How Input Output's cyclic atomic swap protocol enables trustless cross-chain exchanges – no bridges, no custodians, no compromise
Summary
- Locked liquidity: Bitcoin holds approximately $1 trillion in market capitalization, yet its limited scripting keeps that liquidity locked away from DeFi users
- New protocol: CANS (Cyclic Atomic N-party Swap) lets multiple parties swap assets across different blockchains at once – with a mathematical guarantee that either everyone gets what they agreed to, or nobody loses anything
- Decentralized: the CANS protocol does not require bridges, wrapped tokens, or trusted intermediaries – the cryptography enforces the rules
- Adaptable: the pattern is not limited to Bitcoin and Cardano: any blockchain with native Schnorr signature support, or a smart contract layer capable of verifying Schnorr signatures, can participate in a CANS swap session
- Proven: a reference implementation in Rust, formally verified and tested with up to 20 concurrent parties, proves this is achievable in practice today
Bitcoin's liquidity problem
Bitcoin is the most valuable asset in cryptocurrency – but it isn’t liquid. Its deliberately simple scripting language was never designed to support lending, trading, or the kind of complex financial interactions that have flourished on programmable blockchains like Cardano. Meanwhile, Cardano has a mature DeFi ecosystem: decentralized exchanges, lending protocols, liquid staking, oracles – with a fraction of Bitcoin's potential liquidity.
Connecting these two worlds sounds straightforward. In practice, most solutions involve a compromise: a bridge that holds the Bitcoin assets while issuing a stand-in token, a custodian you have to trust, or a centralized exchange that introduces the very counterparty risk that blockchain was supposed to remove. These are not decentralized solutions – they are centralized solutions wearing a decentralized mask.
What is CANS?
The Cyclic Atomic N-party Swap protocol (CANS) is developed by Input Output under the Intersect IOR proposal. This is part of the work package WP4.1 Bridges, Atomic Swaps, & Agent Chains. This protocol takes a different approach by arranging participants in a ring: each person agrees to send assets to the next person in the chain, with the last person completing the loop back to the first. Each participant sends exactly once and receives exactly once. Crucially, the entire swap is atomic: either everyone gets what they agreed to, or nobody loses anything. There is no partial outcome, and there is no intermediary holding funds in the middle.
Think of it like a coordinated round of gift exchanges, where everyone simultaneously hands over their gift – except the coordination is handled by mathematics, not trust. No one hands over their gift until they are certain everyone else will too.
The protocol supports any combination of assets and blockchains within a single swap session. Two parties can exchange BTC for ADA. Ten parties can swap across multiple chains at once. The ring structure scales naturally.
How does the CANS protocol work?
The core innovation of the CANS protocol is that digital signatures can be made conditionally valid – locked behind a secret that only becomes visible once someone commits to the swap. CANS uses this property to choreograph the exchange. Before any funds move, every participant contributes a piece of a shared cryptographic puzzle. Once the designated leader confirms that everyone has locked their funds, they reveal the final piece. That single act unlocks the entire ring: every participant can now claim their incoming funds, on whatever blockchain those funds sit.
The beauty of this approach, compared to earlier techniques like hash time-locked contracts, is that nothing sensitive appears on-chain. Spend transactions look like ordinary transfers. There is no shared hash linking the legs of the swap together, which is good for privacy and for scalability beyond two parties.
One primary hurdle is that Bitcoin and Cardano use different cryptographic systems under the hood. Bitcoin uses the secp256k1 elliptic curve with Schnorr signatures (via Taproot), while Cardano natively relies on Ed25519. The reference implementation elegantly solves this by deploying a Cardano smart contract (a Plutus validator) capable of verifying Bitcoin's Schnorr signatures. This allows a single cryptographic event on the Bitcoin network to instantly trigger and unlock UTXOs on Cardano.
What if someone backs out?
Every participant holds a fully signed refund transaction before a single lock transaction is broadcast. No one locks their funds unless their exit is already guaranteed. Refund transactions are time-locked – only valid after a certain block height – and the windows are staggered deliberately: each party's window opens after the person claiming their funds has had a chance to act. This ordering ensures that if the leader stops cooperating mid-swap, every honest participant can recover their funds safely, without racing against each other.
The implementation
The reference implementation demonstrates that trustless, multi-party, cross-chain atomic swaps are practically achievable. The prototype is written in Rust and runs as a daemon that manages the full protocol lifecycle – key exchange, transaction construction, broadcast, and settlement – for a single participant in a swap session. Daemons communicate directly over TCP; there is no central server.
Regression tests validate correct behaviour with up to 20 concurrent parties, each running an independent daemon against Bitcoin and Cardano nodes on a private test network. The protocol's safety and liveness properties have been formally verified, giving mathematical confidence that honest participants cannot lose funds.
The pattern is not limited to Bitcoin and Cardano: any blockchain with native Schnorr signature support, or a smart contract layer capable of verifying Schnorr signatures, can participate in a CANS swap session.
Why does CANS matter?
The trade finance gap perfectly illustrates why CANS matters. Each year, $1.7 trillion in trade remains static – not for lack of capital, but for lack of trust infrastructure. Banks turn away small and mid-sized deals as they are too small, too costly, and too risky to service, leaving SMEs with poor options: ship and hope for payment, demand full prepayment until the deal collapses, trade only with known partners, or accept steep premiums from intermediaries. The result isn't expensive trade; it's absent trade.
By applying CANS technology, we can service the trade finance gap and unlock trillions in new trade activity. Every prior attempt – TradeLens, we.trade, Contour, Marco Polo – was a proprietary walled garden, and each failed because you can't force a whole competing industry to join one company's platform. CANS instead is an open, chain-agnostic protocol.
Concretely, in a cross-border trade, CANS lets a buyer, seller, shipper, insurer, and financier settle in a single atomic transaction across whatever chains each prefers. Cryptography – N-of-N multi-signature locks, adaptor signatures, and staggered time-locked refunds – gives the same guarantee a letter of credit does: either every leg executes, or none executes, and no principal is ever lost. That removes counterparty risk without a bank's credit assessment, compressing settlement from weeks to minutes and removing bank margins and subscription fees.
The CANS protocol turns deals that simply couldn't happen into deals that settle safely in minutes, by replacing the missing trust infrastructure with cryptographic guarantees instead of yet another platform nobody wants to join.
The reference implementation is being developed on GitHub. We welcome contributions, integrations, and feedback from the community by raising pull requests or issues, or adding comments.
Timelines and product features are not final and are not guaranteed; all future developments are subject to change. IO does not review, approve, monitor, endorse or make representations with respect to third-party protocols or offerings.
