eXch - instant exchange BTC / LN / XMR / LTC / ETH / ERC20

[AuroraHF]

Is there some issue with the host? Unable to connect to the site right now.

[Bitcoin_Arena]

Thanks, Even if the site is open or close source, I also don't understand how to check the code.

You would need some knowledge in programming languages to be able to interpret the code, but open source code is usually available in platforms like Github or Gitlabs. Most services that are open source share the link to their source codes within their websites.

Is there some issue with the host? Unable to connect to the site right now.

It works for me. Maybe it was a temporary downtime

Alternatively, you can also use their Tor mirror if you find that the clearnet is not connecting: http://hszyoqwrcp7cxlxnqmovp6vjvmnwj33g4wviuxqzq47emieaxjaperyd.onion/

[dkbit98]

Is there some issue with the host? Unable to connect to the site right now.

Everything works fine on my end, but I would always suggest using onion link with Tor browser for better privacy, instead of clearnet.
Just make sure to use and bookmark eXch official onion link only.

[arabspaceship123]

I've used the service for small swapping to test it. It's convenient service I wouldn't hesitate swapping larger amount if I had it. You can downloaded a letter of guarantee. They've processed swaps fast with good rates. They won't ask for KYC so users don't have to worry about getting funds suspended.

[virasog]

I've used the service for small swapping to test it. It's convenient service I wouldn't hesitate swapping larger amount if I had it. You can downloaded a letter of guarantee. They've processed swaps fast with good rates. They won't ask for KYC so users don't have to worry about getting funds suspended.

I have also tested the service and really like their service. i have also bookmarked the site, in case i would be needing to swap the coins, i will prefer eXch.

However, there is one question in my mind after my recent bitcoin to XMR swap. I send the bitcoin to the eXch.cx address and it took a few blocks until my transaction was confirmed. (These days the mempool fees are quite high) and my order was executed.

In case, we send Bitcoin to them with less fee, how long the order will remain active and wait for the confirmations? Is there any limit to this or the order will remain active to receive confirmation of the transaction even if it takes few days?

[Bitcoin_Arena]

In case, we send Bitcoin to them with less fee, how long the order will remain active and wait for the confirmations? Is there any limit to this or the order will remain active to receive confirmation of the transaction even if it takes few days?

They don't talk about any time limit for the order, which means you could wait for as long as your transactions gets the required confirmations. I bet the reason for the refund address is also for such situations where, by the time the order is confirmed, the coin you need in exchange is not available in the reserve.

[Z-tight]

In case, we send Bitcoin to them with less fee, how long the order will remain active and wait for the confirmations? Is there any limit to this or the order will remain active to receive confirmation of the transaction even if it takes few days?

Don't send BTC with a purging or low priority fee rate because it'll surely get stuck except the mempool drops. It is better if you pay a reasonable amount in fees so the transaction wouldn't stay unconfirmed for days, and it is easy to do by just checking the mempool before making your tx. Nevertheless i have gone through this thread and i don't think i've seen any time limit for orders, but only 1 confirmation is required to start the exchange, so you either pay an appropriate fee or bump the tx if it is stuck for too long.

[dragonvslinux]

What's the deal with exchanging to XMR? I see that currently there is 0 reserves so I assume this isn't possible at present if there are no third party liquidity providers?

I created an order to see what would happen and I get the following:

Code:

min: 0.00000055 max: 0.00000000

Obviously there's something not quite right with that calculation if the maximum I can send is 0, but the minimum is 0.00000055.

[virasog]

What's the deal with exchanging to XMR? I see that currently there is 0 reserves so I assume this isn't possible at present if there are no third party liquidity providers?

I created an order to see what would happen and I get the following:

Code:

min: 0.00000055 max: 0.00000000

Obviously there's something not quite right with that calculation if the maximum I can send is 0, but the minimum is 0.00000055.

They have some limited reserves for a few crypto and XMR wallets just seem to fill up slowly. As you can see below the screenshot, the current XMR reserves are zero, however  the last 24 hour volume for XMR was only 310. Also i can see only 1.4 LTC in reserve at the moment. If many people will use this exchange, I think the wallets will get emptied a lot quicker.

You need to be online and refresh the site to see if the XMR wallet loads up and you can make an exchange.

[Z-tight]

What's the deal with exchanging to XMR? I see that currently there is 0 reserves so I assume this isn't possible at present if there are no third party liquidity providers?

Yes if the reserve is empty you cannot receive XMR from eXch, you can only swap XMR for another coin, you're correct that there are no third party liquidity providers and eXch do not also refill the balance in the reserves themselves, the reserves only gets refilled when customers send those coins to them for swapping.

If many people will use this exchange, I think the wallets will get emptied a lot quicker.

And it will also get refilled quicker because they are swapping one coin for another, and the coin they are swapping adds to the reserves.

[arabspaceship123]

That's a good question I didn't have to wait long so can't say. If it's fixed or dynamic fees they've got to have time limits. It doesn't make sense for swaps staying open forever. We don't know so OP should answer it.

