2

Imagine the following graph in the Lightning Network:

  B   D
 / \ / \ 
A   C   E
 \ / \ /
  F   G

and node A wants to pay node E. A chooses to pay with multi-path-payment composed of the routes: A->B->C->D->E and A->F->C->G->E.

According to the BOLT4 in a basic MPP all parts use the same payment hash and payee releases the preimage once a set of HTLC arrive to destination ensuring that the total amount is fulfilled. The atomicity is then guaranteed by the economic incentive of the payee. However, I don't see how this mechanism prevents the steal of funds when the different routes of the same payment have a common routing node like in the example above. The issue lies in the fact that the same preimage releases the funds on all parts HTLCs.

My thought experiment is as follows:

  1. A constructs a 2 route MPP to pay E, these are A->B->C->D->E and A->F->C->G->E.

  2. E receives two HTLCs from D and G that add up to the payment amount, and then releases the preimage to D and G to settle these.

  3. C receives the preimage from D and settles the HTLC in the channel C--D.

  4. at this point C can show the preimage to B and F as proof of payment forwarding, but he doesn't need to settle the HTLC with G. He will wait until the timelock expires, thus effectively stealing funds from G.

I'm sure there must be something wrong with this reasoning. I cannot see how the cryptographic guarantees that apply to single route payments solve this situation as well. And my fear is that MPP can only be performed securely only for disjoint routes.

This 3 year old post describes another kind of multi-part-payment called AMP (atomic multi-path), in which each route uses a different payment hash and thus the problem described above doesn't apply, with the drawback that the preimage is known to the sender in advanced and thus cannot be used as a proof of payment.

Coming back to the question: What prevents C from stealing G's funds in a basic MPP payment?

1 Answer 1

2

The wrong assumption is that G needs to collaborate with C to get the refund for routing the payment.

After step 4 in the situation described in the question, G tries to settle the HTLC with C, claiming that he paid to E and showing the preimage as proof of payment. If C doesn't cooperate I guess G can unilaterally close the channel and claim the funds on-chain.

The latest valid transaction G has the following outputs:

+------------+
| funding tx |
+------------+
      |
      |        +-------------+
      \--------| commit tx G |
               +-------------+
                  |  |  |  
                  |  |  | C's main output
                  |  |  \------------------ to C
                  |  |
                  |  |
                  |  |                  ,-- to G (& delay)
                  |  | G's main output /
                  |  \----------------<
                  |                    \ 
                  |                     `-- to C (& revocation key)
                  |  
                  |                   
                  |                                                   ,-- to G (& delay)
                  |                           +-----------------+    /
                  |                        ,--| HTLC-success tx |---<
                  | HTLC received by G    /   +-----------------+    \
                  \----------------------<     (w/ payment preimage)  `-- to C (& revocation key)
                                          \
                                           `-- to C (after timeout)
                                           \
                                            `- to C (& revocation key)

Credits to the original ASCII graph

With the preimage and before the OP_CHECK_LOCK_TIME_VERIFY becomes valid, G can spend the HTLC output and claim the funds after the delay. C cannot do anything to prevent G from doing this. The HTLC in the latest transaction is actually a promise that C will reimburse G if he can provide the preimage, whether C cooperates or not.

1
  • 1
    It is important to stress that E must not release the preimage unless all parts for the full amount have arrived. In that case even if C had already claimed their HTLC with B and F(for example because C had learnt it from D) C will not be able to withheld funds from G as described in your answer. Luckily E is incentiviced to release the preimage only after enough incoming HTLCs were locked in Commented Jun 13, 2023 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.