Imagine the following graph in the Lightning Network:
B D
/ \ / \
A C E
\ / \ /
F G
and node A
wants to pay node E
.
A
chooses to pay with multi-path-payment composed of the routes: A->B->C->D->E
and A->F->C->G->E
.
According to the BOLT4 in a basic MPP all parts use the same payment hash and payee releases the preimage once a set of HTLC arrive to destination ensuring that the total amount is fulfilled. The atomicity is then guaranteed by the economic incentive of the payee. However, I don't see how this mechanism prevents the steal of funds when the different routes of the same payment have a common routing node like in the example above. The issue lies in the fact that the same preimage releases the funds on all parts HTLCs.
My thought experiment is as follows:
A
constructs a 2 route MPP to payE
, these areA->B->C->D->E
andA->F->C->G->E
.E
receives two HTLCs fromD
andG
that add up to the payment amount, and then releases the preimage toD
andG
to settle these.C
receives the preimage fromD
and settles the HTLC in the channelC--D
.at this point
C
can show the preimage toB
andF
as proof of payment forwarding, but he doesn't need to settle the HTLC withG
. He will wait until the timelock expires, thus effectively stealing funds fromG
.
I'm sure there must be something wrong with this reasoning. I cannot see how the cryptographic guarantees that apply to single route payments solve this situation as well. And my fear is that MPP can only be performed securely only for disjoint routes.
This 3 year old post describes another kind of multi-part-payment called AMP (atomic multi-path), in which each route uses a different payment hash and thus the problem described above doesn't apply, with the drawback that the preimage is known to the sender in advanced and thus cannot be used as a proof of payment.
Coming back to the question:
What prevents C
from stealing G
's funds in a basic MPP payment?