Can you trustlessly trade Monero for Bitcoin?

Question

Some cryptocurrencies can be traded in a trustless manner, also known as atomic cross-chain traded. This means that when the trade is done, either the entire trade is done, or none of it is (otherwise, one party could choose not to send their coins).

Can this be done between Bitcoin and Monero. Monero doesn't have scripting support, so the above link's protocol wouldn't work.

One application for this is recovering stolen Bitcoins. If your Bitcoins are stolen, you can buy them back at a discount from the attacker. Since you don't trust each other, or even trust a common arbitrator, it needs to be a trustless trade. You won't recover all your wealth (since you had to give up some of your Monero, which you may have had to buy), but since its at a discount, you'll have recovered some of it. (The thief is likely to accept this, since otherwise he would need to go through the process of laundering the bitcoins.)

Answer 1

Indeed it can. Let's say Alice has Y XMR and Bob has Z BTC, and they want to trade.

1. Alice and Bob setup a multisig wallet (see this).
2. Alice creates (but does not sign) a transaction of Y XMR to the multisig wallet.
3. Alice and Bob mutually sign a transaction from the multisig wallet that sends Y_1 XMR < Y XMR to itself, but locked for 48 hours. They also sign a transaction to send Y_1 and (Y - Y_1) to Alice. These transactions are called the escape transactions, and are not published to the block chain unless Bob acts maliciously.
4. Alice signs her transaction from step 2 and publishes it to the blockchain. Then Alice and Bob wait until Bob feels that there are enough confirmations of the transaction.
5. Bob now buys Alice's key to the multisig wallet using his Z BTC using a contingent bitcoin payment. This payment expires if not claimed in 24 hours.
6. Alice redeems this transaction, revealing her mulitsig key.
7. Bob drains the multisig wallet for its Y XMR.
8. Alice know has the Z BTC, and Bob has the Y XMR.

In the event of one of the parties being malicious

• If Alice or Bob refuse to do step 1, 2, 3, no coins have changed hands, and the trade is aborted.
• If Alice refuses to do step 4, the transactions signed in step 3 are invalid, and so no valid transactions have been signed. The trade is aborted.
• If Bob refuses to do step 5, Alice can redeem her Y XMR after 48 hours by publishing the escape transaction.
• If Alice refuses to do step 6, the trade is aborted. Bob will be able to recover his Bitcoin after 24 hours. (Alice will also be able to redeem her Monero after 48 hours.)
• If Alice tries to publish the escape transactions after step 6, only the first one will be accepted (since the second one is spending monero that is time locked). Bob can and must then redeem (Y-Y_1) XMR from the multisig wallet (since he know has both of its keys), which permanently invalidates the second escape transaction (he can redeem a lesser amount, if he so chooses, as well). After 48 hours, he will be able to move or spend the Y_1 monero that was time locked. Despite Alice trying to be malicious, the trade has been completed successfully.

The only issue with this is that a party acting maliciously can cause the other parties funds to be frozen, but this is only temporary. It may even be possible to add collateral such that if one party aborts once the funds are locked, the other party gets their collateral. That is a question for another day though.

The 24 hours and 48 hours in the above protocol can be adjusted for security. The only requirement is that the contingent payment expires before the escape transactions become valid (with a good buffer in between just in case), as otherwise Alice could drain the multisig monero wallet and then reveal her key to get the bitcoin.

Answer 2

peertrade is a simple way to trade trustlessly without arbitrator by trading in small increments. There is a risk of losing one step worth of coins, but you can make the steps as small as you want.

Lots more info here: https://github.com/peertrade/peertrade

Edit: peertrade works with coins that share the standard bitcoin json-rpc api. I don't think that monero does, so it would probably require some customization.