ETH Reddit Mentions | ChartExchange

Disclosure up front: I built this. I take 0.075% of the ETH side of a swap. Another 0.075% goes somewhere else — a separate multisig I'll explain below, so that somebody who isn't me can get paid to keep this alive. Both addresses are burned into the contract at deploy. Neither can be changed, by me or anyone.
The protocol isn't mine. That's Athanor's, built on Joël Gugger's paper. The ed25519 library the contract uses is Jan Vornberger's, turned into a Solidity library by hbs.
Last time I was in here I said ETH-XMR atomic swaps were dead and that nobody was funded to keep one running. Both wrong, and monerobull was the one who put me straight. I posted an apology. Somebody replied that it was accepted and to get back to work.
So here's the work.
What's live
Contract on Base: 0xC2b2e8D385309d6552657c0b80434ca616DE12fC. Verified on Basescan. 525 lines. No owner. No admin function. No upgrade path. owner() doesn't exist — the call reverts.
A buyer page that needs a browser wallet and nothing else: https://dafarusd.github.io/monero-swap/
A seller program, monero-swap-v2, in the repo.
https://github.com/dafarusd/monero-swap
Nobody's selling on it. Including me. The board is empty as I write this, so there's nothing to take today. I'd rather say that than have you click and find out.
How it works
Buyer locks ETH in the contract. Seller sends Monero to an address that needs both parties' one-time keys to spend. Buyer confirms it arrived. Seller collects the ETH — and collecting is what reveals the seller's one-time Monero key on-chain. Buyer adds that to their own key and can spend the Monero.
Seller never sends? Buyer takes the ETH back. Buyer refunds? That reveals the buyer's key, and the seller sweeps the Monero back. Nobody ends up holding nothing.
The contract checks the revealed key itself — an ed25519 scalar multiply against the committed Monero public spend key. Athanor used secp256k1 and a cross-curve DLEq proof because that multiply costs too much on Ethereum mainnet. On an L2 you can just do it, and the whole DLEq layer vanishes from the client.
What I changed in v2, and why
Timeouts are 24 hours minimum now. They were an hour. That was a bug. Base runs one sequencer, and if it censors you your way out is forcing the transaction in from L1, which takes about twelve hours. An hour-long window can close while you're being censored and you'd never get a move in.
Sellers post a bond — 5% of the offer's ceiling. It comes back every time, whichever way the swap ends. It's never handed to the other side. The contract can't see Monero, so it can't tell a seller who didn't deliver from a buyer who bailed, and a bond it can't judge fairly is one it has no business keeping. It's there so spamming the board costs something.
Fees are credited, not sent. If a fee address is a contract that reverts when it receives, and you push the fee inside claim, that address can brick every claim in the system. So the contract credits it and you withdraw later. Pull, don't push.
Tokens are gone. v1 swapped ERC-20s. An issuer can freeze a contract's balance and strand every swap sitting in it. hbs's FAQ made that argument before I ever started. I shipped tokens anyway, then pulled them.
The offer board lives in contract storage. Enumerable, so finding an offer never depends on how long some node kept its logs.
Measured today: posting an offer 357,981 gas, taking one 254,026, marking ready 30,904, claiming 617,795. At the gas price my own deploy paid, a claim runs about 0.0000037 ETH. 83 Foundry tests pass, twelve of them invariants the fuzzer hammers across 128,000 calls with no reverts. The one I care about checks that every wei the contract holds is either a bond, money owed, or value in an open swap — measured against a ledger the test keeps itself, not against the contract's own books.
The fee, the dev fund, and handing this over
This is the part I actually want feedback on.
This sub has watched a swap project die because one person stopped caring. I don't want to be that, so the money is arranged to outlive me.
0.15% comes off the ETH side of a swap. It splits in half. 0.075% to me. The other 0.075% goes to a dev-fund multisig at 0x61C9cc608Edf3Ba392B8c654171823984FA32240. That's not a donation address and it's not mine to spend on whatever — it's there so somebody who isn't me can be paid to maintain this.
Here's why that's a real mechanism and not a nice sentence. The contract's copy of that address is immutable, so it gets paid forever regardless of who's running things. But a Safe's signers are not immutable. Add signers, change the threshold, and the people doing the work control that money — no redeploy, no migration, nobody asking my permission. That's the whole reason the fee splits in two instead of landing in one wallet.
Where it stands right now, honestly: both Safes are 1-of-1, both signers are me, and both hold exactly zero, because no swap has ever paid a fee. It's a mechanism, not a treasury. I'm not going to call an empty wallet a war chest.
