Imagine the following graph in the Lightning Network:
/ \ / \
A C E
\ / \ /
A wants to pay node
A chooses to pay with multi-path-payment composed of the routes:
According to the BOLT4 in a basic MPP all parts use the same payment hash and payee releases the preimage once a set of HTLC arrive to destination ensuring that the total amount is fulfilled. The atomicity is then guaranteed by the economic incentive of the payee. However, I don't see how this mechanism prevents the steal of funds when the different routes of the same payment have a common routing node like in the example above. The issue lies in the fact that the same preimage releases the funds on all parts HTLCs.
My thought experiment is as follows:
Aconstructs a 2 route MPP to pay
E, these are
Ereceives two HTLCs from
Gthat add up to the payment amount, and then releases the preimage to
Gto settle these.
Creceives the preimage from
Dand settles the HTLC in the channel
at this point
Ccan show the preimage to
Fas proof of payment forwarding, but he doesn't need to settle the HTLC with
G. He will wait until the timelock expires, thus effectively stealing funds from
I'm sure there must be something wrong with this reasoning. I cannot see how the cryptographic guarantees that apply to single route payments solve this situation as well. And my fear is that MPP can only be performed securely only for disjoint routes.
This 3 year old post describes another kind of multi-part-payment called AMP (atomic multi-path), in which each route uses a different payment hash and thus the problem described above doesn't apply, with the drawback that the preimage is known to the sender in advanced and thus cannot be used as a proof of payment.
Coming back to the question:
C from stealing
G's funds in a basic MPP payment?