What I understand is that Greenaddress locks a recovery transaction to be spend 90 days in the future. Whats the advantage in doing this? Why not creating a recovery transaction without nLocktime?
2 Answers
When using a multisig Green Address wallet your funds are locked in a 2-of-2 multisig account, i.e. if you want to spend money from that account you need both your signature and Green Address' signature. This is done so that Green Address can guarantee that you will not try to double spend money from that account. This allows Green Address to grant you instant confirmation transactions. However, this means that in case Green Address goes down, or stops functioning in any way, your funds are locked in the multisig account for good. To mitigate this problem, Green Address generates and signs a transaction that unlocks your funds after 90 days. This means that, in case Green Address disappears, after 90 days you can broadcast that transaction and get your funds back. The reason why nLocktime is used is that if Green Address gave you a transaction without nLocktime, you would be able to spend the money in the multisig account at any time. This would not allow Green Address to guarantee that you do not try to double spend your funds when performing a transaction from that account, hence making Green Address not able to allow you instant confirmation transactions. In this way, instead, Green Address can guarantee that you will not double spend from that account for the next 90 days, hence granting you instant confirmation transactions.
-
I would also like to add that if the recovery transaction has no lock the two factor authentication or threshold/limit features become a little less useful as one only needs the mnemonics to use the recovery transaction. In the 20f3 case on the other hand one can use two factor authentication and threshold while keeping the recovery (third key) entirely separate (and have no recovery file needed but no support for instant) Commented Mar 1, 2017 at 17:30
The GreenAddress website explains the recovery lockout in their FAQ. As zero locktime is equivalent to the situation after the nLocktime expires, the following FAQ paragraph is relevant:
Why am I am being asked to redeposit my funds?
Once the nLockTime period expires these nLockTime transactions would allow you to recover the funds in the 2of2 account without requiring GreenAddress's signature. This also means that any limits placed on your spending in GreenAddress, such as 2FA requirements, cease to be enforceable by GreenAddress.
The nLocktime is hence necessary to maintain the requirement for the second factor in GreenAddress 2FA for the period of the nLocktime.
If you don't move funds in a GreenAddress wallet during the nLocktime period, the same situation arises and you are asked to redeposit funds to invalidate the existing pre-signed recovery transaction.
If you were to get hacked, the black hat would get the first factor from your wallet device and the second factor (recovery transaction) from your email account. Considering the recovery transaction is time locked for 90 days, the hacker would only succeed if the funds hadn't been spent/moved during those 90 days.
