papers/lux-teleport-protocol/sections/05-atomic-transfer-protocol.tex

\section{Atomic Transfer Protocol}
\label{sec:atomic}

\subsection{Two-Phase Commit}

To ensure atomicity---either both lock and mint succeed, or neither does---we use a two-phase commit with timeout:

\begin{algorithm}[H]
\caption{Atomic Interchain Transfer}
\label{alg:atomic}
\begin{algorithmic}[1]
\Require User transfers $n$ tokens from chain $A$ to chain $B$
\State \textbf{Phase 1: Commit}
\State User locks $n$ tokens on chain $A$ with timeout $T$
\State Lock emits commitment $C = H(\mathsf{secret})$ (hash time-lock)
\State Relayer proves lock on chain $B$
\State Chain $B$ mints $n$ wrapped tokens, locked with same $C$
\State \textbf{Phase 2: Reveal}
\State User reveals $\mathsf{secret}$ on chain $B$ to claim wrapped tokens
\State $\mathsf{secret}$ is relayed to chain $A$
\State Chain $A$ finalizes the lock (tokens permanently locked)
\State \textbf{Timeout:}
\If{$\mathsf{secret}$ not revealed within $T$}
    \State Chain $A$ returns locked tokens to user
    \State Chain $B$ burns minted tokens (if any)
\EndIf
\end{algorithmic}
\end{algorithm}

\subsection{Atomicity Proof}

\begin{theorem}[Transfer Atomicity]
Under standard asynchronous network assumptions (messages delivered within bounded delay $\Delta$), the atomic transfer protocol satisfies:
\begin{enumerate}
    \item \textbf{Safety}: At no point does the total supply of a token exceed its initial supply.
    \item \textbf{Liveness}: If both chains are live and the user is honest, the transfer completes within $2\Delta + T$ time.
    \item \textbf{Atomicity}: Either both lock and mint succeed, or the user recovers their tokens.
\end{enumerate}
\end{theorem}

\begin{proof}
\textbf{Safety}: Tokens are minted on chain $B$ only after verifying a lock proof from chain $A$. The lock proof is unique (nonce-based), so double-minting is impossible. \textbf{Liveness}: The user locks tokens (round 1), the relayer proves the lock (round 2, delay $\leq \Delta$), and the user claims (round 3, delay $\leq \Delta$). Total: $2\Delta + \text{confirmation time}$. \textbf{Atomicity}: If the user does not reveal the secret within $T$, the HTLC expires and tokens are returned on both chains. If the user reveals, both sides complete.
\end{proof}

\subsection{Timeout Selection}

\begin{proposition}[Optimal Timeout]
The timeout $T$ should satisfy:
\begin{equation}
    T > 2 \cdot \Delta_{\text{finality}}^A + \Delta_{\text{finality}}^B + 3 \cdot \Delta_{\text{relay}}
\end{equation}
For Lux-to-Ethereum: $T > 2(3\text{s}) + 15\text{min} + 3(30\text{s}) = 16.6$ min. We set $T = 30$ min.
For Lux-to-Lux: $T > 2(3\text{s}) + 3\text{s} + 3(5\text{s}) = 24$ s. We set $T = 5$ min.
\end{proposition}