I've used the service for small swapping to test it. It's convenient service I wouldn't hesitate swapping larger amount if I had it. You can downloaded a letter of guarantee. They've processed swaps fast with good rates. They won't ask for KYC so users don't have to worry about getting funds suspended.

I have also tested the service and really like their service. i have also bookmarked the site, in case i would be needing to swap the coins, i will prefer eXch.

However, there is one question in my mind after my recent bitcoin to XMR swap. I send the bitcoin to the eXch.cx address and it took a few blocks until my transaction was confirmed. (These days the mempool fees are quite high) and my order was executed.

In case, we send Bitcoin to them with less fee, how long the order will remain active and wait for the confirmations? Is there any limit to this or the order will remain active to receive confirmation of the transaction even if it takes few days?

[blue Snow]

So when I have set to exchange to 0.01 BTC to ETH, is there I have to send the amount of 0.01 BTC exactly?
What happens if I send it less or more for example I send 0.009 or 0.012? Will it be received according to what we sent?.

On the order set, I read that if I send 0.01 BTC I will receive 0.160154138151151 ETH (Network fee included). I think this exchange offered a very low fee and simpler transaction than the conventional exchange I tried. I think this is a big breakthrough in the future if they continue to maintain their service.

[LoyceV]

So when I have set to exchange to 0.01 BTC to ETH, is there I have to send the amount of 0.01 BTC exactly?
What happens if I send it less or more for example I send 0.009 or 0.012? Will it be received according to what we sent?

This works the way you'd expect it to work The Letter of Guarantee doesn't mention anything about an amount, and the transaction page shows this:

If the amount sent is different than 0.01 BTC, the exchange amount will be recalculated automatically

[Charles-Tim]

Icopress invited me to review eXch if I have time to review it. It's been a week now and I think I should.

This is my review

I wanted to use exch service in the afternoon but the site was not working excellently. I wanted to exchange some coins, I inputted the amount and clicked on exchange. There was nothing but my browser keep on showing the process but no result. I tried again 30 minutes later and it was working perfectly, but I waited until nighttime because I was later busy in the afternoon. I tried it in the night, it was working perfectly. I have clicked on the exchange before many times and it was working perfectly. So that after was a coincidence.

Finally in the night, I exchange some coins and it worked excellently. Immediately I noticed that the coin has been confirmed onchain, it indicated on the exchange that the amount I sent to the address they displayed to pay to as been received. I used Dynamic rate which might be the reason for a little delay in the transaction. I think using flat rate would make the exchange faster. Immediately the exchange indicated that it has processed the transaction, I open my wallet and saw the coin.

As you are about to make payment, you can download a letter of guarantee that contain proof of the exchange order which contain the time you created the transaction to send coin to the address provided on the exchange, it also has the refund address. In general, it is a bitcoin signed message that consists of the information I mentioned.

After the exchange has received the coins that you sent, you can also download letter of guarantee which consist of proof of order and contain other information like the site (exch) which I used for the coin that I exchanged into another coin. It also contain the date of the order, the time, refund address, the amount they have received, the amount sent and their txids and the exchange rate used for the calculation. All these mentioned are also in a message which was signed with a legacy address private key (just the address shown, no private key shown, the address is also not funded). So it includes a bitcoin signature.

The address used to sign the message is a legacy address that ends with exch. I wonder the amount of computational power that would have been used to generate that uncompressed address.


Suggestions

What I will suggest is that the site should look more attracting, although it is very simple to use.

More coins should be supported. For now, it is supporting bitcoin, ether, litecoin, dash and three ERC20 tokens which are USDT, USDC and DAI.

Another suggestion is that if someone input the amount of coin he wants to exchange, the exchange should automatically display the person the amount of coins that the person will receive. I mean if the person input the amount of bitcoin he wants to send to receive moner as an example, the exchange should deduct the fee and automatically display the amount of monero the person will receive. Also the person can instead, input the amount of monero he wants to receive and the exchange will display the amount of bitcoin to send.





Although, it is not automated, but it can be manually done. After you input the amount of bitcoin that you want to send, or the amount of monero that you want to receive and you click on calculate, the amount you will receive will be displayed:





About refunded address

I intentionally did not include refunded address which I know it is for the purpose of error and inability to process an exchange successfully, the coin would be sent back to the owner. On the bitcoin signed message, the address I used to send the coin is the refund address. But I think because of privacy reason, users are allowed to provide a refund address which can be different from the address they use to send the coin. If no address is provided, the address you used to send the coin is the refund address. I think this is nice.


Supported bitcoin addresses
I tried other address type like multisig and pay-to-taproot addresses and all were accepted.


Do not try this, use the correct address
I edited the address to input different characters to make each addresses have exactly the same number of characters of their address types. Secondly, I later added more characters. Third, I removed some characters. The three brought up the same error:



I think that is good, but people should not send to a wrong address. Wrong but valid bitcoin addresses would be successful and your money will be lost forever.

