Atomic swap · P2P OTC · Native Zcash ⇄ Ethereum
Swap shielded ZEC for ETH.
No bridge. No wrapped ZEC.
Zatomic is a native shielded ZEC ⇄ ETH atomic swap for two parties who have already agreed on a trade. A joint 2-of-2 FROST key controls the ZEC, while a RedPallas adaptor signature links its shielded claim to an Ethereum escrow, with no bridge, custodian or solver. Both parties verify their recovery paths before funding.
Try the live demo See the public testnet swap
Live demo: run a shielded swap, a crash recovery or a refund on private test chains, with real transactions and real proofs. About two minutes each.
- AtomicPre-authorized claim and refund paths are ready before either side commits funds.
- Stays shieldedPrincipal and recipients stay in Ironwood. Ethereum never sees a Zcash address or note.
- Recovers after a crashDurable journals resume the exit without a new signature from the peer.
Public testnets · 2026-10-18
It settled on real networks
0.001 test ZEC for 0.001 Sepolia ETH, settled end to end on public networks. On Zcash, the whole swap was two fully shielded transactions.
| Chain | Step | Transaction | What it shows |
|---|---|---|---|
| Sepolia | Escrow deployed | 0xac3b8d4f…a8d486f0 | Pinned code hash verified |
| Zcash testnet | Alice funds the shared note | 582f27b8ab…8400f7b5 | Shielded: no transparent input or output |
| Sepolia | Bob locks 0.001 ETH | 0x775787d1…ca3fa26b | Bound to the point T |
| Sepolia | Alice claims, revealing t | 0xf7ea23e3…724a0420 | Escrow checked t·G = T on Pallas |
| Zcash testnet | Bob claims 0.001 ZEC with t | 85aff28c00…98774422 | Shielded; Bob’s wallet decrypted it |
| Sepolia | Alice withdraws the ETH | 0x5a475c0f…b401aa23 | Finalized |
Verify it yourself: all six transactions are linked above. Both Zcash transactions stayed fully shielded (ZecBlock shows their amounts and addresses as encrypted), and no Zcash transaction ID was submitted to Ethereum. Full record ↗
Why Zatomic
What other routes give up for a private trade
Most cross-chain systems optimize for liquidity, routing or general interoperability. Zatomic is built for something else: direct settlement of an agreed trade between two counterparties, with native ZEC kept shielded. It needs no solver or shared liquidity pool, exposes no shielded payout through a public viewing key, and asks Ethereum to verify no Zcash history: one adaptor secret connects two native settlements.
SPV, light-client or ZK bridge
Strength: Ethereum verifies Zcash payments and events, which supports general cross-chain apps.
For a private tradeEthereum must verify Zcash history. Skyhook’s September testnet swap put the Zcash recipient and txid on Ethereum (post ↗); hiding them with ZK needs extra proving infrastructure.
NEAR Intents
Strength: competing solvers, many assets and automatic liquidity; live today.
For a private tradeSettlement runs through solvers and bridge contracts. The cited Zcash payout code uses a public outgoing viewing key, exposing a shielded payout’s recipient and amount (code ↗).
THORChain
Strength: native ZEC liquidity and market-priced swaps, with no wrapped ZEC.
For a private tradeIts ZEC integration uses transparent Zcash transactions, so addresses and amounts are public, and funds pass through shared vaults (THORChain ↗).
Zatomic · direct shielded settlement
One scalar. Two native chains. No cross‑chain state proof.
One adaptor secret connects a shielded RedPallas claim to an Ethereum escrow: the secret t that releases the ETH completes Bob’s Zcash signature. Neither chain verifies the other’s transactions.
- No third-party custodian or solverA 2-of-2 FROST key controls the ZEC; the escrow pays the ETH only to Alice with t, or back to Bob after the deadline.
- Shielded when it settlesBoth Zcash transactions stay shielded on a settled swap, and no Zcash transaction ID, address or note reaches Ethereum.
- Exits before fundingBob holds an adaptor pre-signature, Alice a fully signed, time-locked refund; each app resumes from its own records after a crash.
Proven on public testnets: on 2026-10-18 a swap settled between the Zcash testnet (Ironwood) and Sepolia, with both Zcash transactions fully shielded (transactions). The live demo runs settlement, crash recovery and refunds in your browser.
Trade-offs: built for trades two parties have already agreed, so no price discovery or matching; ZEC ⇄ ETH only; each side watches until its deadline.
A custodial bridge relies on whoever holds the ZEC; a transparent Zcash HTLC puts the same hash on both chains, linking them. Comparison details ↗
How it works
Five steps, one secret
What is new: Zatomic combines 2-of-2 FROST signing, a RedPallas adaptor signature and an Ethereum point escrow, so Zcash’s own shielded spend authorization becomes one side of an atomic swap. Neither chain verifies the other’s transactions.
