# Towards faster settlement in HTLC-based Cross-Chain Atomic Swaps
††thanks: This work was supported by the European Research Council (ERC) under
the European Union’s Horizon 2020 research (grant agreement 771527- BROWSEC),
by the Austrian Science Fund (FWF) through the projects PRO- FET (grant
agreement P31621) and the project W1255-N23, by the Austrian Research
Promotion Agency (FFG) through COMET K1 SBA and COMET K1 ABC, by the Vienna
Business Agency through the project Vienna Cybersecurity and Privacy Research
Center (VISP), by the Austrian Federal Ministry for Digital and Economic
Affairs, the National Foundation for Research, Technology and Development and
the Christian Doppler Research Association through the Christian Doppler
Laboratory Blockchain Technologies for the Internet of Things (CDL-BOT).

Subhra Mazumdar  TU Wien, Christian Doppler Laboratory
Blockchain Technologies for the Internet of Things
Vienna, Austria
<EMAIL_ADDRESS>
###### Abstract

Hashed Timelock (HTLC)-based atomic swap protocols enable the exchange of
coins between two or more parties without relying on a trusted entity. This
protocol is like the _American call option_ without premium. It allows the
finalization of a deal within a certain period. This puts the swap initiator
at liberty to delay before deciding to proceed with the deal. If she finds the
deal unprofitable, she just waits for the time-period of the contract to
elapse. However, the counterparty is at a loss since his assets remain locked
in the contract. The best he can do is to predict the initiator’s behavior
based on the asset’s price fluctuation in the future. But it is difficult to
predict as cryptocurrencies are quite volatile, and their price fluctuates
abruptly. We perform a game theoretic analysis of HTLC-based atomic cross-
chain swap to predict whether a swap will succeed or not. From the strategic
behavior of the players, we infer that this model lacks fairness. We propose
_Quick Swap_ , a two-party protocol based on hashlock and timelock that
fosters faster settlement of the swap. The parties are required to lock
griefing-premium along with the principal amount. If the party griefs, he ends
up paying the griefing-premium. If a party finds a deal unfavorable, he has
the provision to cancel the swap. We prove that _Quick Swap_ is more
participant-friendly than HTLC-based atomic swap. Our work is the first to
propose a protocol to ensure fairness of atomic-swap in a cyclic multi-party
setting.

###### Index Terms:

Cryptocurrencies, Atomic Swap, Hashed Timelock (HTLC), Griefing Attack, Game
Theory, Griefing-Premium, Faster Settlement

##  I Introduction

Centralized exchange enabled users to trade one cryptocurrency for the other.
For example, Alice wants to exchange $x_{a}$ coins for Bob’s $y_{b}$ coins.
The exchange can be done by involving a third party _Carol_ , where both
_Alice_ can deposit $x_{a}+x$ coins and _Bob_ deposits $y_{b}$ coins with
_Carol_ respectively. $x$ is the service fee charged by _Carol_ for offering
the swap service. If _Carol_ is honest, she will handover $x_{a}$ coins to
_Bob_ , $y_{b}$ coins to _Alice_ and keep the service charge. If she is
malicious, she can just run away with _Alice_ ’s and _Bob_ ’s money. Thus , it
become very important to have decentralized exchange of cryptocurrencies. With
the introduction of Blockchain [Nakamoto(2008)], it is now possible to realize
decentralized protocols for atomic swaps without relying on any trusted third
party [TN1(2013), Thomas and Schwartz(2015), Herlihy(2018), Zamyatin et
al.(2019), Zakhary et al.(2020), Tairi et al.(2021), Moreno-Sanchez et
al.(2020), Lys et al.(2021), Thyagarajan et al.(2022), Narayanam et
al.(2022)]. _Alice_ and _Bob_ can now safely lock their coins and have rules
encoded in the smart contract. Exchange of assets leads to change of
ownership, it either succeeds or fails in entirety. Bitcoin-based blockchains
primarily leverage on Hashed Timelock Contracts or HTLC [Herlihy(2018),
Borkowski et al.(2019), Dai et al.(2020), Narayanam et al.(2022)] for
exchanging Bitcoins (BTC) with other cryptocurrencies like Litecoins (LTC),
Ether (ETH), ERC Tokens.

Figure 1: HTLC-based atomic swap. We assume that there is no waiting involved
when parties lock their coins and are willing to exchange it as well.

We explain a two-party HTLC-based atomic swap protocol with an example shown
in Fig. 1. _Alice_ wants to exchange $x_{a}$ coins for $y_{b}$ coins of _Bob_.
Both of them have accounts in two different blockchains Chain-a and Chain-b.
_Alice_ samples a secret $s$, generates a hash $H=\mathcal{H}(s)$ and shares
it with _Bob_ at time $t_{0}$. The protocol comprises two phases: _Lock_ and
_Claim_. _Lock phase_ defines the time interval within which the parties have
locked their assets in the contracts instantiated in the respective
blockchains. _Alice_ locks $x_{a}$ coins in Chain-a at time $t_{1}$. The coin
are locked in a contract where the spending conditions are as follows: _if Bob
provides the secret $s$ within $t_{a}$ units of time, then he claims $x_{a}$
coins else Alice initiates a refund after $t_{a}$ elapses_. Once the
transaction is confirmed in Chain-a in the next $\tau_{a}$ units of time,
_Bob_ locks $y_{b}$ coins in Chain-b at time $t_{2}$. He uses the same hash
value $H$ in the contract deployed in Chain-b for locking his coins. The
spending conditions are different: _if Alice provides the secret $s$ within
$t_{b}$ units of time, then she claims $y_{b}$ coins else Bob initiates a
refund after $t_{b}$ elapses_, where $t_{a}>t_{b}$. It takes $\tau_{b}$ units
for the lock transaction to be confirmed in Chain-b. _Claim phase_ signals the
period within which the parties claim their assets. In the best case involving
zero waiting, _Alice_ broadcasts the claim transaction at $t_{3}$, releases
the preimage $s$ and claims $y_{b}$ coins from _Bob_. The latter uses the
preimage $s$ at broadcasts a transaction to claim $x_{a}$ coins at time
$t_{4}$, where $t_{4}-t_{3}=t_{\epsilon}$ is the time taken by _Bob_ to
observe _Alice_ ’s transaction in Chain-b. Once the ownership of the assets
changes successfully, an instance of the protocol succeeds.

###  I-A Griefing Attack in Timelocked Contracts

Figure 2: Coins remain unutilized in HTLC-based atomic swap due to (a) Bob
speculates the deal and does not lock his coins and (b) Bob speculates, finds
$t_{2}^{\prime}$ favourable for locking his coins, delaying by
$t_{2}^{\prime}-t_{2}$, and Alice speculates, finds
$t_{3}^{\prime\prime}=t_{5}^{\prime}-\epsilon$ favourable for claiming the
coins from Bob

One of the main disadvantage of HTLC-based atomic swap is that parties are not
enforced to settle the transaction. It has already been shown in [Han et
al.(2019)], [zmn(2018)] that atomic swap is equivalent to _American call
option_ without premium. In _American call option_ , buyer is allowed to
exercise the contract no later than the strike time. We illustrate the
situation in Fig. 2. After _Alice_ has locked $x_{a}$ coins at $t_{1}$, the
time taken for the transaction to be confirmed in Chain-a is $\tau_{a}$.
Ideally, _Bob_ should begin locking his coins at $t_{2}=t_{1}+\tau_{a}$.
However, he may choose to delay speculate within duration $t_{2}$ to
$t_{6}-(t_{b}+\epsilon+t_{\epsilon})$ and delay or he may choose to not lock
his coins at all. If _Bob_ does not lock his coins, then _Alice_ ’s coins get
locked unnecessarily and she loses her coins in paying fees to miners for
successful mining of refund transaction. This is termed as _draining attack_
[Eizinger et al.(2021)]. Let us assume that _Bob_ locks his coins at
$t_{2}^{\prime}\in[t_{2},t_{6}-(t_{b}+\epsilon+t_{\epsilon})$. The time taken
for the transaction to be confirmed in Chain-b is $\tau_{b}$. If _Alice_
chooses not to delay, then she will claim the coins at time
$t_{3}^{\prime}=t_{2}^{\prime}+\tau_{b}$. However, _Alice_ may delay in
claiming the coins or just abort. If she chooses to claim the coins at time
$t_{3}^{\prime\prime}=t_{5}^{\prime}-\epsilon$ where
$t_{5}^{\prime}=t_{2}^{\prime}+\tau_{b}$ then _Bob_ gets to claim $x_{a}$
coins at $t_{4}^{\prime\prime}=t_{3}^{\prime\prime}+t_{\epsilon}$. So _Bob_
has to wait a duration of $t_{4}^{\prime\prime}-t_{4}^{\prime}$ where
$t_{4}^{\prime}=t_{3}^{\prime}+t_{\epsilon}$. Upon simplification, we observe
that he waits $t_{3}^{\prime\prime}-t_{3}^{\prime}=t_{5}^{\prime}-\epsilon-
t_{3}^{\prime}$, which is the delay due to _Alice_ ’s speculation. It may so
happen that _Alice_ does not want to claim $y_{b}$ coins, she waits for
$t_{b}$ units to elapse, and _Bob_ broadcasts refund transaction at time
$t_{5}^{\prime}=t_{2}^{\prime}+t_{b}$. _Alice_ broadcasts her refund
transaction after $t_{a}$ units elapse, i.e., at time $t_{6}=t_{1}+t_{a}$. If
_Alice_ chooses not to respond, then it leads to a _Griefing Attack_
[Robinson(2019)]. Coins remain unutilized in either of the blockchains leading
to substantial rise in opportunity cost. We define the attack formally.

###### Definition 1

_(Griefing Attacks in Atomic Swap)_ Given two parties A and B, such that A is
required to forward an HTLC of $x_{a}$ coins to B for a certain timeperiod
$t_{a}$, and in turn, B must forward an HTLC of $y_{b}$ coins to A for a
timeperiod $t_{b}:t_{a}>t_{b}$, a griefing attack can happen in the following
situations:

  * •

_A locks $x_{a}$ coins and B doesn’t lock $y_{b}$ coins_: It leads to
$\textbf{A}^{\prime}s$ $x_{a}$ coins being locked for $t_{a}$ units, the loss
in terms of collateral cost being $\mathcal{O}(x_{a}t_{a})$.

  * •

_A locks $x_{a}$ coins, B has locked $y_{b}$ coins, and A aborts_: In such a
situation, A griefs B at the cost of locking his coins for $t_{a}$ units of
time. B’s coins remains locked for $t_{b}$ units, the loss in terms of
collateral cost being $\mathcal{O}(y_{b}t_{b})$.

### Motivation for Griefing in Atomic Swap

A party may grief intentionally or decides to abort when the situation is not
favourable for exchanging coins . We consider our parties to be either
genuinely interested in exchanging coins or malicious. We define
characteristic of each type:

  * •

_Interested to Exchange_ : A party who is willing to exchange coins but might
end up griefing depending on whether she finds a favourable exchange rate.

  * •

_Malicious_ : A party whose only motive is to mount Denial-of-Service (DoS)
attack on the counterparty. Such a party will not take any actions after the
counterparty has locked coins for exchange. Gain of malicious party is the
lost opportunity cost of counterparty’s locked coins.

Enforcing the parties not to back out from the deal is a major challenge.
Additionally, we observe HTLC lacks flexibility as it does not provide an
option to cancel the contract when the situation turns out to be unfavorable.
_Is it possible to propose an atomic swap that allows cancellation but at the
same time penalizes malicious behavior?_

###  I-B Contributions

  * •

We model HTLC-based atomic cross-chain swap as a two-player sequential game
and analyze the success rate of the protocol as a function of exchange rate
and delay.

  * •

We observe HTLC-based atomic swap is not participant-friendly by estimating
the success rate of such a protocol.

  * •

We propose _Quick Swap_ , a hashlock and timelock-based protocol compatible
with Bitcoin script. Our protocol is more robust and efficient, allowing easy
cancellation of trade and penalizing a party if it griefs.

  * •

_Quick Swap_ can also be generalized to multi-party cyclic atomic swap for
countering griefing attacks.

##  II Game Theoretic Analysis of HTLC-based atomic swap

###  II-A System Model & Assumptions

The atomic swap protocol comprises two phase: _Lock Phase_ \- for the duration
$t_{0}$ to just before $t_{3}$, and _Claim Phase_ \- from time $t_{3}$ onward.
It proceeds sequentially, with the assets being locked first and then the
assets being claimed in the next phase. Given two parties Alice and Bob, their
strategy space consists of the actions _continue_ and _stop_. In this paper,
we will alternately use the term _stop_ and _abort_ , both denoting that a
party chooses not to take any action. After _Alice_ locks $x_{a}$ coins in
Chain-a, _Bob_ can choose to either _continue_ , i.e., lock $y_{b}$ coins in
Chain-b, or abort from the process. There is no way by which _Alice_ can abort
before timeout period $t_{a}$ elapses, if _Bob_ aborts. If _Bob_ locks his
coins before that, _Alice_ can choose continue with the swap by claiming
$y_{b}$ coins and releasing the preimage of $H$ before $t_{b}$ elapses. If she
choose to _stop_ , she will wait for $t_{b}$ to elapse and Bob initiates a
refund after that. If either of the party is malicious, then the sole motive
would be to keep the coins locked. So if _Alice_ is malicious, she will not
initiate the _Claim Phase_ , and if _Bob_ is malicious, he will simply abort
in the _Lock Phase_ without locking his coins.

###  II-B Basic Setup

We denominate coins locked by _Bob_ as a function of value of _Alice_ ’s coin
at a given time $t$. Thus we express $y_{b}$ coins as $x(y_{b},t)$, where the
price is decided based on the exchange rate prevailing at time $t$. At time
$t_{0}\approx t_{1}$, $x(y_{b},t_{1})$ is the price of _Bob_ ’s coins decided
to be exchanged for $x_{a}$ coins of _Alice_. Price of Bob’s coins at any time
$t$ follow a geometric Brownian motion [Dipple et al.(2020)]. Coins locked by
Bob (or B), i.e., $y_{b}$, is denoted as $x(y_{b},t)$, when denominated in
terms of Alice’s coins at time $t$. $x(y_{b},t)$ follows a geometric Brownian
motion:

$\ln{\frac{x(y_{b},t+\tau)}{x(y_{b},t)}}=\Big{(}\mu-\frac{\sigma^{2}}{2}\Big{)}\tau+\sigma(W_{t+\tau}-W_{t})$
(1)

where $W$ follows a Wiener Process with drift $\mu$ and variance $\sigma^{2}$
[Malliaris(1990)]. .

