// OTC · Atomic Swap · Founder Console

SOST Atomic Swap Console

A guided, founder-only console for SOST ↔ EVM cross-chain atomic swaps (HTLC), activating at block 15,000. It explains, validates and generates the exact sost-cli commands for you to run in your own terminal. It never asks for a seed phrase or private key, never signs, never broadcasts, and never sends your secret anywhere.

DO NOT USE · Founder-only Unaudited · EVM-only (BTC = V15) Status: checking… Height: —

What this is — and what it is NOT

An HTLC (Hash Time-Locked Contract) is a self-custodial lockbox with two exits: CLAIM (whoever reveals the correct secret S whose sha256(S) equals the agreed hashlock can take the funds) and REFUND (if the timeout passes and nobody claimed, the owner takes their funds back). Two parties lock on their own chains under the same hashlock; revealing S to claim one side lets the other side be claimed too. No custodian, no trust.

This page is read-only + a command generator. The real money moves only when you run the generated commands in your terminal, sign them, and broadcast them. If anything looks wrong, do not run it.

Why it is delicate

It touches real funds on two chains. A wrong hashlock, timeout or pkh can lock funds until refund; a bug or a chain reorg can break atomicity; and if un-upgraded miners reject HTLC blocks, the SOST network can split. The point of no return is not block 15,000 — it is the FIRST HTLC you create.

Glossary

HTLC
The lockbox contract with CLAIM + REFUND exits under one hashlock + timeout.
LOCK
The transaction that puts your SOST into the HTLC (here: createhtlclock).
CLAIM
Spending the lock by revealing the secret preimage (claimhtlc).
REFUND
Reclaiming your own locked funds after the timeout (refundhtlc).
secret / preimage (S)
A random 32-byte value you generate and keep private until you claim. Lose it → claim can fail.
hashlock (H)
H = sha256(S). Identical on both chains. Public.
refund_height
The SOST block height at/after which you may refund. Set it LATER than the counterparty's EVM timeout.
reorg
A chain reorganisation can un-mine a claim after the secret is already public on the other chain — the classic cross-chain risk.
Why native first
ETH/BNB native behave predictably. USDT/PAXG/XAUT (non-standard / fee-on-transfer) can break the locked-amount accounting — not for first tests.
Why BTC is off
BTC HTLC signing is not active until V15; the BTC builder is a stub.

Readiness checklist

Only live items are verified by this page (via the public /rpc). self items you must verify yourself on your machines — the website cannot inspect your node binary, flags or hashrate. Be honest with yourself.

…Current height reached 15,010+ (settle past the fork before any HTLC) live
checking height…
…Public node RPC reachable live
checking…
VPS node + Beelink miner rebuilt at the V14 commit (b57c41ed or later) self
run git rev-parse --short HEAD on both
Both built with SOST_ENABLE_PHASE2_SBPOW=ON and SOST_TESTNET_FORKS=OFF self
grep CMakeCache.txt on both
Node restarted & miner relaunched on the new binaries self
Explorer height matches your node tip (no divergence) self
No REJECTED block / invalid / consensus in node logs self
Majority of hashrate is on the new binary (coordinate miners BEFORE the first HTLC) self
Readiness: not evaluated yet.

This checklist is advisory. Ticking boxes does not make the swap safe — it records that you checked. The hard invariant: do not create the first HTLC until height ≥ 15,010 AND every box is genuinely true.

Founder unlock

The command generators are locked until you confirm this is founder-only use. Type exactly: I UNDERSTAND THIS IS FOUNDER-ONLY

Test 1 — REFUND only (do this first)

The safest first test: lock a tiny amount of SOST, let the timeout pass, and recover it by refund. If refund works, you know you can never get stuck. No counterparty, no EVM, no claim.

Prerequisites: a spendable SOST UTXO (txid, vout, amount, your pkh — from your wallet), height ≥ 15,010, and the smallest viable amount. The CLI builders output an unsigned tx — you sign + sendrawtransaction yourself.

Step A — generate a fresh secret + hashlock (in your browser, never sent)

Step B — your inputs

EVM operate — real LOCK / CLAIM / REFUND (MetaMask)

This runs the real AtomicSwapHTLC contract via your wallet: it builds the exact calldata (verified against the contract ABI) and your wallet signs & sends. ETH/BNB native + ERC-20 (USDT/USDC/PAXG/XAUT). BTC is excluded (V15). No seed/private key ever touches this page.

Contract status: the AtomicSwapHTLC contract is NOT deployed by default (unaudited). Operations stay disabled until you deploy it and paste its address per network below. This is intentional — the console will not let you call a contract that does not exist.

Founder unlock

Type exactly: I UNDERSTAND THIS IS FOUNDER-ONLY

1 · Wallet & network

Not connected.

