pLoopringA Decentralized Token Exchange ProtocolDaniel Wangdanielloopring.orgJay Zhoujayloopring.orgAlex Wangalexloopring.orgMatthew Fhttps//loopring.orgApril 6, 2018AbstractLoopring is an open protocol for building decentralized exchanges. Loopring operates as a public set of smartcontracts responsible for trade and settlement, with an o -chain group of actors aggregating and communicating orders.The protocol is free, extensible, and serves as a standardized building block for decentralized applications dApps thatincorporate exchange functionality. Its interoperable standards facilitate trustless, anonymous trading. An importantimprovement over current decentralized exchange protocols is the ability for orders to be mix-and-matched with other,dissimilar orders, obviating the constraints of two-token trading pairs and drastically improving liquidity. Loopringalso employs a unique and robust solution to prevent front-running the unfair attempt to transactions into ablock quicker than the original solution provider. Loopring is blockchain agnostic, and deployable on any blockchainwith smart contract functionality. At the time of writing, it’s operable on Ethereum [1] [2] and Qtum [3] with NEO [4]under construction.1 IntroductionWith the proliferation of blockchain-based assets, the needto exchange these assets amongst counterparties has signi -cantly increased. As thousands of new tokens are introduced- including the tokenization of traditional assets - this needis magni ed. Whether exchanging tokens for speculativetrading motivations, or converting to access networks viatheir native utility tokens, the ability to exchange one cryp-toasset for another is foundational for the larger ecosystem.Indeed, there is a potential energy in assets [5], and realizingthis energy - unlocking capital - requires not only assertingownership, which blockchains have immutably allowed for,but the ability to freely transfer and trans these assets.As such, the trustless exchange of tokens value is acompelling use case for blockchain technology. Until now,however, crypto enthusiasts have largely settled for tradingtokens on traditional centralized exchanges. The Loopringprotocol is needed because, just as Bitcoin [6] dutifullyemphasized that, in regards to peer-to-peer electronic cash,\the main bene ts are lost if a trusted third party is stillrequired to prevent double-spendingquot;, so too are the mainbene ts of decentralized assets lost if they must pass throughtrusted, gated, centralized exchanges.Trading decentralized tokens on centralized exchangesdoesn’t make sense from a philosophical perspective, asit fails to uphold the virtues these decentralized projectsespouse. There are also numerous practical risks and lim-itations in using centralized exchanges which are describedbelow. Decentralized exchanges DEXs [7] [8] [9] havesought to address these issues, and in many cases havesucceeded in alleviating security risks by using blockchainsfor disintermediation. However, as DEX capability becomescrucial infrastructure for the new economy, there is substan-tial room for perance improvement. Loopring aims toprovide modular tools for said infrastructure with its dAppagnostic open protocol.2 Current Exchange Landscape2.1 Inadequacies of Centralized ExchangesThe three primary risks of centralized exchanges are; 1 Lackof security, 2 Lack of transparency, and 3 Lack of liquidity.Lack of Security arises from users typically surrender-ing control of their private-keys funds to one centralizedentity. This exposes users to the possibility that centralizedexchanges fall prey to malicious hackers. The security andhacking risks facing all centralized exchanges are well known[10] [11], yet are often accepted as \table stakesquot; for tokentrading. Centralized exchanges continue to be honeypots for1hackers to attack as their servers have custody over millionsof dollars of user funds. Exchange developers can also makehonest, accidental errors with user funds. Simply, usersare not in control of their own tokens when deposited ata centralized exchange.Lack of Transparency exposes users to the risk ofdishonest exchanges acting unfairly. The distinction here isby the exchange operator’s malicious intentions, as users arenot truly trading their own assets on centralized exchanges,but rather, an IOU. When tokens are sent to the exchange’swallet, the exchange takes custody, and o ers an IOU in itsplace. All trades are then e ectively between users’ IOUs.To withdraw, users redeem their IOU with the exchange,and receive their tokens to their external wallet address.Throughout this process there is a lack of transparency,and the exchange can shutdown, freeze your account, gobankrupt, etc. It is also possible that they use user assetsfor other purposes while in custody, such as lending themout to third parties. Lack of transparency can cost userswithout a total loss of funds, such as in higher trading fees,delays at peak