Given Eq.1, the expected price of $x(y_{b},t)$ at time
$t+\lambda,(\mathcal{E}(x(y_{b},t),\lambda)$, Probability density function of
$x(y_{b},t)$ at time $t+\lambda,(P(x,x(y_{b},t),\lambda))$ , and Cumulative
density function of $x(y_{b},t)$ coins at time
$t+\lambda,(C(x,x(y_{b},t),\lambda))$ is expressed as follows:

$\begin{matrix}\mathcal{E}(x(y_{b},t),\lambda)=\mathbb{E}[x(y_{b},t+\lambda)|x(y_{b},t)]=x(y_{b},t)e^{\mu\lambda}\\\
\\\ P(x,x(y_{b},t),\lambda)=\mathbb{P}[x(y_{b},t+\lambda)=x|x(y_{b},t)]\\\
=\frac{e^{-\Big{(}\frac{\ln{\frac{x}{x(y_{b},t)}}-\Big{(}\mu-\frac{\sigma^{2}}{2}\Big{)}\tau}{2\tau\sigma^{2}}\Big{)}^{2}}}{\sqrt{2\pi\tau}\sigma
x}\\\ \\\ C(x,x(y_{b},t),\lambda)=\mathbb{C}[x(y_{b},t+\lambda)\leq
x|x(y_{b},t)]\\\
=\frac{erfc{\Big{(}\frac{\ln{\frac{x}{x(y_{b},t)}}-\Big{(}\mu-\frac{\sigma^{2}}{2}\Big{)}\tau}{\sqrt{2\tau}\sigma}\Big{)}}}{2}\\\
\\\ \end{matrix}$ (2)

where $erfc$ is the complementary error function. $erfc(x)$ is defined as:

$erfc(x)=\frac{2}{\Pi}\int_{x}^{\infty}e^{t^{2}}\,dt$ (3)

The expressions are taken from [Xu et al.(2021)].

We assume both parties know each other’s parameters. Transaction fees are
assumed to be negligible compared to the amounts involved in the transactions.
The rest of the notations are defined in Table I.

Notation | Description
---|---
$x_{a}$ | Coins possessed by _Alice_ or A
$y_{b}$ | Coins of _Bob_ or B that A decides to buy for $x_{a}$ coins at time $t_{0}$
$\tau_{a}$ | Time taken for a transaction to get confirmed in Chain-a
$\tau_{a}$ | Time taken for a transaction to get confirmed in Chain-b
$t_{a}$ | HTLC forwarded by A to B in Chain-a, locking $x_{a}$, expires
$t_{b}$ | HTLC forwarded by B to A in Chain-b, locking $y_{b}$, expires
$t_{\epsilon}$ | Propagation delay
$\epsilon$ | Short time gap
$\theta_{1}$ | Belief of B regarding type of A being _interested to swap_
$\theta_{2}$ | Belief of A regarding type of B being _interested to swap_
$sp_{a}$ | Success premium of A, if swap succeeds
$sp_{b}$ | Success premium of B, if swap succeeds
$x(y_{b},t)$ | Price of $y_{b}$ coins in terms of $x_{a}$ at time a given time $t$
$r_{a}$ | Time discounting factor of A
$r_{b}$ | Time discounting factor of B
$f_{a}$ | Transaction fee in Chain-a
$f_{b}$ | Transaction fee in Chain-b
$\mu$ | Wiener process drift
$\sigma^{2}$ | Wiener process variance
$\mathcal{E}(x(y_{b},t),\lambda)$ | Expected price of $x(y_{b},t)$ at time $t+\lambda$, also expressed
| as $\mathbb{E}[x(y_{b},t+\lambda),x(y_{b},t)]=x(y_{b},t)e^{\mu\lambda}$
$P(x,x(y_{b},t),\lambda)$ | Probability density function at time $t+\lambda$
| given that price at time $t$ is $x(y_{b},t)$
$C(x,x(y_{b},t),\lambda)$ | Cumulative density function at time $t+\lambda$
| given that price at time $t$ is $x(y_{b},t)$

TABLE I: Notations used in the paper

###  II-C Game Model

We model the interaction between two parties _Alice_ , denoted as A, and _Bob_
, denoted as B, as a sequential game $\Gamma_{swap}$. We assume that all the
miners in the blockchains Chain-a and Chain-b are honest. In our model, B
considers A to be _interested in exchanging coins_ with probability
$\theta_{1}$ and _malicious_ with probability $1-\theta_{1}$. A considers B to
be _interested with probability_ $\theta_{2}$ and _malicious_ with probability
$1-\theta_{2}$. Given the belief A has regarding B’s type, if she has chosen
to initiate the lock phase at time $t_{1}$ then B chooses either to lock
$y_{b}$ coins or abort based on his belief of A’s type at time $t_{2}$. If B
doesn’t lock his coins before $t_{1}+t_{a}$ elapses then the swap stands
canceled. If B locks his coins, A makes the next move at $t_{3}$, choosing
either to claim $y_{b}$ coins or abort. Once A has chosen an action, B follows
that.

The extensive-form game $\Gamma_{swap}$, is defined for players A and B. The
payoff function $u_{k,\theta}:S\times\mathbb{N}\rightarrow\mathbb{R}$ for any
player $k\in\\{\textbf{A,B}\\}$ and $\theta\in\\{\textrm{interested (int),
malicious}\\}$, where $S=\\{continue,stop\\}$, is denoted as
$u_{k,\theta}(s,t)$ where $s\in S$ and $t\in\mathbb{N}$. $S$ denotes the set
of actions for players A and B. $u_{k,\theta}(s,t)$ specifies the payoff the
player $k$ of type $\theta$ would get at time $t\in\mathbb{N}$, if the players
chose their action $s\in S$. The game begins with Nature (N) choosing the type
of players A and B, where the probability of picking both players who are
interested to exchange coins is $\theta_{1}\theta_{2}$ (probability of picking
malicious A (B) is $1-\theta_{1}$ ($1-\theta_{2}$). Since selecting type of
players are mutually independent, all possible combinations probability is the
product of individual probability). In the next step, _interested_ A will
selects her strategy of either _continue_ or _stop_ , based on the belief of
B’s type, where as _malicious_ A will always choose to _continue_. Next,
_interested_ B chooses his strategy based on his belief of A’s type, however
_malicious_ B will choose _stop_. Finally, interested A will choose to claim
the coins if the exchange rates are in her favour else she aborts. _Malicious_
A will always abort.

(a) $sp_{a}=sp_{b}=0.3,r_{a}=r_{b}=0.005,\sigma=0.1$

(b) $sp_{a}=sp_{b}=0.3,r_{a}=r_{b}=0.01,\sigma=0.1$

(c) $sp_{a}=sp_{b}=0.3,r_{a}=r_{b}=0.005,\sigma=0.2$

Figure 3: 3-D plot of Swap Success Rate as a function of delay
($T,T^{\prime}$) (x-y axis) and A’s coins (z-axis), with different parameter
values, $\theta_{1}=\theta_{2}=0.5$

####  II-C1 Preference Structure

To calculate the payoff of each party for type _interested_ 111We do not
calculate the payoff for type _malicious_ as we are interested in quantifying
the success rate of HTLC-based atomic swap and this is possible only in
presence of _interested_ parties., we use backward induction, starting from
$t_{3}$. The claim phase starts at time $t_{3}$, when an _interested_ A
decides whether to _continue_ and reveal preimage of $H$, or _stop_ for
$t_{b}$ to elapse. If _interested_ A decides to claim $y_{b}$ coins, then an
_interested_ B claims $y_{b}$ coins. We define the utility or payoff for each
strategy. If _interested_ A chooses to _continue_ at $t_{3}$, then the time
taken for the redeem transaction to get confirmed in Chain-b is $\tau_{b}$. We
multiply payoff of A upon continuing with a factor $(1+sp_{a})$, where $u_{a}$
is the success premium (or $u_{b}$ for B) to emphasize that rational parties
gain higher utility by swapping their assets rather than abort. The utility of
_interested_ A is expressed with their time discounted for duration
$\tau_{b}$. Similarly, when _interested_ B claims coins in Chain-a at time
$t_{3}+t_{\epsilon}$, time taken for the transaction to be confirmed is
$\tau_{a}$, hence the utility is expressed with their time discounted for
duration $t_{\epsilon}+\tau_{a}$.

$\begin{matrix}u_{A,int}(cont,t_{3})=(1+sp_{a})\mathcal{E}(x(y_{b},t_{3}),\tau_{b})e^{-r_{a}\tau_{b}}\\\
-f_{b}\\\
u_{B,int}(cont,t_{3})=(1+sp_{b})x_{a}e^{-r_{b}(\tau_{a}+t_{\epsilon})}-f_{a}\\\
\end{matrix}$ (4)

where $t_{3}=t_{2}+\tau_{b}+T$, and $T\in[0,t_{b}-\tau_{b}-\epsilon]$ being
the delay by _interested_ A before she decides to claim the coins. If
_interested_ A decides to _stop_ , then _interested_ B has to abort as well.
The coins remain locked uselessly for the entire duration. The utility is
expressed as: $u_{A,int}(stop,t_{3})=x_{a}e^{-r_{a}t_{a}}-f_{a}$ and
$u_{B,int}(stop,t_{3})=\mathcal{E}(x(y_{b},t_{3}),t_{b})e^{-r_{b}t_{b}}-f_{b}$.
An _interested_ A will decide on _continue_ over _stop_ at $t_{3}$, if the
following condition holds:

$\begin{matrix}(1+sp_{a})\mathcal{E}(x(y_{b},t_{3}),\tau_{b})e^{-r_{a}\tau_{b}}-f_{b}\geq
x_{a}e^{-r_{a}t_{a}}-f_{a}\\\
or,x(y_{b},t_{3})e^{\mu\tau_{b}}\geq\frac{x_{a}e^{-r_{a}(t_{a}-\tau_{b})}-(f_{a}-f_{b})e^{r_{a}\tau_{b}}}{1+sp_{a}}\\\
or,x(y_{b},t_{3})\geq\frac{\Big{(}x_{a}e^{-r_{a}(t_{a}-\tau_{b})}-(f_{a}-f_{b})e^{r_{a}\tau_{b}}\Big{)}e^{-\mu\tau_{b}}}{(1+sp_{a})}\\\
\end{matrix}$

We derive $x(y_{b},t_{3})^{*}$ in terms of $x_{a}$ for which the above
inequality holds. If $x(y_{b},t_{3})\geq x(y_{b},t_{3})^{*}$ then A claims the
coins.

In the second round of _lock phase_ , _interested_ B has to decide whether he
will _continue_ (i.e., lock $y_{b}$ coins) or _stop_ after A has locked
$x_{a}$ coins. Since _B_ is unaware of A’s type, he calculates the expected
payoff where with probability $1-\theta_{1}$ he has to _stop_ at time
$t_{2}+\tau_{b}$ and with probability $\theta_{1}$, he can either _continue_ ,
if the price of coins rise to $x(y_{b},t_{3})^{*}$, or _stop_ at time
$t_{2}+\tau_{b}+T$, if the price drops. The payoff is expressed as time
discounted, expected utility for duration $\tau_{b}+T$. An _interested_ B
calculates what will be the probability that price of his coins will rise to
$x(y_{b},t_{3})^{*}$ within time $\tau_{b}+T$.

$\begin{matrix}u_{B,int}(cont,t_{2})=\\\
\theta_{1}\Big{(}\frac{\Big{[}1-C\Big{(}x(y_{b},t_{3})^{*},x(y_{b},t_{2}),\tau_{b}+T\Big{)}\Big{]}u_{B,int}(cont,t_{3})}{e^{r_{b}(\tau_{b}+T)}}\\\
+\\\
\frac{\bigint_{0}^{x(y,t_{3})^{*}}P\Big{(}p,x(y_{b},t_{2}),\tau_{b}\Big{)}u_{B,int}(stop,t_{3})\,dp}{e^{r_{b}(\tau_{b})}}\Big{)}+\\\
(1-\theta_{1})\Big{(}\frac{u_{B,int}(stop,t_{3})}{e^{r_{b}\tau_{b}}}\Big{)}\end{matrix}$
(5)

_Interested_ A knows what action was taken at $t_{3}$ and so there is no need
to consider B’s type.

$\begin{matrix}u_{A,int}(cont,t_{2})=\\\
\frac{\bigint_{x(y_{b},t_{3})^{*}}^{\infty}P\Big{(}p,x(y_{b},t_{2}),\tau_{b}+T\Big{)}u_{A,int}(cont,t_{3})\,dp}{e^{r_{a}(\tau_{b}+T)}}\\\
+\frac{C\Big{(}x(y_{b},t_{3})^{*},x(y_{b},t_{2}),\tau_{b}\Big{)}u_{A,int}(stop,t_{3})}{e^{r_{a}\tau_{b}}}\\\
\end{matrix}$ (6)

If B _stops_ at $t_{2}$, then A’s coins remain locked for $t_{a}$ units of
time. The utility is expressed as
$u_{A,int}(stop,t_{2})=x_{a}e^{-r_{a}t_{a}}-f_{a}$ and
$u_{B,int}(stop,t_{2})=x(y_{b},t_{2})$. B’s decision is dependent on how price
of $y_{b}$ evolves until $t_{3}$. He will decide to _continue_ over _stop_ ,
if the following condition holds: $u_{B,int}(cont,t_{2})\geq x(y_{b},t_{2})$.
We derive the range in which $x(y_{b},t_{2})$ must lie for the above
inequality to hold. B will continue if $x_{1}<x(y_{b},t_{2})\leq x_{2}$. If
$x(y_{b},t_{2})>x_{2}$ or $x(y_{b},t_{2})\leq x_{1}$ then B will stop.

In the first round of the lock phase, _interested_ A takes a decision on
whether she wants to lock coins or abort at time $t_{1}$ based on her belief
regarding B’s type. B can choose to take action at
$t_{2}=t_{1}+\tau_{a}+T^{\prime}$ where
$T^{\prime}\in[0,t_{a}-(t_{b}-\epsilon+t_{\epsilon})-\tau_{a}]$. Payoff of A
can be expressed with their time-discounted, expected utility for duration
$t_{2}-t_{1}$.