And there's nothing to hand over on the contract itself, which is the point. No owner, no admin function, no upgrade path. Nobody can change the fee, the split, the bond, the timeouts or either payout address. It runs whether or not I'm around. That part's finished, not promised.
What I keep is the 0.075%, permanently, and I can't redirect it any more than a successor could. If this outlives my interest I end up a fee recipient while somebody else runs it. That's the arrangement, said out loud now rather than sprung on anyone later.
The backstop matters more than any of it: you don't need my permission for a thing. It's MIT. Take the contract, put your own two addresses in the constructor, set your own fee, set it to zero if you like, deploy it. I have no claim on yours. Only thing that makes this one mine is that I deployed it first.
The other one, and where it's better than mine
hbs's MoneroSwap: https://codeberg.org/moneroswap/moneroswap. MIT. The dApp was funded by a CCS of 135 XMR, finished and paid in February. Talks at EthCC and two MoneroKons. Still shipping security fixes this week.
We landed on the same answers independently more often than not — on-chain order book, ed25519 checked on-chain with no DLEq, 24-hour minimum timeouts, native currency only, deposits from both sides, no upgrade path.
Where theirs wins:
Their seller runs no software at all. Browser wallet, plus a normal phone wallet to scan a payment QR. No daemon, no wallet-rpc, no CLI. Mine needs a program running. If you want to sell Monero once, theirs is the better tool and I'm not going to pretend otherwise. I didn't copy it because I wasn't building for the one-off sale — I wanted something that keeps an offer up continuously and survives a restart with nobody watching. Once a long-running thing holds Monero and signs by itself you need wallet-rpc anyway, which is why their market-making bot needs it too. But they made the manual path work without any of that and I didn't build a manual path at all. That's a hole in mine, not a design choice I'm proud of.
Reproducible builds. Their docs tell you to hash the deployed code and match it to a repo tag. I tried it on one of their deployments and it matched exactly. Their app is static, pinned on IPFS, addressed by ENS. Mine's a GitHub Pages build and you're trusting the bundle came from the source. Theirs is better and I'm copying it.
Both directions. They run a buy book and a sell book. Mine has one — the maker is always the Monero side. Sitting on ETH, you can only wait for someone to post; you can't advertise a bid.
Funding requests, so a seller with no native coin can borrow the deposit from a third party.
No protocol fee. Theirs takes nothing. Mine takes 0.15%.
Where mine differs. Three things, all checkable:
No owner, at all. Theirs has one, set in the constructor, who can move the coverage ratio, the funding fee, book sizes, offer limits, both delays and the price oracle. They know it's a risk — the owner can lock the contract for a stretch and their app shows a padlock, and their own safety doc warns parameters can shift between you posting an offer and someone taking it. Their deployed Gnosis contracts carry three more owner functions than their current source does, left from an sDAI yield feature, and the owner called withdraw on it as recently as March. That's yield, not swap principal, and it's in their FAQ. Still a key that can do things. Mine has none.
It pays for itself. Their CCS is finished and only ever covered the dApp — the contract was unpaid work. Grants end, then maintenance stops. That's the failure I'm building against. You may think taking a fee is the wrong trade. Fair.
The page does its own Monero scanning. View-tag matching, ECDH amount decryption, commitment check, in JS, so it can tell you the money landed rather than asking you to go look.
On chains: they're on Gnosis, Lens and Stable — native currencies that are stablecoins, which is a clever way to offer stablecoin swaps without ever touching an ERC-20. They're on Base too, same address, empty book there like everywhere else. I'm Base only. Not dressing that up as an edge: Gnosis gas is ten wei, so their swaps cost less than mine do.
Why build it when your wallet already swaps
Because it doesn't, in this direction.
The swap buttons in Monero wallets sell Monero. They take your XMR and hand you something else. Try to go the other way — turn ETH into Monero without an account — and there's no button. I went and read the source of the one I use to be sure, and the source coin is hardcoded. The receive screen doesn't contain a line of swap code.
There's also no trustless option anywhere in shipping wallet software. eigenwallet does real atomic swaps, but it's desktop-only and Bitcoin↔Monero.
And the swaps those buttons do run aren't trustless either. They hand your coins to an exchange service, which holds them and then sends the other asset. From the AML policy of the one behind it:
"Exolix reserves the right to suspend, delay, reject or cancel transactions until compliance review procedure is completed."
They can ask for legal name, date of birth, address, citizenship, government ID, a selfie or liveness check, proof of address, source of funds, source of wealth. And:
"Failure to provide the required information will lead to transaction delays, cancellations, restrictions on account or exclusion from the use of the Services."
