Peer-to-peer atomic swap between Bitcoin (signet) and Alephium (testnet) using MuSig2 adaptor signatures. No intermediaries, no custodians.
Roles
Alice = ALPH seller, Bob = BTC seller. If you publish a "Sell ALPH" offer or accept a "Buy ALPH" offer, you are Alice. Otherwise you are Bob.
Protocol Simulator
Click Start, then fire transitions to explore happy path, cancel, and abort scenarios.
Protocol (5 steps)
- Setup — Alice generates an adaptor secret t and sends the public adaptor point T to Bob
- Lock — Bob locks BTC in a Taproot output (with CSV timelock for refund). Alice deploys an ALPH contract (with timeout for refund). Both sides cross-verify.
- Nonces — Commit-then-reveal MuSig2 nonce exchange (prevents grinding attacks)
- Pre-sign — Exchange adaptor pre-signatures for both BTC and ALPH claim transactions
- Claim — Alice completes the adaptor signature and claims BTC, revealing t on the Bitcoin blockchain. Bob extracts t from the Bitcoin witness data and claims ALPH.
Timeouts & Refunds
| BTC refund (T1) | 144 blocks after lock tx confirms (~24h mainnet, ~2.5h signet) |
| ALPH refund (T2) | 6 hours after contract deployment |
| Offer expiry | 1 hour after publishing |
T2 < T1 is critical: Alice can refund ALPH before Bob can refund BTC, preventing a scenario where Bob claims both assets.
Security
- Funds are safe at every step — if the peer disappears, wait for timeout and use refund buttons
- Swap messages (setup, nonces, pre-signatures, claims) are encrypted peer-to-peer (NIP-04)
- Offers are public so they can be discovered by anyone on Nostr
- Uses Schnorr adaptor signatures for atomicity — no hash preimages
- BTC side uses Taproot MuSig2. ALPH side uses a Ralph contract — asymmetric by design for inspectable state, unilateral locking, and explicit timeouts (a symmetric MuSig2 construction is possible but adds complexity)
Important Notes
- Bob (BTC seller) needs a small amount of ALPH (~0.01 ALPH) to pay gas fees when claiming ALPH on the Alephium side. Use the ALPH faucet to get testnet tokens before accepting a swap.
- Balance warnings will appear when publishing or accepting offers if your funds appear insufficient.
Recovery
Swap state is saved to localStorage at key checkpoints (locked, presigned, btc_claimed). If the page is refreshed mid-swap, recovery UI appears with available actions: resume (if peer is online), claim, or refund (after timeout).