The Bitcoin DEX

[RobinLinus]

Today we are releasing an alpha version of Bitcoin DEX - a decentralised bitcoin exchange based on non-interactive atomic swaps. It allows you to swap bitcoins for stablecoins with a single bitcoin transaction, and without having to know your counterparty upfront. You can find the FAQ here. Here are some screenshots.
Your feedback is very welcome!

PS: you can use this faucet to receive some testnet Bitcoins to buy testnet Dollars on the DEX. Or you can receive testnet dollars by posting your address in this thread. Or you can receive testnet dollars in our Telegram group.


Edit: Here's a writeup of the protocol.

[1696453754]

1696453754

[1696453754]

1696453754

[1696453754]

1696453754

[1696453754]

1696453754

[BlackHatCoiner]

It asks me for my email address. I know that it's a web wallet and how web wallets supposedly work, but why should there be a requirement to create a new wallet? I mean, just why if it's not sent to a server?

Your email address will stay on your computer. No data will be sent to any server. We cannot send you any emails.

PS: you can use this faucet to receive some testnet Bitcoins to buy testnet Dollars on the DEX.

Or for greater amounts, use my faucet.

[bitmover]

It asks me for my email address. I know that it's a web wallet and how web wallets supposedly work, but why should there be a requirement to create a new wallet? I mean, just why if it's not sent to a server?

Your email address will stay on your computer. No data will be sent to any server. We cannot send you any emails.

I agree with this. The idea to create an account and use an e-mail address is somewhat contradictory to a the philosophy behind a DEX.

I suggest that we should be able to just use a computer generated number instead of our email address.

I was reading the FAQ:

USDx is a stablecoin on the bitcoin blockchain. It wraps Tether coins (USDt) which are locked in the Ethereum blockchain.

Isnt' ethereum blockchain too much expensive? I mean, to transfer an ERC-20 token it costs around 20-50 USD right now. (https://etherscan.io/gastracker)

Shouldn't you be using a cheaper blockchain? It could even be bitcoin blockchain, I think there are still some USDT there?

[RobinLinus]

It asks me for my email address.

You're right, it looks like we are communicating badly here. Your email is used only locally on your machine as salt for generating keys with a WarpWallet. It is basically just a random string that is unique per user which guarantees attackers using bruteforce have to target each user separately. We use the email address because it is a salt that is easy to remember and makes the login feel familiar to regular web services.

Of course, you can use the DEX with any random email address if you want.

[RobinLinus]

@BlackHatCoiner and @bitmover,  I updated the signup page to be more clear about the email being used as salt.

Do you think this is better, or do you consider warpwallet with email+pw a bad idea in general?

I personally like the idea because users are very familiar with such logins.

[BlackHatCoiner]

Do you think this is better, or do you consider warpwallet with email+pw a bad idea in general?

Email and password remind login credentials. Just leave a password text field which makes it look like a brain wallet. The safest option is none of those, though; it's to return you a seed phrase instead.

Also, how can I verify these aren't sent to a server? Is the wallet open-source?

[RobinLinus]

Just leave a password text field which makes it look like a brain wallet.

Using some email as salt is important for security...

Also, how can I verify these aren't sent to a server?

You can monitor all requests in the network tab of the developer tools in your browser.

Is the wallet open-source?

Yes, you can find the source code on Github. You can run it locally simply by downloading the client and clicking on the index.html.

[dkbit98]

I played around the rules and entered some random characters during registration process, so I managed to test register even with fake email containing only @ character with two letters, one before and one after.
This is probably not great for security, but since this is acting as a salt you can just type longer random passphrase containing one @ character, it doesn't have to be email at all.

I don't like that you are using some new stablecoin connected with USDT token on ethereum blockchain, and I don't understand how this exactly work.
Can you please explain to me how this exchange can be called decentralized when it's available on only as web version and it's operated by centralized server?
If someone attacks or shuts down the server, what happens with exchange?
There is already decentralized exchange for Bitcoin called Bisq, but you need to download and sync software on your computer.

I will do more testing of this exchange in next few days, and post my feedback.

[bitmover]

I played around the rules and entered some random characters during registration process, so I managed to test register even with fake email containing only @ character with two letters, one before and one after.
This is probably not great for security, but since this is acting as a salt you can just type longer random passphrase containing one @ character, it doesn't have to be email at all.

@BlackHatCoiner and @bitmover,  I updated the signup page to be more clear about the email being used as salt.

Do you think this is better, or do you consider warpwallet with email+pw a bad idea in general?

I personally like the idea because users are very familiar with such logins.

I suggest that you change the label "email" to "username"

I would also add a button "generate random username".

Bitcoin users who as looking for a dex are certainly worried about Privacy.

I don't like that you are using some new stablecoin connected with USDT token on ethereum blockchain, and I don't understand how this exactly work.

I looked at USDT rich list and there are still some usdt in omni (bitcoin blockchain)
Isn't it better yo use it?

https://wallet.tether.to/richlist

[RobinLinus]

Here is a more technical writeup of this project. Maybe it would have been better to start the thread with this summary instead of dumping the prototype on you without much background info  

[dkbit98]

I suggest that you change the label "email" to "username"

He could use that option, but than he would need to add information that @ symbol is required for the username.
Something similar is used in some log in services when they ask you to make password more complicated with addition of special characters #$%& or brackets, in addition to letters and numbers.
In addition I would add information to create more complex ''email salt'' because if you use something like I did x@x it can be cracked much easier, intheory.

