The way Hydra works is:
- Some collection of parties agree they want to do business together
- They each deposit some funds into a smart contract, and "open" the head, which locks in an initial distribution of funds; Alice owns 5 ADA, Bob owns 10 ADA, etc
- They open up direct connections to each other to communicate
- They submit transactions to eachother, which they validate, that update their **own** accounting of who owns what
- Periodically (usually every transaction but doesn't have to be), they will sign those snapshots; "After 10 transactions, Alice owns 7 ADA, Bob owns 8 ADA, etc"
- At any time, anyone with one of these snapshots can decide to close the head: they present the snapshot to the smart contract
- There's a small window where the other participants can present a *newer* snapshot, to make sure you're not trying to get out with an old snapshot
- After that window expires, whatever the latest snapshot presented to the smart contract gets distributed: 7 ADA gets sent to Alice, 8 ADA gets sent to Bob, etc.
This works as long as all the money is owned by one of the people operating the head. The snapshots have to be unanimously signed, so Bob and Charlie can't steal Alice's funds. The worst she can do is sign a snapshot voluntarily letting Bob and Charlie steal the funds.
Hydra is fast because it's just a few (2-9ish) people talking to eachother directly, no need to get *global* consensus, no need to handle if someone might be offline, etc. This means you can't scale up Hydra to hundreds of first-class participants; because getting a signature from 100 different people is going to be slow, and if even one of them is offline, progress grinds to a halt.
However, if you deposit funds that **are owned by someone else**, then this dramatically changes things; If you have funds from 10,000 users in a head controlled by 2 or 3 people, then all it takes is for those 2 or 3 people to coordinate or get hacked and sign a snapshot that says "everything belongs to us now"; or to decide to roll back a bunch of history by closing the head with an older snapshot; etc.
We had a demo of SundaeSwap working on Hydra in Summer of 2022, but the reason we never rolled it out is because we were never comfortable with this trade-off.