"Exolix is not obliged to notify the user about reporting, reviewing, and flagging any transaction, wallet or activity related to compliance."
The one that should bother this sub most, about coins already sitting in their deposit address:
"If the funds that came to the deposit under your transaction were recognized by the system as suspicious, we may ask you for information to verify the source of the funds. If you refuse to provide such information, we are not responsible for ensuring the refund or completion for this transaction."
ID asked for after they're holding your Monero, and they've written down in advance that refusing might cost you both the swap and the coins.
Two more, since this is r/Monero. You have to turn Tor off to use it — the wallet says so itself in the error string. And in May 2026 a researcher found that service's partner API was handing out full transaction histories: 355,944 swaps, $39.5M, deposit addresses matched to withdrawal addresses. Monero was the single largest asset in the dump. That's precisely the link a swap is supposed to break. Their answer was that the access was "in fact a feature."
None of which is a warning you'll see in the app. I grepped every string in it — there's an IP note and nothing about custody, ID or frozen funds.
The part I can't spin
Nobody trades on either of these. Not mine. Not hbs's.
Every mainnet order book of theirs I checked is empty. Their busiest deployment has 87 transactions and the one complete swap I could trace had the same address on both sides — a developer testing. Mine has zero swaps and zero offers. Two people built ETH↔XMR atomic swaps and there's no volume on either.
Their project isn't dead, to be clear — hbs shipped fixes this week and has 565 commits behind him. Mine's just new. Neither of us has users.
People had the choice and they took the custodial one. Ten to thirty minutes, about 0.79% in spread, and they accept that someone might ask them for a selfie holding their ID. Against that, this asks for a 24-hour wait, a program left running, and a counterparty who doesn't exist yet. I get it. I'd make the same call most days — and I did. The Monero I was going to sell trustlessly, I bought through a custodial exchanger, because it was there and this wasn't.
So I'm not telling anyone to switch. Use the wallet, it's faster and it works. I built this for the case where nobody's holding your coins while they decide whether to give them back.
Run a seller
The ask, if there is one. Contract works, page works, nobody's selling.
git clone https://github.com/dafarusd/monero-swap.git
cd monero-swap
./scripts/install-monero-linux.sh
make build-swap-v2
./bin/monero-swap-v2 --eth-rpc https://mainnet.base.org --contract 0xC2b2e8D385309d6552657c0b80434ca616DE12fC terms
terms reads the live contract and prints the fee, the split, the bond and the timeouts before you put anything in. Don't take my word for those numbers — that command doesn't either. Then addresses to see what needs funding, then:
./bin/monero-swap-v2 --eth-rpc https://mainnet.base.org --contract 0xC2b2e8D385309d6552657c0b80434ca616DE12fC --monerod-host node.monerodevs.org --monerod-port 18089 maker run --payout YOUR\_ETH\_ADDRESS --min 0.01 --max 0.1 --price 15.5
\--payout is any wallet you want; it never touches the gas key. --manual-xmr if you'd rather the program didn't hold your Monero — it watches, you pay from your own wallet.
Two things that'll catch you:
The bond comes out of the same key that pays gas. 5% of your --max. Fund it for both.
The bond returns as a credit inside the contract, not a transfer. maker run collects it after each swap on its own; withdraw does it by hand. Miss that and your bonds pile up and it looks like the contract ate them.
And the one that matters: this program has never carried a swap start to finish. The logic is the v1 seller's, which did run real swaps on test networks, but nobody's run v2 against a real buyer. Use an amount you don't care about. Tell me what breaks.
Limits
Not audited. 525 lines, tests pass, nobody outside the repo has read it. Tests only prove what I thought to check.
The v2 seller has never completed a swap.
Five swaps and one refund ran end to end on test networks, all on v1. No real-money swap has finished on either version.
The seller has to be online and act inside the windows. That's Monero, not a bug.
24-hour timeouts tie your money up for a day.
My page has no reproducible-build story. Theirs does.
Base only. The same contract runs on any EVM chain, and every extra chain splits the sellers.
One offer direction. Running a seller is selling Monero for ETH, so both roles exist — but only the Monero side can post. No buy-side book.
If you spot a hole in the key check or the accounting I'd rather hear it here than read about it on Basescan.

.dark-mode .kG387M{ color: white; background-color: #333333; border: 2px solid white; }.light-mode .kG387M{ color: #333333; background-color: white; border: 2px solid #333333; }ETHUSDTEthereum / Tether USDcrypto Composite

ETHUSDT
Ethereum / Tether USD
crypto Composite