8

Until this afternoon I thought the anti-cheat transactions or breach remedies built on the exit-transaction of the counterparty.

Apparently, they build on something called a "hash pre-image". What is it the pre-image from? How and why can it be used to create a transaction once the counterparty tries to breach the payment channel?

Improve this question

1 Answer 1

Reset to default
15

In the image below from Rusty Russell's Deployable Lightning paper, you can see a visualization of the commitment transactions and their outputs:

enter image description here

For each payment in a channel, there are two commitment transactions generated, one for Alice and one for Bob. Both Alice and Bob sign both commitment transactions, so they're both valid transactions (although only one of them could be included in the blockchain since both transactions spend the same inputs).

Both transactions pay two outputs. The transaction Alice has (on the left in the diagram, Commit TxA) pays the following two scripts:

  • A regular P2PKH (or its segwit equivalent) output that Bob can spend at his leisure.

  • An output that Alice can spend after waiting a specified number of blocks (let's say 100), as enforced with OP_CSV, or which Bob can spend if he has a piece of data that hashes to a value in this output. I call this the pre-image; in other descriptions of Lightning this is a private key used to generate a signature.

In the transaction that Bob has (on the right, TxB) these are reversed, there's:

  • An output that pays Alice using P2PKH.

  • An output that Bob can spend after waiting 100 blocks or which Alice can spend at any time using a pre-image.

In these outputs, Alice selects the pre-image that prevents Bob from spending her output (Revocation-A) and Bob selects the pre-image that prevents Alice from spending his output (Revocation-B). They could use a random number of large size, although they'll probably both use hashes from a hashchain generated using Rusty Russell's 64-dimensional shachain to allow compact storage of any revealed hashes, seeding the chain with some initial random value.

Each time Alice and Bob agree to update the state of the channel, they both reveal to the other person the pre-image for the hashlock they placed on the output for the previous state of the channel, allowing the other person to create a breach remedy transaction.

Improve this answer
2
  • If Alice revealed to Bob the pre-image for the hashlock, allowing Bob to create a breach-remedy transaction, why wouldn't Bob immediately broadcast the breach-remedy transaction with the pre-image, and take all the funds?
    – Oren
    May 28, 2020 at 8:47
  • I think I solved it: Alice revealed to Bob the pre-image for the hashlock of TxA, but Bob only sent to Alice TxA with Bob's signature. Bob cannot broadcast TxA without Alice's signature. Only if Alice's broadcasts TxA with both Bob's and Alice's signatures, Bob can then immediately broadcast the same transaction with the same signatures but also with the pre-image, and get all the funds. Right?
    – Oren
    May 28, 2020 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.