Design-only sketch — does not touch any live rail. Follows 0269's honest trust
discussion by walking a legitimate reduction in the deposit-time trust window
that the current bonded-operator model has.
contracts/WithdrawalHTLC.cash
BCH side of a WITHDRAWAL atomic swap. Two branches:
claim(sig dexSig, bytes preimage)
sha256(preimage) == hashLock, DEX signature, output[0] pinned to return
the CashToken to the Deposit reservoir's locking bytecode (burn on
claim — supply un-mints to match the DGB drained on the source chain).
refund(sig aliceSig)
Alice signature + tx.time >= timeout — freeform spend.
Uses SHA-256 (matches DGB / BTC OP_SHA256 in the mirror HTLC), absolute
Unix-timestamp locktime, and enforces the reservoir shape via
OP_OUTPUTBYTECODE / OP_OUTPUTTOKENCATEGORY / OP_OUTPUTTOKENAMOUNT / OP_OUTPUTVALUE.
Compiled cleanly against cashc 0.12.x on first pass. Both branches
materialize as expected in the ASM (OP_IF … OP_ELSE … OP_ENDIF); reservoir
dust check emits >= 546. Artifact reproducible via
npx cashc contracts/WithdrawalHTLC.cash -o build/WithdrawalHTLC.json
scripts/design/withdrawal-atomic-swap-sketch.mjs
Mocked driver using MockNetworkProvider. Walks Phases 1-5: preimage +
hashlock generation, HTLC funding on both chains (BCH side sketched via
cashscript TransactionBuilder, DGB side described in comments as a plain
P2SH-HTLC), happy-path claim with burn to reservoir, refund path with
timeouts, reconciliation. Not runnable end-to-end (reservoirLB shim + a
couple of illustrative UTXO shapes); it reads as a sequence diagram in
code, which is what a design sketch wants.
snapshots/0270-atomic-swap-deposit-withdrawal-htlc-design.md
Design doc. Covers the paired-covenant pattern (WithdrawalHTLC +
DepositHTLC sibling), the T_A >= 2·T_B timeout safety rule, what atomic
swaps FIX (transactional trust window on both deposit and withdrawal)
and what they DON'T FIX (accumulated custody trust in the DEX's
source-chain address, which still needs MPC/multi-sig + slashable-bond
as separate composable layers). Also flags the Deposit.cash v2 companion
requirement — a burn() function that accepts an incoming CashToken input
and increments the reservoir's FT amount. Not yet coded; symmetric to
the existing deposit() function.
Roadmap position: bonded-operator rails (0267-0269) stay as-is. MPC signing
is the honest first upgrade to those. Atomic-swap deposits (this sketch)
is the second, and would migrate one rail at a time starting with DGB.
Slashable-bond covenant is the third. Trustless BCH-verified DGB release
remains blocked by DGB Script (no zk opcodes, no BCH light client).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
77283e5eda