- 01
Agree on the trade and prepare both exits Off chain
Alice signs a quote with exact ZEC and ETH amounts, and Bob accepts. A FROST DKG gives them a fresh 2-of-2 spend key, so neither can spend the shared ZEC alone. Alice picks a secret scalar t and shares only T = t·G on Pallas. Before any funds move, Bob verifies his adaptor pre-signature ŝ on claim C, Alice holds refund R fully signed and time-locked, and both sign the full terms.
- 02
Alice funds the shared shielded note Zcash · F
Transaction F moves Alice’s ZEC into the note the joint FROST key controls. It has no transparent input or output, and the note’s only two exits, Bob’s claim and Alice’s time-locked refund, were authorized before funding.
- 03
Bob locks ETH in the escrow Ethereum · lock
After checking F, Bob locks the agreed ETH in PointEscrow for Alice’s fixed address and the point T, until the ETH deadline. The escrow receives no Zcash transaction ID, address or note.
- 04
Alice claims the ETH and reveals t Ethereum · claim
Alice calls
claim(t). The escrow checks t·G = T and credits the ETH to Alice, who withdraws it in a separate transaction. The claim makes t public, and t is exactly what Bob’s signature is missing. - 05
Bob completes his shielded claim Zcash · C
Bob reads t from Ethereum and computes s = ŝ + t, a valid RedPallas spend signature. He broadcasts claim C and receives the ZEC, shielded, with nothing more needed from Alice.
Result: two native settlements, linked by one scalar. On Zcash the whole swap is F and C, both fully shielded.
If Alice never reveals t
Bob takes his ETH back after the ETH deadline. After the later Zcash refund height, Alice broadcasts her pre-signed transaction A, which turns a little of her own change into a small transparent coin. She then broadcasts her time-locked refund R, which spends that coin and returns her ZEC shielded. Zcash enforces a lock time only on a transparent input; a settled swap needs neither A nor R.
Why the ETH deadline comes first: once Alice reveals t, Bob still has time to claim the ZEC before her refund unlocks. Each app watches its deadline; recovery assumes timely inclusion and bounded reorgs. Protocol details ↗
FROST DKG and nonces use the Zcash Foundation libraries; the adaptor extension and the Solidity check are this project’s own.
Privacy
What each observer sees
On a settled swap the Zcash side stays shielded. Ethereum is public by design, so the ETH side is public. Full analysis ↗
| Observer | Learns | Does not learn |
|---|---|---|
| Anyone watching Zcash | That two shielded transactions happened, with their fees and timing. Both use expiry height 0, which few wallets do, so they stand out. On a refund only: Alice’s 20,000-zatoshi refund coin, and 15,000 zatoshi returned to the same transparent address. | Exact amounts (the public ETH amount hints at the size via the market price), senders, recipients, which note is the swap’s. |
| Anyone watching Ethereum | Both ETH addresses, the ETH amount, the expiry, the point T and, after the claim, the secret t. | Any Zcash address, viewing key, note or amount. t itself does not identify a Zcash transaction or recipient; timing can still suggest the match. |
| The message relay | Each owner’s public keys; who sent a message to whom, when, and its size. | The quote, amounts, terms or funding transaction: every message is sealed to its recipient. |
| The other party | The agreed amounts, both ETH addresses, your one-time Zcash receive address, and which Zcash transactions are the swap’s (the funding and the shared note). | Your viewing keys, your wallet, or where your ZEC goes next. |
Recovery
What if someone disappears?
Results under the stated assumptions: honest owners keep monitoring, and inclusion and reorgs stay within the timing window.
| If this happens | Outcome | Shown here |
|---|---|---|
| Setup stops before funding is released | Cancel the offer. No swap funds were locked. | Evidence ↗ |
| Alice funds; Bob never locks ETH | Alice broadcasts her prepared refund after the native deadline. | Evidence ↗ |
| Bob locks; Alice never reveals | Bob refunds ETH at expiry; Alice refunds ZEC after the native deadline. | Live demo · scenario 3 |
| Alice reveals, then everything stops | Bob finishes his ZEC claim from the public witness, with Alice offline. | Live demo · scenario 2 |
| Recovery runs twice | It reconciles confirmed transactions; no second payment is sent. | Evidence ↗ |
| Outage or reorg beyond the window | Not covered. This is a monitored swap, not indefinite offline safety. | Limit |
Evidence
Claims you can check
Recorded runs, committed with the code: this hosted demo, the public testnet swap and the isolated-chain failure tests. Each record states its own commands and limits.
Watch one swap settle
Separate apps for Alice and Bob: run the swap, a crash after the claim, or a refund, about two minutes each.
Private test chains on this server, no real money. One visitor drives; everyone else watches live.