demand, regulatory risk, and orders beingfront ran.Lack of Liquidity. From the point of view of exchangeoperators, fragmented liquidity inhibits entry by new ex-changes because of two winner-takes-all scenarios. First, theexchange with the greatest number of trading pairs wins,because users nbsp;nd it desirable to conduct all their trades onone exchange. Second, the exchange with the largest orderbook wins, because of favorable bid-ask spreads for eachtrading pair. This discourages competition from newcomersbecause it is di cult for them to build up initial liquidity.As a result, many exchanges command a high market sharedespite user complaints and even major hacking incidents.It’s worth noting that as centralized exchanges win marketshare, they become an ever-larger hacking target.From the point of view of users, fragmented liquiditysigni cantly reduces user experience. In a centralized ex-change, users are only able to trade within the exchange’sown liquidity pools, against its own order book, and be-tween its supported token pairs. To trade token A fortoken B, users must go to an exchange that supports bothtokens or register at di erent exchanges, disclosing personalination. Users often need to cute preliminary orintermediate trades, typically against BTC or ETH, payingbid-ask spreads in the process. Finally, the order books maynot be deep enough to complete the trade without materialslippage. Even if the exchange purports to process largevolumes, there is no guarantee that this volume and liquidityis not fake [12].The result is disconnected silos of liquidity and a frag-mented ecosystem that resembles the legacy nbsp;nancial sys-tem, with signi cant trading volume centralized on fewexchanges. The global liquidity promises of blockchains holdno merit within centralized exchanges.2.2 Inadequacies of Decentralized Ex-changesDecentralized exchanges di er from centralized exchangesin part because users maintain control of their private-keysassets by pering trades directly on the underlyingblockchain. By leveraging the trustless technology of cryp-tocurrencies themselves, they successfully mitigate many ofthe abovementioned risks surrounding security. However,problems persist in regards to perance and structurallimitations.Liquidity often remains an issue as users must searchfor counterparties across disparate liquidity pools and stan-dards. Fragmented liquidity e ects are present if DEXsor dApps at large don’t employ consistent standards tointeroperate, and if orders are not shared/propagated acrossa wide network. The liquidity of limit order books, and,speci cally, their resiliency { how fast nbsp;lled limit ordersare regenerated { can signi cantly a ect optimal tradingstrategies [13]. The absence of such standards has resultednot only in reduced liquidity, but also exposure to an arrayof potentially insecure proprietary smart contracts.Furthermore, since trades are pered on chain, DEXsinherit the limitations of the underlying blockchain, namelyscalability, delays in cution mining, and costly modi -cations to orders. Thus, blockchain order books do not scaleparticularly well, as cuting code on the blockchain incursa cost gas, making multiple order-cancellation cadencesprohibitively expensive.Finally, because blockchain order books are public, thetransaction to place an order is visible by miners as it awaitsbeing mined into the next block and placed into an orderbook. This delay exposes the user to the risk of being frontrun and having the price or cution move against him.2.3 Hybrid SolutionsFor the above reasons, purely blockchain-based exchangeshave limitations that make them uncompetitive with cen-tralized exchanges. There is a tradeo between on-chaininherent trustlessness, and centralized exchange speed andorder nbsp;exibility. Protocols such as Loopring and 0 x [14]extend a solution of on-chain settlement with o -chain ordermanagement. These solutions revolve around open smartcontracts, but navigate scalability limitations by peringseveral functions o -chain and giving nodes nbsp;exibility inful lling critical roles for the network. However, drawbacksremain for the hybrid model as well [15]. The Loopringprotocol proposes meaningful di erences in our approach toa hybrid solution throughout this paper.3 Loopring ProtocolLoopring is not a DEX, but a modular protocol for buildingDEXs on multiple blockchains. We disassemble the compo-nent parts of a traditional exchange and o er a set of public2smart contracts and decentralized actors in its place. Theroles in the network include wallets, relays, liquidity-sharingconsortium blockchains, order book browsers, Ring-Miners,and asset tokenization services. Before de ning each, weshould nbsp;rst understand Loopring orders.3.1 Order RingLoopring orders are expressed in what we call a Unidirec-tional Order Model UDOM[16]. UDOM expresses ordersas token exchange requests, amountS/amountB, amount tosell/buy instead of bids and asks. Since