I would also add a button "generate random username".

I wouldn't do that.
After doing some research I found out that random is not always random, especially if generated online on websites.

I looked at USDT rich list and there are still some usdt in omni (bitcoin blockchain)
Isn't it better yo use it?

I don't know if there are testnet coins available for that, and I think that RobinLinus is not using USDT directly.

Here is a more technical writeup of this project. Maybe it would have been better to start the thread with this summary instead of dumping the prototype on you without much background info  

Thanks, I will check it out.
I am sure people are interested in using alternative dex exchanges, but you need to have rock solid proposal to attract more attention.

[buwaytress]

Let me know if you're ready for someone to try do it for real (not with testnet). I miss the days of using Counterparty, despite its super clunkiness I also remember the time when atomic swaps on Bitcoin were going to be the gamechanger. Haha. Speaking of, I wonder if it even is still alive.

Me = a very average user, but very happy to try stuff like this with a holding hand. I am increasingly getting requests for a fair amount of stablecoin payments I prefer to swap to Bitcoin without going through an exchange though (the problem is they're all on BSC).

I do believe there is demand for a Bitcoin DEX. I have no evidence of this, but if I am the average Joe yardstick...

[RobinLinus]

Thanks a lot for your feedback because it was motivating.

Let me know if you're ready for someone to try do it for real (not with testnet).

There is already a "reckless" mainnet version and there is already a $5 offer which you can buy. It's even discounted as it wasn't changed since bitcoin was at $42000. You are very welcome to execute the first real world order on our DEX! :-)

Me = a very average user, but very happy to try stuff like this with a holding hand. I am increasingly getting requests for a fair amount of stablecoin payments I prefer to swap to Bitcoin without going through an exchange though (the problem is they're all on BSC).

This inspired me to work out the details of the 2-way peg protocol. Next step is to implement the peg-out in Solidity. Then you can trade every asset on every EVM-like platform trustlessly against BTC. This includes all assets on Binance Smart Chain, too.

[RobinLinus]

I don't like that you are using some new stablecoin connected with USDT token on ethereum blockchain, and I don't understand how this exactly work.

Here's a detailed writeup of the trustless 2-way peg. For now, it is just a trusted peg containing $480 USDt inital "playmoney", or "bug bounty" if you want. We want to replace it ASAP with the trustless peg.

Can you please explain to me how this exchange can be called decentralized when it's available on only as web version and it's operated by centralized server?

You can download and run the client just by clicking on the html file. The server is not required to swap tokens. In theory, I could paste an order here into this thread and then anyone could take it. The purpose of the servers is only to bundle liquidity.

[dkbit98]

Here's a detailed writeup of the trustless 2-way peg. For now, it is just a trusted peg containing $480 USDt inital "playmoney", or "bug bounty" if you want. We want to replace it ASAP with the trustless peg.

Instead of using ethereum peg maybe you should consider using some Bitcoin Sidechains that are also using stable coins.
I am not a fan of Blockstream Liquid but they have usdt tether, and there are few more options you can find on Jameson Lopp website:
https://www.lopp.net/bitcoin-information/other-layers.html

You can download and run the client just by clicking on the html file. The server is not required to swap tokens. In theory, I could paste an order here into this thread and then anyone could take it. The purpose of the servers is only to bundle liquidity.

So you are saying there is no middle man when using your Bitcoin dex for atomic swaps?
How is that possible if both parties don't have any software downloaded, and they can't prove any swap transaction ever happened?

[RobinLinus]

Instead of using ethereum peg maybe you should consider using some Bitcoin Sidechains that are also using stable coins.

We're developing the contract in Solidity. That makes it compatible with Ethereum, BSC, but also RSK.

So you are saying there is no middle man when using your Bitcoin dex for atomic swaps?

You are right. No third party is required to execute a swap. The client is only doing the client-side validation of the token protocol for you and compiles your token transactions. In theory, you could do that in e.g. Electrum, too. If you're curious about the details, here's a writeup on swaps.

[crypto-project]

I see a potential project here. Because to be honest as a crypto user, it is quite complicated to be able to exchange BTC to stablecoins on a centralized exchange.

But the concern is why should we make to get access to the DEX? if we can use random email, what does the email feature do? isn't it better to use a random ID with a password?

And is the developer of this project providing liquidity or is there a third party providing liquidity for this exchange?

[RobinLinus]

if we can use random email, what does the email feature do? isn't it better to use a random ID with a password?

The point of using your email is that basically everyone has one and it is easy for them to remember. Of course, you can use a random ID, but that's hard to remember.

[dkbit98]

The point of using your email is that basically everyone has one and it is easy for them to remember. Of course, you can use a random ID, but that's hard to remember.

It's even more easy to remember my real name or date of birth but I don't use them as login options anywhere.
I don't want my email address to be associated with anything I don't want, especially with bitcoin or bitcoin exchanges... because you never really knows who really is saving and reading all that data.
No need for remembering all different random ID's when you are using password managers like keepass.

[theskillzdatklls]

Cool project. As it progresses, I would definitely like to LP some pairs if it works efficiently. Will watch.