7

The core lightning security assumption relies on a punishment mechanism called “Justice Transaction”. However, how can you prevent a malicious user from colluding with a miner, and producing a block with old state transactions without the rest of the network (watchtowers/honest nodes) realising it pre-mining?

2

When a channel is closed unilaterally, it requires two transactions by the closing party to move funds from a channel back into unilateral control.

The closing party publishes their version of the commitment transaction to the network. The commitment transaction has a special condition for the closer's output. After the commitment transaction is included in a block, the closing party's funds are locked for a period of time in which only the counterparty is able to issue their penalty transaction. The closing party can only spend their output after the lock expires. Since the two spending conditions are encoded in the output's locking script, the funds remain subject to potential penalty spending until the closing party moves the funds to a different output.

To prevent a penalty transaction from occurring during the wait period, the attacker would need to be able to censor the penalty transaction from being included in any block between the commitment transaction being confirmed and the lock expiring. Censorship of such level would require sufficient hashrate to reorganize any block that includes it.

1

It's named "penalty transaction" by the specs :).

Regarding your core question, you are right but this also requires this miner to be able to heal this block chain without a censored (the penalty) transaction. It therefore assumes that a single miner has more hashpower than the rest of the network combined.

Thus it can be stated as such:

The Lightning Network core security assumption relies on the fact that nobody can "51% attack" the network.

The decentralization of mining is a huge deal for Lightning (and all other L2s i know of).

16
  • You don't need a majority hashpower since a minority hashrate can also mine an old state if channel lock time is long enough. I understand your “healing” argument, but in order to “heal” the chain you should be able to differentiate fraudulent blocks from honest blocks. So the new question is, how honest miners can identify those fraudulent blocks that include old states. PTLCs are now making this differentiation even harder. – Brqoo Jan 23 at 12:07
  • You do need a majority of hashpower as we assume the miners to be economically rationale. ie they will mine the transaction that pays more fee. So what happens is: with a funding tx A an old state tx B gets broadcast, the penalty tx C gets as well. Most of the network will include C which pays more fees, unless the miner you colluded with is most of the network itself and will likely get paid through a bribe. If the colluding miner does not have enough hashpower, even if it finds a block it will get reorged out as the rest of the network just mined the high-fee tx C, which – darosior Jan 23 at 12:44
  • conflicts with the stealing transaction B. In addition the rationale miners have a huge delay to mine the penalty tx C before B even gets valid. This is the reason why you need to have >50% of the network hashrate in order to censor the transaction long enough AND then not even getting reorg'ed out by economically rationale miners: you need to heal a chain which censors a transaction. – darosior Jan 23 at 12:45
  • Your argument is true for pre-mining, but I'm talking about post-mining of an old state. I don’t think reorg is practical (at least today) since all these miners must consolidate and agree on whether to reorg a particular block. Miners are all independent organisations and they have no clue what strategy the rest of miners are following. – Brqoo Jan 23 at 12:52
  • 1
    I don't think you read carefully and try to understand my explanation.. Ping me on IRC if you'd like as it's becoming too long for this medium. As for your last comment: tx B cannot end up from nowhere in a valid block as it is not valid by the time the peer remarks the tentative of theft and broadcast tx C (penalty). first-seen safe is brittle and completely unrelated. – darosior Jan 23 at 14:37
0

This is a special case of 51% attack.

The lock of the funds in a force-close is at a minimum 144 blocks for the person who submit the old state, but the other party can claim their share at once. They can also submit a penalty transaction at once, and have all the funds in a channel to spend from.

So 144 is how many blocks that had to be mined in secret to pull this off.

And yes, it would have to be a majority, because the chain with the most PoW wins.

In theory it is possible, but it's impossible in the same way that 6 blocks is seen as immutable - it is not likely to yield gains worth the expenditure, to pull it off.

If they had that hash rate and the willigness to steal, they'd be more likely doublespend a transaction to an exchange, because that is easier.

4
  • 1
    No it's not a special case of 51% attack. Anyone with %1 hashrate can mine such block and the rest of the miners will continue to mine from that outpoint. – Brqoo Jan 23 at 14:03
  • 1
    You have not done your research. I read your post on r/btc, and it is pretty clear you have no idea how any of this works. Now, it's fair not to, but you should try to listen to those who do. Any commitment transaction that a channel partner can spend unilaterally is a smart contract that is formed like this: 1 output is the counterpartys money. He can spend those immediately. 1 output is what you claim is your money. This output has this contract: 1) After a timelock (minimum 144 blocks), you can spend them. 2) Your counterparty can spend them immediately with revocation key – Vegard Engen Jan 23 at 15:46
  • 1
    The revocation key, he will have, because that is part of the protocol. And when I say "the counterparty", I mean the counterpartys node - or someone who he have delegated to watch for him (populary called a watchtower). Now, this is part of the standard functionality of lightning network. Mobile nodes will typically enforce longer timelocks, though, I have seen two weeks. – Vegard Engen Jan 23 at 15:49
  • Having read the other comments here, I sense the grand misunderstanding here. It's really very simple: The penalty TX C spends from the output of the channel closure B. It can't be mined before a faulty channel closure has been mined. There is a time lock that says how many blocks the penalty transaction has to claim the attackers money. The minimum is 144 blocks, the maximum will usually be substantially higher for mobile wallets. The attacker will not be able to move those funds during this period. This is coded into smart bitcoin contracts and is part of what makes LN safe enough. – Vegard Engen Jan 25 at 11:39
-1

You can't as described here:

https://lists.linuxfoundation.org/pipermail/lightning-dev/2018-March/001080.html

Tl,dr: if one controlls more than 50% of hashrate and secretly mines the longest chain with old state one can steal the entire capacity of all channels one is connected to. Reward is much higher than regular Bitcoin double spent through reorg but execution is also more expensive

1
  • A %1 hashrate can mine an old state without others realizing it. Your approach could be true if the rest %99 reorgs (aka heals) the fraudulent block. However I don’t think this is practical since all these miners must consolidate and agree on what to mine. Miners are today not even in agreement what method to use to activate a soft fork. – Brqoo Jan 23 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.