[JeromeTash]

Hey @eXch.cc, according to what's said on your website. Your service is Cloudflare free. Definitely one of your biggest selling points for someone who is in search of some level of privacy when exchanging their coins.

But then you use Cloudflare DNS according to whois. Now I am not too informed about how websites work, maybe I may learn a thing or two here. Can't a Domain Name Server be used by Cloudflare to gain access to your website's traffic there by compromising client's privacy?

[virasog]

So when I have set to exchange to 0.01 BTC to ETH, is there I have to send the amount of 0.01 BTC exactly?
What happens if I send it less or more for example I send 0.009 or 0.012? Will it be received according to what we sent?.

On the order set, I read that if I send 0.01 BTC I will receive 0.160154138151151 ETH (Network fee included). I think this exchange offered a very low fee and simpler transaction than the conventional exchange I tried. I think this is a big breakthrough in the future if they continue to maintain their service.

Well here is how i do it. I do enter the amount to calculate how many coins i will get, so i can get an idea of the exchange rate that i will get.

Now, before doing the actual exchange, I will clear all fields, and write only in the "To address" my address, keep the amount filed blank and click "Exchange". On the order process window, it will ask me to send any amount of the cryptocurrency to the given address.

[eXch]

Hey @eXch.cc, according to what's said on your website. Your service is Cloudflare free. Definitely one of your biggest selling points for someone who is in search of some level of privacy when exchanging their coins.

But then you use Cloudflare DNS according to whois. Now I am not too informed about how websites work, maybe I may learn a thing or two here. Can't a Domain Name Server be used by Cloudflare to gain access to your website's traffic there by compromising client's privacy?

"Cloudflare free" usually means that a website doesn't use Cloudflare's reverse-proxy service to prevent exposure of their users to MITM and UX issues, however this is not related to Cloudflare's NS service used by our domain name.

The main role of nameservers (NS) is to serve DNS records, which in our case is the "A" record that points users to the IP address of our web-server when they lookup our domain name. We use Cloudflare's nameservers because they are reliable and fast due to their company's considerable infrastructure available across the globe. They also provide a Tor-friendly API which we use to manage our DNS records.

The only possible attack vector in this case is DNS record hijacking. It means that Cloudflare will have to change our domain's "A" record from our IP address to another one with a working reverse-proxy in order to intercept all the network traffic of our users (MITM). This attack is very unlikely to happen because there is no point to do this in our case, since anyone on the Internet will be able to detect a such event and also because we will receive an alert from our security monitoring system about a DNS record change and will simply switch our NS to somewhere else. It is also worth to mention that a fingerprint of the website's TLS certificate will change during a such attack, since there is no way they can retrieve the private key of our TLS certificate to use it on their MITM reverse-proxy. There is a browser extension called CheckMyHTTPS (https://github.com/checkmyhttps/checkmyhttps) that is useful to detect HTTPS fingerprint changes, however not as reliable as the older Certificate Patrol (https://github.com/tg-x/certpatrol) which was storing each website's certificate fingerprints locally to detect and alert about fingerprint changes later.

Such attacks are very rare to happen, but when they happen, they're usually some LE operations with enough gathered intelligence to know what to intercept that mostly go for website's operators (i.e. admin credentials) and not their users. Our management interface is not available via clearnet at all nor located at our public Tor HS either, therefore a DNS hijacking attack on our domain name would not bring anything useful to LE.

The most famous LE operations with this technique involved that come up to my mind were mostly targeting botnets, where they intercepted operators credentials that usually represent superior value for investigations in order to obtain ultimate evidence. Nevertheless, this technique is not popular anymore compared to cooperating directly with datacenter operators and upstream network providers. I recommend searching through KrebsOnSecurity blog for the "takedown" keyword to find relevant articles and to learn more about LE methodologies and strategies.

[blue Snow]

Now, before doing the actual exchange, I will clear all fields, and write only in the "To address" my address, keep the amount filed blank and click "Exchange". On the order process window, it will ask me to send any amount of the cryptocurrency to the given address.

Thanks, I just know that method, but there have limit maximum which can be sent like the picture below.



I am not sure if the problem is litecoin, where maybe the exchange only have a few on the storage.

[Inwestour]

The exchanger is very easy to use, which is good, low fees, fast exchange. A letter of guarantee is also a positive point, which can eliminate all controversial issues.

Among the shortcomings, I would probably note the small number of supported networks. It would not be superfluous to have TRC20, it seems to me that USDT TRC20 is used by a much larger number of users than ERC20, for those who make frequent exchanges will pay attention to fees.

[Bitcoin_Arena]

Among the shortcomings, I would probably note the small number of supported networks. It would not be superfluous to have TRC20, it seems to me that USDT TRC20 is used by a much larger number of users than ERC20, for those who make frequent exchanges will pay attention to fees.

Here is the answer you are looking for, from the representative

We don't exchange some popular crypto assets because they represent considerable risks to us. We don't plan to support the Tron network for now, however we may reconsider it the future.

Users who want to buy risky/popular assets usually buy ETH from us then swap to whatever they like on liquidity pools (i.e. Uniswap).