System Overview

Atomic Loans provides a mechanism for cross-chain collateralized loans. Specifically, the system allows people to borrow Ethereum-based USD stablecoins while locking Bitcoin as collateral. In case of default, the collateral is liquidated to make the lender whole. As a fallback for failed liquidations, the lender can eventually seize a portion of the collateral.

Detailed Design

In the description below, we'll use the following characters:

Alice, who wishes to borrow Ethereum tokens using Bitcoin as collateral.
Bob, who wishes to lend out his Ethereum tokens.
Carol, an automated agent who aids in the liquidation process.
David, the liquidator who buys the collateral at a discount.

Loan Establishment

To set up a loan, Alice and Bob must first agree on the loan parameters. This agreement can occur off chain, though there is an optional Funds contract that allows lenders to establish parameters on chain and accept loans from anyone who agrees to those parameters. These parameters include the amount of collateral and principal, the interest rate, what portion of the collateral can be seized in the case of default, durations for the various steps of the process, etc.

Part of setting up a loan is the establishment of secrets that will be used throughout the loan process. These secrets are used for a number of commit-reveal schemes, so the secrets are initially hashed and then revealed at the appropriate time.

A1 is revealed by Alice when she retrieves the loan principal. It can later be used by Bob to seize collateral once the loan has expired.
B1 is revealed by Bob to accept loan repayment or to cancel the loan (before Alice has received the principal). Alice can use this secret to reclaim her collateral.
A2 and B2 are used as part of the collateral liquidation process in case of default. There are actually multiple A2s and B2s to support multiple liquidations.

To establish the loan, Alice must prove that she has the funds necessary for the debt agreement. She does this by signing an invalid Bitcoin transaction, who's signature is checked by Bob. This proof of funds is to prevent griefing.

Once Bob is satisfied with Alice's funds, he moves the tokens to the Loans contract. Alice then has until approve expiration to lock her collateral in a pair of Bitcoin P2SHs (pay to script hashes): one for the refundable collateral and one for the seizable collateral. At a high level, refundable collateral goes back to Alice unless it's sold in a liquidation, and seizable collateral may be seized by Bob if he is not repaid otherwise.

Once Bob is satisfied with the locked collateral, he releases the principal to Alice on the Ethereum blockchain. Alice takes this collateral, revealing A1.

Loan Repayment

Alice can repay the loan principal plus interest on the Ethereum blockchain. Bob must reveal B1 to accept this repayment, at which point Alice can unlock all of her collateral, and the loan is complete.

Collateral Liquidation

Alice may fail to repay the loan by the end of the loan period. In those cases, Alice's collateral is liquidated at a 7% discount. Of the funds raised in the liquidation, Bob receives up to the amount he's owed (principal plus interest), and Alice receives the remainder. The collateral is then paid to the liquidator.

Alice's collateral is subject to liquidation in one other case. One of the loan's parameters is a minimum collateralization ratio, which is measured by determining the value of Alice's collateral in USD and comparing it to the amount of the loan. If the collateralization ratio is not maintained, a liquidation may be started even before the end of the loan period.

The liquidation process is complicated by the need to handle cross-chain interactions. The following is a description of the liquidation process:

The collateral is offered up at a 7% discount.
A third party Liquidator liquidates the collateral by calling the liquidate function and providing tokens to buy this collateral at a discount, as well as provide hash of a secret D1, which locks their liquidation in the smart contract. At this point, the Liquidator (David) is established.
Alice and Bob produce signatures to move all of the collateral into new collateral swap P2SHs.
Alice and Bob also produce signatures to move the collateral back to standard refundable collateral and seizable collateral scripts after a timeout. This is to handle the case where David never reveals D1.
Alice and Bob, once they're both satisfied with the signatures, reveal A2 and B2.
The collateral P2SHs accept Alice and Bob's signatures, along with A2 and B2, and allow funds to be moved to a new collateral swap script, locked with D1.
David retrieves the Bitcoin collateral, revealing D1 in the process.
Alice and Bob can use D1 to disburse the funds on Ethereum that David bid.

If Alice and Bob fail to move the collateral, David can request a refund of his bid after a timeout.

If David fails to reveal D1 in the time period allotted, Alice and Bob can move the funds back to standard collateral P2SHs (using the "back" scripts established in step 4) and attempt another liquidation.

Collateral Seizure

For an liquidation to be successful, both Alice and Bob have to participate by producing signatures and revealing secrets. Up to three liquidations can occur. If all of them fail, Bob can seize the seizable portion of the collateral, and Alice can reclaim the refundable portion.

Using an Automated Agent

Many of the steps in the loan process have a liveness requirement. Alice or Bob need to be online to execute their part of the process before a timeout elapses. As an optional component, Alice and Bob can agree on an agent named Carol. Carol can act on behalf of either Alice or Bob at two key times:

Either Bob or Carol can accept loan repayment or cancel a loan. This is particularly useful for lenders who may be offline at the time a borrower repays a loan.
During an liquidation, it takes only two out of Alice, Bob, and Carol to move funds to the collateral swap script or to move them back after the sale has expired. This means either party can be offline during the liquidation.

Open Source Code

The following resources contain the Ethereum smart contracts and Bitcoin scripts involved in the protocol.

Bitcoin:

Ethereum:

Note: This is V1 of Atomic Loans

V2 will involve a trustless Bitcoin-backed loan protocol (other than oracles), without a third party arbiter, using a non-custodial Bitcoin price oracle detailed here: https://github.com/AtomicLoans/atomicloans-rfc/wiki/Bitcoin-Non-Custodial-Oracle