$\begin{matrix}u_{A,int}(cont,t_{1})=\\\
\theta_{2}\Big{(}\frac{\bigint_{x_{1}}^{x_{2}}P\Big{(}p,x(y_{b},t_{1}),\tau_{a}+T^{\prime}\Big{)}u_{A,int}(cont,t_{2})\,dp}{e^{r_{a}(\tau_{a}+T^{\prime})}}+\\\
\frac{\Big{[}1-C\Big{(}x_{2},x(y_{b},t_{1}),\tau_{a}\Big{)}+C\Big{(}x_{1},x(y_{b},t_{1}),\tau_{a}\Big{)}\Big{]}u_{A,int}(stop,t_{2})}{e^{r_{a}\tau_{a}}}\Big{)}+\\\
(1-\theta_{2})\Big{(}\frac{u_{A,int}(stop,t_{2})}{e^{r_{a}\tau_{a}}}\Big{)}\end{matrix}$
(7)

_Interested_ B knows what action was taken at $t_{2}$ and so there is no need
to consider A’s type.

$\begin{matrix}u_{B,int}(cont,t_{1})=\\\
\frac{\bigint_{x_{1}}^{x_{2}}P\Big{(}p,x(y_{b},t_{1}),\tau_{a}+T^{\prime}\Big{)}u_{B,int}(cont,t_{2})\,dp}{e^{r_{b}(\tau_{a}+T^{\prime})}}+\\\
\frac{\bigint_{0}^{x_{1}}P\Big{(}x,x(y_{b},t_{1}),\tau_{a}\Big{)}u_{B,int}(stop,t_{2})\,dp}{e^{r_{b}\tau_{a}}}\par\par\end{matrix}$
(8)

If _interested_ A stops at $t_{1}$, then no one locks coins and we express the
utility as $u_{A,int}(stop,t_{1})=x_{a}$ and
$u_{B,int}(stop,t_{1})=x(y_{b},t_{1})$. A’s decision is based on how price of
$y_{b}$ evolves until $t_{2}$. A will decide on _continue_ over _stop_ , if
the following condition holds: $u_{A,int}(cont,t_{1})\geq x_{a}$. We derive
the range $(x^{*},x^{*^{\prime}})$, in which $x_{a}$ must lie for the swap to
start.

###### Proposition 1

HTLC-based atomic swap is not participant-friendly.

_Proof_ : A’s willingness to participate in the atomic swap is decided by the
expected success of the protocol for given set of parameters. The success rate
_(SR)_ of a swap is the probability that the swap succeeds after it has been
initiated, i.e. after A has locked coins at $t_{1}$ [Xu et al.(2021)]. For a
given pair of $\theta_{1}$ and $\theta_{2}$. _SR_ is defined as function of
$x_{a}$ (A’s coins or tokens), delay by A (T) at final step while claiming
coins, and delay by B (T’) at second step while locking $y_{b}$ coins. It is
expressed as:

$\begin{matrix}SR(x_{a},T^{\prime},T)=\bigints_{x_{1}[x_{a}]}^{x_{2}[x_{a}]}P_{A}(p,T^{\prime})P_{B}(p,T)\,dp\end{matrix}$
(9)

where $P_{A}(p,T^{\prime})=\theta_{2}P(p,x(y_{b},t_{1}),\tau_{a}+T^{\prime})$
and
$P_{B}(p,T)=\theta_{1}\Big{(}1-C(x(y_{b},t_{3})[x_{a}],p,\tau_{b}+T)\Big{)}$.

We plot the success rate of the protocol in Fig. 3 (a-c), the parameters used
are $t_{\epsilon}\approx\epsilon=1\ hr$ and $\tau_{a}=\tau_{b}=3\ hrs$. As per
standard practice, $t_{a}=48\ hrs$ and $t_{b}=24\ hrs$ [Han et al.(2019)]. We
select $x_{a}\in[1,3]$ given $x(y_{b},t_{1})=2$. The parameters $T$ is varied
between $[0,20$] and $T^{\prime}$ is varied between $[0,21]$. The fee $f_{a}$
and $f_{b}$ is negligible, so we consider them to be 0. The success premiums
$sp_{a}=sp_{b}=0.3$, time-discounting factor $r_{a}=r_{b}$ is chosen from
$\\{0.005,0.01\\}$, $\sigma$ is varied between 0.1 and 0.2, and $\mu$ is
selected from $\\{-0.002,0.002\\}$. We observe that the success rate is $\geq
0.9$ in Fig. 3 (a-b), and around 0.6 for Fig. 3 (c), when $T=T^{\prime}=0$.
When $T$ or $T^{\prime}$ increases, the success rate drops and beyond certain
range, it becomes $NA$ (not applicable) as $u_{A_{continue},t_{1}}<x_{a}$.
Success rate is function of $T$ and $T^{\prime}$ that cannot be determined
before the swap proceeds to the second round or to the third round. In the
worst case, if $T\approx t_{b}$ and/or $T^{\prime}\approx t_{a}-t_{b}$, then
the success rate drops drastically as the payoff upon continuing is too low.
In such situation, a party is better off if he does not participate in the
swap rather than keep his coins locked for one full day.

##  III Quick Swap: A protocol based on Ideal Swap Model

The flaw in the HTLC-based atomic swap is that either of the parties can
speculate and delay in settling the transaction without losing anything. Our
objective is to force the parties to settle the transaction faster, and
penalize for delayed action. We provide a high-level overview of our proposed
protocol where a party will lock the principal amount for swap provided he or
she gets a guarantee of compensation upon suffering from a griefing attack.
With respect to the previous example, _Alice_ has to lock $x_{a}$ coins for a
period of $t_{a}$ units. If _Bob_ griefs, _Alice_ ’s collateral locked will be
$\mathcal{O}(x_{a}t_{a})$. She calculates the collateral cost of locking
$x_{a}$ coins for $t_{a}$, let it be defined as $c(x_{a}t_{a})$. Similarly,
_Bob_ calculates the collateral cost of locking $y_{b}$ coins for $t_{b}$, let
it be $c(y_{b}t_{b})$. The steps for locking the coins proceeds as follows:

  * (i)

_Bob_ first locks $c(x_{a}t_{a})$ coins in Chain-b for $D+\Delta$ units of
time where $\tau_{a}+2\tau_{b}<D+\Delta<t_{b}$. We will explain later why an
additional $\Delta$ unit is chosen.

  * (ii)

After _Alice_ gets a confirmation of the griefing-premium locked by _Bob_ ,
she locks $x_{a}$ for $t_{a}$ units and griefing-premium
$c(x_{a}t_{a})+c(y_{b}t_{b})$ for $D>\tau_{a}+\tau_{b}$ units of time, both in
Chain-a .

  * (iii)

After _Bob_ gets a confirmation of the griefing-premium locked by _Alice_ , he
locks $y_{b}$ for $t_{b}$ units of time in Chain-b.

If _Bob_ doesn’t want to proceed after step [ii] and cancels the swap, then
_Alice_ can unlock $x_{a}$ coins from Chain-a. If _Bob_ griefs, then _Alice_
gets the compensation $c(x_{a}t_{a})$ after $D+\Delta$ elapses instead of
being griefed for $t_{a}$. The principle we follow here is _“Coins you have
now is better than coins you have later”_. _Alice_ can use the compensation
from $t_{b}-(D+\Delta)$. Had we set the timelock for locking $c(x_{a}t_{a})$
to $t_{a}$, _Bob_ can still grief by canceling the contract at time
$t_{b}-\epsilon$. We will discuss later how should we choose $D$ to ensure a
faster compensation.

If _Alice_ initiates the swap, she claims $y_{b}$ coins and withdraws the
compensation from Chain-a. _Bob_ gets to claim $x_{a}$ coins and he withdraws
the compensation from Chain-b. If _Alice_ cancels the swap, then _Bob_ unlocks
$y_{b}$ coins from Chain-b. If _Alice_ delays beyond $D$ unit of time, then
_Bob_ gets compensation for the loss. Since $D+\Delta<\tau_{b}$, _Alice_ can
delay beyond this point as well. In that case, she gets a compensation of
$c(x_{a}t_{a})$ and her net gain is $g_{a}=c(x_{a}t_{a})-c(y_{b}t_{b})$ and
_Bob_ ’s net loss is $-g_{a}$. Thus to prevent _Bob_ from incurring a loss,
_Alice_ is forced to pay a compensation of $c(x_{a}t_{a})+c(y_{b}t_{b})$. Even
if she does not respond, _Bob_ is entitled to a compensation of
$c(y_{b}t_{b})$ after refunding $c(x_{a}t_{a})$ coins to _Alice_.

###  III-A Formal Description of Quick Swap

####  III-A1 System Model and Assumption

The system model and assumptions are same as HTLC-based atomic swap. Since
$t_{a}\approx 2t_{b}$, for ease of analysis, we consider $c(x_{a}t_{a})\geq
2c(y_{b}t_{b})$. For a fixed rate of griefing-premium, we consider
$Q=c(x_{a}t_{a})$ and $\frac{Q}{2}=c(y_{b}t_{b})$. _Alice_ locks a griefing-
premium of 1.5Q and _Bob_ locks griefing-premium Q coins. We denote _Alice_ as
A and _Bob_ as B while describing the protocol.

####  III-A2 Detailed Description

The protocol has the following phases: (A) Preprocessing Phase, (B) Lock Phase
and (C) Claim Phase. An instance of successful execution of _Quick Swap_ is
shown in Fig. 4.

Figure 4: An instance of successful Quick Swap between Alice and Bob

(A) Preprocessing Phase: The steps are defined as follow:
Sampling Cancellation Hash and Payment Hash:

  * (i)

A’s pair of secret and public key is $(sk_{a},pk_{a})$ and B’s pair of secret
and public key is $(sk_{b},pk_{b})$. A uses $sk_{a}$ and B uses $sk_{b}$ for
signing transactions. $pk_{a}$ and $pk_{b}$ are used for verifying each such
signed transaction.

  * (ii)

A samples random values $s_{1}$ and $s_{3}$, creates payment hash
$H_{1}=\mathcal{H}(s_{1})$ and cancellation hash $H_{3}=\mathcal{H}(s_{3})$.
She shares $H_{1}$ and $H_{3}$ with B.

  * (ii)

B samples a random value $s_{2}$ and creates cancellation hash
$H_{2}=\mathcal{H}(s_{2})$ and shares it with A.

(B) Locking Phase:

  * (i)

At time $t_{1}$, B creates and signs transaction griefing_premium_lock_B using
funding address $addr_{funding,penalty,B}$ that locks $Q$ coins address
$addr_{lock,penalty,B}$ and publishes griefing_premium_lock_B in Chain-b. B
encodes the condition whereby $Q$ coins can be claimed either by revealing the
preimage of $H_{1}$ or $H_{2}$, or it can be spend by A after $D+\Delta$ units
of time.

  * (ii)

A checks whether griefing_premium_B is confirmed within $\tau_{b}$ units. Once
that is confirmed, at time $t_{2}=t_{1}+\tau_{b}$, A creates and signs a
transaction griefing_premium_lock_A using funding address
$addr_{funding,penalty,A}$ that locks $1.5Q$ coins into address
$addr_{lock,penalty,A}$. The condition for spending the coins are as follows:
(a) Either provide the preimage of $H_{1}$ or $H_{3}$;
(b) If no preimage is provided, B can spend the coins locked after $D$ units
of time.
Simultaneously, A creates and signs another transaction principal_lock_A using
funding address $addr_{funding,principal,A}$ that locks $x_{a}$ coins into
address $addr_{lock,principal,A}$. The coins can be spend either by revealing
the preimage of $H_{1}$, or, A can refund the coins either after $t_{a}$ unit
elapses or by revealing preimage of $H_{2}$, whichever occurs first. She
publishes both principal_lock_A and griefing_premium_lock_A in Chain-a.

  * (iii)

B checks whether the transactions broadcasted by A gets confirmed in another
$\tau_{a}$ units. At time $t_{3}=t_{2}+\tau_{a}$, He creates and signs another
transaction principal_lock_B using funding address
$addr_{funding,principal,B}$ that locks $y_{b}$ coins into address
$addr_{lock,principal,B}$. The coins can be spend either by revealing the
preimage of $H_{1}$, or, B can refund the coins either after $t_{b}$ unit
elapses or by revealing preimage of $H_{3}$, whichever occurs first. He then
proceeds to publish principal_lock_B in Chain-b.

(C) Claim Phase: Once A observes that B has locked $y_{b}$ coins in Chain-b,
he initiates the claim phase at time $t_{4}=t_{3}+\tau_{b}$, where $tau_{b}$
is the time taken for principal_lock_B to be confirmed.
_Redeem_ : If A wishes to redeem the coins,
a. At time $t_{4}=t_{3}+\tau_{b}<D$:

  * (i)

A releases the preimage $s_{1}$ for payment hash $H_{1}$ and claims the output
of transaction principal_lock_B with her signature in Chain-b. This allows her
to claim $y_{b}$ coins.

  * (ii)

A uses $s_{1}$ to refund the griefing-premium of $1.5Q$ locked in Chain-a.

b. At time $t_{5}=t_{4}+t_{\epsilon}$:

  * (i)

B uses the preimage $s_{1}$ and unlocks the output of the transaction
principal_lock_A with his signature in Chain-a, claiming $x_{a}$ coins.

  * (ii)

B uses $s_{1}$ to refund $Q$ locked in Chain-b.

Refund: If A wishes to cancel the swap,
a. At time $t_{4}=t_{3}+\tau_{b}<D$:

  * (i)

A releases the preimage $s_{3}$ for cancellation hash $H_{2}$ with her
signature in Chain-a, unlocking $1.5Q$ coins.

  * (ii)

B uses $s_{3}$ to refund $y_{b}$ coins from Chain-b at time
$t_{4}+t_{\epsilon}$. This results in cancelation of swap before $t_{b}$
elapses.

b. At time $t_{5}=t_{4}+\tau_{b}+t_{\epsilon}$:

  * (i)

B releases the preimage $s_{2}$, unlocks $Q$ coins with her signature from
Chain-b.

  * (ii)

A uses $s_{2}$ for refunding $x_{a}$ coins from Chain-a at time
$t_{4}+\tau_{b}+2t_{\epsilon}$.

###  III-B Proof of Correctness, Safety and Liveness

It is necessary to argue the state of a proposed protocol in presence of both
compliant and malicious parties. Parties either may choose to follow the
protocol or they may deviate. We prove that _Quick Swap_ satisfies both safety
and liveness. By safety, we mean that _“compliant parties should end up “no
worse off,” even when other parties deviate arbitrarily from the protocol”_
[Herlihy et al.(2022)]. Simultaneously, the liveness property states that none
of the parties end up keeping their coins locked forever. Before arguing for
liveness and safety, we prove the correctness of the protocol in presence of
compliant parties - either all agreed coin exchange take place, and no
exchange take place.

