paint-brush
A New Way to Trade Options Without Collateralโ€‚by@escholar
New Story

A New Way to Trade Options Without Collateral

tldt arrow

Too Long; Didn't Read

A novel protocol enables collateral-free cross-chain options by employing economic incentives and two-phase contracts. This method eliminates the need for upfront collateral, introduces hashlock-based activation, and resists phantom bid attacks for seamless and secure option trading.
featured image - A New Way to Trade Options Without Collateral
EScholar: Electronic Academic Papers for Scholars HackerNoon profile picture
  1. Abstract and Introduction

  2. Preliminaries

  3. Overview

  4. Protocol

    4.1 Efficient Option Transfer Protocol

    4.2 Holder Collateral-Free Cross-Chain Options

  5. Security Analysis

    5.1 Option Transfer Properties

    5.2 Option Properties

  6. Implementation

  7. Related Work

  8. Conclusion and Discussion, and References


A. Codes

B. Proofs

4.2 Holder Collateral-Free Cross-Chain Options

We want to remove the need for upfront collateral from Alice without using a cross-chain bridge. Allowing Alice direct access to the exercise secret risks Bobโ€™s asset since Alice has no collateral. To address this, we resort to economic incentives and let Bob control the exercise secret while Alice retains the right to penalize Bob. In addition to the usual collateral, Bob locks a valuable asset on ๐ถโ„Ž๐‘Ž๐‘–๐‘›๐ด as a guarantee. If Bob fails to release the exercise secret when Alice exercises her right, she receives Bobโ€™s guarantee as compensation, incentivizing Bob to cooperate.


Figure 2: Collateral-Free Cross-Chain Swap Options if both Alice and Bob are honest, where Alice generates ๐ด and ๐ป(๐ด), Bob generates ๐ต and๐ป(๐ต), then they exchange๐ป(๐ด) and๐ป(๐ต).


Suppose Alice and Bob reach an agreement that Alice pays Bob ๐‘ƒ as a premium on a chain denoted by ๐ถโ„Ž๐‘Ž๐‘–๐‘›๐‘ƒ . The option takes effective at ๐‘‡๐ด meaning that Alice obtains the right to exchange ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ด for ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต before ๐‘‡๐ธ. Bobโ€™s guarantee is ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ .


The protocol involves two kinds of asset settlement: first for option establishment (or activation, we use them interchangably) and second for option exercise. We therefore introduce two secrets:


(1) Activation secret ๐ด, used for Alice to pay the premium and activate the option; and (2) Exercise secret ๐ต, used for Alice to pay ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ด to Bob in exchange for ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต when the option is exercised. Secret ๐ด is generated by Alice and ๐ต is generated by Bob.


The protocol is divided into two phases. Figure 2 shows the execution process of this protocol if both parties are honest.


(1) Setup phase: Alice and Bob activate an option. Alice obtains option and Bob obtains premium.


(2) Exercise/Abandon phase: Alice can either exercise the option or abandon it.


In the setup phase, Alice and Bob will establish this option similarly to a vanilla HTLC. Alice locks ๐‘ƒ with a hashlock ๐ป(๐ด) in a contract on any chain. Bob creates two contracts, ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด on ๐ถโ„Ž๐‘Ž๐‘–๐‘›๐ด and ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ต on ๐ถโ„Ž๐‘Ž๐‘–๐‘›๐ต, which are used in the option. The option remains inactive until Alice reveals the activation secret ๐ด before ๐‘‡๐ด, at which point the state updates to active and Bob gets Aliceโ€™s premium. ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด holds Bobโ€™s guarantee, ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ , until the option expires. If Alice exercises the option and Bob fulfills his obligation by revealing the exercise secret ๐ต, ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ is refunded to Bob. If Bob fails to fulfills his obligation, ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ will be transferred to Alice. ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ต locks Bobโ€™s collateral, ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต, using ๐ป(๐ต).


I. Setup Phase.


(1) Alice randomly selects a secret ๐ด as activation secret, and computes its hash value ๐ป(๐ด). Bob generates ๐ต and ๐ป(๐ต), which serve as the exercise secret and hashlock.


(2) Alice locks ๐‘ƒ with hashlock ๐ป(๐ด) on the agree-upon๐ถโ„Ž๐‘Ž๐‘–๐‘›๐‘ƒ with timeout ๐‘‡๐ด + ฮ”.


(3) If Bob observes that Alice has honestly deposited the premium, Bob should, at any time before ๐‘‡๐ด โˆ’ ฮ”:


(a) Create ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด on ๐ถโ„Ž๐‘Ž๐‘–๐‘›๐ด and ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ต on ๐ถโ„Ž๐‘Ž๐‘–๐‘›๐ต. These contracts are initially in an inactive state, and record the holder and writer, activation time ๐‘‡๐ด and option expiration time ๐‘‡๐ธ.


