphasizes that no third party is needed after setup and no dispute resolution is required (Futoransky et al., 2020).

The limitations are equally persistent. The 2019 survey stresses that atomic swaps were still in their infancy, that on-chain swaps are slow, and that timelocked refunds can freeze funds temporarily. Support in major wallets and exchanges was lacking, systems without smart contract support could not easily participate, and atomic swaps did not by themselves provide a fully decentralized exchange architecture. Implementation also required substantial programming expertise, while regulatory uncertainty remained significant because private, cross-jurisdictional off-chain swaps complicate oversight and may enable illicit markets (Miraz et al., 2019).

A further controversy concerns incentive compatibility. "Decentralized Exchange that Mitigate a Bribery Attack" (Awathare, 23 Oct 2025) argues that standard HTLCs are cryptographically atomic but economically fragile: a malicious counterparty can bribe miners to censor the honest party’s redemption transaction until timeout. The paper critiques earlier mitigations such as MAD-HTLC and He-HTLC, introduces Miner-to-Miner Bribery Attack (M2MBA) and B3A, and proposes a two-phase collateral-based protocol $O(\mathrm{diam}(\mathcal D))$2 in which miners lose the special confiscation lever that enabled prior attacks. The Bitcoin and Ethereum evaluations report competitive time to completion and improved cost in several refund scenarios. This line of work shows that TokenSwap security is not exhausted by cryptographic correctness; miner incentives and censorship markets are also part of the design surface (Awathare, 23 Oct 2025).

6. Terminological ambiguity and unrelated later usages

By the mid-2020s, TokenSwap also became an overloaded term outside blockchain research. "A Lightweight Method to Disrupt Memorized Sequences in LLM" (Prashant et al., 7 Feb 2025) uses TokenSwap to denote a post-hoc inference-time defense against verbatim memorization in LLMs. There, token probabilities for a selected subset $O(\mathrm{diam}(\mathcal D))$3 of mostly grammatical tokens are replaced by probabilities from a smaller auxiliary model, with a theorem giving exponential suppression of extractable memorized sequences and empirical results showing up to a $O(\mathrm{diam}(\mathcal D))$4 drop in exact memorization on pretrained models (Prashant et al., 7 Feb 2025).

An even more distant usage appears in "TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-LLMs" (Zhang et al., 29 Sep 2025), where TokenSwap denotes a stealthy backdoor attack that injects a visual trigger and swaps the grammatical roles of key tokens in the textual target, inducing bags-of-words behavior while preserving correct object mentions. This usage is unrelated to cross-chain exchange or fair exchange of digital assets; the commonality is only nominal (Zhang et al., 29 Sep 2025).

In current technical usage, therefore, TokenSwap is best treated as a polysemous term. Its primary meaning in distributed-ledger research remains a family of cryptographically enforced exchange mechanisms for tokens or tokenized rights across chains and ledgers, ranging from classical HTLC atomic swaps to multi-party, predicate-based, scriptless, channel-based, and AMM-style variants. A plausible implication is that future references to TokenSwap increasingly require domain qualification—blockchain, fair exchange, or machine learning—to avoid ambiguity.