###### Property 1

(_Correctness_) If all parties are compliant, then the swap either succeeds
with coins being exchanged, or the swap gets canceled with the coins being
refunded.

_Proof_ : A and B exchange the hashes $H_{1},H_{2}$ and $H_{3}$ before the
start of the protocol. At $t_{1}$, B locks $Q$ coins in Chain-b that can be
unlocked contingent to either providing preimage of $H_{1}$ or $H_{2}$. The
coins are locked for $D+\Delta$ units, after which A can claim $Q$ coins and
begins the next phase of locking at $t_{2}=t_{1}+\tau_{b}$. She locks $x_{a}$
coins in Chain-a that can be claimed by B contingent to providing the preimage
of $H_{1}$, else A refunds after time $t_{a}$ or using preimage of $H_{2}$.
She also locks $1.5Q$ coins at $t_{2}$ in Chain-a. The amount can be unlocked
contingent to either providing preimage of $H_{1}$ or $H_{3}$. The coins are
locked for $D$ units, after which B can claim $1.5Q$ coins. The last locking
phase starts at $t_{3}=t_{2}+\tau_{a}$, when B locks $y_{b}$ coins in Chain-b.
The latter can be claimed by A contingent to providing the preimage of
$H_{1}$, else B refunds after time $t_{b}$ or using preimage of $H_{3}$. The
correctness of _Claim Phase_ follows from the description of _Redeem_ and
_Refund_ defined in Section III-A2.

###### Property 2

(_Safety Property_) The safety property states that compliant parties should
be as better off as they had been before the protocol execution, even when
other parties deviate arbitrarily from the protocol.

_Proof_ : After B has locked $Q$ coins Chain-b, if A does not lock any coins
Chain-a, $B$ unlocks it after a certain timeperiod $\delta<D+\Delta$. If B
locks $Q$ coins, A locks $x_{a}+1.5Q$ coins, but B aborts without locking
$y_{b}$ coins, then A unlocks $1.5Q$ coins revealing preimage $s_{3}$. She
gets a compensation $Q$ coins after $D+\Delta$ that covers up for the lost
opportunity cost of keeping $x_{a}$ coins locked for $t_{a}$ units. If all the
parties have locked their coins but A delays beyond $D$ or griefs, B gets
compensation of $1.5Q$. He may lose $Q$ coins (if A cancels before elapse of
$D+\Delta$ but after timeout $D$, then B is entitled to the full compensation
$1.5Q$) but we ensure that $1.5Q-Q=0.5Q$ coins are enough to compensate for
locked collateral $\mathcal{O}(y_{b}t_{b})$.

###### Property 3

_(Liveness)_ Coins No asset belonging to a compliant party do not remain
locked forever.

_Proof_ : If A doesn’t take any action by $t_{2}=t_{1}+\tau_{b}$, B unlocks
$Q$ coins after $\tau_{b}>\delta>0$ units. If B does not lock coins at
$t_{3}=t_{2}+\tau_{a}$, then by time $t_{3}+\tau_{b}$, A refunds the griefing-
premium $1.5Q$ by revealing preimage of $H_{3}$ in her own interest. B
observes that A has canceled the swap by withdrawing the griefing-premium. If
he is rational, then he will releases preimage $s_{2}$ for $H_{2}$, unlock $Q$
coins and allow A to unlock $x_{a}$ coins before $D$ elapses. If B is
malicious, then he will end up losing $Q$ coins after $D+\Delta$ units, but A
will be able to unlock $x_{a}$ coins after $t_{a}$ elapses. If at time
$t_{4}=t_{3}+\tau_{b}$, A aborts then she loses compensation of $1.5Q$ to B.
The latter can unlock $y_{b}$ coins after $t_{b}$ has elapsed but loses his
compesation of $Q$ coins.

###  III-C Game-Theoretic Analysis

We model the interaction between the two entities A and B as a sequential game
$\Gamma_{quick\ swap}$. B initiates the lock phase by locking griefing-premium
$Q$ for duration $D+\tau_{a}+\tau_{b}+\Delta$ units in Chain-b at time
$t_{1}$, followed by A choosing either to lock $x_{a}$ coins for duration
$t_{a}$ units or abort at $t_{2}=t_{1}+\tau_{b}$. If A has not responded then
B either cancels the swap at time $t_{2}+\tau_{a}$ by unlocking $Q$ or he
stops. If A wishes to continue, she locks the principal amount and the
griefing-premium $1.5Q$ for $D$ units in Chain-a at time $t_{2}$. At time
$t_{3}=t_{2}+\tau_{a}$, if B observes that A has locked the principal amount
as well as griefing-premium, then B either locks $y_{b}$ coins for $t_{b}$
units in Chain-b or stops. If he does not lock coins, then at time
$t_{3}+\tau_{b}$, A cancels the swap by unlocking $1.5Q$ coins from Chain-a or
stops. If B has not responded, he loses the griefing-premium at time
$t_{1}+t_{a}$. Else if he chooses to cancel, then A will be able to withdraw
the principal amount as well. If B has chosen to continue, A decides at time
$t_{4}=t_{3}+\tau_{b}$, whether to continue or cancel the swap.

####  III-C1 Game Model & Preference Structure

The extensive-form game $\Gamma_{quick\ swap}$ is similar to $\Gamma_{swap}$,
except that A and B’s strategy space has the option to _cancel_ , apart from
_continue_ and _stop_. The analysis is done by applying backward induction on
$\Gamma_{quick\ swap}$.

If A delays instead of making a move at $t_{3}+\tau_{b}$, then the opportunity
cost of coins locked as griefing-premium will rise. Canceling the swap at
$t_{3}+\tau_{b}$ will lead to A’s utility as
$\frac{x_{a}}{e^{r_{a}(t_{\epsilon}+2\tau_{a})}}+\frac{1.5Q}{e^{r_{a}\tau_{a}}}$.
If A chooses to delay and cancel at time say $t_{3}+\tau_{b}+t$ for $t>0$,
then the utility drops further, i.e,
$\frac{x_{a}}{e^{r_{a}(t_{\epsilon}+2\tau_{a}+t)}}+\frac{1.5Q}{e^{r_{a}(\tau_{a}+t)}}$.
In the previous HTLC-based atomic swap, if A finds that the utility on
continuing is less than the utility of the swap till the lock time of HTLC
expires, she speculated till the situation turns in her favor. However, the
situation is different now as A is allowed to abort the swap much earlier
without waiting for the lock time to elapse. A rational A will choose not to
delay anticipating that the situation may turn worse later. At time $t_{4}$,
if A continues and B follows:

$\begin{matrix}u_{A,int}(cont,t_{4})=(1+sp_{a})\frac{\mathcal{E}(x(y_{b},t_{4}),\tau_{b})}{e^{r_{a}\tau_{b}}}+\frac{1.5Q}{e^{r_{a}\tau_{a}}}-f_{a}-f_{b}\\\
u_{B,int}(cont,t_{4})=(1+sp_{b})\frac{x_{a}}{e^{r_{b}(\tau_{a}+t_{\epsilon})}}+\frac{Q}{e^{r_{b}(t_{\epsilon}+\tau_{b})}}\\\
-f_{a}-f_{b}\end{matrix}$ (10)

At time $t_{4}$, if A cancels then B cancels the deal as well. The payoffs are
$u_{A,int}(cancel,t_{4})=\frac{x_{a}}{e^{r_{a}(2t_{\epsilon}+\tau_{b}+\tau_{a})}}+\frac{1.5Q}{e^{r_{a}\tau_{a}}}-2f_{a}$
and
$u_{B,int}(cancel,t_{4})=\frac{\mathcal{E}(x(y_{b},t_{4}),t_{\epsilon}+\tau_{b})}{e^{r_{b}(\tau_{b}+t_{\epsilon})}}+\frac{Q}{e^{r_{b}(t_{\epsilon}+2\tau_{b})}}-2f_{b}$.
A will continue at $t_{4}$ over canceling the swap, if the following condition
holds:

$\begin{matrix}(1+sp_{a})\frac{\mathcal{E}(x(y_{b},t_{4}),\tau_{b})}{e^{r_{a}\tau_{b}}}+\frac{1.5Q}{e^{r_{a}\tau_{a}}}-f_{a}-f_{b}>\frac{x_{a}}{e^{r_{a}(2t_{\epsilon}+\tau_{b}+\tau_{a})}}\\\
+\frac{1.5Q}{e^{r_{a}\tau_{a}}}-2f_{a}\\\ \\\ or,\
x(y_{b},t_{4})>\frac{\frac{x_{a}}{e^{r_{a}(2t_{\epsilon}+\tau_{b}+\tau_{a})}}-f_{a}+f_{b}}{(1+sp_{a})e^{(\mu-
r_{a})\tau_{b}}}\end{matrix}$ (11)

We derive $x(y_{b},t_{4})^{*}$ in terms of $x_{a}$ for which the above
inequality holds. If $x(y_{b},t_{4})\geq x(y_{b},t_{4})^{*}$ then A claims the
coins.

At time $t_{3}$, B decides to continue, then with probability $1-\theta_{1}$,
A is malicious and will delay till $D-\epsilon$ ($D-\epsilon\rightarrow D$).
The utility is expressed as follows:
$u_{B,int}(cont,t_{3})=\theta_{1}\Big{(}\frac{\Big{[}1-C(x(y,t_{4})^{*},x(y,t_{3}),\tau_{b})\Big{]}u_{B,int}(cont,t_{4})\,dp}{e^{r_{b}\tau_{b}}}+\\\
\frac{\bigint_{0}^{x(y,t_{4})^{*}}P(p,x(y,t_{3}),\tau_{b})u_{B,int}(cancel,t_{4})\,dp}{e^{r_{b}\tau_{b}}}\Big{)}+(1-\theta_{1})\Big{(}\frac{\mathcal{E}(x(y_{b},t_{4}),t_{\epsilon}+D)}{e^{r_{b}(D-\epsilon+t_{\epsilon})}}+\frac{Q}{e^{r_{b}(t_{\epsilon}+D-\epsilon+\tau_{b})}}-2f_{b}\Big{)}$
and $u_{A,int}(cont,t_{3})=\\\
\frac{\bigint_{x(y,t_{4})^{*}}^{\infty}P(p,x(y,t_{3}),\tau_{b})u_{A,int}(cont,t_{4})\,dp}{e^{r_{a}\tau_{b}}}+\frac{\bigint_{0}^{x(y,t_{4})^{*}}P(p,x(y,t_{3}),\tau_{b})u_{A,int}(cancel,t_{4})\,dp}{e^{r_{a}\tau_{b}}}$

At time $t_{3}$, B chooses stop, then the utility for A and B is defined as:
$u_{A,int}(stop,t_{3})=\frac{x_{a}}{e^{r_{a}(t_{a}+\tau_{a})}}+\frac{1.5Q}{e^{r_{a}(t_{b}+\tau_{a})}}-2f_{a}+\frac{Q}{e^{r_{b}\tau_{b}}}-f_{b}$
and $u_{B,int}(stop,t_{3})=x(y_{b},t_{3})$.

If at time $t_{3}$, B chooses cancel then he unlocks the premium $Q$ locked in
Chain-b by releasing preimage of $H_{2}$. A observes that swap is canceled, so
she unlocks $x_{a}$ coins and griefing-premium $1.5Q$ from Chain-a. The
utility is defined as
$u_{B,int}(cancel,t_{3})=x(y_{b},t_{3})+\frac{Q}{e^{r_{b}\tau_{b}}}-f_{b}$ and
$u_{A,int}(cancel,t_{3})=\frac{x_{a}}{e^{r_{a}(\tau_{a}+t_{\epsilon})}}+\frac{1.5Q}{e^{r_{a}(t_{\epsilon}+\tau_{a})}}-2f_{a}$.
We observe that it is better to cancel the swap than wait for the contract to
expire as B will lose his griefing-premium in the process. Thus _cancel_
strictly dominates _stop_ in our protocol. B will continue at $t_{3}$ over
canceling the swap, if the following condition holds:
$u_{B,int}(cont,t_{3})>u_{B,int}(cancel,t_{3})$

At time $t_{2}$, A decides to continue, then utility is:
$u_{A,int}(cont,t_{2})=\theta_{2}\Big{(}\frac{\bigint_{x^{3}_{1}}^{x^{3}_{2}}P(p,x(y,t_{2}),\tau_{a})u_{A,int}(cont,t_{3})\,dp}{e^{r_{a}\tau_{a}}}+\frac{\bigint_{x^{3}_{2}}^{\infty}P(p,x(y_{b},t_{2}),\tau_{a})u_{A,int}(stop,t_{3})\,dp}{e^{r_{a}\tau_{a}}}\Big{)}+(1-\theta_{2})\Big{(}\frac{u_{A,int}(stop,t_{3})}{e^{r_{a}\tau_{a}}}\Big{)}$
and
$u_{B,int}(cont,t_{2})=\Big{(}\frac{\bigint_{x^{3}_{1}}^{x^{3}_{2}}P(p,x(y,t_{2}),\tau_{a})u_{B,int}(cont,t_{3})\,dp}{e^{r_{b}\tau_{a}}}+\\\
\frac{\bigint_{x^{3}_{2}}^{\infty}P(p,x(y_{b},t_{2}),\tau_{a})u_{B,int}(stop,t_{3})\,dp}{e^{r_{b}\tau_{a}}}\Big{)}$
At time $t_{2}$, A decides to abort then B initiates cancellation by releasing
preimage of $H_{2}$. Note that A will not take any action if she intends to
cancel as she has not locked any coins. Thus both cancel and stop means the
same payoff for A. The payoff is defined as
$u_{A,int}(stop,t_{2})=u_{A,int}(cancel,t_{2})=x_{a}+1.5Q$ and
$u_{B,int}(cancel,t_{2})=x(y_{b},t_{2})+\frac{Q}{e^{r_{b}(\tau_{a}+\tau_{b})}}-f_{b}$.
A will continue at $t_{2}$ over stopping the swap, if the following condition
holds: $u_{A,int}(cont,t_{2})>u_{A,int}(cancel,t_{2})$.

###### Proposition 2

Quick Swap is more participant-friendly compared to HTLC-based atomic swap.