every order is justan exchange rate between two tokens, a powerful feature ofthe protocol is the mixing and matching of multiple orders incircular trade. By using up to 16 orders instead of a singletrading pair, there is a dramatic increase in liquidity andpotential for price improvement.ORDER2ownerYamountS9BamountB12CORDER1ownerXamountS10000AamountB2BORDER3ownerZamountS100CamountB160A7898A8B 98CFigure 1 An order-ring of 3 ordersThe above nbsp;gure shows an order-ring of 3 orders. Eachorder’s token to sell tokenS is another order’s token tobuy tokenB. It creates a loop that allows each order toexchange their desired tokens without requiring an opposingorder for its pair. Traditional order pair trades can, ofcourse, still be cuted, in what is essentially a special caseof an order-ring.De nition 3.1 order-ring Let C0, C1, nbsp; nbsp;, Cn 1 be ndi erent tokens, O01, nbsp; nbsp;, Oii 1, nbsp; nbsp;, On 10 be norders. Those orders can a order-ring for tradingO01 nbsp; Oii 1 nbsp; On 10,where n is the length of the order-ring, and i 1 nbsp;i 1mod n.An order-ring is valid when all component transactionscan be cuted at an exchange rate equal to or better thanthe original rate speci ed implicitly by the user. To verifyorder-ring validity, Loopring protocol smart contracts mustreceive order-rings from ring-miners where the product ofthe original exchange rates of all orders is equal to or greaterthan 1.Let’s assume Alice and Bob want to trade their tokenA and B. Alice has 15 token A and she wants 4 token B forthem; Bob has 10 token B and he wants 30 token A for them.Who is buying and who is selling This depends onlyon the asset we nbsp;x to give price quotations. If token A isthe reference, then Alice is buying token B for the price of154 375A, while Bob is selling 10 token B for the priceof 3010 300A. In the case of nbsp;xing token B as reference,we say that Alice is selling 15 token A for the price of415 026666667B and Bob is buying 10 token A for theprice of 1030 033333334B. Hence, who’s the buyer or selleris arbitrary.In the nbsp;rst situation Alice is willing to pay a higherprice 375A than the price Bob is selling his tokens for300A, while in the second situation Bob is willing to pay ahigher price 033333334B than the price Alice is selling hertokens for 026666667B. It is clear that a trade is possiblewhenever the buyer is willing to pay an equal or higher pricethan the seller’s price.15430101030415 154 nbsp;1030 125 gt; 1 1Thus, for a set of n orders to be able to be nbsp;lled, fully orpartially, we need to know if the product of each one of theexchange rates as buy orders results in a number greater orequal to 1. If so, all the n orders can be either partially, ortotally nbsp;lled [17].If we introduce a third counterparty, Charlie, such thatAlice wants to give x1 token A and receive y1 token B,Bob wants to give x2 token B and receive y2 token C, andCharlie wants to give x3 token C and receive y3 token A. Thenecessary tokens are present, and the trade is possible ifx1 x2 x3y1 y2 y3 nbsp;1 2See section 7.1 for more details about Loopring’s orders.4 Ecosystem ParticipantsThe following ecosystem participants jointly provide allfunctionalities a centralized exchange has to o er.Wallets A common wallet service or interface thatgives users access to their tokens and a way to sendorders to the Loopring network. Wallets will beincentivized to produce orders by sharing fees withring-miners see section 8. With the belief that thefuture of trading will take place within the safety ofindividual user’s wallets, connecting these liquiditypools through our protocol is paramount.Consortium Liquidity Sharing Blockchain/Relay-Mesh A relay-mesh network for order amp; liquiditysharing. When nodes run Loopring relay software,they are able to join an existing network andshare liquidity with other relays over a consortiumblockchain. The consortium blockchain we arebuilding as a nbsp;rst implementation has near real timeorder sharing 1-2 second blocks, and trims oldhistory to allow for faster download by new nodes.Notably, relays need not join this consortium; theycan act alone and not share liquidity with others, or,they can start and manage their own liquidity sharingnetwork.3 Relays/Ring-Miners Relays are nodes that re-ceive orders from wallets or the relay-mesh, maintainpublic order books and trade history, and optionallybroadcast orders to other relays via any arbitraryo -chain medium and/or relay-mesh nodes. Ring-mining is a feature { not a requirement { of relays.It is computationally heavy and is done completelyo -chain. We call relays with the ring-mining featureturned on \Ring-Minersquot;, who produce order-rings bystitching together disparate orders. Relays are free in1 how they choose to communicate with one another,2 how they build their order books, and 3 how theymine order-rings mining algorithms.Loopring Protocol Smart Contracts LPSCA set of public and free smart contracts that/p