(b) Escrow the guarantee ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ on ๐ถโ„Ž๐‘Ž๐‘–๐‘›๐ด, and lock principal ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต on ๐ถโ„Ž๐‘Ž๐‘–๐‘›๐ต with hashlock ๐ป(๐ต).


(4) If Alice observes that Bob has created contracts and made deposits, Alice reveals ๐ด at ๐‘‡๐ด on both chains to activate the option. If not, transaction aborts, Bob calls refund() and retrieves ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ and ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต. Alice refunds ๐‘ƒ.


II. Exercise/Abandon Phase.


(1) Exercise: If Alice wants to exercise the option at ๐‘‡๐ต before expiration, she calls exercise() and deposits ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ด into ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด, then within one ฮ”:


(a) If Bob reveals ๐ต and calls fulfill() on ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด, then he obtains both ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ด and ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ . Upon observing ๐ต, Alice obtains ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต with ๐ต from ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ต.


(b) If Bob does not reveal ๐ต, Alice calls claim() on๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด after ๐‘‡๐ต + ฮ” to receive ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ as compensation.


(2) Abandon: If Alice does not call exercise() before or at ๐‘‡๐ธ, then the option is abandoned and Bob can call refund() on ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด and ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ต to refund ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ and ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต.


Timeouts. The latest deadline ๐‘‡๐ต is no later than ๐‘‡๐ธ. If Bob fails to fulfill his obligations, then Alice receives ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ by ๐‘‡๐ธ + 2ฮ”. Therefore, the lock period for ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ in ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด is ๐‘‡๐ธ +ฮ” if Alice waives the option, or extends to๐‘‡๐ธ +2ฮ” if Alice exercises the option. Alice exercises the option and receives ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต by๐‘‡๐ธ +2ฮ”. Therefore, the lock period for ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต in ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ต is ๐‘‡๐ธ + 2ฮ”.


4.2.1 Integration: Efficient Cross-Chain Options without Upfront Holder Collateral. We incorporate the efficient option transfer protocol to enable a collateral-free option transfer process. From the option transfer perspective, the roles of the holder and writer are reversed, as Bob owns the exercise secret. Bob deposits ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ and ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต in ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด and ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ต. In the transfer of Bobโ€™s position, hashlock ๐ป(๐ต) must remain consistent.


Take Bob transferring writer to Dave as an example. It is similar to the Protocol 4.1.1 with three notable differences. Suppose Bob reaches an agreement with Dave to transfer the writer position. Dave is able to buy Bobโ€™s risky asset with its obligation at the price of ๐‘Š ๐‘Ÿ๐‘–๐‘ก๐‘’๐‘Ÿ๐น๐‘’๐‘’ before or at ๐‘‡๐‘Š . First, Dave must choose a new hashlock as the exercise secret, and similarly, Bob needs to use his private key ๐‘ ๐‘˜๐ต to sign Daveโ€™s new hashlock ๐ป(๐ท), which means message ๐‘š = (๐‘Ž, (Dave.๐‘Ž๐‘‘๐‘‘๐‘Ÿ๐‘’๐‘ ๐‘ , ๐ป(๐ท), ๐‘๐‘˜๐ท )). Second, Alice can use Bobโ€™s private key ๐‘ ๐‘˜๐ต to reclaim ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐ต and guarantee, ๐ด๐‘ ๐‘ ๐‘’๐‘ก๐บ . Third, if Alice wants to exercise the option and makes the deposit after Bob reveals the signature during the transfer process, the transfer continues, and Dave must forward the signature to obtain the writerโ€™s position. Dave should fulfill his obligation and reveal the exercise secret at ๐‘‡๐‘Š โˆ’ ฮ” on ๐ถ๐‘œ๐‘›๐‘ก๐‘Ÿ๐‘Ž๐‘๐‘ก๐ด.



As a result of the support for concurrent bidding, our protocol can effectively defend against phantom bid attack. In phantom bid attack, an adversary creates multiple virtual buyers who offer higher prices but do not finalize the transfer. In the previous protocol [12] which attempts to transfer the option to a buyer sequentially, in face of such an attack, the option holder/writer cannot sell their positions in a reasonable time since the virtual buyers are exhausting the option transfer window.


With our proposed protocol, an adversary option buyer cannot launch this attack. This is due to the use of a signature for option transfer settlement, rather than a hashlock used in the previous protocol. By this signature scheme, once a buyer is chosen by the seller, the option transfer can be finalized. There is no time window for the buyer to choose to finalize the option transfer or abort.


Authors:

(1) Zifan Peng, The Hong Kong University of Science and Technology (Guangzhou) Guangzhou, Guangdong, China ([email protected]);

(2) Yingjie Xue, The Hong Kong University of Science and Technology (Guangzhou) Guangzhou, Guangdong, China ([email protected]);

(3) Jingyu Liu, The Hong Kong University of Science and Technology (Guangzhou) Guangzhou, Guangdong, China ([email protected]).


This paper is available on arxiv under CC BY 4.0 license.