_Proof_ : In _Quick Swap_ , for given values of $\theta_{1}$ and $\theta_{2}$,
success rate or $SR$ is function of $x_{a}$ (or A’s tokens) since there is no
delay involved. It is expressed as:

$\begin{matrix}SR(x_{a})=\bigints_{x^{3}_{1}[x_{a}]}^{x^{3}_{2}[x_{a}]}A(x_{a})B(x_{a})\,dp\end{matrix}$
(12)

where $A(x_{a})=\theta_{2}P(p,x(y_{b},t_{2}),\tau_{a})$ and
$B(x_{a})=\theta_{1}\Big{(}1-C(x(y,t_{4})[x_{a}],p,\tau_{b})\Big{)}$

A is able to estimate the success rate now as it is dependent solely on
$x_{a}$. There is no uncertainty involved, unlike in HTLC-based atomic swap
where a higher delay leads to violation of participation constraint.
Additionally, the range of $x_{a}$ for which _Quick Swap_ has a non-zero
success rate is larger. The provision of cancellation, even before the elapse
of the contract’s locktime, makes the protocol robust and more resilient to
fluctuation in asset price.

###  III-D Discussions

(a) Our protocol requires an extra round compared to _HTLC_ -based atomic
swap. The number of transactions created for _Quick Swap_ is double the number
of transactions needed for the latter.
(b) The parameter $D$ can be chosen by A and B, after they have negotiated
with each other. A rational honest party will choose a shorter delay for
keeping the griefing-premium locked.

##  IV Construction of a fair multiparty cyclic atomic swap

Suppose _Alice_ wants to exchange coins with _Bob_ where the former has some
Bitcoins and later has Ethers, but _Bob_ wants to exchange his Ethers for
Litecoins. In such a scenario, they take the help of some intermediaries for
assisting in the exchange of coins. If we consider just a three-party
situation, then there may exist a participant _Carol_ who is willing to
exchange Litecoins for Bitcoins. So _Alice_ send $x_{a}$ BTC to _Carol_ and
_Carol_ sends $z_{c}$ LTC to _Bob_ , and finally _Bob_ sends $y_{b}$ ETH to
_Alice_. In a real situation, _Carol_ will charge a fee from _Alice_ for
facilitating the swap but we ignore the fee in this paper.

_Problem of Griefing_ : In an HTLC-based setting, _Alice_ samples a secret
$s$, shares $H=\mathcal{H}(s)$ with _Carol_ and _Bob_. _Alice_ forwards HTLC
to _Carol_ locking $x_{a}$ BTC in Chain-a for $T_{1}$ unit of time contingent
to providing preimage of $H$. The confirmation time of a transaction in
Chain-a in $\tau_{a}$. _Carol_ forwards an HTLC to _Bob_ using the same
condition for a time period of $T_{2}$ units where $T_{2}<T_{1}$, locking
$z_{c}$ LTC in Chain-b. The confirmation time of a transaction in Chain-b in
$\tau_{b}$, Finally, _Bob_ forwards the HTLC, locking $y_{b}$ BTC in Chain-c
for time period of $T_{3}$ units where $T_{3}<T_{2}$. The confirmation time of
a transaction in Chain-c in $\tau_{c}$. The problem of griefing persists as
_Carol_ may not choose to lock coins based on the fluctuation rate of Bitcoin
and Litecoin, and even if _Carol_ locks her coins, _Bob_ may abort. If all the
parties have locked coins, _Alice_ may abort, and makes _Bob_ and _Carol_
suffer. We discuss a fix to this problem by extending _Quick Swap_ from a two-
party setting to a three-party setting.

Figure 5: Quick Swap extended to three-party cyclic atomic swap

#### High Level Overview of the protocol

We discuss the steps followed upon extending _Quick Swap_ to three party
setting. The steps have been illustrated in Fig. 5.

  * (i)

Alice _samples_ hashes $H_{1}$ and $H_{2}$ using a randomly sampled secret
$s_{1}$ and $s_{2}$ respectively, and shares it with _Bob_ and _Carol_. _Bob_
samples hash $H_{3}$ using secret $s_{3}$ and _Carol_ samples hash $H_{4}$
using secret $s_{4}$.

  * (ii)

_Bob_ locks griefing-premium $c(x_{a}T_{1})$ in Chain-c for a time-period of
$D+2\Delta<T_{3}$ using hashlock $H_{3}\vee H_{1}$, at time $t_{1}$.

  * (iii)

_Alice_ locks principal amount $x_{a}$ for time period $T_{1}$ using hashlock
$H_{1}$ at time $t_{2}=t_{1}+\tau_{a}$, with the provision of refunding
earlier if preimage of $H_{3}$ is revealed. She samples a hash $H_{2}$ using
secret $s_{2}$, and locks griefing-premium $c(z_{c}T_{2})$ for a time period
$D+\Delta$, hashlock $H_{1}\vee H_{2}$ in Chain-a at time $t_{2}$.

  * (iv)

_Carol_ locks principal amount $z_{c}$ for time period $T_{2}$, hashlock
$H_{1}$, at time $t_{3}=t_{2}+\tau_{b}$ in Chain-b. She can refund before
$T_{2}$ elapses if preimge of $H_{2}$ is revealed. _Carol_ samples hash
$H_{4}$ using secret $s_{4}$, and locks griefing-premium $c(y_{b}T_{3})$ for
timperiod $D$, hashlock $H_{1}\vee H_{4}$ in Chain-b.

  * (v)

Finally, _Bob_ locks $z_{c}$ coins in Chain-c for timeperiod $T_{3}$, hashlock
$H_{1}$, at time $t_{2}=t_{1}+\tau_{a}$. He has a provision to refund earlier
if the preimage of $H_{4}$ is revealed.

To initiate the swap, _Alice_ reveals secret $s_{1}$ and everyone is able to
unlock their griefing-premium and the swapped coins. If any of the parties
want to cancel, he or she will choose to reveal either secret $s_{2},s_{3}$ or
$s_{4}$.

###  IV-A Generic n-party fair cyclic atomic swap

####  IV-A1 System Model & Assumption

Party $P_{0}$ wants to exchange $a_{0}$ coins for $a_{n}$ coins of party
$P_{n}$, taking help of $n-1$ intermediaries $P_{1},P_{2},\ldots,P_{n-1}$. A
party $P_{i}$ has account in Chain-i and Chain-($(i-1)\mod n+1)$ . Blockchain
Chain-i has transaction confirmation time $\tau_{i}$ where $i\in[0,n]$.

####  IV-A2 Detailed Construction

We describe the steps:

  * •

$P_{0}$ samples payment hash $\bar{H}$ and shares with neighbors $P_{n}$ and
$P_{1}$.

  * •

$P_{n}$ initiates the _Locking Phase_ , samples cancellation hash $H_{n}$. He
locks griefing-premium $c(a_{0}T_{0})$ for locktime $D+n\Delta<T_{n}$ in
Chain-n, using hashlock $\bar{H}\vee H_{n}$, at time $t_{1}$.

  * •

Rest of the parties $P_{i},i\in[0,n-1]$ does the following: $P_{i}$ generates
a cancellation hash $H_{i}$ and locks $a_{i}$ coins for locktime $T_{i}$,
using hashlock $\bar{H}$, at time $t_{i+2}=t_{i+1}+\tau_{(i-1)\mod n+1}$ in
Chain-i. The coins can be refunded before $T_{i}$ if preimage of
$H_{(i-1)\mod(n+1)}$ is revealed. He also locks griefing-premium
$c(a_{i+1}T_{i+1})$ at $t_{i+2}$, for locktime $D+(n-1-i)\Delta$, using
hashlock $\bar{H}\vee H_{i}$.

  * •

Finally, $P_{n}$ locks $a_{n}$ coins for locktime $T_{n}$, using hashlock
$\bar{H}$, at time $t_{n+2}=t_{n+1}+\tau_{n-1}$ in Chain-n. He has an option
to refund the coins if $P_{n-1}$ cancels the swap by revealing the preimage of
$H_{n-1}$. The locktimes assigned follow a strictly decreasing order:
$T_{0}>T_{1}>\ldots>T_{n}$.

##  V Related Works

The HTLC-based atomic swap was first proposed in [TN1(2013)]. However, the
design lacks fairness and is susceptible to griefing attacks. Later Hao et al.
[Han et al.(2019)] suggested the use of premium to counter griefing attacks.
However, the protocol assumed that in a two-party setting where _Alice_ wants
to exchange currency with _Bob_ , only _Alice_ can be at fault. So she must
lock premium and _Bob_ is not required to do so. In an American-style option-
based swap, _Bob_ gets the premium even though _Alice_ initiates the swap on
time. In currency exchange-based atomic swap, _Bob_ gets the premium if
_Alice_ doesn’t respond within the time period of the contract. The protocol
is not fair as _Bob_ can grief as well. The construction cannot be realized in
Bitcoin scripts as it requires the inclusion of an additional opcode.

Similar work has been done that talks about locking premium by both the
parties involved in exchanging currency [Xue and Herlihy(2021)]. However, the
protocol is not compatible with Bitcoin scripts and suffers from the problem
of mismatched premiums, and lacking fairness. Further, the authors have
bootstrapped the premium, whereby small valued premiums get locked first, and
with each iteration, the premium amount increases. This leads to multiple
round communication, creation of multiple contracts for each iteration, and
longer lock time than [TN1(2013)] and griefing on the locked-up premium is
possible [Nadahalli et al.(2022)]. Nadahalli et al. [Nadahalli et al.(2022)]
have proposed a protocol that is _grief-free_ and compatible with Bitcoin
scripts. The protocol is efficient regarding the number of transactions and
the worst-case timelock for which funds remain locked. However, the problem of
mismatched premium exists. The model lacks flexibility due to the coupling of
premium with the principal amount, and thus cannot be extended to multi-party
atomic swap setting involving more than two blockchains [Herlihy(2018)]. Our
proposed protocol overcomes several such shortcomings. However, there is a
constant factor increase in overhead of transaction and communication round
compared to [Han et al.(2019)] and [Nadahalli et al.(2022)]. We summarize the
discussion by performing a comparative analysis of _Quick Swap_ with other
state-of-the-art protocols in Table II.

| TN [TN1(2013)] | HLY [Han et al.(2019)] | XH [Xue and Herlihy(2021)] | NKW [Nadahalli et al.(2022)] | _Quick_
---|---|---|---|---|---
| Swap | Swap | Swap | Swap | _Swap_
$P1$ | ✗ | Partial | ✓ | ✓ | ✓
$P2$ | ✗ | ✗ | ✗ | Partial | ✓
$P3$ | ✗ | ✗ | ✗ | Partial | ✓
$P4$ | NA | ✗ | ✗ | ✗ | ✓
$P5$ | ✓ | ✗ | ✗ | ✓ | ✓
$P6$ | NA | ✗ | ✗ | ✗ | ✓

TABLE II: Comparative Analysis of _Quick Swap_ with existing Atomic Swap
protocols in terms of $P1$: Countering griefing attack, $P2$: Cancellation
Allowed, $P_{3}$ Counters speculation, $P4$ Fairness of premium locked,
$P_{5}$ Supported by Bitcoin script and $P6$: Extension to multi-party cyclic
swap

##  VI Conclusion

In this paper, we perform a game-theoretic analysis of HTLC-based atomic swap.
We observe that the protocol lacks fairness and it is not at all participant-
friendly. We propose _Quick Swap_ that is robust and allows faster settlement
of the transaction. We discuss the step for extending _Quick Swap_ to a
multiparty setting involving more than two blockchains. As a part of our
future work, we would like to analyze _Quick Swap_ in presence of rational
miners in underlying Blockchains.

## Acknowledgement

We thank Dr. Abhinandan Sinha, Assistant Professor at Ahmedabad University,
for his initial valuable comments on this work.

