Based on the study of existing fair exchange protocols, this paper sets up an accurate formal model by stepwise refinement. In the process of refinement an unreliable channel is employed to simulate an attack behavior. The model provides a novel formal definition of exchanged items, and presents the formal goals for fairness, accountability, etc., reflecting the inherent requirements for fair exchange protocols across-the-board. In order to check, prove, and design fair exchange protocols effectively and efficiently, the model puts forward a novel property of abuse-freeness which applies to all fair exchange protocols, gives a formal definition for trust strand of the third party, and presents general criteria of designing a secure and effective fair exchange protocol. Taking a typical fair exchange protocol as an example, this paper presents the analysis steps of fair exchange protocols appealing to our model. An unknown attack is uncovered. The analysis reveals the process of a complete attack, discovering deeper reasons for causing an attack. Finally, we modify the flawed protocol and the revised protocol ensures the desirable properties. Based on the study of existing fair exchange protocols, this paper sets up an accurate formal model by stepwise refinement. In the process of refinement an unreliable channel is employed to simulate an attack behavior. The model provides a novel formal definition of of items, and presents the formal goals for fairness, accountability, etc., reflecting the historic requirements for fair exchange protocols across-the-board. In order to check, prove, and design fair exchange protocols effectively and efficiently, the model puts forward a novel property of abuse-freeness which applies to all fair exchange protocols, gives a formal definition for trust strand of the third party, and presents general criteria of designing a secure and effective fair exchange protocol. Taking a typical fair exchange protocol as an example, this paper presents the analysis steps of fair exchange protocols appealing to our model. An unknown attack is uncovered. The analysis reveals the process of a compl Finally, we modify the flawed protocol and the revised protocol ensures the desirable properties.