2 · Asset & amount

3 · Swap parameters

Cross-chain rule: your SOST refund_height must open LATER in wall-clock time than this EVM refundTime (different block speeds — Ethereum ≈12s, BNB ≈3s, SOST varies). The contract does NOT enforce this; you do.

4 · Actions

Each action opens MetaMask for you to review & sign. The exact calldata is shown first.

Test 2 — full CLAIM flow

Only attempt a claim after a refund test has succeeded. Native ETH/BNB only, cents-level amounts.

Refund-only test completed successfully (unlocks the claim generator)

Flow: (1) you generate S/H; (2) you LOCK SOST with H + your refund_height; (3) counterparty LOCKs the EVM side with the same H and an earlier timeout; (4) you confirm their lock (amount + hashlock) on the EVM explorer; (5) you CLAIM the EVM side, revealing S; (6) counterparty CLAIMs your SOST with the now-public S.

Swap status & logbook

Paste your swap identifiers to generate the read-only status command and to keep a local logbook. Your secret stays local and is never included in any upload.

Simple usage guide (founder-only)

⚠ Do NOT use it with money you care about. It is unaudited and in testing. ALWAYS rehearse on testnet first. This console never touches your key/seed: it only builds the command/calldata and YOUR wallet signs.

In plain terms, what an atomic swap does: you lock funds on one chain under a "lock" (hashlock) with a deadline; whoever reveals the secret gets paid; if nobody claims in time, you get your funds back (refund). No intermediary.

Before you start (one time)

  1. Rehearse on testnet (Sepolia or BNB testnet): deploy the contract there with forge create and run the whole cycle risk-free. The console detects the testnet automatically.
  2. Have MetaMask with some gas (ETH/BNB) and a minimal amount for the test.

Step by step (the “EVM operate” tab)

  1. Connect MetaMask → you will see your address, the network and your gas balance.
  2. Paste the deployed contract address → click “Verify contract code” (it must show EXACT).
  3. Choose asset Native (ETH/BNB) and a tiny amount. (ERC-20 is disabled for safety; BTC is for V15.)
  4. Click “New S+H” to generate the secret and the hashlock → save the secret (without it you cannot claim). “Random” generates the swapId.
  5. Set refundTime (current EVM block + margin) and the claimer/refunder addresses.
  6. Click LOCK → review the box (network, contract, amount) and sign in MetaMask. It returns the tx with an explorer link.
  7. Read swap status → it must show LOCKED / CLAIMABLE.
  8. To get paid: CLAIM (paste the secret; the console checks the sha256 matches before signing). To recover after the deadline: REFUND.
  9. Save everything with “Download swap log” (Swap status tab). Never upload your secret anywhere.

Recommended first test: REFUND first

Before a real swap, run the “1 · Refund test” tab: lock a minimal amount in SOST and recover it via refund. If refund works, you know you can never get stuck. Then try CLAIM.

Golden rules

Founder-only · tiny amounts · native ETH/BNB (not USDT/PAXG/XAUT) · testnet first, then mainnet (height ≥ 15,010 + checklist) · if anything fails, do NOT create more HTLCs → see the Emergency tab.

More detail in each tab: Readiness (is everything ready?), EVM operate (the real operation), Swap status (query / log), Emergency (what to do if something goes wrong).

Emergency plan

STOP rule: at any sign of trouble — do NOT create more HTLCs, preserve all logs, and follow the matching scenario below. (Full runbook: docs/ATOMIC_SWAP_V14_OPERATIONS.md, section E.)

1 · Before the first HTLC (benign window)

Reaching block 15,000 changes nothing until an HTLC is mined. If miner coverage is unsafe or you have doubts: simply do not create an HTLC. The clean lever is to revert the gate to INT64_MAX, rebuild, redeploy and re-announce — no fork, because no HTLC ever existed.

2 · Network split (chain diverges)

Symptoms: peers stuck, your tip diverges from the explorer, REJECTED block in logs. Actions: stop all tests; create no more HTLCs; tell miners to rebuild on the new binary & resync; the canonical chain is the majority-hashrate (your) chain; compare getblockcount / tip hash across node, explorer and peers before doing anything.

3 · Bug AFTER an HTLC is mined (worst case)

If you can't claim, can't refund, a tx is rejected, the EVM side mismatches, or a reorg hits: create no more HTLCs; harden the DO-NOT-USE banner; preserve everything (SOST txid, EVM txid, secret/hashlock, refund_height, node logs, block height, exact commands); check whether funds are recoverable via refund after the timeout; if it is a consensus bug, prepare a coordinated emergency point-release / fork; if it is a CLI/contract bug, patch and do not use again until tested.

Golden rule: keep the first HTLC tiny and native, run REFUND before CLAIM, and don't scale until several clean cycles — so you never reach scenario 3 with real value.

SOST Atomic Swap Console · founder-only · DO NOT USE · this page never holds keys, signs, or moves funds · © SOST Protocol