## References

  * [1]
  * [TN1(2013)] 2013\.  _TierNolan_.  Technical Report. https://github.com/TierNolan.
  * [zmn(2018)] December 2018.  An Argument For Single-Asset Lightning Network.  https://lists.linuxfoundation.org/pipermail/lightning-dev/2018-December/001752.html.
  * [Borkowski et al.(2019)] Michael Borkowski, Marten Sigwart, Philipp Frauenthaler, Taneli Hukkinen, and Stefan Schulte. 2019\.  DeXTT: Deterministic cross-blockchain token transfers.  _IEEE Access_ 7 (2019), 111030–111042.
  * [Dai et al.(2020)] Bingrong Dai, Shengming Jiang, Menglu Zhu, Ming Lu, Dunwei Li, and Chao Li. 2020\.  Research and implementation of cross-chain transaction model based on improved hash-locking. In _International Conference on Blockchain and Trustworthy Systems_. Springer, 218–230.
  * [Dipple et al.(2020)] Stephen Dipple, Abhishek Choudhary, James Flamino, Boleslaw K Szymanski, and György Korniss. 2020\.  Using correlated stochastic differential equations to forecast cryptocurrency rates and social media activities.  _Applied Network Science_ 5, 1 (2020), 1–30.
  * [Eizinger et al.(2021)] Thomas Eizinger, Philipp Hoenisch, and Lucas Soriano del Pino. 2021\.  Open problems in cross-chain protocols.  arXiv:2101.12412 [cs.CR]
  * [Han et al.(2019)] Runchao Han, Haoyu Lin, and Jiangshan Yu. 2019.  On the optionality and fairness of Atomic Swaps. In _Proceedings of the 1st ACM Conference on Advances in Financial Technologies_. 62–75.
  * [Herlihy(2018)] Maurice Herlihy. 2018\.  Atomic Cross-Chain Swaps. In _Proceedings of the 2018 ACM Symposium on Principles of Distributed Computing, PODC 2018, Egham, United Kingdom, July 23-27, 2018_ , Calvin Newport and Idit Keidar (Eds.). ACM, 245–254.  https://doi.org/10.1145/3212734
  * [Herlihy et al.(2022)] Maurice Herlihy, Barbara Liskov, and Liuba Shrira. 2022\.  Cross-chain deals and adversarial commerce.  _The VLDB journal_ 31, 6 (2022), 1291–1309.
  * [Lys et al.(2021)] Léonard Lys, Arthur Micoulet, and Maria Potop-Butucaru. 2021\.  _R-SWAP: Relay based atomic cross-chain swap protocol_.  Ph. D. Dissertation. Sorbonne Université.
  * [Malliaris(1990)] A. G. Malliaris. 1990\.  _Wiener Process_.  Palgrave Macmillan UK, London, 316–318.  https://doi.org/10.1007/978-1-349-20865-4_43
  * [Moreno-Sanchez et al.(2020)] Pedro Moreno-Sanchez, Arthur Blue, Duc Viet Le, Sarang Noether, Brandon Goodell, and Aniket Kate. 2020.  DLSAG: Non-interactive Refund Transactions for Interoperable Payment Channels in Monero. In _Financial Cryptography and Data Security - 24th International Conference, FC 2020_ _(Lecture Notes in Computer Science, Vol. 12059)_ , Joseph Bonneau and Nadia Heninger (Eds.). Springer, 325–345.  https://doi.org/10.1007/978-3-030-51280-4\\_18
  * [Nadahalli et al.(2022)] Tejaswi Nadahalli, Majid Khabbazian, and Roger Wattenhofer. 2022\.  Grief-free Atomic Swaps. In _2022 IEEE International Conference on Blockchain and Cryptocurrency (ICBC)_. 1–9.  https://doi.org/10.1109/ICBC54727.2022.9805490
  * [Nakamoto(2008)] Satoshi Nakamoto. 2008\.  Bitcoin: A peer-to-peer electronic cash system.  _Decentralized Business Review_ (2008), 21260.
  * [Narayanam et al.(2022)] Krishnasuri Narayanam, Venkatraman Ramakrishna, Dhinakaran Vinayagamurthy, and Sandeep Nishad. 2022\.  Generalized HTLC for Cross-Chain Swapping of Multiple Assets with Co-Ownerships.  _arXiv preprint arXiv:2202.12855_ (2022).
  * [Robinson(2019)] Daniel Robinson. 2019\.  HTLCs considered harmful. In _Stanford Blockchain Conference_.
  * [Tairi et al.(2021)] Erkan Tairi, Pedro Moreno-Sanchez, and Matteo Maffei. 2021\.  A${}^{\mbox{2}}$L: Anonymous Atomic Locks for Scalability and Interoperability in Payment Channel Hubs. In _2021 IEEE Symposium on Security and Privacy (SP)_. IEEE, 1834–1851.
  * [Thomas and Schwartz(2015)] Stefan Thomas and Evan Schwartz. 2015.  A protocol for interledger payments.  _URL https://interledger. org/interledger. pdf_ (2015).
  * [Thyagarajan et al.(2022)] S. Thyagarajan, G. Malavolta, and P. Moreno-Sanchez. 2022\.  Universal Atomic Swaps: Secure Exchange of Coins Across All Blockchains. In _2022 2022 IEEE Symposium on Security and Privacy (SP) (SP)_. IEEE Computer Society, Los Alamitos, CA, USA, 1083–1100.  https://doi.org/10.1109/SP46214.2022.00063
  * [Xu et al.(2021)] Jiahua Xu, Damien Ackerer, and Alevtina Dubovitskaya. 2021\.  A game-theoretic analysis of cross-chain atomic swaps with HTLCs. In _2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS)_. IEEE, 584–594.
  * [Xue and Herlihy(2021)] Yingjie Xue and Maurice Herlihy. 2021.  Hedging against sore loser attacks in cross-chain transactions. In _Proceedings of the 2021 ACM Symposium on Principles of Distributed Computing_. 155–164.
  * [Zakhary et al.(2020)] Victor Zakhary, Divyakant Agrawal, and Amr El Abbadi. 2020\.  Atomic commitment across blockchains.  _Proceedings of the VLDB Endowment_ 13, 9 (2020), 1319–1331.
  * [Zamyatin et al.(2019)] Alexei Zamyatin, Dominik Harz, Joshua Lind, Panayiotis Panayiotou, Arthur Gervais, and William J. Knottenbelt. 2019.  XCLAIM: Trustless, Interoperable, Cryptocurrency-Backed Assets. In _2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019_. IEEE, 193–210.  https://doi.org/10.1109/SP.2019.00085


# Pressure-induced reconstitution of Fermi surfaces and spin fluctuations in
S-substituted FeSe

T. Kuwayama,1 K. Matsuura, 2111present address: Research Center for Advanced
Science and Technology, University of Tokyo, 4-6-1 Komaba, Meguro-ku, Tokyo
153-8904, Japan J. Gouchi,3 Y. Yamakawa,4 Y. Mizukami,2 S.
Kasahara,5222present address: Department of Physics, Okayama University,
Okayama 700-8530, Japan Y. Matsuda,5 T. Shibauchi,2 H. Kontani,4 Y. Uwatoko,3
and N. Fujiwara1333Corresponding author<EMAIL_ADDRESS>1Graduate School of Human and Environmental Studies, Kyoto University,
Yoshida-Nihonmatsu-cyo, Sakyo-ku, Kyoto 606-8501, Japan
2Graduate School of Frontier Sciences, University of Tokyo, 5-1-5 Kashiwanoha,
Kashiwa, Chiba 277-8581, Japan
3Institute for Solid State Physics, University of Tokyo, 5-1-5 Kashiwanoha,
Kashiwa, Chiba 277-8581, Japan
4Department of Physics, Nagoya University, Furo-cho, Nagoya 464-8602, Japan
5Division of Physics and Astronomy, Graduate School of Science, Kyoto
University, Kitashirakawa Oiwake-cho, Sakyo-ku, Kyoto 606-8502, Japan

###### Abstract

FeSe is a unique high-$T_{c}$ iron-based superconductor in which nematicity,
superconductivity, and magnetism are entangled with each other in the $P-T$
phase diagram. We performed 77Se-nuclear magnetic resonance measurements under
pressures of up to 3.9 GPa on 12% S-substituted FeSe, in which the complex
overlap between the nematicity and magnetism are resolved. A pressure-induced
Lifshitz transition was observed at 1.0 GPa as an anomaly of the density of
states and as double superconducting (SC) domes accompanied by different types
of antiferromagnetic (AF) fluctuations. The low-$T_{\rm c}$ SC dome below 1
GPa is accompanied by strong AF fluctuations, whereas the high-$T_{\rm c}$ SC
dome develops above 1 GPa, where AF fluctuations are fairly weak. These
results suggest the importance of the $d_{xy}$ orbital and its intra-orbital
coupling for the high-$T_{\rm c}$ superconductivity.

FeSe has unusual features among high-$T_{c}$ iron-based superconductors
Matsuda  because its superconductivity emerges without magnetism in the
nematic phase where four-fold rotational symmetry breaks Fernandes2014 ;
Shimojima2014 ; Shimojima2019 . The absence of magnetism originates from
characteristic unconnected Fermi surfaces (see the unfolded Fermi surfaces in
the left panel of Fig. 1a): small hole pockets at point $\Gamma$,
$\textbf{\emph{k}}=(0,0)$, and anisotropic electron pockets at point $X$,
$\textbf{\emph{k}}=(\pi,0)$ or $(0,\pi)$, which are caused by the splitting of
the $d_{xz}$ and $d_{yz}$ orbitals Watson2015a ; Watson2017 ; Kushnirenko2018
; Coldea2018 ; Skornyakov2018 ; Fanfarillo2018 . The orbital configuration at
ambient pressure (see the left panel of Fig. 1a) reduces the likelihood of
nesting between electron and hole pockets with the same orbital, leading to
the absence of magnetism. The importance of orbital selectivity in Cooper
pairing for the superconducting (SC) state in the nematic phase has been
suggestedSprau .

Upon pressure application, FeSe undergoes an antiferromagnetic (AF) order
instead of the nematic order. The AF order is accompanied by an enhancement in
$T_{\rm c}$: the $T_{\rm c}$ of 9 K at ambient pressure increases to 38 K at
pressures above 6 GPa Sun2016a . Nematicity, superconductivity, and magnetism
are entangled with each other in the pressure versus temperature ($P$-$T$)
phase diagram. This makes it extremely difficult to understand the nature of
this system, although S substitution resolves the complex overlap between the
nematic and AF phases, and rich-S substitution induces the nematic critical
phenomenon Matsuura2017 ; Xiang2017 ; Holenstein2019 . Furthermore,
experimental difficulties are faced in observing Fermi surfaces under
pressure-restricted experimental approaches. In fact, direct observations via
angle-resolved photoemission spectroscopy (ARPES) or scanning tunneling
microscopy (STM) have not been reported so far. To date, only a few
experimental results have been reported. In particular, the Hall coefficient
changes sign from minus to plus upon pressure application Sun2017 , and the
band masses for several orbitals gradually change around the nematic critical
point (0.58 GPa) Col2019 . The presence of a stripe-type AF order with
Q=($\pi$, 0) or (0, $\pi$) has been suggested from the results of nuclear
magnetic resonance (NMR) measurements Wang2016 ; Wiecki2017a . NMR
measurements on 12% S-substituted FeSe have revealed that the characteristics
of low-energy magnetic fluctuations change at 1 GPa Kuwa , which is indicative
of the reconstitution of Fermi surfaces as well as the band mass change.

Figure 1:  Contribution of each orbital to unfolded Fermi surfaces and the
density of states (DOS). a, Schematic Fermi surfaces of pure FeSe in a
tetragonal phase theoretically derived at ambient pressure Watson2015a ;
Watson2017 ; Kushnirenko2018 ; Coldea2018 ; Skornyakov2018 ; Fanfarillo2018
and high pressure Yamakawa2017a ; Sun2017 . The Fermi surfaces colored in
green, red, and blue represent $d_{xz}$, $d_{yz}$, and $d_{xy}$ orbitals,
respectively. In a high-pressure regime, the antiferromagnetic (AF) order can
be induced owing to the nesting of $d_{xy}$ orbitals between points M and X,
as indicated by arrows. b, The DOS originating from $d_{xy}$, $d_{xz}$, and
$d_{yz}$ orbitals and the total DOS calculated theoretically based on the
crystal structure of 10% S-substituted FeSe.

To explain the appearance of the AF order under pressure, a theoretical model
has been proposed. In this model, another hole pocket emerges with increasing
pressure at point $M$, $\textbf{\emph{k}}=(\pi,\pi)$, causing a better nesting
with the electron pocket at point $X$ (see the unfolded Fermi surfaces in the
right panel of Fig. 1a Yamakawa2017a ). The better nesting between points $X$
and $M$ with the same orbital can induce a stripe-type magnetic order. When
the hole pocket emerges at point $M$, the shapes of pockets at points $\Gamma$
and $X$ are qualitatively similar to those at ambient pressure, although their
size changes monotonically with increasing pressure Yamakawa2017a . The
emergence of the $d_{xy}$ hole pocket also enhances the density of states
(DOS) (see Fig. 1b), as will be described in detail later. The pressure-
induced reconstitution of Fermi surfaces can change the Cooper pairing,
leading to an SC-SC phase transition from the SC state under the nematic order
to a higher-$T_{\rm c}$ state (see Fig. 4b). The higher-$T_{\rm c}$ state
would provide an intriguing stage for the superconductivity mechanism common
to iron-based superconductors with a high $T_{\rm c}$. However, such a
theoretically predicted Lifshitz transition has not been reported so far
because of the entangled $P-T$ phase diagram and the experimental difficulties
faced in observing Fermi surfaces under pressure.

In this study, we conducted 77Se(I=1/2)-NMR measurements under pressure,
focusing on 12% S-substituted FeSe, where the overlap of nematicity and
magnetism is absent in the intermediate-pressure regime between 1 and 4 GPa
Matsuura2017 ; Xiang2017 . Based on the results, we suggest that the
theoretically predicted Lifshitz transition is observed as an anomaly of the
DOS and as double SC domes accompanied by different types of AF fluctuations.

Typical NMR spectra corresponding to the nematic and magnetic orders are shown
in Fig. 2a. We applied a magnetic field of 6.02 T parallel to a axis in the
tetragonal phase throughout the NMR measurements. In the nematic phase, the
NMR spectra exhibit a double-edge structure Kuwa , as shown in the left panel
of Fig. 2a. The double edges have been observed as two separate peaks for pure
FeSe Wang2016 ; Wiecki2017a ; Baek2015 ; Wang2017c . This edge structure
disappears above 0.57 GPa. The spectra above 1 GPa exhibit a single peak. At
3.9 GPa, the 77Se signal disappears at approximately 60 K because of the AF
order (see the right panel of Fig. 2a). The $T$ dependence of the linewidth at
ambient pressure, 3.5 GPa and 3.9 GPa is shown in Fig. 2b. The AF order is
observed via a remarkable increase in the linewidth and the loss of the
signal. We defined $T_{\rm N}$ as the temperature of the onset of linewidth
broadening.

Figure 2:  Typical 77Se-NMR spectra and linewidth for 12% S-substituted FeSe
corresponding to the nematic and antiferromagnetic (AF) orders. a, The NMR
spectra at ambient pressure show a double-edge structure in the nematic phase
below 60 K. The NMR spectra at 3.9 GPa broaden remarkably, and the signal is
not observed below the AF transition temperature $T_{\rm N}$. b, Full width at
half maximum at 3.5 and 3.9 GPa. The arrows shown by $T_{\rm nem}$ and $T_{\rm
c}$ represent the nematic and superconducting transition temperatures,
respectively.

Now, we focus on the Knight shift ($K$) in a paramagnetic state. Figure 3a
shows the $T$ dependence of $K$ in a paramagnetic state. We adopted the
average of the two edges for $K$ in the nematic phase. The data below 3 GPa
were already publisged in an early work Kuwa . The Knight shift above 3 GPa is
$T$ dependent even at low temperatures suggesting the influence of AF
fluctuations, whereas the influence is absent below 3 GPa. Hereafter, we
discuss the $P$ dependence of $K$ below 3 GPa in relation to the DOS shown in
Fig. 1b. Fig 3b shows the $P$ dependence of the NMR spectra at 60 K, and each
spectrum is fitted by a Gaussian function. From the peak positions in Fig. 3b,
the $P$ dependence of $K$ is obtained, as shown in Fig. 3c. Note that the
anomaly at 1 GPa is observed at entire temperatures and therefore is not
directly caused by the nematic transition.

