The name Papa Swap comes from Papa Class, a group of Cold War submarines that included the world’s fastest declassified submarine – the Soviet K-222. As those are the fastest submarines, these are the fastest submarine swaps.

It sounds like you like it! Consider writing your own version with this improvement implemented. And help me convince @Boltz - Non-Custodial Bitcoin Bridge to implement this, or maybe write a real version and compete with them

i think from a privacy pov it's definitely a good idea not to reveal on-chain that it's an HTLC and what was the hash lock/preimage on the happy path. i'm not sure about how UX is improved otherwise.

started writing something up, will see if this helps me get back in the saddle. i should probably check out how submarine swaps work first before i go into more details, lol!

Gist

SHOT - Schnorr HTLC Obfuscation Technique

SHOT - Schnorr HTLC Obfuscation Technique. GitHub Gist: instantly share code, notes, and snippets.

The problem I see with this design is that the server has to do L1 transaction + commit to locking funds up for possible time period without assurance from user that they will pay lightning invoice. I may be misunderstanding. These problems could be mitigated with a fee that has to be played before the L1 transaction but I would like to hear your ideas for mitigation @Super Testnet Thanks! Very interesting idea!

Excited to hear more about Papa Swap at @btcplusplus in Istanbul! View quoted note →

Not revealing anything about the swap on-chain is already pretty much the standard nowadays:

Introducing Taproot Swaps: Putting the "Fun" Back into Refunds! 🥕🔁

Today we are stoked to announce Taproot Swaps, a long anticipated upgrade that enables more private swaps with a smaller chain footprint and finall...

is it interactive or non-interactive spend on the happy path?

based on this, interactive (proper MuSig2) @Kilian

correct

it's not a huge win, but you can make it non-interactive by making the private key share for the internal key the secret for the LN invoice. probably makes more sense for LN to on-chain swaps. in theory this makes the user able to unilaterally pay straight up from the HTLC and swipe the change. decreases server load and might improve UX. idk.

Yup, this is a general unsolved problem with submarine swaps: the party with the timelock path can be grieved by abandoning the swap after the name the L1 deposit. They lose atwo mining fees and make no money. I think a fidelity bond paid via LN can help here. If you compete the swap, you trust the server to give you the bond money back. If you abandon the swap, the server keeps the bond money to reimburse their two mining fees.

If you think about it, all submarine swaps are LN to on chain. Even when one party is going from on chain to LN, the other party is going from LN to on chain.