Free Option Problem

What Is the Free Option Problem?

The free option problem is a fundamental vulnerability in HTLC-based atomic swaps where one party gains an unearned American-style call option on the other party's asset. When two parties lock funds sequentially to perform a cross-chain swap, the party who knows the hash preimage (the initiator) can wait and observe price movements before deciding whether to complete the trade. If the price moved favorably, the initiator claims the counterparty's funds. If the price moved unfavorably, the initiator simply lets the timelocks expire and both parties refund. The counterparty bears all the cost: their funds remain locked for the entire duration with zero compensation.

The problem was formally identified and modeled in "On the optionality and fairness of Atomic Swaps" by Han, Lin, and Yu, presented at ACM AFT 2019. Their analysis demonstrated that every standard HTLC-based atomic swap inherently creates an options contract, whether the participants realize it or not. This insight transformed how protocol designers think about cross-chain exchange mechanisms.

How It Works

To understand the free option problem, consider a typical atomic swap between Alice and Bob. Alice wants to trade Bitcoin for another asset that Bob holds.

1. Alice generates a secret preimage s and computes its hash H(s)
2. Alice locks her Bitcoin in an on-chain HTLC with hash H(s) and timelock T1
3. Bob sees Alice's locked funds and locks his asset in a corresponding HTLC with the same hash H(s) and a shorter timelock T2 (where T2 is less than T1)
4. Alice now holds the option: she can reveal s to claim Bob's asset at any point before T2 expires

The critical asymmetry is in step 4. After both sides have locked funds, Alice faces no downside. She can monitor the exchange rate between the two assets for the entire duration of T2. If the rate moves in her favor, she reveals the secret and completes the swap. If it moves against her, she does nothing. Both HTLCs eventually expire, and both parties recover their original funds.

Bob, meanwhile, has his liquidity completely locked. He cannot trade, lend, or use those funds for anything else. He has effectively written a free call option to Alice: she gets all the upside with none of the downside.

Option Value and Timelock Duration

The value of Alice's free option scales directly with two factors: the duration of the timelock and the volatility of the underlying assets. Using the Cox-Ross-Rubinstein binomial option pricing model, Han et al. calculated that fair premiums for typical crypto-to-crypto atomic swaps range from 2 to 3 percent of asset value. This is roughly ten times the premium for comparable stock or fiat options, reflecting the higher volatility in cryptocurrency markets.

In practical terms: if Bob locks $10,000 worth of assets in a swap with a 24-hour timelock, Alice effectively receives a free option worth $200 to $300. If she lets the swap expire, Bob has lost that economic value in opportunity cost and exposure, even though his funds are eventually returned.

# Simplified option value relationship
# V = option value, σ = volatility, T = timelock duration, S = asset value

# For a standard BTC/altcoin swap:
#   σ ≈ 60-80% annualized volatility
#   T = 24 hours ≈ 0.0027 years
#   S = $10,000
#
# Fair premium ≈ S × σ × √T
# ≈ $10,000 × 0.70 × √0.0027
# ≈ $10,000 × 0.70 × 0.052
# ≈ $364
#
# Longer timelocks amplify the value linearly with √T

The Timing Asymmetry

The free option problem is inherently tied to the sequential nature of HTLC-based swaps. The timelocks must be staggered: T1 (Alice's lock) must be longer than T2 (Bob's lock) so that Alice has time to claim Bob's funds and Bob can still reclaim his funds if Alice disappears. This staggering is not a bug in protocol design: it is a necessary property for atomicity. Without it, Alice could claim Bob's asset while Bob's timelock has already expired, breaking the swap's safety guarantee.

The problem also compounds in multi-hop scenarios. Each additional hop in a routed payment requires additional timelock buffer, extending the total option window. A four-hop swap might need timelocks spanning days rather than hours, dramatically increasing the option value.

Impact on Lightning Network Routing

The free option problem is not limited to direct two-party swaps. It affects every multi-hop payment on the Lightning Network where intermediate routing nodes face similar timing asymmetries.

In a standard Lightning payment routed through multiple hops, each node adds a CLTV delta to the timelock. The sender's HTLC has the longest timelock, and the receiver's has the shortest. When a routing node receives the preimage from the next hop, it can delay forwarding it back to the previous hop. During this delay, the routing node holds a free option: if the routing fee economics or exchange rate changes, the node can choose the optimal time to settle.

This creates a form of griefing attack where nodes intentionally stall payments to lock other nodes' liquidity without cost. The channel jamming problem is closely related: an attacker can lock up a victim's channel capacity by creating payments that are never settled, effectively forcing the victim to write free options.