The Knight shift in a paramagnetic state is decomposed as

$K=K_{\rm spin}+K_{\rm orb}$ (1)

where $K_{\rm spin}$ and $K_{\rm orb}$ represent the spin and orbital parts of
the Knight shift, respectively. The former and latter are $T$-dependent and
$T$-independent, respectively. Experimentally, $K$ is decomposed into $K_{\rm
spin}$ and $K_{\rm orb}$ using the uniform spin susceptibility, $\chi(0)$. The
orbital part $K_{\rm orb}$ is estimated to be 0.26% at ambient pressure
[Supplemental material], which is almost the same as that obtained for pure
FeSe JLi . The results suggest that $K_{\rm orb}$ is insensitive to S
substitution. The spin part $K_{\rm spin}$ and $\chi(0)$ are related to
$K_{\rm spin}=A\chi(0)$, where $A$ is the hyperfine coupling. The monotonic
decrease in $K$ below 3 GPa with decreasing $T$ suggests that the influence of
magnetism is absent at low temperatures. In this case, $\chi(0)$ can be
described using the formula for conventional paramagnetic metals and is
related to the DOS of free electrons, $D(E_{\rm F})$. Therefore, $K_{\rm
spin}$ is proportional to $D(E_{\rm F})$:

$K_{\rm spin}\propto D(E_{\rm F}).$ (2)

Although the DOS shown in Fig. 1b is derived using a tight-binding (TB) model
as described later, overall features can be roughly explained by the DOS for
two-dimensional free electron systems. For two-dimensional free electron
systems, $D(E_{\rm F})$ is expressed as

$D(E_{\rm F})=\frac{(Na)^{2}}{2\pi}\frac{2m}{2\hbar}$ (3)

where $N^{2}$, $a$, and $m$ are the total number of lattices, lattice
constant, and electron mass, respectively. The $P$ dependence of $D(E_{\rm
F})$ originates only from that of $a^{2}$. According to X-ray analyses up to 1
GPa Matsuura2017 , the lattice constant ($a$) shrinks linearly with increasing
pressure. The lattice constant also shrinks for S substitution: 30%
S-substitution is equivalent to a pressure application of 1 GPa. Therefore,
the discrepancy in $a$ between pure FeSe and 12% S-substituted FeSe is
trivial. We use $a$ for pure FeSe because $a$ for 12% S-substituted FeSe is
not available at present. In addition, the data above 1 GPa is not available
at present, and instead we adopted the extrapolation of the data below 1 GPa.
The values of $a^{2}$ and $K_{\rm spin}/a^{2}$ normalized by those at ambient
pressure are shown in Fig. 3d. The normalized $K_{\rm spin}/a^{2}$ is a
quantity compared with the theoretical results shown in Fig. 1b. The step-like
enhancement at 1 GPa reaches 10% of $K_{\rm spin}/a^{2}$ at ambient pressure,
which is consistent with the theoretical calculation of the total DOS shown in
Fig. 1b. The enhancement of $K_{\rm spin}/a^{2}$ seems to be smaller than that
shown in Fig. 1b, implying that the size of the hole pocket at the point $M$
is fairly small, as described later. We determined $K_{\rm spin}$ at low
pressures below 1 GPa, assuming that $K_{\rm orb}$ is estimated to be $\sim
0.26\%$. However, at high pressures such as 2 or 3 GPa, the determination of
$K_{\rm spin}$ is very difficult because the data of $\chi(0)$ under pressure
are not available. The assumption of $K_{\rm orb}\sim 0.26\%$ leads to an
unrealistic result, namely, $K_{\rm spin}$ or the DOS at high pressures
becomes lower than that at ambient pressure. To overcome this difficulty, we
focus on a remarkable drop in $K_{\rm spin}$ below $T_{\rm c}$ at 2 and 3 GPa
(see Fig. 3a). The apparent drop at 2 and 3 GPa originates from $K_{\rm
spin}$, indicating that $T$-independent $K_{\rm orb}$ decreases at high
pressures. Therefore, we assumed that the decrease in $K_{\rm orb}$ at high
pressures is equivalent to the drop in $K_{\rm spin}$ below $T_{\rm c}$. In
Fig. 3d, we estimated the decrease in $K_{\rm orb}$ to be 0.005 and 0.01 % for
2 and 3 GPa, respectively, from the drop in $K_{\rm spin}$ below $T_{\rm c}$.

Figure 3:  77Se-Knight shift for 12% S-substituted FeSe. a, Temperature
dependence of Knight shift ($K$) at several pressures. The Knight shift below
3 GPa Kuwa  reflects the density of states (DOS) at low temperatures. The
decrease in K due to superconductivity is clearly observed at 2 or 3 GPa. b,
Pressure dependence of the NMR spectra at 60 K. Each spectrum is fitted with a
Gaussian function, as indicated by dotted curves. c, Pressure dependence of
$K$ measured at 60 and 70 K. The dotted curves are guides to the eye. d,
Pressure dependence of the square of the a-axis lattice constant ($a^{2}$) and
$K_{\rm spin}/a^{2}$ normalized by those at ambient pressure. The dashed lines
represent the average of $K_{\rm spin}/a^{2}$ at pressure regions below and
above 1 GPa. Figure 4:  $T$ dependence of $1/T_{1}T$ of 77Se measured at 6.02
T and color plot of $1/T_{1}T$. a, The data at ambient pressure, 1.0, 2.0, and
3.0 GPa were published in an eraly work Kuwa . $T_{\rm C}$s shown by arrows
are determined from AC susceptibility measurements at 6.02 T. Both nematic and
superconducting (SC) orders are absent at 1.0 GPa. b, The SC phase shows a
double-dome structure at 6.02 T. $T_{\rm C}$s shown by circles and inverted
triangles are determined from AC susceptibility measurements at 0 T and 6.02
T, respectively. $T_{\rm C}$s shown by inverted triangles are the same as
those shown by arrows in Fig. 4a.

The step-like enhancement is theoretically explained by the hole pocket at
($\pi$, $\pi$) appearing across the Fermi level owing to the lift of the
$d_{xy}$ orbital (see Fig. 1a). Assuming that $a$=1, the $P$ dependence of the
DOS for each orbital was calculated for 10% S-substituted FeSe (Fig. 1b). The
DOS was calculated using the TB models constructed from first-principles
calculations based on the crystal structure. We denote the Hamiltonian for
FeSxSe1-x at pressure $P$ (GPa) as $H^{(0)}_{x}(P)$. The model Hamiltonian
used for these calculations is expressed as

$H(P)=H^{(0)}_{0.1}(0)+\Delta H(P)+\Delta E$ (4)

where $\Delta E$ is the correction term added to fit the real size of the
Fermi surfaces observed experimentally from ARPES and dHvA quantum oscillation
Watson2015a ; Watson2017 ; Kushnirenko2018 ; Coldea2018 ; Skornyakov2018 ;
Fanfarillo2018 . Given that $\Delta H(P)\equiv
H^{(0)}_{0.1}(P)-H^{(0)}_{0.1}(0)$ changes linearly in the pressure range of
0–4 GPa and is insensitive to the concentration $x$, $H^{(0)}_{0.1}(P)\simeq
H^{(0)}_{0}(P)$, $\Delta H(P)$ is expressed as

$\Delta H(P)\simeq\frac{P}{4}(H^{(0)}_{0}(4)-H^{(0)}_{0}(0)).$ (5)

The DOS enhancement appears at around 1.5 GPa, which is consistent with the
experimental results of $K$ shown in Fig. 2d.

The DOS enhancement can affect low-energy magnetic fluctuations obtained from
the relaxation rates divided by temperature, $1/T_{1}T$, as the nesting
condition between Fermi surfaces changes. Figure 4a shows the $T$ dependence
of $1/T_{1}T$ at several pressures. $T_{\rm c}$s shown by arrows were
determined from the AC susceptibility measurements at 6.02 T [Supplemental
material]. When the wave vector $(q)$-dependence of the hyperfine interaction
is neglected, $1/T_{1}T$ is expressed as follows:

$\frac{1}{T_{1}T}\propto\sum_{q}\frac{{\rm Im}\chi(q,\omega)}{\omega}$ (6)

where $\omega$ and $\chi(q,\omega)$ represent the NMR frequency and the
dynamical spin susceptibility, respectively. Below $T_{\rm c}$, the signal
intensity became extremely small, and thus, we could not detect signals below
10 K at 2.0 GPa and 15 K at 3.0 GPa, respectively. At ambient pressure,
$1/T_{1}T$ shows Curie–Weiss-like behavior in the nematic phase, indicating
the development of AF fluctuations Moriya1973 ; Moriya1974 :

$\frac{1}{T_{1}T}\sim a+\frac{b}{T-\theta}$ (7)

where $a$ and $b$ are independent of $T$. $\theta$ is estimated to be almost
zero at ambient pressure. However, the Curie–Weiss behavior is strongly
suppressed even at 0.57 GPa. Although the Curie–Weiss behavior is not clearly
observed at pressures between 2 and 3.5 GPa, an anomaly of $1/T_{1}T$ is
observed at around $T_{\rm c}$. In this pressure regime, $T_{\rm c}$ at 6.02 T
gradually recovers with increasing pressure. The data at 3.9 GPa are
completely different from those at 2.0 and 3.0 GPa in that the anomaly occurs
not at $T_{\rm c}$ but at $T_{\rm N}$. The data series in Fig. 4a is presented
as a color plot in Fig. 4b. As shown in Fig. 4b, different types of AF
fluctuations are observed in the $P-T$ phase diagram, indicating that the
origins of the AF fluctuations are different between the lower and higher
pressure regimes. This result indicates a change in the nesting condition and
confirms the theoretically predicted pressure-induced Lifshitz transition.

The results of $K$ and $1/T_{1}T$ show that the DOS and the AF fluctuations
change at around 1 GPa, respectively. Interestingly, the AF fluctuations,
which are unambiguous in the low-pressure regime where the nematic order
occurs, unexpectedly become ambiguous in the high-pressure regime despite the
AF phase boundary. In general, the Curie–Weiss behavior should be clearly
observed near the AF phase boundary. Therefore, ambiguous AF fluctuations at
high pressures are extremely rare compared to those of conventional AF
magnets. This peculiarity arises because the nesting condition is not optimal,
which implies that the $d_{xy}$ hole pocket is fairly small. Such a small hole
pocket is consistent with the small increase in the DOS at 1 GPa.

Another peculiar phenomenon is the loss of the NMR signal at low temperatures
in the high-pressure regime above 1 GPa. This peculiarity can be attributed to
the close relationship between the nematic and AF orders Yamakawa2017a .
Nematic and/or AF states can appear at any pressure. Thus, a short-range AF
order can develop even in the absence of a long-range AF order. A short-range
AF order would make the NMR signal very weak and undetectable at low $T$ below
$T_{\rm c}$. A long-range AF order at pressures above 3.9 GPa can develop
together with a finite order parameter from the short-range AF order.

We demonstrated the strong suppression of $1/T_{1}T$ under pressure. A similar
suppression is also observed by isovalent S substitution Wiecki2018 , despite
the fact that the Fermi surfaces become larger and the nesting condition
becomes better with increasing S concentration Coldea2016 ; Watson2015b ;
Reiss2017 . S substitution would have the same effect as the application of
pressure, because the atomic radius of S is smaller than that of Se. However,
the chalcogen height decreases with increasing S concentration, in contrast to
the application of pressure Matsuura2017 . For the heavily S-substituted
regime over 20%, where the BCS-BEC crossover has been suggested Kasahara2014 ;
Hosoi2016 ; Sato2017 ; Hanaguri2017 ; Hanaguri2019 , the Curie–Weiss behavior
of $1/T_{1}T$ is strongly suppressed, similar to $1/T_{1}T$ for 12%
S-substituted FeSe at 1 GPa. Although the strong suppression of the
Curie–Weiss behavior is common, it is not clear whether the present high-
pressure regime is smoothly linked with the heavily S-substituted regime. To
solve this problem, further investigation is needed.

In conclusion, we performed 77Se-NMR measurements on 12% S-substituted FeSe
under pressures of up to 3.9 GPa. We observed the anomalies of $K$ and
$1/T_{1}T$ corresponding to the theoretically predicted pressure-induced
Lifshitz transition. These results indicate that nematicity and magnetism
exhibit cooperative coupling. The AF fluctuation unambiguously develops in the
nematic phase as the Curie-Weiss behavior of $1/T_{1}T$ in the low-pressure
regime below 1 GPa. In contrast, in the high-pressure regime between 1 and 3.9
GPa where the nematic order is absent, the AF fluctuation is strongly
suppressed. Further, a high $T_{\rm c}$ is realized in a pressure regime where
the nematic order is absent and the correlated AF fluctuation is fairly weak.
The emergence of the $d_{xy}$ orbital and its intra-orbital coupling play a
key role for the high-$T_{\rm c}$ superconductivity.

## Methods

We performed 77Se-NMR measurements at 6.02 T using a single crystal of 12%
S-substituted FeSe with dimensions of approximately $1.0mm\times 1.0mm\times
0.5mm$. We applied a magnetic field parallel to the FeSe planes to suppress
the decrease in $T_{\rm c}$. We applied a pressure up to 3.9 GPa using a
NiCrAl piston-cylinder-type pressure cell. The highest pressure attainable by
clamping this pressure cell is 3.7 GPa because a decrease of 10% in pressure
is inevitable after releasing a load. To attain a pressure of 3.9 GPa, we
maintained a constant load by employing an oil press mounted on top of the
cryostat Fujiwara2007 . We performed pulsed-NMR measurements using a
conventional spectrometer and measured the relaxation time ($T_{1}$) via the
saturation-recovery method.

## Data availability

Data are available from the corresponding author upon reasonable request.

## Acknowledgements (not compulsory)

The present work was supported by Grants-in-Aid for Scientific Research
(KAKENHI Grant No. JP18H01181) and a grant from the Mitsubishi Foundation.
This work was partly supported by Grants-in-Aid for Scientific Research
(KAKENHI Grant Nos. JP18H05227, JP19H00648, and JP18K13492) and by Innovative
Areas “Quantum Liquid Crystals” (No. JP19H05824) from the Japan Society for
the Promotion of Science.

## Author contributions statement

N. F. designed the NMR experiments. T. K. carried out the NMR measurements
under the instruction of N. F.. K. M., Y. M., S. K., Y. M., and T. S.
synthesized the samples and performed the chemical analysis of the samples. J.
G. measured the magnetization at ambient pressure to decompose the Knight
shift to the orbital and spin parts. Y. Y. and H. K. calculated the DOS. The
high-pressure technique under a constant load was designed by Y. U..

## References

  * (1) Takasada Shibauchi, Tetsuo Hanaguri, and Yuji Matsuda, J. Phys. Soc. Jpn. 89, 102002 (2020).
  * (2) R. M. Fernandes, A. V. Chubukov, and J. Schmalian, Nat. Phys. 10, 97 (2014).
  * (3) T. Shimojima, Y. Suzuki, T. Sonobe, A. Nakamura, M. Sakano, J. Omachi, K. Yoshioka, M. Kuwata-Gonokami, K. Ono, H. Kumigashira, A. E. Böhmer, F. Hardy, T. Wolf, C. Meingast, H. V. Löhneysen, H. Ikeda, and K. Ishizaka, Phys. Rev. B 90, 121111(R) (2014).
  * (4) T. Shimojima, Y. Suzuki, A. Nakamura, N. Mitsuishi, S. Kasahara, T. Shibauchi, Y. Matsuda, Y. Ishida, S. Shin, and K. Ishizaka, Nat. Commun. 10, 1946 (2019).
  * (5) M. D. Watson, T. K. Kim, A. A. Haghighirad, N. R. Davies, A. McCollam, A. Narayanan, S. F. Blake, Y. L. Chen, S. Ghannadzadeh, A. J. Schofield, M. Hoesch, C. Meingast, T. Wolf, and A. I. Coldea, Phys. Rev. B 91, 155106 (2015).
  * (6) M. D. Watson, A. A. Haghighirad, L. C. Rhodes, M. Hoesch, and T. K. Kim, New J. Phys. 19, 103021 (2017).
  * (7) Y. S. Kushnirenko, A. V. Fedorov, E. Haubold, S. Thirupathaiah, T. Wolf, S. Aswartham, I. Morozov, T. K. Kim, B. Büchner, and S. V. Borisenko, Phys. Rev. B 97, 180501 (2018).
  * (8) A. I. Coldea and M. D. Watson, Annu. Rev. Condens.Matter Phys. 9, 125 (2018).
  * (9) S. L. Skornyakov, V. I. Anisimov, D. Vollhardt, and I. Leonov, Phys. Rev. B 97, 115165 (2018).
  * (10) L. Fanfarillo, L. Benfatto, and B. Valenzuela, Phys. Rev. B 97, 121109 (2018).
  * (11) P. O. Sprau, A. Kostin, A. Kreisel, A. E. Böhmer, V. Taufour, P. C. Canfield, S. Mukherjee, P. J. Hirschfeld, B. M. Andersen, J. C. Séamus Davis, Science 357, 75 (2018).
  * (12) J. P. Sun, K. Matsuura, G. Z. Ye, Y. Mizukami, M. Shimozawa, K. Matsubayashi, M. Yamashita, T. Watashige, S. Kasahara, Y. Matsuda, J. Q. Yan, B. C. Sales, Y. Uwatoko, J. G. Cheng, and T. Shibauchi, Nat. Commun. 7,12146 (2016).
  * (13) K. Matsuura, Y. Mizukami, Y. Arai, Y. Sugimura, N. Maejima, A. Machida, T. Watanuki, T. Fukuda, T. Yajima, Z. Hiroi, K. Y. Yip, Y. C. Chan, Q. Niu, S. Hosoi, K. Ishida, K. Mukasa, S. Kasahara, J. G. Cheng, S. K. Goh, Y. Matsuda, Y. Uwatoko, and T. Shibauchi, Nat. Commun. 8, 1143 (2017).
  * (14) L. Xiang, U. S. Kaluarachchi, A. E. Böhmer, V. Taufour, M. A. Tanatar, R. Prozorov, S. L. Budḱo, and P. C. Canfield, Phys. Rev. B 96, 024511 (2017).
  * (15) S. Holenstein, J. Stahl, Z. Shermadini, G. Simutis, V. Grinenko, D. A. Chareev, R. Khasanov, J.-C. Orain, A. Amato, H.-H. Klauss, E. Morenzoni, D. Johrendt, and H. Luetkens, Phys. Rev. Lett. 123, 147001 (2019).
  * (16) J. P. Sun, G. Z. Ye, P. Shahi, J. Q. Yan, K. Matsuura, H. Kontani, G. M. Zhang, Q. Zhou, B. C. Sales, T. Shibauchi, Y. Uwatoko, D. J. Singh, J. G. Cheng, Phys. Rev. Lett 118, 147004 (2017).
  * (17) P. Reiss, D. Graf, A. A. Haghighirad, W. Knafo, L. Drigo, M. Bristow, A. J. Schofield and A. I. Coldea, Nat. Phys.16, 89 (2019).
  * (18) P. S. Wang, S. S. Sun, Y. Cui, W. H. Song, T. R. Li, R. Yu, H. Lei, and W. Yu, Phys. Rev. Lett. 117, 237001 (2016).
  * (19) P. Wiecki, M. Nandi, A. E. Böhmer, S. L. Budḱo, P. C. Canfield, and Y. Furukawa, Phys. Rev. B 96, 180502(R) (2017).
  * (20) T. Kuwayama, K. Matsuura, Y. Mizukami, S. Kasahara, Y. Matsuda, T. Shibauchi, Y. Uwatoko, and N. Fujiwara, J. Phys. Soc. Jpn. 88, 033703 (2019).
  * (21) Y. Yamakawa, and H. Kontani, Phys. Rev. B 96, 144509 (2017).
  * (22) S. H. Baek, D. V. Efremov, J. M. Ok, J. S. Kim, J. Van Den Brink, and B. Büchner, Nat. Mater. 14, 210 (2015).
  * (23) P. S. Wang, P. Zhou, S. S. Sun, Y. Cui, T. R. Li, H. Lei, Z. Wang, and W. Yu, Phys. Rev. B 96, 094528 (2017).
  * (24) J. Li, B. Lei, D. Zhao, L. P. Nie, D. W. Song, L. X. Zheng, S. J. Li, B. L. Kang, X. G. Luo, T. Wu, and X. H. Chen, Phys. Rev. X 10, 011034 (2020).
  * (25) T. Moriya, and A. Kawabata, J. Phys. Soc. Jpn. 34,  639 (1973).
  * (26) T. Moriya, and K. Ueda, Solid State Commun. 15,  169 (1974).
  * (27) P. Wiecki, K. Rana, A. E. Böhmer, Y. Lee, S. L. Budḱo, P. C. Canfield, and Y. Furukawa, Phys. Rev. B 98, 020507 (2018).
  * (28) A. I. Coldea, S. F. Blake, S. Kasahara, A. A. Haghighirad, M. D. Watson, W. Knafo, E. S. Choi, A. McCollam, P. Reiss, T. Yamashita, M. Bruma, S. Speller, Y. Matsuda, T. Wolf, T. Shibauchi, and A. J. Schofield, npj Quantum Mater. 4, 2 (2019).
  * (29) M. D. Watson, T. K. Kim, A. A. Haghighirad, S. F. Blake, N. R. Davies, M. Hoesch, T. Wolf, and A. I. Coldea, Phys. Rev. B 92, 121108(R) (2015).
  * (30) P. Reiss, M. D. Watson, T. K. Kim, A. A. Haghighirad, D. N. Woodruff, M. Bruma, S. J. Clarke, and A. I. Coldea, Phys. Rev. B 12, 121103(R) (2017).
  * (31) S. Kasahara, T. Watashige, T. Hanaguri, Y. Kohsaka, T. Yamashita, Y. Shimoyama, Y. Mizukami, R. Endo, H. Ikeda, K. Aoyama, T. Terashima, S. Uji, T. Wolf, H. v. Löhneysenn, T. Shibauchi, and Y. Matsuda, Proc. Natl. Acad. Sci. 111, 16309 (2014).
  * (32) S. Hosoi, K. Matsuura, K. Ishida, H. Wang, Y. Mizukami, T. Watashige, S. Kasahara, Y. Matsuda, and T. Shibauchi, Proc. Natl. Acad. Sci. 113, 8139 (2016).
  * (33) Y. Sato, S. Kasahara, T. Taniguchi, X. Xing, Y. Kasahara, Y. Tokiwa, Y. Yamakawa, H. Kontani, T. Shibauchi, and Y. Matsuda, Proc. Natl. Acad. Sci. 115, 1227 (2017).
  * (34) T. Hanaguri, K. Iwaya, Y. Kohsaka, T. Machida, T. Watashige, S. Kasahara, T. Shibauchi and Y. Matsuda, Sci. Adv. 4, eaar6419 (2018).
  * (35) T. Hanaguri, S. Kasahara, J. Böker, I. Eremin, T. Shibauchi and Y. Matsuda, Phys. Rev. Lett. 122, 077001 (2019).
  * (36) N. Fujiwara, T. Matsumoto, K. Koyama-Nakazawa, A. Hisada, and Y. Uwatoko Rev. Sci. Instrum. 78, 073905 (2007).

Supplemental Materials

  1. 1.

Determination of $T_{\rm c}$ from the AC susceptibility

  2. 2.

Magnetization

  3. 3.

Orbital part of the Knight shift determined from the K-$\chi$ plot

##  I Determination of $T_{\rm c}$ from the AC susceptibility

We determined $T_{\rm c}$ from the resonance frequency $f_{\rm{r}}$ of the
tank circuit attached to the head of an NMR probe. The frequency $f_{\rm{r}}$
was measured using a commercially available network analyzer. It is related to
the AC susceptibility $\chi$ as $f_{\rm{r}}=1/\sqrt{LC(1+4\pi\chi)}$, where
$C$ and $L$ represent the capacitance of a variable capacitor and the
inductance of a coil wound onto the sample, respectively. Figure 1 shows the
$T$ dependence of $f_{\rm{r}}$: $f_{\rm{r}}$ increases gradually with
decreasing temperature from room temperature, as $L$ of the coil gradually
decreases during the cooling process. The drastic increase in $f_{\rm{r}}$
occurs at $T_{\rm c}$ owing to the Meissner effect. We determined $T_{\rm c}$s
from the crossing points of the dashed lines, as indicated by the red arrows
in Fig. 1. $T_{\rm c}$ at ambient pressure is approximately 9 K. This result
is in agreement with $T_{\rm c}$ determined from magnetization measurements,
as described below.

Figure 5:  $T$ dependence of the resonance frequency $f_{\rm{r}}$ of the tank
circuit measured at zero and 6.02 T. We measured $f_{\rm{r}}$ at 6.02 T
because the NMR measurements described in the main text were performed at 6.02
T.

##  II Magnetization and DC susceptibility

Figure 2 shows the $T$ dependence of the magnetization ($M$) and
susceptibility ($\chi$) measured for 12% S-substituted FeSe with an MPMS
system by Quantum Design Inc. $T_{\rm c}$ determined from the magnetization is
in good agreement with that determined from the AC susceptibility. A large
demagnetization was observed at $T_{\rm c}\sim 9K$. The susceptibility data
measured at 6 T were used to separate the spin and orbital parts of the Knight
shift, as shown in the following $K-\chi$ plot.

Figure 6:  Magnetization and susceptibility for 12% S-substituted FeSe

##  III Spin and orbital parts of ${}^{77}K$ determined from the
${}^{77}K-\chi$ plot

The susceptibility $\chi$ measured from the experiments is decomposed into
three parts: the uniform spin part $\chi(0)$, orbital part $\chi_{\rm orb}$,
and diamagnetic term $\chi_{\rm dia}$; $\chi=\chi(0)+\chi_{\rm orb}+\chi_{\rm
dia}$. The last term is estimated to be approximately $6\times 10^{-5}$
(emu/mol Oe). Both $\chi(0)$ and $\chi_{\rm orb}$ originate from $d$
electrons, and they are estimated only from the ${}^{57}K-\chi$ plot for 57Fe.
$\chi(0)$ and $\chi_{\rm orb}$ are expressed as ${}^{57}K_{\rm
spin}=^{57}A\chi(0)$ and ${}^{57}K_{\rm orb}=^{57}A_{\rm orb}\chi_{\rm orb}$,
where ${}^{57}K_{\rm spin}$ and ${}^{57}K_{\rm orb}$ represent the spin and
orbital parts of ${}^{57}K$, respectively. ${}^{57}A$ is the hyperfine
coupling of 57Fe and is obtained from the slope of the ${}^{57}K-\chi$ plot.
${}^{57}A_{\rm orb}$ is given as $2<\frac{1}{r^{3}}>$, where $r$ represents
the distance between an electron on the $d$ orbits and the 57Fe nucleus.
Because five $d$ orbitals are involved in iron-based systems, detailed
theoretical investigations are needed to restrict the estimation of
${}^{57}A_{\rm orb}$. Because such theoretical calculations are currently
unavailable, ${}^{57}A_{\rm orb}$ is estimated, for convenience, using
$<\frac{1}{r^{3}}>$ for free Fe3+ ions. Five parameters $\chi(0),\chi_{\rm
orb},\chi_{\rm dia},^{57}K_{\rm spin}$, and ${}^{57}K_{\rm orb}$ are uniquely
determined from the following five equations:

${}^{57}K=^{57}K_{\rm orb}+^{57}K_{\rm spin}$ (8)
$\displaystyle\chi=\chi(0)+\chi_{\rm orb}+\chi_{\rm dia}$ (9) ${}^{57}K_{\rm
spin}=^{57}A\chi(0)$ (10) ${}^{57}K_{\rm orb}=^{57}A_{\rm orb}\chi_{\rm orb}$
(11) $\displaystyle\chi_{\rm dia}\sim 6\times 10^{-5}$ (12)

where 57A is determined as the slope of the ${}^{57}K-\chi$ plot and
${}^{57}A_{\rm orb}$ is calculated using the parameter of free Fe3+ ions. Li
et al. estimated $\chi_{\rm orb}$ based on the assumption that $\chi_{\rm
orb}+\chi_{\rm dia}\sim 0$, namely $\chi\sim\chi(0)$ instead of ${}^{57}K_{\rm
orb}=^{57}A_{\rm orb}\chi_{\rm orb}$ [1].

The Knight shift (${}^{77}K$) of 77Se is obtained from the 77Se-NMR spectra.
${}^{77}K$ is decomposed into the orbital part (${}^{77}K_{\rm orb}$) and the
spin part (${}^{77}K_{\rm spin}$): ${}^{77}K=^{77}K_{\rm orb}+^{77}K_{\rm
spin}$. The latter is related to the uniform spin susceptibility $\chi(0)$;
therefore, the density of states (${}^{77}K_{\rm spin}=^{77}A\chi(0)$, where
${}^{77}A$ is the hyperfine coupling of 77Se). The ${}^{77}K-\chi$ plot is
often used for the decomposition of ${}^{77}K$ into ${}^{77}K_{\rm orb}$ and
${}^{77}K_{\rm spin}$, as shown in Fig. 3. Li et al. also estimated
${}^{77}K_{\rm orb}$ to be 0.23% for pure FeSe from the ${}^{77}K-\chi$ plot
under the assumption that $\chi_{\rm orb}+\chi_{\rm dia}\sim 0$. The
${}^{77}K-\chi$ plot for 12% S-substituted FeSe is almost the same as that for
pure FeSe [1]; therefore, ${}^{77}K_{\rm orb}$ can be estimated to be 0.26%,
similar to the case of pure FeSe.

Figure 7:  ${}^{77}K-\chi$ plot for 12% S-substituted FeSe

[1] J. Li, B. Lei, D. Zhao, L. P. Nie, D. W. Song, L. X. Zheng, S. J. Li, B.
L. Kang, X. G. Luo, T. Wu, and X. H. Chen, Supplemental material, Phys. Rev. X
10, 011034 (2020).