Mitigations

Several approaches have been proposed and implemented to reduce or eliminate the free option problem. Each involves tradeoffs between security, complexity, and practicality.

Premium Payments

The most direct mitigation is requiring the initiator to pay a non-refundable premium to the counterparty, compensating them for the option value. The ERC-2266 standard, authored by the same Monash University team that formalized the problem, implements this for Ethereum-based atomic swaps. The protocol uses a three-layer timelock structure: asset timelocks for each party plus a separate premium timelock.

With premiums, the initiator has skin in the game. Walking away from the swap still costs them the premium payment, which the counterparty keeps regardless of the outcome. The premium is calibrated to the option's fair value, making exploitation unprofitable.

Short Timelocks

Reducing the timelock duration shrinks the option window and thus its value. A swap with a 10-minute timelock offers far less optionality than one with a 24-hour timelock. However, shorter timelocks introduce reliability risks: on-chain transactions may not confirm in time, especially during periods of network congestion. If the counterparty cannot lock their funds before the initiator's timelock expires, the swap fails entirely.

Adaptor Signatures

Adaptor signatures (also called scriptless scripts) replace hash-locked contracts with cryptographic constructions based on elliptic curve points. Instead of revealing a hash preimage on-chain, parties exchange partial signatures that can be completed (adapted) to valid signatures using a shared secret.

While adaptor signatures do not directly eliminate the free option problem, they enable more flexible protocol designs that can incorporate premium mechanisms with less on-chain footprint. They also improve privacy by removing the hash correlation between the two sides of a swap. PTLCs (Point Time-Locked Contracts) bring this approach to Lightning, using Schnorr-based adaptor signatures enabled by Taproot.

Trusted or Semi-Trusted Intermediaries

Some protocols sidestep the free option problem by introducing a coordinating party that enforces simultaneous execution. Centralized exchanges do this implicitly: both sides of a trade execute atomically within the exchange's database. Federated systems like Fedimint offer a middle ground, using threshold cryptography to distribute trust across multiple guardians while maintaining atomic execution.

Use Cases Where It Matters

Cross-Chain Atomic Swaps

The free option problem is most acute in cross-chain atomic swaps where assets on different blockchains are exchanged without intermediaries. The timelocks must account for confirmation times on both chains, often resulting in multi-hour windows that create substantial option value. This is a key reason why trustless cross-chain DEXs have struggled to gain traction compared to centralized alternatives.

Submarine Swaps

Submarine swaps exchange on-chain Bitcoin for Lightning payments (or vice versa). The on-chain leg requires block confirmations, introducing timing delays that create free option exposure. Services like Loop and Boltz mitigate this through reputation, fees that implicitly price the option, and optimized timelock parameters.

Lightning Routing Payments

Every forwarded Lightning payment creates a small free option for each routing node. While individual payments involve minimal option value due to short timelocks and small amounts, the aggregate effect across thousands of routed payments can be significant. This is especially relevant for high-value payments where the per-hop option value becomes economically meaningful.

Risks and Considerations

Economic Losses for Market Makers

Market makers and liquidity providers in decentralized swap protocols face continuous free option exposure. Every pending swap effectively writes an option that the counterparty can exercise for free. Over time, this adverse selection erodes profitability: market makers consistently lose on trades where the price moved against them (counterparties complete the swap) and gain nothing on trades where the price moved in their favor (counterparties abandon the swap).

Reduced Liquidity Provision

The free option problem discourages liquidity provision in trustless swap protocols. Rational participants demand wider spreads or higher fees to compensate for the embedded option they are writing. This increases costs for all users and reduces the competitiveness of decentralized swap mechanisms compared to centralized alternatives that do not suffer from this problem.

Compounding in Volatile Markets

The free option becomes most damaging during periods of high volatility: exactly when swap demand tends to be highest. A market crash or rally dramatically increases the option value, incentivizing counterparties to exploit the asymmetry rather than complete trades honestly. This creates a negative feedback loop where the protocol becomes least reliable when users need it most.

Game-Theoretic Implications

Research by Xu (2020) and Tsabary, Yehuda, and Gaazi (2021) has shown that the free option problem creates a game-theoretic imbalance in HTLC-based protocols. In "Failure is (literally) an Option," the authors demonstrated that rational participants will always exploit the optionality when the potential gain exceeds transaction costs. This means that without explicit mitigation, HTLC-based swaps are fundamentally unfair in equilibrium: the initiator always captures value at the participant's expense.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.